joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1408910ec
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
test r15b, al
jmp 0x140891107
mov qword [rax + 8], rbx
xadd bx, bx
dec bx
shr rbx, 0xb9
mov qword [rax + 0x10], rsi
bt ebx, 0x34
mov qword [rax + 0x18], rdi
shl rdi, cl
and bx, 0x7c9a
rcl dil, cl
push rbp
not rdi
cmovae di, r14w
rcr bh, 0xf3
lea rbp, [rax - 0x5f]
bts di, r9w
sub rsp, 0x90
mov dil, 0xba
clc
xor esi, esi
ror bh, cl
or edi, ebx
mov dword [rbp + 7], 0x4b005c
mov qword [rbp + 0x7f], rsi
mov rbx, r8
or dil, cl
mov dword [rbp + 0xb], 0x6f006e
bt rdi, r8
movsx rdi, r11w
mov rdi, rcx
mov dword [rbp + 0xf], 0x6e0077
test si, 0x2697
cmc
mov dword [rbp + 0x13], 0x6c0044
stc
mov dword [rbp + 0x17], 0x73006c
cmp r15w, r8w
clc
test r14w, 0x7afd
mov dword [rbp + 0x1b], 0x320033
test r14w, bp
mov word [rbp + 0x1f], si
stc
clc
test dl, dl
jmp 0x1408911b5
jne 0x1408911c2
mov word [rbp + 0x1b], si
setbe ch
lea rdx, [rbp + 7]
movzx cx, dh
mov cx, 0x7ed4
lea rcx, [rbp - 0x19]
jmp 0x1408911d7
call 0x140825d2f
lea rax, [rbp - 0x19]
jmp 0x1408911e6
mov dword [rbp + 0x27], 0x30
jmp 0x1408911f2
xorps xmm0, xmm0
mov qword [rbp + 0x37], rax
mov dx, 0x7df0
lea r8, [rbp + 0x27]
cmovb edx, eax
movsx edx, r9w
not dl
mov qword [rbp + 0x2f], rsi
movsxd rdx, ebp
mov edx, 3
movzx rcx, r8w
movsx cx, ah
mov dword [rbp + 0x3f], 0x40
movzx cx, bpl
movzx rcx, r12w
lea rcx, [rbp + 0x7f]
jmp 0x140891237
movdqu xmmword [rbp + 0x47], xmm0
call int.1404a1229
test eax, eax
jmp 0x140891248
js 0x1408912ee
mov rdx, rdi
movzx cx, r12b
lea rcx, [rbp - 9]
jmp 0x14089125f
call 0x1407af4ca
mov rax, qword [rbp + 0x7f]
movzx r8, r13w
movzx r8w, cl
movsx r8, r11w
lea r8, [rbp + 0x27]
mov qword [rbp + 0x2f], rax
jmp 0x140891283
xorps xmm0, xmm0
lea rax, [rbp - 9]
mov dword [rbp + 0x27], 0x30
mov rcx, 0x42e47a86
mov edx, 0xf
movsx cx, bl
mov qword [rbp + 0x37], rax
movzx rcx, bx
movsx rcx, r15w
setns ch
mov rcx, rbx
jmp 0x1408912b8
mov dword [rbp + 0x3f], 0x40
jmp 0x1408912c4
movdqu xmmword [rbp + 0x47], xmm0
call fcn.140077115
mov rcx, qword [rbp + 0x7f]
jmp 0x1408912e0
mov ebx, eax
jmp 0x1408912e7
call fcn.1404384a1
mov eax, ebx
lea r11, [rsp + 0x90]
movzx esi, r11w
movzx rbp, cx
mov rbx, qword [r11 + 0x10]
bswap si
mov rsi, qword [r11 + 0x18]
xchg bpl, bpl
movzx edi, r15w
mov rdi, qword [r11 + 0x20]
movsx ebp, cx
movsx bp, sil
mov bp, r14w
mov rsp, r11
movsx ebp, r15w
pop rbp
ret
Function at 0x1408947d2
Capabilities:
Execute anti-debugging instructions
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
test si, 0x613
mov r8w, sp
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
add r10w, dx
adc r9b, cl
push rdi
push r14
inc rdi
ror r10b, 0xb8
sal r14b, 0xba
mov r8, rdx
shr r10w, cl
btc rdi, 0x6a
sbb r10w, r8w
mov r9, rdx
dec r10
shr r8, 3
movzx r14d, r13w
mov rdi, rcx
movabs rsi, 0xcbf29ce484222325
cmovge r10, r15
xchg r14b, r14b
not rbp
movabs rbp, 0x100000001b3
movsx r14w, sil
movabs r14, 0x7080100200400801
jmp 0x14089485c
mov r10d, 8
jmp 0x140894867
jmp 0x14089491b
dec r8
shrd cx, bx, 0x28
btc bx, dx
movsx eax, r13w
rdtsc
btc cx, ax
shr r11b, cl
shl rdx, 0x20
sbb r11d, edi
lea r11, [rsp + 0x18]
or rax, rdx
movsxd rdx, esi
mov rbx, r10
rcr cx, cl
mov rcx, rax
ror dx, cl
bts dx, ax
movzx dx, dl
ror rcx, 3
sub dx, 0x5a5a
inc rdx
shld rdx, rax, 0xdb
xor rcx, rax
mov rax, r14
cwd
mul rcx
clc
shl ecx, cl
mov rcx, rsi
test r8w, 0x59d5
xor rdx, rax
mov qword [rsp + 0x18], rdx
bswap rax
movzx eax, byte [r11]
inc r11
cmp r8w, 0x1e3c
test esp, ecx
xor rcx, rax
imul rcx, rbp
cmp r9w, 0x1ddb
sub rbx, 1
jmp 0x140894903
jne 0x1408948de
xor rcx, rdx
clc
stc
mov qword [rdi], rcx
test r11b, 0xf6
test cl, r12b
add rdi, r10
test r8, r8
jmp 0x140894923
jne 0x14089486c
and r9d, 7
je 0x140894a04
rdtsc
btr cx, 0x44
shl rdx, 0x20
movsx cx, r10b
shrd cx, di, 0x8b
btr rcx, rsp
or rax, rdx
mov rcx, rax
ror rdx, 0xa
ror rcx, 3
adc edx, r11d
shr dl, 0xd1
xor rcx, rax
bsf edx, edx
mov rax, r14
mul rcx
sal cl, cl
adc rcx, r15
or cx, 0x72ff
lea rcx, [rsp + 0x18]
test r13w, sp
cmc
jmp 0x140894985
xor rdx, rax
mov eax, ebx
movzx rax, cx
xchg al, ah
mov qword [rsp + 0x18], rdx
movzx eax, byte [rcx]
jmp 0x14089499d
inc rcx
test ax, di
test rax, 0x7d3c7d03
xor rsi, rax
cmp r11d, 0x1f3d6f0b
imul rsi, rbp
sub r10, 1
jmp 0x1408949c0
jne 0x140894995
xor rdx, rsi
cmc
jmp 0x1408949cf
mov qword [rsp + 0x18], rdx
test dx, sp
cmc
stc
test rdi, rdi
jmp 0x1408949e1
je 0x140894a04
lea rsi, [rsp + 0x18]
xchg r14d, ecx
jmp 0x1408949f7
mov rcx, r9
cmovl r14w, sp
bswap bx
rep movsb byte [rdi], byte [rsi]
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov sil, 0xba
mov rsi, qword [rsp + 0x30]
pop r14
not dil
movzx di, r12b
pop rdi
ret
Function at 0x14089507c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
btr bx, ax
or bh, 0x3a
seta bl
push rbp
push rsi
dec sil
push rdi
xchg bx, bp
sar sil, 0x42
bt rbx, 0x7b
lea rbp, [rsp - 0x430]
stc
ror sil, cl
shr ebx, 0xe5
sub rsp, 0x530
or si, r8w
cmp qword [rcx], 0
jmp 0x1408950c7
mov rsi, rdx
movzx rbx, r12w
movsx rbx, bp
bswap rbx
mov rbx, rcx
je 0x140895112
add rcx, 0x90
not ah
lahf
lea rax, [rbx + 0x10]
jmp 0x140895104
cmp byte [rax + 0x18], 0
jne 0x14089514d
add rax, 0x20
jmp 0x140895104
cmp rax, rcx
jmp 0x14089510c
jne 0x1408950f1
and dword [rsi], 0
mov rbx, qword [rsp + 0x558]
movzx ebp, r10w
btc edi, 0x8a
add rsp, 0x530
not rbp
pop rdi
movsx ebp, ax
movzx bp, r10b
movzx esi, bp
pop rsi
mov ebp, 0x302d45b5
movsx bp, r8b
pop rbp
jmp 0x14089514c
ret
mov rcx, qword [rbx]
rcl r9b, 0xc3
bswap r8w
cmovno r8w, sp
lea r8, [rsp + 0x30]
bts r9w, r13w
btr r9w, r11w
or r9, 0x758b2f88
and qword [rsp + 0x20], 0
xor r9b, 9
sub r9, rbp
test r8b, 0x26
mov r9d, 0x30
stc
cmp r15w, r12w
jmp 0x140895194
sub edx, edx
jmp 0x14089519b
call fcn.14046abf6
mov dword [rsi], eax
cmc
cmp cx, di
test eax, eax
jmp 0x1408951ad
js 0x1408951c6
cmp dword [rsp + 0x30], 0x103
jmp 0x1408951c0
jne 0x140895112
mov rcx, qword [rbx]
mov dx, sp
not edx
lea rdx, [rbp + 0x460]
jmp 0x1408951da
call fcn.1402deeb2
mov dword [rsi], eax
test eax, eax
jmp 0x1408951e8
js 0x140895115
xor eax, eax
cdq
cwd
lea rdi, [rsp + 0x60]
mov ecx, 0x4d0
lea rdx, [rsp + 0x60]
rep stosb byte [rdi], al
movsxd rcx, r8d
mov rcx, qword [rbx]
jmp 0x14089520f
mov dword [rbp - 0x70], 0x100010
jmp 0x14089521b
call int.14056738c
mov dword [rsi], eax
test r15d, 0x5a1c01a9
test eax, eax
jmp 0x140895230
jns 0x14089525f
mov rcx, qword [rbx]
shl dh, 3
cqo
inc edx
lea rdx, [rbp + 0x450]
and dword [rbp + 0x450], 0
jmp 0x140895253
call fcn.14007c06e
mov dword [rsi], eax
jmp 0x140895115
lea rdx, [rbp - 0x58]
bswap cx
xor edi, edi
movzx ecx, r14w
shr rcx, 2
lea rcx, [rbx + 0x28]
jmp 0x140895283
cmp byte [rcx], 0
jmp 0x14089528b
je 0x1408952b7
mov rax, qword [rcx - 0x10]
cmp qword [rdx], rax
jmp 0x14089529d
jne 0x1408952b4
and qword [rdx], 0
cmc
mov rax, qword [rbp - 0x30]
btr rax, rdi
mov qword [rbp - 0x30], rax
mov byte [rcx], 0
add rcx, 0x20
test r9, r10
test r9w, 0x6c28
add rdi, 2
stc
jmp 0x1408952ce
add rdx, 8
cmp bh, 8
stc
cmp rdi, 8
jmp 0x1408952df
jb 0x140895283
mov rcx, qword [rbx]
cwd
mov dl, sil
lea rdx, [rsp + 0x60]
jmp 0x1408952f7
call fcn.140675e38
mov dword [rsi], eax
jmp 0x140895303
jmp 0x140895236
Function at 0x140896f11
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
cmc
rcl eax, cl
movzx rax, bp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x20], r9
movsx eax, r14w
not al
movzx ax, r12b
mov qword [r11 + 0x10], rdx
btc ax, r14w
push rbp
push rsi
rcl bp, 0x92
and bpl, 0x5e
and bpl, r11b
push rdi
and ax, cx
cdqe
sal rax, 1
push r14
sal ebp, 0xaa
push r15
bt eax, r10d
ror bp, cl
sub rsp, 0x20
mov rax, qword [r8 + 0x18]
add bpl, 0x14
btr bp, 0x73
mov rbp, rcx
test r8w, r9w
clc
cmp r11d, 0x5e56521c
mov qword [r11 + 0x20], rax
cmc
clc
jmp 0x140896f86
test rax, rax
jmp 0x140896f8e
jne 0x140896f99
jmp 0x1408971a6
lea rbx, [rcx + 0x30]
bswap ecx
mov cx, r8w
mov rcx, rbx
call 0x1401a74a6
mov rcx, qword [rbp + 0x58]
mov rsi, qword [rbp + 0x60]
cmp spl, 0xc4
cmp rcx, rsi
jmp 0x140896fc0
je 0x14089718b
mov rdx, qword [rsp + 0x68]
test r12, r10
shl eax, cl
mov rax, qword [rcx]
test rdi, r14
stc
test ch, 0x97
cmp qword [rax + 0x38], rdx
je 0x140896ff7
add rcx, 0x10
stc
cmp rcx, rsi
jmp 0x140896ff1
jne 0x140896fd0
cmp rcx, rsi
jmp 0x140896fff
je 0x14089718b
lea rdi, [rcx + 0x10]
test al, dil
or r15d, 0xffffffff
cmp ecx, r9d
cmp r15d, 0x356a14df
cmp rdi, rsi
jmp 0x140897022
je 0x14089710f
mov rcx, qword [rdi + 8]
and ah, 0x8c
xadd r14b, r14b
bt r14w, r13w
and qword [rdi + 8], 0
mov rax, qword [rdi]
xor r14b, 3
and qword [rdi], 0
rcl r14b, cl
movzx r14, dx
add r14w, 0x6122
mov qword [rdi - 0x10], rax
rcl r14b, cl
btc r14w, 0xf8
mov r14, qword [rdi - 8]
mov qword [rsp + 0x58], rcx
test ax, 0x3476
test r11w, sp
cmp al, ah
mov qword [rdi - 8], rcx
test ebx, r12d
test r14, r14
jmp 0x140897084
je 0x1408970ee
mov eax, r15d
cmp r14b, sil
stc
lock xadd dword [r14 + 8], eax
clc
add eax, r15d
jmp 0x1408970a0
jne 0x1408970ee
mov rax, qword [r14]
xchg cl, cl
movzx ecx, r8w
mov cx, 0x6aa
mov rcx, r14
jmp 0x1408970bb
call qword [rax]
mov eax, r15d
lock xadd dword [r14 + 0xc], eax
add eax, r15d
jmp 0x1408970ce
jne 0x1408970ee
mov rax, qword [r14]
movzx cx, dl
movzx ecx, r10w
movsx ecx, r11w
mov rcx, r14
jmp 0x1408970eb
call qword [rax + 8]
add rdi, 0x10
cmp rdi, rsi
jmp 0x1408970fa
jne 0x140897028
mov rsi, qword [rbp + 0x60]
xadd dil, dil
neg rdi
movsx rdi, bx
mov rdi, qword [rsi - 8]
cmc
clc
test rdi, rdi
jmp 0x14089711d
je 0x140897186
mov eax, r15d
jmp 0x14089712c
lock xadd dword [rdi + 8], eax
jmp 0x14089713a
add eax, r15d
jmp 0x140897142
jne 0x140897186
mov rax, qword [rdi]
movzx cx, spl
mov rcx, rdi
jmp 0x140897158
call qword [rax]
mov eax, r15d
lock xadd dword [rdi + 0xc], eax
cmc
test r9w, dx
stc
add eax, r15d
jne 0x140897186
mov rax, qword [rdi]
mov cl, sil
cmovno cx, di
mov rcx, rdi
jmp 0x140897183
call qword [rax + 8]
add qword [rbp + 0x60], 0xfffffffffffffff0
test rbx, rbx
jmp 0x140897193
je 0x1408971a6
mov rcx, rbx
jmp 0x1408971a1
call 0x14050da43
mov rbx, qword [rsp + 0x50]
cmovl r15w, di
inc r14b
add rsp, 0x20
jmp 0x1408971c0
pop r15
bswap r14
setg r14b
movsx r14, r11w
pop r14
pop rdi
setl sil
xchg bpl, bpl
movzx bp, r8b
pop rsi
movsx ebp, dx
movzx bp, dl
jmp 0x1408971e9
pop rbp
jmp 0x1408971ef
ret
Function at 0x140898ddf
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
test dil, 0x92
jmp 0x140898df3
mov qword [rax + 0x10], rbx
add bl, r9b
movsx rbx, r9w
test rdx, r8
mov qword [rax + 0x20], rsi
shl bl, cl
mov dword [rax + 0x18], r8d
push rdi
sar dil, 0xab
bswap esi
shrd esi, ebp, 0xb3
sub rsp, 0x30
jmp 0x140898e1f
lea rbx, [rcx + 0x30]
movzx rdi, r12w
mov edi, esi
jmp 0x140898e2e
mov byte [rax - 0x18], 1
jmp 0x140898e37
mov rdi, rcx
mov cx, 0x5f5c
mov rsi, rdx
jmp 0x140898e48
mov rcx, rbx
call 0x1401026c2
mov r11, qword [rdi + 0x60]
rcr r10, 0xc1
or r10d, 0x724050eb
movzx r10, sp
mov r10, qword [rdi + 0x58]
test di, r15w
cmp bp, 0x141b
stc
cmp r10, r11
jmp 0x140898e7a
je 0x140898ef9
mov dil, byte [rsp + 0x20]
mov rcx, qword [r10]
cmp byte [rcx + 0x44], dil
jmp 0x140898e91
je 0x140898edc
add rcx, 0x68
stc
cmp qword [rcx + 0x18], 8
jmp 0x140898ea6
jb 0x140898eb4
mov rcx, qword [rcx]
jmp 0x140898eb4
call fcn.1402d03df
xor eax, 0x75ede3db
test rcx, rdi
test rcx, 0x44316849
jmp 0x140898ecd
cmp dword [rsp + 0x50], eax
jmp 0x140898ed6
je 0x140898ef9
add r10, 0x10
cmp si, 0x62c5
clc
jmp 0x140898eeb
cmp r10, r11
jmp 0x140898ef3
jne 0x140898e85
mov qword [rsp + 0x40], r11
jmp 0x140898f06
and qword [rsi], 0
jmp 0x140898f10
and qword [rsi + 8], 0
test rbp, rdi
cmp r10, r11
jmp 0x140898f20
je 0x140898f65
mov rcx, qword [r10 + 8]
test rcx, rcx
je 0x140898f4a
lock inc dword [rcx + 8]
movzx rax, bp
and ax, r9w
mov rcx, qword [r10 + 8]
bt eax, 0x44
sal ah, 0xb6
mov rax, qword [r10]
jmp 0x140898f53
mov qword [rsi], rax
cmp si, 0x4ff6
clc
mov qword [rsi + 8], rcx
test r10b, 0xcb
cmc
test rbx, rbx
jmp 0x140898f6d
je 0x140898f80
mov rcx, rbx
jmp 0x140898f7b
call 0x1401c66ea
mov rbx, qword [rsp + 0x48]
sar dil, 0x4e
rcl eax, 0xec
mov rax, rsi
and si, 0x75e4
shr dil, 0x81
or di, 0x6510
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
movzx rdi, si
cmovb rdi, rdx
not dil
pop rdi
jmp 0x140898fb8
ret
Function at 0x1408aa618
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
movsxd r11, r14d
bt ax, 0x76
push rdi
dec r10b
sub rsp, 0x20
bt r10w, sp
movzx r9, di
xchg rbx, r10
mov r9, qword [rcx + 0x18]
movabs rax, 0xcccccccccccccccd
dec dil
sar bl, cl
xor r8w, dx
mov edi, edx
xadd r8w, bx
btr r8d, 0x25
movzx r8, ax
mov rbx, rcx
test r9b, al
movsxd r8, dword [r9 + 0xac]
cmc
movzx dx, dl
movsxd r10, dword [r9 + 0xa8]
cmovbe edx, r14d
dec dx
movzx edx, bx
mul r8
sub r11b, 0x38
lea r10, [r10 + r9]
shrd r11w, r14w, 6
xor r8d, r8d
bsr r11w, cx
neg r11w
mov r11, rdx
clc
test si, r8w
shr r11, 5
test r9w, r15w
test r11, r11
jmp 0x1408aa6b8
je 0x1408aa711
mov edx, dword [r10]
movzx rcx, r11w
mov rcx, rbx
call fcn.14047e1ad
mov rcx, rax
jmp 0x1408aa6d5
call fcn.1404e978b
cmp eax, edi
jmp 0x1408aa6e1
je 0x1408aa72a
inc r8d
not eax
cmovo rax, r8
movzx ax, r12b
add r10, 0x28
movsx ax, r9b
bsf rax, rbp
ror ah, 0xef
movsxd rax, r8d
cmp rax, r11
jb 0x1408aa6be
or eax, 0xffffffff
clc
mov rbx, qword [rsp + 0x30]
adc di, bp
add dil, 0x8f
add rsp, 0x20
not rdi
pop rdi
ret
mov eax, r8d
jmp 0x1408aa715
Function at 0x1408aaf2d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
rol rdi, 0x1f
ror r11b, 0x4c
or bpl, dl
mov rbp, rsp
sete r11b
sub rsp, 0x40
movzx r11d, dx
mov rdi, rcx
sar r11, cl
inc r11
movsx r11w, spl
mov rbx, r9
sar r11b, cl
btc r11d, 0x13
sub ecx, ecx
mov r11, rdx
jmp 0x1408aaf79
test rdx, rdx
je 0x1408ab0e2
mov r9, qword [rbp + 0x38]
xadd al, al
rcl al, 0xb8
sar al, 0x32
mov al, byte [r9 + 0x21]
clc
cmp al, 0x20
jmp 0x1408aaf9b
jae 0x1408ab089
movzx r10d, al
mov rdx, r8
jmp 0x1408aafad
inc al
cmc
jmp 0x1408aafb9
add r10, r10
mov byte [r9 + 0x21], al
test r9b, dl
cmp r9d, r9d
test r8, r8
jmp 0x1408aafce
je 0x1408ab00b
jmp 0x1408aaff7
cmp al, 0x5c
jmp 0x1408aafe0
je 0x1408aafee
cmp al, 0x2f
jne 0x1408aaff4
lea rdx, [r8 + 1]
inc al
inc r8
mov al, byte [r8]
cmc
test al, al
jmp 0x1408ab002
jne 0x1408aafd9
mov rcx, rdx
call fcn.1404e978b
mov dword [r9 + r10*8 + 0x78], eax
sub rax, 0x675d25fc
lea eax, [rbx - 0x10000]
xor bx, 0x5308
dec rbx
adc bl, r9b
mov rbx, qword [rsp + 0x50]
mov dword [r9 + r10*8 + 0x80], eax
clc
mov eax, dword [rbp + 0x30]
xchg bpl, bpl
movsx bp, r12b
shr bpl, 0x32
add eax, 0xffff0000
rol bpl, 0x6c
inc bpl
sub r11d, edi
bt rbp, 0xa6
shr bpl, 0x20
mov dil, 0x92
mov dword [r9 + r10*8 + 0x84], eax
cmp r12b, 0x59
mov rdi, qword [rsp + 0x58]
mov dword [r9 + r10*8 + 0x7c], r11d
movsx ebp, ax
jmp 0x1408ab083
add rsp, 0x40
pop rbp
ret
sub eax, eax
movzx edx, r9w
setne ch
mov dword [rbp - 8], 0xd0001412
cqo
mov qword [rbp - 0x18], rax
lea rdx, [0x140068a88]
mov qword [rbp - 0x10], rax
movzx ax, sil
lea rcx, [rbp - 0x20]
movzx eax, di
jmp 0x1408ab0c0
lea rax, [0x14005b4d8]
mov dword [rbp - 4], 0x12
jmp 0x1408ab0d3
mov qword [rbp - 0x20], rax
call 0x14040e97d
int3
sub eax, eax
mov dword [rbp - 8], 0xd0001416
movsxd rdx, r12d
not cl
movsx dx, r8b
mov qword [rbp - 0x18], rax
mov cx, 0x1157
movsxd rdx, r13d
movsx rdx, ax
lea rdx, [0x140068a88]
movsx cx, bl
mov qword [rbp - 0x10], rax
cdqe
movzx ax, r15b
cwde
lea rcx, [rbp - 0x20]
movsx eax, r14w
movzx ax, r9b
lea rax, [0x14005b4d8]
mov dword [rbp - 4], 6
mov qword [rbp - 0x20], rax
call 0x14087915e
int3
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140017680]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x140017690]
mov dword [rax], 1
mov rax, qword [0x1400176a0]
mov dword [rax], 1
mov rax, qword [0x140017620]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x140017670]
mov dword [0x14001d00c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x140017750]
mov edx, dword [rdx]
mov dword [rax], edx
call sym.__p__commode
mov rdx, qword [0x140017730]
mov edx, dword [rdx]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x1400175c0]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [sym._matherr]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a

Function at 0x140002712
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
xor r8d, r8d
mov rsi, rcx
mov rbx, rdx
test rdx, rdx
je 0x140002731
mov rcx, rdx
call sym.strlen
mov r8, rax
mov rcx, rbx
mov r9, rsi
mov edx, 1
call sym.fwrite
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp sym.fflush

Function at 0x140008580
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop dword [rax]
Function at 0x1400085f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x14001d1e4]
mov rbx, rcx
test esi, esi
jle 0x140008720
mov rax, qword [0x14001d1e8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x14000863b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x1400086c5
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140008620
mov rcx, rbx
call sym.__mingw_GetSectionForAddress
mov rdi, rax
test rax, rax
je 0x140008742
mov rax, qword [0x14001d1e8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call sym._GetPEImageBase
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x14001d1e8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140008727
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x1400086be
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x1400086d0
add dword [0x14001d1e4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x14001d1e8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400086be
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
nop dword [rax]
xor esi, esi
jmp 0x140008648
mov rax, qword [0x14001d1e8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call sym.__report_error
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call sym.__report_error
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140008cb0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x14001d240]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14001d220]
test rbx, rbx
je 0x140008d0c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x140008d03
test rsi, rsi
je 0x140008d03
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140008ce8
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140008f20
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140008f38
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x140008f40
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret
Function at 0x140008f50
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r8d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
test r8w, r8w
je 0x140008f9d
lea ecx, [r8 - 1]
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp rdx, r8
jb 0x140008f94
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x140008f9f
add rax, 0x28
cmp rax, r9
jne 0x140008f80
xor eax, eax
ret

Function at 0x140008fa0
Capabilities:
Parse pe header

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
call sym.strlen
cmp rax, 8
ja 0x140009030
mov rdx, qword [0x140017620]
xor ebx, ebx
cmp word [rdx], 0x5a4d
jne 0x14000901e
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x14000901e
cmp word [rax + 0x18], 0x20b
jne 0x14000901e
movzx edx, word [rax + 0x14]
lea rbx, [rax + rdx + 0x18]
movzx edx, word [rax + 6]
test dx, dx
je 0x140009030
lea eax, [rdx - 1]
lea rax, [rax + rax*4]
lea rdi, [rbx + rax*8 + 0x28]
jmp 0x140009009
add rbx, 0x28
cmp rbx, rdi
je 0x140009030
mov r8d, 8
mov rdx, rsi
mov rcx, rbx
call sym.strncmp
test eax, eax
jne 0x140009000
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor ebx, ebx
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x140009040
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140017620]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140009060
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140009068
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140009060
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x1400090bd
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1400090b4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140009060
add rax, 0x28
cmp rax, r9
jne 0x1400090a0
xor eax, eax
ret

Function at 0x1400090c0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140017620]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x1400090df
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400090e8
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x1400090df
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140009100
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x140017620]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x140009120
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x140009128
ret
cmp word [rdx + 0x18], 0x20b
jne 0x140009120
movzx eax, word [rdx + 0x14]
movzx r8d, word [rdx + 6]
lea rax, [rdx + rax + 0x18]
test r8w, r8w
je 0x140009170
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x140009167
test rcx, rcx
je 0x140009120
sub rcx, 1
add rax, 0x28
cmp rax, rdx
jne 0x140009158
xor eax, eax
ret