joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800476fc
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x1800d2580]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor ebx, ebx
mov r15d, edx
mov rdi, rcx
mov qword [rcx], rbx
mov qword [rcx + 8], rbx
xor edx, edx
mov r14d, r8d
mov esi, ebx
lea ecx, [rbx + 4]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x180047898
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rax
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x18004783a
lea esi, [rbx + 1]
cmp dword [rsp + 0x20], 0x10
jb 0x1800477f6
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x2c], eax
jne 0x1800477f6
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x28], eax
je 0x1800477f6
mov rdx, qword [rdi]
test rdx, rdx
jne 0x1800477b8
mov dword [rdi + 8], 0x80
mov r8d, 0x200
mov rcx, qword [0x1800d2f30]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rdi], rax
mov rdx, rax
test rax, rax
je 0x18004781e
jmp 0x1800477e9
mov eax, dword [rdi + 8]
cmp dword [rdi + 0xc], eax
jb 0x1800477e9
add eax, eax
mov r8, rdx
mov r9d, eax
xor edx, edx
mov dword [rdi + 8], eax
mov rcx, qword [0x1800d2f30]
shl r9, 2
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rdx, rax
test rax, rax
je 0x18004781e
mov qword [rdi], rax
mov ecx, dword [rdi + 0xc]
mov eax, dword [rsp + 0x28]
mov dword [rdx + rcx*4], eax
inc dword [rdi + 0xc]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rbp
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x180047766
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x18004783a
mov esi, ebx
cmp qword [rdi], rbx
je 0x18004783a
mov r8, qword [rdi]
xor edx, edx
mov rcx, qword [0x1800d2f30]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rdi], rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x180047898
cmp qword [rdi], rbx
je 0x18004789d
mov esi, ebx
cmp dword [rdi + 0xc], ebx
jbe 0x18004789d
mov r8, qword [rdi]
xor edx, edx
mov eax, esi
lea ecx, [rdx + 0x5a]
mov r8d, dword [r8 + rax*4]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbp, rax
test rax, rax
je 0x18004788f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, r14d
mov edx, r15d
mov rcx, rbp
call fcn.180047adc
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [rdi + 0xc]
jb 0x180047853
jmp 0x18004789d
mov ebx, 9
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180058830
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x180047c78
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx], 0
mov rbx, rcx
je 0x180047cdc
xor edi, edi
cmp dword [rcx + 0xc], edi
jbe 0x180047cca
mov r8, qword [rbx]
xor edx, edx
mov r8d, dword [r8 + rdi*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x180047cc3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [rbx + 0xc]
jb 0x180047c97
mov r8, qword [rbx]
xor edx, edx
mov rcx, qword [0x1800d2f30]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x180048050
Capabilities:
Check for software breakpoints

Disassembly:
mov r8b, byte [rcx]
mov r9d, edx
test r8b, r8b
je 0x180048067
cmp r8b, 0x90
je 0x180048067
cmp r8b, 0xcc
jne 0x180048089
mov r10d, 1
mov edx, r10d
cmp r9d, r10d
jbe 0x180048085
mov eax, edx
cmp byte [rax + rcx], r8b
jne 0x180048089
add edx, r10d
cmp edx, r9d
jb 0x180048075
mov eax, r10d
ret
xor eax, eax
ret
Function at 0x180053504
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor ebp, ebp
cmp byte [0x1800d3839], bpl
je 0x1800536e2
mov rax, qword [0x1800d38a8]
test rax, rax
jne 0x1800535d3
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rbx, qword [rax]
mov rdx, rbx
mov r8, qword [rdx + 0x30]
movsxd rax, dword [r8 + 0x3c]
mov r9d, dword [rax + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x1800535b8
mov r10d, dword [r9 + 0x18]
test r10d, r10d
je 0x1800535b8
mov esi, dword [r9 + 0x20]
dec r10d
mov r11d, 0x811c9dc5
lea rax, [rsi + r10*4]
mov ecx, dword [rax + r8]
add rcx, r8
mov al, byte [rcx]
inc rcx
test al, al
je 0x1800535b3
movsx eax, al
xor eax, r11d
imul r11d, eax, 0x1000193
mov al, byte [rcx]
inc rcx
test al, al
jne 0x180053590
cmp r11d, 0x95466b05
je 0x1800536c4
test r10d, r10d
jne 0x180053573
mov rax, qword [rdx]
mov rdx, rax
cmp rax, rbx
je 0x1800535c9
cmp qword [rax + 0x30], rbp
jne 0x18005354e
mov rax, rbp
mov qword [0x1800d38a8], rax
mov ecx, dword [0x1800d385c]
call rax
test ax, ax
je 0x1800536e2
mov rax, qword [0x1800d2f70]
mov rcx, qword [rax]
test rcx, rcx
je 0x1800536e2
mov r11, qword [rcx + 8]
test r11, r11
je 0x1800536e2
mov rax, qword [0x1800d2f78]
mov r8, qword [rax]
test r8, r8
je 0x1800536e2
mov r8, qword [r8 + 0x18]
test r8, r8
je 0x1800536e2
mov r9d, ebp
mov r10, rbp
movsxd rax, r9d
cmp rax, qword [r8 + 0x108]
jae 0x1800536e2
mov rdx, qword [r8 + 0x100]
test rdx, rdx
je 0x1800536b8
mov rdx, qword [r10 + rdx]
test rdx, rdx
je 0x1800536b8
cmp rdx, r11
je 0x1800536b8
mov eax, dword [0x1800d2f9c]
mov ecx, dword [rax + rdx]
test ecx, ecx
je 0x1800536b8
and ecx, 0x1fc000
cmp ecx, 0x8000
je 0x1800536b8
movsd xmm0, qword [r11 + 0x90]
movss xmm2, dword [r11 + 0x98]
movsd qword [rsp + 0x20], xmm0
movss xmm1, dword [rsp + 0x24]
addss xmm1, dword [0x18005baec]
movss xmm0, dword [rsp + 0x20]
mov dword [rdx + 0x280], 0x3dcccccd
unpcklps xmm0, xmm1
movsd qword [rdx + 0x90], xmm0
movss dword [rdx + 0x98], xmm2
inc r9d
add r10, 0x10
jmp 0x18005362a
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + r10*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
jmp 0x1800535cc
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x180053e24
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
movaps xmmword [rax - 0x28], xmm6
xor r14d, r14d
cmp byte [0x1800d37d4], r14b
movaps xmmword [rax - 0x38], xmm7
movaps xmmword [rax - 0x48], xmm8
movaps xmmword [rax - 0x58], xmm9
je 0x18005404a
mov rax, qword [0x1800d38a8]
test rax, rax
jne 0x180053f05
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rbx, qword [rax]
mov r10, rbx
mov r8, qword [r10 + 0x30]
movsxd rax, dword [r8 + 0x3c]
mov r9d, dword [rax + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x180053eea
mov edx, dword [r9 + 0x18]
test edx, edx
je 0x180053eea
mov esi, dword [r9 + 0x20]
dec edx
mov r11d, 0x811c9dc5
lea rax, [rsi + rdx*4]
mov ecx, dword [rax + r8]
add rcx, r8
mov al, byte [rcx]
inc rcx
test al, al
je 0x180053ee6
movsx eax, al
xor eax, r11d
imul r11d, eax, 0x1000193
mov al, byte [rcx]
inc rcx
test al, al
jne 0x180053ec3
cmp r11d, 0x95466b05
je 0x180053f7f
test edx, edx
jne 0x180053ea7
mov rax, qword [r10]
mov r10, rax
cmp rax, rbx
je 0x180053efb
cmp qword [rax + 0x30], r14
jne 0x180053e83
mov rax, r14
mov qword [0x1800d38a8], rax
mov ecx, dword [0x1800d22d8]
call rax
test ax, ax
jns 0x18005404a
call fcn.18004dd80
mov rbx, rax
test rax, rax
je 0x18005404a
cmp dword [0x1800d2300], 1
jne 0x18005404a
movss xmm9, dword [0x1800d2fd8]
lea rcx, [rbp - 0x50]
movss xmm6, dword [0x1800d2fdc]
xor r8d, r8d
mulss xmm9, dword [0x18005bae8]
mov rdx, rax
mulss xmm6, dword [0x18005bae8]
call fcn.18004da40
mov ecx, dword [0x1800d37dc]
sub ecx, 1
je 0x180053fa4
sub ecx, 1
je 0x180053f9c
cmp ecx, 1
jne 0x180053fb6
mov r8d, ecx
jmp 0x180053faa
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
jmp 0x180053efe
mov r8d, 8
jmp 0x180053faa
mov r8d, 7
mov rdx, rbx
lea rcx, [rbp - 0x50]
call fcn.18004da40
movsd xmm8, qword [rbp - 0x50]
lea rdx, [rbp - 0x50]
mov ebx, dword [rbp - 0x48]
lea rcx, [rbp + 0x20]
movsd qword [rbp - 0x50], xmm8
mov dword [rbp - 0x48], ebx
call fcn.180052fe8
movss xmm0, dword [rbp + 0x24]
cvtps2pd xmm1, xmm6
cvtps2pd xmm0, xmm0
subsd xmm0, xmm1
movsd xmm1, qword [0x180063598]
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
movsd xmm1, qword [0x180063598]
movaps xmm7, xmm0
movss xmm0, dword [rbp + 0x20]
cvtps2pd xmm0, xmm0
cvtps2pd xmm2, xmm9
subsd xmm0, xmm2
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
addsd xmm7, xmm0
xorps xmm0, xmm0
cvtsd2ss xmm0, xmm7
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrtf
mov eax, dword [0x1800d22dc]
lea ecx, [rax + rax*4]
add ecx, ecx
movd xmm1, ecx
cvtdq2ps xmm1, xmm1
comiss xmm1, xmm0
jbe 0x18005404a
lea rcx, [rbp - 0x50]
movsd qword [rbp - 0x50], xmm8
mov dword [rbp - 0x48], ebx
call fcn.18004d338
movaps xmm6, xmmword [rsp + 0x60]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm7, xmmword [rsp + 0x50]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x180058194
Capabilities:
Enumerate gui resources
Get graphical window text

Disassembly:
sub rsp, 0xd8
mov rax, qword [0x1800d2580]
xor rax, rsp
mov qword [rsp + 0xc0], rax
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
lea rcx, [0x1800580fc]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
jne 0x18005820b
mov qword [rsp + 0x20], 0xc8
lea rdx, [rsp + 0x30]
lea rcx, [0x1800580fc]
call qword [sym.imp.USER32.dll_EnumWindows]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x28]
call fcn.1800481c0
mov rcx, rax
call fcn.18004842c
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1800581d8
mov r8d, 0x80
lea rdx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextA]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.180058830
add rsp, 0xd8
ret
Function at 0x180bcf058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.180bcf1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x180bcf089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180bcf06f
add dl, dl
jne 0x180bcf096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180bcf0f6
xor eax, eax
add dl, dl
jne 0x180bcf0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180bcf1ad
add dl, dl
jne 0x180bcf0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180bcf0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180bcf0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180bcf0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x180bcf0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x180bcf07e
mov eax, 1
add dl, dl
jne 0x180bcf106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180bcf113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180bcf0fb
sub eax, ebx
mov ebx, 1
jne 0x180bcf14c
mov ecx, 1
add dl, dl
jne 0x180bcf12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180bcf13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180bcf123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180bcf07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x180bcf168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180bcf175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180bcf15d
cmp eax, 0x7d00
jae 0x180bcf19b
cmp eax, 0x500
jb 0x180bcf196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180bcf07e
cmp eax, 0x7f
ja 0x180bcf19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180bcf07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x180bcf1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x180bcf07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14001ffb0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x10090
call fcn.140023f50
sub rsp, rax
mov rax, qword [0x140061240]
xor rax, rsp
mov qword [rsp + 0x10080], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor ebp, ebp
mov rsi, rcx
mov word [rsp + 0x80], bp
mov edi, 0x28
mov word [rsp + 0x30], bp
test al, al
je 0x140020072
nop dword [rax]
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], bpl
lea rcx, [rsp + 0x24]
call fcn.140032f1c
cmp rax, 1
jne 0x1400200ce
mov rcx, rdi
mov rax, rbx
cmp word [rbx], bp
je 0x14002004f
add rax, 2
dec rcx
cmp word [rax], bp
jne 0x140020043
cmp rcx, 1
jb 0x1400200ce
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], bp
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x140020010
mov r8d, 0x10000
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0xffff
ja 0x1400200a3
lea rcx, [rsp + 0x80]
call fcn.1400359a0
jmp 0x1400200a5
xor eax, eax
mov rcx, qword [rsp + 0x10080]
xor rcx, rsp
call fcn.140023c80
lea r11, [rsp + 0x10090]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.140032cc8
int3
Function at 0x140020cb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp byte [0x140062d3e], 0
mov rsi, r8
mov rdi, rdx
mov rbp, rcx
jne 0x140020d35
mov edx, 3
xor ecx, ecx
mov r8d, 0xa
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [0x140062b90], rax
xor ecx, ecx
mov ebx, dword [rax]
lea rdx, [rax + 4]
mov qword [0x140062b90], rdx
mov r8d, dword [rdx]
add rdx, 4
mov qword [0x140062b90], rdx
call fcn.14001ee70
cmp eax, ebx
jne 0x140020e9d
mov byte [0x140062d3e], 1
lea rdx, [0x140044420]
mov rcx, rsi
call fcn.140032970
test eax, eax
je 0x140020dc0
cmp byte [0x140062d3d], 1
je 0x140020dc0
call qword [sym.imp.python311.dll_PyDict_New]
mov qword [0x140063a90], rax
call qword [sym.imp.python311.dll_PyDict_New]
mov qword [0x140063a98], rax
call qword [sym.imp.python311.dll_PyDict_New]
mov qword [0x140063aa0], rax
call qword [sym.imp.python311.dll_PyDict_New]
mov qword [0x140063aa8], rax
call qword [sym.imp.python311.dll_PyDict_New]
mov qword [0x140063ab0], rax
call qword [sym.imp.python311.dll_PyDict_New]
mov qword [0x140063ab8], rax
call qword [sym.imp.python311.dll_PyDict_New]
mov qword [0x140063ac0], rax
call qword [sym.imp.python311.dll_PyDict_New]
mov qword [0x140063ac8], rax
mov byte [0x140062d3d], 1
mov r8, qword [0x140062b90]
mov rax, rsi
mov rdx, r8
sub rdx, rsi
movzx ecx, byte [rax]
xor r9d, r9d
cmp cl, byte [rax + rdx]
jne 0x140020de7
inc rax
test cl, cl
jne 0x140020dd0
mov ecx, r9d
jmp 0x140020dec
sbb ecx, ecx
or ecx, 1
mov rax, 0xffffffffffffffff
cmp byte [r8 + rax + 1], r9b
lea rax, [rax + 1]
jne 0x140020df3
lea rdx, [r8 + rax]
mov eax, dword [r8 + rax + 1]
add rdx, 5
test ecx, ecx
je 0x140020e58
nop
add rdx, rax
mov rax, rsi
mov r8, rdx
sub r8, rsi
nop dword [rax]
movzx ecx, byte [rax]
cmp cl, byte [rax + r8]
jne 0x140020e35
inc rax
test cl, cl
jne 0x140020e20
mov ecx, r9d
jmp 0x140020e3a
sbb ecx, ecx
or ecx, 1
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], r9b
jne 0x140020e41
add rdx, rax
mov eax, dword [rdx + 1]
add rdx, 5
test ecx, ecx
jne 0x140020e10
movzx ecx, word [rdx]
lea rax, [rdx + 2]
cmp r9w, cx
jae 0x140020e88
mov ebx, ecx
nop word [rax + rax]
mov r8, rax
mov rdx, rdi
mov rcx, rbp
call fcn.14001d440
add rdi, 8
sub rbx, 1
jne 0x140020e70
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
lea rcx, str.Error__corrupted_constants_object
call fcn.14002f684
call fcn.140032cc8
int3
Function at 0x140023830
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rax, qword [0x140061240]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor r14d, r14d
mov rbp, rdx
mov word [rsp + 0x30], r14w
mov rsi, rcx
mov edi, 0x28
test al, al
je 0x1400238e1
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], r14b
lea rcx, [rsp + 0x24]
call fcn.140032f1c
cmp rax, 1
jne 0x140023917
mov rcx, rdi
mov rax, rbx
cmp word [rbx], r14w
je 0x1400238bd
add rax, 2
dec rcx
cmp word [rax], r14w
jne 0x1400238b0
cmp rcx, 1
jb 0x140023917
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], r14w
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x140023880
mov rdx, rbp
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140023c80
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.140032cc8
int3

Function at 0x140023b00
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x140061240]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor ebp, ebp
mov rsi, rcx
mov word [rsp + 0x30], bp
mov edi, 0x28
test al, al
je 0x140023baf
nop dword [rax]
nop dword [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], bpl
lea rcx, [rsp + 0x24]
call fcn.140032f1c
cmp rax, 1
jne 0x140023be5
mov rcx, rdi
mov rax, rbx
cmp word [rbx], bp
je 0x140023b8c
nop
add rax, 2
dec rcx
cmp word [rax], bp
jne 0x140023b80
cmp rcx, 1
jb 0x140023be5
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], bp
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x140023b50
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140023c80
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.140032cc8
int3

Function at 0x1400246e8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140024732
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140024732
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140024732
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140024732
cmp dword [rcx + 0x84], 0xe
jbe 0x140024732
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140024734
xor al, al
add rsp, 0x28
ret
Function at 0x140028a54
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140028ac3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140028ac3
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140028ac3
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140028ac3
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140028ac3
cmp dword [rcx + 0x84], 0xe
jbe 0x140028ac3
cmp dword [rcx + 0xf8], 0
je 0x140028ac3
mov ecx, ebx
call fcn.140028b74
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140028950
nop
cmp dword [rbp + 0x20], 0
je 0x140028b11
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140028b1c
int3
xor r8d, r8d
xor edx, edx
jmp 0x140028a54

Function at 0x140028c58
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140028ac3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140028ac3
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140028ac3
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140028ac3
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140028ac3
cmp dword [rcx + 0x84], 0xe
jbe 0x140028ac3
cmp dword [rcx + 0xf8], 0
je 0x140028ac3
mov ecx, ebx
call fcn.140028b74
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140028950
nop
cmp dword [rbp + 0x20], 0
je 0x140028b11
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140028b1c
int3
xor r8d, r8d
xor edx, edx
jmp 0x140028a54
Function at 0x14003a810
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14003a897
mov rsi, rbx
cmp word [rax], bp
je 0x14003a856
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14003a840
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14003a83c
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140035a8c
mov rdi, rax
test rax, rax
je 0x14003a884
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1400404d0
mov rbp, rdi
xor ecx, ecx
call fcn.1400369c0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14003cb40
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14003cb56
mov al, 1
jmp 0x14003cbb6
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14003cb67
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14003cbb4
mov ecx, dword [rcx + 0x18]
nop
call fcn.14003ab58
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003cbb4
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14003cbb4
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14003cbb4
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14003cbb6
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x140040320
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140040348
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140040348
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret