joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14010b9b0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x10090
call fcn.140110440
sub rsp, rax
mov rax, qword [0x140152880]
xor rax, rsp
mov qword [rsp + 0x10080], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor ebp, ebp
mov rsi, rcx
mov word [rsp + 0x80], bp
mov edi, 0x28
mov word [rsp + 0x30], bp
test al, al
je 0x14010ba72
nop dword [rax]
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], bpl
lea rcx, [rsp + 0x24]
call fcn.14011f414
cmp rax, 1
jne 0x14010bace
mov rcx, rdi
mov rax, rbx
cmp word [rbx], bp
je 0x14010ba4f
add rax, 2
dec rcx
cmp word [rax], bp
jne 0x14010ba43
cmp rcx, 1
jb 0x14010bace
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], bp
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x14010ba10
mov r8d, 0x10000
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0xffff
ja 0x14010baa3
lea rcx, [rsp + 0x80]
call fcn.140121e90
jmp 0x14010baa5
xor eax, eax
mov rcx, qword [rsp + 0x10080]
xor rcx, rsp
call fcn.140110170
lea r11, [rsp + 0x10090]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.140113930
int3
Function at 0x14010fcd0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rax, qword [0x140152880]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor r14d, r14d
mov rbp, rdx
mov word [rsp + 0x30], r14w
mov rsi, rcx
mov edi, 0x28
test al, al
je 0x14010fd81
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], r14b
lea rcx, [rsp + 0x24]
call fcn.14011f414
cmp rax, 1
jne 0x14010fdb7
mov rcx, rdi
mov rax, rbx
cmp word [rbx], r14w
je 0x14010fd5d
add rax, 2
dec rcx
cmp word [rax], r14w
jne 0x14010fd50
cmp rcx, 1
jb 0x14010fdb7
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], r14w
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x14010fd20
mov rdx, rbp
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140110170
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.140113930
int3

Function at 0x14010fff0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x140152880]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor ebp, ebp
mov rsi, rcx
mov word [rsp + 0x30], bp
mov edi, 0x28
test al, al
je 0x14011009f
nop dword [rax]
nop dword [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], bpl
lea rcx, [rsp + 0x24]
call fcn.14011f414
cmp rax, 1
jne 0x1401100d5
mov rcx, rdi
mov rax, rbx
cmp word [rbx], bp
je 0x14011007c
nop
add rax, 2
dec rcx
cmp word [rax], bp
jne 0x140110070
cmp rcx, 1
jb 0x1401100d5
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], bp
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x140110040
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140110170
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.140113930
int3

Function at 0x140110bd8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140110c22
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140110c22
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140110c22
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140110c22
cmp dword [rcx + 0x84], 0xe
jbe 0x140110c22
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140110c24
xor al, al
add rsp, 0x28
ret
Function at 0x140114fa4
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140115013
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140115013
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140115013
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140115013
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140115013
cmp dword [rcx + 0x84], 0xe
jbe 0x140115013
cmp dword [rcx + 0xf8], 0
je 0x140115013
mov ecx, ebx
call fcn.1401150c4
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140114ea0
nop
cmp dword [rbp + 0x20], 0
je 0x140115061
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14011506c
int3
xor r8d, r8d
xor edx, edx
jmp 0x140114fa4

Function at 0x1401151a8
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140115013
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140115013
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140115013
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140115013
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140115013
cmp dword [rcx + 0x84], 0xe
jbe 0x140115013
cmp dword [rcx + 0xf8], 0
je 0x140115013
mov ecx, ebx
call fcn.1401150c4
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140114ea0
nop
cmp dword [rbp + 0x20], 0
je 0x140115061
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14011506c
int3
xor r8d, r8d
xor edx, edx
jmp 0x140114fa4
Function at 0x140126d00
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140126d87
mov rsi, rbx
cmp word [rax], bp
je 0x140126d46
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140126d30
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140126d2c
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140122368
mov rdi, rax
test rax, rax
je 0x140126d74
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14012c9c0
mov rbp, rdi
xor ecx, ecx
call fcn.140122eb0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140129030
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x140129046
mov al, 1
jmp 0x1401290a6
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x140129057
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1401290a4
mov ecx, dword [rcx + 0x18]
nop
call fcn.140127048
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1401290a4
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1401290a4
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1401290a4
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1401290a6
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x14012c810
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14012c838
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14012c838
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140001160
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.140001920
movzx eax, al
test eax, eax
jne 0x140001180
mov ecx, 7
call fcn.140001ed0
nop
mov byte [rsp + 0x20], 0
call fcn.1400018b0
mov byte [rsp + 0x21], al
cmp dword [0x14005a070], 1
jne 0x1400011a4
mov ecx, 7
call fcn.140001ed0
nop
jmp 0x1400011fc
cmp dword [0x14005a070], 0
jne 0x1400011f7
mov dword [0x14005a070], 1
lea rdx, [0x140044318]
lea rcx, [0x1400442e0]
call fcn.140009ec0
test eax, eax
je 0x1400011d8
mov eax, 0xff
jmp 0x140001301
lea rdx, [0x1400442d8]
lea rcx, [0x1400442c8]
call fcn.140009e50
mov dword [0x14005a070], 2
jmp 0x1400011fc
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.140001b10
call fcn.140001ea0
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140001259
mov rcx, qword [rsp + 0x30]
call fcn.140001a80
movzx eax, al
test eax, eax
je 0x140001259
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x1400442a0]
nop
call fcn.140001eb0
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x14000128d
mov rcx, qword [rsp + 0x38]
call fcn.140001a80
movzx eax, al
test eax, eax
je 0x14000128d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.14000a630
nop
call fcn.140001340
mov dword [rsp + 0x28], eax
call fcn.140002080
movzx eax, al
test eax, eax
jne 0x1400012ac
mov ecx, dword [rsp + 0x28]
call fcn.14000a680
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x1400012bb
call fcn.14000a5f0
nop
xor edx, edx
mov cl, 1
call fcn.140001b40
mov eax, dword [rsp + 0x28]
jmp 0x140001301
add rsp, 0x68
ret

Function at 0x140003ed0
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.1400039b0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140003f0f
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1400442a0]
jmp 0x140003f19
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret
Function at 0x1400234c0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x1400266f0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0xb8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140002e80
lea rcx, [rsp + 0x40]
call fcn.1400266b0
movzx eax, al
test eax, eax
jne 0x140026738
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call fcn.1400265e0
mov rax, qword [rsp + 0x70]
jmp 0x140026909
lea rcx, [rsp + 0x40]
call fcn.140002f00
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.140026660
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x40]
call fcn.140002f00
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.1400264b0
cdqe
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x1400267de
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x40]
call fcn.1400265e0
mov rax, qword [rsp + 0x80]
jmp 0x140026909
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, qword [rsp + 0x58]
call fcn.14000e690
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140002e80
lea rcx, [rsp + 0x48]
call fcn.140002ec0
movzx eax, al
test eax, eax
jne 0x140026845
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x48]
call fcn.140002ea0
lea rcx, [rsp + 0x40]
call fcn.1400265e0
mov rax, qword [rsp + 0x88]
jmp 0x140026909
lea rcx, [rsp + 0x48]
call fcn.140002f00
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x40]
call fcn.140002f00
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call fcn.1400264b0
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x1400268db
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x48]
call fcn.140002ea0
lea rcx, [rsp + 0x40]
call fcn.1400265e0
mov rax, qword [rsp + 0xa0]
jmp 0x140026909
lea rcx, [rsp + 0x48]
call fcn.140003460
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x48]
call fcn.140002ea0
lea rcx, [rsp + 0x40]
call fcn.1400265e0
mov rax, qword [rsp + 0xa8]
add rsp, 0xb8
ret
Function at 0x140031770
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x128
lea rcx, [rsp + 0xe8]
call fcn.14001fbf0
lea rcx, [rsp + 0xb8]
call fcn.14001fbf0
lea rcx, [rsp + 0x88]
call fcn.14001fbf0
call fcn.14001fcd0
mov r8d, eax
lea rdx, [rsp + 0xe8]
mov rcx, qword [rsp + 0x130]
call fcn.14001fba0
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
je 0x140031812
mov dword [rsp + 0x54], 0
lea rcx, [rsp + 0x88]
call fcn.14001fc50
lea rcx, [rsp + 0xb8]
call fcn.14001fc50
lea rcx, [rsp + 0xe8]
call fcn.14001fc50
mov eax, dword [rsp + 0x54]
jmp 0x1400319b8
call fcn.14001fcd0
mov r8d, eax
lea rdx, [rsp + 0xb8]
mov rcx, qword [rsp + 0x138]
call fcn.14001fba0
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0
je 0x140031872
mov dword [rsp + 0x5c], 0
lea rcx, [rsp + 0x88]
call fcn.14001fc50
lea rcx, [rsp + 0xb8]
call fcn.14001fc50
lea rcx, [rsp + 0xe8]
call fcn.14001fc50
mov eax, dword [rsp + 0x5c]
jmp 0x1400319b8
mov qword [rsp + 0x70], 0
cmp qword [rsp + 0x168], 0
je 0x1400318f8
call fcn.14001fcd0
mov r8d, eax
lea rdx, [rsp + 0x88]
mov rcx, qword [rsp + 0x168]
call fcn.14001fba0
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
je 0x1400318e6
mov dword [rsp + 0x64], 0
lea rcx, [rsp + 0x88]
call fcn.14001fc50
lea rcx, [rsp + 0xb8]
call fcn.14001fc50
lea rcx, [rsp + 0xe8]
call fcn.14001fc50
mov eax, dword [rsp + 0x64]
jmp 0x1400319b8
lea rcx, [rsp + 0x88]
call fcn.14001fec0
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0xb8]
call fcn.14001fec0
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0xe8]
call fcn.14001fec0
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x170]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x160]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x158]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x150]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x148]
mov r8, qword [rsp + 0x140]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [rsp + 0x68], eax
lea rcx, [rsp + 0x88]
call fcn.14001fc50
lea rcx, [rsp + 0xb8]
call fcn.14001fc50
lea rcx, [rsp + 0xe8]
call fcn.14001fc50
mov eax, dword [rsp + 0x68]
add rsp, 0x128
ret
Function at 0x1400340e0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
lea rcx, [rsp + 0x78]
call fcn.14001fbf0
lea rcx, [rsp + 0x48]
call fcn.14001fbf0
call fcn.14001fcd0
mov r8d, eax
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0xc0]
call fcn.14001fba0
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x14003414f
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x48]
call fcn.14001fc50
lea rcx, [rsp + 0x78]
call fcn.14001fc50
mov eax, dword [rsp + 0x24]
jmp 0x1400341e0
call fcn.14001fcd0
mov r8d, eax
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0xc8]
call fcn.14001fba0
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x140034196
mov dword [rsp + 0x2c], 0
lea rcx, [rsp + 0x48]
call fcn.14001fc50
lea rcx, [rsp + 0x78]
call fcn.14001fc50
mov eax, dword [rsp + 0x2c]
jmp 0x1400341e0
lea rcx, [rsp + 0x48]
call fcn.14001fec0
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x78]
call fcn.14001fec0
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x48]
call fcn.14001fc50
lea rcx, [rsp + 0x78]
call fcn.14001fc50
mov eax, dword [rsp + 0x30]
add rsp, 0xb8
ret
Function at 0x14003ca20
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.140041ee0
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x14005ad00]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x14003cc12
lea rax, [rsp + 0x147f]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x38], rax
jae 0x14003cb66
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x14003cb66
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
mov byte [rsp + 0x31], al
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x30], al
movsx eax, byte [rsp + 0x30]
cmp eax, 0xa
jne 0x14003cb4b
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x38]
mov byte [rax], 0xd
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, byte [rsp + 0x30]
mov byte [rax], cl
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
jmp 0x14003cae8
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14003cbd2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14003cc31
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x44], eax
jae 0x14003cc0d
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14003cc31
jmp 0x14003cabe
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.140001030
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x14003cc50
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.140041ee0
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x14005ad00]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x14003ce5d
lea rax, [rsp + 0x147e]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x38], rax
jae 0x14003cda9
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x14003cda9
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
mov word [rsp + 0x40], ax
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x30]
cmp eax, 0xa
jne 0x14003cd89
mov eax, dword [rsp + 0x78]
add eax, 2
mov dword [rsp + 0x78], eax
mov eax, 0xd
mov rcx, qword [rsp + 0x38]
mov word [rcx], ax
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, word [rsp + 0x30]
mov word [rax], cx
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
jmp 0x14003cd18
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov eax, eax
shl rax, 1
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14003ce1d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14003ce7c
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x48], eax
jae 0x14003ce58
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14003ce7c
jmp 0x14003ccee
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.140001030
add rsp, 0x1498
pop rdi
pop rsi
ret