joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c7652
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140186ca0
mov rax, rcx
neg rcx
test rax, 7
je 0x140186cbd
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x140186d18
test al, 7
jne 0x140186cb0
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x140186cd1
mov rdx, qword [rax - 8]
test dl, dl
je 0x140186d42
test dh, dh
je 0x140186d3c
shr rdx, 0x10
test dl, dl
je 0x140186d36
test dh, dh
je 0x140186d30
shr rdx, 0x10
test dl, dl
je 0x140186d2a
test dh, dh
je 0x140186d24
shr edx, 0x10
test dl, dl
je 0x140186d1e
test dh, dh
jne 0x140186cd1
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret

Function at 0x1400c7689
Capabilities:
Query environment variable

Disassembly:
jmp 0x140235ee0
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.140235a60
lea rcx, [rsp + 0x20]
call fcn.140235ab0
movzx eax, al
test eax, eax
jne 0x140235f25
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x20]
call fcn.140235a90
mov rax, qword [rsp + 0x40]
jmp 0x14023601f
lea rcx, [rsp + 0x20]
call fcn.140235bb0
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.140235b50
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r9d, 0x40
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, rax
call fcn.1400c7a26
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.1400c6fa9
lea rcx, [rsp + 0x28]
call fcn.1400c7f3f
movzx eax, al
test eax, eax
jne 0x140235fbf
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x28]
call fcn.1400c94a7
lea rcx, [rsp + 0x20]
call fcn.140235a90
mov rax, qword [rsp + 0x50]
jmp 0x14023601f
lea rcx, [rsp + 0x20]
call fcn.140235bb0
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call fcn.1400ca50f
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r8, rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.1400c7968
lea rcx, [rsp + 0x28]
call fcn.1400caeb5
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x28]
call fcn.1400c94a7
lea rcx, [rsp + 0x20]
call fcn.140235a90
mov rax, qword [rsp + 0x68]
add rsp, 0x78
ret
Function at 0x1400c7bde
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x140183470
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.140182df0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1401834af
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1402d2020]
jmp 0x1401834b9
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret

Function at 0x1400c7e59
Capabilities:
Query environment variable

Disassembly:
jmp 0x140235c30
sub rsp, 0xb8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140235a60
lea rcx, [rsp + 0x40]
call fcn.140235be0
movzx eax, al
test eax, eax
jne 0x140235c78
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call fcn.140235a90
mov rax, qword [rsp + 0x70]
jmp 0x140235e49
lea rcx, [rsp + 0x40]
call fcn.140235bb0
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.140235b50
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x40]
call fcn.140235bb0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.1400c90c4
cdqe
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x140235d1e
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x40]
call fcn.140235a90
mov rax, qword [rsp + 0x80]
jmp 0x140235e49
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, qword [rsp + 0x58]
call fcn.1400c7a26
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.1400c77fb
lea rcx, [rsp + 0x48]
call fcn.1400c71e8
movzx eax, al
test eax, eax
jne 0x140235d85
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x48]
call fcn.1400c5d66
lea rcx, [rsp + 0x40]
call fcn.140235a90
mov rax, qword [rsp + 0x88]
jmp 0x140235e49
lea rcx, [rsp + 0x48]
call fcn.1400c8395
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x40]
call fcn.140235bb0
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call fcn.1400c90c4
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x140235e1b
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x48]
call fcn.1400c5d66
lea rcx, [rsp + 0x40]
call fcn.140235a90
mov rax, qword [rsp + 0xa0]
jmp 0x140235e49
lea rcx, [rsp + 0x48]
call fcn.1400c77b5
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x48]
call fcn.1400c5d66
lea rcx, [rsp + 0x40]
call fcn.140235a90
mov rax, qword [rsp + 0xa8]
add rsp, 0xb8
ret
Function at 0x1400c7e72
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x1401833a0
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.140182d70
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1401833e1
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1402d2020]
jmp 0x1401833e7
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x48
ret

Function at 0x1400c7f4e
Capabilities:
Get geographical location

Disassembly:
jmp 0x140220800
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
call fcn.14021f730
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x140220867
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
movabs r10, 0xe375262d7cd44270
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
call qword [0x1402d2030]
jmp 0x140220889
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.1400c7152
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x58
ret

Function at 0x1400c7f62
Capabilities:
Terminate process

Disassembly:
jmp 0x140160bc0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret
Function at 0x1400c8331
Capabilities:
Print debug messages

Disassembly:
jmp 0x140244950
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x30]
mov rax, qword [0x1402b4080]
xor rax, rbp
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x30], 0
jne 0x140244976
jmp 0x1402449f3
mov rcx, qword [rbp + 0x30]
call fcn.1400c7652
inc rax
mov qword [rbp], rax
cmp qword [rbp], 0
jne 0x14024498f
jmp 0x1402449f3
mov rax, qword [rbp]
shl rax, 1
mov rcx, rax
add rcx, 0xf
cmp rcx, rax
ja 0x1402449ac
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400c5fa0
sub rsp, rax
lea rax, [rsp + 0x30]
mov qword [rbp + 8], rax
mov rax, qword [rbp]
dec rax
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x30]
mov r8, qword [rbp]
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x10]
call fcn.1400c65e5
test eax, eax
jne 0x1402449f3
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
call fcn.1400c7945
lea rsp, [rbp + 0x20]
pop rbp
ret

Function at 0x1400c877d
Capabilities:
Set environment variable

Disassembly:
jmp 0x140237d90
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add rsp, 0x28
ret

Function at 0x1400c8949
Capabilities:
Initialize winsock library

Disassembly:
jmp 0x1400ef7f0
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1402d1103]
call fcn.1400ca604
nop
lea rdx, [0x1402b6c70]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x1400ef84e
lea rdx, [0x140268a60]
lea rcx, [0x1402b73d0]
call fcn.1400c5942
lea rdx, [0x1400c535c]
mov rcx, rax
call fcn.1400c7b9d
nop
mov eax, 0xffffffff
jmp 0x1400ef91d
xor eax, eax
cmp eax, 1
je 0x1400ef8fa
lea rcx, [rbp + 0xc8]
call fcn.1400c8561
mov qword [rbp + 0xf8], rax
mov rdx, qword [rbp + 0xf8]
lea rcx, [0x1402b6e08]
call fcn.1400c9b69
lea rcx, [rbp + 0xc8]
call fcn.1400c66cb
nop
lea rcx, [0x1402b6e08]
call fcn.1400c718e
movzx eax, al
test eax, eax
jne 0x1400ef8c6
lea rdx, [0x140268a78]
lea rcx, [0x1402b73d0]
call fcn.1400c5942
lea rdx, [0x1400c535c]
mov rcx, rax
call fcn.1400c7b9d
nop
jmp 0x1400ef8fa
lea rdx, [0x140268aa0]
lea rcx, [0x1402b73d0]
call fcn.1400c5942
lea rdx, [0x1400c535c]
mov rcx, rax
call fcn.1400c7b9d
nop
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
jmp 0x1400ef84e
call fcn.1400c8a2f
movzx eax, al
test eax, eax
je 0x1400ef911
call qword [sym.imp.WS2_32.dll_WSACleanup]
nop
xor eax, eax
jmp 0x1400ef91d
call qword [sym.imp.WS2_32.dll_WSACleanup]
nop
mov eax, 0xffffffff
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x1400c8ade
Capabilities:
Parse pe header

Disassembly:
jmp 0x140161ad0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140161af0
xor al, al
jmp 0x140161b71
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140161b03
xor al, al
jmp 0x140161b71
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140161b2d
xor al, al
jmp 0x140161b71
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140161b41
xor al, al
jmp 0x140161b71
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140161b53
xor al, al
jmp 0x140161b71
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140161b6f
xor al, al
jmp 0x140161b71
mov al, 1
add rsp, 0x38
ret
Function at 0x1400c938f
Capabilities:
Terminate process

Disassembly:
jmp 0x140184460
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x14018448e
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
mov ecx, 2
call fcn.1400c9fe2
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000417
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400ca06e
Capabilities:
Print debug messages

Disassembly:
jmp 0x140215670
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x1400ca1db
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x1401834e0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.140182e30
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140183529
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1402d2020]
jmp 0x140183538
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x48
ret

Function at 0x1400ca2e4
Capabilities:
Set environment variable

Disassembly:
jmp 0x14024d8c0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
lea rcx, [rsp + 0x78]
call fcn.1400c6f5e
lea rcx, [rsp + 0x48]
call fcn.1400c6f5e
call fcn.1400c7dc3
mov r8d, eax
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0xc0]
call fcn.1400c6c2f
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x14024d92f
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x48]
call fcn.1400c74db
lea rcx, [rsp + 0x78]
call fcn.1400c74db
mov eax, dword [rsp + 0x24]
jmp 0x14024d9c0
call fcn.1400c7dc3
mov r8d, eax
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0xc8]
call fcn.1400c6c2f
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x14024d976
mov dword [rsp + 0x2c], 0
lea rcx, [rsp + 0x48]
call fcn.1400c74db
lea rcx, [rsp + 0x78]
call fcn.1400c74db
mov eax, dword [rsp + 0x2c]
jmp 0x14024d9c0
lea rcx, [rsp + 0x48]
call fcn.1400c6e7d
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x78]
call fcn.1400c6e7d
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x48]
call fcn.1400c74db
lea rcx, [rsp + 0x78]
call fcn.1400c74db
mov eax, dword [rsp + 0x30]
add rsp, 0xb8
ret
Function at 0x140225580
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.1400c5fa0
sub rsp, rax
mov rax, qword [0x1402b4080]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x1402b9340]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x140225772
lea rax, [rsp + 0x147f]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x38], rax
jae 0x1402256c6
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x1402256c6
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
mov byte [rsp + 0x31], al
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x30], al
movsx eax, byte [rsp + 0x30]
cmp eax, 0xa
jne 0x1402256ab
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x38]
mov byte [rax], 0xd
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, byte [rsp + 0x30]
mov byte [rax], cl
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
jmp 0x140225648
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140225732
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x140225791
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x44], eax
jae 0x14022576d
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x140225791
jmp 0x14022561e
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.1400c7945
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x140225840
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.1400c5fa0
sub rsp, rax
mov rax, qword [0x1402b4080]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x1402b9340]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x140225a4d
lea rax, [rsp + 0x147e]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x38], rax
jae 0x140225999
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x140225999
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
mov word [rsp + 0x40], ax
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x30]
cmp eax, 0xa
jne 0x140225979
mov eax, dword [rsp + 0x78]
add eax, 2
mov dword [rsp + 0x78], eax
mov eax, 0xd
mov rcx, qword [rsp + 0x38]
mov word [rcx], ax
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, word [rsp + 0x30]
mov word [rax], cx
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
jmp 0x140225908
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov eax, eax
shl rax, 1
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140225a0d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x140225a6c
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x48], eax
jae 0x140225a48
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x140225a6c
jmp 0x1402258de
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.1400c7945
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x4011f0
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
sub rsp, 0x28
xor rcx, rcx
call sub.KERNEL32_GetModuleHandleA
mov qword [0x004290a0], rax
call fcn.0040fde0
call fcn.0040b9a0
call fcn.0040fdf0
lea rax, [section..data]
lea rcx, [0x004013b0]
mov qword [rax + 0x30], rcx
lea rcx, section..text
mov qword [rax], rcx
lea rcx, [0x0040118c]
mov qword [rax + 8], rcx
lea rcx, [0x0040118c]
mov qword [rax + 0x10], rcx
lea rcx, [0x004011ec]
mov qword [rax + 0x18], rcx
lea rcx, [0x0041f190]
mov qword [rax + 0x68], rcx
lea rcx, [0x0041f590]
mov qword [rax + 0x70], rcx
lea rcx, [0x0041f5c0]
mov qword [rax + 0x78], rcx
lea rcx, [0x0041fb70]
mov qword [rax + 0x80], rcx
lea rcx, [0x007d3eb0]
mov qword [rax + 0x50], rcx
mov rcx, rax
push 0
jmp 0x420660
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rsi, r9
mov r14d, r8d
mov ebx, edx
mov edi, ecx
call fcn.00420600
test edi, edi
je 0x41ed25
test ebx, ebx
jne 0x41ed3c
test edi, edi
jne 0x41ed16
call qword [0x007d4a98]
call qword [0x007d4aa0]
call fcn.00420620
mov ecx, r14d
call fcn.004203c0
jmp 0x41ed3c
mov rcx, rsi
call fcn.0041ead0
call fcn.004204d0
call qword [0x007d4a90]
test ebx, ebx
je 0x41ed06
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
jmp fcn.00420620
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0x80]
mov rsi, rcx
mov eax, dword [rsi + 0x20]
and eax, 1
mov dword [0x007d4af0], eax
mov rcx, qword [rsi + 0x50]
call fcn.004120e0
mov rcx, qword [rsi + 0x88]
call fcn.004120f0
mov dword [0x007e7e80], 1
lea rdi, [0x007e7e80]
mov qword [0x007e7e88], rsi
call sub.KERNEL32_GetEnvironmentStrings
mov qword [0x007e7e20], rax
call sub.KERNEL32_GetCommandLineA
mov qword [0x007e7e30], rax
mov rcx, qword [rsi + 0x68]
mov rdx, qword [rsi + 0x70]
mov r8, qword [rsi + 0x78]
mov r9, qword [rsi + 0x80]
call fcn.0041ef50
xor edx, edx
mov rcx, rdi
call fcn.004203d0
test byte [rsi + 0x20], 1
jne 0x420724
mov ecx, dword [0x007e7e4c]
mov rdx, qword [0x007e7e50]
mov r8, qword [0x007e7e58]
call qword [rsi + 0x30]
xor ecx, ecx
xor edx, edx
mov r9, 0xffffffffffffffff
mov r8d, eax
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop rbp
jmp 0x41ece0
mov rax, qword [0x007e7e30]
nop dword [rax + rax]
inc rax
mov cl, byte [rax - 1]
cmp cl, 9
je 0x420730
cmp cl, 0x20
je 0x420730
cmp cl, 0x22
jne 0x42074e
mov cl, byte [rax]
mov edx, 0x22
jmp 0x420756
dec rax
mov edx, 0x20
movsx edi, cl
cmp edx, edi
je 0x420774
nop dword [rax]
test cl, cl
je 0x420774
cmp cl, 9
je 0x420774
movsx ecx, byte [rax + 1]
inc rax
cmp edx, ecx
jne 0x420760
lea rdi, [rax + 1]
cmp cl, 0x22
cmovne rdi, rax
jmp 0x420793
inc rdi
movzx eax, byte [rdi]
cmp al, 0x20
je 0x420790
cmp al, 9
je 0x420790
mov rbx, qword [rsi + 0x30]
xor ecx, ecx
call sub.KERNEL32_GetModuleHandleA
mov rsi, rax
lea rcx, [rbp - 0x60]
call sub.KERNEL32_GetStartupInfoA
mov eax, dword [rbp - 0x24]
test al, 1
movzx eax, word [rbp - 0x20]
mov r9d, 0xa
cmovne r9d, eax
xor edx, edx
mov rcx, rsi
mov r8, rdi
call rbx
xor ecx, ecx
xor edx, edx
mov r9, 0xffffffffffffffff
mov r8d, eax
call 0x41ece0
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop rbp
ret