joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff6d4a651e0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rbp
push r15
sub rsp, 0x48
mov r15d, r8d
mov rbp, rcx
test r8d, r8d
je 0x7ff6d4a65420
mov qword [rax + 8], rbx
mov ecx, r15d
mov qword [rax - 0x18], rsi
mov qword [rax - 0x20], rdi
mov qword [rax - 0x28], r12
mov qword [rax - 0x30], r13
mov qword [rax - 0x38], r14
call fcn.7ff6d4981740
xor r12d, r12d
mov r13, rax
mov r14d, r12d
mov esi, r15d
test r15d, r15d
je 0x7ff6d4a6531f
nop dword [rax]
nop word [rax + rax]
mov rax, qword gs:[0x60]
movsxd rdi, r14d
add rdi, r13
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r11d, dword [rcx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x7ff6d4a652d7
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x7ff6d4a652d7
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rdx, [rbx + r9*4]
mov ecx, dword [rdx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x7ff6d4a652d2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x7ff6d4a652b0
cmp r8d, 0xece4502d
je 0x7ff6d4a652dc
test r9d, r9d
jne 0x7ff6d4a65290
mov rax, qword [rax]
jmp 0x7ff6d4a65260
mov eax, dword [r11 + 0x24]
mov rdx, rdi
mov ecx, dword [r11 + 0x1c]
add rax, r10
add rcx, r10
movzx r8d, word [rax + r9*2]
xor r9d, r9d
mov eax, dword [rcx + r8*4]
mov r8d, esi
mov rcx, qword [rbp + 0x10]
add rax, r10
call rax
mov edi, eax
lea ecx, [rax + 1]
cmp ecx, 1
jbe 0x7ff6d4a65323
add r14d, eax
sub esi, eax
cmp r14d, r15d
jb 0x7ff6d4a65240
jmp 0x7ff6d4a65323
mov edi, dword [rsp + 0x70]
mov rax, qword gs:[0x60]
mov rsi, qword [rsp + 0x40]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r11d, dword [rcx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x7ff6d4a653b5
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x7ff6d4a653b5
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [rbx + r9*4]
mov r8d, dword [rdx + r10]
mov edx, 0x811c9dc5
add r8, r10
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x7ff6d4a653b0
nop
movsx ecx, cl
lea r8, [r8 + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8 - 1]
test cl, cl
jne 0x7ff6d4a65390
cmp edx, 0xa45cec64
je 0x7ff6d4a653ba
test r9d, r9d
jne 0x7ff6d4a65370
mov rax, qword [rax]
jmp 0x7ff6d4a65340
mov eax, dword [r11 + 0x24]
mov r8, r15
mov ecx, dword [r11 + 0x1c]
add rax, r10
add rcx, r10
movzx edx, word [rax + r9*2]
mov r9d, dword [rcx + rdx*4]
mov rdx, r13
mov rcx, qword [rsp + 0x68]
add r9, r10
call r9
mov rcx, r13
call fcn.7ff6d4a69ff8
mov r13, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x60]
cmp edi, 0xffffffff
je 0x7ff6d4a65419
test edi, edi
cmovne r12d, r14d
mov eax, r12d
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov r14, qword [rsp + 0x20]
add rsp, 0x48
pop r15
pop rbp
ret
mov eax, 0xffffffff
jmp 0x7ff6d4a65402
xor eax, eax
add rsp, 0x48
pop r15
pop rbp
ret
Function at 0x7ff6d4a65930
Capabilities:
Access peb ldr_data
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov rax, qword gs:[0x60]
mov esi, r8d
mov rbp, rdx
mov r14, rcx
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r10, qword [rax + 0x30]
movsxd r9, dword [r10 + 0x3c]
mov ebx, dword [r9 + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x7ff6d4a659d7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x7ff6d4a659d7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x7ff6d4a659d2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x7ff6d4a659b0
cmp r8d, 0x7261c8af
je 0x7ff6d4a659dc
test r9d, r9d
jne 0x7ff6d4a65990
mov rax, qword [rax]
jmp 0x7ff6d4a65960
mov ecx, dword [rbx + 0x24]
mov r8d, esi
add rcx, r10
movzx edx, word [rcx + r9*2]
xor r9d, r9d
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov rdx, rbp
mov rcx, qword [r14 + 0x10]
add rax, r10
mov rbx, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
pop r14
jmp rax

Function at 0x7ff6d4a67ba0
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
nop
mov eax, dword [0x7ff6d4c70808]
nop
syscall
ret

Function at 0x7ff6d4a6af20
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [0x7ff6d4a6e328]
test rax, rax
je 0x7ff6d4a6af6a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x7ff6d4a6af6a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x7ff6d4a6af6a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x7ff6d4a6af6a
cmp dword [rcx + 0x84], 0xe
jbe 0x7ff6d4a6af6a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x7ff6d4a6af6c
xor al, al
add rsp, 0x28
ret
Function at 0x14013cd10
Capabilities:
Check for debugger via api
Check for peb ntglobalflag flag

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x14013ce29
xor ebx, ebx
mov dword [rsp + 0x48], ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
test eax, eax
je 0x14013cd50
cmp dword [rsp + 0x48], ebx
jne 0x14013ce0f
mov qword [rsp + 0x48], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 8
mov qword [rsp + 0x20], rbx
mov rcx, rax
lea r8, [rsp + 0x48]
mov edx, 0x1e
call qword [0x1401b8c10]
test eax, eax
jne 0x14013cd88
cmp qword [rsp + 0x48], rbx
jne 0x14013ce1c
call fcn.14013ce70
test al, al
jne 0x14013ce29
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movsxd rcx, dword [rax + 0x3c]
mov edx, dword [rcx + rax + 0xd8]
cmp dword [rdx + rax + 0xc], ebx
jne 0x14013ce29
mov rax, qword gs:[0x60]
mov rdi, qword [rax + 0x30]
call fcn.14013cc30
test eax, eax
mov edx, 0x70
mov ebx, 0x14
cmovne ebx, edx
call fcn.14013cc30
test eax, eax
mov ecx, 0x18
mov edx, 0x74
cmovne ecx, edx
test dword [rbx + rdi], 0xfffffffd
jne 0x14013ce29
cmp dword [rcx + rdi], 0
jne 0x14013ce29
mov rax, qword gs:[0x60]
test byte [rax + 0xbc], 0x70
jne 0x14013ce29
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
lea rcx, str.Sorry__you_cant_use_debuggers_with_this_program.
call fcn.14013ce40
int3
lea rcx, str.Sorry__you_cant_use_debuggers_with_this_program.
call fcn.14013ce40
int3
lea rcx, str.Sorry__you_cant_use_debuggers_with_this_program.
call fcn.14013ce40
int3
Function at 0x14013ce70
Capabilities:
Enumerate pe sections
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
push r14
push r15
sub rsp, 0x180
mov rax, qword [0x1401b05c0]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rsi, 0xffffffffffffffff
mov qword [rsp + 0x58], rsi
xor ebx, ebx
mov qword [rsp + 0x50], rbx
mov r14d, ebx
mov qword [rsp + 0x48], rbx
xor r15b, r15b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movsxd r8, dword [rax + 0x3c]
add r8, rax
movzx eax, word [r8 + 0x14]
lea r9, [r8 + 0x18]
add r9, rax
mov edx, ebx
mov dword [rsp + 0x40], ebx
lea r10, [0x14018f79c]
movzx eax, word [r8 + 6]
cmp edx, eax
jge 0x14013cf1e
movsxd rax, edx
lea rcx, [rax + rax*4]
lea rdi, [r9 + rcx*8]
mov rax, rbx
nop dword [rax + rax]
movzx ecx, byte [rdi + rax]
inc rax
cmp cl, byte [r10 + rax - 1]
jne 0x14013cf16
cmp rax, 7
jne 0x14013cf00
jmp 0x14013cf21
inc edx
mov dword [rsp + 0x40], edx
jmp 0x14013cee4
mov rdi, rbx
mov r8d, 0x104
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x14013cfeb
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r12d, 1
mov r8d, r12d
mov edx, 0x80000000
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
mov qword [rsp + 0x58], rax
cmp rax, 0xffffffffffffffff
je 0x14013cfeb
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor edx, edx
mov r8d, 2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14013cfeb
mov ecx, dword [rdi + 0x10]
add ecx, dword [rdi + 0x14]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov edx, 4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r14, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x14013cfeb
movsxd rcx, dword [rax + 0x3c]
mov edx, dword [rcx + rax + 0xd8]
sub edx, dword [rdi + 0xc]
add edx, dword [rdi + 0x14]
movzx r15d, r15b
cmp dword [rdx + rax + 0xc], 0
cmovne r15d, r12d
test r14, r14
je 0x14013cff9
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test rbx, rbx
je 0x14013d007
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rsi, 0xffffffffffffffff
je 0x14013d016
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, r15b
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.14016d700
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x140168e40
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x10090
call fcn.14016da60
sub rsp, rax
mov rax, qword [0x1401b05c0]
xor rax, rsp
mov qword [rsp + 0x10080], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor ebp, ebp
mov rsi, rcx
mov word [rsp + 0x80], bp
mov edi, 0x28
mov word [rsp + 0x30], bp
test al, al
je 0x140168f02
nop dword [rax]
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], bpl
lea rcx, [rsp + 0x24]
call fcn.14017c954
cmp rax, 1
jne 0x140168f5e
mov rcx, rdi
mov rax, rbx
cmp word [rbx], bp
je 0x140168edf
add rax, 2
dec rcx
cmp word [rax], bp
jne 0x140168ed3
cmp rcx, 1
jb 0x140168f5e
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], bp
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x140168ea0
mov r8d, 0x10000
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0xffff
ja 0x140168f33
lea rcx, [rsp + 0x80]
call fcn.14017f588
jmp 0x140168f35
xor eax, eax
mov rcx, qword [rsp + 0x10080]
xor rcx, rsp
call fcn.14016d700
lea r11, [rsp + 0x10090]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.140170f20
int3
Function at 0x140169e90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp byte [0x1401b6aae], 0
mov rsi, r8
mov rdi, rdx
mov rbp, rcx
jne 0x140169f24
mov edx, 3
xor ecx, ecx
mov r8d, 0xa
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rcx, rax
mov qword [0x1401b6810], rax
call fcn.14013d0a0
mov qword [0x1401b6810], rax
xor ecx, ecx
mov ebx, dword [rax]
lea rdx, [rax + 4]
mov qword [0x1401b6810], rdx
mov r8d, dword [rdx]
add rdx, 4
mov qword [0x1401b6810], rdx
call fcn.140167b90
cmp eax, ebx
jne 0x14016a08d
mov byte [0x1401b6aae], 1
lea rdx, str..bytecode
mov rcx, rsi
call fcn.14017e400
test eax, eax
je 0x140169faf
cmp byte [0x1401b6aad], 1
je 0x140169faf
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x1401b7808], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x1401b7810], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x1401b7818], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x1401b7820], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x1401b7828], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x1401b7830], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x1401b7838], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x1401b7840], rax
mov byte [0x1401b6aad], 1
mov r8, qword [0x1401b6810]
mov rax, rsi
mov rdx, r8
sub rdx, rsi
nop
movzx ecx, byte [rax]
xor r9d, r9d
cmp cl, byte [rax + rdx]
jne 0x140169fd7
inc rax
test cl, cl
jne 0x140169fc0
mov ecx, r9d
jmp 0x140169fdc
sbb ecx, ecx
or ecx, 1
mov rax, 0xffffffffffffffff
cmp byte [r8 + rax + 1], r9b
lea rax, [rax + 1]
jne 0x140169fe3
lea rdx, [r8 + rax]
mov eax, dword [r8 + rax + 1]
add rdx, 5
test ecx, ecx
je 0x14016a048
nop
add rdx, rax
mov rax, rsi
mov r8, rdx
sub r8, rsi
nop dword [rax]
movzx ecx, byte [rax]
cmp cl, byte [rax + r8]
jne 0x14016a025
inc rax
test cl, cl
jne 0x14016a010
mov ecx, r9d
jmp 0x14016a02a
sbb ecx, ecx
or ecx, 1
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], r9b
jne 0x14016a031
add rdx, rax
mov eax, dword [rdx + 1]
add rdx, 5
test ecx, ecx
jne 0x14016a000
movzx ecx, word [rdx]
lea rax, [rdx + 2]
cmp r9w, cx
jae 0x14016a078
mov ebx, ecx
nop word [rax + rax]
mov r8, rax
mov rdx, rdi
mov rcx, rbp
call fcn.140166210
add rdi, 8
sub rbx, 1
jne 0x14016a060
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
lea rcx, str.Error__corrupted_constants_object
call fcn.14017bcd8
call fcn.140170f20
int3
Function at 0x14016d290
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rax, qword [0x1401b05c0]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor r14d, r14d
mov rbp, rdx
mov word [rsp + 0x30], r14w
mov rsi, rcx
mov edi, 0x28
test al, al
je 0x14016d341
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], r14b
lea rcx, [rsp + 0x24]
call fcn.14017c954
cmp rax, 1
jne 0x14016d377
mov rcx, rdi
mov rax, rbx
cmp word [rbx], r14w
je 0x14016d31d
add rax, 2
dec rcx
cmp word [rax], r14w
jne 0x14016d310
cmp rcx, 1
jb 0x14016d377
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], r14w
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x14016d2e0
mov rdx, rbp
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14016d700
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.140170f20
int3

Function at 0x14016d580
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x1401b05c0]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor ebp, ebp
mov rsi, rcx
mov word [rsp + 0x30], bp
mov edi, 0x28
test al, al
je 0x14016d62f
nop dword [rax]
nop dword [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], bpl
lea rcx, [rsp + 0x24]
call fcn.14017c954
cmp rax, 1
jne 0x14016d665
mov rcx, rdi
mov rax, rbx
cmp word [rbx], bp
je 0x14016d60c
nop
add rax, 2
dec rcx
cmp word [rax], bp
jne 0x14016d600
cmp rcx, 1
jb 0x14016d665
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], bp
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x14016d5d0
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14016d700
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.140170f20
int3

Function at 0x14016e1c4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14016e20e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14016e20e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14016e20e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14016e20e
cmp dword [rcx + 0x84], 0xe
jbe 0x14016e20e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14016e210
xor al, al
add rsp, 0x28
ret
Function at 0x140173f00
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140173f6f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140173f6f
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140173f6f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140173f6f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140173f6f
cmp dword [rcx + 0x84], 0xe
jbe 0x140173f6f
cmp dword [rcx + 0xf8], 0
je 0x140173f6f
mov ecx, ebx
call fcn.140174020
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140173dfc
nop
cmp dword [rbp + 0x20], 0
je 0x140173fbd
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140173fc8
int3
xor r8d, r8d
xor edx, edx
jmp 0x140173f00

Function at 0x140174104
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140173f6f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140173f6f
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140173f6f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140173f6f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140173f6f
cmp dword [rcx + 0x84], 0xe
jbe 0x140173f6f
cmp dword [rcx + 0xf8], 0
je 0x140173f6f
mov ecx, ebx
call fcn.140174020
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140173dfc
nop
cmp dword [rbp + 0x20], 0
je 0x140173fbd
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140173fc8
int3
xor r8d, r8d
xor edx, edx
jmp 0x140173f00
Function at 0x1401844e0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140184567
mov rsi, rbx
cmp word [rax], bp
je 0x140184526
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140184510
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14018450c
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14018070c
mov rdi, rax
test rax, rax
je 0x140184554
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14018a860
mov rbp, rdi
xor ecx, ecx
call fcn.14017fad8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140187d74
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x140187d8a
mov al, 1
jmp 0x140187dea
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x140187d9b
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140187de8
mov ecx, dword [rcx + 0x18]
nop
call fcn.140184c84
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140187de8
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140187de8
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140187de8
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x140187dea
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x14018a640
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14018a668
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14018a668
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140008c10
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 0x38
mov dword [rsp + 0x34], edx
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x20], rcx
mov edx, dword [rsp + 0x34]
mov r8d, 0xffffffff
mov r9d, 0x6c078965
call fcn.14000d180
mov rax, qword [rsp + 0x20]
add rsp, 0x38
ret

Function at 0x14000d620
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rcx
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
cmp dword [rax], 0x270
jne 0x14000d64e
mov rcx, qword [rsp + 0x20]
call fcn.14000d6f0
jmp 0x14000d66f
mov rcx, qword [rsp + 0x20]
mov eax, 0x4e0
cmp eax, dword [rcx]
ja 0x14000d66a
mov rcx, qword [rsp + 0x20]
call fcn.14000d7b0
jmp 0x14000d66f
mov rcx, qword [rsp + 0x20]
mov eax, dword [rcx]
mov edx, eax
add edx, 1
mov dword [rcx], edx
mov eax, eax
mov eax, dword [rcx + rax*4 + 4]
and eax, 0xffffffff
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x2c]
shr eax, 0xb
and eax, dword [rcx + 0x1384]
xor eax, dword [rsp + 0x2c]
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x2c]
shl eax, 7
and eax, 0x9d2c5680
xor eax, dword [rsp + 0x2c]
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x2c]
shl eax, 0xf
and eax, 0xefc60000
xor eax, dword [rsp + 0x2c]
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x2c]
and eax, 0xffffffff
shr eax, 0x12
xor eax, dword [rsp + 0x2c]
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x2c]
add rsp, 0x38
ret

Function at 0x14000d6f0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 0x20
mov qword [rsp + 0x18], rcx
mov rax, qword [rsp + 0x18]
mov qword [rsp], rax
mov qword [rsp + 0x10], 0x270
cmp qword [rsp + 0x10], 0x4e0
jae 0x14000d7a0
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x10]
sub rcx, 0x270
mov ecx, dword [rax + rcx*4 + 4]
and ecx, 0x80000000
mov rdx, qword [rsp + 0x10]
sub rdx, 0x270
mov edx, dword [rax + rdx*4 + 8]
and edx, 0x7fffffff
or ecx, edx
mov dword [rsp + 0xc], ecx
mov edx, dword [rsp + 0xc]
shr edx, 1
mov r9d, dword [rsp + 0xc]
and r9d, 1
xor ecx, ecx
mov r8d, 0x9908b0df
cmp r9d, 0
cmovne ecx, r8d
xor edx, ecx
mov rcx, qword [rsp + 0x10]
sub rcx, 0x270
xor edx, dword [rax + rcx*4 + 0x638]
mov rcx, qword [rsp + 0x10]
mov dword [rax + rcx*4 + 4], edx
mov rax, qword [rsp + 0x10]
add rax, 1
mov qword [rsp + 0x10], rax
jmp 0x14000d70b
add rsp, 0x20
ret