joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001bd67
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xffffffffffffffff
lea rax, [0x14001bb8a]
mov rdx, rax
lea rax, [0x1400f6bf0]
mov rcx, rax
call fcn.14001b182
mov eax, dword [0x1400c01e0]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
je 0x14001bdba
mov rax, qword [rbp - 0x10]
jmp 0x14001bf1a
call fcn.14001a8e5
mov qword [rbp - 0x10], rax
mov rax, qword [0x1400f9048]
test rax, rax
je 0x14001bdd6
cmp qword [rbp - 0x10], 0
jne 0x14001bde0
mov eax, 0
jmp 0x14001bf1a
mov rax, qword [rbp - 0x10]
mov dword [rax + 0x44], 1
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call rax
mov rdx, qword [rbp - 0x10]
mov dword [rdx + 0x70], eax
mov r9d, 0
mov r8d, 0
mov edx, 1
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateEventA]
call rax
mov rdx, qword [rbp - 0x10]
mov qword [rdx + 0x30], rax
mov rax, qword [rbp - 0x10]
mov qword [rax + 0x38], 0xffffffffffffffff
mov rax, qword [rbp - 0x10]
lea rcx, [rax + 0x68]
mov rax, qword [rbp - 8]
mov rdx, rax
call fcn.14001aa09
mov rax, qword [rbp - 0x10]
mov dword [rax + 0xb8], 0
mov rax, qword [rbp - 0x10]
mov qword [rax + 0x28], 0
mov rax, qword [rbp - 0x10]
lea rdi, [rax + 0x28]
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov rsi, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call rax
mov rbx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, rdi
mov r8, rsi
mov rdx, rbx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DuplicateHandle]
call rax
test eax, eax
jne 0x14001bebb
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x28]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetThreadPriority]
call rax
mov rdx, qword [rbp - 0x10]
mov dword [rdx + 0xc0], eax
mov rax, qword [rbp - 0x10]
mov dword [rax + 0xbc], 0
mov rax, qword [rbp - 0x10]
movzx edx, byte [rax + 0x40]
and edx, 0xffffffcf
or edx, 0x10
mov byte [rax + 0x40], dl
mov eax, dword [0x1400c01e0]
mov rdx, qword [rbp - 0x10]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
test eax, eax
jne 0x14001bf16
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov rax, qword [rbp - 0x10]
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x14001c017
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp - 0x10], 0
mov rax, qword [rbp + 0x10]
mov dword [rbp - 4], eax
call fcn.14001bd67
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
mov rdx, qword [rbp + 0x10]
mov qword [rax + 8], rdx
mov rax, qword [rbp - 0x18]
mov rax, qword [rax + 0x1d8]
mov rcx, rax
call fcn.14001bbb8
mov rax, qword [rbp - 0x18]
movzx eax, byte [rax + 0x40]
and eax, 0x30
test al, al
jne 0x14001c084
mov rax, qword [rbp - 0x18]
add rax, 0xd0
mov edx, 1
mov rcx, rax
mov rax, qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_longjmp]
call rax
mov eax, dword [0x1400c01e0]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
je 0x14001c1c8
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x28]
test rax, rax
jne 0x14001c121
mov rax, qword [rbp - 0x10]
mov dword [rax], 0xdeadbeef
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x30]
test rax, rax
je 0x14001c0dc
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x10]
mov qword [rax + 0x30], 0
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 8]
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call fcn.14001a7be
mov qword [rbp - 0x10], 0
mov eax, dword [0x1400c01e0]
mov rdx, qword [rbp - 0x10]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
jmp 0x14001c1c8
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 8]
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov dword [rax + 0xbc], 1
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x30]
test rax, rax
je 0x14001c15b
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x10]
mov qword [rax + 0x30], 0
mov rax, qword [rbp - 0x10]
mov eax, dword [rax + 0x44]
and eax, 4
test eax, eax
je 0x14001c1c8
mov rax, qword [rbp - 0x10]
mov dword [rax], 0xdeadbeef
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x28]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x10]
mov qword [rax + 0x28], 0
mov rax, qword [rbp - 0x10]
mov rcx, rax
call fcn.14001a7be
mov qword [rbp - 0x10], 0
mov eax, dword [0x1400c01e0]
mov rdx, qword [rbp - 0x10]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
mov eax, dword [rbp - 4]
mov ecx, eax
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__endthreadex]
call rax
nop
Function at 0x14001e0d0
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov dword [rbp + 0x18], edx
lea rax, [0x1400c0200]
mov rcx, rax
call fcn.14001a03c
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov eax, dword [rax]
cmp eax, 0xbab1f0ed
jne 0x14001e10c
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov eax, dword [rax + 4]
test eax, eax
jg 0x14001e14c
mov ecx, 2
mov rax, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
call rax
mov rcx, rax
mov dword [rsp + 0x20], 0x28
lea r9, str..._.._.._mingw_w64_libraries_winpthreads_src_rwlock.c
lea r8, str.___rwlock_t__rwl___valid__LIFE_RWLOCK______rwlock_t__rwl___busy___0_
lea rax, str.Assertion_failed:___s___file__s__line__d_n
mov rdx, rax
call fcn.1400175a0
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov edx, dword [rax + 4]
sub edx, 1
mov dword [rax + 4], edx
lea rax, [0x1400c0200]
mov rcx, rax
call fcn.14001a0bb
mov eax, dword [rbp + 0x18]
add rsp, 0x30
pop rbp
ret

Function at 0x140023840
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
call rcx
nop
jmp 0x1400bd6c0
Function at 0x1400847c0
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
mov rcx, qword [rdi]
call sub.api_ms_win_crt_stdio_l1_1_0.dll__fileno
mov ecx, eax
mov r8d, ebx
mov rdx, rsi
call sub.api_ms_win_crt_stdio_l1_1_0.dll__read
movsxd rbp, eax
cmp eax, 0xffffffff
je 0x140084808
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call r12
cmp dword [rax], 4
je 0x1400847da
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x1400a9ec0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
movabs rcx, 0x3fffffffffffffff
mov rax, qword [rdx]
cmp rcx, rax
jb 0x1400a9f1b
lea r9, [rax + 1]
cmp r8, rax
jae 0x1400a9ef9
add r8, r8
cmp rax, r8
jae 0x1400a9ef9
cmp rcx, r8
jae 0x1400a9f08
movabs r9, 0x4000000000000000
mov qword [rdx], rcx
mov rcx, r9
add rsp, 0x28
jmp fcn.1400bccc0
lea r9, [r8 + 1]
mov qword [rdx], r8
mov rcx, r9
add rsp, 0x28
jmp fcn.1400bccc0
lea rcx, [0x1400c5570]
call fcn.1400be970
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov qword [rcx + 8], rdx
ret

Function at 0x1400adc00
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
movabs rax, 0x1fffffffffffffff
mov rcx, qword [rdx]
cmp rax, rcx
jb 0x1400adc61
cmp r8, rcx
jb 0x1400adc30
add rcx, 1
add rcx, rcx
add rsp, 0x28
jmp fcn.1400bccc0
add r8, r8
cmp rcx, r8
jae 0x1400adc1b
cmp rax, r8
jae 0x1400adc58
movabs rcx, 0x4000000000000000
mov qword [rdx], rax
add rsp, 0x28
jmp fcn.1400bccc0
mov qword [rdx], r8
lea rcx, [r8 + 1]
jmp 0x1400adc1f
lea rcx, str.basic_string::_M_create
call fcn.1400be970
nop
nop
nop
mov qword [rcx + 8], rdx
ret

Function at 0x1400bccc0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov eax, 1
test rcx, rcx
cmovne rax, rcx
mov rbx, rax
mov rcx, rbx
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
test rax, rax
je 0x1400bcce7
add rsp, 0x20
pop rbx
ret
call fcn.1400b79f0
test rax, rax
je 0x1400bd6e0
call rax
jmp 0x1400bccd4
Function at 0x1400bd6c0
Capabilities:
Write file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rbx, rcx
call fcn.1400bcde0
mov rax, qword [rbx - 0x10]
mov rcx, qword [rbx - 0x40]
mov rbp, qword [rbx - 0x18]
movsxd rsi, dword [rbx - 0x24]
mov qword [rsp + 0x30], rax
mov rdi, qword [rbx - 0x38]
call fcn.140023860
mov rcx, rax
jmp 0x1400bd600
call fcn.1400bcde0
call fcn.1400bd030
mov rbx, qword [rax]
test byte [rbx + 0x50], 1
je 0x1400bd687
mov rbx, qword [rbx]
lea r12, [rsp + 0x20]
mov rdx, rbp
xor ecx, ecx
mov r8, r12
call fcn.140023430
mov rdx, qword [rbx - 0x90]
mov r9, rsi
mov r8, rbx
mov rcx, r12
call fcn.140023520
test al, al
jne 0x1400bd6a5
lea rbx, [0x1400cc520]
mov r9, rsi
xor r8d, r8d
mov rcx, r12
mov rdx, rbx
call fcn.140023520
test al, al
je 0x1400bd6aa
mov ecx, 8
call fcn.1400bcd70
lea r8, [0x14008a9e0]
mov rdx, rbx
mov rcx, rax
mov rax, qword [0x1400ca000]
add rax, 0x10
mov qword [rcx], rax
call fcn.1400bd2f0
add rbx, 0x90
jmp 0x1400bd616
call fcn.1400bd2a0
mov rcx, rdi
call fcn.140023840
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov rcx, rax
call fcn.1400bcde0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, 8
call fcn.1400bcd70
lea r8, [fcn.1400b52e0]
lea rdx, [0x1400cd190]
mov rcx, rax
mov rax, qword [str.P4_r_]
add rax, 0x10
mov qword [rcx], rax
call fcn.1400bd2f0
nop
nop
nop
mov rcx, rax
mov rax, rdx
sub rax, 1
jne 0x1400bd78c
call fcn.1400bcde0
mov rcx, rax
mov rax, qword [rax]
call qword [rax + 0x10]
mov ecx, 2
mov rbx, rax
call rsi
mov r9, rax
mov r8d, 0xb
mov edx, 1
lea rcx, str.__what__:
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov ecx, 2
call rsi
mov rdx, rax
mov rcx, rbx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputs
mov ecx, 2
call rsi
mov rdx, rax
mov ecx, 0xa
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
call fcn.1400bcf10
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov rcx, rdi
call fcn.140017ae0
call fcn.1400bd2a0
call fcn.1400bcde0
call fcn.1400bcf10
jmp 0x1400bd77a
Function at 0x1400bd6e0
Capabilities:
Write file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rbx, rcx
call fcn.1400bcde0
mov rax, qword [rbx - 0x10]
mov rcx, qword [rbx - 0x40]
mov rbp, qword [rbx - 0x18]
movsxd rsi, dword [rbx - 0x24]
mov qword [rsp + 0x30], rax
mov rdi, qword [rbx - 0x38]
call fcn.140023860
mov rcx, rax
jmp 0x1400bd600
call fcn.1400bcde0
call fcn.1400bd030
mov rbx, qword [rax]
test byte [rbx + 0x50], 1
je 0x1400bd687
mov rbx, qword [rbx]
lea r12, [rsp + 0x20]
mov rdx, rbp
xor ecx, ecx
mov r8, r12
call fcn.140023430
mov rdx, qword [rbx - 0x90]
mov r9, rsi
mov r8, rbx
mov rcx, r12
call fcn.140023520
test al, al
jne 0x1400bd6a5
lea rbx, [0x1400cc520]
mov r9, rsi
xor r8d, r8d
mov rcx, r12
mov rdx, rbx
call fcn.140023520
test al, al
je 0x1400bd6aa
mov ecx, 8
call fcn.1400bcd70
lea r8, [0x14008a9e0]
mov rdx, rbx
mov rcx, rax
mov rax, qword [0x1400ca000]
add rax, 0x10
mov qword [rcx], rax
call fcn.1400bd2f0
add rbx, 0x90
jmp 0x1400bd616
call fcn.1400bd2a0
mov rcx, rdi
call fcn.140023840
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov rcx, rax
call fcn.1400bcde0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, 8
call fcn.1400bcd70
lea r8, [fcn.1400b52e0]
lea rdx, [0x1400cd190]
mov rcx, rax
mov rax, qword [str.P4_r_]
add rax, 0x10
mov qword [rcx], rax
call fcn.1400bd2f0
nop
nop
nop
mov rcx, rax
mov rax, rdx
sub rax, 1
jne 0x1400bd78c
call fcn.1400bcde0
mov rcx, rax
mov rax, qword [rax]
call qword [rax + 0x10]
mov ecx, 2
mov rbx, rax
call rsi
mov r9, rax
mov r8d, 0xb
mov edx, 1
lea rcx, str.__what__:
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov ecx, 2
call rsi
mov rdx, rax
mov rcx, rbx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputs
mov ecx, 2
call rsi
mov rdx, rax
mov ecx, 0xa
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
call fcn.1400bcf10
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov rcx, rdi
call fcn.140017ae0
call fcn.1400bd2a0
call fcn.1400bcde0
call fcn.1400bcf10
jmp 0x1400bd77a
Function at 0x1400bd710
Capabilities:
Write file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rbx, rcx
call fcn.1400bcde0
mov rax, qword [rbx - 0x10]
mov rcx, qword [rbx - 0x40]
mov rbp, qword [rbx - 0x18]
movsxd rsi, dword [rbx - 0x24]
mov qword [rsp + 0x30], rax
mov rdi, qword [rbx - 0x38]
call fcn.140023860
mov rcx, rax
jmp 0x1400bd600
call fcn.1400bcde0
call fcn.1400bd030
mov rbx, qword [rax]
test byte [rbx + 0x50], 1
je 0x1400bd687
mov rbx, qword [rbx]
lea r12, [rsp + 0x20]
mov rdx, rbp
xor ecx, ecx
mov r8, r12
call fcn.140023430
mov rdx, qword [rbx - 0x90]
mov r9, rsi
mov r8, rbx
mov rcx, r12
call fcn.140023520
test al, al
jne 0x1400bd6a5
lea rbx, [0x1400cc520]
mov r9, rsi
xor r8d, r8d
mov rcx, r12
mov rdx, rbx
call fcn.140023520
test al, al
je 0x1400bd6aa
mov ecx, 8
call fcn.1400bcd70
lea r8, [0x14008a9e0]
mov rdx, rbx
mov rcx, rax
mov rax, qword [0x1400ca000]
add rax, 0x10
mov qword [rcx], rax
call fcn.1400bd2f0
add rbx, 0x90
jmp 0x1400bd616
call fcn.1400bd2a0
mov rcx, rdi
call fcn.140023840
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov rcx, rax
call fcn.1400bcde0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, 8
call fcn.1400bcd70
lea r8, [fcn.1400b52e0]
lea rdx, [0x1400cd190]
mov rcx, rax
mov rax, qword [str.P4_r_]
add rax, 0x10
mov qword [rcx], rax
call fcn.1400bd2f0
nop
nop
nop
mov rcx, rax
mov rax, rdx
sub rax, 1
jne 0x1400bd78c
call fcn.1400bcde0
mov rcx, rax
mov rax, qword [rax]
call qword [rax + 0x10]
mov ecx, 2
mov rbx, rax
call rsi
mov r9, rax
mov r8d, 0xb
mov edx, 1
lea rcx, str.__what__:
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov ecx, 2
call rsi
mov rdx, rax
mov rcx, rbx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputs
mov ecx, 2
call rsi
mov rdx, rax
mov ecx, 0xa
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
call fcn.1400bcf10
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov rcx, rdi
call fcn.140017ae0
call fcn.1400bd2a0
call fcn.1400bcde0
call fcn.1400bcf10
jmp 0x1400bd77a

Function at 0x1407f570c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + r9 - 0x23be28b2], rbx
movsx ebx, r9w
not r9w
dec r9
lea rbx, [0x1407e1ee0]
movzx r9d, byte [rdx]
push 0xffffffff81237992
xor r9d, eax
push 0x4a936da3
neg dword [rsp + 7]
and r9d, 0xff
mov r9d, dword [rbx + r9*4]
push 0x6bb59d13
shr eax, 8
xor eax, r9d
push 0xffffffffde2cff8c
sub word [rsp + 0x1c], 0xe58e
inc rdx
xor eax, 0xd73b7018
dec r10
lea rsp, [rsp + 0x20]
jne 0x1407f5726
mov ebx, 0xa1023a09
pop rbx

Function at 0x1407ffc56
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r11, qword [r9]
mov qword [rsp], rdi
neg dword [rsp + 3]
add r9, 8
mov r8d, edi
movzx ecx, r8w
jmp 0x1407e3cae

Function at 0x140806f0a
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1407f26fd
jmp 0x1407fed45
pop r8
mov r8, rax
jmp 0x1407ee7a6
Function at 0x1400110b9
Capabilities:
Execute command

Disassembly:
jmp 0x140012200
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x140024017]
call fcn.1400113d9
nop
mov rdx, qword [rbp + 0x120]
lea rcx, [0x14001be44]
call fcn.1400111d1
nop
lea rcx, str.pause
call qword [sym.imp.ucrtbased.dll_system]
nop
mov dword [rbp + 4], 0
jmp 0x140012262
mov eax, dword [rbp + 4]
inc eax
mov dword [rbp + 4], eax
movsxd rax, dword [rbp + 4]
cmp rax, qword [rbp + 0x138]
jae 0x1400122eb
mov dword [rbp + 0x24], 0
jmp 0x140012280
mov eax, dword [rbp + 0x24]
inc eax
mov dword [rbp + 0x24], eax
movsxd rax, dword [rbp + 0x24]
cmp rax, qword [rbp + 0x130]
jae 0x1400122e6
movsxd rax, dword [rbp + 0x24]
mov ecx, 8
imul rcx, rcx, 1
movsxd rdx, dword [rbp + 4]
mov r8, qword [rbp + 0x128]
mov rcx, qword [r8 + rcx]
mov r8d, 8
imul r8, r8, 0
movsxd r9, dword [rbp + 4]
mov r10, qword [rbp + 0x128]
mov r8, qword [r10 + r8]
mov qword [rbp + 0xf8], r8
mov r8, rax
movsd xmm1, qword [rcx + rdx*8]
mov rax, qword [rbp + 0xf8]
movsd xmm0, qword [rax + r9*8]
call fcn.140011389
nop
jmp 0x140012278
jmp 0x14001225a
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x140011235
Capabilities:
Terminate process

Disassembly:
jmp 0x140014260
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x1400112b7
Capabilities:
Terminate process

Disassembly:
jmp 0x1400120d0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x140024017]
call fcn.1400113d9
nop
lea rdx, [0x14001be90]
lea rcx, str.output.csv
call qword [sym.imp.ucrtbased.dll_fopen]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x14001212d
lea rcx, str.Error_opening_file_
call fcn.1400111d1
nop
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
nop
mov dword [rbp + 0x24], 0
jmp 0x14001213e
mov eax, dword [rbp + 0x24]
inc eax
mov dword [rbp + 0x24], eax
movsxd rax, dword [rbp + 0x24]
cmp rax, qword [rbp + 0x128]
jae 0x1400121a3
mov eax, 8
imul rax, rax, 1
movsxd rcx, dword [rbp + 0x24]
mov rdx, qword [rbp + 0x120]
mov rax, qword [rdx + rax]
mov edx, 8
imul rdx, rdx, 0
movsxd r8, dword [rbp + 0x24]
mov r9, qword [rbp + 0x120]
mov rdx, qword [r9 + rdx]
movsd xmm3, qword [rax + rcx*8]
movq r9, xmm3
movsd xmm2, qword [rdx + r8*8]
movq r8, xmm2
lea rdx, str._.4f__.4f_n
mov rcx, qword [rbp + 8]
call fcn.140011384
nop
jmp 0x140012136
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_fclose]
nop
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x1400112cb
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400155a0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400155c0
xor al, al
jmp 0x140015641
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400155d3
xor al, al
jmp 0x140015641
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400155fd
xor al, al
jmp 0x140015641
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140015611
xor al, al
jmp 0x140015641
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140015623
xor al, al
jmp 0x140015641
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001563f
xor al, al
jmp 0x140015641
mov al, 1
add rsp, 0x38
ret
Function at 0x14001139d
Capabilities:
Terminate process

Disassembly:
jmp 0x1400119e0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x140024017]
call fcn.1400113d9
nop
mov eax, 8
mul qword [rbp + 0x120]
mov rcx, 0xffffffffffffffff
cmovb rax, rcx
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_malloc]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x140011a4b
lea rcx, str.Memory_allocation_failed__n
call fcn.1400111d1
nop
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
nop
jmp 0x140011a97
mov dword [rbp + 0x24], 0
jmp 0x140011a5c
mov eax, dword [rbp + 0x24]
inc eax
mov dword [rbp + 0x24], eax
movsxd rax, dword [rbp + 0x24]
cmp rax, qword [rbp + 0x120]
jae 0x140011a97
mov eax, 8
mul qword [rbp + 0x128]
mov rcx, 0xffffffffffffffff
cmovb rax, rcx
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_malloc]
movsxd rcx, dword [rbp + 0x24]
mov rdx, qword [rbp + 8]
mov qword [rdx + rcx*8], rax
jmp 0x140011a54
mov rax, qword [rbp + 8]
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x1400134a0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.140011401
movzx eax, al
test eax, eax
jne 0x1400134c0
mov ecx, 7
call fcn.140011366
nop
mov byte [rsp + 0x20], 0
call fcn.14001137a
mov byte [rsp + 0x21], al
cmp dword [0x14001f878], 1
jne 0x1400134e4
mov ecx, 7
call fcn.140011366
nop
jmp 0x14001353c
cmp dword [0x14001f878], 0
jne 0x140013537
mov dword [0x14001f878], 1
lea rdx, [0x14001b660]
lea rcx, [0x14001b330]
call fcn.1400111d6
test eax, eax
je 0x140013518
mov eax, 0xff
jmp 0x140013641
lea rdx, [0x14001b220]
lea rcx, [section..rdata]
call fcn.140011370
mov dword [0x14001f878], 2
jmp 0x14001353c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.140011352
call fcn.1400112ee
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140013599
mov rcx, qword [rsp + 0x30]
call fcn.14001117c
movzx eax, al
test eax, eax
je 0x140013599
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140025020]
nop
call fcn.140011320
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x1400135cd
mov rcx, qword [rsp + 0x38]
call fcn.14001117c
movzx eax, al
test eax, eax
je 0x1400135cd
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.1400113c0
nop
call fcn.1400136f0
mov dword [rsp + 0x28], eax
call fcn.1400112cb
movzx eax, al
test eax, eax
jne 0x1400135ec
mov ecx, dword [rsp + 0x28]
call fcn.140011055
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x1400135fb
call fcn.1400113ca
nop
xor edx, edx
mov cl, 1
call fcn.14001116d
mov eax, dword [rsp + 0x28]
jmp 0x140013641
add rsp, 0x68
ret
Function at 0x1400031e0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000322a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000322a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000322a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000322a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000322a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000322c
xor al, al
add rsp, 0x28
ret
Function at 0x14000137f
Capabilities:
Parse pe header

Disassembly:
jmp 0x14004e8a8
xor r8d, r8d
xor edx, edx
jmp 0x14004e58c

Function at 0x14000169f
Capabilities:
Print debug messages

Disassembly:
jmp 0x14005fa68
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, r8d
mov rbp, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ebx, eax
test eax, eax
je 0x14005fab0
test rdi, rdi
je 0x14005fa9f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call fcn.1400017f8
cmp eax, 1
je 0x14005fab0
mov eax, 4
jmp 0x14005faf5
call fcn.140003977
cmp eax, 2
jne 0x14005faec
call fcn.140001852
test al, al
je 0x14005faec
call fcn.140002ae5
test al, al
jne 0x14005fae2
bts esi, 0x15
xor ecx, ecx
mov rdx, rdi
mov r8, rbp
mov r9d, esi
call fcn.1400039b3
jmp 0x14005faf5
call fcn.14000385a
mov rcx, rax
jmp 0x14005fad2
neg ebx
sbb eax, eax
neg eax
add eax, 3
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret