joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003e530
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x1400ae368]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbx, rcx
cmp qword [rcx + 0x20], 0
je 0x14003e64c
mov rcx, qword [rcx + 0x28]
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x14003e5a3
lea rcx, [0x14003e9b0]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdx
lea rdx, [rsp + 0x40]
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14004c5b0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov rdi, qword [rcx + 0x10]
mov rax, qword [rdx]
xor esi, esi
mov qword [rdx], rsi
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x20]
mov qword [rsp + 0x50], rax
mov ecx, dword [0x1400b5ba0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14003e5df
mov rdx, qword [rax + 8]
jmp 0x14003e5e2
mov rdx, rsi
mov r8d, 0x18
call fcn.14000d8c0
mov qword [rsp + 0x60], rsi
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x28], rsi
mov qword [rax + 8], rcx
lea rcx, [0x14003eb30]
mov qword [rax], rcx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x58], rsi
lea rcx, [rsp + 0x50]
call fcn.14003e840
nop
lea rcx, [rsp + 0x28]
call fcn.14000bfb0
nop
lea rdx, [rsp + 0x30]
mov rcx, rbx
call rdi
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14003e647
mov rax, qword [rcx]
xor edx, edx
call rax
nop
jmp 0x14003e584
lea rcx, [rsp + 0x50]
call fcn.140004140
nop
lea rcx, [rsp + 0x50]
call fcn.140009ab0
int3

Function at 0x14003e840
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14003e867
add rcx, 8
call fcn.14000bfb0
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x14003e8b3
mov ecx, dword [0x1400b5ba0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14003e8a3
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14003e8a3
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x14003e8be
inc ecx
inc rax
cmp rax, 6
jl 0x14003e891
mov rcx, rbx
call case.0x1400459db.0
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x18]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x30]
mov qword [rdi + 8], 0
add rsp, 0x20
pop rdi
ret
Function at 0x14003e8e0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14003e907
add rcx, 0x10
call fcn.14003fda4
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x14003e953
mov ecx, dword [0x1400b5ba0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14003e943
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14003e943
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x14003e95e
inc ecx
inc rax
cmp rax, 6
jl 0x14003e931
mov rcx, rbx
call case.0x1400459db.0
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x28]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x30]
mov qword [rdi + 8], 0
add rsp, 0x20
pop rdi
ret
Function at 0x14003ed00
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1400ae368]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rcx
mov qword [rbp - 0x30], rcx
xor esi, esi
mov dword [rbp - 0x58], esi
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx], rsi
mov qword [rcx + 8], rsi
mov qword [rcx + 0x10], rsi
mov dword [rbp - 0x58], 1
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x28], xmm1
mov qword [rbp - 0x18], rsi
mov ecx, 0x2027
call fcn.14004c6f0
test rax, rax
je 0x14003eef1
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
mov qword [rbp - 0x28], rcx
lea rbx, [rcx + 0x2000]
mov qword [rbp - 0x18], rbx
xor edx, edx
mov r8d, 0x2000
call fcn.14004f060
mov qword [rbp - 0x20], rbx
mov rdx, qword [rbp - 0x28]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov rcx, qword [rbp - 0x28]
test eax, eax
je 0x14003ee8b
mov ebx, 4
nop word [rax + rax]
movzx eax, word [rbx + rcx - 4]
test ax, ax
je 0x14003ee7d
mov word [rbp - 0x60], ax
movzx eax, word [rbx + rcx - 2]
mov word [rbp - 0x5e], ax
movzx ecx, word [rbx + rcx]
mov word [rbp - 0x5c], cx
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x38], 7
mov qword [rbp - 0x40], 3
mov eax, dword [rbp - 0x60]
mov dword [rbp - 0x50], eax
mov word [rbp - 0x4c], cx
mov word [rbp - 0x4a], si
mov rdx, qword [rdi + 8]
cmp rdx, qword [rdi + 0x10]
je 0x14003ee31
movups xmm0, xmmword [rbp - 0x50]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp - 0x40]
movups xmmword [rdx + 0x10], xmm1
mov edx, 7
mov word [rbp - 0x50], si
add qword [rdi + 8], 0x20
jmp 0x14003ee41
lea r8, [rbp - 0x50]
mov rcx, rdi
call fcn.14000fe50
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x14003ee79
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003ee74
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003eeeb
call fcn.14004c97c
mov rcx, qword [rbp - 0x28]
add rbx, 8
cmp rbx, 0x2c
jl 0x14003edc0
test rcx, rcx
je 0x14003eec3
mov rdx, qword [rbp - 0x18]
sub rdx, rcx
sar rdx, 1
add rdx, rdx
mov r8, rcx
cmp rdx, 0x1000
jb 0x14003eebe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub r8, rcx
add r8, 0xfffffffffffffff8
cmp r8, 0x1f
ja 0x14003eef1
call fcn.14004c97c
mov rax, rdi
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14004c5b0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.140053d3c
nop
call fcn.140053d3c
int3
Function at 0x14003ef00
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1400ae368]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r10, qword [rdx + 0x18]
movzx esi, r8b
mov r9, qword [rdx + 0x10]
mov rdi, rdx
mov qword [rsp + 0x28], rcx
mov rbx, rcx
cmp r10, 8
jb 0x14003ef3e
mov rdx, qword [rdx]
test r9, r9
je 0x14003effe
lea rcx, [r9 - 1]
mov rax, 0xffffffffffffffff
cmp rcx, rax
cmovb rax, rcx
cmp word [rdx + rax*2], 0x2e
lea r8, [rdx + rax*2]
je 0x14003ef78
cmp r8, rdx
je 0x14003effe
sub r8, 2
cmp word [r8], 0x2e
jne 0x14003ef64
sub r8, rdx
sar r8, 1
cmp r8, 0xffffffffffffffff
je 0x14003effe
cmp r9, r8
xorps xmm0, xmm0
xorps xmm1, xmm1
mov rdx, rdi
cmovb r8, r9
movups xmmword [rsp + 0x30], xmm0
movdqu xmmword [rsp + 0x40], xmm1
cmp r10, 8
jb 0x14003efa8
mov rdx, qword [rdi]
lea rcx, [rsp + 0x30]
call fcn.14001ed80
test sil, sil
je 0x14003efdb
cmp qword [rsp + 0x48], 8
lea rdx, [rsp + 0x30]
cmovae rdx, qword [rsp + 0x30]
cmp qword [rdi + 0x18], 8
jb 0x14003efd2
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_MoveFileW]
movups xmm0, xmmword [rsp + 0x30]
mov qword [rbx + 0x10], 0
movups xmm1, xmmword [rsp + 0x40]
mov qword [rbx + 0x18], 0
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm1
jmp 0x14003f009
mov rdx, rdi
mov rcx, rbx
call fcn.140006e00
mov rax, rbx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14004c5b0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x14003f190
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x14003f214
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1400896a0]
cmp byte [rcx + rax], 0
je 0x14003f214
dec r8
sub rdx, 1
jne 0x14003f1fa
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x140043d50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbx
sub rsp, 0x50
mov rax, r8
mov rbx, rcx
test rdx, rdx
jne 0x140043d75
mov eax, 0xfffffff7
add rsp, 0x50
pop rbx
ret
test rax, rax
je 0x140043e68
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
mov ecx, dword [rbx + 0x88]
test ecx, ecx
jne 0x140043e13
mov eax, dword [rbx + 0x10]
lea edx, [rcx + 1]
mov r14d, dword [rbx + 0x94]
mov rcx, rbx
mov edi, dword [rbx + 0x3c]
mov esi, dword [rbx + 0x8c]
mov ebp, dword [rbx]
mov r13d, dword [rbx + 0x98]
mov r15d, dword [rbx + 0x14]
mov r12d, dword [rbx + 0x90]
mov dword [rsp + 0x78], eax
call fcn.140043e70
lea eax, [r14 + rdi]
mov dword [rbx + 0x88], 8
xor eax, esi
mov ecx, 8
xor eax, ebp
bswap eax
mov dword [rbx + 0x80], eax
lea eax, [r15 + r13]
xor eax, r12d
xor eax, dword [rsp + 0x78]
bswap eax
mov dword [rbx + 0x84], eax
mov eax, 8
sub eax, ecx
cdqe
movzx ecx, byte [rax + rbx + 0x80]
mov rax, qword [rsp + 0x68]
xor byte [rax], cl
inc rax
dec dword [rbx + 0x88]
sub qword [rsp + 0x70], 1
mov qword [rsp + 0x68], rax
jne 0x140043da1
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov r13, qword [rsp + 0x30]
mov r12, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x60]
xor eax, eax
add rsp, 0x50
pop rbx
ret
Function at 0x140044050
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
push r15
movzx eax, dl
lea r10, str.cw
movzx esi, byte [rax + r10]
mov eax, edx
shr eax, 8
movzx ecx, al
mov eax, edx
shr eax, 0x10
lea edi, [rsi + rsi]
movzx r15d, byte [rcx + r10]
movzx ecx, al
mov eax, edx
shr rax, 0x18
lea r9d, [r15 + r15]
movzx r14d, byte [rcx + r10]
mov r8d, r9d
xor r8d, r15d
movzx r10d, byte [rax + r10]
movzx eax, dil
xor al, 0x1b
movzx ebp, al
bt edi, 8
movzx eax, dil
cmovae ebp, eax
movzx eax, r8b
xor al, 0x1b
movzx ecx, al
bt r8d, 8
movzx eax, r8b
lea r8d, [r14 + r14]
cmovae ecx, eax
mov edx, r8d
xor bpl, cl
xor edx, r14d
xor bpl, r10b
movzx eax, dl
xor al, 0x1b
xor bpl, r14b
movzx r11d, al
bt edx, 8
movzx eax, dl
cmovae r11d, eax
movzx eax, r9b
xor al, 0x1b
movzx ecx, al
bt r9d, 8
movzx eax, r9b
lea r9d, [r10 + r10]
cmovae ecx, eax
mov edx, r9d
xor edx, r10d
xor r11b, cl
xor r11b, r10b
movzx eax, dl
xor al, 0x1b
xor r11b, sil
movzx r10d, al
bt edx, 8
movzx eax, dl
cmovae r10d, eax
movzx eax, r8b
xor al, 0x1b
movzx ecx, al
bt r8d, 8
movzx eax, r8b
cmovae ecx, eax
xor edi, esi
xor r10b, cl
movzx eax, dil
xor al, 0x1b
xor r10b, r15b
movzx ecx, al
xor r10b, sil
movzx eax, dil
bt edi, 8
cmovae ecx, eax
movzx eax, r9b
xor al, 0x1b
movzx r8d, cl
movzx ecx, al
movzx eax, r9b
mov rbx, qword [rsp + 0x18]
bt r9d, 8
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
cmovae ecx, eax
movzx eax, cl
xor eax, r8d
movzx ecx, r10b
xor eax, r14d
xor eax, r15d
shl eax, 8
or eax, ecx
movzx ecx, r11b
shl eax, 8
or eax, ecx
movzx ecx, bpl
mov rbp, qword [rsp + 0x20]
shl eax, 8
or eax, ecx
pop r15
pop r14
ret
Function at 0x14004a8c0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov r9, rdx
mov r8, rcx
mov edx, 8
lea ecx, [rdx + 6]
jmp 0x14004ad40
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
xor r11d, r11d
mov r10d, edx
lea esi, [rcx*4 + 4]
mov rdi, r8
lea rbp, [0x14008b270]
test edx, edx
je 0x14004adb1
mov rbx, r8
lea eax, [r11*4]
inc r11d
movzx edx, byte [rax + r9 + 3]
lea rbx, [rbx + 4]
shl edx, 8
mov ecx, eax
movzx eax, byte [rax + r9 + 2]
or edx, eax
shl edx, 8
movzx eax, byte [rcx + r9 + 1]
or edx, eax
movzx eax, byte [rcx + r9]
shl edx, 8
or edx, eax
mov dword [rbx - 4], edx
cmp r11d, r10d
jb 0x14004ad72
mov r9d, r10d
cmp r10d, esi
jae 0x14004ae94
lea r11, [r8 + r10*4]
lea rbx, [0x14008b280]
nop dword [rax + rax]
lea eax, [r9 - 1]
xor edx, edx
mov ecx, dword [rdi + rax*4]
mov eax, r9d
div r10d
test edx, edx
jne 0x14004ae2c
mov r8d, ecx
movzx eax, cl
movzx ecx, byte [rax + rbx]
mov eax, r8d
shr rax, 0x18
shl ecx, 8
movzx eax, byte [rax + rbx]
or ecx, eax
mov eax, r8d
shr rax, 0x10
shl ecx, 8
movzx edx, al
shr r8, 8
movzx eax, byte [rdx + rbx]
or ecx, eax
movzx eax, r8b
shl ecx, 8
movzx edx, byte [rax + rbx]
movzx eax, byte [rbp]
or ecx, edx
xor ecx, eax
inc rbp
jmp 0x14004ae78
cmp r10d, 6
jbe 0x14004ae78
cmp edx, 4
jne 0x14004ae78
mov r8, rcx
mov rax, rcx
shr rax, 0x10
movzx ecx, al
mov rax, r8
shr rax, 0x18
movzx ecx, byte [rcx + rbx]
movzx eax, byte [rax + rbx]
shl eax, 8
or ecx, eax
mov rax, r8
shr rax, 8
movzx edx, al
shl ecx, 8
movzx eax, byte [rdx + rbx]
or ecx, eax
movzx eax, r8b
shl ecx, 8
movzx edx, byte [rax + rbx]
or ecx, edx
mov eax, r9d
inc r9d
sub eax, r10d
xor ecx, dword [rdi + rax*4]
mov dword [r11], ecx
add r11, 4
cmp r9d, esi
jb 0x14004add0
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret

Function at 0x14004a8e0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], r9
mov r9, rdx
mov rdx, rcx
mov qword [rsp + 0x20], r8
mov ecx, 0xe
lea r8, [0x14008b280]
call fcn.14004aeb0
add rsp, 0x38
ret

Function at 0x14004a910
Capabilities:
Hash data using sha256

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.14004aa40
movups xmm0, xmmword [0x14008b230]
xor eax, eax
movups xmmword [rbx], xmm0
movups xmm1, xmmword [0x14008b240]
mov qword [rbx + 0x20], rax
mov dword [rbx + 0x28], eax
movups xmmword [rbx + 0x10], xmm1
add rsp, 0x20
pop rbx
ret
Function at 0x14004ad40
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov r9, rdx
mov r8, rcx
mov edx, 8
lea ecx, [rdx + 6]
jmp 0x14004ad40
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
xor r11d, r11d
mov r10d, edx
lea esi, [rcx*4 + 4]
mov rdi, r8
lea rbp, [0x14008b270]
test edx, edx
je 0x14004adb1
mov rbx, r8
lea eax, [r11*4]
inc r11d
movzx edx, byte [rax + r9 + 3]
lea rbx, [rbx + 4]
shl edx, 8
mov ecx, eax
movzx eax, byte [rax + r9 + 2]
or edx, eax
shl edx, 8
movzx eax, byte [rcx + r9 + 1]
or edx, eax
movzx eax, byte [rcx + r9]
shl edx, 8
or edx, eax
mov dword [rbx - 4], edx
cmp r11d, r10d
jb 0x14004ad72
mov r9d, r10d
cmp r10d, esi
jae 0x14004ae94
lea r11, [r8 + r10*4]
lea rbx, [0x14008b280]
nop dword [rax + rax]
lea eax, [r9 - 1]
xor edx, edx
mov ecx, dword [rdi + rax*4]
mov eax, r9d
div r10d
test edx, edx
jne 0x14004ae2c
mov r8d, ecx
movzx eax, cl
movzx ecx, byte [rax + rbx]
mov eax, r8d
shr rax, 0x18
shl ecx, 8
movzx eax, byte [rax + rbx]
or ecx, eax
mov eax, r8d
shr rax, 0x10
shl ecx, 8
movzx edx, al
shr r8, 8
movzx eax, byte [rdx + rbx]
or ecx, eax
movzx eax, r8b
shl ecx, 8
movzx edx, byte [rax + rbx]
movzx eax, byte [rbp]
or ecx, edx
xor ecx, eax
inc rbp
jmp 0x14004ae78
cmp r10d, 6
jbe 0x14004ae78
cmp edx, 4
jne 0x14004ae78
mov r8, rcx
mov rax, rcx
shr rax, 0x10
movzx ecx, al
mov rax, r8
shr rax, 0x18
movzx ecx, byte [rcx + rbx]
movzx eax, byte [rax + rbx]
shl eax, 8
or ecx, eax
mov rax, r8
shr rax, 8
movzx edx, al
shl ecx, 8
movzx eax, byte [rdx + rbx]
or ecx, eax
movzx eax, r8b
shl ecx, 8
movzx edx, byte [rax + rbx]
or ecx, edx
mov eax, r9d
inc r9d
sub eax, r10d
xor ecx, dword [rdi + rax*4]
mov dword [r11], ecx
add r11, 4
cmp r9d, esi
jb 0x14004add0
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
Function at 0x14004d43c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14004d486
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14004d486
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14004d486
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14004d486
cmp dword [rcx + 0x84], 0xe
jbe 0x14004d486
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14004d488
xor al, al
add rsp, 0x28
ret

Function at 0x14005f874
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14005f6a0
Function at 0x140074550
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140074578
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140074578
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x180001010
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0xffffffffffffffff
jne 0x180001061
xor eax, eax
jmp 0x1800010ba
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jne 0x180001088
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1800010ba
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x40]
add rsp, 0x58
ret

Function at 0x1800010c0
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0xffffffffffffffff
jne 0x18000110c
xor eax, eax
jmp 0x180001142
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jne 0x180001133
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x180001142
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x40]
add rsp, 0x58
ret
Function at 0x140003880
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push rbx
push rsi
sub rsp, 0x278
mov rax, qword [0x14000e040]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, rcx
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400038d8
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x1400038df
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x140003989
mov qword [rsp + 0x298], rbp
xor bpl, bpl
mov qword [rsp + 0x270], r14
mov r14d, 1
mov qword [rsp + 0x2a0], rdi
cmp qword [rbx + 0x18], 7
mov rdx, rbx
jbe 0x14000390d
mov rdx, qword [rbx]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140003952
mov r8d, dword [rsp + 0x28]
xor edx, edx
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x140003952
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
movzx ebp, bpl
mov rcx, rdi
test eax, eax
cmovne ebp, r14d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140003900
mov r14, qword [rsp + 0x270]
mov rcx, rsi
mov rdi, qword [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, bpl
mov rbp, qword [rsp + 0x298]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140007810
add rsp, 0x278
pop rsi
pop rbx
ret
Function at 0x1400052e0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x14000e040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov esi, 0xffff
movzx edi, dx
mov rbx, rcx
cmp si, dx
jne 0x140005311
xor eax, eax
jmp 0x14000545b
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x14000534e
mov r9, qword [rcx + 0x58]
movsxd r10, dword [r9]
lea rdx, [r8 + r10*2]
cmp r8, rdx
jae 0x14000534e
lea ecx, [r10 - 1]
movzx eax, di
mov dword [r9], ecx
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], di
jmp 0x14000545b
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xb0], rbp
je 0x140005450
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x140005395
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1400053a3
movzx ecx, di
jmp 0x1400053f7
lea rax, [rsp + 0x40]
mov word [rsp + 0x50], di
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x52]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__wchar_t_const____ptr64__wchar_t_const____ptr64__wchar_t_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140005410
sub eax, 1
je 0x140005410
cmp eax, 2
jne 0x140005450
movzx ecx, word [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputwc]
cmp ax, si
cmove di, si
movzx eax, di
jmp 0x140005453
mov rbp, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rbp, rax
je 0x14000543e
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbp
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbp, rax
jne 0x140005450
lea rax, [rsp + 0x50]
mov byte [rbx + 0x72], 1
cmp qword [rsp + 0x48], rax
cmovne si, di
movzx eax, si
mov rbp, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140007810
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret
Function at 0x140005890
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14000e040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140005965
cmp byte [rcx + 0x72], 0
je 0x140005965
mov rax, qword [rcx]
mov qword [rsp + 0x78], rdi
mov edi, 0xffff
mov edx, edi
call qword [rax + 0x18]
cmp di, ax
je 0x140005961
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140005926
sub eax, 1
je 0x14000592a
cmp eax, 2
jne 0x140005961
mov byte [rbx + 0x72], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140007810
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x72], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140005958
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140005961
cmp byte [rbx + 0x72], 0
sete al
jmp 0x14000590e
xor al, al
jmp 0x14000590e
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140007810
add rsp, 0x60
pop rbx
ret