joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b4210
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [rdx + 8]
mov rdi, rdx
mov rsi, rcx
xor r8d, r8d
mov ecx, dword [rcx + 0x1328]
mov edx, dword [rbx + 0xc]
call fcn.14001604c
mov ebx, dword [rbx]
xor ebp, ebp
add rbx, qword [rsi + 0x78]
cmp dword [rdi + 0x14], ebp
jbe 0x1400b42ca
mov rax, qword [rdi + 0x18]
mov r8, qword [rax + rbp*8]
mov rax, rbx
mov rcx, r8
shr rax, 0xc
shr rcx, 0xc
sub ecx, eax
shl r8d, 0xa
mov eax, dword [0x1401f92d0]
mov edx, ecx
and edx, 3
and eax, 0x9f00001f
shl edx, 0x1a
and ecx, 0x1ffffc
or edx, ecx
shl edx, 3
or edx, eax
mov eax, dword [0x1401f92d4]
xor r8d, eax
mov dword [0x1401f92d0], edx
and r8d, 0x3ffc00
lea rdx, [0x1401f92d0]
xor eax, r8d
mov r8d, 0xc
mov dword [0x1401f92d4], eax
mov ecx, dword [rsi + 0x1328]
call fcn.1400467b4
add rbx, 0xc
inc ebp
cmp ebp, dword [rdi + 0x14]
jb 0x1400b424c
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400b43ec
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x38
test dword [rcx + 0x150], 0x40000000
je 0x1400b441c
lea r8, str.FIXED
mov edx, 0x4de
lea r9, str.ARM64
mov qword [rsp + 0x20], r8
xor ecx, ecx
call fcn.14005e3e8
int3
test byte [rcx + 0x278], 4
je 0x1400b444e
test byte [rcx + 0xa6], 0x40
jne 0x1400b444e
lea r8, str.DYNAMICBASE:NO
mov edx, 0x4de
lea r9, str.ARM64
mov qword [rsp + 0x20], r8
xor ecx, ecx
call fcn.14005e3e8
int3
xor eax, eax
cmp byte [0x1401fa4b8], al
je 0x1400b44a1
cmp byte [0x1401fcad1], al
je 0x1400b44a1
cmp byte [0x1401fcad0], al
je 0x1400b4482
lea r9, str.SIMARM64
mov edx, 0xfeb
lea r8, str.INCREMENTAL
xor ecx, ecx
call fcn.1400ebbc8
mov cl, 1
call fcn.140005b0c
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.14000510c
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [rcx + 0x1270]
mov byte [rdx], 1
bts eax, 9
lea rdx, [0x1400b23fc]
mov dword [rcx + 0x1270], eax
mov qword [0x1401fa4b0], rdx
lea rdx, [0x1400b4c6c]
mov qword [0x1401fa4a8], rdx
lea rdx, [0x1400b458c]
mov qword [0x1401fa4a0], rdx
lea rdx, [fcn.1400b6d70]
mov qword [0x1401fa498], rdx
lea rdx, [fcn.1400b8c84]
mov qword [0x1401fa490], rdx
mov edx, 0x3a64
cmp word [rcx + 0x48], dx
jne 0x1400b4542
btr eax, 9
mov dword [rcx + 0x1270], eax
lea rax, [0x1400f3308]
mov qword [0x1401fce08], rax
lea rax, [0x1400f3db8]
mov qword [0x1401fce00], rax
lea rax, [fcn.1400f3f8c]
mov qword [0x1401fcdf8], rax
lea rax, [0x1400f3fd8]
jmp 0x1400b457e
mov eax, 0xa64e
cmp word [rcx + 0x48], ax
jne 0x1400b4585
lea rax, [0x14001eb00]
mov qword [0x1401fce08], rax
lea rax, [0x14013c55c]
mov qword [0x1401fce00], rax
lea rax, [0x1400345e0]
mov qword [0x1401fcdf8], rax
lea rax, [0x14013d2c0]
mov qword [0x1401fcdf0], rax
add rsp, 0x38
ret
Function at 0x1400b9b48
Capabilities:
Check if file exists
Delete file
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edx, dword [0x1401fb554]
xor edi, edi
test edx, edx
je 0x1400b9c27
mov rax, qword [0x1401fa3e0]
mov rbx, qword [rax + rdi*8]
test rbx, rbx
je 0x1400b9c1d
cmp qword [rbx + 0x18], 0
je 0x1400b9c1d
mov al, byte [rbx + 0x28]
test al, 2
je 0x1400b9c1d
test al, 0x20
je 0x1400b9ba4
mov rcx, qword [rbx + 0x30]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
test eax, eax
je 0x1400b9c67
test byte [rbx + 0x28], 4
je 0x1400b9bbc
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test eax, eax
je 0x1400b9c77
mov rcx, qword [rbx + 0x18]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
jne 0x1400b9ca7
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x1400b9ca7
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1400b9c97
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400b9c12
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x1400b9c87
and qword [rbx + 0x18], 0
mov edx, dword [0x1401fb554]
inc edi
cmp edi, edx
jb 0x1400b9b62
mov cl, 1
call fcn.140005b0c
cmp byte [0x1401fa4b8], 0
je 0x1400b9c5b
call fcn.1401232e4
mov rcx, qword [0x1401fa4f0]
xor edx, edx
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__waccess]
test eax, eax
jne 0x1400b9c5b
mov rcx, qword [0x1401fa4f0]
call fcn.1400ba5e4
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov r8, qword [rbx]
mov edx, 0x451
xor ecx, ecx
call fcn.14005e3e8
int3
mov r8, qword [rbx]
mov edx, 0x451
xor ecx, ecx
call fcn.14005e3e8
int3
mov r8, qword [rbx]
mov edx, 0x455
xor ecx, ecx
call fcn.14005e3e8
int3
mov r8, qword [rbx]
mov edx, 0x451
xor ecx, ecx
call fcn.14005e3e8
int3
mov r8, qword [rbx]
mov edx, 0x451
xor ecx, ecx
call fcn.14005e3e8
int3
Function at 0x1400b9de4
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rbx, rcx
call fcn.1400b9d1c
mov al, byte [rbx + 0x28]
xor esi, esi
and al, 0xa
mov dword [rbx + 0x2c], esi
cmp al, 0xa
jne 0x1400b9e13
mov eax, 0x400000
jmp 0x1400b9e51
mov rcx, qword [rbx + 0x18]
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x1400b9e36
mov r8, qword [rbx]
mov edx, 0x450
xor ecx, ecx
call fcn.14005e3e8
int3
mov rax, qword [rsp + 0x40]
test rax, rax
jne 0x1400b9e4e
mov rcx, qword [rbx]
mov edx, 0x470
call fcn.14005e3e8
int3
mov dword [rbx + 0x2c], eax
lea ecx, [rax + 0x10000]
mov dword [rbx + 0x38], eax
shr ecx, 0x10
mov eax, ecx
mov ebp, ecx
shl eax, 0x10
mov dword [rbx + 0x3c], eax
lea r14, [rcx*8]
mov ecx, 8
mov rdx, r14
call fcn.14004881c
test rax, rax
jne 0x1400b9e8e
mov edx, 0x44e
xor ecx, ecx
call fcn.14005e3e8
int3
test byte [rbx + 0x28], 8
lea r8, [rbx + 0x30]
mov qword [r8], rax
lea rax, [rbx + 0x48]
mov qword [rax], rax
mov qword [rax + 8], rax
jne 0x1400b9f05
mov r9d, 1
test ebp, ebp
je 0x1400b9ef1
lea ecx, [r9 + 1]
cmp ebp, ecx
jb 0x1400b9ef1
mov rdi, qword [r8]
lea rax, [rdi - 8]
add rax, r14
cmp rdi, r8
ja 0x1400b9ecc
cmp rax, r8
jae 0x1400b9ef1
mov eax, ebp
cdq
idiv ecx
mov eax, ebp
sub eax, edx
add esi, ecx
cmp esi, eax
jl 0x1400b9ed5
inc eax
cdq
idiv ecx
movsxd rcx, eax
mov rax, r9
shl rcx, 4
shr rcx, 3
rep stosq qword [rdi], rax
movsxd rcx, esi
jmp 0x1400b9f00
mov rax, qword [r8]
mov qword [rax + rcx*8], r9
add rcx, r9
cmp rcx, rbp
jl 0x1400b9ef6
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
jmp fcn.1400b9ff0

Function at 0x1400ba590
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rdi, rdx
mov rcx, rdx
call fcn.14000478c
mov r8d, 0xb
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x1400ba5d7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, rdi
mov edx, 0x45a
mov r9d, eax
xor ecx, ecx
call fcn.14005e3e8
int3
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400ba5e4
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
call fcn.14000478c
mov edi, 3
jmp 0x1400ba627
mov ecx, edi
dec edi
test ecx, ecx
jle 0x1400ba637
lea rcx, [rsp + 0x38]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__get_errno]
cmp dword [rsp + 0x38], 0xd
jne 0x1400ba637
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wremove]
mov ebx, eax
cmp eax, 0xffffffff
je 0x1400ba602
mov rsi, qword [rsp + 0x40]
test ebx, ebx
mov rbx, qword [rsp + 0x30]
sete al
add rsp, 0x20
pop rdi
ret
Function at 0x1400ba678
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
test byte [rcx + 0x14], 2
mov rdi, rcx
movsxd rdx, dword [rcx]
mov rax, qword [0x1401fa3e0]
mov rbx, qword [rax + rdx*8]
je 0x1400ba74c
mov edx, dword [rcx + 4]
xor r9d, r9d
mov esi, dword [rcx + 0x10]
xor r8d, r8d
mov rcx, qword [rbx + 0x18]
sub esi, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x1400ba6d0
mov r8d, dword [rdi + 4]
mov edx, 0x452
mov rcx, qword [rbx]
call fcn.14005e3e8
int3
mov rcx, qword [rbx + 0x18]
lea rdx, [rdi + 0x18]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400ba719
cmp dword [rsp + 0x40], esi
jne 0x1400ba719
movzx ecx, word [rdi + 6]
mov rax, qword [rbx + 0x30]
mov qword [rax + rcx*8], 1
test byte [rbx + 0x28], 2
je 0x1400ba76c
mov eax, dword [rdi + 0x10]
cmp eax, dword [rbx + 0x2c]
jbe 0x1400ba76c
mov dword [rbx + 0x2c], eax
jmp 0x1400ba76c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___doserrno]
cmp dword [rax], 0x70
jne 0x1400ba732
mov rcx, qword [rbx]
mov edx, 0x49c
call fcn.14005e3e8
int3
mov rcx, qword [rbx + 0x18]
call fcn.1400ba77c
mov rcx, qword [rbx]
mov r8d, eax
mov edx, 0x454
call fcn.14005e3e8
int3
mov eax, dword [rdi + 4]
mov rcx, qword [rbx + 0x30]
shr rax, 0x10
test byte [rdi + 0x14], 4
je 0x1400ba767
mov qword [rcx + rax*8], 1
jmp 0x1400ba76c
and qword [rcx + rax*8], 0
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1400ba994
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rax, qword [rcx + 0x40]
lea r8, [rsp + 0x48]
and qword [rsp + 0x48], 0
mov rbx, rcx
mov rcx, qword [rcx + 0x18]
xor r9d, r9d
mov edx, dword [rax + 4]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x1400ba9d7
mov r8d, dword [rsp + 0x48]
mov edx, 0x452
mov rcx, qword [rbx]
call fcn.14005e3e8
int3
mov rdx, qword [rbx + 0x40]
lea r9, [rsp + 0x40]
mov edi, dword [rbx + 0x2c]
mov eax, 0x10000
mov rcx, qword [rbx + 0x18]
sub edi, dword [rdx + 4]
cmp edi, eax
cmova edi, eax
and qword [rsp + 0x20], 0
mov r8d, edi
add rdx, 0x18
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400baa24
cmp dword [rsp + 0x40], edi
jne 0x1400baa24
mov rax, qword [rbx + 0x40]
mov rbx, qword [rsp + 0x50]
and dword [rax + 0x14], 0xfffffff7
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rbx + 0x18]
call fcn.1400ba77c
mov rcx, qword [rbx]
mov r8d, eax
mov edx, 0x453
call fcn.14005e3e8
int3
Function at 0x1400ce374
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rdi, rdx
mov rsi, rcx
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
mov rcx, qword [rdi + 8]
call fcn.140015df8
mov ebx, eax
mov dword [rsp + 0x68], eax
mov ecx, eax
call fcn.140010488
test al, al
je 0x1400ce3bc
mov edx, 0x470
mov rcx, qword [rdi + 8]
call fcn.14005e3e8
nop
test ebx, ebx
je 0x1400ce3ca
xor edx, edx
mov ecx, ebx
call fcn.140033a30
nop
and qword [rsp + 0x40], 0
mov byte [rsp + 0x38], 1
and dword [rsp + 0x30], 0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov rax, qword [rsi + 0xf20]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov rdx, qword [0x1401fc570]
mov r8, qword [rdx + 8]
mov rdx, qword [rdx + 0x10]
mov rcx, rsi
call fcn.1400104bc
mov r8, qword [0x1401fa9c0]
mov rdx, rax
mov rcx, rsi
call fcn.1400cd814
test al, al
jne 0x1400ce453
xor r8d, r8d
mov rdx, qword [0x1401fa9c0]
mov rcx, qword [0x1401fc570]
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x1400ce453
mov r8, qword [0x1401fa9c0]
mov edx, 0x450
xor ecx, ecx
call fcn.14005e3e8
int3
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x1400d02f0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
lea rbx, [r8 - 1]
mov r11, rcx
sar rbx, 1
mov r14, r9
mov rdi, r8
mov r10, rdx
mov rsi, rdx
mov rcx, rdx
cmp rdx, rbx
jge 0x1400d0358
lea r9, [rcx + rcx]
mov r8, qword [r11 + r9*8 + 8]
mov rdx, qword [r11 + r9*8 + 0x10]
call fcn.1400d0884
movzx edx, al
lea rcx, [r9 + 1]
xor rdx, 1
add rcx, rdx
mov rax, qword [r11 + rcx*8]
mov qword [r11 + r10*8], rax
mov r10, rcx
cmp rcx, rbx
jl 0x1400d0327
cmp rcx, rbx
jne 0x1400d0370
test dil, 1
jne 0x1400d0370
mov rax, qword [r11 + rdi*8 - 8]
mov qword [r11 + r10*8], rax
lea r10, [rdi - 1]
cmp rsi, r10
jge 0x1400d0398
mov r8, qword [r14]
lea r9, [r10 - 1]
sar r9, 1
mov rdx, qword [r11 + r9*8]
call fcn.1400d0884
test al, al
je 0x1400d0398
mov qword [r11 + r10*8], rdx
mov r10, r9
cmp rsi, r9
jl 0x1400d0375
mov rax, qword [r14]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov qword [r11 + r10*8], rax
add rsp, 0x20
pop r14
ret
Function at 0x1400e9cd0
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov dil, dl
mov rcx, qword [rcx + 8]
call fcn.14000478c
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x1400e9d43
mov rcx, qword [rbx + 8]
mov r9, rcx
sub r9, rax
movzx edx, word [rax]
movzx r8d, word [rax + r9]
sub edx, r8d
jne 0x1400e9d12
add rax, 2
test r8d, r8d
jne 0x1400e9cfc
test edx, edx
je 0x1400e9d43
call fcn.14000478c
mov rdx, qword [rbx + 8]
xor r8d, r8d
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x1400e9d43
mov r8, qword [rbx + 0x10]
mov edx, 0x47c
mov rcx, qword [rbx + 8]
call fcn.1400e86bc
int3
test dil, dil
je 0x1400e9db7
mov rax, qword [rbx + 8]
mov ecx, 0x208
mov qword [0x140201868], rax
call qword [sym.imp.tbbmalloc.dll_scalable_malloc]
test rax, rax
jne 0x1400e9d70
mov edx, 0x44e
xor ecx, ecx
call fcn.14005e3e8
int3
mov edx, 0x104
mov qword [0x140201870], rax
mov rcx, rax
call fcn.140004f74
mov rdx, qword [0x140201870]
xor r8d, r8d
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x1400e9dab
mov rcx, qword [rbx + 8]
mov edx, 0x53e
call fcn.1400eb7f0
int3
mov rcx, qword [0x140201870]
call fcn.140134660
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400eb408
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x240
mov rax, qword [0x1401f7030]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rdx, rcx
mov r8d, 0x104
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wfullpath]
mov ebx, 2
lea rdx, [0x1401c7e88]
mov r8d, ebx
lea rcx, [rsp + 0x20]
lea rbp, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
xor edi, edi
test eax, eax
jne 0x1400eb47d
lea rdx, [0x1401a1908]
lea rcx, [rsp + 0x24]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
lea rcx, [rbx + rax]
jmp 0x1400eb4cc
mov r8, rbx
lea rdx, [0x1401c7e90]
lea rcx, [rsp + 0x22]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
test eax, eax
lea rcx, [rsp + 0x26]
cmovne rcx, rbp
jmp 0x1400eb4cc
xor edx, edx
mov word [rbx], di
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400eb4c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1400eb508
mov eax, 0x5c
lea rcx, [rbx + 2]
mov word [rbx], ax
lea rdx, [0x1401a1908]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
mov rbx, rax
test rax, rax
jne 0x1400eb49f
mov al, 1
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14005a600
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
lea r8, [rsp + 0x20]
mov edx, 0x2368
xor ecx, ecx
call fcn.1400eb834
xor al, al
jmp 0x1400eb4e3
Function at 0x1400eb568
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x40
mov sil, r9b
mov edi, r8d
mov rbp, rdx
mov r14, rcx
xor r15d, r15d
mov bl, r15b
cmp byte [0x1401facf4], r15b
jne 0x1400eb686
lea r12, [0x1401fb370]
mov qword [rax - 0x28], r12
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
cmp byte [0x1401facf4], r15b
jne 0x1400eb5ee
mov bl, 1
mov byte [0x1401facf4], bl
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x80]
mov r8d, edi
mov rdx, rbp
mov rcx, r14
call fcn.140007650
nop
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test bl, bl
je 0x1400eb686
mov cl, 1
call fcn.140005b0c
test sil, sil
je 0x1400eb675
cmp byte [0x1401fa4b8], r15b
je 0x1400eb631
mov rcx, qword [0x1401fa9c0]
test rcx, rcx
je 0x1400eb62c
call fcn.1400492f0
mov qword [0x1401fa9c0], rax
call fcn.1401232e4
mov rcx, qword [0x1401fa9c0]
test rcx, rcx
je 0x1400eb648
cmp word [rcx], r15w
je 0x1400eb648
call fcn.1400ba5e4
cmp byte [0x1401fa4b8], r15b
je 0x1400eb675
mov rcx, qword [0x1401fa4f0]
test rcx, rcx
je 0x1400eb675
xor edx, edx
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__waccess]
test eax, eax
jne 0x1400eb675
mov rcx, qword [0x1401fa4f0]
call fcn.1400ba5e4
cmp edi, 2
jne 0x1400eb686
mov edx, 0x4c2
xor ecx, ecx
call fcn.1400eb754
test byte [0x1401fca80], 0x80
je 0x1400eb69b
lea rdx, [0x1401a6ff0]
call fcn.1400c1c40
mov ecx, dword [rsp + 0x80]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x140101ca4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov r11, rcx
mov dword [rax + 0x10], edx
lea rcx, [rax + 0x10]
mov rbx, r8
mov esi, edx
or r10d, 0xffffffff
mov edi, 4
movzx edx, byte [rcx]
lea rax, [0x1401b02b0]
movzx r8d, r10b
inc rcx
xor r8, rdx
shr r10d, 8
xor r10d, dword [rax + r8*4]
sub rdi, 1
jne 0x140101ccb
xor edx, edx
mov eax, r10d
div dword [r11 + 0x30]
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x140101d02
mov dword [rax], edx
mov rax, qword [r11 + 0x28]
mov rdx, qword [rax + rdx*8]
test rdx, rdx
je 0x140101d3a
mov r8d, dword [rdx + 8]
xor ecx, ecx
test r8d, r8d
je 0x140101d3a
mov rdi, qword [rdx]
mov r11, qword [r11 + 8]
mov rdx, qword [rdi + rcx*8]
mov r10d, dword [rdi + rcx*8]
shr rdx, 0x20
cmp dword [r11 + rdx*4], esi
je 0x140101d4c
inc ecx
cmp ecx, r8d
jb 0x140101d21
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
test rbx, rbx
je 0x140101d53
mov dword [rbx], edx
test r9, r9
je 0x140101d5b
mov dword [r9], r10d
mov eax, 1
jmp 0x140101d3c
Function at 0x14011b000
Capabilities:
Resolve path using msvcrt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [0x1401f7030]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov rcx, qword [0x14020c598]
mov rbx, qword [0x14020c008]
call fcn.14000a1a8
test eax, eax
je 0x14011b052
mov r8, rbx
mov edx, 0x451
xor ecx, ecx
call fcn.14005e3e8
int3
and qword [rsp + 0x20], 0
lea r8, str._PRELIB_
and qword [rsp + 0x28], 0
lea rcx, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__wdupenv_s]
lea r8, str._LIB_
xor edx, edx
lea rcx, [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__wdupenv_s]
cmp qword [rsp + 0x20], 0
je 0x14011b0a2
lea rdx, [0x1401a3214]
lea rcx, str._PRELIB_
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__wputenv_s]
cmp qword [rsp + 0x28], 0
je 0x14011b0be
lea rdx, [0x1401a3214]
lea rcx, str._LIB_
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__wputenv_s]
mov edi, 0x106
lea r8, [0x1401cb940]
mov edx, edi
lea rcx, [rbp - 0x80]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
mov r8, rbx
lea rcx, [rbp - 0x80]
mov edx, edi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
call fcn.1400ebaf0
and qword [rsp + 0x78], 0
mov rdi, rax
cmp byte [0x1401fcad2], 0
lea rax, str.link.exe
mov qword [rsp + 0x40], rax
lea rax, str._lib
mov qword [rsp + 0x48], rax
lea rax, str._wowa64lib
mov qword [rsp + 0x50], rax
lea rax, str._ignore:4221
mov qword [rsp + 0x58], rax
lea rax, str._nolinkrepro
mov qword [rsp + 0x60], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rdi
je 0x14011b176
call fcn.14000775c
call fcn.14000775c
mov rdx, qword [0x1401fa558]
mov ecx, 0x2347
mov rdx, qword [rdx]
call fcn.14000761c
lea rcx, [rsp + 0x40]
call fcn.1401320c4
mov rcx, rbx
call fcn.14011a5c4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p__wpgmptr]
lea r8, [rsp + 0x40]
lea rcx, [rsp + 0x30]
mov rdx, qword [rax]
call fcn.1400052dc
mov rcx, rbx
call fcn.1400ba5e4
test rdi, rdi
je 0x14011b1a4
mov rcx, rdi
call qword [sym.imp.tbbmalloc.dll_scalable_free]
mov rdx, qword [rsp + 0x20]
test rdx, rdx
je 0x14011b1c6
lea rcx, str._PRELIB_
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__wputenv_s]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rdx, qword [rsp + 0x28]
test rdx, rdx
je 0x14011b1e8
lea rcx, str._LIB_
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__wputenv_s]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
cmp byte [rsp + 0x30], 0
jne 0x14011b206
mov r8, qword [0x1401fa558]
mov edx, 0x486
xor ecx, ecx
mov r8, qword [r8]
call fcn.14005e3e8
int3
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.14005a600
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x14011fed8
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x68
mov rax, qword [0x1401f7030]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r8d, 0xb
lea rdx, [rsp + 0x40]
lea rcx, str.MSVCETW_PARENT_CONTEXT_THREAD_ID
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x14011ff46
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.1400223b4
nop
test byte [0x1401fca80], 0x80
je 0x14011ff3a
lea rcx, [rsp + 0x20]
call fcn.140120ff0
mov r8d, eax
mov rcx, qword [0x1401fb8f0]
call fcn.14012120c
nop
lea rcx, [rsp + 0x20]
call fcn.1400235d4
jmp 0x14011ff5e
test byte [0x1401fca80], 0x80
je 0x14011ff5e
xor r8d, r8d
mov rcx, qword [0x1401fb8f0]
call fcn.14012120c
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14005a600
add rsp, 0x68
ret
Function at 0x140120960
Capabilities:
Set environment variable

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x1401f7030]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea rbx, [rsp + 0x6a]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r9d, eax
sub rbx, 2
mov eax, 0xcccccccd
mul r9d
shr edx, 3
movzx ecx, dx
shl cx, 2
lea r8d, [rcx + rdx]
add r8w, r8w
sub r9w, r8w
add r9w, 0x30
mov word [rbx], r9w
mov r9d, edx
test edx, edx
jne 0x140120986
lea r8, [rsp + 0x6a]
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140007148
cmp qword [rsp + 0x38], 8
lea rdx, [rsp + 0x20]
lea rcx, str.MSVCETW_PARENT_CONTEXT_THREAD_ID
cmovae rdx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rcx, [rsp + 0x20]
call fcn.1400235d4
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14005a600
add rsp, 0x80
pop rbx
ret