joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400033b0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x14000348d
mov edx, 0x40
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x14000348d
mov edi, 0x5a4d
cmp word [rbx], di
jne 0x14000348d
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x14000348d
lea rsi, [rbx + rax]
mov edx, 0xf8
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x14000348d
cmp dword [rsi], 0x4550
jne 0x14000348d
test rsi, rsi
je 0x14000348d
mov edx, 0x40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x14000347a
cmp word [rbx], di
jne 0x14000347a
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x14000347a
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x14000347a
cmp dword [rdi], 0x4550
jne 0x14000347a
test rdi, rdi
je 0x14000347a
mov edx, 0xf8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x14000347a
mov eax, 0x20b
mov eax, dword [rsi + 0x28]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400034a0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
mov rbp, rdx
mov rbx, rcx
test rcx, rcx
je 0x140003574
call fcn.140002db0
mov rsi, rax
test rax, rax
je 0x140003574
mov edx, 0x40
mov qword [rsp + 0x30], rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x140003535
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x140003535
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140003535
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x140003535
cmp dword [rdi], 0x4550
jne 0x140003535
test rdi, rdi
je 0x140003535
mov edx, 0xf8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x140003535
mov eax, 0x20b
lea rax, [rsi + 4]
test rax, rax
je 0x14000355d
cmp rax, rbx
jb 0x14000355d
mov rcx, rax
sub rcx, rbx
lea rdx, [rcx + 0x14]
cmp rdx, rbp
ja 0x14000355d
cmp rdx, 0x14
jb 0x14000355d
cmp rdx, rcx
jae 0x14000355f
xor eax, eax
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
mov rbx, qword [rsp + 0x38]
xor eax, eax
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
Function at 0x140003600
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rdi, rcx
call fcn.140002db0
test rax, rax
jne 0x140003634
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
mov qword [rsp + 0x40], rbx
mov rdx, rsi
mov rcx, rdi
mov qword [rsp + 0x48], rbp
call fcn.1400034a0
test rax, rax
je 0x1400036ef
cmp word [rax + 2], 0
je 0x1400036ef
xor ebx, ebx
mov edx, 5
mov rcx, rdi
mov ebp, ebx
call fcn.140003190
test rax, rax
jne 0x14000367e
mov rcx, rdi
call fcn.1400032a0
mov rbp, rax
mov r8, r14
mov qword [rsp + 0x20], rbp
mov rdx, rsi
mov rcx, rdi
call fcn.140003b50
mov rdi, rax
test rax, rax
je 0x1400036d7
mov rdx, qword [r14]
mov r8, rax
mov rcx, rax
call fcn.140004050
test al, al
jne 0x1400036ea
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.____Could_not_relocate_the_module__n
call fcn.1400013a0
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, rbx
mov rdi, rbx
jmp 0x14000373f
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.____Could_not_allocate_memory_at_the_desired_base__n
call fcn.1400013a0
mov rax, rdi
jmp 0x14000373f
mov rcx, rdi
call fcn.1400032a0
mov rcx, rdi
mov rbx, rax
call fcn.140003070
mov ebp, eax
test eax, eax
je 0x14000373a
mov r9d, 0x40
mov r8d, 0x3000
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
je 0x14000373a
mov r8, rsi
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov qword [r14], rbp
jmp 0x14000373c
xor ebx, ebx
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140003b50
Capabilities:
Allocate or change rwx memory
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, r8
mov rbp, rdx
mov rbx, rcx
test rcx, rcx
je 0x140003c9e
mov edx, 0x40
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x140003c9e
mov edi, 0x5a4d
cmp word [rbx], di
jne 0x140003c9e
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140003c9e
lea rsi, [rbx + rax]
mov edx, 0xf8
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x140003c9e
cmp dword [rsi], 0x4550
jne 0x140003c9e
test rsi, rsi
je 0x140003c9e
mov edx, 0x40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x140003c2e
cmp word [rbx], di
jne 0x140003c2e
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140003c2e
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x140003c2e
cmp dword [rdi], 0x4550
jne 0x140003c2e
test rdi, rdi
je 0x140003c2e
mov edx, 0xf8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
mov edi, dword [rsi + 0x50]
test rdi, rdi
je 0x140003c89
mov rcx, qword [rsp + 0x50]
mov r9d, 0x40
mov r8d, 0x3000
mov edx, edi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
je 0x140003c89
mov r9d, edi
mov r8, rax
mov rdx, rbp
mov rcx, rbx
call fcn.140003760
test al, al
jne 0x140003c81
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Could_not_copy_PE_file
call fcn.1400013a0
jmp 0x140003ccd
mov qword [r14], rdi
mov rax, rsi
jmp 0x140003cdf
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Could_not_allocate_memory_in_the_current_process
call fcn.1400013a0
jmp 0x140003ccd
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Invalid_payload:
call fcn.1400013a0
lea rdx, [0x140001eb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
lea rdx, [0x140001e70]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140004050
Capabilities:
Parse pe header

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x50
mov rax, qword [0x140012040]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbp, r8
mov r14, rdx
mov rbx, rcx
test rcx, rcx
je 0x14000415b
mov qword [rsp + 0x78], rsi
call fcn.1400032a0
mov rsi, rax
cmp rbp, rax
je 0x140004157
mov edx, 0x40
mov qword [rsp + 0x80], rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1400040fa
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x1400040fa
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x1400040fa
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1400040fa
cmp dword [rdi], 0x4550
jne 0x1400040fa
test rdi, rdi
je 0x1400040fa
mov edx, 0xf8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1400040fa
movzx eax, word [rdi + 0x18]
jmp 0x1400040fc
xor eax, eax
mov ecx, 0x20b
mov qword [rsp + 0x30], rsi
cmp ax, cx
mov qword [rsp + 0x38], rbp
lea rax, vtable.ApplyRelocCallback.0
mov rdx, r14
lea r8, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov rcx, rbx
sete byte [rsp + 0x28]
call fcn.140003d20
mov rdi, qword [rsp + 0x80]
test al, al
setne al
mov rsi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14000a140
add rsp, 0x50
pop r14
pop rbp
pop rbx
ret
mov al, 1
jmp 0x14000413c
xor al, al
jmp 0x140004141
Function at 0x140004160
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rsi, r8
mov rbp, rdx
mov r14, rcx
call fcn.140003070
mov edi, eax
test eax, eax
je 0x1400043fc
test rbp, rbp
jne 0x140004191
mov ebp, edi
mov edx, 9
mov rcx, r14
call fcn.140003190
test rax, rax
je 0x1400043fc
mov eax, dword [rax]
test eax, eax
je 0x1400043fc
mov ebx, eax
add rbx, r14
je 0x1400043fc
mov rbx, qword [rbx + 0x18]
test rbx, rbx
je 0x1400043fc
cmp rbx, r14
jb 0x1400041ec
lea rax, [r14 + rdi]
cmp rbx, rax
jae 0x1400041ec
mov rax, rbx
mov ecx, 0xffffffff
sub rax, r14
cmp rax, rcx
jae 0x140004200
sub ebx, r14d
jmp 0x140004202
cmp rbx, rdi
jae 0x1400043fc
mov ecx, 0xffffffff
cmp rbx, rcx
cmovb ecx, ebx
mov ebx, ecx
test r14, r14
je 0x140004358
mov edx, 0x40
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x140004358
mov eax, 0x5a4d
cmp word [r14], ax
jne 0x140004358
movsxd rax, dword [r14 + 0x3c]
cmp eax, 0x400
jg 0x140004358
lea rdi, [r14 + rax]
mov edx, 0xf8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x140004358
cmp dword [rdi], 0x4550
jne 0x140004358
test rdi, rdi
je 0x140004358
mov edx, 0xf8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x140004358
mov eax, 0x20b
cmp word [rdi + 0x18], ax
jne 0x140004358
mov eax, ebx
lea rcx, [r14 + rax]
test rcx, rcx
je 0x1400043f5
cmp rcx, r14
jb 0x1400043f5
lea rbx, [rax + 8]
cmp rbx, rbp
ja 0x1400043f5
cmp rbx, 8
jb 0x1400043f5
cmp rbx, rax
jb 0x1400043f5
mov rcx, r14
call fcn.140003070
xor edi, edi
nop word [rax + rax]
lea rcx, [r14 - 8]
add rcx, rbx
je 0x1400043f7
cmp rcx, r14
jb 0x1400043f7
cmp rbx, rbp
ja 0x1400043f7
cmp rbx, 8
jb 0x1400043f7
lea rax, [rbx - 8]
cmp rbx, rax
jb 0x1400043f7
mov rax, qword [rcx]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400043f7
mov rdx, qword [rsi + 8]
cmp rdx, qword [rsi + 0x10]
je 0x140004342
mov qword [rdx], rax
inc rdi
add qword [rsi + 8], 8
add rbx, 8
jmp 0x1400042e0
lea r8, [rsp + 0x40]
mov rcx, rsi
call fcn.140004600
inc rdi
add rbx, 8
jmp 0x1400042e0
mov eax, ebx
lea rcx, [rax + r14]
test r14, r14
je 0x1400043f5
test rcx, rcx
je 0x1400043f5
cmp rcx, r14
jb 0x1400043f5
lea rbx, [rax + 4]
cmp rbx, rbp
ja 0x1400043f5
cmp rbx, 4
jb 0x1400043f5
cmp rbx, rax
jb 0x1400043f5
mov rcx, r14
call fcn.140003070
xor edi, edi
lea rcx, [r14 - 4]
add rcx, rbx
je 0x1400043f7
cmp rcx, r14
jb 0x1400043f7
cmp rbx, rbp
ja 0x1400043f7
cmp rbx, 4
jb 0x1400043f7
lea rax, [rbx - 4]
cmp rbx, rax
jb 0x1400043f7
mov eax, dword [rcx]
test eax, eax
je 0x1400043f7
mov rdx, qword [rsi + 8]
mov qword [rsp + 0x40], rax
cmp rdx, qword [rsi + 0x10]
je 0x1400043df
mov qword [rdx], rax
inc rdi
add qword [rsi + 8], 8
add rbx, 4
jmp 0x140004397
lea r8, [rsp + 0x40]
mov rcx, rsi
call fcn.140004600
inc rdi
add rbx, 4
jmp 0x140004397
xor edi, edi
mov rax, rdi
jmp 0x1400043fe
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x140008c50
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x13c0]
mov eax, 0x14c0
call fcn.14000b0f0
sub rsp, rax
mov r14d, edx
mov r15, rcx
mov rsi, qword [rbp + 0x1418]
xor r12d, r12d
mov word [rbp + 0x3c0], r12w
mov byte [rbp - 0x40], r12b
mov rbx, qword [rbp + 0x1420]
mov ecx, dword [rbx]
mov dword [rsp + 0x28], ecx
mov eax, dword [rbx + 4]
mov dword [rsp + 0x2c], eax
call fcn.140005590
mov edi, eax
mov dword [rsp + 0x20], 3
mov ecx, r12d
mov eax, 8
cmp dword [rbx + 8], 1
cmove ecx, eax
mov dword [rsp + 0x24], ecx
mov ecx, 1
lock xadd dword [0x140013a20], ecx
inc ecx
mov dword [rsp + 0x30], ecx
mov qword [rsp + 0x38], r12
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x40], eax
lea rax, str.E:_source_reposVCT_V3packagesMicrosoft.Windows.ImplementationLibrary.1.0.240803.1includewil_resource.h
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], r14d
mov dword [rsp + 0x64], edi
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], r12
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x50], r15
mov qword [rsp + 0x68], r12
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], rax
xorps xmm1, xmm1
movups xmmword [rsp + 0x70], xmm1
mov qword [rbp - 0x80], rax
mov rax, qword [0x140013ac0]
test rax, rax
je 0x140008d44
call rax
mov qword [rbp - 0x60], rax
jmp 0x140008d48
mov qword [rbp - 0x60], r12
mov rax, qword [0x140013a50]
test rax, rax
je 0x140008d5b
lea rcx, [rsp + 0x20]
call rax
mov rax, qword [0x140013a80]
test rax, rax
je 0x140008d78
mov r8d, 0x400
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x20]
call rax
mov rax, qword [0x140013a78]
test rax, rax
je 0x140008d8b
lea rcx, [rsp + 0x20]
call rax
mov rax, qword [0x140013a98]
test rax, rax
je 0x140008da5
test byte [rsp + 0x24], 2
jne 0x140008da5
lea rcx, [rsp + 0x20]
call rax
cmp dword [rsp + 0x28], r12d
jl 0x140008dc2
mov dword [rsp + 0x28], 0x8000ffff
mov ecx, 0x8000ffff
call fcn.140005750
mov dword [rsp + 0x2c], eax
cmp byte [0x140013a30], r12b
jne 0x140008df0
mov rax, qword [0x140013a28]
test rax, rax
je 0x140008ddf
call rax
movzx r12d, al
jmp 0x140008deb
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
setne r12b
test r12d, r12d
je 0x140008df7
test byte [rsp + 0x24], 2
je 0x140008e1a
mov rax, qword [0x140013a48]
test rax, rax
je 0x140008e70
cmp byte [0x140013a60], 0
jne 0x140008e70
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x20]
call rax
jmp 0x140008e70
mov rax, qword [0x140013a48]
test rax, rax
je 0x140008e43
cmp byte [0x140013a60], 0
jne 0x140008e43
mov r8d, 0x800
lea rdx, [rbp + 0x3c0]
lea rcx, [rsp + 0x20]
call rax
cmp word [rbp + 0x3c0], 0
jne 0x140008e63
lea r8, [rsp + 0x20]
mov edx, 0x800
lea rcx, [rbp + 0x3c0]
call fcn.1400050b0
lea rcx, [rbp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test byte [rsp + 0x24], 4
jne 0x140008e80
cmp byte [0x140013a40], 0
je 0x140008e8f
mov rax, qword [0x140013a88]
test rax, rax
je 0x140008e8f
call rax
nop
lea rcx, [rsp + 0x20]
call fcn.140006a40
int3
Function at 0x140008ea0
Capabilities:
Print debug messages

Disassembly:
jmp 0x1400096c0
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x13d0]
mov eax, 0x14d0
call fcn.14000b0f0
sub rsp, rax
mov rax, qword [0x140012040]
xor rax, rsp
mov qword [rbp + 0x13c0], rax
mov esi, edx
mov r14, rcx
mov rdi, qword [rbp + 0x1428]
xor r15d, r15d
mov word [rbp + 0x3c0], r15w
mov byte [rbp - 0x40], r15b
mov r8, qword [rbp + 0x1430]
mov ecx, dword [r8]
mov dword [rsp + 0x28], ecx
mov eax, dword [r8 + 4]
mov dword [rsp + 0x2c], eax
call fcn.140005550
mov ebx, eax
mov edx, 1
mov dword [rsp + 0x20], edx
mov ecx, r15d
mov eax, 8
cmp dword [r8 + 8], edx
cmove ecx, eax
mov dword [rsp + 0x24], ecx
lock xadd dword [0x140013a20], edx
inc edx
mov dword [rsp + 0x30], edx
mov qword [rsp + 0x38], r15
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x40], eax
lea rax, [0x14000d400]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], esi
mov dword [rsp + 0x64], ebx
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x50], r15
mov qword [rbp - 0x58], rdi
mov qword [rbp - 0x50], r14
mov qword [rsp + 0x68], r15
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], rax
xorps xmm1, xmm1
movups xmmword [rsp + 0x70], xmm1
mov qword [rbp - 0x80], rax
mov rax, qword [0x140013ac0]
test rax, rax
je 0x1400097bb
call rax
mov qword [rbp - 0x60], rax
jmp 0x1400097bf
mov qword [rbp - 0x60], r15
mov rax, qword [0x140013a50]
test rax, rax
je 0x1400097d2
lea rcx, [rsp + 0x20]
call rax
mov rax, qword [0x140013a80]
test rax, rax
je 0x1400097ef
mov r8d, 0x400
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x20]
call rax
mov rax, qword [0x140013a78]
test rax, rax
je 0x140009802
lea rcx, [rsp + 0x20]
call rax
mov rax, qword [0x140013a98]
test rax, rax
je 0x14000981c
test byte [rsp + 0x24], 2
jne 0x14000981c
lea rcx, [rsp + 0x20]
call rax
cmp dword [rsp + 0x28], r15d
jge 0x14000992c
cmp byte [0x140013a30], r15b
jne 0x140009855
mov rax, qword [0x140013a28]
test rax, rax
je 0x140009844
call rax
movzx r15d, al
jmp 0x140009850
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
setne r15b
test r15d, r15d
je 0x14000985c
test byte [rsp + 0x24], 2
je 0x14000987f
mov rax, qword [0x140013a48]
test rax, rax
je 0x1400098d5
cmp byte [0x140013a60], 0
jne 0x1400098d5
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x20]
call rax
jmp 0x1400098d5
mov rax, qword [0x140013a48]
test rax, rax
je 0x1400098a8
cmp byte [0x140013a60], 0
jne 0x1400098a8
mov r8d, 0x800
lea rdx, [rbp + 0x3c0]
lea rcx, [rsp + 0x20]
call rax
cmp word [rbp + 0x3c0], 0
jne 0x1400098c8
lea r8, [rsp + 0x20]
mov edx, 0x800
lea rcx, [rbp + 0x3c0]
call fcn.1400050b0
lea rcx, [rbp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test byte [rsp + 0x24], 4
jne 0x1400098e5
cmp byte [0x140013a40], 0
je 0x1400098f4
mov rax, qword [0x140013a88]
test rax, rax
je 0x1400098f4
call rax
nop
test byte [rsp + 0x24], 1
jne 0x140009921
mov rcx, qword [rbp + 0x13c0]
xor rcx, rsp
call fcn.14000a140
mov rbx, qword [rsp + 0x1510]
add rsp, 0x14d0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
lea rcx, [rsp + 0x20]
call fcn.140006a40
nop
call fcn.140006c90
nop
int3
Function at 0x1400096c0
Capabilities:
Print debug messages

Disassembly:
jmp 0x1400096c0
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x13d0]
mov eax, 0x14d0
call fcn.14000b0f0
sub rsp, rax
mov rax, qword [0x140012040]
xor rax, rsp
mov qword [rbp + 0x13c0], rax
mov esi, edx
mov r14, rcx
mov rdi, qword [rbp + 0x1428]
xor r15d, r15d
mov word [rbp + 0x3c0], r15w
mov byte [rbp - 0x40], r15b
mov r8, qword [rbp + 0x1430]
mov ecx, dword [r8]
mov dword [rsp + 0x28], ecx
mov eax, dword [r8 + 4]
mov dword [rsp + 0x2c], eax
call fcn.140005550
mov ebx, eax
mov edx, 1
mov dword [rsp + 0x20], edx
mov ecx, r15d
mov eax, 8
cmp dword [r8 + 8], edx
cmove ecx, eax
mov dword [rsp + 0x24], ecx
lock xadd dword [0x140013a20], edx
inc edx
mov dword [rsp + 0x30], edx
mov qword [rsp + 0x38], r15
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x40], eax
lea rax, [0x14000d400]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], esi
mov dword [rsp + 0x64], ebx
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x50], r15
mov qword [rbp - 0x58], rdi
mov qword [rbp - 0x50], r14
mov qword [rsp + 0x68], r15
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], rax
xorps xmm1, xmm1
movups xmmword [rsp + 0x70], xmm1
mov qword [rbp - 0x80], rax
mov rax, qword [0x140013ac0]
test rax, rax
je 0x1400097bb
call rax
mov qword [rbp - 0x60], rax
jmp 0x1400097bf
mov qword [rbp - 0x60], r15
mov rax, qword [0x140013a50]
test rax, rax
je 0x1400097d2
lea rcx, [rsp + 0x20]
call rax
mov rax, qword [0x140013a80]
test rax, rax
je 0x1400097ef
mov r8d, 0x400
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x20]
call rax
mov rax, qword [0x140013a78]
test rax, rax
je 0x140009802
lea rcx, [rsp + 0x20]
call rax
mov rax, qword [0x140013a98]
test rax, rax
je 0x14000981c
test byte [rsp + 0x24], 2
jne 0x14000981c
lea rcx, [rsp + 0x20]
call rax
cmp dword [rsp + 0x28], r15d
jge 0x14000992c
cmp byte [0x140013a30], r15b
jne 0x140009855
mov rax, qword [0x140013a28]
test rax, rax
je 0x140009844
call rax
movzx r15d, al
jmp 0x140009850
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
setne r15b
test r15d, r15d
je 0x14000985c
test byte [rsp + 0x24], 2
je 0x14000987f
mov rax, qword [0x140013a48]
test rax, rax
je 0x1400098d5
cmp byte [0x140013a60], 0
jne 0x1400098d5
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x20]
call rax
jmp 0x1400098d5
mov rax, qword [0x140013a48]
test rax, rax
je 0x1400098a8
cmp byte [0x140013a60], 0
jne 0x1400098a8
mov r8d, 0x800
lea rdx, [rbp + 0x3c0]
lea rcx, [rsp + 0x20]
call rax
cmp word [rbp + 0x3c0], 0
jne 0x1400098c8
lea r8, [rsp + 0x20]
mov edx, 0x800
lea rcx, [rbp + 0x3c0]
call fcn.1400050b0
lea rcx, [rbp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test byte [rsp + 0x24], 4
jne 0x1400098e5
cmp byte [0x140013a40], 0
je 0x1400098f4
mov rax, qword [0x140013a88]
test rax, rax
je 0x1400098f4
call rax
nop
test byte [rsp + 0x24], 1
jne 0x140009921
mov rcx, qword [rbp + 0x13c0]
xor rcx, rsp
call fcn.14000a140
mov rbx, qword [rsp + 0x1510]
add rsp, 0x14d0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
lea rcx, [rsp + 0x20]
call fcn.140006a40
nop
call fcn.140006c90
nop
int3
Function at 0x14000acd8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000ad22
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000ad22
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000ad22
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000ad22
cmp dword [rcx + 0x84], 0xe
jbe 0x14000ad22
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000ad24
xor al, al
add rsp, 0x28
ret
Function at 0x1417cd768
Capabilities:
Encode data using xor

Disassembly:
call fcn.1417adbde
mov dword [rdi], edx
lea rsp, [rsp + 0x10]
jmp fcn.1417c8006
call fcn.1417ab25e
mov dword [rsi], ecx
call fcn.1417c14e9
mov rdi, qword [rbp + riz]
push 0xffffffffc32f19ba
mov rax, qword [rbp + 8]
add rbp, 0x10
mov qword ss:[rdi], rax
lea rsp, [rsp + 8]
jmp 0x14179b97a
adc rbx, 0xc
xor edi, edi
test rdx, rdx
lea rsp, [rsp + 8]
je 0x1417aba2a
push r10
mov r11d, 0xe4a09d91
and r11b, r11b
lea r10, [r11 + r11*2 + 0x3aa8fe88]
lea r11, [0x1417b83a0]
mov r10d, 0x2fa2cc80
movzx r10d, byte [r9 + r10*2 - 0x5f459900]
push 0x6d3c74b6
xor r10d, edi
sar dword [rsp + 4], 0x61
and r10d, 0xff
mov r10d, dword [r11 + r10*4]
shr edi, 8
dec word [rsp + 1]
xor edi, r10d
inc r9
sar byte [rsp + 5], 0xe3
sal qword [rsp], 0x7a
xor qword [rsp], 0xf308f3e
xor edi, 0xc3a1d13f
push 0xffffffff9293f9bd
dec rdx
lea rsp, [rsp + 0x10]
jne 0x1417cd799
call fcn.1417aba20
mov edx, 0xe83db1b9
sub rbx, 2
movzx edx, word [rbx]
jmp 0x1417c31e0