joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140069350
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rax, qword [rsp + 0x40]
cmp qword [rax], 0
jne 0x1400693a9
lea rax, str.m_hKey___0
mov qword [rsp + 0x28], rax
lea rax, [0x1401a4858]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x1866
lea rdx, [0x1401a4ac0]
mov ecx, 2
call fcn.1400e00a0
cmp eax, 1
jne 0x1400693a9
int3
xor eax, eax
test eax, eax
jne 0x140069364
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x30
pop rdi
ret

Function at 0x1400693f0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov rax, qword [rsp + 0x60]
cmp qword [rax], 0
jne 0x140069449
lea rax, str.m_hKey___0
mov qword [rsp + 0x28], rax
lea rax, [0x1401a4858]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x1886
lea rdx, [0x1401a4ac0]
mov ecx, 2
call fcn.1400e00a0
cmp eax, 1
jne 0x140069449
int3
xor eax, eax
test eax, eax
jne 0x140069404
cmp qword [rsp + 0x70], 0
je 0x140069461
mov dword [rsp + 0x44], 1
jmp 0x140069469
mov dword [rsp + 0x44], 0
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jne 0x1400694b2
lea rax, [0x1401a4a98]
mov qword [rsp + 0x28], rax
lea rax, [0x1401a4858]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x1887
lea rdx, [0x1401a4ac0]
mov ecx, 2
call fcn.1400e00a0
cmp eax, 1
jne 0x1400694b2
int3
cmp dword [rsp + 0x40], 0
jne 0x1400694c0
mov eax, SafeArrayDestroy
jmp 0x14006953f
xor eax, eax
test eax, eax
jne 0x14006944f
mov dword [rsp + 0x38], 0
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.1400e1df0
inc eax
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x3c]
mov rcx, qword [rsp + 0x30]
lea rax, [rcx + rax*2]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x38]
lea rax, [rcx + rax*2]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x3c], 1
jne 0x1400694d8
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 7
xor r8d, r8d
mov rdx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x50
pop rdi
ret
Function at 0x140069550
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rax, qword [rsp + 0x50]
cmp qword [rax], 0
jne 0x1400695ae
lea rax, str.m_hKey___0
mov qword [rsp + 0x28], rax
lea rax, [0x1401a4858]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x1877
lea rdx, [0x1401a4ac0]
mov ecx, 2
call fcn.1400e00a0
cmp eax, 1
jne 0x1400695ae
int3
xor eax, eax
test eax, eax
jne 0x140069569
cmp qword [rsp + 0x60], 0
je 0x1400695c6
mov dword [rsp + 0x34], 1
jmp 0x1400695ce
mov dword [rsp + 0x34], 0
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x140069617
lea rax, [0x1401a4a98]
mov qword [rsp + 0x28], rax
lea rax, [0x1401a4858]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x1878
lea rdx, [0x1401a4ac0]
mov ecx, 2
call fcn.1400e00a0
cmp eax, 1
jne 0x140069617
int3
cmp dword [rsp + 0x30], 0
jne 0x140069628
mov eax, SafeArrayDestroy
jmp 0x1400696b0
xor eax, eax
test eax, eax
jne 0x1400695b4
cmp dword [rsp + 0x68], 1
je 0x140069676
cmp dword [rsp + 0x68], 2
je 0x140069676
lea rax, str._dwType____1ul______dwType____2ul___
mov qword [rsp + 0x28], rax
lea rax, [0x1401a4858]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x1879
lea rdx, [0x1401a4ac0]
mov ecx, 2
call fcn.1400e00a0
cmp eax, 1
jne 0x140069676
int3
mov rcx, qword [rsp + 0x60]
call fcn.1400e1df0
inc eax
mov eax, eax
shl rax, 1
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x40
pop rdi
ret
Function at 0x1400ddf40
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.1400dda20
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1400ddf7f
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x14019ba20]
jmp 0x1400ddf89
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret
Function at 0x1401581f0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x140169950
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.1400bff80
sub rsp, rax
mov rax, qword [0x1402558e8]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x14025bc70]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x140169b42
lea rax, [rsp + 0x147f]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x38], rax
jae 0x140169a96
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x140169a96
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
mov byte [rsp + 0x31], al
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x30], al
movsx eax, byte [rsp + 0x30]
cmp eax, 0xa
jne 0x140169a7b
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x38]
mov byte [rax], SafeArrayDestroy
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, byte [rsp + 0x30]
mov byte [rax], cl
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
jmp 0x140169a18
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140169b02
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x140169b61
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x44], eax
jae 0x140169b3d
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x140169b61
jmp 0x1401699ee
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.1400bfed0
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x140169b80
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.1400bff80
sub rsp, rax
mov rax, qword [0x1402558e8]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x14025bc70]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x140169d8d
lea rax, [rsp + 0x147e]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x38], rax
jae 0x140169cd9
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x140169cd9
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
mov word [rsp + 0x40], ax
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x30]
cmp eax, 0xa
jne 0x140169cb9
mov eax, dword [rsp + 0x78]
add eax, 2
mov dword [rsp + 0x78], eax
mov eax, SafeArrayDestroy
mov rcx, qword [rsp + 0x38]
mov word [rcx], ax
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, word [rsp + 0x30]
mov word [rax], cx
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
jmp 0x140169c48
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov eax, eax
shl rax, 1
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140169d4d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x140169dac
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x48], eax
jae 0x140169d88
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x140169dac
jmp 0x140169c1e
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.1400bfed0
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x14016d060
Capabilities:
Get geographical location

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
call fcn.14016c340
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x14016d0c7
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
movabs r10, 0xe375262d7cd44270
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
call qword [0x14019ba28]
jmp 0x14016d0e9
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.14016d580
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x58
ret
Function at 0x140174ca0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0xb8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140174b30
lea rcx, [rsp + 0x40]
call fcn.140174c60
movzx eax, al
test eax, eax
jne 0x140174ce8
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call fcn.140174b50
mov rax, qword [rsp + 0x70]
jmp 0x140174eb9
lea rcx, [rsp + 0x40]
call fcn.140174c40
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.140174bf0
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x40]
call fcn.140174c40
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.140174a00
cdqe
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x140174d8e
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x40]
call fcn.140174b50
mov rax, qword [rsp + 0x80]
jmp 0x140174eb9
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, qword [rsp + 0x58]
call fcn.14014b1e0
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.1400c6fd0
lea rcx, [rsp + 0x48]
call fcn.1400c7050
movzx eax, al
test eax, eax
jne 0x140174df5
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x48]
call fcn.1400c7010
lea rcx, [rsp + 0x40]
call fcn.140174b50
mov rax, qword [rsp + 0x88]
jmp 0x140174eb9
lea rcx, [rsp + 0x48]
call fcn.1400c7140
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x40]
call fcn.140174c40
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call fcn.140174a00
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x140174e8b
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x48]
call fcn.1400c7010
lea rcx, [rsp + 0x40]
call fcn.140174b50
mov rax, qword [rsp + 0xa0]
jmp 0x140174eb9
lea rcx, [rsp + 0x48]
call fcn.140145bf0
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x48]
call fcn.1400c7010
lea rcx, [rsp + 0x40]
call fcn.140174b50
mov rax, qword [rsp + 0xa8]
add rsp, 0xb8
ret
Function at 0x140174ed0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.140174b30
