joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800c9da0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r14
sub rsp, 0x250
mov rax, qword [0x18016c040]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov eax, dword [rcx + 0x58]
lea rbx, [rsp + 0x30]
mov dword [rsp + 0x40], eax
mov ebp, r9d
mov eax, dword [rcx + 0x5c]
mov rsi, rcx
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x290]
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x3c], r8d
mov dword [rsp + 0x30], r9d
mov qword [rsp + 0x278], rdi
nop dword [rax]
mov r10d, dword [rbx + 0x14]
mov eax, r10d
mov r14d, dword [rbx + 4]
cmp r10d, r14d
mov r9d, dword [rbx + 0xc]
cmovg eax, r14d
cmp r9d, eax
jl 0x1800c9f3c
cmp r10d, r14d
mov eax, r14d
cmovg eax, r10d
cmp r9d, eax
jg 0x1800c9f3c
cmp r10d, r14d
jne 0x1800c9e40
sub rbx, 0x10
jmp 0x1800c9f84
mov edx, dword [rsi + 0x88]
xor r9d, r9d
cmp r10d, r14d
setge r9b
inc r9d
cmp edx, r9d
je 0x1800c9eb2
mov eax, dword [rsi + 4]
mov ecx, eax
mov r8d, dword [rsi + 8]
neg ecx
cmp r10d, r14d
jge 0x1800c9e74
dec eax
add eax, r10d
and eax, ecx
sub eax, r10d
jmp 0x1800c9e7c
and ecx, r10d
mov eax, r10d
sub eax, ecx
cmp eax, r8d
setge r11b
test edx, edx
je 0x1800c9e9b
movzx edx, r11b
mov rcx, rsi
call fcn.1800caf50
test al, al
jne 0x1800c9f95
movzx r8d, r11b
mov edx, r9d
mov rcx, rsi
call fcn.1800cb5c0
test al, al
jne 0x1800c9f95
mov edx, dword [rsi + 0x64]
lea r9, [0x1800cb920]
mov ecx, dword [rsi + 0x60]
mov r8, rbx
cmp r10d, r14d
jge 0x1800c9ede
mov dword [rsp + 0x28], edx
mov edx, 2
mov dword [rsp + 0x20], ecx
mov rcx, rsi
call fcn.1800c9c20
jmp 0x1800c9f32
mov eax, dword [rbx + 4]
neg ecx
movzx edi, byte [rsi + 0x6a]
neg eax
mov dword [rbx + 4], eax
neg edx
mov eax, dword [rbx + 0xc]
neg eax
mov dword [rsp + 0x28], ecx
mov dword [rbx + 0xc], eax
mov rcx, rsi
mov eax, dword [rbx + 0x14]
neg eax
mov dword [rsp + 0x20], edx
mov edx, 2
mov dword [rbx + 0x14], eax
call fcn.1800c9c20
test dil, dil
je 0x1800c9f2a
cmp byte [rsi + 0x6a], 0
jne 0x1800c9f2a
mov rdx, qword [rsi + 0x70]
mov ecx, dword [rdx + 0x20]
neg ecx
mov dword [rdx + 0x20], ecx
mov ecx, dword [rbx + 4]
neg ecx
mov dword [rbx + 4], ecx
test al, al
jne 0x1800c9f95
sub rbx, 0x10
jmp 0x1800c9f84
mov eax, dword [rbx + 8]
mov ecx, dword [rbx + 0x10]
mov dword [rbx + 0x20], ecx
add ecx, eax
mov dword [rbx + 0x24], r10d
lea edx, [rax + rbp]
mov eax, ecx
sar eax, 1
mov dword [rbx + 0x18], eax
lea eax, [rcx + rdx]
sar eax, 2
lea ecx, [r10 + r9]
mov dword [rbx + 0x10], eax
mov eax, ecx
sar edx, 1
sar eax, 1
mov dword [rbx + 8], edx
lea edx, [r14 + r9]
mov dword [rbx + 0x1c], eax
lea eax, [rcx + rdx]
sar eax, 2
sar edx, 1
mov dword [rbx + 0x14], eax
mov dword [rbx + 0xc], edx
add rbx, 0x10
lea rax, [rsp + 0x30]
cmp rbx, rax
jb 0x1800c9f99
mov ebp, dword [rbx]
jmp 0x1800c9e00
mov al, 1
jmp 0x1800c9fa2
mov dword [rsi + 0x58], ebp
xor al, al
mov dword [rsi + 0x5c], r14d
mov rdi, qword [rsp + 0x278]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.18006b340
mov rbx, qword [rsp + 0x280]
add rsp, 0x250
pop r14
pop rsi
pop rbp
ret
Function at 0x1800d02f0
Capabilities:
Get file size
Read file on windows
Read file via mapping

Disassembly:
push rbx
push rbp
sub rsp, 0x48
mov rbp, rdx
mov rbx, rcx
test rcx, rcx
jne 0x1800d030c
lea eax, [rcx + 0x28]
add rsp, 0x48
pop rbp
pop rbx
ret
mov qword [rsp + 0x68], rsi
xor r9d, r9d
mov qword [rsp + 0x40], r14
mov edx, 0x80000000
xor r14d, r14d
mov rcx, rbp
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea r8d, [r14 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1800d0360
mov r14, qword [rsp + 0x40]
lea eax, [rsi + 2]
mov rsi, qword [rsp + 0x68]
add rsp, 0x48
pop rbp
pop rbx
ret
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x78], rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1800d0485
mov rax, qword [rsp + 0x70]
cmp rax, 0x7fffffff
jg 0x1800d0485
test rax, rax
je 0x1800d0485
xor r9d, r9d
mov qword [rsp + 0x28], r14
xor edx, edx
mov dword [rsp + 0x20], r14d
mov rcx, rsi
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rdi, rax
test rax, rax
je 0x1800d0485
mov ecx, dword [rsp + 0x70]
xor r9d, r9d
mov dword [rbx + 8], ecx
xor r8d, r8d
mov rcx, rax
mov dword [rbx + 0xc], r14d
mov qword [rsp + 0x20], r14
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rcx, rdi
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rbx], r14
je 0x1800d03fa
lea rax, [0x1800d04e0]
jmp 0x1800d0453
mov rcx, qword [rbx + 0x30]
xor edx, edx
movsxd r8, dword [rbx + 8]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx], rax
test rax, rax
je 0x1800d0485
mov edi, r14d
nop dword [rax + rax]
mov r8d, dword [rbx + 8]
lea r9, [rsp + 0x60]
mov edx, edi
sub r8d, edi
add rdx, qword [rbx]
mov rcx, rsi
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1800d0473
add edi, dword [rsp + 0x60]
cmp edi, dword [rbx + 8]
jne 0x1800d0420
lea rax, [0x1800d04b0]
mov rcx, rsi
mov qword [rbx + 0x28], rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbx]
mov qword [rbx + 0x10], rax
xor eax, eax
mov qword [rbx + 0x18], rbp
mov qword [rbx + 0x20], r14
jmp 0x1800d049a
mov rcx, qword [rbx + 0x30]
xor edx, edx
mov r8, qword [rbx]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x51
mov qword [rbx], r14
mov qword [rbx + 8], r14
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x68]
mov r14, qword [rsp + 0x40]
add rsp, 0x48
pop rbp
pop rbx
ret
Function at 0x1800d1a70
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9, rdx
test rdx, rdx
jne 0x1800d1a7b
xor eax, eax
ret
lea r11, [0x1800f4310]
not ecx
cmp r8d, 8
jb 0x1800d1b51
mov r10d, r8d
shr r10, 3
nop word [rax + rax]
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
add r8d, 0xfffffff8
movzx edx, byte [r9 + 1]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 2]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 3]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 4]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 5]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 6]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 7]
add r9, 8
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r10, 1
jne 0x1800d1aa0
test r8d, r8d
je 0x1800d1b7d
nop word [rax + rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
add r8d, 0xffffffff
jne 0x1800d1b60
not ecx
mov eax, ecx
ret
Function at 0x180001140
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x180001171
xor eax, eax
lea r8, section..text
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x38
ret
Function at 0x140001000
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rcx
mov rbp, rdx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rsi, rax
movsxd r9, dword [rax + 0x3c]
lea r10, [rax + 0x18]
add r10, r9
movzx r8d, word [r9 + rax + 0x14]
movzx r11d, word [r9 + rax + 6]
add r10, r8
test r11, r11
je 0x1400010b5
xor r9d, r9d
nop word [rax + rax]
movups xmm2, xmmword [r10]
mov rdi, qword [r10 + 8]
lea rax, [rsp + 0x20]
movups xmm0, xmmword [r10 + 0x10]
mov r8, rbp
shr rdi, 0x20
movsd xmm1, qword [r10 + 0x20]
sub r8, rax
movups xmmword [rsp + 0x20], xmm2
movups xmmword [rsp + 0x30], xmm0
movsd qword [rsp + 0x40], xmm1
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1400010a5
inc rax
test ecx, ecx
jne 0x140001092
test edx, edx
je 0x1400010e6
inc r9
add r10, 0x28
cmp r9, r11
jl 0x140001060
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov rax, rbx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140001530
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
lea rax, [rsp + 0x20]
psrldq xmm2, 8
movd ecx, xmm2
mov qword [rbx], rax
lea rax, [rdi + rsi]
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rcx
jmp 0x1400010c1
Function at 0x140001110
Capabilities:
Enumerate pe sections
Terminate process

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x60
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r14, qword [rdx + 8]
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov eax, 0x5a4d
cmp word [r14], ax
je 0x140001149
xor al, al
jmp 0x140001304
mov qword [rsp + 0x90], rbp
mov rdx, r14
mov qword [rsp + 0x58], rsi
mov rsi, qword [rbx + 8]
mov qword [rsp + 0x50], r15
mov rcx, rsi
movsxd r15, dword [r14 + 0x3c]
add r15, r14
movzx r8d, word [r15 + 0x14]
lea rbp, [r15 + 0x18]
movzx edi, word [r15 + 6]
add rbp, r8
call fcn.14000fb10
mov ebx, edi
test rdi, rdi
je 0x1400011bf
nop dword [rax]
movups xmm1, xmmword [rbp + 0x10]
mov rcx, qword [rbp + 8]
shr rcx, 0x20
movq rdx, xmm1
movd r8d, xmm1
shr rdx, 0x20
add rcx, rsi
add rdx, r14
call fcn.14000fb10
lea rbp, [rbp + 0x28]
sub rbx, 1
jne 0x140001190
mov r14d, dword [r15 + 0x90]
add r14, rsi
cmp dword [r14], 0
je 0x140001248
nop
mov ecx, dword [r14 + 0xc]
add rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, dword [r14]
mov rbp, rax
mov edi, dword [r14 + 0x10]
add rbx, rsi
add rdi, rsi
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000123e
test cl, 1
je 0x140001216
mov edx, ecx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x14000122b
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rdx, [rsi + 2]
add rdx, rcx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140001262
add rbx, 8
mov qword [rdi], rax
add rdi, 8
mov rcx, qword [rbx]
test rcx, rcx
jne 0x1400011f5
add r14, 0x14
cmp dword [r14], 0
jne 0x1400011d0
test byte [r15 + 0x5e], 0x40
mov eax, dword [r15 + 0xb0]
jne 0x14000126e
mov ecx, 7
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 6
call qword [sym.imp.KERNEL32.dll_ExitProcess]
test eax, eax
jne 0x14000127e
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov r11, rsi
lea r9, [rsi + rax]
sub r11, qword [r15 + 0x30]
cmp dword [r9], 0
je 0x1400012e7
mov ebx, 0xf000
mov edi, 0xa000
nop dword [rax]
mov r10d, dword [r9 + 4]
mov edx, 0
sub r10, 8
shr r10, 1
je 0x1400012da
movzx ecx, word [r9 + rdx*2 + 8]
mov r8d, dword [r9]
mov rax, rcx
and eax, 0xfff
and cx, bx
add rax, rsi
cmp cx, di
jne 0x1400012d2
add qword [r8 + rax], r11
inc rdx
cmp rdx, r10
jb 0x1400012b2
mov eax, dword [r9 + 4]
add r9, rax
cmp dword [r9], 0
jne 0x1400012a0
mov eax, dword [r15 + 0x28]
add rax, rsi
call rax
mov rsi, qword [rsp + 0x58]
mov al, 1
mov rbp, qword [rsp + 0x90]
mov r15, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140001530
add rsp, 0x60
pop r14
pop rdi
pop rbx
ret
Function at 0x140001320
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0xc0
movaps xmmword [rax - 0x18], xmm6
lea rdx, [0x140011360]
movaps xmmword [rax - 0x28], xmm7
lea rcx, [rsp + 0x40]
movaps xmmword [rax - 0x38], xmm8
movaps xmmword [rax - 0x48], xmm9
call section..text
lea rdx, [0x140011364]
lea rcx, [rsp + 0x60]
movups xmm6, xmmword [rax]
movsd xmm7, qword [rax + 0x10]
movups xmmword [rsp + 0x20], xmm6
movsd qword [rsp + 0x30], xmm7
call section..text
mov rbx, qword [rsp + 0x30]
mov rcx, rbx
movups xmm8, xmmword [rax]
movsd xmm9, qword [rax + 0x10]
call fcn.140004990
psrldq xmm6, 8
mov r8, rbx
movq rdx, xmm6
mov rcx, rax
mov rdi, rax
call fcn.14000fb10
xor ecx, ecx
test rbx, rbx
je 0x14000143d
cmp rbx, 0x40
jb 0x14000141d
movdqa xmm2, xmmword [str.iiiiiiiiiiiiiiii]
lea rax, [rdi + 0x20]
mov rdx, rbx
and rdx, 0xffffffffffffffc0
nop dword [rax]
movdqu xmm0, xmmword [rax - 0x20]
lea rax, [rax + 0x40]
add rcx, 0x40
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rax - 0x60], xmm1
movdqa xmm1, xmm2
movdqu xmm0, xmmword [rax - 0x50]
xorps xmm0, xmm2
movdqu xmmword [rax - 0x50], xmm0
movdqu xmm0, xmmword [rax - 0x40]
xorps xmm1, xmm0
movdqu xmmword [rax - 0x40], xmm1
movdqa xmm1, xmm2
movdqu xmm0, xmmword [rax - 0x30]
xorps xmm1, xmm0
movdqu xmmword [rax - 0x30], xmm1
cmp rcx, rdx
jb 0x1400013d0
cmp rcx, rbx
jae 0x14000143d
lea rax, [rcx + rdi]
sub rbx, rcx
nop dword [rax]
xor byte [rax], 0x69
lea rax, [rax + 1]
sub rbx, 1
jne 0x140001430
mov qword [rsp + 0x28], rdi
lea rdx, [rsp + 0x20]
movups xmm0, xmmword [rsp + 0x20]
lea rcx, [rsp + 0x40]
movsd qword [rsp + 0x30], xmm7
movaps xmmword [rsp + 0x20], xmm0
movaps xmmword [rsp + 0x40], xmm8
movsd qword [rsp + 0x50], xmm9
call fcn.140001110
lea rcx, str.pause
call fcn.140004998
lea r11, [rsp + 0xc0]
xor eax, eax
mov rbx, qword [r11 + 0x10]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
mov rsp, r11
pop rdi
ret

Function at 0x140001df8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001e42
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001e42
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001e42
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001e42
cmp dword [rcx + 0x84], 0xe
jbe 0x140001e42
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001e44
xor al, al
add rsp, 0x28
ret
Function at 0x14000555c
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1400055cb
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400055cb
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400055cb
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400055cb
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400055cb
cmp dword [rcx + 0x84], 0xe
jbe 0x1400055cb
cmp dword [rcx + 0xf8], 0
je 0x1400055cb
mov ecx, ebx
call fcn.140005670
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140005464
nop
cmp dword [rbp + 0x20], 0
jne 0x14000562c
call fcn.140009c18
cmp eax, 1
jne 0x14000561c
xor dl, dl
jmp 0x140005626
call fcn.140009be4
test al, al
sete dl
cmp dword [rbp + 0x20], 0
je 0x140005637
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140005640
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x14000555c

Function at 0x140005744
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14000555c
Function at 0x1400095d4
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140009604
xor eax, eax
jmp 0x1400096c7
mov rbp, rbx
cmp word [rax], si
je 0x140009629
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140009610
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14000960c
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1400094f4
movsxd r14, eax
mov rcx, r14
test eax, eax
jne 0x14000966a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1400095fd
call fcn.1400060b0
mov rdi, rax
test rax, rax
jne 0x140009680
xor ecx, ecx
call fcn.140006660
jmp 0x14000965f
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1400094f4
test eax, eax
jne 0x1400096b1
mov rcx, rdi
call fcn.140006660
jmp 0x1400096bb
xor ecx, ecx
call fcn.140006660
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14000d7a4
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.140007580
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14000d82e
cmp byte [rbp - 0x21], r15b
je 0x14000d829
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x14000d864
call fcn.14000aca0
test eax, eax
jne 0x14000d850
cmp byte [rbp - 0x21], r15b
je 0x14000d848
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x14000d864
cmp byte [rbp - 0x21], r15b
je 0x14000d861
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.1400073e0
test eax, eax
jne 0x14000d904
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.140007580
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14000d8a3
cmp byte [rbp - 0x21], r15b
je 0x14000d8d8
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x14000d8d8
call fcn.14000aca0
test eax, eax
jne 0x14000d8c4
cmp byte [rbp - 0x21], r15b
je 0x14000d8bd
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x14000d8d8
cmp byte [rbp - 0x21], r15b
je 0x14000d8d5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.1400073e0
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x14000d904
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14000d907
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x14000d915
mov rcx, rdi
call fcn.140006660
cmp byte [rbp + 0x3f], r15b
je 0x14000d924
mov rcx, qword [rbp + 0x27]
call fcn.140006660
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14000f730
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14000f758
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14000f758
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140002990
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140008040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x1400029bd
xor eax, eax
jmp 0x140002b29
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x1400029f7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x1400029f7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140002b29
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140002b1c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140002a3a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140002a65
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002b21
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140002ad4
sub eax, 1
je 0x140002ad4
cmp eax, 2
jne 0x140002b1c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002b21
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140002b02
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140002b1c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140002b21
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140003b50
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140002e50
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140008040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140002f23
cmp byte [rcx + 0x71], 0
je 0x140002f23
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140002f1f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140002ee4
sub eax, 1
je 0x140002ee8
cmp eax, 2
jne 0x140002f1f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140003b50
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140002f16
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140002f1f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140002ecc
xor al, al
jmp 0x140002ecc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140003b50
add rsp, 0x60
pop rbx
ret