joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140007750
Capabilities:
Check if file exists
Read .ini file

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x140032030]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x38]
call fcn.140007310
nop
lea rdx, [0x14002e2a8]
lea rcx, [rsp + 0x38]
call fcn.140007aa0
lea rdx, [0x14002e2c0]
lea rcx, [rsp + 0x38]
call fcn.140007aa0
lea rdx, [0x14002e2f0]
lea rcx, [rsp + 0x38]
call fcn.140007aa0
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rcx, qword [rsp + 0x38]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x140007880
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x140007825
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007820
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400079c2
call fcn.14000acfc
xor edi, edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], 7
mov word [rsp + 0x38], di
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x140007879
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140007874
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400079c8
mov rcx, r8
call fcn.14000acfc
xor al, al
jmp 0x14000798f
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x60]
call fcn.14000d090
lea rax, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rax, qword [rsp + 0x38]
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x1400078b0
mov rdx, qword [rbx]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x100
lea r9, [rsp + 0x60]
lea r8, [0x14002e310]
lea rcx, [0x14002e320]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rax, [rsp + 0x60]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x1400078e2
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.140001b10
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x14000793d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007938
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400079c2
call fcn.14000acfc
xor edi, edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], 7
mov word [rsp + 0x38], di
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x14000798d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140007988
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400079c8
mov rcx, r8
call fcn.14000acfc
mov al, 1
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 7
mov word [rbx], di
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.14000aa50
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.140010f38
nop
call fcn.140010f38
int3

Function at 0x140016780
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140016570
Function at 0x14001b804
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14001b88b
mov rsi, rbx
cmp word [rax], bp
je 0x14001b84a
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14001b834
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14001b830
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140017ef8
mov rdi, rax
test rax, rax
je 0x14001b878
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14000c9e0
mov rbp, rdi
xor ecx, ecx
call fcn.140017ebc
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x405778
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x03529000]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.004014c4
xor ebx, ebx
cmp qword [0x0352b928], rbx
mov rdi, rax
jne 0x40588b
lea rcx, str.USER32.DLL
call qword [sym.imp.kernel32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x405962
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x405962
mov rcx, rax
call qword [sym.imp.kernel32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x0352b928], rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.kernel32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x0352b930], rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.kernel32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x0352b938], rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.kernel32.dll_EncodePointer]
mov r11, rax
mov qword [0x0352b948], rax
test rax, rax
je 0x405882
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.kernel32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.kernel32.dll_EncodePointer]
mov qword [0x0352b940], rax
jmp 0x405892
mov rax, qword [0x0352b940]
jmp 0x405899
mov rax, qword [0x0352b940]
mov r11, qword [0x0352b948]
cmp rax, rdi
je 0x405900
cmp r11, rdi
je 0x405900
mov rcx, rax
call qword [sym.imp.kernel32.dll_DecodePointer]
mov rcx, qword [0x0352b948]
mov rsi, rax
call qword [sym.imp.kernel32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x405900
test rax, rax
je 0x405900
call rsi
test rax, rax
je 0x4058fa
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x4058fa
test byte [rsp + 0x40], 1
jne 0x405900
bts ebp, 0x15
jmp 0x405940
mov rcx, qword [0x0352b930]
cmp rcx, rdi
je 0x405940
call qword [sym.imp.kernel32.dll_DecodePointer]
test rax, rax
je 0x405940
call rax
mov rbx, rax
test rax, rax
je 0x405940
mov rcx, qword [0x0352b938]
cmp rcx, rdi
je 0x405940
call qword [sym.imp.kernel32.dll_DecodePointer]
test rax, rax
je 0x405940
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x0352b928]
call qword [sym.imp.kernel32.dll_DecodePointer]
test rax, rax
je 0x405962
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x405964
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.00405384
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x405cab
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x03529000]
jne 0x40539e
rol rcx, 0x10
test cx, 0xffff
jne 0x40539a
repz ret
ror rcx, 0x10
jmp 0x405c04
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x0352b9f0]
call qword [sym.imp.kernel32.dll_RtlCaptureContext]
mov rax, qword [0x0352bae8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.kernel32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x405c89
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x0352b9f0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.kernel32.dll_RtlVirtualUnwind
jmp 0x405cab
mov rax, qword [rsp + 0x88]
mov qword [0x0352bae8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x0352ba88], rax
mov rax, qword [0x0352bae8]
mov qword [0x0352b960], rax
mov rax, qword [rsp + 0x90]
mov qword [0x0352ba70], rax
mov dword [0x0352b950], 0xc0000409
mov dword [0x0352b954], 1
mov rax, qword [0x03529000]
mov qword [rsp + 0x68], rax
mov rax, qword [0x03529008]
mov qword [rsp + 0x70], rax
call qword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x0352b9e8], eax
mov ecx, 1
call fcn.00405764
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x0352a948]
call qword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x0352b9e8], 0
jne 0x405d32
mov ecx, 1
call fcn.00405764
call qword [sym.imp.kernel32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.kernel32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x1407b2058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1407b21df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1407b2089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407b206f
add dl, dl
jne 0x1407b2096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407b20f6
xor eax, eax
add dl, dl
jne 0x1407b20a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407b21ad
add dl, dl
jne 0x1407b20b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407b20c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407b20d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407b20dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1407b20ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1407b207e
mov eax, 1
add dl, dl
jne 0x1407b2106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407b2113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407b20fb
sub eax, ebx
mov ebx, 1
jne 0x1407b214c
mov ecx, 1
add dl, dl
jne 0x1407b212e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1407b213b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407b2123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407b207e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1407b2168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1407b2175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407b215d
cmp eax, 0x7d00
jae 0x1407b219b
cmp eax, 0x500
jb 0x1407b2196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407b207e
cmp eax, 0x7f
ja 0x1407b219e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407b207e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1407b21d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1407b207e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14000410c
Capabilities:
Get storage device properties

Disassembly:
push rdi
mov eax, 0x2980
call fcn.140007690
sub rsp, rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 3
mov edx, 0x80000000
lea rcx, str..PhysicalDrive0
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0xffffffffffffffff
jne 0x140004185
lea rdx, str.Failed_to_open_device.
lea rcx, [0x140037520]
call fcn.140001350
lea rdx, [0x1400026c8]
mov rcx, rax
call fcn.140003acc
xor al, al
jmp 0x140004379
mov r8d, 0xc
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.1400243e0
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x54], 0
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x2710
lea rax, [rsp + 0x270]
mov qword [rsp + 0x20], rax
mov r9d, 0xc
lea r8, [rsp + 0x50]
mov edx, 0x2d1400
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x14000433b
lea rax, [rsp + 0x270]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, pe_nt_image_headers64
rep stosb byte [rdi], al
lea rax, [rsp + 0x170]
mov rdi, rax
xor eax, eax
mov ecx, pe_nt_image_headers64
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x48]
cmp dword [rax + 0xc], 0
je 0x140004252
mov rax, qword [rsp + 0x48]
mov eax, dword [rax + 0xc]
lea rax, [rsp + rax + 0x270]
mov r8, rax
mov edx, pe_nt_image_headers64
lea rcx, [rsp + 0x70]
call fcn.14000ff44
nop
mov rax, qword [rsp + 0x48]
cmp dword [rax + 0x10], 0
je 0x140004283
mov rax, qword [rsp + 0x48]
mov eax, dword [rax + 0x10]
lea rax, [rsp + rax + 0x270]
mov r8, rax
mov edx, pe_nt_image_headers64
lea rcx, [rsp + 0x170]
call fcn.14000ff44
nop
lea rdx, str.Vendor_ID:
lea rcx, [0x1400373f0]
call fcn.140001350
lea rdx, [rsp + 0x70]
mov rcx, rax
call fcn.140001350
lea rdx, [0x1400026c8]
mov rcx, rax
call fcn.140003acc
lea rdx, str.Product_ID:
lea rcx, [0x1400373f0]
call fcn.140001350
lea rdx, [rsp + 0x170]
mov rcx, rax
call fcn.140001350
lea rdx, [0x1400026c8]
mov rcx, rax
call fcn.140003acc
nop
lea rdx, str.VMware
lea rcx, [rsp + 0x70]
call fcn.140006a0c
test rax, rax
jne 0x14000432a
lea rdx, str.VBOX
lea rcx, [rsp + 0x70]
call fcn.140006a0c
test rax, rax
jne 0x14000432a
lea rdx, str.Virtual
lea rcx, [rsp + 0x170]
call fcn.140006a0c
test rax, rax
je 0x140004339
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x140004379
jmp 0x14000436c
lea rdx, str.DeviceIoControl_failed.
lea rcx, [0x140037520]
call fcn.140001350
lea rdx, [0x1400026c8]
mov rcx, rax
call fcn.140003acc
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x140004379
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
add rsp, 0x2980
pop rdi
ret
Function at 0x140007ea0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140007eea
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140007eea
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140007eea
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140007eea
cmp dword [rcx + 0x84], 0xe
jbe 0x140007eea
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140007eec
xor al, al
add rsp, 0x28
ret

Function at 0x14000a308
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x14000a336
xor eax, eax
jmp 0x14000a41c
cmp qword [rcx + 0x68], 0
je 0x14000a347
call fcn.14000a438
jmp 0x14000a41c
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14000a35e
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14000a360
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14000a392
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.140023c60
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x14000a416
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x14000a3c9
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x14000a3f2
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.1400147f4
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x14000a416
cmp rsi, rbx
ja 0x14000a3d0
test rsi, rsi
je 0x14000a416
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.1400147f4
sub rsi, rax
sub rbp, rsi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140010180
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1400101ef
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400101ef
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400101ef
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400101ef
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400101ef
cmp dword [rcx + 0x84], 0xe
jbe 0x1400101ef
cmp dword [rcx + 0xf8], 0
je 0x1400101ef
mov ecx, ebx
call fcn.1400102ac
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14001007c
nop
cmp dword [rbp + 0x20], 0
je 0x14001023d
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140010248
int3
xor r8d, r8d
xor edx, edx
jmp 0x140010180

Function at 0x140010390
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1400101ef
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400101ef
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400101ef
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400101ef
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400101ef
cmp dword [rcx + 0x84], 0xe
jbe 0x1400101ef
cmp dword [rcx + 0xf8], 0
je 0x1400101ef
mov ecx, ebx
call fcn.1400102ac
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14001007c
nop
cmp dword [rbp + 0x20], 0
je 0x14001023d
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140010248
int3
xor r8d, r8d
xor edx, edx
jmp 0x140010180
Function at 0x14001828c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1400182bc
xor eax, eax
jmp 0x14001837f
mov rbp, rbx
cmp word [rax], si
je 0x1400182e1
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1400182c8
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1400182c4
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1400181dc
movsxd r14, eax
test eax, eax
jne 0x14001831f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1400182b5
mov rcx, r14
call fcn.14001691c
mov rdi, rax
test rax, rax
jne 0x140018338
xor ecx, ecx
call fcn.1400168a4
jmp 0x140018314
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1400181dc
test eax, eax
jne 0x140018369
mov rcx, rdi
call fcn.1400168a4
jmp 0x140018373
xor ecx, ecx
call fcn.1400168a4
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14001ea90
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rsi, rcx
test rcx, rcx
jne 0x14001eac2
call fcn.140015488
mov dword [rax], 0x16
call fcn.14000fba8
jmp 0x14001ebe1
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x14001ebe1
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x14001ebe1
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x14001eaf1
lock or dword [rcx + 0x14], 0x10
jmp 0x14001ebe1
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x14001eb05
call fcn.1400200f4
mov rdi, qword [rsi + 8]
mov rcx, rsi
mov ebx, dword [rsi + 0x20]
mov qword [rsi], rdi
call fcn.14001dacc
mov r8d, ebx
mov rdx, rdi
mov ecx, eax
call fcn.14001f870
mov dword [rsi + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 1
jbe 0x14001ebcf
mov eax, dword [rsi + 0x14]
or edi, 0xffffffff
test al, 6
jne 0x14001eb9a
mov rcx, rsi
call fcn.14001dacc
cmp eax, edi
je 0x14001eb85
mov rcx, rsi
call fcn.14001dacc
cmp eax, 0xfffffffe
je 0x14001eb85
mov rcx, rsi
call fcn.14001dacc
movsxd rbx, eax
lea r14, [0x140037e10]
mov rcx, rsi
sar rbx, 6
call fcn.14001dacc
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rbx*8]
lea rdx, [rax + rcx*8]
jmp 0x14001eb8c
lea rdx, [0x140036950]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14001eb9a
lock or dword [rsi + 0x14], 0x20
cmp dword [rsi + 0x20], 0x200
jne 0x14001ebbe
mov eax, dword [rsi + 0x14]
shr eax, 6
test al, 1
je 0x14001ebbe
mov eax, dword [rsi + 0x14]
shr eax, 8
test al, 1
jne 0x14001ebbe
mov dword [rsi + 0x20], 0x1000
mov rax, qword [rsi]
add dword [rsi + 0x10], edi
movzx edi, byte [rax]
inc rax
mov qword [rsi], rax
jmp 0x14001ebe4
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rsi + 0x14], eax
and dword [rsi + 0x10], 0
or edi, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret
Function at 0x14001ef0c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.140007690
sub rsp, rax
mov rax, qword [0x140036040]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.14001dacc
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x14001ef5b
mov rax, rbp
jmp 0x14001f063
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x37e10]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.140020048
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0x37e10]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x14001f05f
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14001f05f
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.140020048
test rax, rax
js 0x14001f05f
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x14001f05f
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x14001f051
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x14001f051
cmp byte [rcx], 0xd
jne 0x14001f037
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x14001f046
cmp byte [rcx + 1], 0xa
jne 0x14001f046
inc rcx
jmp 0x14001f046
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x369a0]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x14001f019
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x14001f063
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.1400235f0
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret