joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18011061c
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.1800f746c
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x1801106a6
cmp byte [rbp - 0x21], r15b
je 0x1801106a1
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x1801106dc
call fcn.180109c84
test eax, eax
jne 0x1801106c8
cmp byte [rbp - 0x21], r15b
je 0x1801106c0
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x1801106dc
cmp byte [rbp - 0x21], r15b
je 0x1801106d9
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.1800fda90
test eax, eax
jne 0x18011077c
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.1800f746c
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x18011071b
cmp byte [rbp - 0x21], r15b
je 0x180110750
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x180110750
call fcn.180109c84
test eax, eax
jne 0x18011073c
cmp byte [rbp - 0x21], r15b
je 0x180110735
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x180110750
cmp byte [rbp - 0x21], r15b
je 0x18011074d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.1800fda90
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x18011077c
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x18011077f
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x18011078d
mov rcx, rdi
call fcn.1801099dc
cmp byte [rbp + 0x3f], r15b
je 0x18011079c
mov rcx, qword [rbp + 0x27]
call fcn.1801099dc
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x180111d9c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x180111dcc
xor eax, eax
jmp 0x180111e8f
mov rbp, rbx
cmp word [rax], si
je 0x180111df1
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x180111dd8
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x180111dd4
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.18010f05c
movsxd r14, eax
test eax, eax
jne 0x180111e2f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x180111dc5
mov rcx, r14
call fcn.18010a448
mov rdi, rax
test rax, rax
jne 0x180111e48
xor ecx, ecx
call fcn.1801099dc
jmp 0x180111e24
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.18010f05c
test eax, eax
jne 0x180111e79
mov rcx, rdi
call fcn.1801099dc
jmp 0x180111e83
xor ecx, ecx
call fcn.1801099dc
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x180111eac
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x180111f33
mov rsi, rbx
cmp word [rax], bp
je 0x180111ef2
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x180111edc
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x180111ed8
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.18010a448
mov rdi, rax
test rax, rax
je 0x180111f20
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.180129f80
mov rbp, rdi
xor ecx, ecx
call fcn.1801099dc
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1801176b0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1801176d8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1801176d8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x18011e080
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1e8
mov rax, qword [0x180173200]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov dword [rsp + 0x24], 0
mov eax, 1
mov word [rsp + 0x20], ax
lea rdx, [rsp + 0x30]
movzx ecx, word [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1800e95d0
add rsp, 0x1e8
ret

Function at 0x18011fbe0
Capabilities:
Set current directory

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x1078
call fcn.1800e9570
sub rsp, rax
mov rax, qword [0x180173200]
xor rax, rsp
mov qword [rsp + 0x1060], rax
xor ecx, ecx
call fcn.1800223b0
mov qword [rsp + 0x30], rax
mov edx, 0x800
lea rcx, [rsp + 0x850]
call fcn.180021700
mov rcx, qword [rsp + 0x30]
call fcn.18010670c
test eax, eax
je 0x18011fc5c
mov rax, qword [rsp + 0x1080]
mov dword [rax + 0x228], 0xffffff76
mov rax, qword [rsp + 0x1080]
mov eax, dword [rax + 0x228]
jmp 0x18011fccf
mov eax, 1
imul rax, rax, 1
lea rax, [rsp + rax + 0x40]
mov dword [rsp + 0x20], 1
mov r9, rax
mov r8, qword [rsp + 0x1090]
mov rdx, qword [rsp + 0x1088]
mov rcx, qword [rsp + 0x1080]
call fcn.1800240c0
mov eax, 1
imul rax, rax, 1
lea rax, [rsp + rax + 0x40]
mov rcx, rax
call fcn.180105e58
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x40], Ordinal_60
lea rcx, [rsp + 0x40]
call fcn.180105e58
lea rcx, [rsp + 0x850]
call fcn.18010670c
xor eax, eax
mov rcx, qword [rsp + 0x1060]
xor rcx, rsp
call fcn.1800e95d0
add rsp, 0x1078
ret

Function at 0x180124a80
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
mov qword [rax + 8], rcx
cmp qword [rsp + 0x30], 0
jne 0x180124ac5
mov eax, 1
jmp 0x180124b10
mov r8, qword [rsp + 0x60]
xor edx, edx
mov rcx, qword [rsp + 0x58]
call fcn.180104550
cdqe
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0xffffffffffffffff
je 0x180124af2
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
mov qword [rax], rcx
cmp qword [rsp + 0x28], 0xffffffffffffffff
jne 0x180124b04
mov dword [rsp + 0x20], 1
jmp 0x180124b0c
mov dword [rsp + 0x20], 0
mov eax, dword [rsp + 0x20]
add rsp, 0x48
ret

Function at 0x180127220
Capabilities:
Resolve dns

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x68
mov r8d, gethostbyname
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.18012a620
mov dword [rsp + 0x2c], 0
mov dword [rsp + 0x30], 1
lea r9, [0x180179418]
lea r8, [rsp + 0x28]
xor edx, edx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jne 0x18012727a
jmp 0x180127281
mov eax, 2
jmp 0x180127291
mov edx, dword [rsp + 0x80]
mov ecx, dword [rsp + 0x70]
call fcn.180127170
add rsp, 0x68
ret
Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x24], 0xe
mov byte [rsp + 0x25], 0x52
mov byte [rsp + 0x26], 2
mov byte [rsp + 0x27], 9
mov dword [rsp + 0x20], 0
jmp 0x14000102c
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
cmp rax, 0x31446
jae 0x14000108d
movsxd rax, dword [rsp + 0x20]
mov qword [rsp + 0x38], rax
lea rcx, str.C_bC__
movsxd rdx, dword [rsp + 0x20]
mov qword [rsp + 0x30], rdx
xor edx, edx
mov r8, qword [rsp + 0x30]
mov rax, r8
mov r8d, 4
div r8
mov rax, rdx
movsx eax, byte [rsp + rax + 0x24]
mov rdx, qword [rsp + 0x38]
movzx ecx, byte [rcx + rdx]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x20]
lea rdx, str.C_bC__
mov byte [rdx + rcx], al
jmp 0x140001022
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x31446
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
mov r8d, 0x31446
lea rdx, str.C_bC__
mov rcx, qword [rsp + 0x28]
call fcn.14000ebd0
call qword [rsp + 0x28]
xor eax, eax
add rsp, 0x48
ret

Function at 0x1400017fc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001846
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001846
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001846
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001846
cmp dword [rcx + 0x84], 0xe
jbe 0x140001846
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001848
xor al, al
add rsp, 0x28
ret

Function at 0x140004d88
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140004df7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140004df7
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140004df7
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140004df7
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140004df7
cmp dword [rcx + 0x84], 0xe
jbe 0x140004df7
cmp dword [rcx + 0xf8], 0
je 0x140004df7
mov ecx, ebx
call fcn.140004ea8
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140004c84
nop
cmp dword [rbp + 0x20], 0
je 0x140004e45
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140004e50
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x140004d88

Function at 0x140004f8c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140004d88
Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x24], 0xd7
mov byte [rsp + 0x25], 0xb1
mov byte [rsp + 0x26], 0xd1
mov byte [rsp + 0x27], 0xc8
mov dword [rsp + 0x20], 0
jmp 0x14000102c
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
cmp rax, 0x10600
jae 0x14000108d
movsxd rax, dword [rsp + 0x20]
mov qword [rsp + 0x38], rax
lea rcx, section..data
movsxd rdx, dword [rsp + 0x20]
mov qword [rsp + 0x30], rdx
xor edx, edx
mov r8, qword [rsp + 0x30]
mov rax, r8
mov r8d, 4
div r8
mov rax, rdx
movsx eax, byte [rsp + rax + 0x24]
mov rdx, qword [rsp + 0x38]
movzx ecx, byte [rcx + rdx]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x20]
lea rdx, section..data
mov byte [rdx + rcx], al
jmp 0x140001022
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10600
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
mov r8d, 0x10600
lea rdx, section..data
mov rcx, qword [rsp + 0x28]
call fcn.14000fbc0
call qword [rsp + 0x28]
xor eax, eax
add rsp, 0x48
ret

Function at 0x1400017fc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001846
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001846
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001846
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001846
cmp dword [rcx + 0x84], 0xe
jbe 0x140001846
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001848
xor al, al
add rsp, 0x28
ret

Function at 0x140005f7c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140005d78
Function at 0x140007420
Capabilities:
Create directory
Query environment variable

Disassembly:
push rdi
mov eax, 0x4030
call fcn.14000bda0
sub rsp, rax
mov rax, qword [0x14003f040]
xor rax, rsp
mov qword [rsp + 0x4020], rax
mov rdx, rcx
xor r8d, r8d
xor ecx, ecx
call fcn.140008bd0
mov rdi, rax
test rax, rax
jne 0x140007469
lea rcx, str.LOADER:_Failed_to_convert_runtime_tmpdir_to_a_wide_string._n
call fcn.140002b10
xor eax, eax
jmp 0x140007578
mov r8d, 0x1000
mov qword [rsp + 0x4048], rbx
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsW]
mov rcx, rdi
mov ebx, eax
call fcn.14001555c
test ebx, ebx
jne 0x1400074a6
lea rcx, str.LOADER:_Failed_to_expand_environment_variables_in_the_runtime_tmpdir._n
call fcn.140002b10
xor eax, eax
jmp 0x140007570
lea rcx, [rsp + 0x20]
call fcn.140008a70
test eax, eax
je 0x1400074c0
lea rcx, [rsp + 0x20]
call fcn.140017f84
jmp 0x1400074d2
mov r8d, 0x1000
lea rdx, [rsp + 0x20]
xor ecx, ecx
call fcn.140016908
mov rbx, rax
test rax, rax
jne 0x1400074ed
lea rcx, str.LOADER:_Failed_to_obtain_the_absolute_path_of_the_runtime_tmpdir._n
call fcn.140002b10
xor eax, eax
jmp 0x140007570
xor edx, edx
lea rcx, [rsp + 0x2020]
mov r8d, 0x2000
call fcn.14002b380
mov edx, 0x5c
mov rcx, rbx
call fcn.14000ccf8
mov rdi, rax
test rax, rax
je 0x140007562
nop word [rax + rax]
mov r8, rdi
lea rcx, [rsp + 0x2020]
sub r8, rbx
mov rdx, rbx
sar r8, 1
inc r8
call fcn.140018008
xor edx, edx
lea rcx, [rsp + 0x2020]
call qword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
mov edx, 0x5c
lea rcx, [rdi + 2]
call fcn.14000ccf8
mov rdi, rax
test rax, rax
jne 0x140007520
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
mov rax, rbx
mov rbx, qword [rsp + 0x4048]
mov rcx, qword [rsp + 0x4020]
xor rcx, rsp
call fcn.14000be00
add rsp, 0x4030
pop rdi
ret
Function at 0x140007950
Capabilities:
Get common file path
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov eax, 0x2050
call fcn.14000bda0
sub rsp, rax
mov rax, qword [0x14003f040]
xor rax, rsp
mov qword [rsp + 0x2040], rax
xor edi, edi
mov rbp, rdx
mov r15, rcx
mov esi, edi
test rdx, rdx
je 0x1400079dd
lea rcx, [0x14002ebe4]
call fcn.140007b60
mov rcx, rbp
mov rsi, rax
call fcn.140007420
mov r14, rax
test rax, rax
je 0x140007aaf
mov rdx, rax
lea rcx, [0x14002ebe8]
call fcn.1400183cc
mov rcx, r14
mov ebx, eax
call fcn.14001555c
test ebx, ebx
je 0x1400079dd
lea rcx, str.LOADER:_Failed_to_set_the_TMP_environment_variable._n
call fcn.140002b10
xor eax, eax
jmp 0x140007b38
lea rdx, [rsp + 0x40]
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.DLL_GetTempPathW]
call sub.KERNEL32.DLL_GetCurrentProcessId
mov r9d, eax
lea r8, str._MEI_d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140002810
nop dword [rax + rax]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.140019084
mov rcx, rax
mov rbx, rax
call fcn.140008b70
test eax, eax
je 0x140007ab6
mov rcx, rbx
call fcn.14001555c
inc edi
cmp edi, 5
jl 0x140007a10
test rbp, rbp
je 0x140007aaf
xor r8d, r8d
lea rdx, [0x14002ebe4]
xor ecx, ecx
call fcn.140008bd0
test rsi, rsi
je 0x140007a99
xor r8d, r8d
mov rdx, rsi
xor ecx, ecx
mov rdi, rax
call fcn.140008bd0
mov rdx, rax
mov rcx, rdi
mov rbx, rax
call fcn.1400183cc
mov rcx, rdi
call fcn.14001555c
mov rcx, rbx
call fcn.14001555c
mov rcx, rsi
call fcn.14001555c
xor eax, eax
jmp 0x140007b38
xor edx, edx
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableW]
mov rcx, rbx
call fcn.14001555c
xor eax, eax
jmp 0x140007b38
mov r8d, 0x1000
mov rdx, rbx
mov rcx, r15
call fcn.140008ce0
mov rcx, rbx
call fcn.14001555c
test rbp, rbp
je 0x140007b33
xor r8d, r8d
lea rdx, [0x14002ebe4]
xor ecx, ecx
call fcn.140008bd0
test rsi, rsi
je 0x140007b1d
xor r8d, r8d
mov rdx, rsi
xor ecx, ecx
mov rdi, rax
call fcn.140008bd0
mov rdx, rax
mov rcx, rdi
mov rbx, rax
call fcn.1400183cc
mov rcx, rdi
call fcn.14001555c
mov rcx, rbx
call fcn.14001555c
mov rcx, rsi
jmp 0x140007b2e
xor edx, edx
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableW]
mov rcx, rbx
call fcn.14001555c
mov eax, 1
mov rcx, qword [rsp + 0x2040]
xor rcx, rsp
call fcn.14000be00
mov rbx, qword [rsp + 0x2090]
add rsp, 0x2050
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140007b60
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x4038
call fcn.14000bda0
sub rsp, rax
mov rax, qword [0x14003f040]
xor rax, rsp
mov qword [rsp + 0x4020], rax
mov rdx, rcx
xor r8d, r8d
xor ecx, ecx
call fcn.140008bd0
mov r8d, 0x2000
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
test eax, eax
je 0x140007bf6
mov r8d, 0x2000
lea rdx, [rsp + 0x2020]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsW]
xor r8d, r8d
lea rdx, [rsp + 0x20]
xor ecx, ecx
call fcn.140008ce0
test rax, rax
je 0x140007bf6
cmp byte [rax], 0
je 0x140007bf6
mov rcx, rax
call fcn.14001af7c
mov rcx, qword [rsp + 0x4020]
xor rcx, rsp
call fcn.14000be00
add rsp, 0x4038
ret
xor eax, eax
mov rcx, qword [rsp + 0x4020]
xor rcx, rsp
call fcn.14000be00
add rsp, 0x4038
ret

Function at 0x140008040
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdx, rcx
xor r8d, r8d
xor ecx, ecx
call fcn.140008bd0
xor edx, edx
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableW]
mov rcx, rdi
mov ebx, eax
call fcn.14001555c
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140008080
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x2110
call fcn.14000bda0
sub rsp, rax
mov rax, qword [0x14003f040]
xor rax, rsp
mov qword [rsp + 0x2100], rax
mov rdx, rcx
xor edi, edi
lea rcx, [rsp + 0x100]
mov dword [rsp + 0x50], edi
mov r8d, 0x1000
call fcn.140008bd0
mov ebx, 1
lea rcx, [0x140007400]
mov edx, ebx
call qword [sym.imp.KERNEL32.DLL_SetConsoleCtrlHandler]
lea rcx, [rsp + 0x90]
mov dword [rsp + 0x58], 0x18
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x68], ebx
call qword [sym.imp.KERNEL32.DLL_GetStartupInfoW]
xorps xmm0, xmm0
mov qword [rsp + 0x98], rdi
xor ecx, ecx
movdqa xmmword [rsp + 0xa0], xmm0
mov dword [rsp + 0xcc], 0x101
mov word [rsp + 0xd0], bx
call fcn.1400158d0
mov rcx, rax
call fcn.14001aff4
mov ecx, eax
call fcn.140018c10
cmp rax, 0xffffffffffffffff
mov ecx, ebx
cmove rax, rdi
mov qword [rsp + 0xe0], rax
call fcn.1400158d0
mov rcx, rax
call fcn.14001aff4
mov ecx, eax
call fcn.140018c10
cmp rax, 0xffffffffffffffff
lea ecx, [rdi + 2]
cmove rax, rdi
mov qword [rsp + 0xe8], rax
call fcn.1400158d0
mov rcx, rax
call fcn.14001aff4
mov ecx, eax
call fcn.140018c10
cmp rax, 0xffffffffffffffff
cmove rax, rdi
mov qword [rsp + 0xf0], rax
call qword [sym.imp.KERNEL32.DLL_GetCommandLineW]
xor r9d, r9d
lea r8, [rsp + 0x58]
mov rdx, rax
lea rcx, [rsp + 0x100]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.DLL_CreateProcessW]
test eax, eax
je 0x140008200
mov rcx, qword [rsp + 0x70]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov rcx, qword [rsp + 0x70]
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
mov eax, dword [rsp + 0x50]
jmp 0x140008218
lea rdx, str.Error_creating_child_process__n
lea rcx, [0x14002ecf0]
call fcn.1400029c0
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x2100]
xor rcx, rsp
call fcn.14000be00
mov rbx, qword [rsp + 0x2128]
add rsp, 0x2110
pop rdi
ret
Function at 0x1400082b0
Capabilities:
Read file on windows

Disassembly:
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r12, rcx
mov rsi, r8
mov ecx, 0x2000
mov r14, rdx
xor r13d, r13d
call fcn.140015570
mov r15, rax
test rax, rax
je 0x1400083c3
xor edx, edx
lea r8d, [r13 + 2]
mov rcx, r12
call fcn.140010df4
test eax, eax
js 0x1400083c3
mov rcx, r12
mov qword [rsp + 0x50], rbx
call fcn.140019650
mov rbx, rax
cmp rax, rsi
jb 0x1400083be
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rdi
nop dword [rax]
cmp rbx, 0x2000
lea rbp, [rbx - 0x2000]
cmovb rbp, r13
sub rbx, rbp
cmp rbx, rsi
jb 0x1400083b4
xor r8d, r8d
mov rdx, rbp
mov rcx, r12
call fcn.140010df4
test eax, eax
js 0x1400083b4
mov r9, r12
mov r8, rbx
mov edx, 1
mov rcx, r15
call fcn.140010abc
cmp rax, rbx
jne 0x1400083b4
sub rbx, rsi
add rbx, 1
je 0x14000839b
lea rdi, [r15 - 1]
add rdi, rbx
nop dword [rax]
nop dword [rax + rax]
mov r8, rsi
mov rdx, r14
mov rcx, rdi
call fcn.14002b720
test eax, eax
je 0x1400083ad
dec rdi
sub rbx, 1
jne 0x140008380
lea rbx, [rsi - 1]
add rbx, rbp
test rbp, rbp
jne 0x140008320
jmp 0x1400083b4
lea r13, [rbp - 1]
add r13, rbx
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
mov rcx, r15
call fcn.14001555c
mov rax, r13
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rsi
ret

Function at 0x140008b70
Capabilities:
Create directory

Disassembly:
sub rsp, 0x48
mov rax, qword [0x140040fb0]
test rax, rax
jne 0x140008b96
lea rcx, str.Security_descriptor_is_not_initialized__n
call fcn.140002c30
mov eax, 0xffffffff
add rsp, 0x48
ret
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x18
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
neg eax
sbb eax, eax
neg eax
dec eax
add rsp, 0x48
ret