joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001070
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
cmp dword [0x1400ba240], 0
jne 0x1400010c2
lea rcx, str.PVIEW_UTF8_ENCODING
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x1400010ab
lea rdx, [0x14007601c]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x1400010b8
mov byte [section..data], al
jmp 0x1400010b8
lea rcx, str.PVIEW_UTF8_ENCODINGTRUE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__putenv]
mov dword [0x1400ba240], 1
movzx eax, byte [section..data]
add rsp, 0x28
ret

Function at 0x1400010d0
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x1400ba240], 0
mov rbx, rcx
jne 0x140001127
lea rcx, str.PVIEW_UTF8_ENCODING
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x140001110
lea rdx, [0x14007601c]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x14000111d
mov byte [section..data], al
jmp 0x14000111d
lea rcx, str.PVIEW_UTF8_ENCODINGTRUE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__putenv]
mov dword [0x1400ba240], 1
cmp byte [section..data], 0
mov rcx, rbx
je 0x140001156
mov r9d, 0x120
lea r8, [0x140076460]
xor edx, edx
call fcn.1400027c0
mov rcx, rax
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wchdir]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__chdir]

Function at 0x140001170
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
push rdi
push r15
sub rsp, 0x28
mov r15, rcx
mov rdi, rdx
lea rcx, str.PVIEW_DATA_BASE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne 0x140001242
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor esi, esi
lea rdx, [rsp + 0x50]
mov rcx, rax
mov dword [rsp + 0x50], esi
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ecx, dword [rsp + 0x50]
mov r14, rax
test ecx, ecx
jle 0x140001235
mov qword [rsp + 0x40], rbx
sub r14, rdi
nop dword [rax + rax]
mov rcx, qword [r14 + rdi]
xor edx, edx
call fcn.140002070
mov rbx, rax
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rax + rcx], 0
jne 0x1400011e5
inc rcx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rdi], rax
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rbx + r8], 0
jne 0x140001201
inc r8
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [rsp + 0x50]
inc esi
add rdi, 8
cmp esi, ecx
jl 0x1400011d0
mov rbx, qword [rsp + 0x40]
mov r14, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x48]
mov dword [r15], ecx
add rsp, 0x28
pop r15
pop rdi
ret
Function at 0x140001250
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x820
cmp dword [0x1400ba240], 0
mov rbx, rdx
mov edi, ecx
jne 0x1400012b0
lea rcx, str.PVIEW_UTF8_ENCODING
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x140001299
lea rdx, [0x14007601c]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x1400012a6
mov byte [section..data], al
jmp 0x1400012a6
lea rcx, str.PVIEW_UTF8_ENCODINGTRUE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__putenv]
mov dword [0x1400ba240], 1
cmp byte [section..data], 0
je 0x14000130f
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x840], 0xffffffff
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rdx, [rsp + 0x840]
lea rcx, [rsp + 0x20]
call fcn.1400021a0
sub rbx, rax
nop dword [rax]
movzx ecx, byte [rax]
mov byte [rbx + rax], cl
lea rax, [rax + 1]
test cl, cl
jne 0x1400012f0
mov rbx, qword [rsp + 0x830]
add rsp, 0x820
pop rdi
ret
mov rdx, rbx
mov ecx, edi
mov rbx, qword [rsp + 0x830]
add rsp, 0x820
pop rdi
jmp qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]

Function at 0x140001330
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x1400ba240], 0
mov rbx, rcx
jne 0x140001387
lea rcx, str.PVIEW_UTF8_ENCODING
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x140001370
lea rdx, [0x14007601c]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x14000137d
mov byte [section..data], al
jmp 0x14000137d
lea rcx, str.PVIEW_UTF8_ENCODINGTRUE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__putenv]
mov dword [0x1400ba240], 1
cmp byte [section..data], 0
mov rcx, rbx
je 0x140001461
mov r9d, 0xf3
mov qword [rsp + 0x30], rsi
lea r8, [0x140076380]
xor edx, edx
call fcn.1400027c0
mov rcx, rax
mov rsi, rax
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__wgetenv]
mov rcx, rax
xor edx, edx
call fcn.1400021a0
mov rbx, rax
test rax, rax
je 0x140001453
mov edx, 0x3f
mov rcx, rax
call sub.VCRUNTIME140.dll_strchr
test rax, rax
je 0x140001453
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
movsxd rbx, eax
test eax, eax
jne 0x140001406
mov rsi, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
mov qword [rsp + 0x38], rdi
mov edx, 2
call fcn.1400029e0
mov r8d, ebx
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor edx, edx
mov rcx, rdi
call fcn.1400021a0
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rdi, qword [rsp + 0x38]
mov rax, rbx
mov rsi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
mov rsi, qword [rsp + 0x30]
mov rax, rbx
add rsp, 0x20
pop rbx
ret
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
Function at 0x140001530
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, r9
mov rdi, r8
mov rbx, rdx
call fcn.140003800
mov rax, qword [0x1400ba258]
test rbx, rbx
cmovne rax, rbx
test rdi, rdi
mov qword [0x1400ba258], rax
mov rax, qword [0x1400ba250]
cmovne rax, rdi
test rsi, rsi
mov qword [0x1400ba250], rax
mov rax, qword [str.xl_a_]
cmovne rax, rsi
mov qword [str.xl_a_], rax
call fcn.140004b80
call fcn.140001720
lea rcx, str.PVIEW_STARTUP_SLEEP
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x1400015b6
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
call fcn.1400042f0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140001d00
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x420
movsxd rax, ecx
lea rbp, [0x1400bae60]
lea r14, [rax*8]
cmp qword [r14 + rbp], 0
jne 0x140001f51
call fcn.1400044d0
mov r8, rax
test rax, rax
jne 0x140001d46
lea eax, [r8 - 1]
jmp 0x140001f53
lea rdx, [rsp + 0x20]
mov rcx, r8
sub rdx, r8
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x140001d51
mov rcx, r8
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, [rsp + 0x20]
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140001d70
lea r8, [0x14007ce30]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140001d90
lea rcx, [rsp + 0x20]
dec rcx
lea r8, [0x14007c5c0]
nop
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140001db0
mov r8, qword [r14 + r8]
xor edx, edx
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140001dc0
lea rax, [rsp + 0x20]
dec rax
nop dword [rax + rax]
cmp byte [rax + 1], 0
lea rax, [rax + 1]
jne 0x140001de0
lea r8, str..m2u
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r8 + rdx]
mov byte [rax + rdx], cl
lea rdx, [rdx + 1]
test cl, cl
jne 0x140001e00
movsxd rax, dword [0x1400bb290]
imul rcx, rax, 0x38
mov rax, qword [0x14007d060]
test byte [rcx + rax + 0x18], 0x40
je 0x140001e51
mov r8, qword [rcx + rax]
lea rcx, str._s_MONITOR:_s:
mov rdx, qword [str._unknown_program_]
call fcn.140003480
lea rdx, [rsp + 0x20]
lea rcx, str.Loading_M2U_table___s__n
call fcn.140003210
lea rdx, [0x14007cca4]
lea rcx, [rsp + 0x20]
call fcn.140001470
mov rsi, rax
test rax, rax
je 0x140001f51
mov edx, 1
lea rcx, [rsp + 0x20]
mov r9, rax
lea r8d, [rdx + 0xf]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, 0x10
jne 0x140001f39
mov rcx, qword [rsp + 0x20]
cmp rcx, qword [str.PV_M2U0100]
jne 0x140001f39
movzx eax, word [rsp + 0x28]
cmp ax, word [0x14007ce68]
jne 0x140001f39
cmp byte [rsp + 0x2b], 2
jne 0x140001f39
movzx eax, byte [rsp + 0x2e]
mov qword [rsp + 0x430], rbx
mov qword [rsp + 0x438], rdi
movzx edi, byte [rsp + 0x2f]
shl edi, 8
add edi, eax
movzx eax, byte [rsp + 0x2d]
shl edi, 8
add edi, eax
movzx eax, byte [rsp + 0x2c]
shl edi, 8
add edi, eax
movsxd rbx, edi
mov rcx, rbx
call fcn.140002ed0
mov r9, rsi
mov qword [r14 + rbp], rax
mov r8, rbx
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rbx, qword [rsp + 0x430]
mov ecx, edi
mov rdi, qword [rsp + 0x438]
cmp rax, rcx
je 0x140001f39
mov rcx, qword [r14 + rbp]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [r14 + rbp], 0
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [r14 + rbp]
neg rax
sbb eax, eax
neg eax
dec eax
jmp 0x140001f53
xor eax, eax
lea r11, [rsp + 0x420]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x140002a30
Capabilities:
Query environment variable
Terminate process
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rsi
push rdi
mov eax, 0x1020
call fcn.140066c80
sub rsp, rax
mov rdx, rcx
lea rbx, [0x1400bdf20]
mov rcx, rbx
lea r8, [rsp + 0x1048]
call fcn.140001810
cmp dword [0x1400bb224], 0
mov esi, eax
mov edi, 1
mov byte [rsp + 0x20], 0xa
je 0x140002a90
lea rcx, [rsp + 0x21]
call fcn.1400033a0
lea edi, [rax + 1]
mov r8, qword [str._unknown_program_]
lea rax, [rsp + 0x20]
movsxd rcx, edi
lea rdx, str._s_Fatal:
add rcx, rax
call fcn.1400017b0
add edi, eax
lea rdx, [rsp + 0x20]
movsxd rcx, edi
sub rcx, rbx
add rdx, rcx
nop
movzx eax, byte [rbx]
mov byte [rdx + rbx], al
lea rbx, [rbx + 1]
test al, al
jne 0x140002ac0
mov ecx, dword [0x14007d048]
lea rdx, [rsp + 0x20]
add edi, esi
mov eax, 2
test ecx, ecx
mov r8d, edi
cmovle ecx, eax
mov dword [0x14007d048], ecx
call fcn.140003a70
mov r9, qword [0x1400bb210]
test r9, r9
je 0x140002b28
movsxd r8, edi
lea rcx, [rsp + 0x20]
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp dword [0x1400bb230], 0
jle 0x140002b28
mov rcx, qword [0x1400bb210]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
mov rax, qword [0x1400bb288]
test rax, rax
je 0x140002b36
call rax
lea rcx, str.PVIEW_FATAL_PROMPT
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x140002b55
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call fcn.140003630
lea rcx, str.PVIEW_FATAL_SPIN
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x140002b69
jmp 0x140002b67
call fcn.140002ec0
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x140003210
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push r15
mov eax, 0x1060
call fcn.140066c80
sub rsp, rax
cmp dword [0x14007d048], 0
mov r15, rcx
je 0x140003389
mov qword [rsp + 0x1058], rbx
mov qword [rsp + 0x1050], rbp
mov qword [rsp + 0x1048], rsi
movsxd rsi, dword [0x1400bb238]
mov qword [rsp + 0x1040], rdi
xor edi, edi
mov qword [rsp + 0x1038], r12
lea r12, [rsp + 0x1078]
mov qword [rsp + 0x1030], r14
test esi, esi
je 0x1400032a0
mov r8, rsi
mov dword [0x1400bb238], edi
lea edx, [rdi + 8]
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
jmp 0x1400032a2
mov esi, edi
cmp dword [0x1400bb228], 0
movsxd r14, esi
je 0x1400032c1
mov dword [0x1400bb228], edi
mov ebp, 1
mov byte [rsp + r14 + 0x30], 0xa
jmp 0x1400032c3
mov ebp, edi
mov eax, ebp
lea rbx, [rsp + 0x30]
add rax, r14
add rbx, rax
call fcn.140001510
mov qword [rsp + 0x28], r12
mov r9, r15
mov qword [rsp + 0x20], rdi
mov rdx, rbx
mov rdi, 0xffffffffffffffff
mov rcx, qword [rax]
mov r8, rdi
or rcx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vsprintf]
mov ecx, dword [0x14007d048]
test eax, eax
mov r12, qword [rsp + 0x1038]
mov rbx, qword [rsp + 0x1058]
cmovs eax, edi
mov rdi, qword [rsp + 0x1040]
add ebp, eax
test ecx, ecx
jle 0x140003339
lea r8d, [rsi + rbp]
test r8d, r8d
jle 0x140003339
lea rdx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__write]
mov r9, qword [0x1400bb210]
mov rsi, qword [rsp + 0x1048]
test r9, r9
je 0x140003379
lea rcx, [rsp + 0x30]
movsxd r8, ebp
add rcx, r14
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp dword [0x1400bb230], 0
jle 0x140003379
mov rcx, qword [0x1400bb210]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
mov rbp, qword [rsp + 0x1050]
mov r14, qword [rsp + 0x1030]
add rsp, 0x1060
pop r15
ret
Function at 0x140003480
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push r15
mov eax, 0x1060
call fcn.140066c80
sub rsp, rax
cmp dword [0x14007d048], 0
mov r15, rcx
je 0x140003620
mov qword [rsp + 0x1058], rbx
mov qword [rsp + 0x1050], rbp
mov qword [rsp + 0x1048], rsi
xor esi, esi
mov qword [rsp + 0x1040], rdi
mov qword [rsp + 0x1038], r12
lea r12, [rsp + 0x1078]
mov qword [rsp + 0x1030], r14
movsxd r14, dword [0x1400bb238]
test r14d, r14d
je 0x140003511
mov r8, r14
mov dword [0x1400bb238], esi
lea edx, [rsi + 8]
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
jmp 0x140003514
mov r14d, esi
cmp dword [0x1400bb228], 0
movsxd rbp, r14d
je 0x140003532
mov dword [0x1400bb228], esi
mov edi, 1
mov byte [rsp + rbp + 0x30], 0xa
jmp 0x140003534
mov edi, esi
cmp dword [0x1400bb224], 0
je 0x140003559
mov eax, edi
lea rcx, [rsp + 0x30]
add rax, rbp
add rcx, rax
call fcn.1400033a0
mov r15, qword [rsp + 0x1070]
add edi, eax
movsxd rax, edi
lea rbx, [rsp + 0x30]
add rax, rbp
add rbx, rax
call fcn.140001510
mov qword [rsp + 0x28], r12
mov r9, r15
mov qword [rsp + 0x20], rsi
mov rdx, rbx
mov rsi, 0xffffffffffffffff
mov rcx, qword [rax]
mov r8, rsi
or rcx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vsprintf]
mov ecx, dword [0x14007d048]
test eax, eax
mov r12, qword [rsp + 0x1038]
mov rbx, qword [rsp + 0x1058]
cmovs eax, esi
mov rsi, qword [rsp + 0x1048]
add edi, eax
test ecx, ecx
jle 0x1400035d0
lea r8d, [r14 + rdi]
test r8d, r8d
jle 0x1400035d0
lea rdx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__write]
mov r9, qword [0x1400bb210]
mov r14, qword [rsp + 0x1030]
test r9, r9
je 0x140003610
lea rcx, [rsp + 0x30]
movsxd r8, edi
add rcx, rbp
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp dword [0x1400bb230], 0
jle 0x140003610
mov rcx, qword [0x1400bb210]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
mov rbp, qword [rsp + 0x1050]
mov rdi, qword [rsp + 0x1040]
add rsp, 0x1060
pop r15
ret
Function at 0x1400038e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
mov eax, 0x1048
call fcn.140066c80
sub rsp, rax
cmp ecx, dword [0x14007d050]
jle 0x14000390e
xor eax, eax
add rsp, 0x1048
ret
cmp dword [0x14007d048], 0
je 0x140003a62
mov qword [rsp + 0x1040], rbx
xor ebx, ebx
mov qword [rsp + 0x1038], rbp
lea rbp, [rsp + 0x1060]
mov qword [rsp + 0x1030], rsi
mov qword [rsp + 0x1028], rdi
movsxd rdi, dword [0x1400bb238]
test edi, edi
je 0x140003968
mov r8, rdi
mov dword [0x1400bb238], ebx
lea edx, [rbx + 8]
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll_memset
jmp 0x14000396a
mov edi, ebx
cmp dword [0x1400bb228], 0
movsxd rsi, edi
je 0x140003986
mov dword [0x1400bb228], ebx
mov ebx, 1
mov byte [rsp + rsi + 0x20], 0xa
cmp dword [0x1400bb224], 0
je 0x1400039a3
mov eax, ebx
lea rcx, [rsp + 0x20]
add rax, rsi
add rcx, rax
call fcn.1400033a0
add ebx, eax
mov r8, qword [str._unknown_program_]
lea rcx, [rsp + 0x20]
movsxd rax, ebx
lea rdx, str._s_Warning:
add rax, rsi
add rcx, rax
call fcn.1400017b0
mov rdx, qword [rsp + 0x1058]
lea rcx, [rsp + 0x20]
add ebx, eax
mov r8, rbp
movsxd rax, ebx
add rax, rsi
add rcx, rax
call fcn.140001810
mov ecx, dword [0x14007d048]
add ebx, eax
mov rbp, qword [rsp + 0x1038]
test ecx, ecx
jle 0x140003a0c
lea r8d, [rbx + rdi]
test r8d, r8d
jle 0x140003a0c
lea rdx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__write]
mov r9, qword [0x1400bb210]
mov rdi, qword [rsp + 0x1028]
test r9, r9
je 0x140003a4c
lea rcx, [rsp + 0x20]
movsxd r8, ebx
add rcx, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp dword [0x1400bb230], 0
jle 0x140003a4c
mov rcx, qword [0x1400bb210]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
inc dword [0x1400bb260]
mov rsi, qword [rsp + 0x1030]
mov rbx, qword [rsp + 0x1040]
mov eax, 1
add rsp, 0x1048
ret
Function at 0x140004fe0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x38
cmp dword [0x1400bc018], 0
jne 0x14000505f
mov qword [rsp + 0x30], rbx
call fcn.140005110
call fcn.1400050c0
call fcn.140005070
call fcn.140004f90
lea rcx, [0x1400a19d0]
call fcn.140002f10
xor ebx, ebx
mov dword [0x1400bc018], eax
xor r9d, r9d
mov qword [rsp + 0x20], rbx
lea r8, [0x1400a19d8]
mov ecx, eax
lea rdx, str.Analytical_Geometry_Library
call fcn.1400031d0
lea rcx, str.dgl_USE_PSLIST
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x140005054
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov ebx, eax
mov dword [0x1400bc188], ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret
Function at 0x140058490
Capabilities:
Encode data using xor

Disassembly:
push rbx
and r8d, 0x1f
mov r9, rdx
movabs rbx, 0xc2b2ae3d27d4eb4f
movabs r11, 0x9e3779b185ebca87
cmp r8, 8
jb 0x14005827c
mov r10d, r8d
mov qword [rsp + 0x10], rdi
shr r10, 3
movabs rdi, 0x7a1435883d4d519d
imul rax, r10, 0xfffffffffffffff8
add r8, rax
mov rdx, qword [r9]
add r9, 8
imul rdx, rbx
rol rdx, 0x1f
imul rdx, r11
xor rcx, rdx
rol rcx, 0x1b
imul rcx, r11
sub rcx, rdi
sub r10, 1
jne 0x140058250
mov rdi, qword [rsp + 0x10]
mov rax, r9
movabs r10, 0x165667b19e3779f9
cmp r8, 4
jb 0x1400582ab
mov eax, dword [rax]
add r9, 4
imul rax, r11
xor rcx, rax
rol rcx, 0x17
imul rcx, rbx
add rcx, r10
sub r8, 4
test r8, r8
je 0x1400582dd
movabs rdx, 0x27d4eb2f165667c5
nop word [rax + rax]
movzx eax, byte [r9]
lea r9, [r9 + 1]
imul rax, rdx
xor rcx, rax
rol rcx, 0xb
imul rcx, r11
sub r8, 1
jne 0x1400582c0
mov rax, rcx
shr rax, 0x21
xor rax, rcx
imul rax, rbx
mov rcx, rax
shr rcx, 0x1d
xor rcx, rax
imul rcx, r10
mov rax, rcx
shr rax, 0x20
xor rax, rcx
pop rbx
ret
push rbx
sub rsp, 0x20
mov rbx, qword [rcx]
cmp rbx, 0x20
jb 0x14005856d
mov rdx, qword [rcx + 8]
mov r9, qword [rcx + 0x18]
mov rax, rdx
mov r8, qword [rcx + 0x10]
mov r11, r9
mov r10, qword [rcx + 0x20]
rol r11, 0xc
rol rax, 1
add r11, rax
mov qword [rsp + 0x30], rsi
movabs rsi, 0x9e3779b185ebca87
mov qword [rsp + 0x38], rdi
movabs rdi, 0xc2b2ae3d27d4eb4f
mov rax, r8
rol rax, 7
add r11, rax
mov rax, r10
imul rdx, rdi
imul r8, rdi
imul r10, rdi
imul r9, rdi
mov rdi, qword [rsp + 0x38]
rol rax, 0x12
add r11, rax
rol rdx, 0x1f
imul rdx, rsi
movabs rax, 0x7a1435883d4d519d
rol r8, 0x1f
xor r11, rdx
rol r10, 0x1f
imul r11, rsi
imul r8, rsi
imul r10, rsi
sub r11, rax
rol r9, 0x1f
xor r11, r8
imul r11, rsi
imul r9, rsi
sub r11, rax
xor r11, r9
imul r11, rsi
sub r11, rax
xor r11, r10
movabs r10, 0x85ebca77c2b2ae63
imul r11, rsi
mov rsi, qword [rsp + 0x30]
add r10, r11
jmp 0x14005857e
mov r10, qword [rcx + 0x18]
movabs rdx, 0x27d4eb2f165667c5
add r10, rdx
add r10, rbx
lea rdx, [rcx + 0x28]
mov rcx, r10
xor r9d, r9d
mov r8, rbx
add rsp, 0x20
pop rbx
jmp 0x140058210
Function at 0x140001b48
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001b92
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001b92
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001b92
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001b92
cmp dword [rcx + 0x84], 0xe
jbe 0x140001b92
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001b94
xor al, al
add rsp, 0x28
ret
Function at 0x140137dc0
Capabilities:
Terminate process

Disassembly:
sti
and al, 0xfe
sub spl, byte [0x17d08d16d]
invalid
cld
pop r11
jmp 0x140137dcd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x140137ddd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140137dc5
lea eax, [rcx + 1]
jmp 0x140137deb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x140137dfe
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140137de4
sub eax, 3
jb 0x140137e1e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140137e6d
sar eax, 1
movsxd rbp, eax
jb 0x140137e54
jmp 0x140137e2c
add ebx, ebx
jne 0x140137e2a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140137e54
inc ecx
add ebx, ebx
jne 0x140137e3a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140137e54
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140137e4d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140137e3c
add ecx, 2
jmp 0x140137e59
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140137d82
jmp 0x140137dcd
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0xc2c00
mov dl, 0x1b
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140137eb9
cmp rsi, rcx
jae 0x140137ec1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140137ea0
cmp al, 0x8f
ja 0x140137ea0
cmp byte [rsi - 2], 0xf
je 0x140137ea6
sub al, 0xe8
cmp al, 1
ja 0x140137e8a
cmp rsi, rcx
jae 0x140137ec1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140137e90
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x140137ec1
lodsb al, byte [rsi]
jmp 0x140137ea0
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x132000]
mov eax, dword [rdi]
or eax, eax
je 0x140137f2a
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x13aff0]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140137ece
jns 0x140137f03
movzx rdx, word [rdi]
add rdi, 2
jmp 0x140137f0d
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140137f24
mov qword [rbx], rax
add rbx, 8
jmp 0x140137eee
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140137f64
cmp al, 0xef
ja 0x140137f56
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140137f36
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x140137f45
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x24f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140137fb8
sub rsp, 0xffffffffffffff80
jmp 0x1400bcd0c