joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000328a
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
cmp qword [0x1400150e8], 0
jne 0x1400032a0
add rsp, 0x40
pop rbx
jmp fcn.14000324b
lea rbx, [rsp + 0x30]
mov rdx, rcx
mov rcx, rbx
call fcn.1400031c4
movaps xmm0, xmmword [rsp + 0x30]
lea rcx, [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm0
call qword [0x1400150e8]
mov rcx, rbx
call fcn.140002143
cmp byte [0x1400150c0], 0
je 0x1400032f9
mov rax, qword [0x1400150f0]
lea rcx, [0x1400150f0]
mov byte [0x1400150c0], 0
mov rdx, qword [rax + 0x38]
add rsp, 0x40
pop rbx
jmp fcn.140002515
add rsp, 0x40
pop rbx
ret

Function at 0x1400033d8
Capabilities:
Terminate process

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [sym.imp.ucrtbase.dll___acrt_iob_func]
lea rsi, [0x14000f37f]
mov rbp, qword [rcx]
mov rdi, qword [rcx + 8]
mov ecx, 2
call rbx
lea rdx, str.could_not_load:
mov rcx, rax
call fcn.1400020e0
test rbp, rbp
je 0x140003414
lea rsi, [rdi + 8]
mov ecx, 2
call rbx
mov rdx, rsi
mov rcx, rax
call fcn.1400020e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xc1
jne 0x140003449
mov ecx, 2
call rbx
lea rdx, str._n_bad_format__library_may_be_wrong_architecture_
mov rcx, rax
call fcn.1400020e0
mov ecx, 2
call rbx
lea rdx, [0x14000f3c2]
mov rcx, rax
call fcn.1400020e0
mov ecx, 1
call sub.ucrtbase.dll_exit
nop

Function at 0x14000346a
Capabilities:
Terminate process

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov rsi, rcx
mov ecx, 2
call rbx
lea rdx, str.could_not_import:
mov rcx, rax
call fcn.1400020e0
mov ecx, 2
call rbx
mov rdx, rsi
mov rcx, rax
call fcn.1400020e0
mov ecx, 2
call rbx
lea rdx, [0x14000f3c2]
mov rcx, rax
call fcn.1400020e0
mov ecx, 1
call sub.ucrtbase.dll_exit
nop
Function at 0x140003c5d
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
cmp byte [0x1400150c0], 0
je 0x140003c94
mov rcx, qword [0x1400150f0]
test rcx, rcx
je 0x140003c94
call fcn.140003c38
lea rcx, [0x1400150f0]
xor edx, edx
call fcn.14000231d
mov ecx, 1
call sub.ucrtbase.dll_exit
nop
add rsp, 0x28
ret
push rbx
sub rsp, 0x30
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.14000361b
movups xmm0, xmmword [rsp + 0x20]
movaps xmmword [0x1400154c0], xmm0
call fcn.140005028
mov rbx, qword [0x1400104f0]
cmp byte [rbx], 0
jne 0x140005b52
movabs rax, 0xc0e8f0e48348fc
lea rcx, [0x1400153a0]
mov qword [0x1400153a0], rax
movabs rax, 0x5152504151410000
mov qword [0x1400153a8], rax
movabs rax, 0x528b4865d2314856
mov qword [0x1400153b0], rax
movabs rax, 0x528b4818528b4860
mov qword [0x1400153b8], rax
movabs rax, 0xb70f4850728b4820
mov qword [0x1400153c0], rax
movabs rax, 0xc03148c9314d4a4a
mov qword [0x1400153c8], rax
movabs rax, 0x41202c027c613cac
mov qword [0x1400153d0], rax
movabs rax, 0xede2c101410dc9c1
mov qword [0x1400153d8], rax
movabs rax, 0x8b20528b48514152
mov qword [0x1400153e0], rax
movabs rax, 0x88808bd001483c42
mov qword [0x1400153e8], rax
movabs rax, 0x6774c08548000000
mov qword [0x1400153f0], rax
movabs rax, 0x4418488b50d00148
mov qword [0x1400153f8], rax
movabs rax, 0x56e3d0014920408b
mov qword [0x140015400], rax
movabs rax, 0x4888348b41c9ff48
mov qword [0x140015408], rax
movabs rax, 0xc03148c9314dd601
mov qword [0x140015410], rax
movabs rax, 0xc101410dc9c141ac
mov qword [0x140015418], rax
movabs rax, 0x244c034cf175e038
mov qword [0x140015420], rax
movabs rax, 0x4458d875d1394508
mov qword [0x140015428], rax
movabs rax, 0x4166d0014924408b
mov qword [0x140015430], rax
movabs rax, 0x491c408b44480c8b
mov qword [0x140015438], rax
movabs rax, 0x14888048b41d001
mov qword [0x140015440], rax
movabs rax, 0x5a595e58415841d0
mov qword [0x140015448], rax
movabs rax, 0x83485a4159415841
mov qword [0x140015450], rax
movabs rax, 0x4158e0ff524120ec
mov qword [0x140015458], rax
movabs rax, 0xff57e9128b485a59
mov qword [0x140015460], rax
movabs rax, 0x1ba485dffff
mov qword [0x140015468], rax
mov eax, 0x11b1a9
shl rax, 0x2b
mov qword [0x140015470], rax
movabs rax, 0x8b31ba4100000101
mov qword [0x140015478], rax
movabs rax, 0xa2b5f0bbd5ff876f
mov qword [0x140015480], rax
movabs rax, 0xff9dbd95a6ba4156
mov qword [0x140015488], rax
movabs rax, 0x7c063c28c48348d5
mov qword [0x140015490], rax
movabs rax, 0x47bb0575e0fb800a
mov qword [0x140015498], rax
movabs rax, 0x894159006a6f7213
mov qword [0x1400154a0], rax
movabs rax, 0x2e636c6163d5ffda
mov qword [0x1400154a8], rax
mov dword [0x1400154b0], 0x657865
call fcn.1400053cf
cmp byte [rbx], 0
jne 0x140005b52
lea rcx, [0x1400154c0]
call fcn.1400037c2
nop
add rsp, 0x30
pop rbx
jmp 0x140003c5d
sub rsp, 0x28
call fcn.140005893
nop
add rsp, 0x28
jmp 0x1400058b7
Function at 0x140005028
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
xor esi, esi
lea rdi, str.ntdll.dll
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rbx, qword [rax + 0x10]
xor eax, eax
mov rbp, qword [rbx + 0x30]
test rbp, rbp
je 0x1400050b9
movsxd rax, dword [rbp + 0x3c]
add rax, rbp
jo 0x140005076
movsxd rax, dword [rax + 0x88]
test eax, eax
je 0x140005099
add rax, rbp
jno 0x14000508b
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.1400021b0
movsxd rcx, dword [rax + 0xc]
mov rsi, rax
add rcx, rbp
jno 0x1400050a1
jmp 0x140005076
mov rbx, qword [rbx]
mov rax, rbp
jmp 0x140005054
cmp rcx, rdi
je 0x1400050bc
test rcx, rcx
je 0x14000509c
mov rdx, rdi
call sub.ucrtbase.dll_strcmp
test eax, eax
jne 0x14000509c
jmp 0x1400050bc
mov rbp, rax
movsxd rdi, dword [rsi + 0x1c]
mov r14d, dword [rsi + 0x18]
add rdi, rbp
jo 0x140005076
movsxd rax, dword [rsi + 0x20]
add rax, rbp
jo 0x140005076
movsxd rsi, dword [rsi + 0x24]
mov ebx, dword [rax]
add rsi, rbp
jo 0x140005076
mov r13, qword [0x1400104f0]
xor r12d, r12d
mov r15d, 0x80000000
cmp r12d, r14d
jle 0x140005136
xor eax, eax
mov r9d, 1
lea r8, [rsp + 0x50]
mov rdx, qword [0x1400154c0]
mov qword [rsp + 0x68], rax
lea rax, [0x140004f40]
mov qword [rsp + 0x60], rax
mov rax, qword [0x1400154c8]
movaps xmm1, xmmword [rsp + 0x60]
lea rcx, [rax + 8]
movaps xmmword [rsp + 0x50], xmm1
call fcn.1400041ab
jmp 0x14000520a
movsxd rdx, ebx
mov rax, rbp
add rax, rdx
mov qword [rsp + 0x28], rax
jo 0x140005076
mov bx, word [rsi]
cmp byte [r13], 0
mov word [rsp + 0x36], bx
jne 0x14000520a
test rax, rax
je 0x140005174
mov rcx, rax
mov qword [rsp + 0x38], rdx
call sub.ucrtbase.dll_strlen
mov rdx, qword [rsp + 0x38]
lea rbx, [rax + 1]
mov ecx, 0xffffffff
movsxd rbx, ebx
add rbx, rdx
lea rax, [rbx + r15]
cmp rcx, rax
jb 0x140005076
mov rcx, qword [rsp + 0x28]
lea rdx, [0x14000fa6a]
add rsi, 2
call fcn.140003e30
cmp byte [r13], 0
jne 0x14000520a
test al, al
je 0x1400051f5
mov rcx, qword [rsp + 0x28]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x60], xmm0
call fcn.140004fe3
cmp byte [r13], 0
jne 0x14000520a
movzx edx, word [rsp + 0x36]
mov qword [rsp + 0x60], rax
lea rcx, [0x1400154c0]
mov edx, dword [rdi + rdx*4]
mov dword [rsp + 0x68], edx
movaps xmm2, xmmword [rsp + 0x60]
lea rdx, [rsp + 0x40]
movaps xmmword [rsp + 0x40], xmm2
call fcn.14000364a
cmp r12d, 0x7fffffff
je 0x140005076
inc r12d
jmp 0x1400050ed
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14000521b
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
xor eax, eax
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x40], rax
lea rdi, [rsp + 0x40]
mov qword [rsp + 0x48], rax
call fcn.140004e96
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [0x1400104f0]
cmp byte [rsi], 0
jne 0x1400052b8
mov qword [rsp + 0x40], rax
dec rax
mov qword [rsp + 0x48], rbx
jle 0x14000531a
cmp qword [rbx + 8], 5
jne 0x14000531a
mov rax, qword [rbx + 0x10]
mov r8d, 5
lea rdx, [0x14000fbd8]
lea rcx, [rax + 8]
call sub.ucrtbase.dll_memcmp
test eax, eax
jne 0x14000531a
movups xmm0, xmmword [rbx + 0x18]
lea rcx, [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm0
call fcn.140004602
cmp byte [rsi], 0
mov rbx, rax
jne 0x1400052b8
mov rcx, rdi
call fcn.1400037d7
jmp 0x140005321
mov rcx, rdi
xor ebx, ebx
call fcn.1400037d7
cmp byte [rsi], 0
je 0x140005321
mov rax, qword [0x1400104e0]
mov rax, qword [rax]
mov rax, qword [rax]
mov rdi, qword [rax + 0x18]
test rdi, rdi
je 0x140005321
mov rcx, rdi
call sub.ucrtbase.dll_strlen
cmp rax, 0x2c
jbe 0x140005321
lea rcx, [rdi + rax - 0x2d]
mov r8d, 0x2d
lea rdx, str.ValueErrorCatchableErrorExceptionRootObj
call sub.ucrtbase.dll_memcmp
test eax, eax
jne 0x140005321
mov edx, 1
lea rcx, [0x14000fb90]
mov byte [rsi], 0
call fcn.140001f44
xor ecx, ecx
call sub.ucrtbase.dll_exit
mov rax, rbx
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret

Function at 0x14000532c
Capabilities:
Execute syscall

Disassembly:
push rcx
push rdx
push r8
push r9
sub rsp, 0x20
mov rcx, 0xdc07230
call fcn.140004f52
add rsp, 0x20
pop r9
pop r8
pop rdx
pop rcx
mov r10, rcx
syscall
ret

Function at 0x140005354
Capabilities:
Execute syscall

Disassembly:
push rcx
push rdx
push r8
push r9
sub rsp, 0x20
mov rcx, 0x2421bd37
call fcn.140004f52
add rsp, 0x20
pop r9
pop r8
pop rdx
pop rcx
mov r10, rcx
syscall
ret

Function at 0x14000537c
Capabilities:
Execute syscall

Disassembly:
push rcx
push rdx
push r8
push r9
sub rsp, 0x20
mov rcx, 0xd0d9f24
call fcn.140004f52
add rsp, 0x20
pop r9
pop r8
pop rdx
pop rcx
mov r10, rcx
syscall
ret

Function at 0x1400053a4
Capabilities:
Execute syscall

Disassembly:
push rcx
push rdx
push r8
push r9
sub rsp, 0x20
movabs rcx, 0xdb05a7f6
call fcn.140004f52
add rsp, 0x20
pop r9
pop r8
pop rdx
pop rcx
mov r10, rcx
syscall
ret
Function at 0x1400058b7
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
cmp byte [0x1400150c0], 0
je 0x140003c94
mov rcx, qword [0x1400150f0]
test rcx, rcx
je 0x140003c94
call fcn.140003c38
lea rcx, [0x1400150f0]
xor edx, edx
call fcn.14000231d
mov ecx, 1
call sub.ucrtbase.dll_exit
nop
add rsp, 0x28
ret
push rbx
sub rsp, 0x30
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.14000361b
movups xmm0, xmmword [rsp + 0x20]
movaps xmmword [0x1400154c0], xmm0
call fcn.140005028
mov rbx, qword [0x1400104f0]
cmp byte [rbx], 0
jne 0x140005b52
movabs rax, 0xc0e8f0e48348fc
lea rcx, [0x1400153a0]
mov qword [0x1400153a0], rax
movabs rax, 0x5152504151410000
mov qword [0x1400153a8], rax
movabs rax, 0x528b4865d2314856
mov qword [0x1400153b0], rax
movabs rax, 0x528b4818528b4860
mov qword [0x1400153b8], rax
movabs rax, 0xb70f4850728b4820
mov qword [0x1400153c0], rax
movabs rax, 0xc03148c9314d4a4a
mov qword [0x1400153c8], rax
movabs rax, 0x41202c027c613cac
mov qword [0x1400153d0], rax
movabs rax, 0xede2c101410dc9c1
mov qword [0x1400153d8], rax
movabs rax, 0x8b20528b48514152
mov qword [0x1400153e0], rax
movabs rax, 0x88808bd001483c42
mov qword [0x1400153e8], rax
movabs rax, 0x6774c08548000000
mov qword [0x1400153f0], rax
movabs rax, 0x4418488b50d00148
mov qword [0x1400153f8], rax
movabs rax, 0x56e3d0014920408b
mov qword [0x140015400], rax
movabs rax, 0x4888348b41c9ff48
mov qword [0x140015408], rax
movabs rax, 0xc03148c9314dd601
mov qword [0x140015410], rax
movabs rax, 0xc101410dc9c141ac
mov qword [0x140015418], rax
movabs rax, 0x244c034cf175e038
mov qword [0x140015420], rax
movabs rax, 0x4458d875d1394508
mov qword [0x140015428], rax
movabs rax, 0x4166d0014924408b
mov qword [0x140015430], rax
movabs rax, 0x491c408b44480c8b
mov qword [0x140015438], rax
movabs rax, 0x14888048b41d001
mov qword [0x140015440], rax
movabs rax, 0x5a595e58415841d0
mov qword [0x140015448], rax
movabs rax, 0x83485a4159415841
mov qword [0x140015450], rax
movabs rax, 0x4158e0ff524120ec
mov qword [0x140015458], rax
movabs rax, 0xff57e9128b485a59
mov qword [0x140015460], rax
movabs rax, 0x1ba485dffff
mov qword [0x140015468], rax
mov eax, 0x11b1a9
shl rax, 0x2b
mov qword [0x140015470], rax
movabs rax, 0x8b31ba4100000101
mov qword [0x140015478], rax
movabs rax, 0xa2b5f0bbd5ff876f
mov qword [0x140015480], rax
movabs rax, 0xff9dbd95a6ba4156
mov qword [0x140015488], rax
movabs rax, 0x7c063c28c48348d5
mov qword [0x140015490], rax
movabs rax, 0x47bb0575e0fb800a
mov qword [0x140015498], rax
movabs rax, 0x894159006a6f7213
mov qword [0x1400154a0], rax
movabs rax, 0x2e636c6163d5ffda
mov qword [0x1400154a8], rax
mov dword [0x1400154b0], 0x657865
call fcn.1400053cf
cmp byte [rbx], 0
jne 0x140005b52
lea rcx, [0x1400154c0]
call fcn.1400037c2
nop
add rsp, 0x30
pop rbx
jmp 0x140003c5d
sub rsp, 0x28
call fcn.140005893
nop
add rsp, 0x28
jmp 0x1400058b7
Function at 0x140005b61
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
cmp byte [0x1400150c0], 0
je 0x140003c94
mov rcx, qword [0x1400150f0]
test rcx, rcx
je 0x140003c94
call fcn.140003c38
lea rcx, [0x1400150f0]
xor edx, edx
call fcn.14000231d
mov ecx, 1
call sub.ucrtbase.dll_exit
nop
add rsp, 0x28
ret
push rbx
sub rsp, 0x30
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.14000361b
movups xmm0, xmmword [rsp + 0x20]
movaps xmmword [0x1400154c0], xmm0
call fcn.140005028
mov rbx, qword [0x1400104f0]
cmp byte [rbx], 0
jne 0x140005b52
movabs rax, 0xc0e8f0e48348fc
lea rcx, [0x1400153a0]
mov qword [0x1400153a0], rax
movabs rax, 0x5152504151410000
mov qword [0x1400153a8], rax
movabs rax, 0x528b4865d2314856
mov qword [0x1400153b0], rax
movabs rax, 0x528b4818528b4860
mov qword [0x1400153b8], rax
movabs rax, 0xb70f4850728b4820
mov qword [0x1400153c0], rax
movabs rax, 0xc03148c9314d4a4a
mov qword [0x1400153c8], rax
movabs rax, 0x41202c027c613cac
mov qword [0x1400153d0], rax
movabs rax, 0xede2c101410dc9c1
mov qword [0x1400153d8], rax
movabs rax, 0x8b20528b48514152
mov qword [0x1400153e0], rax
movabs rax, 0x88808bd001483c42
mov qword [0x1400153e8], rax
movabs rax, 0x6774c08548000000
mov qword [0x1400153f0], rax
movabs rax, 0x4418488b50d00148
mov qword [0x1400153f8], rax
movabs rax, 0x56e3d0014920408b
mov qword [0x140015400], rax
movabs rax, 0x4888348b41c9ff48
mov qword [0x140015408], rax
movabs rax, 0xc03148c9314dd601
mov qword [0x140015410], rax
movabs rax, 0xc101410dc9c141ac
mov qword [0x140015418], rax
movabs rax, 0x244c034cf175e038
mov qword [0x140015420], rax
movabs rax, 0x4458d875d1394508
mov qword [0x140015428], rax
movabs rax, 0x4166d0014924408b
mov qword [0x140015430], rax
movabs rax, 0x491c408b44480c8b
mov qword [0x140015438], rax
movabs rax, 0x14888048b41d001
mov qword [0x140015440], rax
movabs rax, 0x5a595e58415841d0
mov qword [0x140015448], rax
movabs rax, 0x83485a4159415841
mov qword [0x140015450], rax
movabs rax, 0x4158e0ff524120ec
mov qword [0x140015458], rax
movabs rax, 0xff57e9128b485a59
mov qword [0x140015460], rax
movabs rax, 0x1ba485dffff
mov qword [0x140015468], rax
mov eax, 0x11b1a9
shl rax, 0x2b
mov qword [0x140015470], rax
movabs rax, 0x8b31ba4100000101
mov qword [0x140015478], rax
movabs rax, 0xa2b5f0bbd5ff876f
mov qword [0x140015480], rax
movabs rax, 0xff9dbd95a6ba4156
mov qword [0x140015488], rax
movabs rax, 0x7c063c28c48348d5
mov qword [0x140015490], rax
movabs rax, 0x47bb0575e0fb800a
mov qword [0x140015498], rax
movabs rax, 0x894159006a6f7213
mov qword [0x1400154a0], rax
movabs rax, 0x2e636c6163d5ffda
mov qword [0x1400154a8], rax
mov dword [0x1400154b0], 0x657865
call fcn.1400053cf
cmp byte [rbx], 0
jne 0x140005b52
lea rcx, [0x1400154c0]
call fcn.1400037c2
nop
add rsp, 0x30
pop rbx
jmp 0x140003c5d
sub rsp, 0x28
call fcn.140005893
nop
add rsp, 0x28
jmp 0x1400058b7
Function at 0x140005eb0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.ucrtbase.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.ucrtbase.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.ucrtbase.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.14000cc10
call sub.ucrtbase.dll_abort
nop

Function at 0x140006b82
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x1400155a8]
test eax, eax
je 0x140006c1a
lea rax, [0x140015580]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x1400155b0]
mov qword [rbp - 8], rax
jmp 0x140006bfe
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x140006bf2
cmp qword [rbp - 0x10], 0
je 0x140006bf2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140006bb8
lea rax, [0x140015580]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x140006c1b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x140006d20
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x140006d48
mov eax, 0
jmp 0x140006d96
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140006d71
mov eax, 0
jmp 0x140006d96
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x140006d91
mov eax, 0
jmp 0x140006d96
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x140006d9c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x140006e1a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x140006e11
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x140006e11
mov rax, qword [rbp - 8]
jmp 0x140006e2f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x140006de4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x436900
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x43690d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x43691d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x436905
lea eax, [rcx + 1]
jmp 0x43692b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x43693e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x436924
sub eax, 3
jb 0x43695e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x4369ad
sar eax, 1
movsxd rbp, eax
jb 0x436994
jmp 0x43696c
add ebx, ebx
jne 0x43696a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x436994
inc ecx
add ebx, ebx
jne 0x43697a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x436994
call r11
adc ecx, ecx
add ebx, ebx
jne 0x43698d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x43697c
add ecx, 2
jmp 0x436999
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.004368c2
jmp 0x43690d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x22e00
mov dl, 6
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x4369fd
cmp rsi, rcx
jae 0x436a05
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x4369e4
cmp al, 0x8f
ja 0x4369e4
cmp byte [rsi - 2], 0xf
je 0x4369ea
sub al, 0xe8
cmp al, 1
ja 0x4369ce
cmp rsi, rcx
jae 0x436a05
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x4369d4
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x436a05
lodsb al, byte [rsi]
jmp 0x4369e4
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x34000]
mov eax, dword [rdi]
or eax, eax
je 0x436a62
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x364ec]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x436a12
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x436a5c
mov qword [rbx], rax
add rbx, 8
jmp 0x436a32
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x436a9c
cmp al, 0xef
ja 0x436a8e
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x436a6e
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x436a7d
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.00436b1b], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.00436b1b
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x436b0b
sub rsp, 0xffffffffffffff80
jmp 0x4014c0