joyce8/EMBER2024-capa huggingface dataset:
Function at 0x550a70
Capabilities:
Encode data using base64

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x550c23
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rax, qword [rsp + 0x60]
lea rdx, [rax + 7]
sar rdx, 0x3f
shr rdx, 0x3d
lea rdx, [rdx + rax + 7]
sar rdx, 3
mov rbx, qword [rsp + 0x50]
cmp rdx, rbx
jg 0x550bc2
test rdx, rdx
jl 0x550c1c
mov rcx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
mov r8, rax
xor r9d, r9d
jmp 0x550af0
bswap rax
mov qword [rcx + r9*8], rax
inc r9
mov rdi, r11
mov rax, r10
cmp rax, 8
jl 0x550b2e
cmp rax, rdi
ja 0x550c15
lea r10, [rax - 8]
sub rax, r10
mov r11, rdi
sub rdi, r10
neg rdi
sar rdi, 0x3f
and rdi, r10
cmp rax, 7
jbe 0x550c0e
mov rax, qword [rsi + rdi]
cmp r9, rdx
jb 0x550ae0
jmp 0x550c07
test rax, rax
jle 0x550b84
xor edi, edi
xor r9d, r9d
jmp 0x550b63
lea r11, [rdi + 8]
movzx r12d, byte [rax + rsi - 1]
mov rax, rcx
mov rcx, rdi
shl r12, cl
cmp rcx, 0x40
sbb r13, r13
and r12, r13
or r9, r12
mov rcx, rax
mov rax, r10
mov rdi, r11
test rax, rax
jle 0x550b76
lea r10, [rax - 1]
cmp r10, r8
jb 0x550b3a
jmp 0x550c00
lea rax, [rdx - 1]
cmp rax, rdx
jae 0x550bf9
mov qword [rcx + rdx*8 - 8], r9
mov qword [rsp], rcx
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rbx
call fcn.00547440
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x80], rdx
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x007b2200]
mov qword [rsp], rax
mov qword [rsp + 8], rdx
lea rax, [rdx + 4]
mov qword [rsp + 0x10], rax
call fcn.004403a0
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x60]
jmp 0x550ace
call fcn.0042bed0
ud2
call fcn.0042bed0
ud2
call fcn.0042bed0
ud2
call fcn.0042bed0
ud2
call fcn.0042c000
ud2
call fcn.0042c000
ud2
call fcn.004559e0
jmp fcn.00550a70
Function at 0x583860
Capabilities:
Encrypt data using des

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x58399c
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
xor eax, eax
jmp 0x58397c
mov rbx, qword [rsp + 0x28]
mov r8, rbx
shl rbx, 8
lea r9, [0x00bad9c0]
add rbx, r9
mov dword [rbx + rdx*4], eax
lea rdx, [rdi + 1]
mov rax, r8
mov rcx, rsi
cmp rdx, 0x10
jge 0x583964
mov qword [rsp + 0x30], rdx
mov rbx, rax
shl rax, 6
shl rcx, 4
lea rdi, [0x00b59be0]
add rax, rdi
add rax, rcx
movzx eax, byte [rax + rdx]
lea rcx, [rbx - 7]
neg rcx
shl rcx, 2
shl rax, cl
cmp rcx, 0x40
sbb r8, r8
and rax, r8
mov qword [rsp], rax
lea rax, [0x00b52100]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x20
mov qword [rsp + 0x18], 0x20
call fcn.00583800
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov rbx, rdx
and rdx, 2
shl rdx, 4
mov rsi, rbx
and rbx, 1
or rdx, rbx
mov rbx, qword [rsp + 0x30]
mov rdi, rbx
shl rbx, 1
or edx, ebx
mov rbx, rax
shl rax, 1
shr rbx, 0x1f
or rax, rbx
movzx edx, dl
cmp rdx, 0x40
jb 0x58388f
jmp 0x583995
inc rcx
cmp rcx, 4
jge 0x583979
mov qword [rsp + 0x38], rcx
xor edx, edx
jmp 0x5838b2
inc rax
cmp rax, 8
jge 0x58398b
mov qword [rsp + 0x28], rax
xor ecx, ecx
jmp 0x583967
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
call fcn.0042bed0
ud2
call fcn.004559e0
jmp fcn.00583860
Function at 0x597550
Capabilities:
Parse credit card information

Disassembly:
movzx eax, byte [rsp + 8]
lea ecx, [rax - 0x41]
cmp cl, 0x19
ja 0x597563
mov byte [rsp + 0x18], 0
ret
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x59755d
lea ecx, [rax - 0x30]
cmp cl, 9
jbe 0x59755d
mov rcx, qword [rsp + 0x10]
cmp rcx, 3
jne 0x5976ef
cmp al, 0x2c
ja 0x5976ce
lea edx, [rax - 0x21]
cmp dl, 1
ja 0x597598
mov byte [rsp + 0x18], 0
ret
cmp al, 0x24
je 0x597592
lea edx, [rax - 0x26]
cmp dl, 6
jbe 0x597592
cmp al, 0x2f
ja 0x597698
cmp al, 0x26
ja 0x597671
cmp al, 0x24
jne 0x597667
cmp rcx, 2
jg 0x59761e
cmp rcx, 1
je 0x597616
cmp rcx, 2
jne 0x5975f9
cmp al, 0x2f
jne 0x5975dc
mov eax, 1
mov byte [rsp + 0x18], al
ret
cmp al, 0x3b
jne 0x5975e7
mov eax, 1
jmp 0x5975d7
cmp al, 0x2c
jne 0x5975f2
mov eax, 1
jmp 0x5975d7
cmp al, 0x3f
sete al
jmp 0x5975d7
cmp rcx, 7
jne 0x597610
cmp al, 0x21
jne 0x597609
mov byte [rsp + 0x18], 0
ret
add eax, 0xffffffd8
cmp al, 2
jbe 0x597603
mov byte [rsp + 0x18], 1
ret
cmp al, 0x3f
sete byte [rsp + 0x18]
ret
cmp rcx, 5
jne 0x59764f
cmp al, 0x40
jne 0x597632
mov eax, 1
mov byte [rsp + 0x18], al
ret
cmp al, 0x2f
jne 0x59763d
mov eax, 1
jmp 0x59762d
cmp al, 0x3f
jne 0x597648
mov eax, 1
jmp 0x59762d
cmp al, 0x3a
sete al
jmp 0x59762d
cmp rcx, 6
je 0x597661
cmp rcx, 7
jne 0x5975f9
mov byte [rsp + 0x18], 0
ret
mov byte [rsp + 0x18], 1
ret
cmp al, 0x26
je 0x5975bc
jmp 0x5975f9
lea edx, [rax - 0x2b]
cmp dl, 1
jbe 0x5975bc
lea edx, [rax - 0x2d]
cmp dl, 1
ja 0x59768b
mov byte [rsp + 0x18], 0
ret
cmp al, 0x2f
je 0x5975bc
jmp 0x5975f9
cmp al, 0x3d
ja 0x5976b5
lea edx, [rax - 0x3a]
cmp dl, 1
jbe 0x5975bc
cmp al, 0x3d
je 0x5975bc
jmp 0x5975f9
lea edx, [rax - 0x3f]
cmp dl, 1
jbe 0x5975bc
cmp al, 0x5f
je 0x597685
cmp al, 0x7e
je 0x597685
jmp 0x5975f9
lea edx, [rax - 0x3a]
cmp dl, 4
jbe 0x597592
cmp al, 0x5b
je 0x597592
cmp al, 0x5d
je 0x597592
jmp 0x5975a4
cmp rcx, 4
je 0x597582
jmp 0x5975a4
Function at 0x6843c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x6844eb
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
xor edi, edi
xor r8d, r8d
jmp 0x684410
add rdi, 2
lea r8d, [r9 + 1]
cmp rdi, rax
jge 0x684488
lea r9, [rdi + 1]
cmp r9, rax
jae 0x6844e4
mov r9d, dword [rcx + rdi*4 + 4]
cmp rdi, rax
jae 0x6844e4
mov r10d, dword [rcx + rdi*4]
dec r10d
cmp r8d, r10d
jg 0x684408
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x3c], r9d
mov qword [rsp], rbx
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x1c], r10d
call fcn.00683df0
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x40]
mov r9d, dword [rsp + 0x3c]
jmp 0x684408
cmp r8d, 0x10ffff
jle 0x6844b3
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x98], rdx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp], rbx
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x1c], 0x10ffff
call fcn.00683df0
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
jmp 0x684491
call fcn.0042bed0
ud2
call fcn.004559e0
jmp fcn.006843c0
Function at 0x684500
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x684766
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
test rdx, rdx
jle 0x684749
mov qword [rsp + 0x58], rdx
mov rbx, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x90]
xor r8d, r8d
jmp 0x6845cd
mov dword [rsp + 0x3c], r9d
mov qword [rsp], rbx
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdi
mov dword [rsp + 0x18], r9d
mov dword [rsp + 0x1c], r9d
call fcn.00683df0
mov eax, dword [rsp + 0x3c]
mov r11d, dword [rsp + 0x4c]
lea r9d, [r11 + rax]
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x50]
mov r10d, dword [rsp + 0x48]
cmp r9d, r10d
jle 0x684562
inc r8
cmp r8, rdx
jge 0x6845fb
add rcx, 6
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x50], r8
movzx r9d, word [rcx]
movzx r10d, word [rcx + 2]
movzx r11d, word [rcx + 4]
cmp r11d, 1
je 0x684701
mov dword [rsp + 0x4c], r11d
mov dword [rsp + 0x48], r10d
jmp 0x6845bc
mov rcx, qword [rax + 0x18]
mov rax, qword [rax + 0x20]
test rax, rax
jle 0x68469f
mov qword [rsp + 0x58], rax
xor edx, edx
jmp 0x684678
mov dword [rsp + 0x38], r8d
mov qword [rsp], rbx
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdi
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x1c], r8d
call fcn.00683df0
mov eax, dword [rsp + 0x38]
mov r9d, dword [rsp + 0x44]
lea r8d, [r9 + rax]
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x50]
mov r10d, dword [rsp + 0x40]
cmp r8d, r10d
jle 0x684615
inc rdx
cmp rdx, rax
jge 0x68469f
add rcx, 0xc
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x50], rdx
mov r8d, dword [rcx]
mov r9d, dword [rcx + 8]
mov r10d, dword [rcx + 4]
cmp r9d, 1
je 0x6846c1
mov dword [rsp + 0x44], r9d
mov dword [rsp + 0x40], r10d
jmp 0x684667
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], rsi
mov qword [rsp + 0xb0], rdi
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov qword [rsp], rbx
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdi
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x1c], r10d
call fcn.00683df0
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x50]
jmp 0x68466c
mov qword [rsp], rbx
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdi
mov dword [rsp + 0x18], r9d
mov dword [rsp + 0x1c], r10d
call fcn.00683df0
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x50]
jmp 0x6845c1
mov rdi, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x88]
jmp 0x6845fb
call fcn.004559e0
jmp fcn.00684500
Function at 0x6c5a80
Capabilities:
Encode data using base64

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x6c5bb3
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
lea rax, [0x007b2b40]
mov qword [rsp], rax
mov qword [rsp + 8], 4
mov qword [rsp + 0x10], 4
call fcn.004403a0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x58]
xor esi, esi
jmp 0x6c5b24
movzx r8d, byte [rax + rsi]
mov r9, rsi
shl rsi, 3
mov r10, rdi
sub rdi, rsi
add rdi, 0xfffffffffffffff9
neg rdi
mov rsi, rcx
mov rcx, rdi
mov r11d, 1
shl r11d, cl
cmp rcx, 0x20
sbb edi, edi
and r11d, edi
or r8d, r11d
mov byte [rax + r9], r8b
lea rdi, [r10 + 1]
mov rcx, rsi
mov rsi, rdi
cmp rsi, rbx
jge 0x6c5b42
mov rdi, rsi
sar rsi, 0x3f
shr rsi, 0x3d
add rsi, rdi
sar rsi, 3
cmp rsi, rdx
jb 0x6c5ae2
jmp 0x6c5bac
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rdx
lea rax, [0x007fd040]
mov qword [rsp], rax
call fcn.0040c3b0
mov rdi, qword [rsp + 8]
mov rax, qword [rsp + 0x30]
mov qword [rdi + 8], rax
mov rax, qword [rsp + 0x38]
mov qword [rdi + 0x10], rax
cmp dword [0x00bac390], 0
jne 0x6c5ba0
mov rax, qword [rsp + 0x40]
mov qword [rdi], rax
mov qword [rdi + 0x18], 4
mov qword [rsp + 0x60], rdi
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rax, qword [rsp + 0x40]
call fcn.00457880
jmp 0x6c5b89
call fcn.0042bed0
ud2
call fcn.004559e0
jmp fcn.006c5a80

Function at 0x6c5bc0
Capabilities:
Encode data using base64

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x6c5cf3
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
lea rax, [0x007b2b40]
mov qword [rsp], rax
mov qword [rsp + 8], 0x10
mov qword [rsp + 0x10], 0x10
call fcn.004403a0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x58]
xor esi, esi
jmp 0x6c5c64
movzx r8d, byte [rax + rsi]
mov r9, rsi
shl rsi, 3
mov r10, rdi
sub rdi, rsi
add rdi, 0xfffffffffffffff9
neg rdi
mov rsi, rcx
mov rcx, rdi
mov r11d, 1
shl r11d, cl
cmp rcx, 0x20
sbb edi, edi
and r11d, edi
or r8d, r11d
mov byte [rax + r9], r8b
lea rdi, [r10 + 1]
mov rcx, rsi
mov rsi, rdi
cmp rsi, rbx
jge 0x6c5c82
mov rdi, rsi
sar rsi, 0x3f
shr rsi, 0x3d
add rsi, rdi
sar rsi, 3
cmp rsi, rdx
jb 0x6c5c22
jmp 0x6c5cec
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rdx
lea rax, [0x007fd040]
mov qword [rsp], rax
call fcn.0040c3b0
mov rdi, qword [rsp + 8]
mov rax, qword [rsp + 0x30]
mov qword [rdi + 8], rax
mov rax, qword [rsp + 0x38]
mov qword [rdi + 0x10], rax
cmp dword [0x00bac390], 0
jne 0x6c5ce0
mov rax, qword [rsp + 0x40]
mov qword [rdi], rax
mov qword [rdi + 0x18], 6
mov qword [rsp + 0x60], rdi
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rax, qword [rsp + 0x40]
call fcn.00457880
jmp 0x6c5cc9
call fcn.0042bed0
ud2
call fcn.004559e0
jmp fcn.006c5bc0
Function at 0x140006018
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
call sub.KERNEL32.dll_GetLastError
mov qword [rsp + 0x38], rax
mov rcx, qword [0x14001f1c0]
call sub.KERNEL32.dll_TlsGetValue
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret

Function at 0x1400071f8
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.140007188
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x1400211f0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140020628]
jmp 0x140007234
cmp qword [rbx + 0x18], rdi
je 0x14000723b
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14000722b
jmp 0x140007255
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x140020628]
call fcn.140011fd8
lea rcx, [0x1400211f0]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop rbp
imul ebp, dword [rcx], 0xe91c4df8
in al, 0xf9
std
invalid
sbb ah, byte [rcx + 0x26845835]
cmp ch, byte [rbp - 0x22491f7d]
xchg ecx, eax
sub eax, 0x2bde6b9b
xchg ecx, eax
imul ecx, dword fs:[rdi - 0x1f4fbe32], 0x74dbc8e4
outsd dx, dword [rsi]
mov ecx, 0xe1b4ce2c
rcl dword [rsi]
pop rdi
or dword [rbx + 0x4e], esp
push si
xchg dword fs:[rdi], eax
ret
add eax, 0x4ef83a6e
mov byte [rax - 0x26ecdbfc], cl
jnp 0x14003f61d
retf
ret 0xc395
or eax, 0xdfb1770c
jb 0x14003f645
cmovnp edi, dword [rdi]
sbb dword [rsi + 0x4b4dd882], ecx
std
in eax, dx
jb 0x14003f6cb
sal dword [rsi + riz*4], 1
cmpsb byte [rsi], byte [rdi]
invalid
fiadd dword [rdi - 0x2d]
hlt
cli
add eax, 0xd72725b3
invalid
mov r9b, 0xf1
movsb byte [rdi], byte [rsi]
mov edi, 0x2d9cc33f
sub eax, 0x182d78b0
invalid
std
and dword ds:[rbp + 0x70736400], 0x4212f3d0
xor dword [rbx + 0x106f1345], edx
outsd dx, dword [rsi]
adc byte [rbp - 0x42], cl
invalid
fnstcw word [rbx]
xchg byte [r8 - 0x75], r12b
mov edx, edx
sub eax, 0x182d78b0
invalid
outsd dx, dword [rsi]
adc byte [rbp - 0x42], cl
invalid
Function at 0x140001570
Capabilities:
Access peb ldr_data
Encode data using xor
Encrypt data using rc4 prga
Get ntdll base address
Resolve function by parsing pe exports

Disassembly:
push r12
sub rsp, 0x20
cmp dword [0x140023cc0], 0
jne 0x1400017a8
mov rax, qword gs:[0x60]
xor r12d, r12d
mov edx, r12d
mov rcx, qword [rax + 0x18]
mov r8, qword [rcx + 0x10]
mov rax, qword [r8 + 0x30]
test rax, rax
je 0x1400017b4
nop word [rax + rax]
mov r11, rax
movsxd rax, dword [rax + 0x3c]
mov ecx, dword [rax + r11 + 0x88]
test ecx, ecx
je 0x1400015ed
lea rdx, [r11 + rcx]
mov ecx, dword [r11 + rcx + 0xc]
mov eax, dword [rcx + r11]
or eax, 0x20202020
cmp eax, 0x6c64746e
jne 0x1400015ed
mov eax, dword [rcx + r11 + 4]
or eax, 0x20202020
cmp eax, 0x6c642e6c
je 0x1400015f9
mov r8, qword [r8]
mov rax, qword [r8 + 0x30]
test rax, rax
jne 0x1400015b0
test rdx, rdx
je 0x1400017b4
mov qword [rsp + 0x30], rbx
mov r8d, r12d
mov ebx, dword [rdx + 0x18]
mov qword [rsp + 0x38], rbp
mov ebp, dword [rdx + 0x24]
mov qword [rsp + 0x40], rsi
mov esi, dword [rdx + 0x20]
mov qword [rsp + 0x18], rdi
add rsi, r11
mov qword [rsp + 0x10], r13
mov r13d, 0x775a
mov qword [rsp + 8], r14
mov r14d, dword [rdx + 0x1c]
add r14, r11
mov qword [rsp], r15
add rbp, r11
lea r15, [0x140023cc0]
nop word [rax + rax]
lea eax, [rbx - 1]
mov r10d, dword [rsi + rax*4]
mov ebx, eax
add r10, r11
mov edi, eax
cmp word [r10], r13w
jne 0x1400016bb
mov r9d, r12d
mov edx, 0x867543ac
mov rax, r10
nop
movzx eax, word [rax]
mov ecx, edx
ror ecx, 8
inc r9d
add ecx, eax
mov eax, r9d
add rax, r10
xor edx, ecx
cmp byte [rax], r12b
jne 0x140001670
mov eax, r8d
inc r8d
lea rcx, [rax + rax*2]
mov dword [r15 + rcx*8 + 8], edx
mov byte [r15 + rcx*8 + 0x18], 1
movzx eax, word [rbp + rdi*2]
mov eax, dword [r14 + rax*4]
mov dword [r15 + rcx*8 + 0x1c], eax
mov qword [r15 + rcx*8 + 0x10], r12
cmp r8d, 0x1f4
je 0x1400016bf
test ebx, ebx
jne 0x140001650
mov r14, qword [rsp + 8]
lea eax, [r8 - 1]
mov r13, qword [rsp + 0x10]
mov r9d, r12d
mov rbp, qword [rsp + 0x38]
mov dword [0x140023cc0], r8d
test eax, eax
je 0x140001795
mov ecx, r8d
mov eax, r12d
sub ecx, r9d
cmp ecx, 1
je 0x140001785
lea r10d, [rax + 1]
mov ecx, eax
lea rdx, [r10 + r10*2]
lea r11, [rdx*8]
mov edi, dword [r11 + r15 + 0x1c]
lea rax, [rcx + rcx*2]
lea rbx, [rax*8]
mov esi, dword [rbx + r15 + 0x1c]
cmp esi, edi
jbe 0x140001771
mov eax, dword [r11 + r15 + 8]
mov r8d, dword [rbx + r15 + 8]
movzx edx, byte [rbx + r15 + 0x18]
mov rcx, qword [rbx + r15 + 0x10]
mov dword [rbx + r15 + 8], eax
movzx eax, byte [r11 + r15 + 0x18]
mov byte [rbx + r15 + 0x18], al
mov rax, qword [r11 + r15 + 0x10]
mov qword [rbx + r15 + 0x10], rax
mov dword [rbx + r15 + 0x1c], edi
mov dword [r11 + r15 + 8], r8d
mov byte [r11 + r15 + 0x18], dl
mov dword [r11 + r15 + 0x1c], esi
mov qword [r11 + r15 + 0x10], rcx
mov r8d, dword [0x140023cc0]
mov ecx, r8d
mov eax, r10d
sub ecx, r9d
dec ecx
cmp r10d, ecx
jb 0x1400016f6
inc r9d
lea eax, [r8 - 1]
cmp r9d, eax
jb 0x1400016e4
mov rdi, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
mov r15, qword [rsp]
mov eax, 1
add rsp, 0x20
pop r12
ret
xor eax, eax
add rsp, 0x20
pop r12
ret
Function at 0x140001810
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x30
add rsp, 8
mov ecx, 0xd1759cb
call fcn.1400017c0
mov r11, rax
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
sub r11, 8
syscall
ret

Function at 0x1400021dc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002226
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002226
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002226
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002226
cmp dword [rcx + 0x84], 0xe
jbe 0x140002226
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002228
xor al, al
add rsp, 0x28
ret

Function at 0x140005cb8
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140005b23
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140005b23
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140005b23
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140005b23
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140005b23
cmp dword [rcx + 0x84], 0xe
jbe 0x140005b23
cmp dword [rcx + 0xf8], 0
je 0x140005b23
mov ecx, ebx
call fcn.140005bd4
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1400059b0
nop
cmp dword [rbp + 0x20], 0
je 0x140005b71
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140005b7c
int3
xor r8d, r8d
xor edx, edx
jmp 0x140005ab4
Function at 0x14000ee5c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14000ee8c
xor eax, eax
jmp 0x14000ef4f
mov rbp, rbx
cmp word [rax], si
je 0x14000eeb1
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14000ee98
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14000ee94
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14000ed7c
movsxd r14, eax
test eax, eax
jne 0x14000eeef
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14000ee85
mov rcx, r14
call fcn.14000c8d0
mov rdi, rax
test rax, rax
jne 0x14000ef08
xor ecx, ecx
call fcn.14000b5ec
jmp 0x14000eee4
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14000ed7c
test eax, eax
jne 0x14000ef39
mov rcx, rdi
call fcn.14000b5ec
jmp 0x14000ef43
xor ecx, ecx
call fcn.14000b5ec
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140013750
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.14000612c
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x1400137da
cmp byte [rbp - 0x21], r15b
je 0x1400137d5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x140013810
call fcn.14000cbd4
test eax, eax
jne 0x1400137fc
cmp byte [rbp - 0x21], r15b
je 0x1400137f4
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x140013810
cmp byte [rbp - 0x21], r15b
je 0x14001380d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.140005fb0
test eax, eax
jne 0x1400138b0
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.14000612c
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14001384f
cmp byte [rbp - 0x21], r15b
je 0x140013884
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140013884
call fcn.14000cbd4
test eax, eax
jne 0x140013870
cmp byte [rbp - 0x21], r15b
je 0x140013869
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x140013884
cmp byte [rbp - 0x21], r15b
je 0x140013881
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.140005fb0
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x1400138b0
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x1400138b3
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x1400138c1
mov rcx, rdi
call fcn.14000b5ec
cmp byte [rbp + 0x3f], r15b
je 0x1400138d0
mov rcx, qword [rbp + 0x27]
call fcn.14000b5ec
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret