joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800bdb04
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
movsxd rbp, ecx
mov r9, r8
mov rax, rbp
lea rcx, [0x1800ec240]
and eax, 0x3f
mov r10, rbp
sar r10, 6
xor edi, edi
mov rsi, rdx
mov r14, rbp
lea r8, [rax + rax*8]
mov rax, qword [rcx + r10*8]
mov ecx, 4
mov qword [rsp + 0x78], rcx
mov r11, qword [rax + r8*8 + 0x28]
lea r12d, [rcx + 6]
test r9, r9
je 0x1800bdb62
cmp word [rdx], r12w
jne 0x1800bdb62
or byte [rax + r8*8 + 0x38], cl
jmp 0x1800bdb68
and byte [rax + r8*8 + 0x38], 0xfb
lea rdx, [rdx + r9*2]
mov rcx, rsi
mov rbx, rsi
cmp rsi, rdx
jae 0x1800bdcc3
mov r9d, 0x1a
lea r13d, [r9 - 0xd]
movzx eax, word [rcx]
cmp ax, r9w
je 0x1800bdc9e
lea r9, [rcx + 2]
cmp ax, r13w
je 0x1800bdba1
mov rcx, r9
jmp 0x1800bdbc4
cmp r9, rdx
jae 0x1800bdbdb
cmp word [r9], r12w
mov eax, 2
cmove rax, qword [rsp + 0x78]
add rcx, rax
mov eax, r12d
cmp word [r9], r12w
cmovne ax, r13w
mov word [rbx], ax
mov r9d, 0x1a
add rbx, 2
cmp rcx, rdx
jb 0x1800bdb85
jmp 0x1800bdcc3
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rdi
mov r8d, 2
lea rdx, [rsp + 0x70]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1800bdc98
cmp dword [rsp + 0x80], edi
je 0x1800bdc98
mov rdx, r14
lea r11, [0x1800ec240]
sar rdx, 6
and r14d, 0x3f
mov rax, qword [r11 + rdx*8]
lea r8, [r14 + r14*8]
test byte [rax + r8*8 + 0x38], 0x48
je 0x1800bdc71
movzx eax, word [rsp + 0x70]
cmp ax, r12w
jne 0x1800bdc44
mov word [rbx], r12w
jmp 0x1800bdcbf
mov word [rbx], r13w
mov word [rsp + 0x78], ax
mov rax, qword [r11 + rdx*8]
lea rcx, [rax + r8*8]
mov al, byte [rsp + rdi + 0x78]
mov byte [rcx + rdi + 0x3a], al
inc rdi
cmp rdi, 2
jl 0x1800bdc4d
mov rax, qword [r11 + rdx*8]
mov byte [rax + r8*8 + 0x3c], r12b
jmp 0x1800bdcbf
cmp word [rsp + 0x70], r12w
jne 0x1800bdc7e
cmp rbx, rsi
je 0x1800bdc3e
mov rdx, 0xfffffffffffffffe
mov ecx, ebp
lea r8d, [rdx + 3]
call fcn.1800bd7d0
cmp word [rsp + 0x70], r12w
je 0x1800bdcc3
mov word [rbx], r13w
jmp 0x1800bdcbf
lea r11, [0x1800ec240]
mov rcx, qword [r11 + r10*8]
mov al, byte [rcx + r8*8 + 0x38]
test al, 0x40
jne 0x1800bdcbb
or al, 2
mov byte [rcx + r8*8 + 0x38], al
jmp 0x1800bdcc3
mov word [rbx], r9w
add rbx, 2
sub rbx, rsi
sar rbx, 1
lea eax, [rbx + rbx]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800c272c
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1800bd7d0
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1800bd7d0
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1800c287c
cmp rax, 0xffffffffffffffff
je 0x1800c287c
xor edi, edi
test rbp, rbp
jle 0x1800c2827
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.1800a6480
mov rbx, rax
test rax, rax
jne 0x1800c27b4
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1800c281d
mov edx, 0x8000
mov ecx, r14d
call fcn.1800c2324
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1800ad878
cmp eax, 0xffffffff
je 0x1800c27fd
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1800c27c4
mov edx, r15d
mov ecx, r14d
call fcn.1800c2324
jmp 0x1800c281d
cmp byte [rsi + 0x38], dil
je 0x1800c2814
cmp dword [rsi + 0x34], 5
jne 0x1800c2814
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x1800c281d
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1800a6500
jmp 0x1800c2890
jns 0x1800c2890
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1800bd7d0
cmp rax, 0xffffffffffffffff
jne 0x1800c2848
cmp byte [rsi + 0x30], dil
je 0x1800c2890
mov edi, dword [rsi + 0x2c]
jmp 0x1800c2890
mov ecx, r14d
call fcn.1800b7770
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1800c2890
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1800c2890
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1800c2889
mov eax, dword [rsi + 0x2c]
jmp 0x1800c288e
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1800bd7d0
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x1400113ca
Capabilities:
Terminate process

Disassembly:
jmp 0x14001a170
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400114c4
Capabilities:
Parse pe header

Disassembly:
jmp 0x14001aca0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14001acc0
xor al, al
jmp 0x14001ad41
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14001acd3
xor al, al
jmp 0x14001ad41
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001acfd
xor al, al
jmp 0x14001ad41
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14001ad11
xor al, al
jmp 0x14001ad41
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14001ad23
xor al, al
jmp 0x14001ad41
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001ad3f
xor al, al
jmp 0x14001ad41
mov al, 1
add rsp, 0x38
ret
Function at 0x140001e42
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x140052fa0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov qword [rsp], 0
jmp 0x140052fc8
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
mov rax, qword [rsp + 0x30]
cmp qword [rsp], rax
jae 0x140053012
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x20]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
movabs rax, 0x100000001b3
mov rcx, qword [rsp + 0x20]
imul rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x140052fbd
mov rax, qword [rsp + 0x20]
add rsp, 0x18
ret
Function at 0x140002c89
Capabilities:
Get geographical location

Disassembly:
jmp 0x1400813d0
push rdi
sub rsp, 0x40
lea rax, [rsp + 0x20]
mov rdi, rax
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
lea rcx, [rsp + 0x20]
call fcn.140002e0f
mov dword [rsp + 0x28], eax
call fcn.140003f3f
mov ecx, 8
imul rcx, rcx, 5
mov rax, qword [rax + rcx]
mov qword [rsp + 0x30], rax
mov r9d, dword [rsp + 0x28]
lea r8, [rsp + 0x20]
mov edx, 0x22
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov eax, 2
imul rax, rax, 0
movzx eax, word [rsp + rax + 0x20]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x30
je 0x14008144f
cmp dword [rsp + 0x24], 0x31
je 0x140081456
cmp dword [rsp + 0x24], 0x32
je 0x14008145d
jmp 0x140081464
mov eax, 2
jmp 0x140081466
mov eax, 1
jmp 0x140081466
mov eax, 3
jmp 0x140081466
xor eax, eax
add rsp, 0x40
pop rdi
ret

Function at 0x14000346d
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140102420
mov rax, rcx
neg rcx
test rax, 7
je 0x14010243d
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x140102498
test al, 7
jne 0x140102430
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x140102451
mov rdx, qword [rax - 8]
test dl, dl
je 0x1401024c2
test dh, dh
je 0x1401024bc
shr rdx, 0x10
test dl, dl
je 0x1401024b6
test dh, dh
je 0x1401024b0
shr rdx, 0x10
test dl, dl
je 0x1401024aa
test dh, dh
je 0x1401024a4
shr edx, 0x10
test dl, dl
je 0x14010249e
test dh, dh
jne 0x140102451
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret
Function at 0x1400034a4
Capabilities:
Query environment variable

Disassembly:
jmp 0x140159d00
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.140159880
lea rcx, [rsp + 0x20]
call fcn.1401598d0
movzx eax, al
test eax, eax
jne 0x140159d45
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x20]
call fcn.1401598b0
mov rax, qword [rsp + 0x40]
jmp 0x140159e3f
lea rcx, [rsp + 0x20]
call fcn.1401599d0
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.140159970
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r9d, 0x40
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, rax
call fcn.14000380a
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.140002e1e
lea rcx, [rsp + 0x28]
call fcn.140003cbf
movzx eax, al
test eax, eax
jne 0x140159ddf
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x28]
call fcn.140005100
lea rcx, [rsp + 0x20]
call fcn.1401598b0
mov rax, qword [rsp + 0x50]
jmp 0x140159e3f
lea rcx, [rsp + 0x20]
call fcn.1401599d0
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call fcn.140006078
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r8, rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.14000374c
lea rcx, [rsp + 0x28]
call fcn.1400069ab
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x28]
call fcn.140005100
lea rcx, [rsp + 0x20]
call fcn.1401598b0
mov rax, qword [rsp + 0x68]
add rsp, 0x78
ret
Function at 0x140003990
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x1400a7d20
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.1400a76a0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1400a7d5f
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1401ef020]
jmp 0x1400a7d69
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret

Function at 0x140003be8
Capabilities:
Query environment variable

Disassembly:
jmp 0x140159a50
sub rsp, 0xb8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140159880
lea rcx, [rsp + 0x40]
call fcn.140159a00
movzx eax, al
test eax, eax
jne 0x140159a98
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call fcn.1401598b0
mov rax, qword [rsp + 0x70]
jmp 0x140159c69
lea rcx, [rsp + 0x40]
call fcn.1401599d0
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.140159970
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x40]
call fcn.1401599d0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.140004d45
cdqe
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x140159b3e
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x40]
call fcn.1401598b0
mov rax, qword [rsp + 0x80]
jmp 0x140159c69
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, qword [rsp + 0x58]
call fcn.14000380a
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.1400035fd
lea rcx, [rsp + 0x48]
call fcn.14000303f
movzx eax, al
test eax, eax
jne 0x140159ba5
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x48]
call fcn.140001cbc
lea rcx, [rsp + 0x40]
call fcn.1401598b0
mov rax, qword [rsp + 0x88]
jmp 0x140159c69
lea rcx, [rsp + 0x48]
call fcn.1400040c5
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x40]
call fcn.1401599d0
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call fcn.140004d45
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x140159c3b
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x48]
call fcn.140001cbc
lea rcx, [rsp + 0x40]
call fcn.1401598b0
mov rax, qword [rsp + 0xa0]
jmp 0x140159c69
lea rcx, [rsp + 0x48]
call fcn.1400035b7
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x48]
call fcn.140001cbc
lea rcx, [rsp + 0x40]
call fcn.1401598b0
mov rax, qword [rsp + 0xa8]
add rsp, 0xb8
ret
Function at 0x140003c01
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x1400a7c50
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.1400a7620
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1400a7c91
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1401ef020]
jmp 0x1400a7c97
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x48
ret

Function at 0x140003cc9
Capabilities:
Get geographical location

Disassembly:
jmp 0x1401412b0
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
call fcn.1401401e0
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x140141317
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
movabs r10, 0xe375262d7cd44270
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
call qword [0x1401ef030]
jmp 0x140141339
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.140002fb8
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x58
ret

Function at 0x140003cdd
Capabilities:
Terminate process

Disassembly:
jmp 0x140083000
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140004061
Capabilities:
Print debug messages

Disassembly:
jmp 0x1401673b0
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x30]
mov rax, qword [0x1401d4080]
xor rax, rbp
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x30], 0
jne 0x1401673d6
jmp 0x140167453
mov rcx, qword [rbp + 0x30]
call fcn.14000346d
inc rax
mov qword [rbp], rax
cmp qword [rbp], 0
jne 0x1401673ef
jmp 0x140167453
mov rax, qword [rbp]
shl rax, 1
mov rcx, rax
add rcx, 0xf
cmp rcx, rax
ja 0x14016740c
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.140001ee7
sub rsp, rax
lea rax, [rsp + 0x30]
mov qword [rbp + 8], rax
mov rax, qword [rbp]
dec rax
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x30]
mov r8, qword [rbp]
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x10]
call fcn.1400024d2
test eax, eax
jne 0x140167453
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
call fcn.140003729
lea rsp, [rbp + 0x20]
pop rbp
ret

Function at 0x140004223
Capabilities:
Parse pe header

Disassembly:
jmp 0x140176c30
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
mov rax, qword [rsp]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140176c54
xor eax, eax
jmp 0x140176ca2
mov rax, qword [rsp]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp]
add rcx, rax
mov rax, rcx
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
cmp dword [rax], 0x4550
je 0x140176c7c
xor eax, eax
jmp 0x140176ca2
mov rax, qword [rsp + 8]
add rax, 0x18
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x10]
movzx eax, word [rax]
cmp eax, 0x20b
je 0x140176c9d
xor eax, eax
jmp 0x140176ca2
mov eax, 1
add rsp, 0x28
ret

Function at 0x140004485
Capabilities:
Set environment variable

Disassembly:
jmp 0x14015bbb0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add rsp, 0x28
ret

Function at 0x1400047af
Capabilities:
Parse pe header

Disassembly:
jmp 0x140086200
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140086220
xor al, al
jmp 0x1400862a1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140086233
xor al, al
jmp 0x1400862a1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14008625d
xor al, al
jmp 0x1400862a1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140086271
xor al, al
jmp 0x1400862a1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140086283
xor al, al
jmp 0x1400862a1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14008629f
xor al, al
jmp 0x1400862a1
mov al, 1
add rsp, 0x38
ret
Function at 0x140004c4b
Capabilities:
Enumerate pe sections

Disassembly:
jmp 0x140176aa0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x10], rax
mov dword [rsp], 0
mov rax, qword [rsp + 0x10]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x10]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 8], rax
jmp 0x140176afe
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
mov rax, qword [rsp + 8]
add rax, 0x28
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x10]
movzx eax, word [rax + 6]
cmp dword [rsp], eax
jae 0x140176b3d
mov rax, qword [rsp + 8]
mov eax, dword [rax + 0xc]
cmp qword [rsp + 0x38], rax
jb 0x140176b3b
mov rax, qword [rsp + 8]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 8]
add eax, dword [rcx + 8]
mov eax, eax
cmp qword [rsp + 0x38], rax
jae 0x140176b3b
mov rax, qword [rsp + 8]
jmp 0x140176b3f
jmp 0x140176ae8
xor eax, eax
add rsp, 0x28
ret

Function at 0x140004ff7
Capabilities:
Terminate process

Disassembly:
jmp 0x1400a9010
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x1400a903e
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
mov ecx, 2
call fcn.140005b78
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000417
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140005bfa
Capabilities:
Print debug messages

Disassembly:
jmp 0x1401370b0
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x140005d53
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x1400a7d90
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.1400a76e0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1400a7dd9
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1401ef020]
jmp 0x1400a7de8
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x48
ret

Function at 0x140005e5c
Capabilities:
Set environment variable

Disassembly:
jmp 0x140172140
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
lea rcx, [rsp + 0x78]
call fcn.140002dce
lea rcx, [rsp + 0x48]
call fcn.140002dce
call fcn.140003b6b
mov r8d, eax
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0xc0]
call fcn.140002ad6
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x1401721af
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x48]
call fcn.140003314
lea rcx, [rsp + 0x78]
call fcn.140003314
mov eax, dword [rsp + 0x24]
jmp 0x140172240
call fcn.140003b6b
mov r8d, eax
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0xc8]
call fcn.140002ad6
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x1401721f6
mov dword [rsp + 0x2c], 0
lea rcx, [rsp + 0x48]
call fcn.140003314
lea rcx, [rsp + 0x78]
call fcn.140003314
mov eax, dword [rsp + 0x2c]
jmp 0x140172240
lea rcx, [rsp + 0x48]
call fcn.140002cfc
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x78]
call fcn.140002cfc
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x48]
call fcn.140003314
lea rcx, [rsp + 0x78]
call fcn.140003314
mov eax, dword [rsp + 0x30]
add rsp, 0xb8
ret
Function at 0x140006adc
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
jmp 0x1400181e0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x70
lea rcx, [0x1401ee140]
call fcn.140006163
cmp qword [rsp + 0x80], 0
jne 0x14001820d
xor eax, eax
jmp 0x140018382
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140018230
xor eax, eax
jmp 0x140018382
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140018260
xor eax, eax
jmp 0x140018382
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x28]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], 0
jmp 0x1400182ed
mov eax, dword [rsp + 0x50]
inc eax
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x18]
cmp dword [rsp + 0x50], eax
jae 0x140018380
lfence
mov eax, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x58]
call fcn.1400069b0
test eax, eax
jne 0x14001837b
lfence
mov eax, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
movzx eax, word [rcx + rax*2]
mov word [rsp + 0x60], ax
movzx eax, word [rsp + 0x60]
mov rcx, qword [rsp + 0x38]
mov eax, dword [rcx + rax*4]
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x64]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
jmp 0x140018382
jmp 0x1400182e3
xor eax, eax
add rsp, 0x70
pop rdi
ret