lea rcx, [rsp + 0x20]
call fcn.140174b70
movzx eax, al
test eax, eax
jne 0x140174f15
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x20]
call fcn.140174b50
mov rax, qword [rsp + 0x40]
jmp 0x14017500f
lea rcx, [rsp + 0x20]
call fcn.140174c40
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.140174bf0
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r9d, 0x40
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, rax
call fcn.14014b1e0
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.140139200
lea rcx, [rsp + 0x28]
call fcn.140145a90
movzx eax, al
test eax, eax
jne 0x140174faf
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x28]
call fcn.140139240
lea rcx, [rsp + 0x20]
call fcn.140174b50
mov rax, qword [rsp + 0x50]
jmp 0x14017500f
lea rcx, [rsp + 0x20]
call fcn.140174c40
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call fcn.14013be60
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r8, rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.1400c44f0
lea rcx, [rsp + 0x28]
call fcn.1401394b0
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x28]
call fcn.140139240
lea rcx, [rsp + 0x20]
call fcn.140174b50
mov rax, qword [rsp + 0x68]
add rsp, 0x78
ret

Function at 0x140176740
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add rsp, 0x28
ret

Function at 0x14018a4f0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
lea rcx, [rsp + 0x78]
call fcn.140171d50
lea rcx, [rsp + 0x48]
call fcn.140171d50
call fcn.140157ae0
mov r8d, eax
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0xc0]
call fcn.1401705d0
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x14018a55f
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x48]
call fcn.140171e80
lea rcx, [rsp + 0x78]
call fcn.140171e80
mov eax, dword [rsp + 0x24]
jmp 0x14018a5f0
call fcn.140157ae0
mov r8d, eax
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0xc8]
call fcn.1401705d0
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x14018a5a6
mov dword [rsp + 0x2c], 0
lea rcx, [rsp + 0x48]
call fcn.140171e80
lea rcx, [rsp + 0x78]
call fcn.140171e80
mov eax, dword [rsp + 0x2c]
jmp 0x14018a5f0
lea rcx, [rsp + 0x48]
call fcn.140172540
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x78]
call fcn.140172540
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x48]
call fcn.140171e80
lea rcx, [rsp + 0x78]
call fcn.140171e80
mov eax, dword [rsp + 0x30]
add rsp, 0xb8
ret
Function at 0x1400021a8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r14d, ecx
call fcn.140002164
mov rdx, qword [rax + 0x18]
mov rbp, qword [rdx + 0x20]
mov r11, rbp
mov rcx, r11
call fcn.1400021a0
mov r11, qword [r11]
mov r10, qword [rax + 0x30]
test r10, r10
je 0x140002233
movsxd rax, dword [r10 + 0x3c]
mov ecx, dword [rax + r10 + 0x88]
test ecx, ecx
je 0x140002233
lea rdi, [r10 + rcx]
mov ecx, dword [rdi + 0xc]
add rcx, r10
call fcn.140002170
mov esi, dword [rdi + 0x20]
xor ebx, ebx
add rsi, r10
mov r15d, eax
cmp dword [rdi + 0x18], ebx
jbe 0x140002233
mov ecx, dword [rsi]
add rcx, r10
call fcn.140002170
add eax, r15d
cmp r14d, eax
je 0x140002253
inc ebx
add rsi, 4
cmp ebx, dword [rdi + 0x18]
jb 0x140002216
cmp r11, rbp
jne 0x1400021d3
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx r8d, word [rcx + rbx*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + r8*4]
add rax, r10
jmp 0x14000223a
Function at 0x14000264c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rbx, rcx
mov ecx, 0x7bac0721
call fcn.1400021a8
mov ecx, 0xf477a895
mov r13, rax
call fcn.1400021a8
lea rcx, [rbp - 0x50]
mov qword [rbp + 0x40], rax
mov dword [rbp - 0x50], 0x6c64746e
xor r15d, r15d
mov dword [rbp - 0x4c], 0x6c642e6c
mov word [rbp - 0x48], 0x6c
mov dword [rbp - 0x20], 0x526c7452
mov dword [rbp - 0x1c], 0x6c6c4165
mov dword [rbp - 0x18], 0x7461636f
mov dword [rbp - 0x14], 0x61654865
mov word [rbp - 0x10], VarBstrFromDisp
call fcn.140002270
mov rcx, rax
lea rdx, [rbp - 0x20]
call fcn.140002290
lea rcx, [rbp - 0x40]
mov qword [rbp + 0x48], rax
mov dword [rbp - 0x40], 0x6c64746e
mov dword [rbp - 0x3c], 0x6c642e6c
mov word [rbp - 0x38], 0x6c
mov dword [rbp - 0x30], 0x416c7452
mov dword [rbp - 0x2c], 0x636f6c6c
mov dword [rbp - 0x28], 0x48657461
mov dword [rbp - 0x24], 0x706165
call fcn.140002270
mov rcx, rax
lea rdx, [rbp - 0x30]
call fcn.140002290
mov rcx, qword [rbx]
lea edi, [r15 + 1]
