joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400dfa30
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov qword [rcx], 0
test rdx, rdx
je 0x1400dfa8b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jb 0x1400dfa71
call fcn.1400c5840
mov rcx, qword [rsi]
call fcn.1400e21b0
mov qword [rsi], 0
lea rax, [rdi + 1]
cmp rax, 2
jb 0x1400dfa83
mov qword [rsi], rdi
call fcn.1400c5840
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [rsi + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp rax, rdi
je 0x1400dfaa5
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
int3

Function at 0x1400dfab0
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [rdx]
mov qword [rdx], 0
lea rbp, [rbx + 1]
cmp rbp, 2
jb 0x1400dfad9
call fcn.1400c5840
mov qword [rsi], 0
test rbx, rbx
je 0x1400dfb25
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jb 0x1400dfb0e
call fcn.1400c5840
mov rcx, qword [rsi]
call fcn.1400e21b0
mov qword [rsi], 0
cmp rbp, 2
jb 0x1400dfb1c
mov qword [rsi], rbx
call fcn.1400c5840
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov al, byte [rdi + 8]
mov byte [rsi + 8], al
mov byte [rdi + 8], 0
mov rax, qword [rdi]
inc rax
cmp rax, 2
jb 0x1400dfb4f
call fcn.1400c5840
mov rcx, qword [rdi]
call fcn.1400e21b0
mov qword [rdi], 0
mov rax, rsi
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x1400dfb60
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [rdx]
mov qword [rdx], 0
lea rbp, [rbx + 1]
cmp rbp, 2
jb 0x1400dfb89
call fcn.1400c5840
cmp qword [rsi], rbx
je 0x1400dfbce
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jb 0x1400dfbb7
call fcn.1400c5840
mov rcx, qword [rsi]
call fcn.1400e21b0
mov qword [rsi], 0
cmp rbp, 2
jb 0x1400dfbc5
mov qword [rsi], rbx
call fcn.1400c5840
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov al, byte [rdi + 8]
mov byte [rsi + 8], al
mov byte [rdi + 8], 0
mov rax, qword [rdi]
inc rax
cmp rax, 2
jb 0x1400dfbf8
call fcn.1400c5840
mov rcx, qword [rdi]
call fcn.1400e21b0
mov qword [rdi], 0
mov rax, rsi
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x1400dfc10
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
cmp qword [rcx], rdx
je 0x1400dfc6c
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rdi]
inc rax
cmp rax, 2
jb 0x1400dfc4a
call fcn.1400c5840
mov rcx, qword [rdi]
call fcn.1400e21b0
mov qword [rdi], 0
lea rax, [rsi + 1]
cmp rax, 2
jb 0x1400dfc5c
mov qword [rdi], rsi
call fcn.1400c5840
mov ecx, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400dfed0
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov ebx, r8d
mov esi, edx
mov rdi, rcx
mov rax, qword [0x140362028]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [rcx + 8], 0
je 0x1400dfeff
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x1400dff02
mov rcx, qword [rdi]
mov edx, esi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x1400dff23
test bl, bl
je 0x1400dff7a
cmp byte [rdi + 8], 0
je 0x1400dff6c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x1400dff6f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [rdi + 8], 0
je 0x1400dff3a
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x1400dff3d
mov rcx, qword [rdi]
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1400dff53
xor edi, edi
jmp 0x1400dfff6
mov dword [rsp + 0x24], 0xaaaaaaaa
cmp byte [rdi + 8], 0
je 0x1400dffae
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x1400dffb1
mov rcx, qword [rdi]
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [rdi + 8], 0
je 0x1400dff8b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x1400dff8e
mov rcx, qword [rdi]
call fcn.1400dfa00
mov rcx, qword [0x140390858]
mov dil, 1
test rcx, rcx
je 0x1400dfff6
mov edx, eax
mov r8d, esi
call fcn.1400c1f20
jmp 0x1400dfff6
mov rcx, qword [rdi]
lea rdx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x1400dffc4
mov esi, dword [rsp + 0x24]
cmp byte [rdi + 8], 0
je 0x1400dffd5
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x1400dffd8
mov rcx, qword [rdi]
call fcn.1400dfa00
mov rcx, qword [0x140390858]
test rcx, rcx
je 0x1400dfff3
mov edx, eax
mov r8d, esi
call fcn.1400c1f20
mov dil, 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1401a4270
mov eax, edi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret

Function at 0x1400e0df0
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
xor eax, eax
test r8d, r8d
sete al
xor ebx, ebx
test edx, edx
sete bl
xor ecx, ecx
mov edx, ebx
mov r8d, eax
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi], 0
test rax, rax
je 0x1400e0e85
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jb 0x1400e0e50
call fcn.1400c5840
mov rcx, qword [rsi]
call fcn.1400e21b0
mov qword [rsi], 0
lea rax, [rdi + 1]
cmp rax, 2
jb 0x1400e0e62
mov qword [rsi], rdi
call fcn.1400c5840
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsi]
mov byte [rsi + 8], 1
inc rax
cmp rax, 1
jbe 0x1400e0e89
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov byte [rsi + 8], 1
int3

Function at 0x1400e17b0
Capabilities:
Create thread

Disassembly:
mov r9d, r8d
xor r8d, r8d
jmp fcn.1400e15d0
Function at 0x1400e2010
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, r8
mov rax, qword [0x140362028]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov eax, 4
lea r9, [rsp + 0x3c]
mov dword [r9], eax
lea rdi, [rsp + 0x38]
mov dword [rdi], eax
lea rax, [rsp + 0x34]
mov dword [rax], 0
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x1400e2083
mov eax, dword [rsp + 0x3c]
add eax, 0xfffffffd
mov edi, 0x3f4
cmp eax, 1
ja 0x1400e2083
cmp dword [rsp + 0x38], 4
jne 0x1400e2083
mov eax, dword [rsp + 0x34]
mov dword [rsi], eax
xor edi, edi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1401a4270
mov eax, edi
add rsp, 0x48
pop rdi
pop rsi
ret

Function at 0x1400e20a0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push r14
push rsi
push rdi
push rbx
mov eax, 0x1048
call fcn.1401a4200
sub rsp, rax
mov r14, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x140362028]
xor rax, rsp
mov qword [rsp + 0x1040], rax
lea rsi, [rsp + 0x840]
mov r8d, 0x800
mov rcx, rsi
mov dl, 0xaa
call fcn.1401a64a0
lea r9, [rsp + 0x3c]
mov dword [r9], 1
lea rax, [rsp + 0x38]
mov dword [rax], 0x800
mov rcx, qword [rbx]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
mov rdx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x1400e2188
mov eax, dword [rsp + 0x3c]
cmp eax, 2
je 0x1400e2138
mov edi, 0x3f4
cmp eax, 1
jne 0x1400e2188
lea rdx, [rsp + 0x840]
jmp 0x1400e217e
lea rsi, [rsp + 0x40]
mov r8d, 0x800
mov rcx, rsi
mov dl, 0xaa
call fcn.1401a64a0
lea rcx, [rsp + 0x840]
mov rdx, rsi
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x38], eax
add eax, 0xfffffbff
mov edi, 0xea
cmp eax, 0xfffffc00
jb 0x1400e2188
lea rdx, [rsp + 0x40]
mov rcx, r14
call fcn.1400b98f0
xor edi, edi
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.1401a4270
mov eax, edi
add rsp, 0x1048
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400e2210
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
cmp dword [rcx + 0x10], 0
mov rax, qword [rcx]
jne 0x1400e2244
test rax, rax
jne 0x1400e2244
cmp dword [rsi + 0x14], 0
je 0x1400e2236
xor eax, eax
jmp 0x1400e2244
xor eax, eax
cmp qword [rsi + 8], 0
mov edx, 0
je 0x1400e229b
lea rcx, [rax + 1]
cmp rcx, 2
jb 0x1400e2264
call fcn.1400c5840
mov rcx, qword [rsi]
call fcn.1400e21b0
mov qword [rsi], 0
xor eax, eax
mov rcx, qword [rsi + 8]
lea rdx, [rcx + 1]
cmp rdx, 2
jb 0x1400e228d
call fcn.1400c5840
mov rcx, qword [rsi + 8]
call fcn.1400e21b0
mov qword [rsi + 8], 0
mov rax, qword [rsi]
xor ecx, ecx
mov rdx, rax
mov qword [rsi + 0x10], 0
mov rax, rcx
mov rbx, qword [rdi]
cmp rdx, rbx
je 0x1400e22e9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jb 0x1400e22cb
call fcn.1400c5840
mov rcx, qword [rsi]
call fcn.1400e21b0
mov qword [rsi], 0
lea rax, [rbx + 1]
cmp rax, 2
jb 0x1400e22dd
mov qword [rsi], rbx
call fcn.1400c5840
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsi + 8]
mov rbp, qword [rdi + 8]
cmp rax, rbp
je 0x1400e2338
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 8]
inc rax
cmp rax, 2
jb 0x1400e231d
call fcn.1400c5840
mov rcx, qword [rsi + 8]
call fcn.1400e21b0
mov qword [rsi + 8], 0
lea rax, [rbp + 1]
cmp rax, 2
jb 0x1400e2330
mov qword [rsi + 8], rbp
call fcn.1400c5840
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rdi + 0x10]
mov dword [rsi + 0x10], eax
mov eax, dword [rdi + 0x14]
mov dword [rsi + 0x14], eax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret

Function at 0x1400e2460
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rax, qword [0x140362028]
xor rax, rsp
mov qword [rsp + 0x48], rax
test rcx, rcx
je 0x1400e2513
mov r14, rdx
mov rdi, rcx
lea r15, [rsp + 0x40]
mov qword [r15], 0
mov rbx, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rbx
mov rsi, rax
call rbx
xor ecx, ecx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], ecx
mov dword [rsp + 0x30], 2
mov rcx, rax
mov rdx, rdi
mov r8, rsi
mov r9, r15
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov edi, eax
test eax, eax
je 0x1400e2517
mov rsi, qword [rsp + 0x40]
cmp qword [r14], rsi
je 0x1400e2527
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [r14]
inc rax
cmp rax, 2
jb 0x1400e24ff
call fcn.1400c5840
mov rcx, qword [r14]
call fcn.1400e21b0
mov qword [r14], 0
lea rax, [rsi + 1]
cmp rax, 2
jb 0x1400e251f
mov qword [r14], rsi
call fcn.1400c5840
jmp 0x1400e251f
mov bl, 1
jmp 0x1400e252c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
setne bl
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401a4270
mov eax, ebx
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400e2890
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x158
mov rax, qword [0x140362028]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov eax, dword [0x140392398]
mov ecx, dword [0x14036bfd8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400e28f0
lea rsi, [0x140392390]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1401a4270
mov rax, rsi
add rsp, 0x158
pop rdi
pop rsi
ret
lea rcx, [0x140392398]
call fcn.1401a2fc0
cmp dword [0x140392398], 0xffffffff
jne 0x1400e28cc
lea rsi, [rsp + 0x34]
mov r8d, 0x118
mov rcx, rsi
xor edx, edx
call fcn.1401a64a0
mov dword [rsi - 4], 0x11c
lea rsi, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
lea rdi, [rsp + 0x2c]
mov dword [rdi], 0
mov ecx, dword [rsi + 4]
mov edx, dword [rsi + 8]
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
mov ecx, 0x80
call fcn.1401a2e6c
mov rsi, rax
mov edi, dword [rdi]
mov eax, dword [0x1403923e0]
mov ecx, dword [0x14036bfd8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400e29b0
lea r8, [0x1403923b0]
lea rdx, [rsp + 0x30]
mov rcx, rsi
mov r9d, edi
call fcn.1400e2ad0
mov qword [0x140392390], rsi
lea rcx, [0x140392398]
call fcn.1401a3058
jmp 0x1400e28cc
lea rcx, [0x1403923e0]
call fcn.1401a2fc0
cmp dword [0x1403923e0], 0xffffffff
jne 0x1400e2981
xorps xmm0, xmm0
movups xmmword [0x1403923d0], xmm0
movups xmmword [0x1403923c0], xmm0
movups xmmword [0x1403923b0], xmm0
lea rcx, [0x1403923b0]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [0x1403923e0]
call fcn.1401a3058
jmp 0x1400e2981

Function at 0x1400e2a20
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x28
mov eax, dword [0x1403923e0]
mov ecx, dword [0x14036bfd8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400e2a5c
movzx ecx, word [0x1403923b0]
cmp cx, 9
jne 0x1400e2aa4
mov eax, 1
add rsp, 0x28
ret
lea rcx, [0x1403923e0]
call fcn.1401a2fc0
cmp dword [0x1403923e0], 0xffffffff
jne 0x1400e2a45
xorps xmm0, xmm0
movups xmmword [0x1403923d0], xmm0
movups xmmword [0x1403923c0], xmm0
movups xmmword [0x1403923b0], xmm0
lea rcx, [0x1403923b0]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [0x1403923e0]
call fcn.1401a3058
jmp 0x1400e2a45
xor eax, eax
test cx, cx
je 0x1400e2a57
cmp cx, 6
jne 0x1400e2ab8
mov eax, 2
jmp 0x1400e2a57
cmp cx, 0xc
jne 0x1400e2ac5
mov eax, 3
jmp 0x1400e2a57
mov eax, 4
jmp 0x1400e2a57
Function at 0x1400e68d0
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r12, r9
mov r13d, r8d
mov rdi, rdx
mov rsi, rcx
xor eax, eax
mov qword [rcx], rax
mov rbx, qword [rdx]
mov qword [rdx], rax
lea rbp, [rbx + 1]
cmp rbp, 2
jb 0x1400e6906
call fcn.1400c5840
mov r15, qword [rsp + 0x90]
cmp qword [rsi], rbx
je 0x1400e6953
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jb 0x1400e693c
call fcn.1400c5840
mov rcx, qword [rsi]
call fcn.1400e21b0
mov qword [rsi], 0
cmp rbp, 2
jb 0x1400e694a
mov qword [rsi], rbx
call fcn.1400c5840
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [rsi + 8], r13d
mov qword [rsi + 0x10], r12
movups xmm0, xmmword [r15]
movups xmmword [rsi + 0x18], xmm0
mov rax, qword [rdi]
inc rax
cmp rax, 2
jb 0x1400e6983
call fcn.1400c5840
mov rcx, qword [rdi]
call fcn.1400e21b0
mov qword [rdi], 0
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x1400e6ac0
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rax, qword [0x140362028]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rsi, qword [rcx]
lea rbp, [rsi + 1]
cmp rbp, 2
jae 0x1400e6aef
xor edi, edi
jmp 0x1400e6bd2
mov rdi, rcx
cmp dword [rcx + 8], 1
jne 0x1400e6bee
mov qword [rdi], 0
call fcn.1400c5840
test rsi, rsi
je 0x1400e6b22
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.1400c5840
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x38]
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor ecx, ecx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], 5
mov rcx, rax
mov rdx, rsi
mov r8, rax
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov ebx, eax
test eax, eax
je 0x1400e6bb9
mov r15, qword [rsp + 0x38]
cmp qword [rdi], r15
je 0x1400e6bb2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
mov rax, qword [rdi]
inc rax
cmp rax, 2
jb 0x1400e6b97
call fcn.1400c5840
mov rcx, qword [rdi]
call fcn.1400e21b0
mov qword [rdi], 0
lea rax, [r15 + 1]
cmp rax, 2
jb 0x1400e6ba9
mov qword [rdi], r15
call fcn.1400c5840
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [rdi + 8], 0
test ebx, ebx
setne dil
cmp rbp, 2
jb 0x1400e6bd2
call fcn.1400c5840
mov rcx, rsi
call fcn.1400e21b0
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1401a4270
mov eax, edi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
int3
Function at 0x1400e6fc0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test rdx, rdx
je 0x1400e6ffc
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x1400e7006
add rdi, rbx
sub rsi, rbx
jne 0x1400e6fda
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
int3

Function at 0x1400e7030
Capabilities:
Get memory capacity

Disassembly:
push rsi
sub rsp, 0x70
mov rax, qword [0x140362028]
xor rax, rsp
mov qword [rsp + 0x68], rax
movaps xmm0, xmmword [0x140232ef0]
lea rsi, [rsp + 0x20]
movaps xmmword [rsi], xmm0
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
mov dword [rsi], 0x40
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rcx, qword [rsi + 8]
movabs rdx, 0x7fffffffffffffff
cmp rcx, rdx
cmovb rdx, rcx
xor esi, esi
test eax, eax
cmovne rsi, rdx
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1401a4270
mov rax, rsi
add rsp, 0x70
pop rsi
ret
Function at 0x1400e9480
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
mov edi, edx
mov rsi, rcx
lea rax, [0x140231340]
mov qword [rcx], rax
add rcx, 8
call fcn.140063e10
lea rcx, [rsi + 0x10]
call fcn.140063e10
xor ebx, ebx
mov byte [rsi + 0x18], bl
lea rcx, [rsi + 0x40]
xorps xmm6, xmm6
movups xmmword [rsi + 0x1c], xmm6
movups xmmword [rsi + 0x2c], xmm6
mov dword [rsi + 0x3c], ebx
call fcn.140063e10
mov byte [rsi + 0x48], bl
lea rax, [rsi + 0x70]
movups xmmword [rsi + 0x50], xmm6
mov qword [rsi + 0x60], rbx
movups xmmword [rsi + 0x70], xmm6
mov qword [rsi + 0x68], rax
movups xmmword [rsi + 0x80], xmm6
movups xmmword [rsi + 0x90], xmm6
movups xmmword [rsi + 0xa0], xmm6
movups xmmword [rsi + 0xb0], xmm6
movups xmmword [rsi + 0xc0], xmm6
movups xmmword [rsi + 0xd0], xmm6
mov qword [rsi + 0xe0], rbx
mov ebp, 0x3f800000
mov dword [rsi + 0xe8], ebp
mov dword [rsi + 0xf0], ebx
movups xmmword [rsi + 0xf8], xmm6
movups xmmword [rsi + 0x108], xmm6
mov dword [rsi + 0x118], ebp
movups xmmword [rsi + 0x120], xmm6
movups xmmword [rsi + 0x130], xmm6
mov dword [rsi + 0x140], ebp
movups xmmword [rsi + 0x148], xmm6
movups xmmword [rsi + 0x158], xmm6
mov dword [rsi + 0x168], ebp
movups xmmword [rsi + 0x170], xmm6
movups xmmword [rsi + 0x180], xmm6
mov dword [rsi + 0x190], ebp
mov qword [rsi + 0x1b0], rbx
movups xmmword [rsi + 0x198], xmm6
mov dword [rsi + 0x1a8], ebx
mov eax, dword [reloc.WS2_32.dll_accept]
mov dword [rsi + 0x1b8], eax
lea rcx, [rsi + 0x1c0]
call fcn.140126280
lea rcx, [rsi + 0x310]
movups xmmword [rsi + 0x2f8], xmm6
mov qword [rsi + 0x308], rbx
xor edx, edx
call fcn.1400d8e30
lea rcx, [rsi + 0x318]
xor edx, edx
call fcn.1400d8e30
lea rcx, [rsi + 0x320]
xor edx, edx
call fcn.1400d8e30
movups xmmword [rsi + 0x328], xmm6
movups xmmword [rsi + 0x338], xmm6
mov dword [rsi + 0x348], ebp
movups xmmword [rsi + 0x350], xmm6
movups xmmword [rsi + 0x360], xmm6
movups xmmword [rsi + 0x370], xmm6
mov byte [rsi + 0x380], bl
mov dword [rsi + 0x384], edi
mov byte [rsi + 0x388], bl
movups xmmword [rsi + 0x390], xmm6
movups xmmword [rsi + 0x3a0], xmm6
call fcn.14003a2a0
call sub.KERNEL32.dll_GetCurrentProcessId
mov dword [rsi + 0x1a8], eax
cdqe
movabs rcx, 0xcbf29ce484222325
xor rcx, rax
movabs rax, 0x100000001b3
imul rax, rcx
mov qword [rsi + 0x1a0], rax
mov rcx, rsi
call fcn.1400e96b0
mov rcx, qword [rsi + 0x20]
mov qword [rsi + 0x20], rax
test rcx, rcx
je 0x1400e967a
mov rax, qword [rcx]
mov rax, qword [rax]
mov edx, 1
call qword [case.0x1401f58d0.0]
call fcn.1400e7d90
lea r8, str.TraceLog
mov rcx, rax
mov rdx, rsi
xor r9d, r9d
call fcn.1400e7f20
mov qword [0x1403947e0], rsi
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x1400ee260
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r14, rdx
mov rsi, rcx
mov rbp, qword [rcx + 0x10]
cmp rbp, qword [rcx + 0x18]
jne 0x1400ee387
mov r15, qword [rsi]
mov rbx, qword [rsi + 8]
mov rax, rbx
sub rax, r15
jbe 0x1400ee2f0
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r13, rax
neg r13
shl rax, 3
mov r12, rbx
sub r12, rax
mov r15, rbp
sub r15, rbx
je 0x1400ee2d2
mov rcx, r12
mov rdx, rbx
mov r8, r15
call fcn.1401a6090
mov rbp, qword [rsi + 8]
add r12, r15
mov qword [rsi + 0x10], r12
lea rax, [r13*8]
add rax, rbp
mov qword [rsi + 8], rax
mov rbp, r12
jmp 0x1400ee387
mov rax, rbp
sub rax, r15
sar rax, 2
cmp rbp, r15
mov edi, 1
cmovne rdi, rax
mov rax, rdi
shr rax, 0x3d
jne 0x1400ee3a4
mov r12, rdi
shr r12, 2
lea rcx, [rdi*8]
call fcn.1401a2e6c
lea r9, [rax + r12*8]
lea r8, [rax + rdi*8]
mov r10, r9
sub rbp, rbx
je 0x1400ee364
mov rdi, rbp
sar rdi, 3
and rbp, 0xfffffffffffffff8
mov r10, rbp
add r10, r9
shl rdi, 3
lea rbp, [rax + r12*8]
xor edx, edx
mov rcx, qword [rbx + rdx]
mov qword [rbp + rdx], rcx
add rdx, 8
cmp rdi, rdx
jne 0x1400ee352
mov qword [rsi], rax
mov qword [rsi + 8], r9
mov qword [rsi + 0x10], r10
mov qword [rsi + 0x18], r8
mov rbp, r10
test r15, r15
je 0x1400ee387
mov rcx, r15
call fcn.1401a2ea8
mov rbp, qword [rsi + 0x10]
mov rax, qword [r14]
mov qword [rbp], rax
add qword [rsi + 0x10], 8
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.1401bfdb0
int3
Function at 0x1400ee8c0
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
mov r15, rdx
mov r14, rcx
mov rax, qword [0x140362028]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x1400ee923
mov ebx, eax
mov r12d, eax
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x30], rax
movaps xmm0, xmmword [0x140232ef0]
movaps xmmword [rsp + 0x20], xmm0
cmp ebx, 0xa
ja 0x1400ee937
lea rsi, [rsp + 0x20]
mov byte [rsi + 0x17], bl
jmp 0x1400ee960
xorps xmm0, xmm0
movups xmmword [r14], xmm0
mov qword [r14 + 0x10], 0
jmp 0x1400ee9f2
lea rdi, [r12 + 8]
and rdi, 0xfffffffffffffff8
lea rcx, [rdi + rdi]
call fcn.1401a2e6c
mov rsi, rax
mov qword [rsp + 0x20], rax
bts rdi, 0x3f
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r12
lea r8, [r12 + r12]
mov rcx, rsi
xor edx, edx
call fcn.1401a64a0
mov word [rsi + r12*2], 0
cmp byte [rsp + 0x37], 0
jns 0x1400ee983
mov rdx, qword [rsp + 0x20]
jmp 0x1400ee988
lea rdx, [rsp + 0x20]
mov rcx, r15
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x1400ee9d1
mov edx, eax
movzx eax, byte [rsp + 0x37]
mov rcx, rax
test al, al
jns 0x1400ee9ab
mov rcx, qword [rsp + 0x28]
cmp rcx, rdx
jbe 0x1400ee9d5
lea rsi, [rsp + 0x20]
mov rcx, rsi
xor r8d, r8d
call fcn.1400ba710
mov rax, qword [rsi + 0x10]
mov qword [r14 + 0x10], rax
movaps xmm0, xmmword [rsi]
movups xmmword [r14], xmm0
jmp 0x1400ee9f2
mov al, byte [rsp + 0x37]
xorps xmm0, xmm0
movups xmmword [r14], xmm0
mov qword [r14 + 0x10], 0
test al, al
jns 0x1400ee9f2
mov rcx, qword [rsp + 0x20]
call fcn.1401a2ea8
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1401a4270
mov rax, r14
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x1400eea10
Capabilities:
Set environment variable

Disassembly:
sub rsp, 0x28
cmp byte [rdx + 0x17], 0
jns 0x1400eea1d
mov rdx, qword [rdx]
cmp byte [rcx + 0x17], 0
jns 0x1400eea26
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
setne al
add rsp, 0x28
ret

Function at 0x1400eea40
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
cmp byte [rcx + 0x17], 0
jns 0x1400eea4d
mov rcx, qword [rcx]
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
setne al
add rsp, 0x28
ret