joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140050043
Capabilities:
Connect socket

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x338
lea rbp, [rsp + 0x80]
and rsp, 0xffffffffffffff80
mov r13, r8
mov rsi, rdx
mov rbx, rcx
movzx eax, byte [rdx + 0x78]
push 2
pop r15
test eax, eax
je 0x1400500cd
cmp eax, 3
jne 0x1400509f0
lea r12, [rsi + 0x70]
lea r14, [rsi + 0x30]
movzx eax, byte [rsi + 0x70]
test eax, eax
je 0x140050196
cmp eax, 3
jne 0x140050a02
mov rax, qword [rsi + 0x68]
mov rcx, qword [rsi + 0x20]
mov qword [rsi + 0x28], rcx
cmp word [rsi], 0
movzx eax, word [rsi + 0x12]
mov word [rsp + 0xd0], ax
movups xmm0, xmmword [rsi + 2]
movaps xmmword [rsp + 0xc0], xmm0
je 0x1400501c3
mov eax, dword [rsi + 0x14]
mov edx, dword [rsi + 0x18]
movzx r9d, word [rsi + 0x1c]
mov r8, qword [rsp + 0xc2]
mov r10d, dword [rsp + 0xca]
movzx r11d, word [rsp + 0xce]
movzx edi, word [rsp + 0xd0]
xorps xmm0, xmm0
movups xmmword [rsp + 0x1bc], xmm0
movups xmmword [rsp + 0x1cc], xmm0
movups xmmword [rsp + 0x1dc], xmm0
and dword [rsp + 0x21c], 0
movups xmmword [rsp + 0x1ec], xmm0
movups xmmword [rsp + 0x1fc], xmm0
cld
add dword [rax], eax
add byte [rsi + 0x41], ah
rol ecx, 8
movups xmmword [rsp + 0x20c], xmm0
mov qword [rsp + 0x1a8], r8
mov dword [rsp + 0x1b0], r10d
add dword [rax], eax
add byte [rsi + 0x44], ah
mov dword [rsp + 0x1b4], ebx
mov qword [rsp + 0xf0], r13
mov qword [rsp + 0x98], r12
mov qword [rsp + 0x90], r14
lea rdx, [rsp + 0x1a8]
movzx r9d, word [rsp + 0xc4]
mov eax, dword [rsp + 0xc0]
rol r9w, 8
xorps xmm0, xmm0
movups xmmword [rdx + 0x60], xmm0
movups xmmword [rdx + 0x50], xmm0
movups xmmword [rdx + 0x40], xmm0
movups xmmword [rdx + 0x30], xmm0
movups xmmword [rdx + 0x20], xmm0
and qword [rdx + 0x70], 0
movups xmmword [rdx + 0x10], xmm0
movups xmmword [rdx], xmm0
push 0x10
pop r8
mov r10w, 2
lea rcx, str._async_fn__resumed_after_completionunable_to_find_any_user_specified_roots_in_the_final_cert_chainC:UsersGang.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_util_0.7.10_srcutilpoll_buf.rs
lea r8, str.C:UsersGang.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.37.0_src_net_tcp_socket.rs
jmp 0x140050a10
lea rcx, str._async_fn__resumed_after_completionunable_to_find_any_user_specified_roots_in_the_final_cert_chainC:UsersGang.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_util_0.7.10_srcutilpoll_buf.rs
Function at 0x14005245c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x6e8
mov r12, r8
mov rdi, rdx
mov qword [rsp + 0x70], rcx
mov rdx, qword [rdx + 0x418]
add rdx, 0x10
lea rsi, [rsp + 0x160]
mov rcx, rsi
call fcn.14001c0dd
cmp qword [rsi], 0
jne 0x140053fe7
mov rcx, qword [rsp + 0x168]
mov dl, byte [rsp + 0x170]
mov rax, qword [rcx + 0x28]
or rax, qword [rcx + 0x38]
je 0x1400524bf
call fcn.14003b334
jmp 0x1400524e8
mov rsi, qword [rcx + 0x230]
call fcn.14003b334
cmp rsi, 1
ja 0x1400524e8
mov rdx, qword [rdi + 0x418]
add rdx, 0x10
lea rcx, [rdi + 0x3b8]
call fcn.1400580aa
mov rax, qword [rdi + 0x390]
cmp rax, 2
jne 0x140052503
mov qword [rsp + 0x160], 2
jmp 0x140052563
lea rsi, [rdi + 0x390]
lea rdx, [rdi + 0x3a8]
test rax, rax
je 0x140052538
mov rcx, qword [rdi + 0x398]
mov rax, qword [rdi + 0x3a0]
mov r8, qword [rax + 0x10]
dec r8
and r8, 0xfffffffffffffff0
add rcx, r8
add rcx, 0x10
jmp 0x140052546
mov rcx, qword [rdi + 0x398]
mov rax, qword [rdi + 0x3a0]
call qword [rax + 0x70]
mov r14, rax
lea r15, [rsp + 0x160]
mov rcx, r15
mov rdx, rsi
call fcn.14009da2e
mov qword [r15 + 0x18], r14
mov rax, qword [rdi + 0x3b0]
mov rcx, qword [rsp + 0x160]
mov rdx, qword [rsp + 0x168]
movups xmm0, xmmword [rsp + 0x170]
movaps xmmword [rsp + 0x460], xmm0
mov qword [rsp + 0x450], rcx
mov qword [rsp + 0x458], rdx
mov qword [rsp + 0x470], rax
cmp dword [rsp + 0x450], 2
je 0x1400525c1
lea rdx, [rsp + 0x468]
lea rcx, [rsp + 0x450]
call fcn.14009db12
mov qword [rsp + 0x5e8], 2
and qword [rsp + 0x608], 0
lea r14, [rdi + 0x48]
lea rax, [rdi + 0x3b8]
mov qword [rsp + 0x2b8], rax
lea rax, [rdi + 0x428]
mov qword [rsp + 0x2b0], rax
lea rbp, [rsp + 0xb8]
mov dword [rsp + 0x5c], eax
mov dword [rsp + 0x58], eax
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x78], r14
mov rax, qword [rsp + 0x168]
mov cl, byte [rsp + 0x170]
lea r8, [rsp + 0x2d0]
mov qword [r8], rax
mov byte [r8 + 8], cl
lea rax, str.C:UsersGang.cargo_registry_srcindex.crates.io_6f17d22bba15001fh2_0.3.26_srcproto_streams_streams.rs
Function at 0x140062d45
Capabilities:
Check for software breakpoints

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x1e98
call fcn.140120200
sub rsp, rax
movaps xmmword [rsp + 0x1e80], xmm9
movaps xmmword [rsp + 0x1e70], xmm8
movaps xmmword [rsp + 0x1e60], xmm7
movaps xmmword [rsp + 0x1e50], xmm6
mov rbx, rdx
mov r12, rcx
lea r13, [rcx + 0x1b0]
lea rbp, [rcx + 0x1d1]
lea r14, [rsp + 0x91]
lea rdi, [rcx + 0x180]
xorps xmm6, xmm6
movss xmm7, dword [0x140125840]
lea rax, [rcx + 0xd8]
mov qword [rsp + 0x2c8], rax
lea rax, [rcx + 0x158]
mov qword [rsp + 0x148], rax
lea rax, [rcx + 0x18]
mov qword [rsp + 0x2c0], rax
lea rax, [rcx + 8]
mov qword [rsp + 0x2b8], rax
lea r15, [rsp + 0x11d0]
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0xd8], rax
mov qword [rsp + 0x50], rdi
Function at 0x140076c92
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rax, r8
mov r14, rdx
mov rsi, rcx
lea rdi, [rsp + 0x50]
mov r8d, 0xb
mov rcx, rdi
mov rdx, rax
call fcn.140076b62
lea r13, [rsp + 0x30]
mov dword [r13], 0x800
lea r15, [rsp + 0x34]
and dword [r15], 0
mov ecx, 0x800
call fcn.140083083
mov rbx, rdx
lea r12, [rsp + 0x38]
mov qword [r12], rax
mov qword [r12 + 8], rdx
and qword [r12 + 0x10], 0
mov rdi, qword [rdi + 8]
mov rbp, qword [sym.imp.advapi32.dll_RegQueryValueExW]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rbx
mov rcx, r14
mov rdx, rdi
xor r8d, r8d
mov r9, r15
call rbp
cmp eax, 0xea
jne 0x140076d35
mov edx, dword [rsp + 0x30]
mov rcx, r12
call fcn.14003dd70
mov rbx, qword [rsp + 0x40]
jmp 0x140076d03
test eax, eax
jne 0x140076d57
mov eax, dword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x34]
cmp eax, 0xb
jbe 0x140076d7f
movabs rax, 0xde00000002
jmp 0x140076d5f
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rcx, qword [rsp + 0x38]
mov rdx, rbx
call fcn.1400370a7
jmp 0x140076d93
mov rcx, qword [rsp + 0x48]
mov qword [rsi + 0x10], rcx
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rsi], xmm0
mov byte [rsi + 0x18], al
mov rcx, qword [rsp + 0x50]
mov rdx, rdi
call fcn.140081de4
nop
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x14007e5f0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae fcn.140014b80
cmp rax, rcx
je 0x14007e615
cmp rdx, 4
jae 0x14007e618
xor eax, eax
xor r8d, r8d
jmp 0x14007e6b0
xor eax, eax
ret
mov r8, rdx
and r8, 0xfffffffffffffffc
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x1401257d0]
movdqa xmm3, xmmword [0x1401257e0]
pxor xmm1, xmm1
nop dword [rax]
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x14007e640
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x14007e6c7
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x14007e6b0
ret

Function at 0x1400820cc
Capabilities:
Get client handle via schannel
Get outbound credentials handle via credssp

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xb8
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0xa8], xmm0
movups xmmword [rsp + 0x98], xmm0
movups xmmword [rsp + 0x88], xmm0
mov byte [rax], al
add byte [rax], al

Function at 0x140082837
Capabilities:
Get remote cert context via schannel

Disassembly:
sub rsp, 0x28
lea r8, [rsp + 0x20]
and qword [r8], 0
add byte [rdx + 0x53], bh
push rbx
add byte [rax], al
invalid
Function at 0x140085d7f
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
mov eax, edx
lea r9, [rsp + 0x34]
mov dword [r9], r8d
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, eax
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x140085dac
xor eax, eax
jmp 0x140085db1
call fcn.14003bb96
nop
add rsp, 0x38
ret

Function at 0x140087c40
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
add byte [rax - 0x77], cl
xlatb

Function at 0x14008c400
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x4a8
lea rbp, [rsp + 0x80]
and al, 0x80
add byte [rax], al
add byte [rax - 0x39], cl
test dword [rax], esp
add al, 0
add dh, bh
invalid
invalid
dec dword [rax - 0x77]
mov esi, ecx
lea rcx, [rbp - 0x58]
call fcn.140088580
mov rax, qword [rbp - 0x58]
movabs rdi, 0x8000000000000000
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax + 0x75f83948], al
invalid
lea rcx, [rbp - 0x50]
call fcn.140086450
mov qword [rsi], rdi
jmp 0x14008c659
mov qword [rbp + 0x3c8], rsi
mov qword [rbp + 0x408], rax
mov rax, qword [rbp - 0x50]
mov qword [rbp + 0x410], rax
adc byte [rax + rax], al
add byte [rax - 0x39], cl
test eax, esi
add eax, dword [rax]
add byte [rax], al
add byte [rax], al
add byte [rax - 0x39], cl
test eax, edi
add eax, dword [rax]
add byte [rdx], al
add byte [rax], al
add byte [rax - 0x39], cl
test dword [rax], eax
add al, 0
add byte [rax], al
add byte [rax], al
add byte [rcx - 0x48], al
add byte [rdx], al
add byte [rax], al
mov eax, 2
mov qword [rbp + 0x418], rax
sbb byte [rax + rax], al
add byte [rcx], dh
push qword [rcx]
fild dword [rbp + 0x31]
in al, 0x49
cmp eax, 0x201
add byte [rbx + 0x2e], dh
jmp fcn.14008c4cf
nop
add rsp, 0x4a8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rdi
pop rbp
ret
Function at 0x14008f8b0
Capabilities:
Resolve dns

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1e0
mov rsi, rcx
mov r14, qword [rdx]
mov rbx, qword [rdx + 8]
movzx edi, word [rdx + 0x10]
mov rax, qword [0x1401a1bc8]
add byte [rax - 0x7d], cl
clc
add ecx, dword [rdi]
invalid
invalid
add dword [rax], eax
invalid
cmp rbx, 0x17f
call fcn.140124430
cmp rbx, 0x17f
jbe 0x14008f8ea

Function at 0x140090de0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
mov edx, 0x10
call qword [sym.imp.advapi32.dll_SystemFunction036]
test al, al
je 0x140090e23
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
add rsp, 0x80
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x30], rax
lea rax, [fcn.14008cfd0]
mov qword [rbp - 0x28], rax
lea rax, str.fallback_RNG_broken:
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 1
mov qword [rbp - 0x40], 0
lea rax, [rbp - 0x30]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 1
lea rdx, str.library_std_src_syspalwindows_rand.rs
lea rcx, [rbp - 0x60]
call fcn.140121460
ud2

Function at 0x140094070
Capabilities:
Generate random numbers via winapi

Disassembly:
sub rsp, 0x38
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x1400940a5
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
mov edx, dword [rsp + 0x28]
invalid
call fcn.140090de0

Function at 0x1400998e4
Capabilities:
Create thread

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x128
lea rbp, [rsp + 0x80]
movdqa xmmword [rbp + 0x90], xmm8
movdqa xmmword [rbp + 0x80], xmm7
movdqa xmmword [rbp + 0x70], xmm6
mov qword [rbp + 0x68], 0xfffffffffffffffe
mov r15, r8
mov rbx, rdx
mov rdi, rcx
lea rsi, [rcx + 0x40]
mov rcx, rsi
call fcn.140094a68
cmp byte [rdi + 0xc4], 0
je 0x140099955
mov rcx, rbx
call fcn.1400958b3
xor ebx, ebx
push 1
pop rdi
mov rcx, rsi
call fcn.140042628
jmp 0x140099e0e
invalid
mov rcx, qword [rdi + 0x48]
mov rax, qword [rdi + 0x60]

Function at 0x14009a0f7
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx]
mov rdx, rax
xor rdx, 3
lock cmpxchg qword [rcx], rdx
jne 0x14009a0fe
test al, 1
je 0x14009a11d
test al, 2
jne 0x14009a135
xor rax, 3
add rsp, 0x28
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x140162550]
mov edx, 0x23
call fcn.140121620
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x140162590]
mov edx, 0x25
call fcn.140121620
int3
Function at 0x14009abc9
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
mov ebx, edx
call fcn.140099847
mov rcx, qword [rax]
movzx eax, bl
lea r9, [rsp + 0x2c]
mov dword [r9], eax
mov dword [rsp + 0x20], 4
mov edx, 6
mov r8d, 1
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x14009ac05
xor eax, eax
jmp 0x14009ac13
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
add rsp, 0x30
pop rbx
ret
Function at 0x14009ae7a
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rdi, r9
mov rbx, r8
mov r14, rdx
mov qword [rsp + 0x28], rcx
mov rax, qword [rsp + 0xd0]
lea r15, [rsp + 0x3a]
lea r13, [rsp + 0x52]
mov rbp, qword [rdx + 0x10]
mov r12, qword [rdx + 0x18]
mov ecx, 0x7fffffff
cmp rax, rcx
cmovb rcx, rax
mov qword [rsp + 0x60], rcx
mov rax, qword [rdx + 0x20]
mov qword [rsp + 0x58], rax
lea rsi, [rsp + 0x30]
mov qword [rsp + 0x40], rbp
Function at 0x1400d0e90
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov ebx, r8d
mov rdi, rdx
mov r8, rdx
mov dword [rsp + 0x20], ebx
mov r9, rdx
mov rsi, rcx
lea rdx, str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d_NULL
call fcn.1400ec954
test ebx, ebx
jne 0x1400d0ed4
mov r8, rdi
lea rdx, str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1_NULL
mov rcx, rsi
call fcn.1400ec954
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1401121d0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
xor ebx, ebx
mov r15, rcx
mov qword [rcx], rbx
mov rbp, r8
mov r12, rdx
lea r13d, [rbx + 0x28]
mov ecx, r13d
call fcn.1400ec390
mov rdi, rax
test rax, rax
jne 0x140112216
lea ebx, [rax + 7]
jmp 0x1401122a8
cmp byte [0x14019f0d4], bl
je 0x140112278
mov rax, qword [0x14019f258]
test rax, rax
je 0x140112235
mov ecx, 0xc8
call rax
test eax, eax
jne 0x140112278
lea r14, [rdi + 8]
mov qword [rdi + 0x18], rbp
lea rsi, [rdi + 0x10]
mov qword [rsp + 0x28], r14
mov r9, rdi
mov dword [rsp + 0x20], ebx
lea r8, [0x1400f7cf8]
mov qword [rsi], r12
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
jne 0x14011228d
mov r8, r13
xor edx, edx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memset
jmp 0x14011228d
mov r8, r13
xor edx, edx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memset
lea rsi, [rdi + 0x10]
lea r14, [rdi + 8]
cmp qword [rsi], rbx
jne 0x1401122a5
call qword [sym.imp.kernel32.dll_GetCurrentThreadId]
mov rcx, rbp
mov dword [r14], eax
call r12
mov qword [rdi + 0x20], rax
mov qword [r15], rdi
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14011ccf8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
movsxd r9, dword [rcx + 0xc]
mov r10, rcx
movsxd rbx, r8d
test r8d, r8d
jle 0x14011cd46
mov r11, r9
xor edi, edi
mov al, byte [rdx + rdi]
mov rcx, qword [r10]
xor byte [rcx + r11], al
lea ecx, [r9 + 1]
xor r9d, r9d
lea rax, [r11 + 1]
cmp ecx, dword [r10 + 8]
cmovl r9d, ecx
xor r11d, r11d
inc rdi
cmp ecx, dword [r10 + 8]
cmovl r11, rax
cmp rdi, rbx
jl 0x14011cd16
add dword [r10 + 0x10], r8d
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
mov dword [r10 + 0xc], r9d
ret

Function at 0x140120cec
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x140120d36
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140120d36
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140120d36
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140120d36
cmp dword [rcx + 0x84], 0xe
jbe 0x140120d36
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140120d38
xor al, al
add rsp, 0x28
ret
Function at 0x140002dd0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140008010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140002dfd
xor eax, eax
jmp 0x140002f69
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140002e37
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140002e37
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140002f69
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140002f5c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140002e7a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140002ea5
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002f61
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140002f14
sub eax, 1
je 0x140002f14
cmp eax, 2
jne 0x140002f5c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002f61
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140002f42
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140002f5c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140002f61
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140003800
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140003360
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140008010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140003433
cmp byte [rcx + 0x71], 0
je 0x140003433
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000342f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400033f4
sub eax, 1
je 0x1400033f8
cmp eax, 2
jne 0x14000342f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140003800
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140003426
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000342f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400033dc
xor al, al
jmp 0x1400033dc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140003800
add rsp, 0x60
pop rbx
ret

Function at 0x140004194
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400041de
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400041de
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400041de
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400041de
cmp dword [rcx + 0x84], 0xe
jbe 0x1400041de
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400041e0
xor al, al
add rsp, 0x28
ret
Function at 0x14001a880
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14001aa0b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [0x1403757e0]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.1400387a0
xorps xmm15, xmm15
mov r14, qword [0x1407f3188]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x14001a8e5
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x14001a8f4
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x14001a913
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x14001a923
cmp rbx, 0x1000
jae 0x14001a8eb
jmp 0x14001a98d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x14001a935
xor edx, edx
jmp 0x14001a984
mov rcx, qword [0x1403757e0]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.1400387a0
xorps xmm15, xmm15
mov r14, qword [0x1407f3188]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x14001a919
jmp 0x14001a908
call fcn.14006c880
xorps xmm15, xmm15
mov r14, qword [0x1407f3188]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.14003ce80
lea rax, [0x140457620]
mov ebx, 0x18
nop dword [rax]
call fcn.14003d700
mov rax, qword [rsp + 0x38]
call fcn.14003d440
lea rax, [0x140458262]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.14003d700
mov rax, qword [rsp + 0x30]
call fcn.14003d440
call fcn.14003d0c0
call fcn.14003cee0
lea rax, [0x14045d176]
mov ebx, 0x21
call fcn.14003b4e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.140069140
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.14001a880