joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140021ff0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rbx, rcx
xor r15d, r15d
mov dword [rbp - 0x19], r15d
mov qword [rcx], r15
mov qword [rcx + 8], r15
mov qword [rcx + 0x10], r15
mov esi, 1
mov dword [rbp - 0x19], esi
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov r14d, eax
mov edi, r15d
movabs r12, 0x7ffffffffffffffe
bt r14d, edi
jae 0x1400221b7
xorps xmm0, xmm0
movups xmmword [rbp - 0x11], xmm0
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov r8d, 2
lea rdx, [0x140058d7c]
lea rcx, [rbp - 0x11]
call fcn.140001f70
nop
lea rax, [rbp - 0x11]
cmp qword [rbp + 7], 7
cmova rax, qword [rbp - 0x11]
add word [rax], di
lea rcx, [rbp - 0x11]
cmp qword [rbp + 7], 7
cmova rcx, qword [rbp - 0x11]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
lea ecx, [rax - 2]
test ecx, 0xfffffffa
jne 0x14002217b
cmp eax, 7
je 0x14002217b
mov rax, r12
mov rcx, qword [rbp - 1]
sub rax, rcx
cmp rax, 4
jb 0x1400221e1
lea rax, [rbp - 0x11]
cmp qword [rbp + 7], 7
cmova rax, qword [rbp - 0x11]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 4
lea r9, str.__
lea rcx, [rbp + 0xf]
call fcn.140008a80
or esi, 2
mov dword [rbp - 0x19], esi
mov rdx, qword [rbp + 7]
cmp rdx, 7
jbe 0x14002213e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140022139
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400221ed
call fcn.1400256e4
movups xmm0, xmmword [rbp + 0xf]
movups xmmword [rbp - 0x11], xmm0
movups xmm1, xmmword [rbp + 0x1f]
movups xmmword [rbp - 1], xmm1
mov rax, qword [rbx + 8]
cmp rax, qword [rbx + 0x10]
je 0x14002216b
lea rdx, [rbp - 0x11]
mov rcx, rax
call fcn.1400021c0
add qword [rbx + 8], 0x20
jmp 0x14002217b
lea r8, [rbp - 0x11]
mov rdx, rax
mov rcx, rbx
call fcn.140023840
nop
mov rdx, qword [rbp + 7]
cmp rdx, 7
jbe 0x1400221b7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x11]
cmp rdx, 0x1000
mov rax, rcx
jb 0x1400221b2
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400221e7
call fcn.1400256e4
inc edi
cmp edi, 0x1a
jb 0x140022046
mov rax, rbx
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.1400016e0
nop
call fcn.140036a34
nop
call fcn.140036a34
int3
Function at 0x140022200
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rbp
push rdi
push r14
lea rbp, [rsp - 0x780]
sub rsp, 0x880
mov rbx, rcx
xor r14d, r14d
mov dword [rsp + 0x40], r14d
mov qword [rcx], r14
mov qword [rcx + 8], r14
mov qword [rcx + 0x10], r14
mov dword [rsp + 0x40], 1
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, eax
mov edi, r14d
nop dword [rax + rax]
bt esi, edi
jae 0x1400223f2
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r14
mov r8d, 2
lea rdx, [0x140058d7c]
lea rcx, [rsp + 0x20]
call fcn.140001f70
nop
lea rax, [rsp + 0x20]
cmp qword [rsp + 0x38], 7
cmova rax, qword [rsp + 0x20]
add word [rax], di
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 7
cmova rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 4
jne 0x1400223b4
mov dword [rbp + 0x7a8], 0x404
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 7
cmova rcx, qword [rsp + 0x20]
lea r8, [rbp + 0x7a8]
lea rdx, [rsp + 0x70]
call qword [sym.imp.MPR.dll_WNetGetConnectionW]
test eax, eax
jne 0x1400223a5
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], r14
lea rax, [rsp + 0x70]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140022310
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.140001f70
nop
mov rdx, qword [rbx + 8]
cmp rdx, qword [rbx + 0x10]
je 0x140022358
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [rdx + 0x10], xmm1
mov edx, 7
mov word [rsp + 0x48], r14w
add qword [rbx + 8], 0x20
jmp 0x14002236a
lea r8, [rsp + 0x48]
mov rcx, rbx
call fcn.14000c1c0
mov rdx, qword [rsp + 0x60]
cmp rdx, 7
jbe 0x1400223b4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002239e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140022418
call fcn.1400256e4
jmp 0x1400223b4
mov edx, eax
lea rcx, str.____WNetGetConnection_failed_0x_X_n
call fcn.140001dd0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 7
jbe 0x1400223f2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
cmp rdx, 0x1000
mov rax, rcx
jb 0x1400223ed
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002241e
call fcn.1400256e4
inc edi
cmp edi, 0x1a
jb 0x140022250
mov rax, rbx
lea r11, [rsp + 0x880]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.140036a34
nop
call fcn.140036a34
int3
Function at 0x140022a40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x40
mov r14, rcx
xor r12d, r12d
mov rsi, qword [r8]
mov r8, rsi
lea edx, [r12 + 0x65]
lea rcx, str.____Get_resource_with_id__i_and_type__s..._n
call fcn.140001dd0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
test rax, rax
je 0x140022bc6
mov r8, rsi
lea edx, [r12 + 0x65]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x140022bc6
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140022bc6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbp, rax
test rax, rax
je 0x140022bc6
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
mov esi, r12d
mov qword [rsp + 0x38], r12
test eax, eax
je 0x140022b27
mov edx, ebx
lea rcx, [rsp + 0x28]
call fcn.140009a50
mov r8d, ebx
xor edx, edx
mov rdi, qword [rsp + 0x28]
mov rcx, rdi
call fcn.140047b00
lea r15, [rbx + rdi]
mov qword [rsp + 0x30], r15
mov rsi, qword [rsp + 0x38]
jmp 0x140022b31
mov r15, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
sub r15, rdi
mov r8, r15
mov rdx, rbp
mov rcx, rdi
call fcn.140047460
mov byte [r14], 1
mov qword [r14 + 8], r12
mov qword [r14 + 0x10], r12
mov qword [r14 + 0x18], r12
test r15, r15
je 0x140022b90
movabs rax, 0x7fffffffffffffff
cmp r15, rax
ja 0x140022c11
mov rdx, r15
lea rcx, [r14 + 8]
call fcn.140009a50
mov rbx, qword [r14 + 8]
mov r8, r15
mov rdx, rdi
mov rcx, rbx
call fcn.140047460
lea rax, [r15 + rbx]
mov qword [r14 + 0x10], rax
test rdi, rdi
je 0x140022be9
sub rsi, rdi
mov rax, rdi
cmp rsi, 0x1000
jb 0x140022bb9
add rsi, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140022c0b
mov rdx, rsi
mov rcx, rdi
call fcn.1400256e4
jmp 0x140022be9
mov r8, rsi
mov edx, 0x65
lea rcx, str.____Resource_with_id__i_and_type__s_not_found_n
call fcn.140001dd0
mov byte [r14], r12b
mov qword [r14 + 8], r12
mov qword [r14 + 0x10], r12
mov qword [r14 + 0x18], r12
mov rax, r14
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
ret
call fcn.140036a34
nop
call fcn.1400062a0
nop
int3
Function at 0x140022c20
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0xe0
cmp qword [rcx + 0x18], 7
lea r14, [rcx + 0x18]
mov rbx, rcx
mov rdx, rcx
jbe 0x140022c4c
mov rdx, qword [rcx]
lea rcx, str.____Run_sync_command:__s_n
mov qword [rsp + 0xf0], rdi
call fcn.140001dd0
xorps xmm0, xmm0
mov dword [rsp + 0x70], 0x68
xor eax, eax
mov rdx, rbx
cmp qword [rbx + 0x18], 7
movups xmmword [rsp + 0x78], xmm0
mov qword [rsp + 0x60], rax
movups xmmword [rsp + 0x88], xmm0
movups xmmword [rsp + 0x98], xmm0
movups xmmword [rsp + 0xa8], xmm0
movups xmmword [rsp + 0xb8], xmm0
movups xmmword [rsp + 0xc8], xmm0
movups xmmword [rsp + 0x50], xmm0
jbe 0x140022cb7
mov rdx, qword [rbx]
lea rdi, [rbx + 0x18]
jmp 0x140022cba
mov rdi, r14
xor ebp, ebp
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
xor r9d, r9d
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x140022d68
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp qword [rbx + 0x18], 7
mov rdx, rbx
jbe 0x140022d11
mov rdx, qword [rbx]
lea rsi, [rbx + 0x18]
jmp 0x140022d14
mov rsi, rdi
mov r8d, eax
lea rcx, str.____Failed_to_run_sync_command:__s__error_0x_X_n
call fcn.140001dd0
mov rdx, qword [r14]
cmp rdx, 7
jbe 0x140022d64
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140022d5c
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140022deb
mov rcx, r8
call fcn.1400256e4
mov rdi, rsi
xor al, al
jmp 0x140022dbb
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbx + 0x18]
cmp rdx, 7
jbe 0x140022db9
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140022db4
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140022deb
mov rcx, r8
call fcn.1400256e4
mov al, 1
mov word [rbx], bp
lea r11, [rsp + 0xe0]
mov rsi, qword [r11 + 0x28]
mov qword [rdi], 7
mov rdi, qword [rsp + 0xf0]
mov qword [rbx + 0x10], rbp
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsp, r11
pop r14
ret
call fcn.140036a34
int3
Function at 0x140023210
Capabilities:
Create process on windows
Get explorer pid
Spoof parent pid

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0xe0
mov rbx, rcx
mov rdx, rcx
lea rdi, [rcx + 0x18]
cmp qword [rcx + 0x18], 7
jbe 0x14002323a
mov rdx, qword [rcx]
lea rcx, str.____RunNonElevated:__s_n
call fcn.140001dd0
call qword [sym.imp.USER32.dll_GetShellWindow]
lea rdx, [rsp + 0x128]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rsp + 0x128]
xor edx, edx
mov ecx, 0x80
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x138], rax
lea r9, [rsp + 0x130]
xor r8d, r8d
lea edx, [r8 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
mov rcx, qword [rsp + 0x130]
call fcn.140025730
mov r15, rax
lea r9, [rsp + 0x130]
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
xor r12d, r12d
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], 8
lea r9, [rsp + 0x138]
xor edx, edx
mov r8d, 0x20000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x74], xmm0
movups xmmword [rsp + 0x84], xmm0
movups xmmword [rsp + 0x94], xmm0
movups xmmword [rsp + 0xa4], xmm0
movups xmmword [rsp + 0xb4], xmm0
movups xmmword [rsp + 0xc4], xmm0
mov dword [rsp + 0xd4], eax
mov qword [rsp + 0xd8], r15
mov dword [rsp + 0x70], 0x70
mov rdx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x140023340
mov rdx, qword [rbx]
jmp 0x140023344
lea rdi, [rbx + 0x18]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80010
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov r14d, eax
mov rbp, rdi
test eax, eax
jne 0x1400233ad
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x14002339a
mov rdx, qword [rbx]
mov r8d, eax
lea rcx, str.____Failed_to_RunNonElevated:__s__error_0x_X_n
call fcn.140001dd0
lea rbp, [rbx + 0x18]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r15
call fcn.1400256e4
mov rcx, qword [rsp + 0x138]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14d, r14d
setne sil
mov rdx, qword [rdi]
cmp rdx, 7
jbe 0x140023421
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbx]
mov rdi, rbp
cmp rdx, 0x1000
jb 0x14002341c
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140023446
mov rcx, r8
lea rdi, [rbx + 0x18]
call fcn.1400256e4
mov qword [rbx + 0x10], r12
mov qword [rdi], 7
mov word [rbx], r12w
movzx eax, sil
add rsp, 0xe0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.140036a34
int3
Function at 0x140023cfc
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x140023d36
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x140023d3b
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140023d84
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x14004c830]
cmp byte [rcx + rax], 0
je 0x140023d84
dec r8
sub rdx, 1
jne 0x140023d6a
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140026218
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140026262
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140026262
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140026262
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140026262
cmp dword [rcx + 0x84], 0xe
jbe 0x140026262
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140026264
xor al, al
add rsp, 0x28
ret

Function at 0x140037d24
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, edx
mov rbp, rcx
test r8, r8
jne 0x140037d5b
call fcn.140037b58
mov dword [rax], 0x16
call fcn.140036a14
xor eax, eax
jmp 0x140037de9
mov rdx, r9
mov rcx, r8
call fcn.140037cc0
mov rbx, rax
test rax, rax
je 0x140037de6
lea rax, [rsp + 0x50]
mov rdx, rsi
mov qword [rsp + 0x28], rax
lea r8, [0x140037bec]
mov eax, dword [rsp + 0x60]
mov r9, rbx
mov rcx, rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x140037dd3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140037acc
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140037dba
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x140037dc9
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call fcn.140039c6c
jmp 0x140037de6
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140037de3
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
mov rdi, rdx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x140038900
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400386fc
Function at 0x14003e2e4
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14003e2fa
mov al, 1
jmp 0x14003e35a
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14003e30b
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14003e358
mov ecx, dword [rcx + 0x18]
nop
call fcn.1400406f8
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003e358
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14003e358
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14003e358
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14003e35a
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x14003f764
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14003f794
xor eax, eax
jmp 0x14003f857
mov rbp, rbx
cmp word [rax], si
je 0x14003f7b9
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14003f7a0
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14003f79c
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14003f684
movsxd r14, eax
test eax, eax
jne 0x14003f7f7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14003f78d
mov rcx, r14
call fcn.140039ca8
mov rdi, rax
test rax, rax
jne 0x14003f810
xor ecx, ecx
call fcn.140039c6c
jmp 0x14003f7ec
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14003f684
test eax, eax
jne 0x14003f841
mov rcx, rdi
call fcn.140039c6c
jmp 0x14003f84b
xor ecx, ecx
call fcn.140039c6c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x14003f874
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14003f8fb
mov rsi, rbx
cmp word [rax], bp
je 0x14003f8ba
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14003f8a4
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14003f8a0
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140039ca8
mov rdi, rax
test rax, rax
je 0x14003f8e8
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140047460
mov rbp, rdi
xor ecx, ecx
call fcn.140039c6c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140045394
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.140032c4c
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14004541e
cmp byte [rbp - 0x21], r15b
je 0x140045419
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x140045454
call fcn.14003c420
test eax, eax
jne 0x140045440
cmp byte [rbp - 0x21], r15b
je 0x140045438
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x140045454
cmp byte [rbp - 0x21], r15b
je 0x140045451
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14003db3c
test eax, eax
jne 0x1400454f4
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.140032c4c
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x140045493
cmp byte [rbp - 0x21], r15b
je 0x1400454c8
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x1400454c8
call fcn.14003c420
test eax, eax
jne 0x1400454b4
cmp byte [rbp - 0x21], r15b
je 0x1400454ad
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x1400454c8
cmp byte [rbp - 0x21], r15b
je 0x1400454c5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14003db3c
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x1400454f4
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x1400454f7
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x140045505
mov rcx, rdi
call fcn.140039c6c
cmp byte [rbp + 0x3f], r15b
je 0x140045514
mov rcx, qword [rbp + 0x27]
call fcn.140039c6c
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x140046f10
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140046f38
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140046f38
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret