joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800866b0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push rbx
sub rsp, 0x60
mov eax, dword [rcx + 8]
mov rbx, rcx
shr eax, 1
not eax
test al, 1
jne 0x1800866d5
call fcn.180087a70
test eax, eax
jne 0x1800866d5
mov rcx, rbx
call fcn.180086960
mov edx, dword [rbx + 8]
mov ecx, edx
and ecx, 7
je 0x18008674e
sub ecx, 1
je 0x1800866f0
cmp ecx, 3
je 0x18008674e
call qword [sym.imp.KERNEL32.dll_DebugBreak]
int3
mov r10d, dword [rbx]
not edx
mov r9, qword [rbx + 0x10]
and edx, 1
movzx ecx, dl
mov ebx, 0x1505
shr r10d, cl
dec r10d
add r10, r9
cmp r9, r10
jae 0x180086827
nop word [rax + rax]
movzx r8d, byte [r9]
inc r9
lea edx, [r8 - 0x61]
cmp dl, 0x19
lea eax, [r8 - 0x20]
movzx ecx, al
cmova ecx, r8d
imul ebx, ebx, 0x21
movsx ecx, cl
xor ebx, ecx
cmp r9, r10
jb 0x180086720
mov eax, ebx
add rsp, 0x60
pop rbx
ret
mov eax, dword [rbx]
not edx
and edx, 1
mov qword [rsp + 0x58], rsi
movzx ecx, dl
mov qword [rsp + 0x50], rdi
mov rdi, qword [rbx + 0x10]
mov ebx, 0x1505
shr eax, cl
dec eax
lea rsi, [rdi + rax*2]
cmp rdi, rsi
jae 0x18008681d
mov qword [rsp + 0x80], rbp
xor ebp, ebp
nop word [rax + rax]
movzx edx, word [rdi]
add rdi, 2
test edx, 0xffffff80
jne 0x1800867af
lea eax, [rdx - 0x61]
cmp ax, 0x19
lea ecx, [rdx - 0x20]
cmova cx, dx
jmp 0x180086804
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], rbp
lea r8, [rsp + 0x70]
mov qword [rsp + 0x30], rbp
lea rcx, [0x1801100f4]
mov word [rsp + 0x70], dx
mov r9d, 1
mov dword [rsp + 0x28], 1
mov edx, 0x200
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_LCMapStringEx]
movzx ecx, word [rsp + 0x78]
test eax, eax
cmove cx, word [rsp + 0x70]
mov word [rsp + 0x78], cx
imul ebx, ebx, 0x21
movzx ecx, cx
xor ebx, ecx
cmp rdi, rsi
jb 0x180086790
mov rbp, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
mov eax, ebx
add rsp, 0x60
pop rbx
ret
Function at 0x18008b4a0
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov r14, rdx
mov rbx, rcx
mov qword [rax - 0x40], rcx
mov qword [rax - 0x38], rdx
xor esi, esi
mov dword [rax - 0x30], esi
mov dword [rax - 0x68], esi
mov qword [rax + 8], rcx
mov r9b, 1
movzx r8d, r9b
lea edx, [rsi + 0x40]
call fcn.180025540
mov qword [rsp + 0x90], rax
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x18008b5dc
mov r9b, 1
movzx r8d, r9b
lea edx, [rsi + 0x40]
mov rcx, rbx
call fcn.180025540
mov qword [rsp + 0x98], rax
cmp dword [rax + 0x3c], esi
je 0x18008b5dc
mov r9b, 1
movzx r8d, r9b
lea edx, [rsi + 0x40]
mov rcx, rbx
call fcn.180025540
mov qword [rsp + 0xa0], rax
movsxd rdi, dword [rax + 0x3c]
add rdi, rbx
mov r9b, 1
movzx r8d, r9b
mov edx, pe_nt_image_headers64
mov rcx, rdi
call fcn.180025540
mov qword [rsp + 0xa8], rax
cmp dword [rax], 0x4550
jne 0x18008b5dc
mov r9b, 1
movzx r8d, r9b
mov edx, pe_nt_image_headers64
mov rcx, rdi
call fcn.180025540
movzx r15d, word [rax + 0x14]
cmp r15w, 2
jb 0x18008b5dc
mov r9b, 1
movzx r8d, r9b
mov edx, pe_nt_image_headers64
mov rcx, rdi
call fcn.180025540
mov qword [rsp + 0x28], rax
mov ecx, 0x20b
cmp word [rax + 0x18], cx
jne 0x18008b5dc
cmp r15w, 0x3c
jb 0x18008b5dc
mov qword [rsp + 0x30], rbx
cmp r14, rbx
jb 0x18008b5dc
mov r9b, 1
movzx r8d, r9b
mov edx, pe_nt_image_headers64
mov rcx, rdi
call fcn.180025540
mov qword [rsp + 0x38], rax
mov ecx, dword [rax + 0x50]
add rcx, rbx
mov eax, 1
cmp r14, rcx
cmovb esi, eax
mov dword [rsp + 0x58], esi
jmp 0x18008b5e2
mov eax, esi
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret

Function at 0x18008b690
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [rcx + 8], 0x40
mov rbx, rcx
jb 0x18008b72a
mov rcx, qword [rcx]
mov r9b, 1
movzx r8d, r9b
mov edx, 0x40
call fcn.180025540
mov rdi, rax
mov eax, 0x5a4d
cmp word [rdi], ax
jne 0x18008b72a
movsxd rcx, dword [rdi + 0x3c]
test ecx, ecx
je 0x18008b72a
mov rdx, rcx
not rcx
cmp rcx, 0x108
jb 0x18008b72a
mov eax, dword [rbx + 8]
lea rcx, [rdx + 0x108]
cmp rax, rcx
jb 0x18008b72a
mov rcx, qword [rbx]
mov r9b, 1
add rcx, rdx
movzx r8d, r9b
mov edx, pe_nt_image_headers64
call fcn.180025540
mov r8, rax
cmp dword [rax], 0x4550
jne 0x18008b72a
movzx eax, word [rax + 0x18]
mov ecx, 0x10b
cmp ax, cx
jne 0x18008b737
mov eax, 0xe0
cmp word [r8 + 0x14], ax
je 0x18008b76e
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov ecx, 0x20b
cmp ax, cx
jne 0x18008b72a
mov eax, 0xf0
cmp word [r8 + 0x14], ax
jne 0x18008b72a
movsxd rcx, dword [rdi + 0x3c]
mov rax, rcx
not rax
cmp rax, 0x108
jb 0x18008b72a
mov eax, dword [rbx + 8]
add rcx, 0x108
cmp rax, rcx
jb 0x18008b72a
mov dl, 1
mov rcx, r8
call fcn.180026630
mov qword [rbx + 0x10], rax
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18008b790
Capabilities:
Enumerate pe sections

Disassembly:
push rbx
push r14
push r15
sub rsp, 0x20
mov r9b, 1
mov r15d, edx
mov r14, rcx
movzx r8d, r9b
mov rcx, qword [rcx]
mov edx, 0x40
call fcn.180025540
mov r9b, 1
mov edx, pe_nt_image_headers64
movzx r8d, r9b
movsxd rcx, dword [rax + 0x3c]
add rcx, qword [r14]
call fcn.180025540
mov dl, 1
mov rcx, rax
mov rbx, rax
call fcn.180026630
movzx ecx, word [rbx + 0x14]
mov r9b, 1
movzx r8d, r9b
mov edx, 0x40
lea rbx, [rax + 0x18]
add rbx, rcx
mov rcx, qword [r14]
call fcn.180025540
mov r9b, 1
mov edx, pe_nt_image_headers64
movzx r8d, r9b
movsxd rcx, dword [rax + 0x3c]
add rcx, qword [r14]
call fcn.180025540
xor ecx, ecx
movzx r8d, word [rax + 6]
test r8, r8
je 0x18008b83a
xor edx, edx
mov rax, 0xffffffffffffffff
div r8
cmp rax, 0x28
jb 0x18008b933
lea rcx, [r8 + r8*4]
shl rcx, 3
mov rax, rbx
mov rdx, rcx
not rax
cmp rax, rcx
jb 0x18008b933
mov qword [rsp + 0x40], rbp
lea rbp, [rcx + rbx]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdi
cmp rbx, rbp
jae 0x18008b8e8
nop dword [rax + rax]
mov r9b, 1
mov edx, 0x28
movzx r8d, r9b
mov rcx, rbx
call fcn.180025540
mov rcx, qword [r14]
mov r9b, 1
movzx r8d, r9b
mov edx, 0x40
mov rsi, rax
call fcn.180025540
mov r9b, 1
mov edx, pe_nt_image_headers64
movzx r8d, r9b
movsxd rcx, dword [rax + 0x3c]
add rcx, qword [r14]
call fcn.180025540
mov r9b, 1
mov edx, 0x28
movzx r8d, r9b
mov rcx, rbx
mov rdi, rax
call fcn.180025540
mov ecx, dword [rdi + 0x38]
lea edx, [rcx - 1]
neg ecx
add edx, dword [rax + 8]
and edx, ecx
add edx, dword [rsi + 0xc]
cmp r15d, edx
jb 0x18008b903
add rbx, 0x28
cmp rbx, rbp
jb 0x18008b870
xor eax, eax
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rbx
ret
mov r9b, 1
mov edx, 0x28
movzx r8d, r9b
mov rcx, rbx
call fcn.180025540
cmp r15d, dword [rax + 0xc]
jb 0x18008b8e8
mov r9b, 1
mov edx, 0x28
movzx r8d, r9b
mov rcx, rbx
call fcn.180025540
jmp 0x18008b8ea
mov ecx, 0x80131c36
call fcn.180025310
int3
Function at 0x18008b940
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x20
mov r9b, 1
mov ebp, edx
mov rdi, rcx
movzx r8d, r9b
mov rcx, qword [rcx]
mov edx, 0x40
call fcn.180025540
mov r9b, 1
mov edx, pe_nt_image_headers64
movzx r8d, r9b
movsxd rcx, dword [rax + 0x3c]
add rcx, qword [rdi]
call fcn.180025540
mov dl, 1
mov rcx, rax
mov rbx, rax
call fcn.180026630
movzx ecx, word [rbx + 0x14]
mov r9b, 1
movzx r8d, r9b
mov edx, 0x40
lea rbx, [rax + 0x18]
add rbx, rcx
mov rcx, qword [rdi]
call fcn.180025540
mov r9b, 1
mov edx, pe_nt_image_headers64
movzx r8d, r9b
movsxd rcx, dword [rax + 0x3c]
add rcx, qword [rdi]
call fcn.180025540
xor ecx, ecx
movzx r8d, word [rax + 6]
test r8, r8
je 0x18008b9ee
xor edx, edx
mov rax, 0xffffffffffffffff
div r8
cmp rax, 0x28
jb 0x18008ba94
lea rcx, [r8 + r8*4]
shl rcx, 3
mov rax, rbx
mov rdx, rcx
not rax
cmp rax, rcx
jb 0x18008ba94
mov qword [rsp + 0x30], rsi
lea rsi, [rcx + rbx]
cmp rbx, rsi
jae 0x18008ba4e
nop
mov r9b, 1
mov edx, 0x28
movzx r8d, r9b
mov rcx, rbx
call fcn.180025540
mov r9b, 1
mov edx, 0x28
movzx r8d, r9b
mov rcx, rbx
mov rdi, rax
call fcn.180025540
mov ecx, dword [rdi + 0x14]
add ecx, dword [rax + 0x10]
cmp ebp, ecx
jb 0x18008ba65
add rbx, 0x28
cmp rbx, rsi
jb 0x18008ba10
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov r9b, 1
mov edx, 0x28
movzx r8d, r9b
mov rcx, rbx
call fcn.180025540
cmp ebp, dword [rax + 0x14]
jb 0x18008ba4e
mov r9b, 1
mov edx, 0x28
movzx r8d, r9b
mov rcx, rbx
call fcn.180025540
jmp 0x18008ba50
mov ecx, 0x80131c36
call fcn.180025310
int3
Function at 0x18008e350
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x1801328bc], 0
mov rbx, rcx
jne 0x18008e395
lea rcx, [0x180132820]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x180132840]
mov ecx, 2
cmp eax, ecx
mov dword [0x1801328bc], 1
cmovb eax, ecx
imul eax, eax, 0x4e20
mov dword [0x180131a34], eax
xor eax, eax
mov dword [rbx], eax
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x180090e20
Capabilities:
Query environment variable

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rbx, rdx
mov r14, rcx
xor r15d, r15d
mov dword [r11 - 0x58], r15d
mov dword [r11 - 0x54], r15d
mov qword [r11 - 0x40], r15
lea rax, [r11 - 0x48]
mov qword [r11 + 0x18], rax
mov eax, dword [rdx + 4]
cmp eax, 2
jbe 0x180090e62
sub rax, 2
shr rax, 1
jmp 0x180090e65
mov rax, r15
lea esi, [rax + 1]
xor r9d, r9d
lea r8d, [r9 + 4]
mov edx, eax
mov rcx, rbx
call fcn.180087ad0
mov ecx, dword [rbx + 8]
not ecx
and ecx, 1
mov edx, esi
shl edx, cl
mov rcx, rbx
call fcn.180048c50
mov r8d, esi
mov rdx, qword [rbx + 0x10]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
mov dword [rsp + 0x20], eax
cmp edi, esi
jbe 0x180090efe
mov esi, edi
mov eax, dword [rbx]
add rax, qword [rbx + 0x10]
test byte [rbx + 8], 1
je 0x180090ebb
mov byte [rax - 1], 0
jmp 0x180090ec0
mov word [rax - 2], r15w
lea edx, [rdi - 1]
xor r9d, r9d
lea r8d, [r9 + 4]
mov rcx, rbx
call fcn.180087ad0
mov ecx, dword [rbx + 8]
not ecx
and ecx, 1
mov edx, edi
shl edx, cl
mov rcx, rbx
call fcn.180048c50
mov r8d, edi
mov rdx, qword [rbx + 0x10]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
mov dword [rsp + 0x20], eax
jmp 0x180090ea3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov dword [rsp + 0x24], eax
mov r8d, dword [rbx + 8]
mov ecx, r8d
not ecx
and ecx, 1
lea eax, [rdi + 1]
shl eax, cl
mov ecx, eax
mov dword [rbx], ecx
add rcx, qword [rbx + 0x10]
test r8b, 1
je 0x180090f2f
mov byte [rcx - 1], 0
jmp 0x180090f34
mov word [rcx - 2], r15w
jmp 0x180090f55
test edi, edi
jne 0x180090f61
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1800ba560
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r15
sub rsp, 0x70
mov rax, qword [rsp + 0xc8]
lea r15, [rsp + 0x40]
test rax, rax
mov qword [rsp + 0x48], 0xffffffffffffffff
mov r12, r9
mov rsi, r8
cmovne r15, rax
mov rbp, rdx
movsx eax, byte [rdx]
mov rdi, rcx
mov r10, r8
mov r11, rdx
mov r9d, 0x1505
test eax, eax
je 0x1800ba5c3
nop dword [rax]
imul r9d, r9d, 0x21
lea r11, [r11 + 1]
xor r9d, eax
movsx eax, byte [r11]
test eax, eax
jne 0x1800ba5b0
movsx eax, byte [r8]
test eax, eax
je 0x1800ba5e3
nop dword [rax + rax]
imul r9d, r9d, 0x21
lea r10, [r10 + 1]
xor r9d, eax
movsx eax, byte [r10]
test eax, eax
jne 0x1800ba5d0
cmp dword [rcx + 0x18], 0
jne 0x1800ba5ed
xor ebx, ebx
jmp 0x1800ba61b
mov rax, qword [rcx + 0x10]
lea r8, [rsp + 0xc8]
lea rdx, [rsp + 0xa0]
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0x20], r15
call fcn.1800baad0
mov rbx, qword [rsp + 0xa0]
mov r9b, 1
mov qword [rsp + 0xa8], r13
movzx r8d, r9b
mov qword [rsp + 0xb0], r14
mov edx, 0x10
mov rcx, rbx
call fcn.180025540
test rax, rax
je 0x1800ba6f6
mov r14d, dword [rsp + 0xc0]
lea r13, [0x180109ca8]
nop word [rax + rax]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x50]
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0xc8]
mov qword [rsp + 0x38], rsi
mov rcx, rdi
mov qword [rsp + 0x50], r13
mov qword [rsp + 0xc8], rbx
call fcn.1800ba190
cmp dword [rsp + 0x60], 0
je 0x1800ba6c6
mov r9b, 1
mov edx, 0x10
movzx r8d, r9b
mov rcx, rbx
call fcn.180025540
xor ecx, ecx
cmp qword [rax + 8], rcx
setne cl
xor eax, eax
test r14d, r14d
setne al
cmp eax, ecx
je 0x1800ba71c
mov r8, r15
lea rdx, [rsp + 0xa0]
call fcn.1800ba980
mov r9b, 1
mov edx, 0x10
movzx r8d, r9b
mov rbx, qword [rax]
mov rcx, rbx
call fcn.180025540
test rax, rax
jne 0x1800ba660
xor eax, eax
mov r14, qword [rsp + 0xb0]
mov r13, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r9b, 1
mov edx, 0x10
movzx r8d, r9b
mov rcx, rbx
call fcn.180025540
test rax, rax
je 0x1800ba6f8
mov rcx, qword [rax]
mov qword [r12], rcx
jmp 0x1800ba6f8
Function at 0x140002050
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
push r15
mov eax, dword [rcx + 0x48]
lea rbx, [rcx + 0x28]
mov rdi, qword [rcx]
lea r11, [rcx + 0x28]
add rbx, rax
mov r9, rcx
movabs rbp, 0xc2b2ae3d27d4eb4f
movabs rsi, 0x9e3779b185ebca87
movabs r14, 0x27d4eb2f165667c5
movabs r15, 0x7a1435883d4d519d
cmp rdi, 0x20
jb 0x140002149
mov r8, qword [r9 + 0x18]
mov rdx, qword [rcx + 8]
mov rax, r8
mov r9, qword [r9 + 0x20]
mov rcx, qword [rcx + 0x10]
mov r10, r9
rol r10, 0x12
rol rax, 0xc
add r10, rax
mov rax, rcx
rol rax, 7
add r10, rax
mov rax, rdx
rol rax, 1
add r10, rax
movabs rax, 0x85ebca77c2b2ae63
imul rdx, rbp
imul rcx, rbp
imul r8, rbp
imul r9, rbp
rol rdx, 0x1f
imul rdx, rsi
rol rcx, 0x1f
xor r10, rdx
rol r8, 0x1f
imul r10, rsi
imul rcx, rsi
imul r8, rsi
sub r10, r15
rol r9, 0x1f
xor r10, rcx
imul r10, rsi
imul r9, rsi
sub r10, r15
xor r10, r8
imul r10, rsi
sub r10, r15
xor r10, r9
imul r10, rsi
add rax, r10
add rax, rdi
jmp 0x140002151
lea rax, [rdi + r14]
add rax, qword [rcx + 0x18]
lea rdx, [r11 + 8]
cmp rdx, rbx
ja 0x14000218a
nop word [rax + rax]
mov rcx, qword [r11]
add rdx, 8
imul rcx, rbp
add r11, 8
rol rcx, 0x1f
imul rcx, rsi
xor rax, rcx
rol rax, 0x1b
imul rax, rsi
sub rax, r15
cmp rdx, rbx
jbe 0x140002160
lea rdx, [r11 + 4]
movabs r8, 0x165667b19e3779f9
cmp rdx, rbx
ja 0x1400021b5
mov ecx, dword [r11]
mov r11, rdx
imul rcx, rsi
xor rax, rcx
rol rax, 0x17
imul rax, rbp
add rax, r8
cmp r11, rbx
jae 0x1400021db
nop word [rax + rax]
movzx ecx, byte [r11]
inc r11
imul rcx, r14
xor rax, rcx
rol rax, 0xb
imul rax, rsi
cmp r11, rbx
jb 0x1400021c0
mov rbx, qword [rsp + 0x18]
mov rcx, rax
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
shr rcx, 0x21
xor rcx, rax
imul rcx, rbp
mov rbp, qword [rsp + 0x20]
mov rdx, rcx
shr rdx, 0x1d
xor rdx, rcx
imul rdx, r8
mov rax, rdx
shr rax, 0x20
xor rax, rdx
pop r15
pop r14
ret

Function at 0x14000a4a0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor r14d, r14d
mov rbp, rdx
mov word [rsp + 0x30], r14w
mov rsi, rcx
mov edi, 0x28
test al, al
je 0x14000a551
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], r14b
lea rcx, [rsp + 0x24]
call fcn.14000ffd0
cmp rax, 1
jne 0x14000a587
mov rcx, rdi
mov rax, rbx
cmp word [rbx], r14w
je 0x14000a52d
add rax, 2
dec rcx
cmp word [rax], r14w
jne 0x14000a520
cmp rcx, 1
jb 0x14000a587
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], r14w
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x14000a4f0
mov rdx, rbp
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14000c490
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.14000fc8c
int3
Function at 0x14000a610
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x250
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, r8
lea rax, [rsp + 0x30]
mov rbx, rcx
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor ecx, ecx
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x14000a655
xor al, al
jmp 0x14000a6a2
cmp word [rbx], 0
je 0x14000a66d
nop dword [rax + rax]
add rbx, 2
dec rdi
cmp word [rbx], 0
jne 0x14000a660
cmp word [rsp + 0x30], 0
je 0x14000a69b
lea rcx, [rsp + 0x30]
sub rcx, rbx
nop dword [rax]
cmp rdi, 1
jb 0x14000a6c3
movzx eax, word [rcx + rbx]
dec rdi
mov word [rbx], ax
add rbx, 2
cmp word [rcx + rbx], 0
jne 0x14000a680
xor eax, eax
mov word [rbx], ax
mov al, 1
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14000c490
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
ret
call fcn.14000fc8c
int3
Function at 0x14000cd84
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000cdce
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000cdce
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000cdce
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000cdce
cmp dword [rcx + 0x84], 0xe
jbe 0x14000cdce
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000cdd0
xor al, al
add rsp, 0x28
ret

Function at 0x14000fa98
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000fb07
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000fb07
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000fb07
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000fb07
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000fb07
cmp dword [rcx + 0x84], 0xe
jbe 0x14000fb07
cmp dword [rcx + 0xf8], 0
je 0x14000fb07
mov ecx, ebx
call fcn.14000fbac
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14000f9a0
nop
cmp dword [rbp + 0x20], 0
jne 0x14000fb68
call fcn.14001468c
cmp eax, 1
jne 0x14000fb58
xor dl, dl
jmp 0x14000fb62
call fcn.140014658
test al, al
sete dl
cmp dword [rbp + 0x20], 0
je 0x14000fb73
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000fb7c
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000fa98

Function at 0x14000fc80
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000fb07
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000fb07
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000fb07
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000fb07
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000fb07
cmp dword [rcx + 0x84], 0xe
jbe 0x14000fb07
cmp dword [rcx + 0xf8], 0
je 0x14000fb07
mov ecx, ebx
call fcn.14000fbac
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14000f9a0
nop
cmp dword [rbp + 0x20], 0
jne 0x14000fb68
call fcn.14001468c
cmp eax, 1
jne 0x14000fb58
xor dl, dl
jmp 0x14000fb62
call fcn.140014658
test al, al
sete dl
cmp dword [rbp + 0x20], 0
je 0x14000fb73
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000fb7c
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000fa98
Function at 0x140019288
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14001930f
mov rsi, rbx
cmp word [rax], bp
je 0x1400192ce
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400192b8
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400192b4
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1400167c0
mov rdi, rax
test rax, rax
je 0x1400192fc
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14001fe40
mov rbp, rdi
xor ecx, ecx
call fcn.1400158a0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14001b3d0
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14001b3e6
mov al, 1
jmp 0x14001b452
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14001b3f7
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14001b450
mov ecx, dword [rcx + 0x18]
nop
call fcn.1400195d0
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001b450
and qword [rsp + 0x38], 0
lea r8, [rsp + 0x38]
mov r9d, 1
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14001b450
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14001b450
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14001b452
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x14001f690
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14001f6b8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14001f6b8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret