joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400606b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [rcx]
mov rbx, rdx
mov eax, ecx
not eax
test ax, 0x101
jne 0x1400606d0
add dword [rdx + 8], 0xc
mov r9b, byte [rsi]
test r9b, r9b
jns 0x1400606fb
xor edx, edx
test byte [rsi + 1], 2
je 0x1400606ed
mov eax, dword [rbx + 0x14]
mov r8d, 0x64
cdq
idiv r8d
mov eax, dword [rsi + 4]
sub eax, 0x13
imul eax, eax, 0x64
add eax, edx
mov dword [rbx + 0x14], eax
and cx, 0x402
cmp cx, 0x400
jne 0x1400607a6
mov eax, r9d
not eax
test al, 0x18
je 0x14006078a
test r9d, 4
je 0x14006078a
mov eax, dword [rbx + 0x14]
lea r11, [0x14007da60]
xor r10d, r10d
lea ecx, [rax + 0x76c]
call method.std._anonymous_namespace_::is_leap_int_
mov ecx, dword [rbx + 0x1c]
mov r8, rax
neg r8
and r8d, 0x1a
add r8, r11
movzx edi, word [r8 + r10*2]
mov rdx, r10
lea r10, [r10 + 1]
cmp edi, ecx
jle 0x140060745
test r9d, 8
jne 0x140060766
lea r8d, [rdx - 1]
mov dword [rbx + 0x10], r8d
and r9d, 0x10
jne 0x140060787
movzx eax, al
dec edx
imul rax, rax, 0xd
movsxd rdx, edx
add rax, rdx
movzx eax, word [r11 + rax*2]
sub ecx, eax
inc ecx
mov dword [rbx + 0xc], ecx
or byte [rsi], 0x18
mov edx, dword [rbx + 0x10]
test byte [rsi], 8
jne 0x140060797
cmp edx, 0xb
ja 0x1400607a6
mov ecx, dword [rbx + 0x14]
mov r8d, dword [rbx + 0xc]
call method.std._anonymous_namespace_::day_of_the_week_int__int__int_
mov dword [rbx + 0x18], eax
mov eax, dword [rsi]
mov dil, byte [rsi]
and ax, 0x404
cmp ax, 0x400
jne 0x1400607f4
movsxd r9, dword [rbx + 0x10]
test edi, 8
jne 0x1400607c7
cmp r9d, 0xb
ja 0x1400607f4
mov eax, dword [rbx + 0x14]
lea ecx, [rax + 0x76c]
call method.std._anonymous_namespace_::is_leap_int_
lea rcx, [0x14007da60]
mov edx, dword [rbx + 0xc]
movzx eax, al
imul rax, rax, 0xd
add rax, r9
movzx eax, word [rcx + rax*2]
lea eax, [rdx + rax - 1]
mov dword [rbx + 0x1c], eax
test edi, 0x60
je 0x1400608d7
test edi, 2
je 0x1400608d7
mov ebp, dword [rbx + 0x14]
test edi, 4
jne 0x140060869
mov r12d, edi
mov r8d, 1
xor edx, edx
mov ecx, ebp
call method.std._anonymous_namespace_::day_of_the_week_int__int__int_
shr r12b, 5
mov r8d, 7
xor r12d, 1
and r12d, 1
sub eax, r12d
mov edx, eax
mov eax, r8d
sub eax, edx
cdq
idiv r8d
mov al, byte [rsi + 2]
and eax, 0x3f
dec eax
imul eax, eax, 7
lea ecx, [rdx + rax]
mov eax, dword [rbx + 0x18]
sub eax, r12d
add eax, 7
cdq
idiv r8d
add ecx, edx
mov dword [rbx + 0x1c], ecx
mov eax, edi
not eax
test al, 0x18
je 0x1400608d7
lea ecx, [rbp + 0x76c]
lea r10, [0x14007da60]
xor r9d, r9d
call method.std._anonymous_namespace_::is_leap_int_
mov ecx, dword [rbx + 0x1c]
mov r8, rax
neg r8
and r8d, 0x1a
add r8, r10
movzx r11d, word [r8 + r9*2]
mov rdx, r9
lea r9, [r9 + 1]
cmp r11d, ecx
jle 0x140060896
test edi, 8
jne 0x1400608b7
lea r8d, [rdx - 1]
mov dword [rbx + 0x10], r8d
and edi, 0x10
jne 0x1400608d7
movzx eax, al
dec edx
imul rax, rax, 0xd
movsxd rdx, edx
add rax, rdx
movzx eax, word [r10 + rax*2]
sub ecx, eax
inc ecx
mov dword [rbx + 0xc], ecx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x140074230
Capabilities:
Query environment variable

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
xor edx, edx
lea rcx, [0x140075780]
call sym.pthread_mutex_init
xor r8d, r8d
lea rbp, [rsp + 0x40]
lea rcx, str.GLIBCXX_TUNABLES
mov qword [0x140075788], r8
mov qword [0x140075790], r8
mov qword [0x140075798], r8
call sym.getenv
xor r9d, r9d
mov dword [rsp + 0x78], 0x100
mov rbx, rax
lea rax, str.glibcxx.eh_pool
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x48], rax
lea rax, str.obj_size
mov qword [rsp + 0x58], rax
lea rax, str.obj_count
mov qword [rsp + 0x40], 0xf
mov qword [rsp + 0x50], 8
mov qword [rsp + 0x68], 9
mov qword [rsp + 0x70], rax
test rbx, rbx
je 0x140074377
cmp byte [rbx], 0x3a
jne 0x1400742d5
inc rbx
xor edx, edx
mov r9, rbx
mov r8d, 0xf
mov rcx, rbp
mov qword [rsp + 0x20], 0xf
call method.std::basic_string_view_char__std::char_traits_char___.compare_unsigned_long_long__unsigned_long_long__char_const__unsigned_long_long__const
test eax, eax
jne 0x140074362
cmp byte [rbx + 0xf], 0x2e
jne 0x140074362
add rbx, 0x10
lea rsi, [rsp + 0x50]
mov rdi, qword [rsi]
xor edx, edx
mov r9, rbx
mov rcx, rsi
mov qword [rsp + 0x20], rdi
mov r8, rdi
call method.std::basic_string_view_char__std::char_traits_char___.compare_unsigned_long_long__unsigned_long_long__char_const__unsigned_long_long__const
test eax, eax
jne 0x140074326
cmp byte [rbx + rdi], 0x3d
je 0x140074339
add rsi, 0x18
lea rax, [rsp + 0x80]
cmp rsi, rax
je 0x140074362
jmp 0x140074304
lea rdx, [rsp + 0x38]
lea rcx, [rbx + rdi + 1]
xor r8d, r8d
call sym.strtoul
mov rbx, qword [rsp + 0x38]
mov dl, byte [rbx]
cmp dl, 0x3a
je 0x14007435b
test dl, dl
jne 0x140074362
test eax, eax
js 0x140074362
mov dword [rsi + 0x10], eax
mov rcx, rbx
mov edx, 0x3a
call sym.strchr
mov rbx, rax
jmp 0x1400742c4
mov eax, dword [rsp + 0x78]
mov edx, 0x1000
cmp eax, edx
cmovle edx, eax
mov eax, dword [rsp + 0x60]
test eax, eax
jne 0x140074392
mov eax, 6
movsxd rbx, eax
movsxd rax, edx
add rbx, 0x26
imul rbx, rax
shl rbx, 3
mov qword [0x140075798], rbx
je 0x1400743dc
mov rcx, rbx
call sym.malloc
mov qword [0x140075790], rax
test rax, rax
jne 0x1400743cc
xor ecx, ecx
mov qword [0x140075798], rcx
jmp 0x1400743dc
xor edx, edx
mov qword [0x140075788], rax
mov qword [rax], rbx
mov qword [rax + 8], rdx
lea rcx, [sym.__tcf_0_2]
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.atexit
Function at 0x1400747e0
Capabilities:
Check mutex on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x90
xor esi, esi
call sym.__main
call sym.__p__acmdln
mov rbx, qword [rax]
test rbx, rbx
jne 0x14007481b
lea rbx, [0x14007c100]
jmp 0x14007484d
cmp cl, 0x22
jne 0x14007480f
xor esi, 1
call sym._ismbblead
test eax, eax
jne 0x140074825
inc rbx
movsx ecx, byte [rbx]
cmp cl, 0x20
jg 0x140074807
jmp 0x140074830
cmp byte [rbx + 1], 0
je 0x140074818
inc rbx
jmp 0x140074818
test cl, cl
je 0x140074847
and esi, 1
je 0x140074847
mov esi, 1
jmp 0x14007480f
cmp al, 0x20
jg 0x14007484d
inc rbx
mov al, byte [rbx]
test al, al
jne 0x140074840
lea rdx, [rsp + 0x28]
xor eax, eax
mov ecx, 0x1a
mov rdi, rdx
rep stosd dword [rdi], eax
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov r9d, 0xa
test byte [rsp + 0x64], 1
je 0x14007487a
movzx r9d, word [rsp + 0x68]
mov rcx, qword [0x14007d700]
mov r8, rbx
xor edx, edx
add rsp, 0x90
pop rbx
pop rsi
pop rdi
jmp sym.WinMain
Function at 0x14112bcf0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x14112bcfa
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x14112bd23
pop rbp
sub rbp, 0x33
sub rbp, 0x112bcf0
sub rsp, 0x20
jmp 0x14112bd42
mov rax, 0x112bcf0
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xffffffffadd010ea
xor byte [rax], dl
inc rax
dec rcx
jne 0x14112bd61
jmp 0x14112bd78
movabs byte [0xeaeaead663610363], al
movabs byte [0xeba2eaeaebe22b6b], al
add esp, dword [rdx - 0x151dd5d3]
invalid
Function at 0x1400d7fb9
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x140154b00
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov qword [rsp], 0
jmp 0x140154b28
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
mov rax, qword [rsp + 0x30]
cmp qword [rsp], rax
jae 0x140154b72
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x20]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
movabs rax, 0x100000001b3
mov rcx, qword [rsp + 0x20]
imul rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x140154b1d
mov rax, qword [rsp + 0x20]
add rsp, 0x18
ret

Function at 0x1400d845f
Capabilities:
Terminate process

Disassembly:
jmp 0x1400f96a0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1411a7125]
call fcn.1400dc9ec
nop
cmp qword [rbp + 0xe8], 0
je 0x1400f96f2
cmp qword [rbp + 0xe8], 0xffffffffffffffff
je 0x1400f96f2
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0xe8]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov rax, qword [rbp + 0xe0]
cmp qword [rax + 8], 0
je 0x1400f9712
mov rax, qword [rbp + 0xe0]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rax, qword [rbp + 0xe0]
cmp qword [rax], 0
je 0x1400f9746
mov edx, 0xffffffff
mov rax, qword [rbp + 0xe0]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
mov rax, qword [rbp + 0xe0]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret
Function at 0x1400d97f1
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140211700
mov rax, rcx
neg rcx
test rax, 7
je 0x14021171d
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x140211778
test al, 7
jne 0x140211710
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x140211731
mov rdx, qword [rax - 8]
test dl, dl
je 0x1402117a2
test dh, dh
je 0x14021179c
shr rdx, 0x10
test dl, dl
je 0x140211796
test dh, dh
je 0x140211790
shr rdx, 0x10
test dl, dl
je 0x14021178a
test dh, dh
je 0x140211784
shr edx, 0x10
test dl, dl
je 0x14021177e
test dh, dh
jne 0x140211731
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret

Function at 0x1400d9837
Capabilities:
Query environment variable

Disassembly:
jmp 0x1402655b0
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.140265130
lea rcx, [rsp + 0x20]
call fcn.140265180
movzx eax, al
test eax, eax
jne 0x1402655f5
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x20]
call fcn.140265160
mov rax, qword [rsp + 0x40]
jmp 0x1402656ef
lea rcx, [rsp + 0x20]
call fcn.140265280
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.140265220
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r9d, 0x40
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, rax
call fcn.1400d9bed
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.1400d9116
lea rcx, [rsp + 0x28]
call fcn.1400da151
movzx eax, al
test eax, eax
jne 0x14026568f
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x28]
call fcn.1400db7d6
lea rcx, [rsp + 0x20]
call fcn.140265160
mov rax, qword [rsp + 0x50]
jmp 0x1402656ef
lea rcx, [rsp + 0x20]
call fcn.140265280
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call fcn.1400dc8e3
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r8, rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.1400d9b25
lea rcx, [rsp + 0x28]
call fcn.1400dd338
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x28]
call fcn.1400db7d6
lea rcx, [rsp + 0x20]
call fcn.140265160
mov rax, qword [rsp + 0x68]
add rsp, 0x78
ret
Function at 0x1400d9db9
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x1401a7bf0
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.1401a7570
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1401a7c2f
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1411a8020]
jmp 0x1401a7c39
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret
Function at 0x1400da061
Capabilities:
Query environment variable

Disassembly:
jmp 0x140265300
sub rsp, 0xb8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140265130
lea rcx, [rsp + 0x40]
call fcn.1402652b0
movzx eax, al
test eax, eax
jne 0x140265348
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call fcn.140265160
mov rax, qword [rsp + 0x70]
jmp 0x140265519
lea rcx, [rsp + 0x40]
call fcn.140265280
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.140265220
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x40]
call fcn.140265280
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.1400db3e4
cdqe
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x1402653ee
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x40]
call fcn.140265160
mov rax, qword [rsp + 0x80]
jmp 0x140265519
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, qword [rsp + 0x58]
call fcn.1400d9bed
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.1400d99a4
lea rcx, [rsp + 0x48]
call fcn.1400d9369
movzx eax, al
test eax, eax
jne 0x140265455
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x48]
call fcn.1400d7e1a
lea rcx, [rsp + 0x40]
call fcn.140265160
mov rax, qword [rsp + 0x88]
jmp 0x140265519
lea rcx, [rsp + 0x48]
call fcn.1400da5e3
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x40]
call fcn.140265280
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call fcn.1400db3e4
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x1402654eb
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x48]
call fcn.1400d7e1a
lea rcx, [rsp + 0x40]
call fcn.140265160
mov rax, qword [rsp + 0xa0]
jmp 0x140265519
lea rcx, [rsp + 0x48]
call fcn.1400d9959
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x48]
call fcn.1400d7e1a
lea rcx, [rsp + 0x40]
call fcn.140265160
mov rax, qword [rsp + 0xa8]
add rsp, 0xb8
ret

Function at 0x1400da07f
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x1401a7b20
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.1401a74f0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1401a7b61
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1411a8020]
jmp 0x1401a7b67
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x48
ret
Function at 0x1400da156
Capabilities:
Get geographical location

Disassembly:
jmp 0x1402459e0
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
call fcn.140244910
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x140245a47
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
movabs r10, 0xe375262d7cd44270
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
call qword [0x1411a8030]
jmp 0x140245a69
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.1400d92c4
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x58
ret

Function at 0x1400da16a
Capabilities:
Terminate process

Disassembly:
jmp 0x1401859c0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret
Function at 0x1400da4da
Capabilities:
Create directory

Disassembly:
jmp 0x14010cc10
push rbp
push rdi
sub rsp, 0x408
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x96
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x141189500]
xor rax, rbp
mov qword [rbp + 0x3c8], rax
lea rcx, [0x1411a7124]
call fcn.1400dc9ec
nop
lea rdx, str.C:WindowsLogsDPX
lea rcx, [rbp + 8]
call fcn.1400d8e0a
nop
lea r8, str._setuparr.log
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x48]
call fcn.1400dbe2a
nop
lea rcx, [rbp + 8]
call fcn.1400d8e7d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14010cccc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x84], eax
cmp dword [rbp + 0x84], 0xb7
je 0x14010cccc
mov dword [rbp + 0x354], 1
lea rcx, [rbp + 0x48]
call fcn.1400dbc95
nop
lea rcx, [rbp + 8]
call fcn.1400dbc95
mov eax, dword [rbp + 0x354]
jmp 0x14010cdf6
mov edx, 0x108
lea rcx, [rbp + 0xb0]
call fcn.1400d9364
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 0x20
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0xb0]
call fcn.1400d83f6
nop
mov rax, qword [rbp + 0xb0]
movsxd rax, dword [rax + 4]
lea rax, [rbp + rax + 0xb0]
mov rcx, rax
call fcn.1400d9760
movzx eax, al
test eax, eax
je 0x14010cd94
mov r8d, 0xc27e00
lea rdx, section..data
lea rcx, [rbp + 0xb0]
call fcn.1400d9ec2
nop
mov rax, qword [rbp + 0xb0]
movsxd rax, dword [rax + 4]
lea rax, [rbp + rax + 0xb0]
mov rcx, rax
call fcn.1400dccee
movzx eax, al
test eax, eax
je 0x14010cd92
mov dword [rbp + 0x374], 1
lea rcx, [rbp + 0xb0]
call fcn.1400d8603
nop
lea rcx, [rbp + 0x48]
call fcn.1400dbc95
nop
lea rcx, [rbp + 8]
call fcn.1400dbc95
mov eax, dword [rbp + 0x374]
jmp 0x14010cdf6
jmp 0x14010cdc6
mov dword [rbp + 0x394], 1
lea rcx, [rbp + 0xb0]
call fcn.1400d8603
nop
lea rcx, [rbp + 0x48]
call fcn.1400dbc95
nop
lea rcx, [rbp + 8]
call fcn.1400dbc95
mov eax, dword [rbp + 0x394]
jmp 0x14010cdf6
mov dword [rbp + 0x3b4], 0
lea rcx, [rbp + 0xb0]
call fcn.1400d8603
nop
lea rcx, [rbp + 0x48]
call fcn.1400dbc95
nop
lea rcx, [rbp + 8]
call fcn.1400dbc95
mov eax, dword [rbp + 0x3b4]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14029e390]
call fcn.1400dba47
mov rax, rdi
mov rcx, qword [rbp + 0x3c8]
xor rcx, rbp
call fcn.1400d9af8
lea rsp, [rbp + 0x3d8]
pop rdi
pop rbp
ret
Function at 0x1400da570
Capabilities:
Print debug messages

