joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001a470
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
movd edx, xmm0
mov r11d, edx
and r11d, 0x7fffff
shr edx, 0x17
and edx, 0xff
je 0x14001a4a5
add edx, 0xffffff6a
test r11d, r11d
je 0x14001a644
or r11d, 0x800000
jmp 0x14001a4b3
mov edx, 0xffffff6b
test r11d, r11d
je 0x14001a6de
imul r9d, edx, 0x4d105
sar r9d, 0x14
mov eax, 1
sub eax, r9d
mov ecx, 0x20
sub ecx, r9d
lea r8, [0x1400367c0]
mov r10, qword [r8 + rcx*8]
imul r8d, eax, 0x1a934f
sar r8d, 0x13
add r8d, edx
mov ecx, r8d
not cl
mov rbx, r10
shr rbx, cl
lea edi, [r11 + r11]
lea eax, [r11*2 + 1]
mov ecx, r8d
shl eax, cl
shl rax, 0x20
mul r10
mov rax, rdx
shr rax, 0x20
imul rsi, rax, 0x51eb851f
shr rsi, 0x25
imul ebp, esi, 0xffffff9c
add ebp, eax
cmp ebp, ebx
jae 0x14001a542
test ebp, ebp
jne 0x14001a57b
test r11b, 1
je 0x14001a57b
mov eax, edx
test rax, rax
jne 0x14001a57b
dec esi
mov ebp, 0x64
jmp 0x14001a5d4
ja 0x14001a5d4
lea eax, [rdi - 1]
imul rax, r10
mov cl, 0x40
sub cl, r8b
movzx ecx, cl
xor edx, edx
bt rax, rcx
setb dl
lea ecx, [r8 + 0x20]
neg ecx
shr rax, cl
xor ecx, ecx
test eax, eax
sete cl
not r11d
and r11d, ecx
or r11d, edx
je 0x14001a5d4
inc r9d
imul eax, esi, 0xc28f5c29
rol eax, 0x1e
xor ecx, ecx
cmp eax, 0x28f5c28
ja 0x14001a5b5
xor ecx, ecx
nop word cs:[rax + rax]
mov esi, eax
add ecx, 2
imul eax, eax, 0xc28f5c29
rol eax, 0x1e
cmp eax, 0x28f5c29
jb 0x14001a5a0
imul eax, esi, 0xcccccccd
ror eax, 1
xor edx, edx
cmp eax, 0x1999999a
setb dl
cmovae eax, esi
or edx, ecx
add r9d, edx
jmp 0x14001a73e
lea eax, [rsi + rsi*4]
shr ebx, 1
sub ebp, ebx
imul edx, ebp, 0x199a
add edx, 0x8002
movzx ecx, dx
shr edx, 0x10
lea eax, [rdx + rax*2]
cmp ecx, 0x1999
ja 0x14001a73e
mov ecx, edi
imul r10, rcx
mov cl, 0x40
sub cl, r8b
movzx ecx, cl
bt r10, rcx
setb cl
test bpl, 1
sete r11b
xor r11b, cl
je 0x14001a734
add r8d, 0x20
neg r8d
mov ecx, r8d
shr r10, cl
test r10d, r10d
sete cl
and edx, 1
and dl, cl
movzx ecx, dl
sub eax, ecx
jmp 0x14001a73e
imul r9d, edx, 0x9a209
add r9d, 0xfffc01e1
sar r9d, 0x15
imul r8d, r9d, 0xffe56cb1
sar r8d, 0x13
add r8d, edx
mov eax, 0x1f
sub eax, r9d
lea rcx, [0x1400367c0]
mov rax, qword [rcx + rax*8]
mov rcx, rax
shr rcx, 0x19
mov r11, rax
sub r11, rcx
mov cl, 0x28
sub cl, r8b
shr r11, cl
mov rsi, rax
shr rsi, 0x18
add rsi, rax
shr rsi, cl
mov ecx, edx
and ecx, 0xfffffffe
xor r10d, r10d
cmp ecx, 2
setne r10b
add r10d, r11d
mov r11d, esi
mov ecx, 0xcccccccd
imul rcx, r11
shr rcx, 0x23
lea r11d, [rcx + rcx]
lea r11d, [r11 + r11*4]
cmp r11d, r10d
jae 0x14001a6e5
mov cl, 0x27
sub cl, r8b
shr rax, cl
inc eax
shr eax, 1
cmp edx, 0xffffffdd
jne 0x14001a738
and eax, 0xfffffffe
jmp 0x14001a73e
xor eax, eax
xor r9d, r9d
jmp 0x14001a73e
inc r9d
imul eax, ecx, 0xc28f5c29
rol eax, 0x1e
xor edx, edx
cmp eax, 0x28f5c28
ja 0x14001a715
xor edx, edx
nop dword [rax]
mov ecx, eax
add edx, 2
imul eax, eax, 0xc28f5c29
rol eax, 0x1e
cmp eax, 0x28f5c29
jb 0x14001a700
imul eax, ecx, 0xcccccccd
ror eax, 1
xor r8d, r8d
cmp eax, 0x1999999a
setb r8b
cmovae eax, ecx
or r8d, edx
add r9d, r8d
jmp 0x14001a73e
dec eax
jmp 0x14001a73e
cmp eax, r10d
adc eax, 0
shl r9, 0x20
mov eax, eax
