joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140068a90
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x140068af1
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140068ab0
mov ecx, dword [r9]
jmp 0x140068bdb
cmp ecx, 0x4e0
jb 0x140068bdb
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
add r10, 4
mov edx, r11d
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140068b10
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140068b60
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x14006adc0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x138
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x14006ae27
lea r8, [r10 + 0x10]
movabs r11, 0xb5026f5aa96619e9
mov rdx, qword [r8]
xor rdx, qword [r8 - 8]
lea r8, [r8 + 8]
and rdx, 0xffffffff80000000
xor rdx, qword [r8 - 8]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r8 + 0x4d0]
xor rcx, rdx
mov qword [r8 + 0x9b0], rcx
sub r9, 1
jne 0x14006ade2
mov ecx, dword [r10]
jmp 0x14006af48
cmp ecx, 0x270
jb 0x14006af48
mov qword [rsp + 0x10], rbx
movabs r11, 0xb5026f5aa96619e9
lea rbx, [r10 + 0x9c8]
mov qword [rsp], rdi
mov rax, qword [rbx]
mov edi, 0x9c
nop word [rax + rax]
mov r9, qword [rbx + 8]
mov r8, rbx
add rbx, 8
mov rdx, r9
xor rdx, rax
and rdx, 0xffffffff80000000
xor rdx, r9
movzx eax, dl
and al, 1
neg al
mov rax, r9
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r8 + 0x4e0]
xor rcx, rdx
mov qword [r8 - 0x9c0], rcx
sub rdi, 1
jne 0x14006ae60
lea rbx, [r10 + 0xea8]
mov edi, 0x9b
mov r9, qword [rbx]
nop dword [rax]
nop dword [rax + rax]
mov r8, qword [rbx + 8]
mov rdx, rbx
xor r9, r8
add rbx, 8
and r9, 0xffffffff80000000
xor r9, r8
movzx eax, r9b
and al, 1
neg al
sbb rcx, rcx
shr r9, 1
and rcx, r11
xor rcx, qword [rdx - 0xea0]
xor rcx, r9
mov r9, r8
mov qword [rdx - 0x9c0], rcx
sub rdi, 1
jne 0x14006aec0
mov rdx, qword [r10 + 8]
xor rdx, qword [r10 + 0x1380]
mov rdi, qword [rsp]
and rdx, 0xffffffff80000000
xor rdx, qword [r10 + 8]
mov rbx, qword [rsp + 0x10]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r10 + 0x4e0]
xor rcx, rdx
mov qword [r10 + 0x9c0], rcx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov rdx, qword [r10 + rax*8 + 8]
lea eax, [rcx + 1]
mov dword [r10], eax
mov rcx, rdx
mov rax, qword [r10 + 0x1388]
shr rcx, 0x1d
and rax, rcx
movabs rcx, 0x38eb3ffff6d3
xor rdx, rax
mov rax, rdx
and rax, rcx
shl rax, 0x11
xor rdx, rax
mov rax, rdx
and rax, 0xffffffffffffbf77
shl rax, 0x25
xor rdx, rax
mov rax, rdx
shr rax, 0x2b
xor rax, rdx
add rsp, 8
ret
Function at 0x14006b340
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x140135040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, qword [0x1401a1a68]
mov rbx, r8
lea rsi, [rdi + 0x164]
lea rcx, [rdi + 0x16c]
mov dword [rsi], 1
call fcn.1400f6e20
mov dword [rdi + 0x168], ebx
add rbx, 8
je 0x14006b417
mov rax, qword [rdi]
test rax, rax
je 0x14006b3d5
mov rcx, qword [rax + 8]
cmp rcx, 0xffffffffffffffff
je 0x14006b3d5
test rsi, rsi
je 0x14006b3d5
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], 0
mov r8d, ebx
mov qword [rsp + 0x20], 0
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
jne 0x14006b3d5
cmp dword [rsp + 0x30], ebx
je 0x14006b417
mov r8, qword [rdi + 0x18]
test r8, r8
je 0x14006b3f4
mov eax, dword [rdi + 8]
dec eax
test eax, 0xfffffffd
jne 0x14006b3f4
mov ecx, dword [rdi + 0x60]
lea rdx, [rdi + 0x64]
call r8
mov rbx, qword [rdi]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 8], 0xffffffffffffffff
xor al, al
mov byte [rbx], 0
mov dword [rdi + 8], 0
jmp 0x14006b419
mov al, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14006fcc0
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x140070a70
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.140070530
movzx eax, al
test eax, eax
jne 0x140070a90
mov ecx, 7
call fcn.140071350
nop
mov byte [rsp + 0x20], 0
call fcn.1400704c0
mov byte [rsp + 0x21], al
cmp dword [0x14016a360], 1
jne 0x140070ab4
mov ecx, 7
call fcn.140071350
nop
jmp 0x140070b0c
cmp dword [0x14016a360], 0
jne 0x140070b07
mov dword [0x14016a360], 1
lea rdx, [0x1400fca40]
lea rcx, [0x1400fc9f8]
call fcn.1400b1020
test eax, eax
je 0x140070ae8
mov eax, 0xff
jmp 0x140070c11
lea rdx, [0x1400fc9f0]
lea rcx, [0x1400fc568]
call fcn.1400b0fc0
mov dword [0x14016a360], 2
jmp 0x140070b0c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.140070720
call fcn.140071880
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140070b69
mov rcx, qword [rsp + 0x30]
call fcn.140070690
movzx eax, al
test eax, eax
je 0x140070b69
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x1400fc540]
nop
call fcn.140071890
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x140070b9d
mov rcx, qword [rsp + 0x38]
call fcn.140070690
movzx eax, al
test eax, eax
je 0x140070b9d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.1400a4070
nop
call fcn.140070c20
mov dword [rsp + 0x28], eax
call fcn.140071500
movzx eax, al
test eax, eax
jne 0x140070bbc
mov ecx, dword [rsp + 0x28]
call fcn.1400a40c0
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x140070bcb
call fcn.1400a4030
nop
xor edx, edx
mov cl, 1
call fcn.140070750
mov eax, dword [rsp + 0x28]
jmp 0x140070c11
add rsp, 0x68
ret
Function at 0x140074a90
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
cmp qword [rsp + 0x80], 0
jg 0x140074ab5
xor eax, eax
jmp 0x140074c76
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x68], 0
je 0x140074add
mov r8, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call fcn.140061720
jmp 0x140074c76
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x70]
call fcn.140063810
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jbe 0x140074b7a
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x20]
call fcn.14004d6f0
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x70]
call fcn.1400638c0
mov r8, qword [rsp + 0x28]
mov rdx, rax
mov rcx, qword [rsp + 0x78]
call fcn.14004d700
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov edx, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x70]
call fcn.140063880
nop
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x80], 0
je 0x140074c66
mov rcx, qword [rsp + 0x70]
call fcn.1400738b0
mov qword [rsp + 0x58], 0xfff
cmp qword [rsp + 0x20], 0xfff
jbe 0x140074c1a
mov rax, qword [rsp + 0x70]
mov r9, qword [rax + 0x80]
mov r8d, 0xfff
mov edx, 1
mov rcx, qword [rsp + 0x78]
call fcn.1400993d0
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x30], 0xfff
je 0x140074c18
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
jmp 0x140074c76
jmp 0x140074ba0
cmp qword [rsp + 0x20], 0
jbe 0x140074c66
mov rax, qword [rsp + 0x70]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x20]
mov edx, 1
mov rcx, qword [rsp + 0x78]
call fcn.1400993d0
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
add rsp, 0x68
ret

Function at 0x1400800e0
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.14007fbc0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14008011f
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1400fc540]
jmp 0x140080129
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret
Function at 0x1400a3e10
Capabilities:
Terminate process

Disassembly:
mov byte [rsp + 0x10], dl
mov dword [rsp + 8], ecx
sub rsp, 0x28
movzx eax, byte [rsp + 0x38]
test eax, eax
je 0x1400a3e38
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, dword [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [rsp + 0x30]
call fcn.1400a3f30
mov ecx, dword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1400c29f0
Capabilities:
Get geographical location

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
call fcn.1400c1dd0
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1400c2a4c
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
call fcn.1400f6de0
jmp 0x1400c2a6e
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.1400c2dc0
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x58
ret
Function at 0x1400c48a0
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.1400ef280
sub rsp, rax
mov rax, qword [0x140135040]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x14016b970]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x1400c4a9a
lea rax, [rsp + 0x147f]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x38], rax
jae 0x1400c49e6
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x1400c49e6
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
mov byte [rsp + 0x31], al
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x30], al
movsx eax, byte [rsp + 0x30]
cmp eax, 0xa
jne 0x1400c49cb
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x38]
mov byte [rax], 0xd
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, byte [rsp + 0x30]
mov byte [rax], cl
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
jmp 0x1400c4968
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400c4a5a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1400c4ab9
mov eax, dword [rsp + 0x40]
mov ecx, dword [rsp + 0x6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x40], eax
jae 0x1400c4a95
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1400c4ab9
jmp 0x1400c493e
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.14006fcc0
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x1400c4ae0
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.1400ef280
sub rsp, rax
mov rax, qword [0x140135040]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x14016b970]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x1400c4cf5
lea rax, [rsp + 0x147e]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x38], rax
jae 0x1400c4c39
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x1400c4c39
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
mov word [rsp + 0x40], ax
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x30]
cmp eax, 0xa
jne 0x1400c4c19
mov eax, dword [rsp + 0x78]
add eax, 2
mov dword [rsp + 0x78], eax
mov eax, 0xd
mov rcx, qword [rsp + 0x38]
mov word [rcx], ax
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, word [rsp + 0x30]
mov word [rax], cx
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
jmp 0x1400c4ba8
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov eax, eax
shl rax, 1
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x48]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400c4cb5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1400c4d14
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x48]
cmp dword [rsp + 0x44], eax
jae 0x1400c4cf0
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1400c4d14
jmp 0x1400c4b7e
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.14006fcc0
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x1400ca4e0
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov edx, 8
lea rcx, [rsp + 0x60]
call fcn.1400815f0
movzx eax, al
test eax, eax
je 0x1400ca507
mov al, 1
jmp 0x1400ca5fc
lea rcx, [rsp + 0x60]
call fcn.140081630
movzx eax, al
test eax, eax
je 0x1400ca546
lea rcx, [rsp + 0x60]
call fcn.140071da0
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x60]
call fcn.140071da0
mov rax, qword [rax + 8]
mov rcx, qword [rsp + 0x40]
cmp qword [rcx], rax
jne 0x1400ca546
xor al, al
jmp 0x1400ca5fc
lea rcx, [rsp + 0x60]
call fcn.140083270
mov ecx, eax
call fcn.1400db540
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0xffffffffffffffff
jne 0x1400ca56b
xor al, al
jmp 0x1400ca5fc
lea rax, [rsp + 0x38]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
lea rax, [rsp + 0x48]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
mov r9d, 1
lea r8, [rsp + 0x38]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x1400ca5b0
xor al, al
jmp 0x1400ca5fc
lea rax, [rsp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x1400ca5d9
xor al, al
jmp 0x1400ca5fc
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
jne 0x1400ca5ef
mov dword [rsp + 0x20], 1
jmp 0x1400ca5f7
mov dword [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
add rsp, 0x50
pop rdi
ret
Function at 0x1400ce530
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x1400d8120
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0xb8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140076b60
lea rcx, [rsp + 0x40]
call fcn.1400d80e0
movzx eax, al
test eax, eax
jne 0x1400d8168
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call fcn.1400d7ff0
mov rax, qword [rsp + 0x70]
jmp 0x1400d8339
lea rcx, [rsp + 0x40]
call fcn.140071da0
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.1400d8090
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x40]
call fcn.140071da0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.1400d1340
cdqe
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x1400d820e
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x40]
call fcn.1400d7ff0
mov rax, qword [rsp + 0x80]
jmp 0x1400d8339
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, qword [rsp + 0x58]
call fcn.1400a8d60
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140076b60
lea rcx, [rsp + 0x48]
call fcn.1400772a0
movzx eax, al
test eax, eax
jne 0x1400d8275
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x48]
call fcn.140077280
lea rcx, [rsp + 0x40]
call fcn.1400d7ff0
mov rax, qword [rsp + 0x88]
jmp 0x1400d8339
lea rcx, [rsp + 0x48]
call fcn.140071da0
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x40]
call fcn.140071da0
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call fcn.1400d1340
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x1400d830b
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x48]
call fcn.140077280
lea rcx, [rsp + 0x40]
call fcn.1400d7ff0
mov rax, qword [rsp + 0xa0]
jmp 0x1400d8339
lea rcx, [rsp + 0x48]
call fcn.1400794c0
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x48]
call fcn.140077280
lea rcx, [rsp + 0x40]
call fcn.1400d7ff0
mov rax, qword [rsp + 0xa8]
add rsp, 0xb8
ret
Function at 0x1400d8350
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.140076b60
lea rcx, [rsp + 0x20]
call fcn.1400d8010
movzx eax, al
test eax, eax
jne 0x1400d8395
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x20]
call fcn.1400d7ff0
mov rax, qword [rsp + 0x40]
jmp 0x1400d848f
lea rcx, [rsp + 0x20]
call fcn.140071da0
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.1400d8090
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r9d, 0x40
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, rax
call fcn.1400a8d60
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.140076b60
lea rcx, [rsp + 0x28]
call fcn.1400772a0
movzx eax, al
test eax, eax
jne 0x1400d842f
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x28]
call fcn.140081850
lea rcx, [rsp + 0x20]
call fcn.1400d7ff0
mov rax, qword [rsp + 0x50]
jmp 0x1400d848f
lea rcx, [rsp + 0x20]
call fcn.140071da0
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call fcn.140071da0
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r8, rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.1400f6e20
lea rcx, [rsp + 0x28]
call fcn.1400794c0
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x28]
call fcn.140081850
lea rcx, [rsp + 0x20]
call fcn.1400d7ff0
mov rax, qword [rsp + 0x68]
add rsp, 0x78
ret

Function at 0x1400d9bc0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add rsp, 0x28
ret

Function at 0x1400e0350
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov dword [rsp + 0x20], 0
cmp qword [rsp + 0x40], 0
je 0x1400e038f
mov rax, qword [rsp + 0x40]
movzx eax, word [rax]
test eax, eax
je 0x1400e038f
lea rdx, [0x140113a78]
mov rcx, qword [rsp + 0x40]
call fcn.1400ddb10
test eax, eax
jne 0x1400e03c6
mov r9d, 2
lea r8, [rsp + 0x20]
mov edx, 0x20001004
mov rax, qword [rsp + 0x48]
mov ecx, dword [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x1400e03b5
xor eax, eax
jmp 0x1400e0415
cmp dword [rsp + 0x20], 0
jne 0x1400e03c4
call qword [sym.imp.KERNEL32.dll_GetACP]
jmp 0x1400e0415
jmp 0x1400e0411
lea rdx, [0x140113a90]
mov rcx, qword [rsp + 0x40]
call fcn.1400ddb10
test eax, eax
jne 0x1400e0403
mov r9d, 2
lea r8, [rsp + 0x20]
mov edx, 0x2000000b
mov rax, qword [rsp + 0x48]
mov ecx, dword [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x1400e0401
xor eax, eax
jmp 0x1400e0415
jmp 0x1400e0411
mov rcx, qword [rsp + 0x40]
call fcn.1400be180
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret