joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400356a0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14021c260]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400356c0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400356c8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400356c0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x140035715
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x14003570c
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400356c0
add rax, 0x28
cmp rax, r9
jne 0x1400356f8
xor eax, eax
ret

Function at 0x140035720
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14021c260]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x140035740
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140035748
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x140035740
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x1400357d0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14021c260]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x1400357f0
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x1400357f8
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret
Function at 0x1400a3450
Capabilities:
Generate random numbers via winapi

Disassembly:
push rbx
xor r8d, r8d
mov ebx, ecx
xor edx, edx
mov r9d, 1
sub rsp, 0x40
mov dword [rsp + 0x20], 0xf0000000
lea rcx, [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x1400a3490
mov eax, dword [rsp + 0x34]
xor edx, edx
add rsp, 0x40
div ebx
pop rbx
mov eax, edx
ret
mov rcx, qword [rsp + 0x38]
lea r8, [rsp + 0x34]
mov edx, 4
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x1400a3479
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [rsp + 0x34]
xor edx, edx
add rsp, 0x40
div ebx
pop rbx
mov eax, edx
ret

Function at 0x1400a34d0
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push r12
xor r8d, r8d
mov r12d, edx
mov r9d, 1
push rbx
xor edx, edx
mov rbx, rcx
sub rsp, 0x48
mov dword [rsp + 0x20], 0xf0000000
lea rcx, [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x1400a3510
add rsp, 0x48
mov eax, 1
pop rbx
pop r12
ret
mov rcx, qword [rsp + 0x38]
mov r8, rbx
mov edx, r12d
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x1400a34ff
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
add rsp, 0x48
xor eax, eax
pop rbx
pop r12
ret

Function at 0x1400a3560
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
mov rbp, rsp
push rbx
lea rbx, [0x140225080]
mov rcx, rbx
and rsp, 0xfffffffffffffff0
sub rsp, 0xa0
call sub.msvcrt.dll_strlen
mov r8, rax
mov rax, rbx
cmp r8, 3
jbe 0x1400a3598
mov rbx, qword [rbp - 8]
leave
ret
xor r8d, r8d
mov byte [rsp + 0x90], 0
movabs rax, 0x4552415754464f53
movabs rdx, 0x6f736f7263694d5c
mov qword [rsp + 0x50], rax
mov r9d, 0x20019
movabs rax, 0x6f646e69575c7466
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x58], rdx
movabs rdx, 0x65727275435c7377
mov qword [rsp + 0x60], rax
movabs rax, 0x6f6973726556746e
mov qword [rsp + 0x68], rdx
movabs rdx, 0x726f6c7078455c6e
mov qword [rsp + 0x70], rax
movabs rax, 0x6c6c6568535c7265
mov qword [rsp + 0x78], rdx
movabs rdx, 0x737265646c6f4620
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x88], rdx
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov r8d, eax
xor eax, eax
test r8d, r8d
jne 0x1400a358b
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rbx
xor edx, edx
mov rcx, qword [rsp + 0x48]
mov dword [rsp + 0x44], 0x104
mov r9d, 2
lea r8, [0x14021b2ea]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rbx
mov rbx, qword [rbp - 8]
leave
ret
Function at 0x1400c5070
Capabilities:
Query or enumerate registry value

Disassembly:
push r14
mov r14, rdx
push r13
mov r13, rcx
push r12
push rsi
mov rsi, r9
push rbx
mov rbx, r8
sub rsp, 0x50
mov rax, qword [0x140223e00]
test rax, rax
jne 0x1400c50e5
mov rdx, rcx
lea r8, [rsp + 0x48]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov r12d, eax
test eax, eax
jne 0x1400c5178
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x28], rsi
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x48]
mov r12d, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400c5178
mov qword [rsp + 0x30], r9
mov r9d, 0xffff
mov qword [rsp + 0x28], r8
mov r8, rdx
mov rdx, rcx
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], 0
call rax
mov r12d, eax
cmp eax, 2
jne 0x1400c5178
mov qword [rsp + 0x30], rsi
mov r9d, 0x1ffff
mov r8, r14
mov rdx, r13
mov qword [rsp + 0x28], rbx
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], 0
call qword [0x140223e00]
mov r12d, eax
cmp eax, 2
jne 0x1400c5178
mov qword [rsp + 0x30], rsi
mov r9d, 0x2ffff
mov r8, r14
mov rdx, r13
mov qword [rsp + 0x28], rbx
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], 0
call qword [0x140223e00]
mov r12d, eax
add rsp, 0x50
mov eax, r12d
pop rbx
pop rsi
pop r12
pop r13
pop r14
ret
Function at 0x1400c55d0
Capabilities:
Print debug messages

Disassembly:
push r13
mov r13, r9
push r12
mov r12, rdx
push rsi
push rbx
mov ebx, r8d
sub rsp, 0x38
mov rax, qword [0x1402233a0]
mov rsi, qword [rsp + 0x80]
test rax, rax
je 0x1400c5603
add rsp, 0x38
pop rbx
pop rsi
pop r12
pop r13
jmp rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1400c56d0
mov qword [rsp + 0x20], 0
test r12, r12
je 0x1400c5657
test ebx, ebx
jle 0x1400c563c
lea rcx, [rsp + 0x20]
mov r9d, ebx
mov r8, r12
lea rdx, str._s:_d
call fcn.1400c55a0
jmp 0x1400c566f
test r12, r12
je 0x1400c5657
lea rcx, [rsp + 0x20]
mov r8, r12
lea rdx, [0x1400f53ea]
call fcn.1400c55a0
jmp 0x1400c566f
test ebx, ebx
jle 0x1400c568e
lea rcx, [rsp + 0x20]
mov r8d, ebx
lea rdx, str._d:
call fcn.1400c55a0
test eax, eax
jle 0x1400c568e
mov r12, qword [rsp + 0x20]
test r12, r12
je 0x1400c568e
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, r12
call sub.msvcrt.dll_free
lea rcx, [rsp + 0x28]
mov r8, rsi
mov rdx, r13
mov qword [rsp + 0x28], 0
call fcn.1400c3e00
test eax, eax
jle 0x1400c56d0
mov r12, qword [rsp + 0x28]
test r12, r12
je 0x1400c56d0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add rsp, 0x38
mov rcx, r12
pop rbx
pop rsi
pop r12
pop r13
jmp sub.msvcrt.dll_free
add rsp, 0x38
pop rbx
pop rsi
pop r12
pop r13
ret

Function at 0x1400c5c90
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x48
cmp qword [0x1402233a0], 0
je 0x1400c5cb3
mov qword [rsp + 0x20], rcx
lea r9, str.assert:__s_n
xor ecx, ecx
call fcn.1400c56e0
jmp 0x1400c5d1a
mov qword [rsp + 0x38], 0
test rdx, rdx
jne 0x1400c5cc8
lea rdx, [0x1400f5bb6]
mov dword [rsp + 0x20], r8d
lea r10, [rsp + 0x38]
mov r9, rdx
mov r8, rcx
lea rdx, str._r_nMDBX_ASSERTION:__s___s:_u
mov rcx, r10
call fcn.1400c55a0
test eax, eax
jle 0x1400c5cf3
cmp qword [rsp + 0x38], 0
jne 0x1400c5cff
lea rax, str._troubles_with_assertion_message_preparation_
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1400c5d1a
call qword [sym.imp.KERNEL32.dll_DebugBreak]
or ecx, 0xffffffff
add rsp, 0x48
jmp qword [sym.imp.KERNEL32.dll_FatalExit]

Function at 0x1400c5d30
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsFree]
test eax, eax
jne 0x1400c5d5b
mov r8d, 0x124e
lea rdx, str.thread_key_delete
lea rcx, str.TlsFree_key_
add rsp, 0x28
jmp fcn.1400c5c90
add rsp, 0x28
ret
Function at 0x140ef8662
Capabilities:
Execute anti-debugging instructions

Disassembly:
ror ebp, 2
add ebp, 0x2b6b711b
push r9
cmc
xor dword [rsp], ebp
pop r9
test bh, bh
cmc
movsxd rbp, ebp
clc
stc
add r10, rbp
push r10
ret
xor ebp, r9d
cmp edi, 0xe491a20
cmc
neg ebp
stc
cmp bl, spl
add ebp, 0x390c42d8
jmp 0x140e39af4
push r12
clc
jmp 0x140e8239c
push rbx
push rbp
bt bp, r10w
push rdx
ror bpl, cl
mov bpl, cl
rol dh, 0x43
push r14
push r11
ror bp, cl
push rax
rol bx, cl
btc r11w, r13w
push r9
ror r9, 0x35
cmovs r11, r14
movzx rbp, r12w
push r10
btr ebp, eax
push rsi
movzx r11d, r11w
push rcx
cwd
rdtsc
push r13
not ah
push rdi
xchg r10b, bl
push r15
btc r9w, di
push r8
cdqe
movabs rbx, 0
btc r10d, r14d
push rbx
rdtsc
cqo
cmc
mov r11, qword [rsp + 0x90]
ror eax, 0xc8
cbw
btc r9, r11
not r11d
xchg bpl, dl
btc r10, 0x3b
ror r11d, 1
cmovle dx, r15w
mov bp, r9w
cwd
bswap r11d
rcr r9b, 0x5c
bts rax, rsp
add al, r15b
neg r11d
test r15b, r9b
shl r8b, cl
not r11d
sal r9b, 0xfb
setae dh
cwde
add r11, rbx
cqo
ror bpl, cl
movabs rax, 0x100000000
add r11, rax
test al, ah
mov r8, rsp
cmp r14d, 0x1a1465ec
bt r10, 0xe6
sub rsp, 0x180
clc
test r15b, r13b
and rsp, 0xfffffffffffffff0
mov r9, r11
rcl bpl, 0x72
sal rbp, cl
movabs rdx, 0
sub r9, rdx
lea r10, [0x140e8249c]
mov ebp, dword [r11]
stc
cmc
cmp di, 0x476e
add r11, 4
jmp 0x140e4821a
pushfq
jmp 0x140e5a2b8
Function at 0x140003566
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
je 0x140003584
mov rcx, rdi
call fcn.14001cb70
mov r8, rax
jmp 0x140003587
xor r8d, r8d
mov edx, 1
mov rcx, rdi
mov r9, rsi
call fcn.14001c1f0
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.14001bc30

Function at 0x140006324
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov ecx, 2
call fcn.14001898c
mov rdi, rax
lea rcx, str.could_not_load:
mov edx, 1
mov r8d, 0x10
mov r9, rax
call fcn.14001c1f0
mov rcx, rdi
call fcn.14001bc30
test rsi, rsi
je 0x140006367
cmp qword [rsi], 0
jne 0x140006370
lea rsi, [0x140032dfd]
jmp 0x140006374
add rsi, 0x10
mov ecx, 2
call fcn.14001898c
mov rdi, rax
mov rcx, rsi
call fcn.14001cb70
mov edx, 1
mov rcx, rsi
mov r8, rax
mov r9, rdi
call fcn.14001c1f0
mov rcx, rdi
call fcn.14001bc30
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xc1
jne 0x1400063e0
mov ecx, 2
call fcn.14001898c
mov rsi, rax
lea rcx, str._n_bad_format__library_may_be_wrong_architecture_
mov edx, 1
mov r8d, 0x30
mov r9, rax
call fcn.14001c1f0
mov rcx, rsi
call fcn.14001bc30
mov ecx, 2
call fcn.14001898c
lea rdx, [0x140032dfc]
mov rcx, rax
call fcn.140003566
mov ecx, 1
call fcn.14001a224
int3

Function at 0x140009606
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
mov ecx, 2
call fcn.14001898c
mov rbx, rax
mov edx, 1
mov rcx, rdi
mov r8, rsi
mov r9, rax
call fcn.14001c1f0
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.14001bc30

Function at 0x14000a13c
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov ebx, r9d
mov r14, r8
mov rsi, rdx
mov rdi, rcx
movzx eax, byte [r14]
cmp eax, 3
jne 0x14000a1fd
mov rcx, rdi
mov rdx, r14
call fcn.140005a8e
mov r12, rax
mov rcx, rsi
mov rdx, r14
call fcn.140005a8e
mov r15, rax
cmp rax, r12
setne al
test r12, r12
setne cl
and cl, al
mov byte [rsp + 0x23], cl
mov eax, 7
mov cl, byte [rsp + 0x23]
cmp cl, 1
jne 0x14000a1d0
cmp dword [0x14004a528], 0xa
jl 0x14000a1c3
mov eax, dword [0x14004a52c]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x14000a1c3
mov rcx, rdi
mov rdx, r12
call fcn.14000a094
mov rcx, rdi
mov rdx, r12
call fcn.14000a094
xor eax, eax
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x24]
mov rdx, qword [r14 + 8]
mov rax, qword [r14 + 0x10]
lea rcx, [rdx + rdi]
add rdx, rsi
mov r8, qword [rax]
call fcn.140029640
mov r14, r15
test r15, r15
jne 0x14000a155
jmp 0x14000a237
test eax, eax
je 0x14000a237
cmp eax, 2
jne 0x14000a245
mov rax, qword [r14 + 0x20]
xor r15d, r15d
test rax, rax
cmovg r15, rax
jle 0x14000a237
xor r12d, r12d
mov rax, qword [r14 + 0x28]
mov r8, qword [rax + r12*8]
mov rcx, rdi
mov rdx, rsi
mov r9d, ebx
call fcn.14000a13c
inc r12
cmp r15, r12
jne 0x14000a219
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rax, qword [r14 + 8]
mov r8, qword [r14 + 0x10]
add rdi, rax
add rsi, rax
add esi, eax
Function at 0x140016f78
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
call fcn.140009e67
test rax, rax
je 0x140016fcc
mov rdx, qword [rax]
test rdx, rdx
jle 0x140016fcc
xor r8d, r8d
lea r9, [0x14002ca80]
mov r10b, byte [rax + r8 + 0x10]
xor r11d, r11d
mov cl, byte [r11 + r9]
mov rdi, rsi
sar rdi, cl
xor r10b, dil
add r11, 8
cmp r11, 0x20
jne 0x140016fa5
mov byte [rax + r8 + 0x10], r10b
inc rsi
inc r8
cmp r8, rdx
jne 0x140016f9d
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x140017ef4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140017f3e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140017f3e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140017f3e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140017f3e
cmp dword [rcx + 0x84], 0xe
jbe 0x140017f3e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140017f40
xor al, al
add rsp, 0x28
ret

Function at 0x14001a224
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14001a36c
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x14001a3dc
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001a3dc
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001a3dc
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001a3dc
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001a3dc
cmp dword [rcx + 0x84], 0xe
jbe 0x14001a3dc
cmp dword [rcx + 0xf8], esi
je 0x14001a3dc
mov ecx, r14d
call fcn.14001a2a8
mov ecx, 2
call fcn.14001e280
nop
cmp byte [0x14004ea6c], 0
jne 0x14001a4a6
mov r15d, 1
mov eax, r15d
xchg dword [0x14004ea68], eax
test ebx, ebx
jne 0x14001a44f
mov rdi, qword [0x140038040]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x14004ea60]
cmp rcx, rax
je 0x14001a446
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [section..00cfg]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x14004eb88]
jmp 0x14001a45b
cmp ebx, r15d
jne 0x14001a461
lea rcx, [0x14004eba0]
call fcn.14001a9b8
nop
test ebx, ebx
jne 0x14001a478
lea rdx, [0x140035a40]
lea rcx, [0x140035a20]
call fcn.14001b544
lea rdx, [0x140035a50]
lea rcx, [0x140035a48]
call fcn.14001b544
movzx eax, byte [0x14004ea6c]
test esi, esi
cmove eax, r15d
mov byte [0x14004ea6c], al
jmp 0x14001a4a6
mov ecx, 2
call fcn.14001e29c
test esi, esi
jne 0x14001a4bd
mov ecx, r14d
call fcn.14001a314
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret

Function at 0x14001cc40
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14001cc68
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14001cc68
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140022c3c
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x140022c19
call fcn.14001adbc
mov dword [rax], 0x16
call fcn.14001eb74
or eax, 0xffffffff
jmp 0x140022c36
sub dword [rcx + 0x10], 1
jns 0x140022c28
add rsp, 0x28
jmp 0x140026b28
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x140022bf8
jmp 0x140026b30
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x140026b78
call fcn.14001adbc
mov dword [rax], 0x16
call fcn.14001eb74
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140026b60
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x140026b60
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x140026baa
lock or dword [rax + 0x14], 0x10
jmp 0x140026b60
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x140026bc7
mov rcx, qword [rbp + 0x10]
call fcn.140026cd8
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.14001ae94
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.140027c9c
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x140026c1e
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x140026b60
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x140026c8a
mov rcx, qword [rbp + 0x10]
call fcn.14001ae94
cmp eax, 0xffffffff
je 0x140026c71
mov rcx, qword [rbp + 0x10]
call fcn.14001ae94
cmp eax, 0xfffffffe
je 0x140026c71
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.14001ae94
movsxd rdi, eax
lea rsi, [0x14004f120]
mov rcx, rbx
sar rdi, 6
call fcn.14001ae94
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x140026c78
lea rax, [0x140038730]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x140026c8a
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x140026cc0
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x140026cbc
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x140026cbc
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x140026b63
Function at 0x140001350
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x1400035f0], rbx
je 0x14000139c
cmp rax, rbx
jne 0x14000138f
mov ebx, 1
mov esi, ebx
jmp 0x1400013a1
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140001374
mov ebx, 1
mov eax, dword [0x1400035f8]
cmp eax, ebx
jne 0x1400013b7
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x14000141c
mov eax, dword [0x1400035f8]
test eax, eax
jne 0x140001416
mov dword [0x1400035f8], ebx
lea r15, [0x140002168]
lea rdi, [0x140002150]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x140001408
test eax, eax
jne 0x14000140c
cmp qword [rdi], 0
je 0x1400013fd
mov rax, qword [rdi]
mov rcx, qword [0x140002130]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x1400013de
test eax, eax
je 0x14000141c
mov eax, 0xff
jmp 0x1400014f8
mov dword [0x140003034], ebx
mov eax, dword [0x1400035f8]
cmp eax, ebx
jne 0x140001443
lea rdx, [0x140002148]
lea rcx, [0x140002138]
call sub.msvcrt.dll__initterm
mov dword [0x1400035f8], 2
test esi, esi
jne 0x140001450
xor eax, eax
xchg qword [0x1400035f0], rax
cmp qword [0x140003600], 0
je 0x140001484
lea rcx, [0x140003600]
call fcn.140001790
test eax, eax
je 0x140001484
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140003600]
mov r9, qword [0x140002130]
call r9
mov r8, qword [0x140003048]
mov rdx, qword [0x140003040]
mov ecx, dword [0x140003038]
call fcn.14000109c
mov dword [0x140003030], eax
cmp dword [0x140003050], 0
jne 0x1400014b4
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140003034], 0
jne 0x1400014c9
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140003030]
jmp 0x1400014f8
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.140133000
add rsp, 0x28
jmp 0x140001350

Function at 0x14000167c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400016c8
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400016c0
cmp dword [rcx + 0x3c], edx
jl 0x1400016c0
cmp dword [rcx + 0x3c], 0x10000000
jae 0x1400016c0
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x1400016c8
mov rax, rdx
add rsp, 0x18
ret
Function at 0x4170c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41724b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00435960
xorps xmm15, xmm15
mov r14, qword [0x0065afd0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x417125
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x417134
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x417153
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x417163
cmp rbx, 0x1000
jae 0x41712b
jmp 0x4171cd
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x417175
xor edx, edx
jmp 0x4171c4
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00435960
xorps xmm15, xmm15
mov r14, qword [0x0065afd0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x417159
jmp 0x417148
call fcn.0046b1e0
xorps xmm15, xmm15
mov r14, qword [0x0065afd0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00439e40
lea rax, [0x0050595c]
mov ebx, 0x18
nop dword [rax]
call fcn.0043a6c0
mov rax, qword [rsp + 0x38]
call fcn.0043a400
lea rax, [0x00505e60]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.0043a6c0
mov rax, qword [rsp + 0x30]
call fcn.0043a400
call fcn.0043a080
call fcn.00439ea0
lea rax, [0x00508394]
mov ebx, 0x21
call fcn.004383a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00467a80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004170c0