joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002924c
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001c844
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001c844
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14002939c
cmp rax, 0xffffffffffffffff
je 0x14002939c
xor edi, edi
test rbp, rbp
jle 0x140029347
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001f158
mov rbx, rax
test rax, rax
jne 0x1400292d4
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14002933d
mov edx, 0x8000
mov ecx, r14d
call fcn.14001a178
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001d520
cmp eax, 0xffffffff
je 0x14002931d
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400292e4
mov edx, r15d
mov ecx, r14d
call fcn.14001a178
jmp 0x14002933d
cmp byte [rsi + 0x38], dil
je 0x140029334
cmp dword [rsi + 0x34], 5
jne 0x140029334
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14002933d
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001af0c
jmp 0x1400293b0
jns 0x1400293b0
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001c844
cmp rax, 0xffffffffffffffff
jne 0x140029368
cmp byte [rsi + 0x30], dil
je 0x1400293b0
mov edi, dword [rsi + 0x2c]
jmp 0x1400293b0
mov ecx, r14d
call fcn.140018630
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400293b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1400293b0
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1400293a9
mov eax, dword [rsi + 0x2c]
jmp 0x1400293ae
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001c844
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x180005058
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
movsxd r10, dword [rcx + 0x3c]
mov r11d, edx
add r10, rcx
movzx eax, word [r10 + 0x14]
lea r9, [r10 + 0x18]
movzx ebx, word [r10 + 6]
add r9, rax
xor r8d, r8d
cmp r11d, dword [r9 + 0xc]
jb 0x18000509c
mov ecx, dword [r10 + 0x3c]
lea edx, [rcx - 1]
add edx, dword [r9 + 0x10]
lea eax, [rcx - 1]
not eax
and edx, eax
add edx, dword [r9 + 0xc]
cmp r11d, edx
jb 0x1800050ac
add r9, 0x28
mov eax, 0xffff
add bx, ax
je 0x1800050b7
jmp 0x18000507b
mov r8d, dword [r9 + 0x14]
sub r8d, dword [r9 + 0xc]
add r8d, r11d
mov rbx, qword [rsp + 8]
mov eax, r8d
ret
Function at 0x180003c40
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x180003c62
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x180003cdc
mov rdi, r14
mov rcx, rbx
call fcn.180005e00
test rax, rax
jle 0x180003cb4
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.180048370
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x180003ccc
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x180003cd4
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x180003c76
sub r14, rdi
jmp 0x180003dbf
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x180003cf3
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x180003cf5
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x180003d27
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.180048370
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x180003dbc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x180003d62
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x180003d9d
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.180058af0
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x180003dbc
cmp rbp, rax
ja 0x180003d70
test rbp, rbp
je 0x180003dbc
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.180058af0
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
Function at 0x1800438c0
Capabilities:
Get geographical location

Disassembly:
push rdi
sub rsp, 0x40
lea rax, [rsp + 0x20]
mov rdi, rax
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
lea rcx, [rsp + 0x20]
call fcn.1800438b0
mov dword [rsp + 0x28], eax
call fcn.18006c030
mov ecx, 8
imul rcx, rcx, 5
mov rax, qword [rax + rcx]
mov qword [rsp + 0x30], rax
mov r9d, dword [rsp + 0x28]
lea r8, [rsp + 0x20]
mov edx, 0x22
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov eax, 2
imul rax, rax, 0
movzx eax, word [rsp + rax + 0x20]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x30
je 0x18004393f
cmp dword [rsp + 0x24], 0x31
je 0x180043946
cmp dword [rsp + 0x24], 0x32
je 0x18004394d
jmp 0x180043954
mov eax, 2
jmp 0x180043956
mov eax, 1
jmp 0x180043956
mov eax, 3
jmp 0x180043956
xor eax, eax
add rsp, 0x40
pop rdi
ret

Function at 0x18004f640
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.18004f120
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x18004f67f
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1800b1350]
jmp 0x18004f689
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret
Function at 0x18007b130
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x180081380
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.1800ade90
sub rsp, rax
mov rax, qword [0x1800d8080]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x1800daf60]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x180081572
lea rax, [rsp + 0x147f]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x38], rax
jae 0x1800814c6
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x1800814c6
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
mov byte [rsp + 0x31], al
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x30], al
movsx eax, byte [rsp + 0x30]
cmp eax, 0xa
jne 0x1800814ab
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x38]
mov byte [rax], 0xd
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, byte [rsp + 0x30]
mov byte [rax], cl
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
jmp 0x180081448
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x180081532
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x180081591
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x44], eax
jae 0x18008156d
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x180081591
jmp 0x18008141e
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.180044a50
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x1800815b0
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.1800ade90
sub rsp, rax
mov rax, qword [0x1800d8080]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x1800daf60]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x1800817bd
lea rax, [rsp + 0x147e]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x38], rax
jae 0x180081709
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x180081709
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
mov word [rsp + 0x40], ax
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x30]
cmp eax, 0xa
jne 0x1800816e9
mov eax, dword [rsp + 0x78]
add eax, 2
mov dword [rsp + 0x78], eax
mov eax, 0xd
mov rcx, qword [rsp + 0x38]
mov word [rcx], ax
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, word [rsp + 0x30]
mov word [rax], cx
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
jmp 0x180081678
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov eax, eax
shl rax, 1
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x18008177d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1800817dc
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x48], eax
jae 0x1800817b8
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1800817dc
jmp 0x18008164e
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.180044a50
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x180087640
Capabilities:
Get geographical location

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
call fcn.180086b20
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1800876a7
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
movabs r10, 0xe375262d7cd44270
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
call qword [0x1800b1358]
jmp 0x1800876c9
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.180087aa0
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x58
ret
Function at 0x1800983d0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0xb8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.18001dcc0
lea rcx, [rsp + 0x40]
call fcn.180098390
movzx eax, al
test eax, eax
jne 0x180098418
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call fcn.1800982a0
mov rax, qword [rsp + 0x70]
jmp 0x1800985e9
lea rcx, [rsp + 0x40]
call fcn.180009930
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.180098340
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x40]
call fcn.180009930
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.180093d20
cdqe
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x1800984be
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x40]
call fcn.1800982a0
mov rax, qword [rsp + 0x80]
jmp 0x1800985e9
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, qword [rsp + 0x58]
call fcn.180056f60
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.18001dcc0
lea rcx, [rsp + 0x48]
call fcn.180043bc0
movzx eax, al
test eax, eax
jne 0x180098525
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x48]
call fcn.180043ba0
lea rcx, [rsp + 0x40]
call fcn.1800982a0
mov rax, qword [rsp + 0x88]
jmp 0x1800985e9
lea rcx, [rsp + 0x48]
call fcn.180009930
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x40]
call fcn.180009930
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call fcn.180093d20
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x1800985bb
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x48]
call fcn.180043ba0
lea rcx, [rsp + 0x40]
call fcn.1800982a0
mov rax, qword [rsp + 0xa0]
jmp 0x1800985e9
lea rcx, [rsp + 0x48]
call fcn.180047c20
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x48]
call fcn.180043ba0
lea rcx, [rsp + 0x40]
call fcn.1800982a0
mov rax, qword [rsp + 0xa8]
add rsp, 0xb8
ret
Function at 0x180098600
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.18001dcc0
lea rcx, [rsp + 0x20]
call fcn.1800982c0
movzx eax, al
test eax, eax
jne 0x180098645
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x20]
call fcn.1800982a0
mov rax, qword [rsp + 0x40]
jmp 0x18009873f
lea rcx, [rsp + 0x20]
call fcn.180009930
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.180098340
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r9d, 0x40
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, rax
call fcn.180056f60
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.18001dcc0
lea rcx, [rsp + 0x28]
call fcn.180043bc0
movzx eax, al
test eax, eax
jne 0x1800986df
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x28]
call fcn.180043ba0
lea rcx, [rsp + 0x20]
call fcn.1800982a0
mov rax, qword [rsp + 0x50]
jmp 0x18009873f
lea rcx, [rsp + 0x20]
call fcn.180009930
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call fcn.180009930
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r8, rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.180048370
lea rcx, [rsp + 0x28]
call fcn.180047c20
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x28]
call fcn.180043ba0
lea rcx, [rsp + 0x20]
call fcn.1800982a0
mov rax, qword [rsp + 0x68]
add rsp, 0x78
ret

Function at 0x180099e70
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add rsp, 0x28
ret
Function at 0x1800a3930
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x128
lea rcx, [rsp + 0xe8]
call fcn.18006e4c0
lea rcx, [rsp + 0xb8]
call fcn.18006e4c0
lea rcx, [rsp + 0x88]
call fcn.18006e4c0
call fcn.18007ae20
mov r8d, eax
lea rdx, [rsp + 0xe8]
mov rcx, qword [rsp + 0x130]
call fcn.18006e3b0
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
je 0x1800a39d2
mov dword [rsp + 0x54], 0
lea rcx, [rsp + 0x88]
call fcn.18006e550
lea rcx, [rsp + 0xb8]
call fcn.18006e550
lea rcx, [rsp + 0xe8]
call fcn.18006e550
mov eax, dword [rsp + 0x54]
jmp 0x1800a3b78
call fcn.18007ae20
mov r8d, eax
lea rdx, [rsp + 0xb8]
mov rcx, qword [rsp + 0x138]
call fcn.18006e3b0
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0
je 0x1800a3a32
mov dword [rsp + 0x5c], 0
lea rcx, [rsp + 0x88]
call fcn.18006e550
lea rcx, [rsp + 0xb8]
call fcn.18006e550
lea rcx, [rsp + 0xe8]
call fcn.18006e550
mov eax, dword [rsp + 0x5c]
jmp 0x1800a3b78
mov qword [rsp + 0x70], 0
cmp qword [rsp + 0x168], 0
je 0x1800a3ab8
call fcn.18007ae20
mov r8d, eax
lea rdx, [rsp + 0x88]
mov rcx, qword [rsp + 0x168]
call fcn.18006e3b0
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
je 0x1800a3aa6
mov dword [rsp + 0x64], 0
lea rcx, [rsp + 0x88]
call fcn.18006e550
lea rcx, [rsp + 0xb8]
call fcn.18006e550
lea rcx, [rsp + 0xe8]
call fcn.18006e550
mov eax, dword [rsp + 0x64]
jmp 0x1800a3b78
lea rcx, [rsp + 0x88]
call fcn.18006e870
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0xb8]
call fcn.18006e870
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0xe8]
call fcn.18006e870
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x170]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x160]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x158]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x150]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x148]
mov r8, qword [rsp + 0x140]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [rsp + 0x68], eax
lea rcx, [rsp + 0x88]
call fcn.18006e550
lea rcx, [rsp + 0xb8]
call fcn.18006e550
lea rcx, [rsp + 0xe8]
call fcn.18006e550
mov eax, dword [rsp + 0x68]
add rsp, 0x128
ret
Function at 0x1800aac50
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
lea rcx, [rsp + 0x78]
call fcn.18006e4c0
lea rcx, [rsp + 0x48]
call fcn.18006e4c0
call fcn.18007ae20
mov r8d, eax
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0xc0]
call fcn.18006e3b0
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x1800aacbf
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x48]
call fcn.18006e550
lea rcx, [rsp + 0x78]
call fcn.18006e550
mov eax, dword [rsp + 0x24]
jmp 0x1800aad50
call fcn.18007ae20
mov r8d, eax
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0xc8]
call fcn.18006e3b0
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x1800aad06
mov dword [rsp + 0x2c], 0
lea rcx, [rsp + 0x48]
call fcn.18006e550
lea rcx, [rsp + 0x78]
call fcn.18006e550
mov eax, dword [rsp + 0x2c]
jmp 0x1800aad50
lea rcx, [rsp + 0x48]
call fcn.18006e870
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x78]
call fcn.18006e870
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x48]
call fcn.18006e550
lea rcx, [rsp + 0x78]
call fcn.18006e550
mov eax, dword [rsp + 0x30]
add rsp, 0xb8
ret
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x00405600]
xor edx, edx
mov dword [rax], 1
mov rax, qword [0x00405610]
mov dword [rax], 1
mov rax, qword [0x00405620]
mov dword [rax], 1
mov rax, qword [0x004055f0]
mov dword [rax], 1
mov rax, qword [0x004054e0]
cmp word [rax], 0x5a4d
je 0x4010b0
mov rax, qword [0x004055e0]
mov dword [0x00408008], edx
mov eax, dword [rax]
test eax, eax
je 0x4010a0
mov ecx, 2
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x004055a0]
mov edx, dword [rdx]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x00405490]
cmp dword [rax], 1
je 0x4010f0
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x401075
movsxd rcx, dword [rax + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x401058
movzx ecx, word [rax + 0x18]
cmp cx, 0x10b
je 0x401103
cmp cx, 0x20b
jne 0x401058
cmp dword [rax + 0x84], 0xe
jbe 0x401058
mov ecx, dword [rax + 0xf8]
xor edx, edx
test ecx, ecx
setne dl
jmp 0x401058
lea rcx, [sym._matherr]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401058
mov r8d, dword [rax + 0xe8]
xor edx, edx
test r8d, r8d
setne dl
jmp 0x401058

Function at 0x40185f
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push rbp
sub rsp, 0x1d0
lea rbp, [rsp + 0x80]
mov word [rbp + 0x14a], 0x101
movzx eax, word [rbp + 0x14a]
lea rdx, [rbp - 0x60]
mov ecx, eax
mov rax, qword [sym.imp.WSOCK32.dll_WSAStartup]
call rax
mov dword [rbp + 0x14c], 0
lea rcx, [0x004051a6]
mov rax, qword [sym.imp.WSOCK32.dll_gethostbyname]
call rax
mov qword [rbp + 0x140], rax
mov dword [rbp + 0x14c], 0
jmp 0x401900
mov rax, qword [rbp + 0x140]
mov rdx, qword [rax + 0x18]
mov eax, dword [rbp + 0x14c]
cdqe
shl rax, 3
add rax, rdx
mov rax, qword [rax]
mov ecx, dword [rax]
mov rax, qword [sym.imp.WSOCK32.dll_inet_ntoa]
call rax
mov qword [rbp + 0x138], rax
mov rax, qword [rbp + 0x138]
mov rcx, rax
call sym.puts
add dword [rbp + 0x14c], 1
cmp qword [rbp + 0x140], 0
je 0x40192c
mov rax, qword [rbp + 0x140]
mov rdx, qword [rax + 0x18]
mov eax, dword [rbp + 0x14c]
cdqe
shl rax, 3
add rax, rdx
mov rax, qword [rax]
test rax, rax
jne 0x4018bb
mov rax, qword [sym.imp.WSOCK32.dll_WSACleanup]
call rax
nop
add rsp, 0x1d0
pop rbp
ret