mov r12, qword [rbx + 8]
mov qword [rbp + 0x50], rax
cmp dword [rcx + 0x94], r15d
jbe 0x14000285f
mov esi, dword [rcx + 0x90]
lea edx, [rdi + 0x13]
add rsi, r12
mov rcx, rsi
call r13
test eax, eax
jne 0x14000285f
add rsi, 0x10
mov edi, 1
cmp dword [rsi - 4], r15d
je 0x14000285f
mov ecx, dword [rsi - 4]
mov rdx, qword [rbx + 0x38]
add rcx, r12
call qword [rbx + 0x20]
mov r14, rax
test rax, rax
je 0x14000285c
mov ecx, dword [rbx + 0x18]
mov r15, qword [rbx + 0x10]
inc ecx
movsxd rdi, ecx
shl rdi, 3
call qword [rbp + 0x40]
mov rcx, rax
test r15, r15
je 0x1400027a2
mov r9, rdi
mov r8, r15
xor edx, edx
call qword [rbp + 0x48]
jmp 0x1400027ad
mov r8, rdi
mov edx, 8
call qword [rbp + 0x50]
mov rcx, rax
test rax, rax
je 0x14000284e
mov qword [rbx + 0x10], rax
movsxd rax, dword [rbx + 0x18]
mov qword [rcx + rax*8], r14
inc dword [rbx + 0x18]
mov eax, dword [rsi - 0x10]
test eax, eax
jne 0x1400027d1
mov eax, dword [rsi]
mov r15d, eax
mov edi, 1
add r15, r12
mov rax, qword [r15]
test rax, rax
je 0x140002823
mov edi, dword [rsi]
add rdi, r12
mov r8, qword [rbx + 0x38]
mov rcx, r14
test rax, rax
jns 0x1400027fb
movzx edx, word [r15]
jmp 0x140002805
mov rdx, qword [r15]
add rdx, 2
add rdx, r12
call qword [rbx + 0x28]
mov qword [rdi], rax
test rax, rax
je 0x140002840
add r15, 8
add rdi, 8
mov rax, qword [r15]
test rax, rax
jne 0x1400027e9
lea edi, [rax + 1]
add rsi, 0x14
mov edx, 0x14
lea rcx, [rsi - 0x10]
call r13
xor r15d, r15d
test eax, eax
je 0x140002752
jmp 0x14000285f
mov rdx, qword [rbx + 0x38]
xor edi, edi
mov rcx, r14
call qword [rbx + 0x30]
jmp 0x14000285f
mov rdx, qword [rbx + 0x38]
mov rcx, r14
call qword [rbx + 0x30]
xor edi, edi
jmp 0x14000285f
mov edi, r15d
mov rbx, qword [rsp + 0xc8]
mov eax, edi
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400028bc
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r9
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov r15, rcx
mov ecx, 0x4faef192
call fcn.1400021a8
mov ecx, 0x9e5a8833
mov r12, rax
call fcn.1400021a8
mov ecx, 0xf477a895
mov rbx, rax
call fcn.1400021a8
mov ecx, 0xc9f93d32
mov rdi, rax
call fcn.1400021a8
lea rcx, [rbp - 0x20]
mov qword [rbp + 0x48], rax
mov dword [rbp - 0x20], 0x6c64746e
mov dword [rbp - 0x1c], 0x6c642e6c
mov word [rbp - 0x18], 0x6c
mov dword [rbp - 0x10], 0x416c7452
mov dword [rbp - 0xc], 0x636f6c6c
mov dword [rbp - 8], 0x48657461
mov dword [rbp - 4], 0x706165
call fcn.140002270
mov rcx, rax
lea rdx, [rbp - 0x10]
call fcn.140002290
mov r13, rax
mov eax, 0x5a4d
cmp word [r15], ax
jne 0x1400029d9
movsxd rsi, dword [r15 + 0x3c]
add rsi, r15
cmp dword [rsi], 0x4550
jne 0x1400029d9
mov edx, dword [rsi + 0x50]
mov r9d, 4
mov rcx, qword [rsi + 0x30]
mov r8d, 0x3000
call rbx
mov r14, rax
test rax, rax
jne 0x1400029af
mov edx, dword [rsi + 0x50]
lea r9d, [rax + 4]
xor ecx, ecx
mov r8d, 0x3000
call rbx
mov r14, rax
test rax, rax
je 0x1400029d9
call rdi
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0x38]
call r13
xor r13d, r13d
mov rdi, rax
mov rcx, r14
test rax, rax
jne 0x1400029f9
xor edx, edx
mov r8d, 0x8000
call r12
xor eax, eax
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov qword [rax + 8], r14
mov r9d, 4
mov qword [rax + 0x18], r13
mov r8d, 0x1000
mov qword [rax + 0x10], r13
lea rax, [0x14000287c]
mov qword [rdi + 0x20], rax
lea rax, [0x140002884]
mov qword [rdi + 0x28], rax
lea rax, [0x14000288c]
mov qword [rdi + 0x30], rax
mov qword [rdi + 0x38], r13
mov edx, dword [rsi + 0x54]
call rbx
mov r8d, dword [rsi + 0x54]
mov rdx, r15
mov rcx, rax
mov rbx, rax
call qword [rbp + 0x48]
movsxd rax, dword [r15 + 0x3c]
mov r8, rdi
add rax, rbx
mov rdx, rsi
mov qword [rdi], rax
mov rcx, r15
mov qword [rax + 0x30], r14
call fcn.1400022c0
mov rdx, r14
sub rdx, qword [rsi + 0x30]
je 0x140002a78
mov rcx, rdi
call fcn.1400025b0
mov rcx, rdi
call fcn.14000264c
test eax, eax
je 0x1400029d9
mov rcx, rdi
call fcn.1400023b4
mov rcx, rdi
call fcn.140002564
mov rax, qword [rdi]
cmp dword [rax + 0x28], r13d
je 0x140002ac0
mov eax, dword [rax + 0x28]
xor r8d, r8d
add rax, r14
mov rcx, r14
lea ebx, [r8 + 1]
mov edx, ebx
call rax
test eax, eax
je 0x1400029d9
mov dword [rdi + 0x1c], ebx
mov rax, rdi
jmp 0x1400029db

Function at 0x140002b90
Capabilities:
Encode data using xor

Disassembly:
movsxd r8, edx
test edx, edx
jle 0x140002ba3
xor byte [rcx], 0x3a
inc rcx
sub r8, 1
jne 0x140002b97
mov eax, 1
ret