joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001f90
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001fda
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001fda
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001fda
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001fda
cmp dword [rcx + 0x84], 0xe
jbe 0x140001fda
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001fdc
xor al, al
add rsp, 0x28
ret