Disassembly:
jmp 0x140272b40
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x30]
mov rax, qword [0x141189500]
xor rax, rbp
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x30], 0
jne 0x140272b66
jmp 0x140272be3
mov rcx, qword [rbp + 0x30]
call fcn.1400d97f1
inc rax
mov qword [rbp], rax
cmp qword [rbp], 0
jne 0x140272b7f
jmp 0x140272be3
mov rax, qword [rbp]
shl rax, 1
mov rcx, rax
add rcx, 0xf
cmp rcx, rax
ja 0x140272b9c
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400d8068
sub rsp, rax
lea rax, [rsp + 0x30]
mov qword [rbp + 8], rax
mov rax, qword [rbp]
dec rax
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x30]
mov r8, qword [rbp]
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x10]
call fcn.1400d86c6
test eax, eax
jne 0x140272be3
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
call fcn.1400d9af8
lea rsp, [rbp + 0x20]
pop rbp
ret
Function at 0x1400da935
Capabilities:
Create process on windows

Disassembly:
jmp 0x140276ba0
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x128
lea rcx, [rsp + 0xe8]
call fcn.1400d90c6
lea rcx, [rsp + 0xb8]
call fcn.1400d90c6
lea rcx, [rsp + 0x88]
call fcn.1400d90c6
call fcn.1400d9fbc
mov r8d, eax
lea rdx, [rsp + 0xe8]
mov rcx, qword [rsp + 0x130]
call fcn.1400d8d60
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
je 0x140276c42
mov dword [rsp + 0x54], 0
lea rcx, [rsp + 0x88]
call fcn.1400d967a
lea rcx, [rsp + 0xb8]
call fcn.1400d967a
lea rcx, [rsp + 0xe8]
call fcn.1400d967a
mov eax, dword [rsp + 0x54]
jmp 0x140276de8
call fcn.1400d9fbc
mov r8d, eax
lea rdx, [rsp + 0xb8]
mov rcx, qword [rsp + 0x138]
call fcn.1400d8d60
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0
je 0x140276ca2
mov dword [rsp + 0x5c], 0
lea rcx, [rsp + 0x88]
call fcn.1400d967a
lea rcx, [rsp + 0xb8]
call fcn.1400d967a
lea rcx, [rsp + 0xe8]
call fcn.1400d967a
mov eax, dword [rsp + 0x5c]
jmp 0x140276de8
mov qword [rsp + 0x70], 0
cmp qword [rsp + 0x168], 0
je 0x140276d28
call fcn.1400d9fbc
mov r8d, eax
lea rdx, [rsp + 0x88]
mov rcx, qword [rsp + 0x168]
call fcn.1400d8d60
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
je 0x140276d16
mov dword [rsp + 0x64], 0
lea rcx, [rsp + 0x88]
call fcn.1400d967a
lea rcx, [rsp + 0xb8]
call fcn.1400d967a
lea rcx, [rsp + 0xe8]
call fcn.1400d967a
mov eax, dword [rsp + 0x64]
jmp 0x140276de8
lea rcx, [rsp + 0x88]
call fcn.1400d8fc2
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0xb8]
call fcn.1400d8fc2
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0xe8]
call fcn.1400d8fc2
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x170]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x160]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x158]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x150]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x148]
mov r8, qword [rsp + 0x140]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [rsp + 0x68], eax
lea rcx, [rsp + 0x88]
call fcn.1400d967a
lea rcx, [rsp + 0xb8]
call fcn.1400d967a
lea rcx, [rsp + 0xe8]
call fcn.1400d967a
mov eax, dword [rsp + 0x68]
add rsp, 0x128
ret

Function at 0x1400daa07
Capabilities:
Set environment variable

Disassembly:
jmp 0x140267420
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add rsp, 0x28
ret