joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000327e
Capabilities:
Enumerate pe sections

Disassembly:
jmp 0x1400df5a0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x10], rax
mov dword [rsp], 0
mov rax, qword [rsp + 0x10]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x10]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 8], rax
jmp 0x1400df5fe
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
mov rax, qword [rsp + 8]
add rax, 0x28
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x10]
movzx eax, word [rax + 6]
cmp dword [rsp], eax
jae 0x1400df63d
mov rax, qword [rsp + 8]
mov eax, dword [rax + 0xc]
cmp qword [rsp + 0x38], rax
jb 0x1400df63b
mov rax, qword [rsp + 8]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 8]
add eax, dword [rcx + 8]
mov eax, eax
cmp qword [rsp + 0x38], rax
jae 0x1400df63b
mov rax, qword [rsp + 8]
jmp 0x1400df63f
jmp 0x1400df5e8
xor eax, eax
add rsp, 0x28
ret

Function at 0x14000347c
Capabilities:
Terminate process

Disassembly:
jmp 0x140098480
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x1400984ae
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
mov ecx, 2
call fcn.140003b3e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000417
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140003a67
Capabilities:
Enumerate processes

Disassembly:
jmp 0x1400076a0
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x448
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xaa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x468]
mov rax, qword [0x140177ec0]
xor rax, rbp
mov qword [rbp + 0x418], rax
lea rcx, [0x1401880fb]
call fcn.140003eae
nop
mov dword [rbp + 4], 0
xor edx, edx
mov ecx, 0xf
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0xffffffffffffffff
je 0x14000774d
mov dword [rbp + 0x50], 0x238
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x28]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140007742
mov eax, dword [rbp + 0x440]
cmp dword [rbp + 0x58], eax
jne 0x140007731
mov eax, dword [rbp + 0x70]
mov dword [rbp + 4], eax
jmp 0x140007742
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x28]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x14000771e
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, dword [rbp + 4]
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x1400eb170]
call fcn.14000366b
mov eax, edi
mov rcx, qword [rbp + 0x418]
xor rcx, rbp
call fcn.14000269e
lea rsp, [rbp + 0x428]
pop rdi
pop rbp
ret
Function at 0x140003b9d
Capabilities:
Print debug messages

Disassembly:
jmp 0x1400a94c0
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x140003c3d
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x140023b80
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.1400234d0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140023bc9
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x140189020]
jmp 0x140023bd8
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x48
ret

Function at 0x140003cd3
Capabilities:
Set environment variable

Disassembly:
jmp 0x1400d0770
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
lea rcx, [rsp + 0x78]
call fcn.14000218f
lea rcx, [rsp + 0x48]
call fcn.14000218f
call fcn.1400028f1
mov r8d, eax
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0xc0]
call fcn.140001fd7
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x1400d07df
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x48]
call fcn.140002437
lea rcx, [rsp + 0x78]
call fcn.140002437
mov eax, dword [rsp + 0x24]
jmp 0x1400d0870
call fcn.1400028f1
mov r8d, eax
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0xc8]
call fcn.140001fd7
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x1400d0826
mov dword [rsp + 0x2c], 0
lea rcx, [rsp + 0x48]
call fcn.140002437
lea rcx, [rsp + 0x78]
call fcn.140002437
mov eax, dword [rsp + 0x2c]
jmp 0x1400d0870
lea rcx, [rsp + 0x48]
call fcn.140002121
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x78]
call fcn.140002121
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x48]
call fcn.140002437
lea rcx, [rsp + 0x78]
call fcn.140002437
mov eax, dword [rsp + 0x30]
add rsp, 0xb8
ret

Function at 0x1400076a0
Capabilities:
Enumerate processes

Disassembly:
jmp 0x1400076a0
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x448
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xaa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x468]
mov rax, qword [0x140177ec0]
xor rax, rbp
mov qword [rbp + 0x418], rax
lea rcx, [0x1401880fb]
call fcn.140003eae
nop
mov dword [rbp + 4], 0
xor edx, edx
mov ecx, 0xf
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0xffffffffffffffff
je 0x14000774d
mov dword [rbp + 0x50], 0x238
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x28]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140007742
mov eax, dword [rbp + 0x440]
cmp dword [rbp + 0x58], eax
jne 0x140007731
mov eax, dword [rbp + 0x70]
mov dword [rbp + 4], eax
jmp 0x140007742
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x28]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x14000771e
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, dword [rbp + 4]
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x1400eb170]
call fcn.14000366b
mov eax, edi
mov rcx, qword [rbp + 0x418]
xor rcx, rbp
call fcn.14000269e
lea rsp, [rbp + 0x428]
pop rdi
pop rbp
ret
Function at 0x140023b10
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x140023b10
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.140023490
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140023b4f
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x140189020]
jmp 0x140023b59
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret
Function at 0x14009c460
Capabilities:
Get geographical location

Disassembly:
jmp 0x14009c460
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
call fcn.14009b390
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x14009c4c7
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
movabs r10, 0xe375262d7cd44270
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
call qword [0x140189030]
jmp 0x14009c4e9
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.1400022a2
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x58
ret
Function at 0x1400a94c0
Capabilities:
Print debug messages

Disassembly:
jmp 0x1400a94c0
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x1400b1850
Capabilities:
Query environment variable

Disassembly:
jmp 0x1400b1850
sub rsp, 0xb8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1400b1680
lea rcx, [rsp + 0x40]
call fcn.1400b1800
movzx eax, al
test eax, eax
jne 0x1400b1898
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call fcn.1400b16b0
mov rax, qword [rsp + 0x70]
jmp 0x1400b1a69
lea rcx, [rsp + 0x40]
call fcn.1400b17d0
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.1400b1770
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x40]
call fcn.1400b17d0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.140003305
cdqe
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x1400b193e
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x40]
call fcn.1400b16b0
mov rax, qword [rsp + 0x80]
jmp 0x1400b1a69
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, qword [rsp + 0x58]
call fcn.14000270c
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.1400025f9
lea rcx, [rsp + 0x48]
call fcn.1400022f2
movzx eax, al
test eax, eax
jne 0x1400b19a5
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x48]
call fcn.14000173a
lea rcx, [rsp + 0x40]
call fcn.1400b16b0
mov rax, qword [rsp + 0x88]
jmp 0x1400b1a69
lea rcx, [rsp + 0x48]
call fcn.140002bdf
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x40]
call fcn.1400b17d0
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call fcn.140003305
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x1400b1a3b
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x48]
call fcn.14000173a
lea rcx, [rsp + 0x40]
call fcn.1400b16b0
mov rax, qword [rsp + 0xa0]
jmp 0x1400b1a69
lea rcx, [rsp + 0x48]
call fcn.1400025d6
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x48]
call fcn.14000173a
lea rcx, [rsp + 0x40]
call fcn.1400b16b0
mov rax, qword [rsp + 0xa8]
add rsp, 0xb8
ret
Function at 0x1400b1b00
Capabilities:
Query environment variable

Disassembly:
jmp 0x1400b1b00
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.1400b1680
lea rcx, [rsp + 0x20]
call fcn.1400b16d0
movzx eax, al
test eax, eax
jne 0x1400b1b45
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x20]
call fcn.1400b16b0
mov rax, qword [rsp + 0x40]
jmp 0x1400b1c3f
lea rcx, [rsp + 0x20]
call fcn.1400b17d0
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.1400b1770
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r9d, 0x40
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, rax
call fcn.14000270c
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.1400021b2
lea rcx, [rsp + 0x28]
call fcn.1400029be
movzx eax, al
test eax, eax
jne 0x1400b1bdf
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x28]
call fcn.14000351c
lea rcx, [rsp + 0x20]
call fcn.1400b16b0
mov rax, qword [rsp + 0x50]
jmp 0x1400b1c3f
lea rcx, [rsp + 0x20]
call fcn.1400b17d0
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call fcn.140003e27
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r8, rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.1400026a3
lea rcx, [rsp + 0x28]
call fcn.14000433b
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x28]
call fcn.14000351c
lea rcx, [rsp + 0x20]
call fcn.1400b16b0
mov rax, qword [rsp + 0x68]
add rsp, 0x78
ret

Function at 0x1400b39b0
Capabilities:
Set environment variable

Disassembly:
jmp 0x1400b39b0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add rsp, 0x28
ret
Function at 0x1400c1080
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.14000187a
sub rsp, rax
mov rax, qword [0x140177ec0]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x14017a910]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x1400c1272
lea rax, [rsp + 0x147f]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x38], rax
jae 0x1400c11c6
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x1400c11c6
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
mov byte [rsp + 0x31], al
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x30], al
movsx eax, byte [rsp + 0x30]
cmp eax, 0xa
jne 0x1400c11ab
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x38]
mov byte [rax], 0xd
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, byte [rsp + 0x30]
mov byte [rax], cl
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
jmp 0x1400c1148
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400c1232
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1400c1291
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x44], eax
jae 0x1400c126d
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1400c1291
jmp 0x1400c111e
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.14000269e
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x1400c1340
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.14000187a
sub rsp, rax
mov rax, qword [0x140177ec0]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x14017a910]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x1400c154d
lea rax, [rsp + 0x147e]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x38], rax
jae 0x1400c1499
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x1400c1499
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
mov word [rsp + 0x40], ax
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x30]
cmp eax, 0xa
jne 0x1400c1479
mov eax, dword [rsp + 0x78]
add eax, 2
mov dword [rsp + 0x78], eax
mov eax, 0xd
mov rcx, qword [rsp + 0x38]
mov word [rcx], ax
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, word [rsp + 0x30]
mov word [rax], cx
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
jmp 0x1400c1408
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov eax, eax
shl rax, 1
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400c150d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1400c156c
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x48], eax
jae 0x1400c1548
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1400c156c
jmp 0x1400c13de
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.14000269e
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x1400d0770
Capabilities:
Set environment variable

Disassembly:
jmp 0x1400d0770
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
lea rcx, [rsp + 0x78]
call fcn.14000218f
lea rcx, [rsp + 0x48]
call fcn.14000218f
call fcn.1400028f1
mov r8d, eax
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0xc0]
call fcn.140001fd7
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x1400d07df
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x48]
call fcn.140002437
lea rcx, [rsp + 0x78]
call fcn.140002437
mov eax, dword [rsp + 0x24]
jmp 0x1400d0870
call fcn.1400028f1
mov r8d, eax
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0xc8]
call fcn.140001fd7
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x1400d0826
mov dword [rsp + 0x2c], 0
lea rcx, [rsp + 0x48]
call fcn.140002437
lea rcx, [rsp + 0x78]
call fcn.140002437
mov eax, dword [rsp + 0x2c]
jmp 0x1400d0870
lea rcx, [rsp + 0x48]
call fcn.140002121
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x78]
call fcn.140002121
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x48]
call fcn.140002437
lea rcx, [rsp + 0x78]
call fcn.140002437
mov eax, dword [rsp + 0x30]
add rsp, 0xb8
ret
Function at 0x1400011c0
Capabilities:
Execute command

Disassembly:
push rbp
push rsi
sub rsp, 0x58
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbp, qword [rcx + 0x10]
mov rsi, rcx
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, rbp
cmp rax, 6
jb 0x14000135f
cmp qword [rsi + 0x18], 0xf
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x50], r14
jbe 0x140001213
mov rsi, qword [rsi]
lea r14, [rbp + 6]
mov ebx, 0xf
lea rdi, [rsp + 0x28]
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rsp + 0x28], xmm0
movdqu xmmword [rsp + 0x38], xmm1
cmp r14, rbx
jbe 0x1400012b1
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x140001273
movabs rax, 0x8000000000000000
mov rbx, rcx
add rax, 0x27
mov rcx, rax
call fcn.140001790
test rax, rax
je 0x14000132d
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400012ac
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14000129b
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001365
jmp 0x140001254
test rcx, rcx
je 0x1400012aa
call fcn.140001790
mov rdi, rax
jmp 0x1400012ac
xor edi, edi
mov qword [rsp + 0x28], rdi
mov eax, dword [str.start]
lea rcx, [rdi + 6]
mov qword [rsp + 0x38], r14
mov r8, rbp
mov qword [rsp + 0x40], rbx
mov rdx, rsi
mov dword [rdi], eax
movzx eax, word [0x1400033c4]
mov word [rdi + 4], ax
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 0xf
cmova rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x140001339
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001334
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001334
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400017cc
mov rdi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x78]
mov r14, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140001770
add rsp, 0x58
pop rsi
pop rbp
ret
call fcn.1400011a0
int3
call fcn.140001100
int3

Function at 0x1400020f0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000213a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000213a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000213a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000213a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000213a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000213c
xor al, al
add rsp, 0x28
ret
Function at 0x140003800
Capabilities:
Create thread
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x10], rdx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov edi, dword [0x140473dac]
movsxd rax, dword [reloc.WS2_32.dll_accept]
xor edx, edx
cmp eax, 0x7b
ja 0x140003836
lea rdx, [0x140472530]
mov rdx, qword [rdx + rax*8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
movdqa xmm1, xmmword [0x14015cf70]
movdqu xmmword [rbp - 0x18], xmm1
mov byte [rbp - 0x28], 0
test rdx, rdx
jne 0x1400038a2
mov dword [rbp - 0x40], 0xcec6ccfb
mov dword [rbp - 0x3c], 0xe48ed9cf
mov dword [rbp - 0x38], 0x100c8d5
xor ecx, ecx
nop word [rax + rax]
lea eax, [rcx - 0x58]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xa
jb 0x140003870
mov byte [rbp - 0x35], 0
lea rax, [rbp - 0x40]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x140003892
lea rdx, [rbp - 0x40]
jmp 0x1400038ba
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x1400038b0
lea rcx, [rbp - 0x28]
call fcn.14001d0b0
cmp edi, 1
jne 0x140003929
movdqa xmm0, xmmword [0x14015d460]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x30], 0xdc
mov byte [rbp - 0x2e], dil
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x58]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x11
jb 0x1400038f0
mov byte [rbp - 0x2e], 0
lea rax, [rbp - 0x40]
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140003910
mov r8, rbx
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x28]
call fcn.14001d0b0
mov dword [rbp + 0x18], 0x42f00000
mov dword [rbp + 0x1c], 0x41a00000
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0xf
cmova rcx, qword [rbp - 0x28]
lea rdx, [rbp + 0x18]
call fcn.140054620
test al, al
je 0x140003978
test edi, edi
jne 0x140003978
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], edi
xor r9d, r9d
lea r8, [0x1400037b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x1400039b6
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400039b1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400039b1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140125de0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret