joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402453f0
Capabilities:
Print debug messages

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa8
mov edi, 3
test rcx, rcx
je 0x14024548e
mov rsi, rdx
mov rbx, rcx
lea rcx, [0x1402d6540]
call fcn.1401ed330
mov rcx, qword [0x1402d6810]
test rcx, rcx
je 0x140245482
cmp rcx, 1
jne 0x14024543d
mov rax, qword [0x1402d6818]
cmp qword [rax + 8], rbx
jne 0x140245482
jmp 0x1402454a0
dec rcx
mov rax, qword [0x1402d6818]
xor edx, edx
jmp 0x14024545b
inc r8
mov rdx, r8
cmp rdx, rcx
ja 0x140245482
lea r8, [rdx + rcx]
shr r8, 1
mov r9, r8
shl r9, 4
cmp qword [rax + r9 + 8], rbx
je 0x14024549d
jbe 0x140245450
cmp r8, rdx
je 0x140245482
dec r8
mov rcx, r8
cmp rdx, rcx
jbe 0x14024545b
lea rcx, [0x1402d6540]
call fcn.1401ed4a0
mov eax, edi
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop r14
ret
add rax, r9
mov r14, qword [rax]
lea rcx, [0x1402d6540]
call fcn.1401ed4a0
test r14, r14
je 0x14024548e
mov rcx, qword [r14 + 0x28]
test rcx, rcx
je 0x14024548e
lea rdx, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.DLL_GetHandleInformation]
test eax, eax
je 0x14024548e
mov edi, 0x16
test byte [r14 + 0x44], 4
jne 0x14024548e
call fcn.140243500
test rax, rax
je 0x1402454eb
mov rax, qword [rax + 0x1d8]
jmp 0x1402454ed
xor eax, eax
mov edi, 0x24
cmp rax, rbx
je 0x14024548e
cmp dword [r14 + 0xbc], 0
mov rcx, qword [r14 + 0x28]
je 0x14024550f
lea rax, [rcx + 1]
cmp rax, 2
jb 0x14024551e
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov rcx, qword [r14 + 0x28]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rcx, qword [r14 + 0x30]
test rcx, rcx
je 0x140245533
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov qword [r14 + 0x30], 0
test rsi, rsi
je 0x140245547
mov rax, qword [r14 + 8]
mov qword [rsi], rax
lea rcx, [r14 + 0x38]
call fcn.1401ed640
lea rcx, [r14 + 0x68]
call fcn.140250cd0
cmp eax, 1
je 0x140245575
mov qword [r14 + 0x68], 0xffffffffffffffff
mov rcx, r14
call fcn.1402442b0
xor edi, edi
jmp 0x14024548e
movups xmm0, xmmword [0x14028655b]
movups xmmword [rsp + 0x8b], xmm0
movaps xmm0, xmmword [0x140286550]
movaps xmmword [rsp + 0x80], xmm0
movaps xmm0, xmmword [0x140286540]
movaps xmmword [rsp + 0x70], xmm0
movaps xmm0, xmmword [0x140286530]
movaps xmmword [rsp + 0x60], xmm0
movaps xmm0, xmmword [0x140286520]
movaps xmmword [rsp + 0x50], xmm0
movaps xmm0, xmmword [0x140286510]
movaps xmmword [rsp + 0x40], xmm0
movaps xmm0, xmmword [str.Error_cleaning_up_spin_keys_for_thread]
movaps xmmword [rsp + 0x30], xmm0
call qword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
lea rdx, [rsp + 0x57]
mov ecx, eax
mov r8d, 0xa
call qword [sym.imp.msvcrt.dll__ultoa]
mov eax, 0x27
mov rcx, rax
inc rax
cmp byte [rsp + rcx + 0x30], 0
je 0x140245600
cmp rcx, 0x6a
jb 0x1402455ed
cmp rcx, 0x69
ja 0x14024560d
mov word [rsp + rax + 0x2f], 0xa
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
call sub.msvcrt.dll_abort
int3
Function at 0x140245860
Capabilities:
Print debug messages

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rbx, rcx
lea rcx, [0x1402d6540]
call fcn.1401ed330
mov esi, 3
test rbx, rbx
je 0x1402459a8
mov rcx, qword [0x1402d6810]
test rcx, rcx
je 0x1402458a6
cmp rcx, 1
jne 0x1402458aa
mov rax, qword [0x1402d6818]
cmp qword [rax + 8], rbx
je 0x1402458f7
xor edi, edi
jmp 0x1402458fa
dec rcx
mov rax, qword [0x1402d6818]
xor edi, edi
xor edx, edx
jmp 0x1402458cb
inc r8
mov rdx, r8
cmp rdx, rcx
ja 0x1402458fa
lea r8, [rdx + rcx]
shr r8, 1
mov r9, r8
shl r9, 4
cmp qword [rax + r9 + 8], rbx
je 0x1402458f4
jbe 0x1402458c0
cmp r8, rdx
je 0x1402458fa
dec r8
mov rcx, r8
cmp rdx, rcx
jbe 0x1402458cb
jmp 0x1402458fa
add rax, r9
mov rdi, qword [rax]
lea rbx, [0x1402d6540]
mov rcx, rbx
call fcn.1401ed4a0
mov rcx, rbx
call fcn.1401ed330
test rdi, rdi
je 0x1402459a8
mov rcx, qword [rdi + 0x28]
test rcx, rcx
je 0x1402459a8
lea rdx, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.DLL_GetHandleInformation]
test eax, eax
je 0x1402459a8
mov eax, dword [rdi + 0x44]
mov esi, 0x16
test al, 4
jne 0x1402459a8
mov rcx, qword [rdi + 0x28]
mov qword [rdi + 0x28], 0
or eax, 4
mov dword [rdi + 0x44], eax
xor esi, esi
test rcx, rcx
je 0x1402459a8
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp dword [rdi + 0xbc], 0
je 0x1402459a8
mov rcx, qword [rdi + 0x30]
test rcx, rcx
je 0x140245979
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov qword [rdi + 0x30], 0
lea rcx, [rdi + 0x38]
call fcn.1401ed640
lea rcx, [rdi + 0x68]
call fcn.140250cd0
cmp eax, 1
je 0x1402459c1
mov qword [rdi + 0x68], 0xffffffffffffffff
mov rcx, rdi
call fcn.1402442b0
lea rcx, [0x1402d6540]
call fcn.1401ed4a0
mov eax, esi
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
ret
movups xmm0, xmmword [0x14028655b]
movups xmmword [rsp + 0x8b], xmm0
movaps xmm0, xmmword [0x140286550]
movaps xmmword [rsp + 0x80], xmm0
movaps xmm0, xmmword [0x140286540]
movaps xmmword [rsp + 0x70], xmm0
movaps xmm0, xmmword [0x140286530]
movaps xmmword [rsp + 0x60], xmm0
movaps xmm0, xmmword [0x140286520]
movaps xmmword [rsp + 0x50], xmm0
movaps xmm0, xmmword [0x140286510]
movaps xmmword [rsp + 0x40], xmm0
movaps xmm0, xmmword [str.Error_cleaning_up_spin_keys_for_thread]
movaps xmmword [rsp + 0x30], xmm0
call qword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
lea rdx, [rsp + 0x57]
mov ecx, eax
mov r8d, 0xa
call qword [sym.imp.msvcrt.dll__ultoa]
mov eax, 0x27
mov rcx, rax
inc rax
cmp byte [rsp + rcx + 0x30], 0
je 0x140245a4c
cmp rcx, 0x6a
jb 0x140245a39
cmp rcx, 0x69
ja 0x140245a59
mov word [rsp + rax + 0x2f], 0xa
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
call sub.msvcrt.dll_abort
int3

Function at 0x1402475e0
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x28
xor eax, eax
test edx, edx
setne al
mov dword [rsp + 0x24], eax
lea r8, [rsp + 0x24]
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
nop
add rsp, 0x28
ret
Function at 0x14024cd50
Capabilities:
Get hostname

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov ebx, edx
mov rdi, rcx
mov byte [rcx], 0
call qword [sym.imp.WS2_32.dll_gethostname]
mov esi, eax
movsxd rax, ebx
mov byte [rax + rdi - 1], 0
test esi, esi
jne 0x14024cd88
mov rcx, rdi
mov edx, 0x2e
call sub.msvcrt.dll_strchr
test rax, rax
je 0x14024cd88
mov byte [rax], 0
mov eax, esi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x14024cf80
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rcx, rdx
mov rdx, r8
mov r8, rbx
call fcn.14024cfd0
lea rdx, [rsi + 8]
lea r8, [rbx + 7]
mov rcx, rdi
call fcn.14024cfd0
add rsi, 0x10
add rbx, 0xe
mov rcx, rdi
mov rdx, rsi
mov r8, rbx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.14024cfd0

Function at 0x14024cfd0
Capabilities:
Create new key via cryptacquirecontext
Encrypt or decrypt via wincrypt

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
mov dword [rsp + 0x4c], 8
mov dword [rsp + 0x20], 0xf0000040
lea rcx, [rsp + 0x58]
xor edx, edx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x14024d133
movabs rax, 0x660100000000
mov qword [rsp + 0x38], rax
mov word [rsp + 0x38], 0x208
mov dword [rsp + 0x40], 8
lea rcx, [rsp + 0x44]
movzx eax, byte [rbx + 4]
mov edx, dword [rbx]
movd xmm0, edx
mov byte [rsp + 0x44], dl
movdqa xmm1, xmm0
psrld xmm1, 8
movd xmm2, eax
pslld xmm2, 0x18
movdqa xmm3, xmmword [0x140286ed0]
pandn xmm3, xmm2
por xmm3, xmm1
punpcklbw xmm3, xmm0
pmullw xmm3, xmmword [0x140286ee0]
psrlw xmm3, 8
packuswb xmm3, xmm3
movd dword [rsp + 0x45], xmm3
movzx edx, byte [rbx + 5]
lea eax, [rax*8]
mov r8d, edx
shr r8b, 5
or r8b, al
mov byte [rsp + 0x49], r8b
movzx eax, byte [rbx + 6]
shl dl, 2
mov r8d, eax
shr r8b, 6
or r8b, dl
mov byte [rsp + 0x4a], r8b
add al, al
mov byte [rsp + 0x4b], al
mov edx, 8
call fcn.140255f40
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
lea rdx, [rsp + 0x38]
mov r8d, 0x14
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x14024d126
mov rax, qword [rdi]
mov qword [rsi], rax
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x30], 8
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x58]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
nop
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
Function at 0x140254ee0
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
mov dword [rsp + 0x20], 0xf0000040
lea rcx, [rsp + 0x30]
xor edx, edx
xor r8d, r8d
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x140254f32
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov edx, 0x800c
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
mov rcx, rbx
call fcn.1401a1dc0
mov rcx, qword [rsp + 0x38]
mov rdx, rdi
mov r8d, eax
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov dword [rsp + 0x2c], 0
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2c]
mov edx, 2
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [rsp + 0x2c], 0x20
jne 0x140254f9d
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2c]
mov edx, 2
mov r8, rsi
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140254fad
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140254fbf
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret

Function at 0x1402550b0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov ebp, r8d
mov rbx, rdx
mov rsi, rcx
mov eax, dword [rcx + 0x18]
mov ecx, dword [rcx + 0x20]
add eax, eax
add rcx, rax
add rcx, 0x18
mov rax, qword [0x1402654c8]
call qword [rax]
mov rdi, rax
test rax, rax
je 0x1402551db
mov qword [rdi], rsi
lea rcx, [rdi + 0x18]
mov qword [rdi + 8], rcx
mov eax, dword [rsi + 0x18]
add rax, rdi
add rax, 0x18
mov qword [rdi + 0x10], rax
cmp dword [rsi + 0x1c], ebp
jae 0x140255130
call qword [rsi]
mov rcx, qword [rdi + 8]
mov rdx, rbx
mov r8d, ebp
call qword [rsi + 8]
mov ebx, dword [rsi + 0x18]
add rbx, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, rbx
call qword [rsi + 0x10]
mov ebp, dword [rsi + 0x20]
mov rcx, qword [rdi + 8]
call qword [rsi]
mov rcx, qword [rdi + 0x10]
call qword [rsi]
mov r15d, ebp
test ebp, ebp
je 0x14025518e
xor r12d, r12d
lea r14, [rsp + 0x2f]
nop word [rax + rax]
movzx eax, byte [rbx + r12]
xor al, 0x36
mov byte [rsp + 0x2f], al
mov rcx, qword [rdi + 8]
mov rdx, r14
mov r8d, 1
call qword [rsi + 8]
movzx eax, byte [rbx + r12]
xor al, 0x5c
mov byte [rsp + 0x2f], al
mov rcx, qword [rdi + 0x10]
mov rdx, r14
mov r8d, 1
call qword [rsi + 8]
inc r12
cmp r15, r12
jne 0x140255150
cmp r15d, dword [rsi + 0x1c]
jae 0x1402551db
lea rbx, str.6Kerberos
lea r14, [0x1402875d9]
nop word cs:[rax + rax]
mov rcx, qword [rdi + 8]
mov rdx, rbx
mov r8d, 1
call qword [rsi + 8]
mov rcx, qword [rdi + 0x10]
mov rdx, r14
mov r8d, 1
call qword [rsi + 8]
inc r15
mov eax, dword [rsi + 0x1c]
cmp r15, rax
jb 0x1402551b0
mov rax, rdi
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1402563e0
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x20], 0xf0000040
lea rcx, [rsp + 0x30]
xor edx, edx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x14025643a
lea rax, [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov edx, 0x8002
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
mov rcx, rbx
call fcn.1401a1dc0
mov rcx, qword [rsp + 0x38]
mov rdx, rdi
mov r8d, eax
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov dword [rsp + 0x2c], 0
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2c]
mov edx, 2
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [rsp + 0x2c], 0x10
jne 0x1402564a5
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2c]
mov edx, 2
mov r8, rsi
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1402564b5
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1402564c7
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
Function at 0x16478
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x1b0
mov rax, qword [0x00012600]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov rdi, r9
mov r12d, r8d
mov rbp, rdx
mov rsi, rcx
mov rax, cr8
xor ebx, ebx
cmp al, bl
je 0x164b6
lea eax, [rbx + 1]
jmp 0x165af
lea rcx, [rsp + 0xa0]
xor edx, edx
mov r8d, 0x100
call fcn.00011ce0
lea r11, [rdi + 0x14f8]
lea rax, str.RegistryMACHINESystemCurrentControlSetMkbuz
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x30], rax
lea rax, [0x0001b510]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0xa0]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x100
mov dword [rsp + 0x20], 0x800
call fcn.00010590
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rsp + 0x88]
lea r8, [rsp + 0x48]
lea rcx, [rsp + 0x40]
mov edx, 0x20006
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x48], 0x30
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x60], 0x40
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbx
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, ebx
mov edi, eax
jl 0x165a8
lea rcx, [rsp + 0x78]
mov rdx, rsi
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x78]
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
cmp edi, ebx
setl bl
mov eax, ebx
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.00011e70
add rsp, 0x1b0
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140001cd0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001d1a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001d1a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001d1a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001d1a
cmp dword [rcx + 0x84], 0xe
jbe 0x140001d1a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001d1c
xor al, al
add rsp, 0x28
ret

Function at 0x140008200
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000806b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000806b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000806b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000806b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000806b
cmp dword [rcx + 0x84], 0xe
jbe 0x14000806b
cmp dword [rcx + 0xf8], 0
je 0x14000806b
mov ecx, ebx
call fcn.14000811c
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140007ef8
nop
cmp dword [rbp + 0x20], 0
je 0x1400080b9
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400080c4
int3
xor r8d, r8d
xor edx, edx
jmp 0x140007ffc
Function at 0x14000dcf8
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14000dd28
xor eax, eax
jmp 0x14000ddeb
mov rbp, rbx
cmp word [rax], si
je 0x14000dd4d
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14000dd34
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14000dd30
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14000dc18
movsxd r14, eax
test eax, eax
jne 0x14000dd8b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14000dd21
mov rcx, r14
call fcn.14000aa68
mov rdi, rax
test rax, rax
jne 0x14000dda4
xor ecx, ecx
call fcn.140009df0
jmp 0x14000dd80
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14000dc18
test eax, eax
jne 0x14000ddd5
mov rcx, rdi
call fcn.140009df0
jmp 0x14000dddf
xor ecx, ecx
call fcn.140009df0
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140011f6c
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x140011f82
mov al, 1
jmp 0x140011fe2
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x140011f93
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140011fe0
mov ecx, dword [rcx + 0x18]
nop
call fcn.14000e4fc
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140011fe0
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140011fe0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140011fe0
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x140011fe2
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x140013020
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.14000cce8
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x1400130aa
cmp byte [rbp - 0x21], r15b
je 0x1400130a5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x1400130e0
call fcn.14000a040
test eax, eax
jne 0x1400130cc
cmp byte [rbp - 0x21], r15b
je 0x1400130c4
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x1400130e0
cmp byte [rbp - 0x21], r15b
je 0x1400130dd
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14000c2c8
test eax, eax
jne 0x140013180
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.14000cce8
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14001311f
cmp byte [rbp - 0x21], r15b
je 0x140013154
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140013154
call fcn.14000a040
test eax, eax
jne 0x140013140
cmp byte [rbp - 0x21], r15b
je 0x140013139
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x140013154
cmp byte [rbp - 0x21], r15b
je 0x140013151
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14000c2c8
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x140013180
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x140013183
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x140013191
mov rcx, rdi
call fcn.140009df0
cmp byte [rbp + 0x3f], r15b
je 0x1400131a0
mov rcx, qword [rbp + 0x27]
call fcn.140009df0
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x140015710
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140015738
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140015738
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140001000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rax, qword gs:[0x60]
mov r15, qword [rax + 0x18]
add r15, 0x20
xor r13d, r13d
mov r14, qword [r15]
mov rsi, qword [r14 + 0x40]
test rsi, rsi
je 0x1400010a7
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rsi + rbx*2], r13w
jne 0x140001052
inc ebx
lea ebp, [rbx + rbx]
mov ecx, ebp
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov rdi, rax
test rax, rax
je 0x1400010aa
mov qword [rsp + 0x38], r13
mov r9d, ebx
mov qword [rsp + 0x30], r13
mov r8, rsi
mov dword [rsp + 0x28], ebp
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x1400010aa
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rdi, r13
lea rdx, str.ntdll.dll
mov rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_strstr]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test rbx, rbx
jne 0x1400010dc
mov r14, qword [r14]
cmp r14, r15
jne 0x140001042
mov r14, r13
jmp 0x1400010e0
mov r14, qword [r14 + 0x20]
movsxd rax, dword [r14 + 0x3c]
mov edi, r13d
mov r15d, dword [rax + r14 + 0x88]
add r15, r14
mov esi, dword [r15 + 0x20]
mov ebp, dword [r15 + 0x24]
add rsi, r14
mov r12d, dword [r15 + 0x1c]
add rbp, r14
add r12, r14
cmp dword [r15 + 0x18], r13d
jbe 0x140001141
nop dword [rax]
movzx eax, word [rbp]
lea rdx, str.NTQuerySystemInformation
mov ecx, dword [rsi]
add rcx, r14
mov ebx, dword [r12 + rax*4]
add rbx, r14
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x140001144
inc edi
add rsi, 4
add rbp, 2
cmp edi, dword [r15 + 0x18]
jb 0x140001110
mov rbx, r13
mov qword [0x140004668], rbx
mov esi, 1
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x44], r13d
test rbx, rbx
je 0x1400011d7
lea r9, [rsp + 0x40]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rbx
mov ebx, dword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x1400011d7
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x44]
mov rdx, rax
xor ecx, ecx
call qword [0x140004668]
mov ebx, r13d
test eax, eax
jne 0x1400011b3
cmp byte [rdi + 0x38], 2
cmovle ebx, esi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp ebx, esi
jne 0x1400011d7
mov rbx, qword [0x140004668]
jmp 0x140001150
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140001230
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret