joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005640
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140045048]
xor rax, rsp
mov qword [rbp - 8], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rbp - 0x30], rcx
xor r14d, r14d
mov qword [rbp - 0x28], r14
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], 7
mov word [rbp - 0x28], r14w
xor r8d, r8d
mov edx, 0x104
lea rcx, [rbp - 0x28]
call fcn.140009020
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rdx, qword [rbp - 0x28]
mov rcx, rdi
cmp qword [rdi + 0x18], 8
jb 0x1400056b1
mov rcx, qword [rdi]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test eax, eax
jne 0x14000571f
mov qword [rbx], r14
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x140005820
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005715
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005844
call fcn.14000e668
jmp 0x140005820
cmp esi, 0x104
jbe 0x1400057dd
mov rdx, rsi
mov rax, qword [rbp - 0x18]
cmp rsi, rax
ja 0x140005750
lea rax, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rax, qword [rbp - 0x28]
mov qword [rbp - 0x18], rdx
mov word [rax + rsi*2], r14w
jmp 0x14000575f
xor r8d, r8d
sub rdx, rax
lea rcx, [rbp - 0x28]
call fcn.140009020
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rdx, qword [rbp - 0x28]
cmp qword [rdi + 0x18], 8
jb 0x140005777
mov rdi, qword [rdi]
mov r8d, 0x104
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x1400057dd
mov qword [rbx], r14
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x140005820
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005715
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005844
jmp 0x140005715
mov rdx, rsi
mov rax, qword [rbp - 0x18]
cmp rsi, rax
ja 0x140005802
lea rax, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rax, qword [rbp - 0x28]
mov qword [rbp - 0x18], rdx
mov word [rax + rsi*2], r14w
jmp 0x140005811
xor r8d, r8d
sub rdx, rax
lea rcx, [rbp - 0x28]
call fcn.140009020
movups xmm0, xmmword [rbp - 0x28]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp - 0x18]
movups xmmword [rbx + 0x10], xmm1
mov rax, rbx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14000e780
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.1400149ec
int3
Function at 0x14000dcd8
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x140045048]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov edi, 0xffff
xor r14d, r14d
movzx esi, dx
mov rbx, rcx
cmp di, dx
jne 0x14000dd1c
movzx eax, r14w
jmp 0x14000de52
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x14000dd58
mov rax, qword [rcx + 0x58]
movsxd r9, dword [rax]
lea rdx, [r8 + r9*2]
cmp r8, rdx
jae 0x14000dd58
lea ecx, [r9 - 1]
mov dword [rax], ecx
movzx eax, si
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], si
jmp 0x14000de52
cmp qword [rcx + 0x80], r14
je 0x14000de4f
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x14000dd96
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14000ddbf
movzx ecx, si
mov rdx, qword [rbx + 0x80]
call fcn.14001846c
cmp ax, di
je 0x14000de4f
movzx edi, si
jmp 0x14000de4f
lea r8, [rbp + 0xf]
mov word [rbp + 7], si
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rbp + 9]
lea r8, [rbp + 0x3f]
mov qword [rsp + 0x30], r8
lea r8, [rbp + 0x1f]
mov rax, qword [rax + 0x38]
mov qword [rsp + 0x28], r8
lea r8, [rbp + 0x17]
mov qword [rsp + 0x20], r8
lea r8, [rbp + 7]
call qword [0x140030348]
test eax, eax
je 0x14000de14
sub eax, 1
je 0x14000de14
cmp eax, 2
jne 0x14000de4f
movzx ecx, word [rbp + 7]
jmp 0x14000dda2
mov r14, qword [rbp + 0xf]
lea rax, [rbp + 0x1f]
sub r14, rax
je 0x14000de3e
mov r9, qword [rbx + 0x80]
lea rcx, [rbp + 0x1f]
mov r8, r14
mov edx, 1
call fcn.140019234
cmp r14, rax
jne 0x14000de4f
lea rax, [rbp + 7]
mov byte [rbx + 0x72], 1
cmp qword [rbp + 0x17], rax
movzx eax, si
jne 0x14000de52
movzx eax, di
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.14000e780
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x14001d2e8
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14001d10c
Function at 0x140023810
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x140023536
call fcn.140014c30
mov dword [rax], 0x16
call fcn.1400149cc
jmp 0x140023681
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140023681
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x140023681
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x140023565
lock or dword [rcx + 0x14], 0x10
jmp 0x140023681
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x140023579
call fcn.140023bb0
mov esi, dword [rbx + 0x10]
cmp esi, 1
jne 0x140023589
mov rax, qword [rbx]
mov bpl, byte [rax]
jmp 0x14002358c
xor bpl, bpl
mov rdi, qword [rbx + 8]
mov rcx, rbx
mov qword [rbx], rdi
call fcn.1400158f0
mov r8d, dword [rbx + 0x20]
mov ecx, eax
mov rdx, rdi
call fcn.14002b9b0
mov dword [rbx + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x14002366f
mov eax, dword [rbx + 0x14]
test al, 6
jne 0x14002361d
mov rcx, rbx
call fcn.1400158f0
cmp eax, 0xffffffff
je 0x140023608
mov rcx, rbx
call fcn.1400158f0
cmp eax, 0xfffffffe
je 0x140023608
mov rcx, rbx
call fcn.1400158f0
movsxd rdi, eax
lea r14, [0x140047860]
mov rcx, rbx
sar rdi, 6
call fcn.1400158f0
mov rcx, qword [r14 + rdi*8]
and eax, 0x3f
shl rax, 6
lea rdx, [rax + rcx]
jmp 0x14002360f
lea rdx, [0x140045400]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14002361d
lock or dword [rbx + 0x14], 0x20
cmp dword [rbx + 0x20], 0x200
jne 0x140023641
mov eax, dword [rbx + 0x14]
shr eax, 6
test al, 1
je 0x140023641
mov eax, dword [rbx + 0x14]
shr eax, 8
test al, 1
jne 0x140023641
mov dword [rbx + 0x20], 0x1000
mov rax, qword [rbx]
cmp esi, 1
jne 0x14002365f
movzx ecx, byte [rax]
dec dword [rbx + 0x10]
shl cx, 8
movzx eax, bpl
or cx, ax
inc qword [rbx]
jmp 0x14002366a
movzx ecx, word [rax]
add dword [rbx + 0x10], 0xfffffffe
add qword [rbx], 2
movzx eax, cx
jmp 0x140023686
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rbx + 0x14], eax
and dword [rbx + 0x10], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
jmp 0x140023500
Function at 0x1400b4681
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x14012ca70
sub rsp, 0x18
mov rax, qword [0x1402850c0]
xor rax, rsp
mov qword [rsp + 8], rax
mov r10, r9
mov r9d, edx
mov r11, rcx
test edx, edx
jne 0x14012caa4
xor eax, eax
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.1400b685f
add rsp, 0x18
ret
mov rcx, qword [r8]
mov qword [rsp], rcx
movzx eax, cl
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [rsp + 1]
xor edx, eax
movzx eax, byte [rsp + 2]
imul r8d, edx, 0x1000193
xor r8d, eax
movzx eax, byte [rsp + 3]
imul edx, r8d, 0x1000193
xor edx, eax
movzx eax, byte [rsp + 4]
imul r8d, edx, 0x1000193
xor r8d, eax
movzx eax, byte [rsp + 5]
imul edx, r8d, 0x1000193
xor edx, eax
movzx eax, byte [rsp + 6]
imul r8d, edx, 0x1000193
xor r8d, eax
movzx eax, byte [rsp + 7]
imul edx, r8d, 0x1000193
xor edx, eax
imul r8d, edx, 0x1000193
xor edx, edx
mov eax, r8d
div r9d
mov rax, qword [r11 + rdx*8]
lea rdx, [r11 + rdx*8]
test rax, rax
je 0x14012cb44
cmp qword [rax + 8], rcx
je 0x14012cb44
mov rdx, rax
mov rax, qword [rax]
test rax, rax
jne 0x14012cb33
test r10, r10
je 0x14012cb4c
mov dword [r10], r8d
mov rax, rdx
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.1400b685f
add rsp, 0x18
ret

Function at 0x1400b48a2
Capabilities:
Query environment variable

Disassembly:
jmp 0x140129fc0
push rbx
sub rsp, 0x20
mov rbx, r8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ecx, eax
test eax, eax
jne 0x140129fde
or eax, 0xffffffff
add rsp, 0x20
pop rbx
ret
xor edx, edx
cmp rcx, rbx
cmovb ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret

Function at 0x1400b48e3
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x140123d20
sub rsp, 0x18
mov rax, qword [0x1402850c0]
xor rax, rsp
mov qword [rsp + 8], rax
mov r10, r9
mov r9d, edx
mov r11, rcx
test edx, edx
jne 0x140123d54
xor eax, eax
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.1400b685f
add rsp, 0x18
ret
mov rcx, qword [r8]
mov qword [rsp], rcx
movzx eax, cl
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [rsp + 1]
xor edx, eax
movzx eax, byte [rsp + 2]
imul r8d, edx, 0x1000193
xor r8d, eax
movzx eax, byte [rsp + 3]
imul edx, r8d, 0x1000193
xor edx, eax
movzx eax, byte [rsp + 4]
imul r8d, edx, 0x1000193
xor r8d, eax
movzx eax, byte [rsp + 5]
imul edx, r8d, 0x1000193
xor edx, eax
movzx eax, byte [rsp + 6]
imul r8d, edx, 0x1000193
xor r8d, eax
movzx eax, byte [rsp + 7]
imul edx, r8d, 0x1000193
xor edx, eax
imul r8d, edx, 0x1000193
xor edx, edx
mov eax, r8d
div r9d
mov rax, qword [r11 + rdx*8]
lea rdx, [r11 + rdx*8]
test rax, rax
je 0x140123df4
cmp qword [rax + 8], rcx
je 0x140123df4
mov rdx, rax
mov rax, qword [rax]
test rax, rax
jne 0x140123de3
test r10, r10
je 0x140123dfc
mov dword [r10], r8d
mov rax, rdx
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.1400b685f
add rsp, 0x18
ret
Function at 0x1400b60cb
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x140124140
sub rsp, 0x18
mov rax, qword [0x1402850c0]
xor rax, rsp
mov qword [rsp + 8], rax
mov r10, r9
mov r9d, edx
mov r11, rcx
test edx, edx
jne 0x140124174
xor eax, eax
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.1400b685f
add rsp, 0x18
ret
mov rcx, qword [r8]
mov qword [rsp], rcx
movzx eax, cl
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [rsp + 1]
xor edx, eax
movzx eax, byte [rsp + 2]
imul r8d, edx, 0x1000193
xor r8d, eax
movzx eax, byte [rsp + 3]
imul edx, r8d, 0x1000193
xor edx, eax
movzx eax, byte [rsp + 4]
imul r8d, edx, 0x1000193
xor r8d, eax
movzx eax, byte [rsp + 5]
imul edx, r8d, 0x1000193
xor edx, eax
movzx eax, byte [rsp + 6]
imul r8d, edx, 0x1000193
xor r8d, eax
movzx eax, byte [rsp + 7]
imul edx, r8d, 0x1000193
xor edx, eax
imul r8d, edx, 0x1000193
xor edx, edx
mov eax, r8d
div r9d
mov rax, qword [r11 + rdx*8]
lea rdx, [r11 + rdx*8]
test rax, rax
je 0x140124214
cmp qword [rax + 8], rcx
je 0x140124214
mov rdx, rax
mov rax, qword [rax]
test rax, rax
jne 0x140124203
test r10, r10
je 0x14012421c
mov dword [r10], r8d
mov rax, rdx
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.1400b685f
add rsp, 0x18
ret
Function at 0x1400b6517
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1401b6110
mov rax, rcx
neg rcx
test rax, 7
je 0x1401b612d
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x1401b6188
test al, 7
jne 0x1401b6120
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x1401b6141
mov rdx, qword [rax - 8]
test dl, dl
je 0x1401b61b2
test dh, dh
je 0x1401b61ac
shr rdx, 0x10
test dl, dl
je 0x1401b61a6
test dh, dh
je 0x1401b61a0
shr rdx, 0x10
test dl, dl
je 0x1401b619a
test dh, dh
je 0x1401b6194
shr edx, 0x10
test dl, dl
je 0x1401b618e
test dh, dh
jne 0x1401b6141
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret

Function at 0x1400b67ec
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x140123900
sub rsp, 0x18
mov rax, qword [0x1402850c0]
xor rax, rsp
mov qword [rsp + 8], rax
mov r10, r9
mov r9d, edx
mov r11, rcx
test edx, edx
jne 0x140123934
xor eax, eax
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.1400b685f
add rsp, 0x18
ret
mov rcx, qword [r8]
mov qword [rsp], rcx
movzx eax, cl
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [rsp + 1]
xor edx, eax
movzx eax, byte [rsp + 2]
imul r8d, edx, 0x1000193
xor r8d, eax
movzx eax, byte [rsp + 3]
imul edx, r8d, 0x1000193
xor edx, eax
movzx eax, byte [rsp + 4]
imul r8d, edx, 0x1000193
xor r8d, eax
movzx eax, byte [rsp + 5]
imul edx, r8d, 0x1000193
xor edx, eax
movzx eax, byte [rsp + 6]
imul r8d, edx, 0x1000193
xor r8d, eax
movzx eax, byte [rsp + 7]
imul edx, r8d, 0x1000193
xor edx, eax
imul r8d, edx, 0x1000193
xor edx, edx
mov eax, r8d
div r9d
mov rax, qword [r11 + rdx*8]
lea rdx, [r11 + rdx*8]
test rax, rax
je 0x1401239d4
cmp qword [rax + 8], rcx
je 0x1401239d4
mov rdx, rax
mov rax, qword [rax]
test rax, rax
jne 0x1401239c3
test r10, r10
je 0x1401239dc
mov dword [r10], r8d
mov rax, rdx
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.1400b685f
add rsp, 0x18
ret
Function at 0x1400b6aa3
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x1401237a0
sub rsp, 0x18
mov rax, qword [0x1402850c0]
xor rax, rsp
mov qword [rsp + 8], rax
mov r10, r9
mov r9d, edx
mov r11, rcx
test edx, edx
jne 0x1401237d4
xor eax, eax
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.1400b685f
add rsp, 0x18
ret
mov rcx, qword [r8]
mov qword [rsp], rcx
movzx eax, cl
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [rsp + 1]
xor edx, eax
movzx eax, byte [rsp + 2]
imul r8d, edx, 0x1000193
xor r8d, eax
movzx eax, byte [rsp + 3]
imul edx, r8d, 0x1000193
xor edx, eax
movzx eax, byte [rsp + 4]
imul r8d, edx, 0x1000193
xor r8d, eax
movzx eax, byte [rsp + 5]
imul edx, r8d, 0x1000193
xor edx, eax
movzx eax, byte [rsp + 6]
imul r8d, edx, 0x1000193
xor r8d, eax
movzx eax, byte [rsp + 7]
imul edx, r8d, 0x1000193
xor edx, eax
imul r8d, edx, 0x1000193
xor edx, edx
mov eax, r8d
div r9d
mov rax, qword [r11 + rdx*8]
lea rdx, [r11 + rdx*8]
test rax, rax
je 0x140123874
cmp qword [rax + 8], rcx
je 0x140123874
mov rdx, rax
mov rax, qword [rax]
test rax, rax
jne 0x140123863
test r10, r10
je 0x14012387c
mov dword [r10], r8d
mov rax, rdx
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.1400b685f
add rsp, 0x18
ret

Function at 0x1400b6ac1
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x1401648a0
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.140164220
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1401648df
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1402a3020]
jmp 0x1401648e9
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret
Function at 0x1400b6d37
Capabilities:
Query environment variable

Disassembly:
jmp 0x140200380
sub rsp, 0xb8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1402001b0
lea rcx, [rsp + 0x40]
call fcn.140200330
movzx eax, al
test eax, eax
jne 0x1402003c8
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call fcn.1402001e0
mov rax, qword [rsp + 0x70]
jmp 0x140200599
lea rcx, [rsp + 0x40]
call fcn.140200300
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.1402002a0
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x40]
call fcn.140200300
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.1400b7e8f
cdqe
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x14020046e
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x40]
call fcn.1402001e0
mov rax, qword [rsp + 0x80]
jmp 0x140200599
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, qword [rsp + 0x58]
call fcn.1400b6931
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.1400b66de
lea rcx, [rsp + 0x48]
call fcn.1400b617a
movzx eax, al
test eax, eax
jne 0x1402004d5
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x48]
call fcn.1400b4c94
lea rcx, [rsp + 0x40]
call fcn.1402001e0
mov rax, qword [rsp + 0x88]
jmp 0x140200599
lea rcx, [rsp + 0x48]
call fcn.1400b721e
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x40]
call fcn.140200300
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call fcn.1400b7e8f
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x14020056b
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x48]
call fcn.1400b4c94
lea rcx, [rsp + 0x40]
call fcn.1402001e0
mov rax, qword [rsp + 0xa0]
jmp 0x140200599
lea rcx, [rsp + 0x48]
call fcn.1400b66a2
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x48]
call fcn.1400b4c94
lea rcx, [rsp + 0x40]
call fcn.1402001e0
mov rax, qword [rsp + 0xa8]
add rsp, 0xb8
ret

Function at 0x1400b6d46
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x1401647d0
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.1401641a0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140164811
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1402a3020]
jmp 0x140164817
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x48
ret
Function at 0x1400b6dff
Capabilities:
Get geographical location

Disassembly:
jmp 0x1401e0880
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
call fcn.1401df7b0
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1401e08e7
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
movabs r10, 0xe375262d7cd44270
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
call qword [0x1402a3030]
jmp 0x1401e0909
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.1400b60e4
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x58
ret

Function at 0x1400b6e18
Capabilities:
Terminate process

Disassembly:
jmp 0x140140f80
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400b71a6
Capabilities:
Print debug messages

Disassembly:
jmp 0x140216050
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x30]
mov rax, qword [0x1402850c0]
xor rax, rbp
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x30], 0
jne 0x140216076
jmp 0x1402160f3
mov rcx, qword [rbp + 0x30]
call fcn.1400b6517
inc rax
mov qword [rbp], rax
cmp qword [rbp], 0
jne 0x14021608f
jmp 0x1402160f3
mov rax, qword [rbp]
shl rax, 1
mov rcx, rax
add rcx, 0xf
cmp rcx, rax
ja 0x1402160ac
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400b4eb5
sub rsp, rax
lea rax, [rsp + 0x30]
mov qword [rbp + 8], rax
mov rax, qword [rbp]
dec rax
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x30]
mov r8, qword [rbp]
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x10]
call fcn.1400b550e
test eax, eax
jne 0x1402160f3
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
call fcn.1400b685f
lea rsp, [rbp + 0x20]
pop rbp
ret

Function at 0x1400b793a
Capabilities:
Parse pe header

Disassembly:
jmp 0x140141ab0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140141ad0
xor al, al
jmp 0x140141b51
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140141ae3
xor al, al
jmp 0x140141b51
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140141b0d
xor al, al
jmp 0x140141b51
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140141b21
xor al, al
jmp 0x140141b51
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140141b33
xor al, al
jmp 0x140141b51
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140141b4f
xor al, al
jmp 0x140141b51
mov al, 1
add rsp, 0x38
ret
Function at 0x1400b8169
Capabilities:
Terminate process

Disassembly:
jmp 0x140165c70
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x140165c9e
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
mov ecx, 2
call fcn.1400b8da8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000417
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400b81f5
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x140123a60
sub rsp, 0x18
mov rax, qword [0x1402850c0]
xor rax, rsp
mov qword [rsp + 8], rax
mov r10, r9
mov r9d, edx
mov r11, rcx
test edx, edx
jne 0x140123a94
xor eax, eax
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.1400b685f
add rsp, 0x18
ret
mov rcx, qword [r8]
mov qword [rsp], rcx
movzx eax, cl
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [rsp + 1]
xor edx, eax
movzx eax, byte [rsp + 2]
imul r8d, edx, 0x1000193
xor r8d, eax
movzx eax, byte [rsp + 3]
imul edx, r8d, 0x1000193
xor edx, eax
movzx eax, byte [rsp + 4]
imul r8d, edx, 0x1000193
xor r8d, eax
movzx eax, byte [rsp + 5]
imul edx, r8d, 0x1000193
xor edx, eax
movzx eax, byte [rsp + 6]
imul r8d, edx, 0x1000193
xor r8d, eax
movzx eax, byte [rsp + 7]
imul edx, r8d, 0x1000193
xor edx, eax
imul r8d, edx, 0x1000193
xor edx, edx
mov eax, r8d
div r9d
mov rax, qword [r11 + rdx*8]
lea rdx, [r11 + rdx*8]
test rax, rax
je 0x140123b34
cmp qword [rax + 8], rcx
je 0x140123b34
mov rdx, rax
mov rax, qword [rax]
test rax, rax
jne 0x140123b23
test r10, r10
je 0x140123b3c
mov dword [r10], r8d
mov rax, rdx
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.1400b685f
add rsp, 0x18
ret

Function at 0x1400b8768
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x1401234e0
sub rsp, 0x18
mov rax, qword [0x1402850c0]
xor rax, rsp
mov qword [rsp + 8], rax
mov r10, r9
mov r9d, edx
mov r11, rcx
test edx, edx
jne 0x140123514
xor eax, eax
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.1400b685f
add rsp, 0x18
ret
mov rcx, qword [r8]
mov qword [rsp], rcx
movzx eax, cl
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [rsp + 1]
xor edx, eax
movzx eax, byte [rsp + 2]
imul r8d, edx, 0x1000193
xor r8d, eax
movzx eax, byte [rsp + 3]
imul edx, r8d, 0x1000193
xor edx, eax
movzx eax, byte [rsp + 4]
imul r8d, edx, 0x1000193
xor r8d, eax
movzx eax, byte [rsp + 5]
imul edx, r8d, 0x1000193
xor edx, eax
movzx eax, byte [rsp + 6]
imul r8d, edx, 0x1000193
xor r8d, eax
movzx eax, byte [rsp + 7]
imul edx, r8d, 0x1000193
xor edx, eax
imul r8d, edx, 0x1000193
xor edx, edx
mov eax, r8d
div r9d
mov rax, qword [r11 + rdx*8]
lea rdx, [r11 + rdx*8]
test rax, rax
je 0x1401235b4
cmp qword [rax + 8], rcx
je 0x1401235b4
mov rdx, rax
mov rax, qword [rax]
test rax, rax
jne 0x1401235a3
test r10, r10
je 0x1401235bc
mov dword [r10], r8d
mov rax, rdx
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.1400b685f
add rsp, 0x18
ret