joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400076f0
Capabilities:
Get common file path

Disassembly:
push rbp
mov rbp, rsp
mov r11d, 2
sub rsp, 0x1000
test dword [rsp], esp
dec r11d
jne 0x1400076fa
sub rsp, 0xd0
mov qword [rbp - 0x20a8], rbx
mov qword [rbp - 0x20a0], rsi
lea rdx, [rbp - 0x2000]
mov qword [rbp - 0x2098], rdx
mov ecx, 0x1000
call fcn.1400111f0
mov ecx, eax
mov rdx, qword [rbp - 0x2098]
call sub.KERNEL32.dll_GetCurrentDirectoryW
mov r9d, eax
lea rax, [0x140007980]
mov qword [rbp - 0x2068], rax
xor edx, edx
mov qword [rbp - 0x2070], rdx
lea r8, [rbp - 0x2070]
lea rcx, str.std_file.d
mov qword [rbp - 0x2058], rcx
mov ebx, 0xa
mov qword [rbp - 0x2060], rbx
lea rdx, [rbp - 0x2060]
mov ecx, 0xd5d
call fcn.140011210
mov dword [rbp - 0x200c], eax
mov eax, eax
mov esi, 0x1000
cmp rax, rsi
jae 0x1400077e4
mov edx, dword [rbp - 0x200c]
mov qword [rbp - 0x2050], rdx
lea rax, [rbp - 0x2000]
mov qword [rbp - 0x2048], rax
lea rcx, [rbp - 0x2050]
sub rsp, 0x20
call fcn.1400112a0
add rsp, 0x20
mov rbx, qword [rbp - 0x20a8]
mov rsi, qword [rbp - 0x20a0]
mov rsp, rbp
pop rbp
ret
mov ecx, dword [rbp - 0x200c]
call fcn.1400112d0
mov dword [rbp - 0x2010], eax
mov edx, 2
lea rcx, [rbp - 0x2010]
call fcn.140011300
mov qword [rbp - 0x2020], rax
lea rcx, [rbp - 0x2020]
call fcn.140011330
mov rcx, rax
call fcn.14008f384
mov qword [rbp - 0x2018], rax
lea rcx, [rbp - 0x2010]
sub rsp, 0x20
call fcn.140011340
add rsp, 0x20
mov rdx, qword [rbp - 0x2018]
mov ecx, eax
sub rsp, 0x20
call sub.KERNEL32.dll_GetCurrentDirectoryW
add rsp, 0x20
mov dword [rbp - 0x2008], eax
test eax, eax
je 0x14000787a
mov edx, dword [rbp - 0x2008]
lea rcx, [rbp - 0x2010]
sub rsp, 0x20
call fcn.140011350
add rsp, 0x20
test eax, eax
jg 0x14000787f
xor r9d, r9d
jmp 0x140007885
mov r9d, 1
lea rax, [0x140007990]
mov qword [rbp - 0x2038], rax
mov qword [rbp - 0x2040], 0
lea r8, [rbp - 0x2040]
lea rdx, str.std_file.d
mov qword [rbp - 0x2078], rdx
mov qword [rbp - 0x2080], rbx
lea rdx, [rbp - 0x2080]
mov ecx, 0xd6a
sub rsp, 0x20
call fcn.140011380
add rsp, 0x20
mov eax, dword [rbp - 0x2008]
mov qword [rbp - 0x2030], rax
mov rbx, qword [rbp - 0x2018]
mov qword [rbp - 0x2028], rbx
lea rcx, [rbp - 0x2030]
sub rsp, 0x20
call fcn.1400112a0
add rsp, 0x20
mov qword [rbp - 0x2090], rax
mov qword [rbp - 0x2088], rdx
sub rsp, 8
call fcn.14000794d
add rsp, 8
mov rdx, qword [rbp - 0x2088]
mov rax, qword [rbp - 0x2090]
mov rbx, qword [rbp - 0x20a8]
mov rsi, qword [rbp - 0x20a0]
mov rsp, rbp
pop rbp
ret
Function at 0x1400079a0
Capabilities:
Accept command line arguments

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x38], 0x80
mov qword [rbp - 0x78], rbx
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x68], rdi
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x58], r13
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x48], r15
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov r9d, dword [rbp + 0x10]
mov dword [0x14022f6f0], r9d
mov r10, qword [rbp + 0x18]
mov qword [0x14022f6f8], r10
sub rsp, 0x20
call sub.KERNEL32.dll_GetCommandLineW
add rsp, 0x20
mov rdi, rax
mov rcx, rdi
sub rsp, 0x20
call fcn.14008f4e4
add rsp, 0x20
mov r12, rax
xor edx, edx
mov dword [rbp - 8], edx
lea rdx, [rbp - 8]
mov rcx, rdi
sub rsp, 0x20
call sub.SHELL32.dll_CommandLineToArgvW
add rsp, 0x20
mov rbx, rax
movsxd rcx, dword [rbp - 8]
shl rcx, 4
sub rsp, 0x20
lea rdx, [rbp - 0x38]
call fcn.140011410
add rsp, 0x20
mov r13, rax
movsxd r8, dword [rbp - 8]
mov qword [rbp - 0x20], r8
mov qword [rbp - 0x18], r13
push 0
push 0
push 0
push 0
mov r9d, r12d
mov r8, rdi
xor edx, edx
mov ecx, 0xfde9
sub rsp, 0x20
call sub.KERNEL32.dll_WideCharToMultiByte
add rsp, 0x40
cdqe
mov rcx, rax
mov qword [rbp - 0x10], rcx
sub rsp, 0x20
lea rdx, [rbp - 0x38]
call fcn.140011410
add rsp, 0x20
mov r15, rax
xor esi, esi
xor r14d, r14d
mov r9d, dword [rbp - 8]
mov dword [rbp - 4], r9d
cmp r9d, esi
jle 0x140007b58
movsxd r8, r14d
mov rcx, qword [rbx + r8*8]
sub rsp, 0x20
mov qword [rbp - 0x40], r8
call fcn.14008f4e4
add rsp, 0x20
mov r12, rax
push 0
push 0
push 0
push 0
mov r9d, r12d
mov rdx, qword [rbp - 0x40]
mov r8, qword [rbx + rdx*8]
xor edx, edx
mov ecx, 0xfde9
sub rsp, 0x20
call sub.KERNEL32.dll_WideCharToMultiByte
add rsp, 0x40
mov edi, eax
mov eax, edi
cdqe
add rax, rsi
sub rax, rsi
lea rdx, [rsi + r15]
mov r8, qword [rbp - 0x40]
shl r8, 4
mov qword [r8 + r13], rax
mov qword [r8 + r13 + 8], rdx
test edi, edi
je 0x140007b4b
movsxd r9, edi
add rsi, r9
push 0
push 0
push rdi
mov rcx, qword [rbp - 0x40]
shl rcx, 4
add rcx, r13
push qword [rcx + 8]
mov r9d, r12d
mov rdx, qword [rbp - 0x40]
mov r8, qword [rbx + rdx*8]
xor edx, edx
mov ecx, 0xfde9
sub rsp, 0x20
call sub.KERNEL32.dll_WideCharToMultiByte
add rsp, 0x40
inc r14d
cmp r14d, dword [rbp - 4]
jl 0x140007aac
mov rcx, rbx
sub rsp, 0x20
call sub.KERNEL32.dll_LocalFree
add rsp, 0x20
mov dword [rbp - 8], 0
mov rax, qword [rbp - 0x20]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], r13
mov r8, qword [rbp + 0x20]
mov rdx, qword [rbp - 0x10]
lea rcx, [rbp - 0x30]
sub rsp, 0x20
call fcn.140011470
add rsp, 0x20
mov rbx, qword [rbp - 0x78]
mov rsi, qword [rbp - 0x70]
mov rdi, qword [rbp - 0x68]
mov r12, qword [rbp - 0x60]
mov r13, qword [rbp - 0x58]
mov r14, qword [rbp - 0x50]
mov r15, qword [rbp - 0x48]
mov rsp, rbp
pop rbp
ret
Function at 0x14000c240
Capabilities:
Get file size

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], rbx
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov qword [rax], 0
mov dword [rbp - 8], 0
lea rdx, [rbp - 8]
mov rcx, qword [rbp + 0x18]
call sub.KERNEL32.dll_GetFileSize
cmp eax, 0xffffffff
setne r8b
mov byte [rbp - 4], r8b
je 0x14000c291
mov edx, eax
mov ecx, dword [rbp - 8]
call fcn.140013e80
mov rbx, qword [rbp + 0x10]
mov qword [rbx], rax
mov al, byte [rbp - 4]
mov rbx, qword [rbp - 0x10]
mov rsp, rbp
pop rbp
ret

Function at 0x14000c2a0
Capabilities:
Read file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x38], rbx
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], r13
mov rbx, rcx
mov r12, rdx
mov r13, r8
xor esi, esi
test rbx, rbx
je 0x14000c338
mov qword [rbp - 0x40], 0
lea r9, [rbp - 8]
mov qword [rbp - 0x10], r9
mov rdx, rbx
sub rdx, rsi
mov ecx, 0xffff0000
sub rsp, 0x20
call fcn.140013ea0
add rsp, 0x20
mov edi, eax
mov r8d, edi
mov r9, qword [rbp - 0x10]
lea rdx, [r12 + rsi]
mov rcx, r13
call sub.KERNEL32.dll_ReadFile
test eax, eax
je 0x14000c312
cmp dword [rbp - 8], edi
je 0x14000c32d
xor eax, eax
mov rbx, qword [rbp - 0x38]
mov rsi, qword [rbp - 0x30]
mov rdi, qword [rbp - 0x28]
mov r12, qword [rbp - 0x20]
mov r13, qword [rbp - 0x18]
mov rsp, rbp
pop rbp
ret
mov r9d, edi
add rsi, r9
cmp rsi, rbx
jne 0x14000c2cc
mov eax, 1
mov rbx, qword [rbp - 0x38]
mov rsi, qword [rbp - 0x30]
mov rdi, qword [rbp - 0x28]
mov r12, qword [rbp - 0x20]
mov r13, qword [rbp - 0x18]
mov rsp, rbp
pop rbp
ret
Function at 0x14000dde0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], rsi
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x18], r14
mov r12, rcx
mov r14, rdx
mov rdi, r8
test r12, r12
je 0x14000de20
mov rcx, rdi
mov rax, qword [rdi]
call qword [rax + 0x40]
mov r13, rax
test r13, r13
jne 0x14000de3f
xor eax, eax
mov rbx, qword [rbp - 0x40]
mov rsi, qword [rbp - 0x38]
mov rdi, qword [rbp - 0x30]
mov r12, qword [rbp - 0x28]
mov r13, qword [rbp - 0x20]
mov r14, qword [rbp - 0x18]
mov rsp, rbp
pop rbp
ret
mov rcx, rdi
call fcn.14000df00
xor al, 1
je 0x14000de82
mov rcx, r13
imul rcx, r12
mov qword [rbp - 0x10], rcx
mov qword [rbp - 8], r14
lea rdx, [rbp - 0x10]
xor ecx, ecx
call fcn.140012330
mov rbx, qword [rbp - 0x40]
mov rsi, qword [rbp - 0x38]
mov rdi, qword [rbp - 0x30]
mov r12, qword [rbp - 0x28]
mov r13, qword [rbp - 0x20]
mov r14, qword [rbp - 0x18]
mov rsp, rbp
pop rbp
ret
xor ebx, ebx
xor esi, esi
test r12, r12
je 0x14000ded7
mov rdx, rsi
imul rdx, r13
add rdx, r14
mov rcx, rdi
mov r8, qword [rdi]
call qword [r8 + 0x28]
movabs r9, 0x87c37b91114253d5
mul r9
rol rax, 0x1f
movabs r10, 0x4cf5ad432745937f
mul r10
xor rax, rbx
rol rax, 0x1b
lea rdx, [rax + rax*4 + 0x52dce729]
mov rbx, rdx
inc rsi
cmp rsi, r12
jb 0x14000de8b
mov rax, rbx
mov rbx, qword [rbp - 0x40]
mov rsi, qword [rbp - 0x38]
mov rdi, qword [rbp - 0x30]
mov r12, qword [rbp - 0x28]
mov r13, qword [rbp - 0x20]
mov r14, qword [rbp - 0x18]
mov rsp, rbp
pop rbp
ret
Function at 0x140012330
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
sub rsp, 0x28
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov r11, rdx
mov dword [rsp + 0x20], ecx
mov r9, qword [r11]
mov r8, r9
and r8, 0xfffffffffffffffc
mov rdx, qword [r11 + 8]
add r8, rdx
cmp rdx, r8
je 0x14001239d
mov ecx, dword [rdx]
imul eax, ecx, 0xcc9e2d51
mov ecx, eax
rol eax, 0xf
mov ecx, eax
imul r10d, ecx, 0x1b873593
mov ecx, r10d
xor dword [rsp + 0x20], ecx
mov ebx, dword [rsp + 0x20]
rol ebx, 0xd
lea ebx, [rbx + rbx*4]
lea esi, [rbx - 0x19ab949c]
mov dword [rsp + 0x20], esi
add rdx, 4
cmp rdx, r8
jne 0x140012363
xor ecx, ecx
mov rdi, r9
and rdi, 3
cmp rdi, 1
je 0x1400123cd
cmp rdi, 2
je 0x1400123c4
cmp rdi, 3
je 0x1400123bd
jmp 0x1400123ed
movzx ecx, byte [rdx + 2]
shl ecx, 0x10
movzx eax, byte [rdx + 1]
shl eax, 8
xor ecx, eax
movzx r8d, byte [rdx]
xor ecx, r8d
imul ebx, ecx, 0xcc9e2d51
mov ecx, ebx
rol ebx, 0xf
mov ecx, ebx
imul esi, ecx, 0x1b873593
mov ecx, esi
xor dword [rsp + 0x20], ecx
xor dword [rsp + 0x20], r9d
movzx ecx, word [rsp + 0x22]
xor ecx, dword [rsp + 0x20]
imul eax, ecx, 0x85ebca6b
mov dword [rsp + 0x20], eax
shr eax, 0xd
xor eax, dword [rsp + 0x20]
imul edx, eax, 0xc2b2ae35
mov dword [rsp + 0x20], edx
movzx ebx, word [rsp + 0x22]
xor dword [rsp + 0x20], ebx
mov eax, dword [rsp + 0x20]
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
add rsp, 0x28
ret
Function at 0x14001d580
Capabilities:
Query environment variable

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xe0
mov qword [rbp - 0xb8], rbx
mov qword [rbp - 0xb0], rsi
mov qword [rbp - 0xa8], rdi
xor eax, eax
mov qword [rbp - 0x10], rax
call sub.KERNEL32.dll_GetEnvironmentStringsW
mov r9, rax
mov qword [rbp - 8], r9
lea rcx, [0x14001d7e0]
mov qword [rbp - 0x78], rcx
mov qword [rbp - 0x80], 0
lea r8, [rbp - 0x80]
lea rdx, str.stdprocess.d
mov qword [rbp - 0x68], rdx
mov qword [rbp - 0x70], 0xd
lea rdx, [rbp - 0x70]
mov ecx, 0x1a1
call fcn.1400240d0
xor esi, esi
mov rax, qword [rbp - 8]
cmp word [rax], si
je 0x14001d767
mov edi, esi
movsxd r8, esi
mov r9, qword [rbp - 8]
cmp word [r9 + r8*2], 0x3d
je 0x14001d61a
inc esi
movsxd rdx, esi
mov rcx, qword [rbp - 8]
cmp word [rcx + rdx*2], 0x3d
jne 0x14001d60a
movsxd r10, esi
movsxd r8, edi
mov qword [rbp - 0xa0], r10
sub r10, r8
mov qword [rbp - 0x40], r10
mov r9, qword [rbp - 8]
lea rdx, [r9 + r8*2]
mov qword [rbp - 0x38], rdx
lea rcx, [rbp - 0x40]
sub rsp, 0x20
call fcn.140024140
add rsp, 0x20
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rdx
lea rcx, [rbp - 0x50]
sub rsp, 0x20
call fcn.1400241a0
add rsp, 0x20
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rdx
lea edi, [rsi + 1]
mov r8, qword [rbp - 0xa0]
mov r9, qword [rbp - 8]
cmp word [r9 + r8*2], 0
je 0x14001d693
inc esi
movsxd rdx, esi
mov r10, qword [rbp - 8]
cmp word [r10 + rdx*2], 0
jne 0x14001d682
cmp qword [rbp - 0x60], 0
je 0x14001d753
movsxd rcx, esi
movsxd r8, edi
sub rcx, r8
mov qword [rbp - 0x90], rcx
mov r9, qword [rbp - 8]
lea rdx, [r9 + r8*2]
mov qword [rbp - 0x88], rdx
lea rcx, [rbp - 0x90]
sub rsp, 0x20
call fcn.1400241a0
add rsp, 0x20
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
lea r8, [rbp - 0x60]
lea rdx, [0x14020ff30]
mov rcx, qword [rbp - 0x10]
sub rsp, 0x20
call fcn.14001d180
add rsp, 0x20
test rax, rax
jne 0x14001d753
mov r9, qword [rbp - 0x18]
or r9, qword [rbp - 0x20]
je 0x14001d70e
mov rdx, qword [rbp - 0x18]
mov rax, qword [rbp - 0x20]
jmp 0x14001d717
lea rdx, [0x14020f7d0]
xor eax, eax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
lea r9, [rbp - 0x60]
mov r8d, 0x10
lea rdx, [0x140219750]
lea rcx, [rbp - 0x10]
sub rsp, 0x20
call fcn.14001d240
add rsp, 0x20
mov rdi, rax
mov rdx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x30]
mov qword [rdi], rax
mov qword [rdi + 8], rdx
inc esi
movsxd rbx, esi
mov rdi, qword [rbp - 8]
cmp word [rdi + rbx*2], 0
jne 0x14001d5f9
mov rax, qword [rbp - 0x10]
mov qword [rbp - 0x98], rax
sub rsp, 8
call fcn.14001d7af
add rsp, 8
mov rax, qword [rbp - 0x98]
mov rbx, qword [rbp - 0xb8]
mov rsi, qword [rbp - 0xb0]
mov rdi, qword [rbp - 0xa8]
mov rsp, rbp
pop rbp
ret
Function at 0x14001fe70
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
sub rsp, 0x28
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov r11, rdx
mov dword [rsp + 0x20], ecx
mov r9, qword [r11]
mov r8, r9
and r8, 0xfffffffffffffffc
mov rdx, qword [r11 + 8]
add r8, rdx
cmp rdx, r8
je 0x14001fedd
mov ecx, dword [rdx]
imul eax, ecx, 0xcc9e2d51
mov ecx, eax
rol eax, 0xf
mov ecx, eax
imul r10d, ecx, 0x1b873593
mov ecx, r10d
xor dword [rsp + 0x20], ecx
mov ebx, dword [rsp + 0x20]
rol ebx, 0xd
lea ebx, [rbx + rbx*4]
lea esi, [rbx - 0x19ab949c]
mov dword [rsp + 0x20], esi
add rdx, 4
cmp rdx, r8
jne 0x14001fea3
xor ecx, ecx
mov rdi, r9
and rdi, 3
cmp rdi, 1
je 0x14001ff0d
cmp rdi, 2
je 0x14001ff04
cmp rdi, 3
je 0x14001fefd
jmp 0x14001ff2d
movzx ecx, byte [rdx + 2]
shl ecx, 0x10
movzx eax, byte [rdx + 1]
shl eax, 8
xor ecx, eax
movzx r8d, byte [rdx]
xor ecx, r8d
imul ebx, ecx, 0xcc9e2d51
mov ecx, ebx
rol ebx, 0xf
mov ecx, ebx
imul esi, ecx, 0x1b873593
mov ecx, esi
xor dword [rsp + 0x20], ecx
xor dword [rsp + 0x20], r9d
movzx ecx, word [rsp + 0x22]
xor ecx, dword [rsp + 0x20]
imul eax, ecx, 0x85ebca6b
mov dword [rsp + 0x20], eax
shr eax, 0xd
xor eax, dword [rsp + 0x20]
imul edx, eax, 0xc2b2ae35
mov dword [rsp + 0x20], edx
movzx ebx, word [rsp + 0x22]
xor dword [rsp + 0x20], ebx
mov eax, dword [rsp + 0x20]
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
add rsp, 0x28
ret

Function at 0x140023b80
Capabilities:
Get system information on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
lea rax, [rbp - 0x30]
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
mov qword [rax + 0x20], rcx
mov qword [rax + 0x28], rcx
mov rcx, rax
call sub.KERNEL32.dll_GetSystemInfo
mov edx, dword [rbp - 0x2c]
mov qword [0x14022f9e0], rdx
mov rsp, rbp
pop rbp
ret

Function at 0x140027bb0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], rdi
mov rdi, rcx
mov rsi, rdx
mov rcx, rsi
call fcn.1400022c0
xor al, 1
je 0x140027bf0
mov rcx, rsi
call fcn.1400321f0
mov edx, eax
mov rcx, rdi
call fcn.140032220
mov rcx, rsi
call fcn.1400022c0
xor al, 1
jne 0x140027bd2
mov rsi, qword [rbp - 0x10]
mov rdi, qword [rbp - 8]
mov rsp, rbp
pop rbp
ret

Function at 0x140027fb0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], rdi
mov rdi, rcx
mov rsi, rdx
mov rcx, rsi
call fcn.140032360
xor al, 1
je 0x140027ff0
mov rcx, rsi
call fcn.140032370
mov edx, eax
mov rcx, rdi
call fcn.140003a90
mov rcx, rsi
call fcn.140032360
xor al, 1
jne 0x140027fd2
mov rsi, qword [rbp - 0x10]
mov rdi, qword [rbp - 8]
mov rsp, rbp
pop rbp
ret
Function at 0x14002f770
Capabilities:
Create thread
Resume thread

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x90
mov qword [rbp - 0x90], rbx
mov qword [rbp - 0x88], rsi
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x60], r15
mov qword [rbp + 0x10], rcx
mov al, byte [0x14022f980]
mov byte [rbp - 0x28], al
mov byte [0x14022f980], 1
mov rsi, rcx
add rsi, 0xb0
mov edi, dword [rcx + 0x40]
lea r12, [0x14003c410]
mov r13, rcx
mov rbx, rcx
add rbx, 0x10
push rbx
push 4
mov r9, rcx
lea r8, [0x14003c410]
mov edx, edi
xor ecx, ecx
sub rsp, 0x20
call fcn.140099504
add rsp, 0x30
mov qword [rsi], rax
mov r10, qword [rbp + 0x10]
cmp qword [r10 + 0xb0], 0
jne 0x14002f81e
lea rax, str.Error_creating_thread
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], 0x15
lea rcx, [rbp - 0x50]
sub rsp, 0x20
call fcn.14003c620
lea rsi, [0x14022fb58]
lea rcx, [0x14022fb70]
sub rsp, 0x20
call sub.KERNEL32.dll_EnterCriticalSection
add rsp, 0x20
inc qword [0x14022fc08]
mov rdx, qword [0x14022fc08]
shl rdx, 3
mov rcx, qword [0x14022fc00]
sub rsp, 0x20
call fcn.14008f38c
add rsp, 0x20
mov qword [0x14022fc00], rax
mov rbx, qword [rbp + 0x10]
mov rsi, qword [0x14022fc08]
lea rax, [rax + rsi*8]
mov qword [rax - 8], rbx
mov rdx, qword [rbp + 0x10]
mov rcx, qword [rdx + 0xb0]
sub rsp, 0x20
call sub.KERNEL32.dll_ResumeThread
add rsp, 0x20
cmp eax, 0xffffffff
jne 0x14002f8b6
lea rbx, str.Error_resuming_thread
mov qword [rbp - 0x38], rbx
mov qword [rbp - 0x40], 0x15
lea rcx, [rbp - 0x40]
sub rsp, 0x20
call fcn.14003c620
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x58], rax
sub rsp, 8
call fcn.14002f905
add rsp, 8
mov rax, qword [rbp - 0x58]
mov rbx, qword [rbp - 0x90]
mov rsi, qword [rbp - 0x88]
mov rdi, qword [rbp - 0x80]
mov r12, qword [rbp - 0x78]
mov r13, qword [rbp - 0x70]
mov r14, qword [rbp - 0x68]
mov r15, qword [rbp - 0x60]
mov rsp, rbp
pop rbp
ret

Function at 0x140030a10
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x38], rbx
mov qword [rbp + 0x10], rcx
call fcn.140003610
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x10]
mov rdx, qword [rax]
lea rcx, [rbp - 8]
call fcn.1400037f0
mov rbx, qword [rbp + 0x10]
mov rdx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x20]
call fcn.14003d520
lea rcx, [rbp - 0x20]
call fcn.14003d610
xor al, 1
je 0x140030a90
lea rcx, [rbp - 0x20]
call fcn.14003d640
mov edx, eax
lea rcx, [rbp - 8]
call fcn.14003d780
lea rcx, [rbp - 0x20]
call fcn.14003d750
lea rcx, [rbp - 0x20]
call fcn.14003d610
xor al, 1
jne 0x140030a66
lea rcx, [rbp - 8]
call fcn.140003840
mov rbx, qword [rbp - 0x38]
mov rsp, rbp
pop rbp
ret
Function at 0x140040680
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xe0
mov qword [rbp - 0xb0], rbx
mov qword [rbp - 0xa8], rsi
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
call fcn.1400407e0
mov qword [rbp - 0x30], rax
cmp rax, 0xffffffffffffffff
jne 0x1400406b6
ud2
mov rax, qword [rbp + 0x18]
mov rdx, qword [rax + 8]
mov rax, qword [rax]
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rdx
mov rdx, qword [rbp + 0x10]
lea rcx, [rbp - 0x20]
mov qword [rbp - 0x98], rcx
mov qword [rbp - 0xa0], 0x14
lea rcx, [rbp - 0xa0]
call fcn.1400121a0
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rdx
mov rbx, qword [rbp + 0x20]
mov rdx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rdx
xor esi, esi
mov qword [rbp - 0xc0], rsi
mov r9, rsi
mov r8d, 0xe
lea rdx, str.Aborting_from
mov rcx, qword [rbp - 0x30]
call sub.KERNEL32.dll_WriteFile
mov qword [rbp - 0xc0], rsi
mov r9, rsi
mov r8d, dword [rbp - 0x80]
mov rdx, qword [rbp - 0x78]
mov rcx, qword [rbp - 0x30]
call sub.KERNEL32.dll_WriteFile
mov qword [rbp - 0xc0], rsi
mov r9, rsi
mov r8d, 1
lea rdx, [0x140210f30]
mov rcx, qword [rbp - 0x30]
call sub.KERNEL32.dll_WriteFile
mov qword [rbp - 0xc0], rsi
mov r9, rsi
mov r8d, dword [rbp - 0x60]
mov rdx, qword [rbp - 0x58]
mov rcx, qword [rbp - 0x30]
call sub.KERNEL32.dll_WriteFile
mov qword [rbp - 0xc0], rsi
mov r9, rsi
mov r8d, 2
lea rdx, [0x14021fdd0]
mov rcx, qword [rbp - 0x30]
call sub.KERNEL32.dll_WriteFile
mov qword [rbp - 0xc0], rsi
mov r9, rsi
mov r8d, dword [rbp - 0x40]
mov rdx, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x30]
call sub.KERNEL32.dll_WriteFile
call fcn.140099a68
mov rbx, qword [rbp - 0xb0]
mov rsi, qword [rbp - 0xa8]
mov rsp, rbp
pop rbp
ret
Function at 0x140041ae0
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
cmp qword [0x14022fd30], 0
je 0x140041afe
lea rax, [0x14022fcb0]
mov rsp, rbp
pop rbp
ret
lea rcx, str.dbghelp.dll
call sub.KERNEL32.dll_LoadLibraryA
mov qword [0x14022fd30], rax
test rax, rax
je 0x140041cc6
lea rdx, str.SymInitialize
mov rcx, qword [0x14022fd30]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x14022fcb0], rax
lea rdx, str.SymCleanup
mov rcx, qword [0x14022fd30]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x14022fcb8], rax
lea rdx, str.StackWalk64
mov rcx, qword [0x14022fd30]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x14022fcc0], rax
lea rdx, str.SymGetOptions
mov rcx, qword [0x14022fd30]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x14022fcc8], rax
lea rdx, str.SymSetOptions
mov rcx, qword [0x14022fd30]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x14022fcd0], rax
lea rdx, str.SymFunctionTableAccess64
mov rcx, qword [0x14022fd30]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x14022fcd8], rax
lea rdx, str.SymGetLineFromAddr64
mov rcx, qword [0x14022fd30]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x14022fce0], rax
lea rdx, str.SymGetModuleBase64
mov rcx, qword [0x14022fd30]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x14022fce8], rax
lea rdx, str.SymGetModuleInfo64
mov rcx, qword [0x14022fd30]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x14022fcf0], rax
lea rdx, str.SymGetSymFromAddr64
mov rcx, qword [0x14022fd30]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x14022fcf8], rax
lea rdx, str.UnDecorateSymbolName
mov rcx, qword [0x14022fd30]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x14022fd00], rax
lea rdx, str.SymLoadModule64
mov rcx, qword [0x14022fd30]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x14022fd08], rax
lea rdx, str.SymGetSearchPath
mov rcx, qword [0x14022fd30]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x14022fd10], rax
lea rdx, str.SymUnloadModule64
mov rcx, qword [0x14022fd30]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x14022fd18], rax
lea rdx, str.SymRegisterCallback64
mov rcx, qword [0x14022fd30]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x14022fd20], rax
lea rdx, str.ImagehlpApiVersion
mov rcx, qword [0x14022fd30]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x14022fd28], rax
lea rax, [0x14022fcb0]
mov rsp, rbp
pop rbp
ret
xor eax, eax
mov rsp, rbp
pop rbp
ret
Function at 0x140041cd0
Capabilities:
Query environment variable

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x890
mov qword [rbp - 0x868], rbx
mov qword [rbp - 0x860], rsi
mov qword [rbp - 0x858], rdi
mov qword [rbp - 0x820], 0
mov qword [rbp - 0x818], 0
lea rsi, [0x140220010]
mov rdx, qword [rsi + 8]
mov rax, qword [rsi]
mov qword [rbp - 0x810], rax
mov qword [rbp - 0x808], rdx
mov r8d, 0x800
lea rdx, [rbp - 0x800]
mov rcx, qword [rbp - 0x808]
call sub.KERNEL32.dll_GetEnvironmentVariableA
mov edi, eax
test edi, edi
je 0x140041da6
mov r9d, edi
mov qword [rbp - 0x830], r9
lea r10, [rbp - 0x800]
mov qword [rbp - 0x828], r10
lea r8, [rbp - 0x830]
lea rdx, [rbp - 0x820]
lea rcx, [0x14020ff30]
call fcn.1400120e0
lea r9, [0x140220080]
mov qword [rbp - 0x838], r9
mov qword [rbp - 0x840], 1
lea r8, [rbp - 0x840]
lea rdx, [rbp - 0x820]
lea rcx, [0x14020ff30]
call fcn.1400120e0
add rsi, 0x10
lea rax, str._NT_SYMBOL_PATH
cmp rsi, rax
jb 0x140041d0d
lea rbx, [0x140220090]
mov qword [rbp - 0x848], rbx
mov qword [rbp - 0x850], 1
lea r8, [rbp - 0x850]
lea rdx, [rbp - 0x820]
lea rcx, [0x14020ff30]
call fcn.1400120e0
mov rdx, qword [rbp - 0x818]
mov rax, qword [rbp - 0x820]
mov rbx, qword [rbp - 0x868]
mov rsi, qword [rbp - 0x860]
mov rdi, qword [rbp - 0x858]
mov rsp, rbp
pop rbp
ret