joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140012080
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x68], 0
je 0x1400120b9
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x1400121a7
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x50], 0
jle 0x14001214f
cmp qword [rsp + 0x20], 0
jle 0x14001214f
mov rax, qword [rsp + 0x20]
cmp qword [rsp + 0x50], rax
jge 0x1400120f9
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x48]
mov rcx, rax
call fcn.14000e6d0
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rsp + 0x50], 0
jle 0x140012197
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x80], 0
je 0x140012197
mov rax, qword [rsp + 0x40]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
sub rcx, rax
mov rax, rcx
add rsp, 0x38
ret
Function at 0x1400121d0
Capabilities:
Log keystrokes via application hook

Disassembly:
sub rsp, 0x98
mov rax, qword [0x14001d038]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x20], 0x12c
lea r8, [rsp + 0x20]
lea rdx, [0x14000e800]
lea rcx, [rsp + 0x40]
call fcn.140001240
nop
lea rcx, [rsp + 0x40]
call fcn.14000ea40
mov edx, 1
lea rcx, [0x14000b470]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
test eax, eax
jne 0x14001226d
lea rdx, str.Failed_to_set_console_control_handler
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001a30
mov qword [rsp + 0x30], rax
lea rdx, [0x140005c10]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x40]
call fcn.14000a680
mov eax, dword [rsp + 0x24]
jmp 0x14001232d
mov r9d, 0x40
mov r8d, 8
lea rdx, [0x14001d670]
lea rcx, [0x14001d6d8]
call fcn.14000f710
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14000b490]
mov ecx, 0xd
call qword [sym.imp.USER32.dll_SetWindowsHookExA]
mov qword [0x14001d6b8], rax
cmp qword [0x14001d6b8], 0
jne 0x1400122f7
lea rdx, str.Failed_to_install_hook
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001a30
mov qword [rsp + 0x38], rax
lea rdx, [0x140005c10]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x28], 0
lea rcx, [rsp + 0x40]
call fcn.14000a680
mov eax, dword [rsp + 0x28]
jmp 0x14001232d
movzx eax, byte [0x14001d5c0]
test eax, eax
jne 0x140012317
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_GetMessageA]
jmp 0x1400122f7
mov dword [rsp + 0x2c], 0
lea rcx, [rsp + 0x40]
call fcn.14000a680
mov eax, dword [rsp + 0x2c]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140013050
add rsp, 0x98
ret
Function at 0x1400123dc
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140012460
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140017350]
cmp byte [rcx + rax], 0
je 0x140012460
dec r8
sub rdx, 1
jne 0x140012446
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x14001282c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rdx, rcx
mov ecx, 0x105
call fcn.14001257c
mov ebx, eax
test eax, eax
jne 0x14001285c
and dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x3c], eax
jmp 0x1400128bf
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400128b6
test al, 0x10
je 0x1400128b6
bt eax, 0xa
jae 0x1400128af
mov r9d, 0x2000000
lea rcx, [rsp + 0x38]
mov r8d, 0x80
mov rdx, rdi
call fcn.1400128d0
mov rcx, qword [rsp + 0x38]
mov edi, eax
cmp rcx, 0xffffffffffffffff
je 0x1400128ab
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1400128ab
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
test edi, edi
jne 0x1400128b6
and dword [rsp + 0x3c], 0
jmp 0x1400128bb
or dword [rsp + 0x3c], 0xffffffff
mov dword [rsp + 0x38], ebx
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140013694
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400136de
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400136de
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400136de
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400136de
cmp dword [rcx + 0x84], 0xe
jbe 0x1400136de
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400136e0
xor al, al
add rsp, 0x28
ret

Function at 0x1400019e4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001a2e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001a2e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001a2e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001a2e
cmp dword [rcx + 0x84], 0xe
jbe 0x140001a2e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001a30
xor al, al
add rsp, 0x28
ret
Function at 0x140002050
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
push r15
mov eax, dword [rcx + 0x48]
lea rbx, [rcx + 0x28]
mov rdi, qword [rcx]
lea r11, [rcx + 0x28]
add rbx, rax
mov r9, rcx
movabs rbp, 0xc2b2ae3d27d4eb4f
movabs rsi, 0x9e3779b185ebca87
movabs r14, 0x27d4eb2f165667c5
movabs r15, 0x7a1435883d4d519d
cmp rdi, 0x20
jb 0x140002149
mov r8, qword [r9 + 0x18]
mov rdx, qword [rcx + 8]
mov rax, r8
mov r9, qword [r9 + 0x20]
mov rcx, qword [rcx + 0x10]
mov r10, r9
rol r10, 0x12
rol rax, 0xc
add r10, rax
mov rax, rcx
rol rax, 7
add r10, rax
mov rax, rdx
rol rax, 1
add r10, rax
movabs rax, 0x85ebca77c2b2ae63
imul rdx, rbp
imul rcx, rbp
imul r8, rbp
imul r9, rbp
rol rdx, 0x1f
imul rdx, rsi
rol rcx, 0x1f
xor r10, rdx
rol r8, 0x1f
imul r10, rsi
imul rcx, rsi
imul r8, rsi
sub r10, r15
rol r9, 0x1f
xor r10, rcx
imul r10, rsi
imul r9, rsi
sub r10, r15
xor r10, r8
imul r10, rsi
sub r10, r15
xor r10, r9
imul r10, rsi
add rax, r10
add rax, rdi
jmp 0x140002151
lea rax, [rdi + r14]
add rax, qword [rcx + 0x18]
lea rdx, [r11 + 8]
cmp rdx, rbx
ja 0x14000218a
nop word [rax + rax]
mov rcx, qword [r11]
add rdx, 8
imul rcx, rbp
add r11, 8
rol rcx, 0x1f
imul rcx, rsi
xor rax, rcx
rol rax, 0x1b
imul rax, rsi
sub rax, r15
cmp rdx, rbx
jbe 0x140002160
lea rdx, [r11 + 4]
movabs r8, 0x165667b19e3779f9
cmp rdx, rbx
ja 0x1400021b5
mov ecx, dword [r11]
mov r11, rdx
imul rcx, rsi
xor rax, rcx
rol rax, 0x17
imul rax, rbp
add rax, r8
cmp r11, rbx
jae 0x1400021db
nop word [rax + rax]
movzx ecx, byte [r11]
inc r11
imul rcx, r14
xor rax, rcx
rol rax, 0xb
imul rax, rsi
cmp r11, rbx
jb 0x1400021c0
mov rbx, qword [rsp + 0x18]
mov rcx, rax
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
shr rcx, 0x21
xor rcx, rax
imul rcx, rbp
mov rbp, qword [rsp + 0x20]
mov rdx, rcx
shr rdx, 0x1d
xor rdx, rcx
imul rdx, r8
mov rax, rdx
shr rax, 0x20
xor rax, rdx
pop r15
pop r14
ret

Function at 0x14000a3d0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor r14d, r14d
mov rbp, rdx
mov word [rsp + 0x30], r14w
mov rsi, rcx
lea edi, [r14 + 0x28]
test al, al
je 0x14000a481
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], r14b
lea rcx, [rsp + 0x24]
call fcn.1400101fc
cmp rax, 1
jne 0x14000a4b7
mov rcx, rdi
mov rax, rbx
cmp word [rbx], r14w
je 0x14000a45d
add rax, 2
dec rcx
cmp word [rax], r14w
jne 0x14000a450
cmp rcx, 1
jb 0x14000a4b7
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], r14w
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x14000a420
mov rdx, rbp
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14000b840
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.14000fec0
int3
Function at 0x14000a540
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x250
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, r8
lea rax, [rsp + 0x30]
mov rbx, rcx
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor ecx, ecx
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x14000a585
xor al, al
jmp 0x14000a5d2
cmp word [rbx], 0
je 0x14000a59d
nop dword [rax + rax]
add rbx, 2
dec rdi
cmp word [rbx], 0
jne 0x14000a590
cmp word [rsp + 0x30], 0
je 0x14000a5cb
lea rcx, [rsp + 0x30]
sub rcx, rbx
nop dword [rax]
cmp rdi, 1
jb 0x14000a5f3
movzx eax, word [rcx + rbx]
dec rdi
mov word [rbx], ax
add rbx, 2
cmp word [rcx + rbx], 0
jne 0x14000a5b0
xor eax, eax
mov word [rbx], ax
mov al, 1
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14000b840
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
ret
call fcn.14000fec0
int3
Function at 0x14000ad90
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x2030
call fcn.14001f690
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2020], rax
mov r11d, dword [0x14002fdb4]
lea rsi, [0x140032df0]
mov rdi, rcx
test r11d, r11d
jne 0x14000ae09
mov r8d, 0x1000
lea rdx, str.HOME
lea rcx, [rsp + 0x20]
call fcn.14000a600
test al, al
je 0x14000aee9
lea rcx, [rsp + 0x20]
call fcn.140014418
movsxd r11, dword [0x14002fdb4]
mov qword [rsi + r11*8], rax
inc r11d
mov dword [0x14002fdb4], r11d
xor r9d, r9d
test r11d, r11d
jle 0x14000ae44
mov r10, rsi
mov r8, qword [r10]
mov rax, rdi
sub r8, rdi
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14000ae34
add rax, 2
test ecx, ecx
jne 0x14000ae20
test edx, edx
je 0x14000ae67
inc r9d
add r10, 8
cmp r9d, r11d
jl 0x14000ae14
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x14000ae50
cmp rax, 2
jne 0x14000ae6b
cmp word [rdi + 2], 0x3a
jne 0x14000ae6b
mov al, 1
jmp 0x14000aec8
xor edx, edx
mov qword [rsp + 0x2048], rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne bl
test eax, eax
jne 0x14000ae96
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000aebd
mov bl, 1
cmp dword [0x14002fdb4], 0x400
jge 0x14000aebd
mov rcx, rdi
call fcn.140014418
movsxd rdx, dword [0x14002fdb4]
mov qword [rsi + rdx*8], rax
inc edx
mov dword [0x14002fdb4], edx
movzx eax, bl
mov rbx, qword [rsp + 0x2048]
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.14000b840
mov rsi, qword [rsp + 0x2050]
add rsp, 0x2030
pop rdi
ret
lea rcx, str.HOME
call fcn.14000ac30
int3
Function at 0x14000b010
Capabilities:
Check if file exists
Delete file
Get file attributes
Terminate process

Disassembly:
sub rsp, 0x68
mov rcx, qword [0x14002fdb8]
test rcx, rcx
je 0x14000b04b
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14000b03e
mov rcx, qword [0x14002fdb8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [0x14002fdb8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x14002fdc8], 0
je 0x14000b13e
mov qword [rsp + 0x70], rbx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x78], rbp
lea rbp, [0x140029848]
mov qword [rsp + 0x80], rsi
lea rsi, [0x1400305f0]
mov qword [rsp + 0x88], rdi
xor edi, edi
mov qword [rsp + 0x60], r14
mov r14d, 0x414
mov word [rsp + 0x40], r14w
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebx, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000b11f
test al, 0x10
je 0x14000b11f
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov word [rsp + 0x40], r14w
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
inc ebx
cmp ebx, 0x14
jl 0x14000b0c5
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x60]
add rsp, 0x68
ret
Function at 0x14000c134
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000c17e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000c17e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000c17e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000c17e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000c17e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000c180
xor al, al
add rsp, 0x28
ret

Function at 0x14000feb4
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000fd13
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000fd13
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000fd13
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000fd13
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000fd13
cmp dword [rcx + 0x84], 0xe
jbe 0x14000fd13
cmp dword [rcx + 0xf8], 0
je 0x14000fd13
mov ecx, ebx
call fcn.14000fdd0
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14000fba0
nop
cmp dword [rbp + 0x20], 0
je 0x14000fd61
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000fd6c
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000fca4
Function at 0x140019184
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14001920b
mov rsi, rbx
cmp word [rax], bp
je 0x1400191ca
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400191b4
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400191b0
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1400169c4
mov rdi, rax
test rax, rax
je 0x1400191f8
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14001fd30
mov rbp, rdi
xor ecx, ecx
call fcn.140015af4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14001f5a0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14001f5c8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14001f5c8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1400013e0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov edi, dword [rcx + 8]
mov rbx, rcx
movsxd rcx, dword [rcx + 0x10]
mov r14d, edi
sub r14d, ecx
mov r15, rdx
test r9d, r9d
js 0x14000145f
mov rax, qword [rbx]
test rax, rax
je 0x14000145f
cmp r9d, r8d
cmovle r8d, r9d
mov r9, rdx
cmp r8d, edi
mov edx, 1
cmovle edi, r8d
add rcx, rax
cmp r14d, edi
jge 0x14000147d
movsxd r8, r14d
call fcn.14000a8dc
mov rcx, qword [rbx]
mov ebp, edi
sub ebp, r14d
mov r9, r15
movsxd r8, ebp
mov edx, 1
mov rsi, rax
call fcn.14000a8dc
add esi, eax
cmp esi, edi
je 0x140001490
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
movsxd r8, edi
call fcn.14000a8dc
mov esi, eax
cmp eax, edi
jne 0x14000145f
mov ebp, dword [rbx + 0x10]
add ebp, edi
mov eax, ebp
cdq
idiv dword [rbx + 8]
mov eax, esi
mov dword [rbx + 0x10], edx
jmp 0x140001464
Function at 0x140001680
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
sub rsp, 0x438
mov rax, qword [0x140031008]
xor rax, rsp
mov qword [rsp + 0x420], rax
mov rsi, 0xffffffffffffffff
mov r12, r9
mov rax, rsi
mov rbp, r8
mov rdi, rdx
mov r14, rcx
nop dword [rax + rax]
inc rax
cmp byte [rdx + rax], 0
jne 0x1400016c0
mov ebx, 0x3ff
cmp rax, rbx
jae 0x1400016e2
mov r8, rsi
inc r8
cmp byte [rdx + r8], 0
jne 0x1400016d6
jmp 0x1400016e5
mov r8, rbx
lea rcx, [rsp + 0x20]
call fcn.140006c50
mov rax, rsi
inc rax
cmp byte [rdi + rax], 0
jne 0x1400016f2
cmp rax, rbx
jae 0x140001719
mov rbx, rsi
inc rbx
cmp byte [rdi + rbx], 0
jne 0x140001703
cmp rbx, 0x400
jae 0x1400018cd
mov byte [rsp + rbx + 0x20], 0
lea rax, [rsp + 0x20]
cmp byte [rax + rsi + 1], 0
lea rsi, [rsi + 1]
jne 0x140001723
cmp byte [rsp + rsi + 0x1f], 0x2f
jne 0x14000173a
mov byte [rsp + rsi + 0x1f], 0
mov edx, 0x2f
lea rcx, [rsp + 0x20]
call fcn.140006a70
test rax, rax
je 0x140001753
mov byte [rax], 0
jmp 0x14000175a
mov word [rsp + 0x20], 0x2e
lea rax, [rsp + 0x20]
sub rbp, rax
movzx ecx, byte [rax]
movzx edx, byte [rax + rbp]
sub ecx, edx
jne 0x140001774
inc rax
test edx, edx
jne 0x140001762
test ecx, ecx
jne 0x1400018ad
mov rcx, rdi
mov qword [rsp + 0x430], r15
call fcn.140001990
xor edi, edi
mov r15, rax
cmp dword [r14 + 0x10], edi
jle 0x1400018a5
mov rbp, qword [rsp + 0x490]
nop dword [rax]
nop word [rax + rax]
mov rax, qword [r14 + 0x28]
xor r8d, r8d
movsxd rsi, edi
mov rcx, r12
mov rbx, rsi
add rbx, rbx
mov edx, dword [rax + rbx*8 + 8]
call fcn.14000ac14
mov rax, qword [r14 + 0x28]
mov rcx, rbp
movsxd rdx, dword [rax + rbx*8 + 8]
sub rcx, rdx
cmp rcx, 0x400
jae 0x1400017ea
mov eax, ebp
sub eax, edx
jmp 0x1400017ef
mov eax, 0x400
movsxd rbx, eax
lea rcx, [rsp + 0x20]
mov r8, rbx
mov r9, r12
mov edx, 1
call fcn.14000a8dc
cmp rax, rbx
jne 0x14000188c
mov r10, qword [r14 + 0x20]
movzx ecx, dil
sar rsi, 3
and cl, 7
movsx r9d, byte [rsi + r10]
movzx eax, r9b
sar al, cl
test al, 1
je 0x14000187e
lea rax, [rsp + 0x20]
mov r8, r15
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140001853
inc rax
test ecx, ecx
jne 0x140001840
test edx, edx
jne 0x14000187e
mov ecx, r9d
lea rdx, [rsp + 0x20]
mov eax, edi
mov r8d, edi
and eax, 7
btr ecx, eax
mov byte [rsi + r10], cl
lea rcx, str.Warning:EnsureVivPathNotInVivDirWritePaths:_Skip_file__s___d___would_overwrite_this_archive__n
inc dword [r14 + 0x1c]
call fcn.140005be0
inc edi
cmp edi, dword [r14 + 0x10]
jl 0x1400017b0
jmp 0x1400018a5
mov ecx, 2
call fcn.140009d00
mov rcx, rax
lea rdx, str.EnsureVivPathNotInVivDirWritePaths:_File_read_error__strcmp__n
call fcn.140004e60
mov r15, qword [rsp + 0x430]
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.140006030
add rsp, 0x438
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.140005da8
int3
Function at 0x1400044d0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r12
push r15
mov eax, 0x1048
call fcn.140005fd0
sub rsp, rax
mov rax, qword [0x140031008]
xor rax, rsp
mov qword [rsp + 0x1020], rax
mov r15, rdx
mov rbp, rcx
mov rcx, r15
lea rdx, [0x14002359c]
mov r12d, r8d
call fcn.14000a458
mov rsi, rax
test rax, rax
jne 0x140004538
lea ecx, [rax + 2]
call fcn.140009d00
mov rcx, rax
lea rdx, str.VivWriteFile:_Cannot_open_file__s__infile__n
mov r8, r15
call fcn.140004e60
lea eax, [rsi - 1]
jmp 0x14000462e
mov qword [rsp + 0x1088], rbx
mov qword [rsp + 0x1040], rdi
mov qword [rsp + 0x1038], r13
mov r13d, 0x1000
mov qword [rsp + 0x1030], r14
nop
mov rcx, rsi
call fcn.14000b1d0
mov ebx, r12d
lea rcx, [rsp + 0x20]
sub ebx, eax
mov r9, rsi
cmp ebx, r13d
mov edx, 1
mov r14d, eax
cmovg ebx, r13d
movsxd rdi, ebx
mov r8, rdi
call fcn.14000a8dc
cmp rax, rdi
jne 0x1400045e2
mov r9, rbp
lea rcx, [rsp + 0x20]
mov r8, rdi
mov edx, 1
call fcn.14000b5d8
cmp rax, rdi
jne 0x1400045c4
test ebx, ebx
jg 0x140004560
mov rcx, rsi
call fcn.140009f14
mov rcx, rbp
call fcn.14000b1d0
jmp 0x14000460e
mov ecx, 2
call fcn.140009d00
mov rcx, rax
lea rdx, str.VivWriteFile:_File_write_error_at__d__outfile__n
mov r8d, ebx
call fcn.140004e60
jmp 0x140004601
mov ecx, 2
call fcn.140009d00
mov rcx, rax
lea rdx, str.VivWriteFile:_File_read_error_at__d_in__s__infile__n
mov r9, r15
mov r8d, r14d
call fcn.140004e60
mov rcx, rsi
call fcn.140009f14
mov eax, 0xffffffff
mov r14, qword [rsp + 0x1030]
mov r13, qword [rsp + 0x1038]
mov rdi, qword [rsp + 0x1040]
mov rbx, qword [rsp + 0x1088]
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.140006030
add rsp, 0x1048
pop r15
pop r12
pop rsi
pop rbp
ret