joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404d89f4
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov rax, rsp
cmp r9w, di
push rbp
bts bp, r15w
push rbx
cmp r10d, 0x41027a0
sar bp, 0xd2
bt bx, 0xe4
push rsi
push rdi
movsx bx, r8b
push r14
xor bl, 0xe6
sub r14b, 0xe5
movsxd rbx, r14d
lea rbp, [rax - 0x37]
sub rsp, 0xf0
shl r14, 0xfa
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x1400b7288]
bt r14w, ax
test r13b, spl
jmp 0x1404d8a4d
xor rax, rsp
mov qword [rbp - 0x11], rax
mov si, 0x620f
movsxd rsi, esp
mov esi, edx
cdq
cwd
mov r14, rcx
movsxd rdi, ebp
mov edx, 0xffc0
setg bl
movsx rcx, si
movsxd rdi, r10d
mov ecx, 0x1f80
mov edi, 0x5ea01929
movsx ebx, di
movzx edi, r15w
mov edi, r9d
movzx rbx, bp
movsx ebx, r15w
mov rbx, r8
jmp 0x1404d8a99
call fcn.1404d3c99
mov ecx, dword [rbp + 0x5f]
mov qword [rsp + 0x48], rax
setbe dl
mov dword [rsp + 0x50], ebx
jmp 0x1404d8aba
movss xmm0, dword [rsp + 0x50]
movsxd rdx, r10d
mov rdx, qword [rsp + 0x48]
jmp 0x1404d8acd
movss dword [rsp + 0x40], xmm0
jmp 0x1404d8ad8
call fcn.1404d8899
movss xmm6, dword [rbp + 0x77]
cmp r10b, r15b
test eax, eax
jne 0x1404d8b73
cmp dword [rbp + 0x7f], 2
jmp 0x1404d8af6
jne 0x1404d8b30
mov eax, dword [rbp - 0x41]
ror cx, 8
and eax, 0xffffffe1
cmp sil, 0x1a
cmc
movss dword [rbp - 0x51], xmm6
btc r9w, si
movzx ecx, r15w
sub cl, r10b
or eax, 1
not r8b
bswap r9w
mov dword [rbp - 0x41], eax
cdq
movzx r8, r14w
rdtsc
mov r8d, dword [rbp + 0x5f]
movsxd r9, r13d
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
not ch
mov edx, esp
rdtsc
lea rdx, [rsp + 0x48]
lea rax, [rbp + 0x6f]
movsxd rcx, r15d
cmovne r9w, r15w
movzx cx, dl
mov r9d, esi
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rax
jmp 0x1404d8b6e
call fcn.1404d631c
call fcn.1401d95b8
test al, al
jmp 0x1404d8b7f
je 0x1404d8beb
test edi, edi
jmp 0x1404d8b8c
je 0x1404d8beb
movss xmm0, dword [rsp + 0x40]
cdq
rdtsc
mov r8, r14
movss xmm3, dword [rbp + 0x6f]
movsx ecx, r15w
mov ecx, edi
mov rax, qword [rsp + 0x48]
cqo
movzx edx, r8w
xchg dl, dl
mov edx, dword [rbp + 0x67]
mov qword [rsp + 0x30], rax
jmp 0x1404d8bc3
cvtps2pd xmm0, xmm0
cvtps2pd xmm1, xmm6
movsd qword [rsp + 0x28], xmm0
cvtps2pd xmm3, xmm3
movsd qword [rsp + 0x20], xmm1
jmp 0x1404d8bdd
call fcn.1404d87df
cvtsd2ss xmm0, xmm0
jmp 0x1404d8c21
mov ecx, edi
jmp 0x1404d8bf2
call fcn.1404d5e4b
mov rcx, qword [rsp + 0x48]
jmp 0x1404d8c09
mov edx, 0xffc0
jmp 0x1404d8c13
call fcn.1404d3c99
movss xmm0, dword [rsp + 0x40]
rol cl, 0xf7
mov rcx, qword [rbp - 0x11]
xor rcx, rsp
jmp 0x1404d8c2d
call fcn.1404988af
movaps xmm6, xmmword [rsp + 0xe0]
btc r14d, esi
add rsp, 0xf0
mov dil, 0x7b
movzx rdi, r13w
movzx ebx, sp
pop r14
pop rdi
movsxd rsi, r13d
movzx ebp, r15w
pop rsi
movsx bp, r13b
pop rbx
movzx bp, r15b
not bpl
jmp 0x1404d8c6d
pop rbp
ret
Function at 0x1404d9048
Capabilities:
Get thread local storage value

Disassembly:
push rbx
cmp rbx, rdx
bt r8w, 0x25
ror dh, 0xd2
sub rsp, 0x20
cwd
jmp 0x1404d9061
mov ebx, ecx
lea r9, [0x1400c8ea0]
not r8b
mov ecx, 2
cqo
cdq
jmp 0x1404d907a
lea r8, [0x1400c8e98]
lea rdx, [0x1400cf758]
jmp 0x1404d908d
call fcn.1404d923c
mov ecx, ebx
test rax, rax
jmp 0x1404d909c
je 0x1404d90b3
add rsp, 0x20
mov bl, r14b
not bh
pop rbx
jmp qword [case.0x140441677.0]
add rsp, 0x20
setae bh
movsxd rbx, ebx
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1404d90c5
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
sub rbx, 0x4ac5f4a
push rdi
movsxd rdi, ebx
bt edi, 0x6c
neg r8b
sub rsp, 0x20
movzx r8w, r13b
not bx
xchg dil, bl
mov rbx, rdx
not r9w
lea r9, [0x1400c8ea8]
setp r8b
bswap r8
mov edi, ecx
jmp 0x1404d9109
lea rdx, [0x1400cf748]
mov ch, 0x71
mov ecx, 3
lea r8, [0x1400c8ea0]
call fcn.1404d923c
mov rdx, rbx
rcr cx, 0x65
cmp cl, r8b
mov ecx, edi
test cl, dil
test bp, 0x455d
test rax, rax
jmp 0x1404d9140
je 0x1404d9151
call qword [case.0x140441677.0]
jmp 0x1404d9157
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
or di, 0x48b5
add rsp, 0x20
not di
pop rdi
jmp 0x1404d916e
ret
Function at 0x1404da365
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
stc
cmc
cmp r12, rax
mov qword [rsp + 0x18], rbp
push rdi
push r12
test r12b, dil
sar bp, cl
and bpl, 0xe7
push r13
push r14
movzx r14w, al
ror edi, cl
push r15
sub rsp, 0x20
add rdi, 0x208b512e
rcr r15w, 0x91
cmp bpl, al
mov rdi, qword [rdx]
shld r14d, eax, 0xf0
movzx ebp, di
sub r13d, r13d
neg r14d
cmp esp, r10d
and r15b, r10b
mov r12, r9
mov rbp, r8
sbb r15b, dil
mov r14, rdx
dec r15
and r15w, r9w
mov r15, rcx
stc
test r15b, 0x34
jmp 0x1404da3d8
test rcx, rcx
jmp 0x1404da3e0
je 0x1404da5c4
mov rbx, rcx
jmp 0x1404da3f2
test r8, r8
je 0x1404da532
cmp byte [rdi], r13b
jmp 0x1404da403
jne 0x1404da419
mov r8d, 1
jmp 0x1404da414
jmp 0x1404da454
cmp byte [rdi + 1], r13b
jmp 0x1404da422
jne 0x1404da438
mov r8d, 2
jmp 0x1404da433
jmp 0x1404da454
mov al, byte [rdi + 2]
neg al
movsx r9, si
sbb r8, r8
movzx edx, cx
cmovbe r9, r8
neg r8
add r8, 3
not cl
mov r9, r12
setb dh
cwd
movzx cx, r11b
lea rcx, [rsp + 0x50]
movsx edx, bx
mov rdx, rdi
call fcn.1404df202
mov rdx, rax
cmc
test dh, 0x28
cmp rax, 0xffffffffffffffff
je 0x1404da55b
test rax, rax
je 0x1404da54a
mov ecx, dword [rsp + 0x50]
clc
cmp ecx, 0xffff
jmp 0x1404da49b
jbe 0x1404da513
cmp rbp, 1
jmp 0x1404da4aa
jbe 0x1404da532
add ecx, 0xffff0000
movzx r8w, r14b
mov r8d, 0xd800
shrd eax, edi, 0x73
nop
and al, 0x72
mov eax, ecx
clc
test r9w, 0x5127
mov dword [rsp + 0x50], ecx
stc
shr eax, 0xa
jmp 0x1404da4df
dec rbp
jmp 0x1404da4ec
or ax, r8w
clc
cmc
mov word [rbx], ax
adc al, r9b
mov eax, 0x3ff
and cx, ax
add rbx, 2
mov eax, 0xdc00
test r12b, 0x2e
cmp r11b, al
or cx, ax
mov word [rbx], cx
lea rdi, [rdi + rdx]
stc
add rbx, 2
cmc
cmp r10b, r12b
sub rbp, 1
jmp 0x1404da52c
jne 0x1404da3fb
sub rbx, r15
btr rax, 0xe2
not ah
mov qword [r14], rdi
sar rbx, 1
mov rax, rbx
jmp 0x1404da578
mov rdi, r13
mov word [rbx], r13w
jmp 0x1404da556
jmp 0x1404da532
mov qword [r14], rdi
jmp 0x1404da563
call fcn.1404ae0f9
mov dword [rax], 0x2a
dec bpl
cmp dh, 0x73
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x58]
movzx edi, si
xor r12b, 0x68
sub r13w, 0x42df
mov rbp, qword [rsp + 0x60]
sbb r15w, r15w
sbb r15w, 0x226c
add rsp, 0x20
mov di, 0x766c
pop r15
mov di, 0xd4
movsxd r14, r10d
movsx r12w, spl
pop r14
bswap r13
pop r13
pop r12
xchg edi, edi
movsx edi, bx
pop rdi
jmp 0x1404da5c3
ret
mov rbx, r13
test sil, 0x6f
cmp byte [rdi], r13b
jne 0x1404da5e4
mov r8d, 1
jmp 0x1404da5df
jmp 0x1404da610
cmp byte [rdi + 1], r13b
jne 0x1404da5f9
mov r8d, 2
jmp 0x1404da610
mov al, byte [rdi + 2]
neg al
sbb r8, r8
bsf dx, si
movsx rdx, r13w
neg r8
add r8, 3
mov r9, r12
and dx, 0x1d2f
rcl dx, cl
mov rdx, rdi
sub ecx, ecx
jmp 0x1404da625
call fcn.1404df202
cmp rax, 0xffffffffffffffff
je 0x1404da563
test rax, rax
jmp 0x1404da63c
je 0x1404da542
cmp rax, 4
jne 0x1404da654
inc rbx
jmp 0x1404da654
add rdi, rax
jmp 0x1404da65c
inc rbx
jmp 0x1404da664
jmp 0x1404da5cb
Function at 0x1404da7cf
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
sub r9d, r9d
add r8w, bp
btc r8w, 0x90
shld r8d, r15d, 0x15
mov r8, rcx
cmp r8b, 0xea
clc
test edx, edx
jmp 0x1404da7f5
jne 0x1404da864
mov rdx, rcx
cmc
and r8d, 0xf
cmc
and rdx, 0xfffffffffffffff0
or r10d, 0xffffffff
xorps xmm0, xmm0
mov ecx, r8d
jmp 0x1404da818
shl r10d, cl
jmp 0x1404da820
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
and eax, r10d
jmp 0x1404da830
jne 0x1404da852
add rdx, 0x10
jmp 0x1404da83f
xorps xmm0, xmm0
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
test eax, eax
je 0x1404da836
bsf eax, eax
cmp dh, bh
add rax, rdx
jmp 0x1404da85f
jmp 0x1404da9a1
cmp dword [reloc.d2d1.dll_Ordinal_1], 2
jge 0x1404da9c7
movzx eax, dl
or r10d, 0xffffffff
test r14, 0x1ceb3174
xor r11w, 0x6e32
mov ecx, eax
or r11d, r8d
shld r11, r15, 8
add r11b, 0xaf
mov r11, r8
cmp dl, r10b
cmc
shl ecx, 8
cmc
clc
and r11, 0xfffffffffffffff0
jmp 0x1404da8a8
or ecx, eax
not eax
sets ah
and r8d, 0xf
movzx rax, dx
jmp 0x1404da8bc
mov eax, r10d
jmp 0x1404da8c4
movd xmm0, ecx
mov ecx, r8d
jmp 0x1404da8d0
pshuflw xmm1, xmm0, 0
xorps xmm0, xmm0
pcmpeqb xmm0, xmmword [r11]
pmovmskb ebx, xmm0
shl r10d, cl
jmp 0x1404da8e9
pshufd xmm2, xmm1, 0
movdqa xmm0, xmm2
shl eax, cl
jmp 0x1404da8f9
pcmpeqb xmm0, xmmword [r11]
pmovmskb edx, xmm0
and edx, r10d
test r13b, r14b
and ebx, eax
jmp 0x1404da90f
jne 0x1404da95e
bsr ecx, edx
xorps xmm1, xmm1
movdqa xmm0, xmm2
add rcx, r11
cmp r8, r15
test edx, edx
jmp 0x1404da92c
cmovne r9, rcx
cmp bx, 0x2732
cmc
add r11, 0x10
jmp 0x1404da93f
pcmpeqb xmm1, xmmword [r11]
pcmpeqb xmm0, xmmword [r11]
pmovmskb ebx, xmm1
pmovmskb edx, xmm0
test ebx, ebx
jmp 0x1404da958
je 0x1404da915
mov eax, ebx
sub cl, r11b
neg eax
bsf rcx, r9
sbb cl, r11b
and eax, ebx
setle cl
movzx rcx, r14w
dec eax
sub bl, spl
and edx, eax
bsr ecx, edx
cwde
add rcx, r11
test edx, edx
mov ebx, 0x5ea5a2e
mov rax, r14
cmovne r9, rcx
mov ax, bx
cmovne rax, r15
mov rax, r9
movzx rbx, r13w
xchg bl, bh
mov rbx, qword [rsp + 8]
jmp 0x1404da9ab
ret
movsx eax, byte [r8]
cmp eax, edx
cmove r9, r8
cmp r15d, r13d
clc
cmp byte [r8], 0
je 0x1404da998
inc r8
test r8b, 0xf
jmp 0x1404da9d0
jne 0x1404da9ac
movzx eax, dl
movd xmm0, eax
pcmpistri xmm0, xmmword [r8], 0x40
jae 0x1404da9fb
movsxd r9, ecx
stc
test bl, r14b
add r9, r8
pcmpistri xmm0, xmmword [r8], 0x40
je 0x1404da998
add r8, 0x10
jmp 0x1404da9dd
Function at 0x140003c30
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 0
mov qword [rbp + 0x3d0], 2
mov qword [rbp + 0x3d8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor ebx, ebx
xor edi, edi
xor r12d, r12d
cmp r8, 0x201
jae 0x140003cd0
jmp 0x140003cbf
jae 0x140003d90
cmp r8, 0x201
jae 0x140003cd0
mov esi, 0x200
lea r13, [rbp - 0x58]
mov r15, r8
jmp 0x140003d28
sub r8, r12
sub rdi, r12
cmp rdi, r8
jae 0x140003cff
lea rcx, [rbp + 0x3c8]
mov rdx, r12
call fcn.140017e60
mov rbx, qword [rbp + 0x3c8]
mov rax, qword [rbp + 0x3d0]
mov qword [rbp + 0x3e8], rax
mov eax, 0xffffffff
cmp rbx, rax
mov r12d, 0xffffffff
cmovb r12, rbx
mov qword [rbp + 0x3d8], r12
mov rdi, rbx
mov rsi, r12
mov r13, qword [rbp + 0x3e8]
mov r15, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r15d
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x140003d51
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140003df8
mov r8d, r14d
cmp r15, r8
jne 0x140003cb0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140003e25
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x140003cbf
jmp 0x140003cd0
cmp rsi, r8
jb 0x140003e3f
lea rcx, [rbp + 0x3a8]
mov rdx, r13
call fcn.140004f30
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rbx, rbx
je 0x140003de1
add rbx, rbx
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rbx
call fcn.140001600
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
test rbx, rbx
jne 0x140003dc9
jmp 0x140003de1
lea rcx, str.internal_error:_entered_unreachable_code_rustc_07dca489ac2d933c78d3c5158e3f43beefeb02celibrary_alloc_src_vecmod.rs
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.1400186a0
jmp 0x140003e54
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.140018af0
ud2
Function at 0x1400090a0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0xe0]
movups xmm0, xmmword [0x14001aca0]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
test rcx, rcx
je 0x1400090e4
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rdx
test rcx, rcx
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x80]
cmove rdx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x14000914a
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x140009181
test eax, eax
js 0x14000915b
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x140009174
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.140004d00
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
call fcn.140001e60
mov ecx, 7
int 0x29
ud2
Function at 0x1400162b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x14001632a
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x140016320
cmp r11, r10
ja 0x1400163c1
cmp r10, rdx
ja 0x1400163d3
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x140016322
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x140016300
jmp 0x140016397
ja 0x14001632a
mov r11, r10
cmp rax, r8
jne 0x1400162d2
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x14001639b
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x140016370
mov r8, r10
sub ecx, r9d
jns 0x14001638e
jmp 0x14001639d
cmp r10, rdx
je 0x1400163a9
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x14001639d
xor al, 1
cmp r8, rdx
jne 0x140016350
jmp 0x14001639d
xor eax, eax
jmp 0x14001639d
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x14001c88b]
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.1400186a0
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.140018b70
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.140018af0
int3

Function at 0x1400178e4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001792e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001792e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001792e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001792e
cmp dword [rcx + 0x84], 0xe
jbe 0x14001792e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140017930
xor al, al
add rsp, 0x28
ret
Function at 0x140001154
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x10], 0
mov dword [rbp - 0x1c], 0x30
mov eax, dword [rbp - 0x1c]
mov rax, qword gs:[rax]
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
mov rax, qword [rax + 8]
mov qword [rbp - 0x18], rax
mov dword [rbp - 4], 0
jmp 0x1400011ac
mov rax, qword [rbp - 0x10]
cmp rax, qword [rbp - 0x18]
jne 0x14000119e
mov dword [rbp - 4], 1
jmp 0x1400011e3
mov ecx, 0x3e8
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov rax, qword [0x140115490]
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x40], 0
mov rcx, qword [rbp - 0x38]
mov rax, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x30]
lock cmpxchg qword [rdx], rcx
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x14000118b
mov rax, qword [0x1401154a0]
mov eax, dword [rax]
cmp eax, 1
jne 0x1400011fd
mov ecx, 0x1f
call fcn.1400f7280
jmp 0x14000123c
mov rax, qword [0x1401154a0]
mov eax, dword [rax]
test eax, eax
jne 0x140001232
mov rax, qword [0x1401154a0]
mov dword [rax], 1
mov rax, qword [0x1401154e0]
mov rdx, rax
mov rax, qword [0x1401154d0]
mov rcx, rax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
jmp 0x14000123c
mov dword [0x140119024], 1
mov rax, qword [0x1401154a0]
mov eax, dword [rax]
cmp eax, 1
jne 0x140001270
mov rax, qword [0x1401154c0]
mov rdx, rax
mov rax, qword [0x1401154b0]
mov rcx, rax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
mov rax, qword [0x1401154a0]
mov dword [rax], 2
cmp dword [rbp - 4], 0
jne 0x140001294
mov rax, qword [0x140115490]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], 0
mov rdx, qword [rbp - 0x50]
mov rax, qword [rbp - 0x48]
xchg qword [rax], rdx
mov rax, qword [0x1401153e0]
mov rax, qword [rax]
test rax, rax
je 0x1400012bf
mov rax, qword [0x1401153e0]
mov rax, qword [rax]
mov r8d, 0
mov edx, 2
mov ecx, 0
call rax
call fcn.1400f6508
mov rax, qword [0x140115520]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call rax
mov rdx, qword [0x140115480]
mov qword [rdx], rax
lea rax, section..text
mov rcx, rax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__set_invalid_parameter_handler
call fcn.1400f5d00
mov eax, dword [0x140119004]
lea rdx, [0x140119008]
mov ecx, eax
call fcn.14000147c
call fcn.1400f5a97
mov rax, qword [0x140115410]
mov rax, qword [rax]
mov rdx, qword [0x140119010]
mov qword [rax], rdx
mov rcx, qword [0x140119010]
mov rdx, qword [0x140119008]
mov eax, dword [0x140119004]
mov r8, rcx
mov ecx, eax
call fcn.1400016d0
mov dword [0x14011901c], eax
mov eax, dword [0x140119020]
test eax, eax
jne 0x14000135d
mov eax, dword [0x14011901c]
mov ecx, eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
mov eax, dword [0x140119024]
test eax, eax
jne 0x14000136c
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
mov eax, dword [0x14011901c]
add rsp, 0x70
pop rbp
ret
Function at 0x1400f5d10
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.1400f7070
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x1400f69e2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x140119168]
test eax, eax
je 0x1400f6a7a
lea rax, [0x140119140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x140119170]
mov qword [rbp - 8], rax
jmp 0x1400f6a5e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x1400f6a52
cmp qword [rbp - 0x10], 0
je 0x1400f6a52
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x1400f6a18
lea rax, [0x140119140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x1400f6a7b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x1400f6b80
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400f6ba8
mov eax, 0
jmp 0x1400f6bf6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400f6bd1
mov eax, 0
jmp 0x1400f6bf6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x1400f6bf1
mov eax, 0
jmp 0x1400f6bf6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x1400f6bfc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x1400f6c7a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x1400f6c71
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x1400f6c71
mov rax, qword [rbp - 8]
jmp 0x1400f6c8f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x1400f6c44
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140004450]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x140004460]
mov dword [rax], 1
mov rax, qword [0x140004470]
mov dword [rax], 1
mov rax, qword [0x1400043f0]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x140004440]
mov dword [0x14000700c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x140004520]
mov edx, dword [rdx]
mov dword [rax], edx
call sym.__p__commode
mov rdx, qword [0x140004500]
mov edx, dword [rdx]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x1400043a0]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [sym._matherr]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a

Function at 0x140001760
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop dword [rax]