joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100140610
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbp, r9
mov r14b, r8b
mov r15, rdx
mov r13, rcx
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x10014066c
test byte [rcx + 0x1c], 1
je 0x10014066c
cmp byte [rcx + 0x19], 4
jb 0x10014066c
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002e10]
mov edx, 0xc
call fcn.10001c7b8
xor eax, eax
xor esi, esi
xor r8d, r8d
mov qword [rbp], rax
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
mov rcx, qword [r13]
xor edx, edx
mov qword [rsp + 0x50], rsi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebx, eax
test eax, eax
jne 0x1001406af
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x10014078d
mov rax, rbx
mov ecx, 0xffffffff
add rax, rax
cmp rax, rcx
jbe 0x1001406c9
mov ebx, 0x80070216
jmp 0x10014078d
mov ecx, eax
mov r12d, eax
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov rdi, rax
test rax, rax
jne 0x1001406e6
mov ebx, 0x8007000e
jmp 0x100140771
mov r8, r12
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov rcx, qword [r13]
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x10014071d
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x100140771
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.10009ba0c
mov ebx, eax
test eax, eax
js 0x10014076c
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rsi, qword [rsp + 0x50]
mov rdx, rbp
mov rcx, rsi
xor edi, edi
call fcn.10009b37c
mov ebx, eax
test eax, eax
js 0x10014077f
mov rcx, qword [r15]
lea rdx, [rbp + 8]
xor r8d, r8d
call fcn.10009b4ec
mov ebx, eax
test eax, eax
js 0x10014077f
mov byte [rbp + 0x10], r14b
jmp 0x100140771
mov rsi, qword [rsp + 0x50]
test rdi, rdi
je 0x10014077f
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test rsi, rsi
je 0x10014078d
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1001407c1
test byte [rcx + 0x1c], 1
je 0x1001407c1
cmp byte [rcx + 0x19], 4
jb 0x1001407c1
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002e10]
mov edx, 0xd
call fcn.10001c7b8
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x100147bbc
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r13
sub rsp, 0x240
mov rax, qword [0x100165138]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor ebx, ebx
mov dword [0x100166690], ebx
mov dword [0x100166694], ebx
mov rcx, qword [0x1001653b8]
lea r13, [0x1001653b8]
cmp rcx, r13
je 0x100147c26
test byte [rcx + 0x1c], 0x20
je 0x100147c26
cmp byte [rcx + 0x19], 4
jb 0x100147c26
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0xa]
lea r8, [0x100002c10]
call fcn.10001c7b8
mov edi, 0x105
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8, rdi
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x20]
lea rcx, [0x100015ad8]
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, edi
jbe 0x100147c5d
mov ebx, 0x8007000e
jmp 0x100147d0e
lea rsi, [rsp + 0x20]
lea rdi, [0x100015b10]
mov ecx, 4
repe cmpsw word [rsi], word [rdi]
jne 0x100147c7c
mov word [0x100165414], bx
jmp 0x100147cb9
mov eax, 6
lea rsi, [rsp + 0x20]
lea rdi, [0x100015b18]
mov rcx, rax
repe cmpsw word [rsi], word [rdi]
jne 0x100147c9c
mov eax, 9
jmp 0x100147cb2
lea rsi, [rsp + 0x20]
lea rdi, [0x100015b28]
mov ecx, 5
repe cmpsw word [rsi], word [rdi]
jne 0x100147cb9
mov word [0x100165414], ax
call fcn.10014d180
cmp eax, ebx
jne 0x100147d07
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
cmp eax, ebx
cmovle ecx, eax
mov ebx, ecx
mov rcx, qword [0x1001653b8]
cmp rcx, r13
je 0x100147d3b
test byte [rcx + 0x1c], 0x20
je 0x100147d15
cmp byte [rcx + 0x19], 2
jb 0x100147d15
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002c10]
mov edx, 0xb
call fcn.10001c7b8
jmp 0x100147d0e
or dword [0x100166690], 1
mov rcx, qword [0x1001653b8]
cmp rcx, r13
je 0x100147d3b
test byte [rcx + 0x1c], 0x20
je 0x100147d3b
cmp byte [rcx + 0x19], 4
jb 0x100147d3b
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002c10]
mov edx, 0xc
call fcn.10001c7b8
mov eax, ebx
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.10014e480
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r13
ret
Function at 0x10014af90
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [0x10016664b], 0
movdqu xmm0, xmmword [0x100001fe0]
mov rbx, rcx
movdqu xmmword [rcx], xmm0
je 0x10014afc7
mov ecx, dword [0x1001666b8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x10014afc7
movdqu xmm0, xmmword [rax]
movdqu xmmword [rbx], xmm0
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x10014d9e0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x250
mov rax, qword [0x100165138]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov ebx, 0x104
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x30]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp eax, ebx
jae 0x10014db67
xor r12d, r12d
cmp eax, r12d
jne 0x10014da3f
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10014db6c
mov rax, qword [rsp + 0x20]
cmp rax, r12
je 0x10014db67
lea rcx, [rsp + 0x30]
cmp rax, rcx
je 0x10014db67
mov word [rax], r12w
movzx ecx, word [rsp + 0x30]
mov r13d, 0x5c
cmp cx, 0x41
jb 0x10014da76
cmp cx, 0x5a
jbe 0x10014da7f
lea eax, [rcx - 0x61]
cmp ax, 0x19
ja 0x10014da9a
cmp word [rsp + 0x32], 0x3a
jne 0x10014da9a
cmp word [rsp + 0x34], r13w
jne 0x10014db67
lea rsi, [rsp + 0x34]
jmp 0x10014da9f
mov rsi, qword [rsp + 0x20]
cmp cx, r13w
jne 0x10014dadb
cmp word [rsp + 0x32], r13w
jne 0x10014dadb
lea rcx, [rsp + 0x34]
mov edx, r13d
call sub.msvcrt.dll_wcschr
cmp rax, r12
je 0x10014db67
lea rcx, [rax + 2]
mov edx, r13d
call sub.msvcrt.dll_wcschr
mov rsi, rax
cmp rax, r12
je 0x10014db67
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10014dafa
and al, 0x10
neg al
sbb eax, eax
not eax
and eax, 0x10b
jmp 0x10014db6c
mov rdi, qword [rsp + 0x20]
lea rax, [rsp + 0x30]
cmp rdi, rax
jne 0x10014db10
lea rdi, [rsp + 0x30]
jmp 0x10014db14
add rdi, 0xfffffffffffffffe
cmp rdi, rsi
je 0x10014db67
cmp word [rdi], r13w
jne 0x10014db67
cmp rdi, rsi
jbe 0x10014db67
lea rcx, [rsp + 0x30]
mov edx, r13d
mov word [rdi], r12w
call sub.msvcrt.dll_wcsrchr
mov rbp, rax
cmp rax, r12
je 0x10014db67
movzx ebx, word [rax + 2]
lea rcx, [rsp + 0x30]
mov word [rax + 2], r12w
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov word [rbp + 2], bx
cmp eax, 0xffffffff
jne 0x10014db99
mov rdi, rbp
cmp rbp, rsi
ja 0x10014db24
cmp rdi, rsi
ja 0x10014dbbf
mov eax, 0x7b
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.10014e480
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
test al, 0x10
jne 0x10014db62
mov eax, 0x10b
jmp 0x10014db6c
cmp word [rdi + 2], r12w
je 0x10014dbd6
mov rcx, rdi
mov word [rdi], r13w
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
lea rdi, [rdi + rcx*2]
lea rcx, [rsp + 0x30]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, r12d
jne 0x10014dba4
jmp 0x10014da34
xor eax, eax
jmp 0x10014db6c
Function at 0x10014dd9c
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x100165138]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x28]
add rcx, r8
call sub.msvcrt.dll_memset
and qword [rbx + 0x50], 0
and dword [rbx + 0x58], 0
and dword [rbx + 0x5c], 0
lea rax, [0x100000000]
mov esi, 0x94
lea rcx, [rsp + 0x20]
mov r8, rsi
xor edx, edx
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rax
mov dword [rbx], 0x60
mov byte [rbx + 0x18], 0
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x30], 2
mov esi, 1
jne 0x10014de2f
cmp dword [rsp + 0x24], 5
jb 0x10014de49
jmp 0x10014de45
cmp dword [rsp + 0x30], esi
jne 0x10014de49
cmp dword [rsp + 0x24], 4
ja 0x10014de45
jne 0x10014de49
cmp dword [rsp + 0x28], 0
jbe 0x10014de49
mov byte [rbx + 0x18], sil
lea rax, [0x100001eb0]
lea rcx, [rbx + 0x28]
mov dword [rbx + 0x1c], 0x800
mov qword [rbx + 0x20], rax
call fcn.1000196a4
movzx ecx, byte [0x100167cb0]
test eax, eax
mov rax, rbx
cmovs ecx, esi
mov byte [0x100167cb0], cl
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.10014e480
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x10014e12c
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
push r13
sub rsp, 0xb0
xor ebx, ebx
mov dword [rsp + 0x20], ebx
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
mov r12d, ebx
xor eax, eax
lock cmpxchg qword [0x100167d60], rdi
je 0x10014e18c
cmp rax, rdi
jne 0x10014e17f
mov r12d, 1
jmp 0x10014e18c
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10014e165
mov eax, dword [0x100167d58]
cmp eax, 1
jne 0x10014e1a1
lea ecx, [rax + 0x1e]
call sub.msvcrt.dll__amsg_exit
jmp 0x10014e208
mov eax, dword [0x100167d58]
cmp eax, ebx
jne 0x10014e1fe
mov dword [0x100167d58], 1
lea r13, [0x100001e70]
lea rdi, [0x100001e58]
mov qword [rsp + 0x30], rdi
mov eax, ebx
mov dword [rsp + 0x24], ebx
cmp rdi, r13
jae 0x10014e1f0
cmp eax, ebx
jne 0x10014e1f0
mov rcx, qword [rdi]
cmp rcx, rbx
je 0x10014e1e5
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x10014e1ce
cmp eax, ebx
je 0x10014e208
mov eax, 0xff
jmp 0x10014e350
mov dword [0x100165ecc], 1
mov eax, dword [0x100167d58]
cmp eax, 1
jne 0x10014e230
lea rdx, [0x100001e50]
lea rcx, [0x100001d90]
call sub.msvcrt.dll__initterm
mov dword [0x100167d58], 2
cmp r12d, ebx
jne 0x10014e23f
mov rax, rbx
xchg qword [0x100167d60], rax
cmp qword [0x100167d78], rbx
je 0x10014e267
lea rcx, [0x100167d78]
call fcn.10014ea1c
cmp eax, ebx
je 0x10014e267
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x100167d78]
mov rcx, qword [sym.imp.msvcrt.dll__wcmdln]
cmp qword [rcx], rbx
jne 0x10014e27d
mov eax, 0xff
jmp 0x10014e350
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
cmp word [rcx], 0x20
ja 0x10014e302
cmp word [rcx], bx
je 0x10014e298
cmp edx, ebx
jne 0x10014e302
cmp word [rcx], bx
je 0x10014e2ae
cmp word [rcx], 0x20
ja 0x10014e2ae
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x10014e298
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x100000000]
call fcn.100066950
mov dword [0x100165ec8], eax
cmp dword [0x100165eac], ebx
jne 0x10014e2ec
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x100165ecc], ebx
jne 0x10014e300
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x100165ec8]
jmp 0x10014e350
cmp word [rcx], 0x22
jne 0x10014e315
mov eax, ebx
cmp edx, ebx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x10014e289
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r12, qword [r11 + 0x20]
mov rsp, r11
pop r13
ret
sub rsp, 0x28
call fcn.100200000
add rsp, 0x28
jmp 0x10014e12c
Function at 0x10014e480
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x100165138]
jne 0x10014e49b
rol rcx, 0x10
test cx, 0xffff
jne 0x10014e497
ret 0
ror rcx, 0x10
jmp 0x10014ebec
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x100165f80]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov r11, qword [0x100166078]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.ntdll.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x10014ec71
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x100165f80]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.ntdll.dll_RtlVirtualUnwind
jmp 0x10014ec93
mov rax, qword [rsp + 0x88]
mov qword [0x100166078], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x100166018], rax
mov rax, qword [0x100166078]
mov qword [0x100165ef0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x100166000], rax
mov dword [0x100165ee0], 0xc0000409
mov dword [0x100165ee4], 1
mov rax, qword [0x100165138]
mov qword [rsp + 0x68], rax
mov rax, qword [0x100165140]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x100001f98]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x10014ea88
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x10014ead5
cmp rcx, 0xffffffffffffffff
je 0x10014ead5
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x10014eacd
cmp dword [rcx + 0x3c], edx
jl 0x10014eacd
cmp dword [rcx + 0x3c], 0x10000000
jae 0x10014eacd
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x10014ead5
mov rax, rdx
add rsp, 0x18
ret

Function at 0x10014ed14
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x530
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x10014ed7f
and qword [rsp + 0x38], 0
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x50]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov r8, rbx
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlVirtualUnwind]
jmp 0x10014ed9f
mov rax, qword [rsp + 0x538]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x538]
mov qword [rsp + 0xf8], rax
lea rcx, [0x100001fa8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add rsp, 0x530
pop rbx
ret
Function at 0x1405fc570
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1405fc57d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1405fc58d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1405fc575
lea eax, [rcx + 1]
jmp 0x1405fc59b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1405fc5ae
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1405fc594
sub eax, 3
jb 0x1405fc5ce
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1405fc61d
sar eax, 1
movsxd rbp, eax
jb 0x1405fc604
jmp 0x1405fc5dc
add ebx, ebx
jne 0x1405fc5da
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1405fc604
inc ecx
add ebx, ebx
jne 0x1405fc5ea
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1405fc604
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1405fc5fd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1405fc5ec
add ecx, 2
jmp 0x1405fc609
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.1405fc532
jmp 0x1405fc57d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x20200
mov dl, 3
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1405fc669
cmp rsi, rcx
jae 0x1405fc671
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x1405fc650
cmp al, 0x8f
ja 0x1405fc650
cmp byte [rsi - 2], 0xf
je 0x1405fc656
sub al, 0xe8
cmp al, 1
ja 0x1405fc63a
cmp rsi, rcx
jae 0x1405fc671
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x1405fc640
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1405fc671
lodsb al, byte [rsi]
jmp 0x1405fc650
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x5fa000]
mov eax, dword [rdi]
or eax, eax
je 0x1405fc6ce
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x614df8]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1405fc67e
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1405fc6c8
mov qword [rbx], rax
add rbx, 8
jmp 0x1405fc69e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x1405fc712
cmp al, 0xef
ja 0x1405fc6fa
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x1405fc6da
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x1405fc6e9
mov eax, dword [rdi]
add rdi, 4
jmp 0x1405fc6e9
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x22f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1405fc766
sub rsp, 0xffffffffffffff80
jmp 0x140020318
Function at 0x140003ff0
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.140003ad0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14000402f
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1400402b0]
jmp 0x140004039
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret
Function at 0x1400206f0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x140023f40
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0xb8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140002fd0
lea rcx, [rsp + 0x40]
call fcn.140023f00
movzx eax, al
test eax, eax
jne 0x140023f88
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call fcn.140023e30
mov rax, qword [rsp + 0x70]
jmp 0x140024159
lea rcx, [rsp + 0x40]
call fcn.140003050
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.140023eb0
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x40]
call fcn.140003050
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.140023d00
cdqe
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x14002402e
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x40]
call fcn.140023e30
mov rax, qword [rsp + 0x80]
jmp 0x140024159
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, qword [rsp + 0x58]
call fcn.14000ee40
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140002fd0
lea rcx, [rsp + 0x48]
call fcn.140003010
movzx eax, al
test eax, eax
jne 0x140024095
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x48]
call fcn.140002ff0
lea rcx, [rsp + 0x40]
call fcn.140023e30
mov rax, qword [rsp + 0x88]
jmp 0x140024159
lea rcx, [rsp + 0x48]
call fcn.140003050
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x40]
call fcn.140003050
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call fcn.140023d00
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x14002412b
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x48]
call fcn.140002ff0
lea rcx, [rsp + 0x40]
call fcn.140023e30
mov rax, qword [rsp + 0xa0]
jmp 0x140024159
lea rcx, [rsp + 0x48]
call fcn.140003580
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x48]
call fcn.140002ff0
lea rcx, [rsp + 0x40]
call fcn.140023e30
mov rax, qword [rsp + 0xa8]
add rsp, 0xb8
ret
Function at 0x140030180
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
lea rcx, [rsp + 0x78]
call fcn.140021770
lea rcx, [rsp + 0x48]
call fcn.140021770
call fcn.140021a20
mov r8d, eax
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0xc0]
call fcn.140020c60
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x1400301ef
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x48]
call fcn.140021830
lea rcx, [rsp + 0x78]
call fcn.140021830
mov eax, dword [rsp + 0x24]
jmp 0x140030280
call fcn.140021a20
mov r8d, eax
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0xc8]
call fcn.140020c60
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x140030236
mov dword [rsp + 0x2c], 0
lea rcx, [rsp + 0x48]
call fcn.140021830
lea rcx, [rsp + 0x78]
call fcn.140021830
mov eax, dword [rsp + 0x2c]
jmp 0x140030280
lea rcx, [rsp + 0x48]
call fcn.140021d80
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x78]
call fcn.140021d80
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x48]
call fcn.140021830
lea rcx, [rsp + 0x78]
call fcn.140021830
mov eax, dword [rsp + 0x30]
add rsp, 0xb8
ret