or rax, r9
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x14002ea50
Capabilities:
Resume thread

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
movaps xmmword [rsp + 0x30], xmm6
mov esi, dword [0x1400478c8]
call sub.KERNEL32.dll_GetCurrentThreadId
mov ecx, eax
mov eax, 0x10dd
cmp esi, ecx
jne 0x14002eb93
mov rdi, qword [0x1400478d0]
test rdi, rdi
je 0x14002eaf9
lea rsi, [rsp + 0x28]
xorps xmm6, xmm6
jmp 0x14002eaa3
mov rbx, qword [rdi]
mov rcx, rdi
call fcn.140032190
mov rdi, rbx
test rbx, rbx
je 0x14002eaf9
mov r8d, dword [rdi + 0x28]
mov rcx, qword [rdi + 0x18]
mov rax, qword [rdi + 0x20]
movzx edx, byte [rax + 0x3e]
mov r9, rsi
call sub.KERNEL32.dll_VirtualProtect
cmp dword [rdi + 8], 0
jne 0x14002ea90
mov rax, qword [rdi + 0x20]
test rax, rax
je 0x14002ea90
mov rcx, rax
and rcx, 0xffffffffffff0000
movups xmmword [rax + 0x50], xmm6
movups xmmword [rax + 0x40], xmm6
movups xmmword [rax + 0x30], xmm6
movups xmmword [rax + 0x20], xmm6
movups xmmword [rax + 0x10], xmm6
movups xmmword [rax], xmm6
mov rdx, qword [rcx + 0x10]
mov qword [rax + 0x48], rdx
mov qword [rcx + 0x10], rax
jmp 0x14002ea90
mov qword [0x1400478d0], 0
call sub.KERNEL32.dll_GetCurrentProcess
mov rdi, qword [0x1400478f0]
test rdi, rdi
je 0x14002eb50
mov rsi, rax
lea rbx, [rsp + 0x2c]
nop dword [rax]
mov edx, 0x10000
mov rcx, rdi
mov r8d, 0x20
mov r9, rbx
call sub.KERNEL32.dll_VirtualProtect
mov r8d, 0x10000
mov rcx, rsi
mov rdx, rdi
call sub.KERNEL32.dll_FlushInstructionCache
mov rdi, qword [rdi + 8]
test rdi, rdi
jne 0x14002eb20
mov rsi, qword [0x1400478d8]
test rsi, rsi
je 0x14002eb7c
nop dword [rax]
mov rcx, qword [rsi + 8]
call sub.KERNEL32.dll_ResumeThread
mov rdi, qword [rsi]
mov rcx, rsi
call fcn.140032190
mov rsi, rdi
test rdi, rdi
jne 0x14002eb60
mov qword [0x1400478d8], 0
mov dword [0x1400478c8], 0
xor eax, eax
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
Function at 0x14002ff20
Capabilities:
Allocate or change rwx memory

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
movaps xmmword [rsp + 0x50], xmm6
movzx eax, cx
mov edi, 0x10000
sub rdi, rax
test rax, rax
cmove rdi, rax
add rdi, rcx
cmp rdi, rdx
jae 0x14003001f
mov rsi, rdx
xorps xmm6, xmm6
lea rbx, [rsp + 0x20]
jmp 0x14002ff70
add rdi, 0x8000000
cmp rdi, rsi
jae 0x14003001f
cmp rdi, qword [0x140047728]
jb 0x14002ff82
cmp rdi, qword [0x140047730]
jbe 0x14002ff60
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm6
movaps xmmword [rsp + 0x20], xmm6
mov r8d, 0x30
mov rcx, rdi
mov rdx, rbx
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
je 0x14003001f
cmp dword [rsp + 0x40], 0x10000
mov rax, qword [rsp + 0x38]
jne 0x140030000
cmp rax, 0x10000
jb 0x140030000
mov edx, 0x10000
mov rcx, rdi
mov r8d, 0x3000
mov r9d, 0x40
call sub.KERNEL32.dll_VirtualAlloc
mov r14, rax
test rax, rax
jne 0x140030022
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
je 0x140030022
add rdi, 0x10000
jmp 0x14002ff67
add rax, qword [rsp + 0x20]
movzx ecx, ax
mov edi, 0x10000
sub rdi, rcx
test rcx, rcx
cmove rdi, rcx
add rdi, rax
jmp 0x14002ff67
xor r14d, r14d
mov rax, r14
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140030040
Capabilities:
Parse pe header

Disassembly:
push rsi
push rdi
sub rsp, 0x58
test rcx, rcx
je 0x140030116
mov rsi, rcx
test rdx, rdx
je 0x14003005e
mov qword [rdx], 0
movzx eax, byte [rsi]
cmp al, 0xff
je 0x14003011a
cmp al, 0xeb
jne 0x140030189
movsx rax, byte [rsi + 1]
lea rdi, [rsi + rax]
add rdi, 2
movzx eax, byte [rsi + rax + 2]
cmp eax, 0xe9
je 0x14003018e
cmp eax, 0xff
jne 0x140030199
cmp byte [rdi + 1], 0x25
jne 0x140030199
movsxd rsi, dword [rdi + 2]
lea rdx, [rsp + 0x28]
mov r8d, 0x30
mov rcx, rdi
call sub.KERNEL32.dll_VirtualQuery
mov rax, qword [rsp + 0x30]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x140030199
movsxd rdx, dword [rax + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x140030199
lea rcx, [rdi + rsi]
add rcx, 6
mov r8d, dword [rax + rdx + 0xe8]
add r8, rax
cmp r8, rcx
ja 0x140030199
mov eax, dword [rax + rdx + 0xec]
add r8, rax
cmp r8, rcx
jbe 0x140030199
mov rdi, qword [rcx]
jmp 0x140030199
xor edi, edi
jmp 0x140030199
cmp byte [rsi + 1], 0x25
jne 0x14003017e
movsxd rdi, dword [rsi + 2]
lea rdx, [rsp + 0x28]
mov r8d, 0x30
mov rcx, rsi
call sub.KERNEL32.dll_VirtualQuery
mov rax, qword [rsp + 0x30]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x14003017e
movsxd rdx, dword [rax + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x14003017e
lea rcx, [rsi + rdi]
add rcx, 6
mov r8d, dword [rax + rdx + 0xe8]
add r8, rax
cmp r8, rcx
ja 0x14003017e
mov eax, dword [rax + rdx + 0xec]
add r8, rax
cmp r8, rcx
jbe 0x14003017e
mov rsi, qword [rcx]
movzx eax, byte [rsi]
cmp al, 0xeb
je 0x140030071
mov rdi, rsi
jmp 0x140030199
movsxd rax, dword [rdi + 1]
add rdi, rax
add rdi, 5
mov rax, rdi
add rsp, 0x58
pop rdi
pop rsi
ret
Function at 0x140030390
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x48
movdqa xmmword [rsp + 0x30], xmm6
cmp byte [0x140047950], 0
je 0x1400303af
xor eax, eax
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
mov rax, qword [0x140047948]
test rax, rax
jne 0x1400303a5
pxor xmm6, xmm6
movdqu xmmword [0x140047930], xmm6
movdqu xmmword [0x140047920], xmm6
movdqu xmmword [0x140047910], xmm6
movdqu xmmword [0x140047900], xmm6
mov qword [0x140047940], 0
call sub.KERNEL32.dll_GetCurrentProcess
mov qword [0x140047900], rax
lea rcx, str.dbghelp.dll
xor edx, edx
xor r8d, r8d
call sub.KERNEL32.dll_LoadLibraryExW
mov qword [0x140047908], rax
test rax, rax
je 0x14003059c
lea rdx, str.ImagehlpApiVersionEx
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x140047910], rax
mov rcx, qword [0x140047908]
lea rdx, str.SymInitialize
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x140047918], rax
mov rcx, qword [0x140047908]
lea rdx, str.SymSetOptions
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x140047920], rax
mov rcx, qword [0x140047908]
lea rdx, str.SymGetOptions
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x140047928], rax
mov rcx, qword [0x140047908]
lea rdx, str.SymLoadModule64
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x140047930], rax
mov rcx, qword [0x140047908]
lea rdx, str.SymGetModuleInfo64
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x140047938], rax
mov rcx, qword [0x140047908]
lea rdx, str.SymFromName
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x140047940], rax
mov qword [rsp + 0x28], 0xc
mov rdx, qword [0x140047910]
movdqu xmm0, xmmword [0x140047930]
movq xmm1, rdx
movq xmm2, qword [0x140047918]
punpcklqdq xmm2, xmm1
pcmpeqd xmm0, xmm6
pshufd xmm1, xmm0, 0xb1
pand xmm1, xmm0
pcmpeqd xmm2, xmm6
pshufd xmm0, xmm2, 0xb1
pand xmm0, xmm2
packssdw xmm0, xmm1
movmskps ecx, xmm0
test ecx, ecx
jne 0x140030582
test rax, rax
je 0x140030582
lea rcx, [rsp + 0x28]
call rdx
cmp word [rsp + 0x28], 0xc
jb 0x140030582
mov rcx, qword [0x140047900]
xor edx, edx
xor r8d, r8d
call qword [0x140047918]
test eax, eax
je 0x140030582
mov rax, qword [0x140047928]
test rax, rax
je 0x14003056a
cmp qword [0x140047920], 0
je 0x14003056a
call rax
and eax, 0xffffd8f8
lea ecx, [rax + 0x2704]
call qword [0x140047920]
lea rax, [0x140047900]
mov qword [0x140047948], rax
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
mov rcx, qword [0x140047908]
mov byte [0x140047950], 1
test rcx, rcx
je 0x1400305a3
call sub.KERNEL32.dll_FreeLibrary
jmp 0x1400305a3
mov byte [0x140047950], 1
xorps xmm0, xmm0
movups xmmword [0x140047930], xmm0
movups xmmword [0x140047920], xmm0
movups xmmword [0x140047910], xmm0
mov qword [0x140047940], 0
xor eax, eax
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x140030a80
Capabilities:
Parse pe header

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rsi, rcx
test rcx, rcx
je 0x140030ac0
movzx eax, word [rsi]
cmp eax, 0x5a4d
jne 0x140030ad4
movsxd rdi, dword [rsi + 0x3c]
cmp dword [rsi + rdi], 0x4550
jne 0x140030ae2
cmp word [rsi + rdi + 0x14], 0
je 0x140030af0
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov esi, dword [rsi + rdi + 0x50]
jmp 0x140030afc
xor ecx, ecx
call sub.KERNEL32.dll_GetModuleHandleW
mov rsi, rax
movzx eax, word [rsi]
cmp eax, 0x5a4d
je 0x140030a9e
xor esi, esi
mov ecx, 0xc1
call sub.KERNEL32.dll_SetLastError
jmp 0x140030afc
xor esi, esi
mov ecx, 0xbf
call sub.KERNEL32.dll_SetLastError
jmp 0x140030afc
xor esi, esi
mov ecx, 0xc0
call sub.KERNEL32.dll_SetLastError
mov eax, esi
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret

Function at 0x140030b30
Capabilities:
Parse pe header

Disassembly:
push rbp
push rsi
sub rsp, 0x58
lea rbp, [rsp + 0x50]
xorps xmm0, xmm0
movaps xmmword [rbp - 0x10], xmm0
movaps xmmword [rbp - 0x20], xmm0
movaps xmmword [rbp - 0x30], xmm0
lea rdx, [rbp - 0x30]
mov r8d, 0x30
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
je 0x140030bad
cmp dword [rbp - 0x10], 0x1000
jne 0x140030ba1
mov eax, dword [rbp - 0xc]
cmp al, 1
je 0x140030ba1
and eax, 0x100
jne 0x140030ba1
mov rsi, qword [rbp - 0x28]
movzx eax, word [rsi]
cmp eax, 0x5a4d
jne 0x140030bc3
movsxd rax, dword [rsi + 0x3c]
cmp dword [rsi + rax], 0x4550
jne 0x140030bcf
cmp word [rsi + rax + 0x14], 0
je 0x140030bdb
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
jmp 0x140030bb9
mov ecx, 0xc1
call sub.KERNEL32.dll_SetLastError
jmp 0x140030bb7
mov ecx, 0xc1
call sub.KERNEL32.dll_SetLastError
xor esi, esi
mov rax, rsi
add rsp, 0x58
pop rsi
pop rbp
ret
mov ecx, 0xc1
call sub.KERNEL32.dll_SetLastError
jmp 0x140030bb7
mov ecx, 0xbf
call sub.KERNEL32.dll_SetLastError
jmp 0x140030bb7
mov ecx, 0xc0
call sub.KERNEL32.dll_SetLastError
jmp 0x140030bb7
Function at 0x140030e10
Capabilities:
Parse pe header

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov rbx, r9
mov qword [rbp], r8
mov rdi, rdx
mov r14, rcx
test rcx, rcx
je 0x140030f76
movzx eax, word [r14]
cmp eax, 0x5a4d
jne 0x140030f8f
movsxd rax, dword [r14 + 0x3c]
cmp dword [r14 + rax], 0x4550
jne 0x140030f9d
cmp word [r14 + rax + 0x14], 0
je 0x140030fab
mov edx, dword [r14 + rax + 0x90]
mov rcx, r14
call fcn.140030e00
test rax, rax
jne 0x140030eaa
xor esi, esi
mov ecx, 0xc0
call sub.KERNEL32.dll_SetLastError
jmp 0x140030fe5
test rbx, rbx
je 0x140030ea2
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call rbx
mov rax, qword [rbp - 8]
add rax, 0x14
mov r12d, dword [rax]
test r12d, r12d
je 0x140030fb9
mov qword [rbp - 8], rax
mov edx, dword [rax + 0xc]
mov rcx, r14
call fcn.140030e00
mov rsi, rax
test rax, rax
je 0x140030fd9
mov rcx, r14
mov edx, r12d
call fcn.140030e00
mov r12, rax
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0x10]
mov rcx, r14
call fcn.140030e00
mov r13, rax
mov rcx, qword [rax]
call fcn.140030b30
cmp qword [rbp], 0
je 0x140030f14
mov rcx, rdi
mov rdx, rax
mov r8, rsi
call qword [rbp]
test eax, eax
je 0x140030fc0
test r12, r12
je 0x140030ea2
xor esi, esi
jmp 0x140030f22
inc esi
mov r15d, esi
mov rdx, qword [r12 + r15*8]
test rdx, rdx
je 0x140030e90
js 0x140030f50
add edx, 2
mov rcx, r14
call fcn.140030e00
xor edx, edx
test rbx, rbx
jne 0x140030f5a
jmp 0x140030f20
movzx edx, dx
xor eax, eax
test rbx, rbx
je 0x140030f20
lea r9, [r15*8]
add r9, r13
mov rcx, rdi
mov r8, rax
call rbx
test eax, eax
jne 0x140030f20
jmp 0x140030e95
xor ecx, ecx
call sub.KERNEL32.dll_GetModuleHandleW
mov r14, rax
movzx eax, word [r14]
cmp eax, 0x5a4d
je 0x140030e4a
xor esi, esi
mov ecx, 0xc1
call sub.KERNEL32.dll_SetLastError
jmp 0x140030fe5
xor esi, esi
mov ecx, 0xbf
call sub.KERNEL32.dll_SetLastError
jmp 0x140030fe5
xor esi, esi
mov ecx, 0xc0
call sub.KERNEL32.dll_SetLastError
jmp 0x140030fe5
cmp qword [rbp], 0
je 0x140030fcb
mov rcx, rdi
xor edx, edx
xor r8d, r8d
call qword [rbp]
mov esi, 1
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
jmp 0x140030fe5
xor esi, esi
mov ecx, 0xc0
call sub.KERNEL32.dll_SetLastError
mov eax, esi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1400310d0
Capabilities:
Parse pe header

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rsi, rcx
test rcx, rcx
je 0x14003119b
movzx eax, word [rsi]
cmp eax, 0x5a4d
jne 0x1400311b3
movsxd rax, dword [rsi + 0x3c]
cmp dword [rsi + rax], 0x4550
jne 0x1400311bf
add rax, rsi
movzx ecx, word [rax + 0x14]
test rcx, rcx
je 0x1400311d7
lea rbx, [rax + rcx]
add rbx, 0x18
movzx r14d, word [rax + 6]
xor r15d, r15d
lea rdi, str..detour
nop word cs:[rax + rax]
cmp r15d, r14d
jae 0x1400311cb
mov eax, r15d
lea r12, [rax + rax*4]
lea rcx, [rbx + r12*8]
mov rdx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
inc r15d
test eax, eax
jne 0x140031140
mov eax, dword [rbx + r12*8 + 0xc]
test rax, rax
je 0x1400311cb
cmp dword [rbx + r12*8 + 0x10], 0
je 0x1400311cb
mov ecx, dword [rsi + rax]
cmp ecx, 0x40
jb 0x1400311cb
add rsi, rax
cmp dword [rsi + 4], 0x727444
jne 0x1400311cb
cmp dword [rsi + 8], 0
jne 0x140031192
mov dword [rsi + 8], ecx
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
jmp 0x1400311e3
xor ecx, ecx
call sub.KERNEL32.dll_GetModuleHandleW
mov rsi, rax
movzx eax, word [rsi]
cmp eax, 0x5a4d
je 0x1400310fd
mov ecx, 0xc1
call sub.KERNEL32.dll_SetLastError
jmp 0x1400311e1
mov ecx, 0xbf
call sub.KERNEL32.dll_SetLastError
jmp 0x1400311e1
mov ecx, 0xc0
call sub.KERNEL32.dll_SetLastError
jmp 0x1400311e1
mov ecx, 0xc0
call sub.KERNEL32.dll_SetLastError
xor esi, esi
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret

Function at 0x140031370
Capabilities:
Parse pe header

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
movaps xmmword [rsp + 0x50], xmm6
mov rsi, rdx
mov rdi, rcx
xor ebx, ebx
xorps xmm6, xmm6
lea r14, [rsp + 0x20]
add rbx, 0x10000
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm6
movaps xmmword [rsp + 0x20], xmm6
jmp 0x1400313ba
mov rbx, qword [rsp + 0x20]
add rbx, qword [rsp + 0x38]
mov r8d, 0x30
mov rcx, rbx
mov rdx, r14
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
je 0x140031427
cmp dword [rsp + 0x40], 0x1000
jne 0x1400313b0
mov eax, dword [rsp + 0x44]
cmp al, 1
je 0x1400313b0
and eax, 0x100
jne 0x1400313b0
movzx eax, word [rbx]
cmp eax, 0x5a4d
jne 0x1400313b0
mov eax, dword [rbx + 0x3c]
cmp rax, 0x40
jb 0x1400313b0
cmp qword [rsp + 0x38], rax
jb 0x1400313b0
cdqe
cmp dword [rbx + rax], 0x4550
jne 0x1400313b0
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call fcn.140031220
test rax, rax
je 0x14003138e
jmp 0x140031433
mov ecx, 0x7e
call sub.KERNEL32.dll_SetLastError
xor eax, eax
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140032c3c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x140032c76
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x140032c7b
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140032cc4
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140036e20]
cmp byte [rcx + rax], 0
je 0x140032cc4
dec r8
sub rdx, 1
jne 0x140032caa
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140033060
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400330aa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400330aa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400330aa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400330aa
cmp dword [rcx + 0x84], 0xe
jbe 0x1400330aa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400330ac
xor al, al
add rsp, 0x28
ret
Function at 0x140001330
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aeskeygenassist xmm0, xmmword [rdx], 2
movdqa xmmword [rcx], xmm0
ret
Function at 0x14000c720
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3d0], rcx
mov qword [rbp + 0x3d8], 0
mov qword [rbp + 0x3e0], 2
mov qword [rbp + 0x3e8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3c8], rax
xor esi, esi
xor edi, edi
xor ebx, ebx
cmp r8, 0x201
jae 0x14000c7c0
jmp 0x14000c7af
jae 0x14000c87f
cmp r8, 0x201
jae 0x14000c7c0
mov r14d, 0x200
lea r15, [rbp - 0x58]
mov r12, r8
jmp 0x14000c817
sub r8, rbx
sub rdi, rbx
cmp rdi, r8
jae 0x14000c7ef
lea rcx, [rbp + 0x3d8]
mov rdx, rbx
call fcn.140026f40
mov rsi, qword [rbp + 0x3d8]
mov rax, qword [rbp + 0x3e0]
mov qword [rbp + 0x3c8], rax
mov eax, 0xffffffff
cmp rsi, rax
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rbp + 0x3e8], rbx
mov rdi, rsi
mov r14, rbx
mov r15, qword [rbp + 0x3c8]
mov r12, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r12d
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r13d, eax
test eax, eax
jne 0x14000c840
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14000c8eb
mov r8d, r13d
cmp r12, r8
jne 0x14000c7a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14000c91f
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x14000c7af
jmp 0x14000c7c0
cmp r14, r8
jb 0x14000c939
lea rcx, [rbp + 0x3a8]
mov rdx, r15
call fcn.14000f550
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3d0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
je 0x14000c8d4
mov rcx, qword [rbp + 0x3e0]
add rdx, rdx
mov r8d, 2
call fcn.140007a80
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3d0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
jne 0x14000c8bf
jmp 0x14000c8d4
lea rcx, str.internal_error:_entered_unreachable_code_rustc_129f3b9964af4d4a709d1383930ade12dfe7c081library_alloc_src_vecmod.rs
lea r8, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.140027f60
jmp 0x14000c94e
lea rax, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.1400282b0
ud2
Function at 0x14000f490
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rcx, qword [rcx]
cmp r8, 0x7fffffff
mov eax, 0x7fffffff
cmovae r8, rax
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x14000f4c6
movsxd rdx, eax
xor eax, eax
add rsp, 0x20
pop rbp
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0x20
pop rbp
ret

Function at 0x14000f4f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rcx, qword [rcx]
cmp r8, 0x7fffffff
mov eax, 0x7fffffff
cmovae r8, rax
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x14000f522
movsxd rdx, eax
xor ecx, ecx
jmp 0x14000f546
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
xor edx, edx
mov ecx, 0
cmp eax, 0x274a
je 0x14000f546
shl rax, 0x20
or rax, 2
mov ecx, 1
mov rdx, rax
mov rax, rcx
add rsp, 0x20
pop rbp
ret

Function at 0x140013910
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov rsi, rcx
movups xmm0, xmmword [0x14002be70]
movaps xmmword [rbp], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
test r9, r9
je 0x140013948
mov rcx, qword [rbp + 0x60]
mov qword [rbp - 0x30], rcx
test r9, r9
mov qword [rbp - 0x38], r9
lea rcx, [rbp - 0x30]
cmove rcx, r9
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov rax, rbp
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x14001399f
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rbp]
cmp eax, 0xc0000011
jne 0x1400139ac
xor edx, edx
xor eax, eax
jmp 0x1400139d6
cmp eax, 0x103
je 0x1400139e0
test eax, eax
js 0x1400139bf
mov rdx, qword [rbp + 8]
xor eax, eax
jmp 0x1400139d6
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa8
pop rsi
pop rbp
ret
mov dword [rbp + 0x18], 0
mov byte [rbp + 0x1c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x18]
lea rdx, [rbp - 0x38]
call fcn.14000e8d0
mov qword [rbp - 8], rax
lea rcx, [rbp - 8]
call fcn.14000abd0
mov ecx, 7
int 0x29
ud2