joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007abc0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
xor r11d, r11d
mov r10d, edx
mov edi, r8d
mov rbx, rcx
mov esi, 0xffffffff
test edx, edx
jne 0x14007ac01
mov eax, dword [rcx]
test eax, eax
je 0x14007abf1
bsf ecx, eax
cmp ecx, r8d
jb 0x14007abfb
mov ecx, r8d
shr eax, cl
mov dword [rbx], eax
xor eax, eax
mov rbx, qword [rsp + 0x30]
pop rdi
pop rsi
ret
shr eax, cl
mov dword [rbx], eax
sub edi, ecx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x28], r15
mov r15d, 1
cmp edi, 0x12
jbe 0x14007aca3
mov edx, r9d
and r9b, 0x30
shr edx, 0x18
lea r8d, [rdx - 1]
cmp r9b, 0x20
jne 0x14007ac4f
mov eax, 0x38e38e39
mov r14d, 0x3f
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
sub r14d, edx
jmp 0x14007acb0
bsr ecx, dword [rbx + r10*4]
imul eax, r10d, 0x1d
mov esi, r10d
sub eax, edi
add eax, ecx
mov ecx, r15d
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [0x1400f8738]
cvttsd2si eax, xmm0
sub ecx, eax
mov eax, 0x38e38e39
sub ecx, edx
imul ecx
mov eax, r8d
sar edx, 1
mov r14d, edx
add edx, 0x3e
shr r14d, 0x1f
add r14d, edx
cdq
and edx, 7
add eax, edx
sar eax, 3
sub esi, eax
add esi, 0x3d
jmp 0x14007acb0
mov r14d, esi
cmp edi, 9
jb 0x14007ad4d
nop
mov ecx, dword [rbx + r10*4]
mov r8d, r10d
mov eax, ecx
and ecx, 0x1ff
shr eax, 9
imul r9d, ecx, 0x1dcd65
mov dword [rbx + r10*4], eax
cmp r10d, r11d
je 0x14007ad09
nop dword [rax]
nop word [rax + rax]
dec r8d
and r8d, 0x3f
mov edx, dword [rbx + r8*4]
mov eax, edx
shr eax, 9
and edx, 0x1ff
add eax, r9d
imul r9d, edx, 0x1dcd65
mov dword [rbx + r8*4], eax
cmp r8d, r11d
jne 0x14007ace0
cmp r11d, r14d
je 0x14007ad2c
cmp r11d, esi
je 0x14007ad2c
test r9d, r9d
je 0x14007ad23
dec r11d
and r11d, 0x3f
mov dword [rbx + r11*4], r9d
cmp dword [rbx + r10*4], 0
jne 0x14007ad41
jmp 0x14007ad38
cmp dword [rbx + r10*4], 0
jne 0x14007ad41
cmp r10d, r11d
je 0x14007adb7
dec r10d
and r10d, 0x3f
dec esi
add edi, 0xfffffff7
cmp edi, 9
jae 0x14007acb0
test edi, edi
je 0x14007adb7
mov r9d, dword [rbx + r10*4]
mov ecx, edi
mov eax, r9d
shl r15d, cl
dec r15d
shr eax, cl
and r9d, r15d
mov dword [rbx + r10*4], eax
mov esi, 0x3b9aca00
sar esi, cl
imul r9d, esi
cmp r10d, r11d
je 0x14007ada7
nop dword [rax]
dec r10d
mov ecx, edi
and r10d, 0x3f
mov edx, dword [rbx + r10*4]
mov eax, edx
shr eax, cl
add eax, r9d
mov r9d, edx
and r9d, r15d
mov dword [rbx + r10*4], eax
imul r9d, esi
cmp r10d, r11d
jne 0x14007ad80
test r9d, r9d
je 0x14007adb7
dec r11d
and r11d, 0x3f
mov dword [rbx + r11*4], r9d
mov r14, qword [rsp + 0x20]
mov eax, r11d
mov rbp, qword [rsp + 0x18]
mov r15, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
pop rdi
pop rsi
ret
Function at 0x140096170
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rdi, rcx
lea r14, [0x140000000]
mov ecx, dword [rcx + 0xa8]
mov eax, ecx
and eax, 0xfff0000
cmp eax, 0x3ff0000
je 0x14009622a
bt ecx, 0x10
jb 0x1400961c8
movzx eax, byte [rdi + 0xbd]
test byte [rax + r14 + 0xf7b50], 0x60
jne 0x1400961c8
mov rcx, rdi
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp fcn.140092b70
mov eax, ecx
and eax, 0xb0000
cmp eax, 0xb0000
je 0x140096206
movzx r8d, byte [rdi + 0xbd]
movzx eax, byte [r8 + r14 + 0xf7b50]
and al, 0x60
cmp al, 0x40
jne 0x140096206
cmp r8b, 0x47
je 0x140096206
mov rcx, rdi
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp fcn.140071c80
and ecx, 0x110000
cmp ecx, 0x110000
je 0x14009622a
movzx eax, byte [rdi + 0xbd]
movzx eax, byte [rax + r14 + 0xf7b50]
and al, 0x60
cmp al, 0x60
je 0x1400961f3
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
mov ebp, 0x7ffd
mov qword [rsp + 0x40], rsi
nop
movzx esi, byte [rdi + 0xbd]
movzx edx, word [rdi + 0xb8]
mov r9d, dword [rdi + 0x28]
shl esi, 0x11
cmp edx, r9d
jb 0x140096286
mov rax, qword [rdi + 0x20]
lea r8, [rax + rdx*8]
movzx eax, byte [rax + rdx*8 + 5]
shl eax, 0xa
add esi, eax
mov rax, qword [r8]
mov qword [rdi + 0xc0], rax
cmp dx, bp
jae 0x140096286
mov rax, qword [r8 + 8]
mov qword [rdi + 0xc8], rax
movzx edx, word [rdi + 0xba]
cmp edx, r9d
jb 0x1400962bd
mov rax, qword [rdi + 0x20]
lea r8, [rax + rdx*8]
movzx eax, byte [rax + rdx*8 + 5]
add esi, eax
mov rax, qword [r8]
mov qword [rdi + 0xd0], rax
cmp dx, bp
jae 0x1400962c5
mov rax, qword [r8 + 8]
mov qword [rdi + 0xd8], rax
jmp 0x1400962c5
and edx, 0x3ff
add esi, edx
xor ebx, ebx
nop word [rax + rax]
mov r9d, ebx
and r9d, 0x1ffff
or r9d, esi
mov r8d, r9d
mov ecx, r9d
ror r8d, 0xb
and ecx, 0xfffff800
sub r8d, r9d
mov eax, r9d
shl eax, 0xb
sub ecx, eax
shr r8d, 0x12
shl ecx, 3
mov eax, 0x5e1d27b
or r8d, ecx
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 9
imul eax, eax, 0x3e9
sub r8d, eax
mov ecx, dword [r14 + r8*4 + 0xf8ed0]
mov eax, ecx
and eax, 0xffffff
cmp eax, r9d
je 0x14009634b
lea eax, [r8 + 1]
mov ecx, dword [r14 + rax*4 + 0xf8ed0]
mov eax, ecx
and eax, 0xffffff
cmp eax, r9d
jne 0x140096363
mov eax, ecx
mov rcx, rdi
shr rax, 0x18
call qword [r14 + rax*8 + 0xf89d0]
movzx edx, ax
test edx, edx
jne 0x14009637d
cmp ebx, 0xfffff
je 0x1400963a0
mov eax, ebx
shr eax, 0xa
or ebx, eax
xor ebx, 0xffc00
jmp 0x1400962d0
cmp edx, 5
jae 0x1400963b6
cmp edx, 1
je 0x140096240
cmp edx, 2
jne 0x1400963aa
mov edx, dword [rdi + 0xb8]
mov rcx, rdi
call fcn.1400720a0
jmp 0x1400963c4
mov rcx, rdi
call fcn.140092b70
jmp 0x1400963c4
cmp edx, 3
je 0x1400963df
mov eax, 0xffff
jmp 0x1400963c4
mov rax, qword [rdi + 0x20]
movzx eax, byte [rax + rdx*8 + 4]
shl eax, 0x18
add eax, edx
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov edx, 0x18
mov rcx, rdi
call fcn.140059980
int3
Function at 0x1400964a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x20
movzx r11d, word [rdx + 2]
mov r14, rcx
movzx r9d, word [r8 + 2]
cmp rdx, r8
je 0x1400965f7
mov r10, qword [rcx + 0x20]
cmp byte [r10 + r11*8 + 5], 0x1e
lea rbx, [r10 + r11*8]
jne 0x1400964d7
movzx r11d, word [rbx]
lea rbx, [r10 + r11*8]
cmp byte [r10 + r9*8 + 5], 0x1e
lea rcx, [r10 + r9*8]
jne 0x1400964eb
movzx r9d, word [rcx]
lea rcx, [r10 + r9*8]
movzx edi, byte [rdx + 5]
lea eax, [rdi - 0x38]
cmp al, 1
jbe 0x1400964fb
movzx eax, word [rdx]
jmp 0x140096503
movzx eax, word [rdx]
movzx eax, word [r10 + rax*8]
movzx edx, ax
movzx eax, byte [r8 + 5]
sub al, 0x38
cmp al, 1
jbe 0x140096517
movzx eax, word [r8]
jmp 0x140096520
movzx eax, word [r8]
movzx eax, word [r10 + rax*8]
movzx r8d, ax
cmp r11d, r9d
jne 0x140096542
cmp edx, r8d
je 0x1400965f7
mov rcx, r14
add rsp, 0x20
pop r14
pop rdi
pop rbx
jmp fcn.1400966a0
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], r15
mov r15d, 0x8000
cmp r11d, r15d
jae 0x140096565
cmp r9d, r15d
jb 0x1400965e9
cmp dil, 0x38
jne 0x1400965de
xor esi, esi
mov ebp, r11d
cmp byte [rbx + 5], 0x29
mov edi, esi
jne 0x140096592
movzx eax, word [rbx + 2]
cmp ax, r15w
jae 0x140096592
movzx ebp, word [rbx]
mov esi, dword [r10 + rax*8]
cmp ebp, r9d
jne 0x140096592
test esi, esi
jne 0x1400965e9
cmp byte [rcx + 5], 0x29
jne 0x1400965b3
movzx eax, word [rcx + 2]
cmp ax, r15w
jae 0x1400965b3
movzx r9d, word [rcx]
mov edi, dword [r10 + rax*8]
cmp r11d, r9d
jne 0x1400965b3
test edi, edi
jne 0x1400965e9
cmp ebp, r9d
jne 0x1400965bc
cmp esi, edi
jne 0x1400965e9
cmp edx, r8d
jne 0x1400965ed
mov eax, 1
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbx
ret
movzx eax, byte [rcx + 4]
xor al, byte [rbx + 4]
test al, 0x1f
je 0x1400965bc
xor eax, eax
jmp 0x1400965c6
mov rcx, r14
call fcn.1400966a0
jmp 0x1400965c6
mov eax, 2
add rsp, 0x20
pop r14
pop rdi
pop rbx
ret
Function at 0x1400975a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
movzx eax, byte [rcx + 0xd4]
lea r14, [rcx + 0xb8]
movzx r12d, word [r14]
and al, 0x1f
mov rdi, rcx
cmp al, 0xe
jne 0x140097608
movzx edx, word [rcx + 0x208]
cmp edx, r12d
jbe 0x140097608
movzx eax, word [rcx + 0x226]
cmp eax, r12d
jbe 0x140097608
nop
cmp eax, edx
jb 0x14009775d
mov ecx, eax
mov rax, qword [rdi + 0x20]
movzx eax, word [rax + rcx*8 + 6]
cmp eax, r12d
ja 0x1400975f0
movzx eax, word [rdi + 0x228]
cmp eax, r12d
jbe 0x140097761
mov rbx, qword [rdi + 0x20]
mov ebp, 0x8000
mov dword [rsp + 0x50], ebp
nop word [rax + rax]
lea r13, [rbx + rax*8]
movzx eax, word [rbx + rax*8]
movzx ecx, word [rbx + rax*8 + 2]
lea rdx, [rbx + rax*8]
cmp r14, rdx
je 0x14009775d
movzx r9d, word [r14 + 2]
cmp byte [rbx + r9*8 + 5], 0x1e
lea r8, [rbx + r9*8]
jne 0x140097663
movzx r9d, word [r8]
lea r8, [rbx + r9*8]
cmp byte [rbx + rcx*8 + 5], 0x1e
lea r10, [rbx + rcx*8]
jne 0x140097676
movzx ecx, word [r10]
lea r10, [rbx + rcx*8]
movzx r11d, byte [r14 + 5]
lea eax, [r11 - 0x38]
cmp al, 1
jbe 0x140097689
movzx eax, word [r14]
jmp 0x140097691
movzx eax, word [r14]
movzx eax, word [rbx + rax*8]
movzx r15d, ax
movzx eax, byte [rdx + 5]
sub al, 0x38
cmp al, 1
jbe 0x1400976a4
movzx eax, word [rdx]
jmp 0x1400976ab
movzx eax, word [rdx]
movzx eax, word [rbx + rax*8]
movzx esi, ax
cmp r9d, ecx
je 0x140097732
cmp r9d, ebp
jae 0x1400976c0
cmp ecx, ebp
jb 0x140097749
cmp r11b, 0x38
jne 0x140097725
xor r11d, r11d
xor edx, edx
cmp byte [r8 + 5], 0x29
mov ebp, r9d
jne 0x1400976f2
movzx eax, word [r8 + 2]
cmp ax, word [rsp + 0x50]
jae 0x1400976f2
movzx ebp, word [r8]
mov r11d, dword [rbx + rax*8]
cmp ebp, ecx
jne 0x1400976f2
test r11d, r11d
jne 0x140097749
cmp byte [r10 + 5], 0x29
jne 0x14009771a
movzx eax, word [r10 + 2]
mov r8d, 0x8000
cmp ax, r8w
jae 0x14009771a
movzx ecx, word [r10]
mov edx, dword [rbx + rax*8]
cmp r9d, ecx
jne 0x14009771a
test edx, edx
jne 0x140097749
cmp ebp, ecx
jne 0x140097732
cmp r11d, edx
je 0x140097732
jmp 0x140097749
movzx eax, byte [r10 + 4]
xor al, byte [r8 + 4]
test al, 0x1f
jne 0x140097749
cmp r15d, esi
je 0x14009775d
mov rcx, rdi
mov r8d, esi
mov edx, r15d
call fcn.1400966a0
test eax, eax
jne 0x14009775d
movzx eax, word [r13 + 6]
cmp eax, r12d
jbe 0x140097761
mov ebp, 0x8000
jmp 0x140097630
xor eax, eax
jmp 0x140097766
mov eax, 1
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140097a70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
movzx ebp, dx
xor edi, edi
mov r15, rcx
movzx r9d, word [rcx + rbp*2 + 0x1a2]
cmp r9d, r8d
jbe 0x140097b50
mov r11, qword [rcx + 0x20]
mov eax, r8d
lea r14, [r11 + rax*8]
nop
movzx eax, byte [r11 + r9*8 + 4]
lea rbx, [r11 + r9*8]
movzx ecx, word [rbx]
and al, 0x1f
cmp ecx, r8d
je 0x140097b7a
test al, al
jne 0x140097b42
movzx ecx, word [r11 + rcx*8 + 2]
movzx edx, word [r14 + 2]
cmp ebp, 0x42
je 0x140097b2e
movzx r9d, byte [r11 + rcx*8 + 4]
movzx r10d, byte [r11 + rdx*8 + 4]
movzx eax, r9b
xor al, r10b
test al, 0x1f
je 0x140097b2e
and r9b, 0x1f
mov ecx, edi
cmp r9b, 5
mov eax, edi
sete cl
and r10b, 0x1f
cmp r10b, 5
sete al
cmp ecx, eax
je 0x140097b42
xor eax, eax
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret
cmp ecx, edx
je 0x140097b11
cmp ecx, 0x8000
jae 0x140097b11
cmp edx, 0x8000
jae 0x140097b11
movzx r9d, word [rbx + 6]
cmp r9d, r8d
ja 0x140097ab0
movzx eax, word [r15 + rbp*2 + 0x192]
cmp eax, r8d
jbe 0x140097b11
mov rdx, qword [r15 + 0x20]
lea rcx, [rdx + rax*8]
movzx eax, word [rdx + rax*8]
cmp eax, r8d
je 0x140097b84
movzx eax, word [rcx + 6]
cmp eax, r8d
ja 0x140097b62
jmp 0x140097b11
test al, al
setne dil
mov eax, edi
jmp 0x140097b13
test byte [rcx + 4], 0x1f
setne dil
mov eax, edi
jmp 0x140097b13
Function at 0x140098c50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r12
push r14
push r15
sub rsp, 0x20
mov r10, qword [rcx + 0x20]
mov esi, r9d
movzx r14d, dx
mov r12d, r8d
mov r9d, edx
mov rbp, rcx
movzx r15d, byte [r10 + r14*8 + 5]
cmp r15d, 0x35
jb 0x140098d99
cmp r15d, r8d
jg 0x140098d99
xor edx, edx
lea rax, [rcx + 0xb24]
nop word [rax + rax]
cmp word [rax], r14w
jne 0x140098cbb
mov ecx, dword [rax + 4]
cmp ecx, esi
jb 0x140098cbb
xor ecx, esi
test ecx, 0xfff
je 0x140098d7f
inc rdx
add rax, 8
cmp rdx, 0x10
jl 0x140098ca0
movzx edx, word [r10 + r14*8]
mov r9d, esi
mov qword [rsp + 0x40], rbx
mov rcx, rbp
movzx ebx, word [r10 + r14*8 + 2]
mov qword [rsp + 0x48], rdi
call fcn.140098c50
mov r9d, esi
mov r8d, r12d
mov edx, ebx
mov rcx, rbp
mov edi, eax
call fcn.140098c50
mov ecx, 0xf4
mov word [rbp + 0xb8], di
add r15w, cx
mov word [rbp + 0xba], ax
movzx edx, r15w
mov ecx, pe_nt_image_headers64
imul edx, ecx
mov r8d, esi
shr r8d, 5
mov rcx, rbp
and r8w, 0x1f
or r8w, dx
mov word [rbp + 0xbc], r8w
call fcn.140096170
mov ecx, dword [rbp + 0xba4]
mov r9d, eax
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
lea rdx, [rcx*8]
lea eax, [rcx + 1]
and eax, 0xf
mov dword [rbp + 0xba4], eax
mov word [rdx + rbp + 0xb24], r14w
mov word [rdx + rbp + 0xb26], r9w
mov dword [rdx + rbp + 0xb28], esi
jmp 0x140098dd6
test rax, rax
je 0x140098cc8
movzx ecx, word [rax + 2]
movzx eax, byte [r10 + rcx*8 + 4]
shl eax, 0x18
add eax, ecx
jmp 0x140098dd9
bt esi, 0xb
jae 0x140098dd6
movzx ecx, byte [r10 + r14*8 + 4]
mov eax, 0x605fd9
and ecx, 0x1f
shr eax, cl
test al, 1
jne 0x140098dd6
mov rcx, rbp
mov word [rbp + 0xbc], 0x5b15
mov word [rbp + 0xb8], r14w
mov word [rbp + 0xba], si
call fcn.140096170
mov r9d, eax
mov eax, r9d
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x1400a1800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, edx
mov rdi, rcx
mov edx, 0x14
call fcn.1400720a0
mov rcx, rdi
mov word [rdi + 0xbc], 0x548a
mov word [rdi + 0xb8], ax
mov word [rdi + 0xba], bx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140096170

Function at 0x1400a45cc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400a4616
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400a4616
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400a4616
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400a4616
cmp dword [rcx + 0x84], 0xe
jbe 0x1400a4616
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400a4618
xor al, al
add rsp, 0x28
ret
Function at 0x14000e10e
Capabilities:
Print debug messages

Disassembly:
jmp 0x1400139a0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r14
push r15
mov eax, 0x2088
call fcn.14000e0a0
sub rsp, rax
mov rax, qword [0x14001f088]
xor rax, rsp
mov qword [rsp + 0x2070], rax
mov rbp, qword [rsp + 0x20c0]
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, 0x2000
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
lea rcx, [rsp + 0x60]
movups xmmword [rsp + 0x60], xmm0
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
xorps xmm0, xmm0
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x60]
xor ecx, ecx
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
movzx ebx, word [rsp + 0x50]
mov eax, 0x51eb851f
movzx ecx, word [rsp + 0x5e]
mov esi, 0x1000
movzx r8d, word [rsp + 0x5c]
movzx r10d, word [rsp + 0x5a]
movzx r11d, word [rsp + 0x58]
movzx r9d, word [rsp + 0x52]
mov dword [rsp + 0x48], ecx
lea rcx, [rsp + 0x70]
mul ebx
mov dword [rsp + 0x40], r8d
lea r8, str._02d._02d._02d__02d:_02d:_02d._03d_:_DumpTool_:
mov dword [rsp + 0x38], r10d
shr edx, 5
imul eax, edx, 0x64
mov edx, esi
mov dword [rsp + 0x30], r11d
sub ebx, eax
movzx eax, word [rsp + 0x56]
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], eax
call fcn.140013780
lea rdi, [rsp + 0x70]
mov r14, rax
lea r15, [rsp + 0x20d0]
sub rsi, rax
lea rdi, [rdi + rax*2]
call fcn.14000e019
mov rcx, qword [rsp + 0x20c8]
lea r9, [rsi - 1]
mov qword [rsp + 0x30], r15
mov r8, rsi
xor r15d, r15d
mov rdx, rdi
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rcx
mov rcx, qword [rax]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vsnwprintf_s]
mov rdx, qword [rbp + 0x10200]
mov ecx, 0xffffffff
test eax, eax
cmovs eax, ecx
movsxd rbx, eax
lea rcx, [rdx*2 + 0x208]
add rbx, r14
mov eax, 0x7ffb
sub rax, rdx
lea rdx, [rsp + 0x70]
cmp rax, rbx
cmovb rbx, rax
add rcx, rbp
mov r8, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
add qword [rbp + 0x10200], rbx
mov rax, qword [rbp + 0x10200]
mov word [rbp + rax*2 + 0x208], r15w
cmp word [rbp], r15w
je 0x140013b5f
lea rdx, [0x14001cd18]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
mov rbx, rax
test rax, rax
je 0x140013b5f
lea rdx, [rsp + 0x70]
mov rcx, rax
call fcn.14000e2c6
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0x2070]
xor rcx, rsp
call fcn.14000e1b3
add rsp, 0x2088
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000e14f
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
jmp 0x140015910
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x14000d000], ax
jne 0x14001599d
movsxd rcx, dword [0x14000d03c]
lea rdx, [0x14000d000]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x14001599d
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001599d
sub r8, rdx
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
add rdx, rax
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x140015984
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x14001597e
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x140015986
add rdx, 0x28
jmp 0x140015963
xor edx, edx
test rdx, rdx
jne 0x14001598f
xor al, al
jmp 0x1400159a3
cmp dword [rdx + 0x24], 0
jge 0x140015999
xor al, al
jmp 0x1400159a3
mov al, 1
jmp 0x1400159a3
xor al, al
jmp 0x1400159a3
add rsp, 0x18
ret
Function at 0x14000e1bd
Capabilities:
Print debug messages
Read file via mapping

Disassembly:
jmp 0x140012ce0
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
lea rbp, [rsp - 0xb70]
sub rsp, 0xc70
mov rax, qword [0x14001f088]
xor rax, rsp
mov qword [rbp + 0xb60], rax
mov rbx, qword [rbp + 0xb80]
lea rax, [0x14001cba8]
mov edi, dword [rbp + 0xb88]
xor edx, edx
mov r8d, 0x11a10
mov qword [rsp + 0x30], rbx
lea rcx, [rbx + 0x30]
mov qword [rbx + 8], 0xffffffffffffffff
mov qword [rbx + 0x10], 0xffffffffffffffff
mov qword [rbx + 0x18], 0
mov qword [rbx + 0x20], 0xffffffffffffffff
mov qword [rbx + 0x28], 0xffffffffffffffff
mov qword [rbx], rax
call sub.VCRUNTIME140.dll_memset
mov r8d, edi
lea rdx, str.DumpToolException__d.bin
lea rcx, [rbp + 0x150]
call fcn.140012af0
xor edx, edx
lea r8, [rbp + 0x150]
lea ecx, [rdx + 6]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov rcx, rax
mov qword [rbx + 0x10], rax
inc rax
test rax, 0xfffffffffffffffe
jne 0x140012dc8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, [rbp + 0x150]
lea rdx, str.Failed_Failed_to_create_file_mapping_of__s__d_n
lea rcx, [rbp + 0x360]
call fcn.140012b80
jmp 0x140012e04
xor r9d, r9d
mov qword [rsp + 0x20], 0x20000
xor r8d, r8d
lea edx, [r9 + 6]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rbx + 0x18], rax
test rax, rax
jne 0x140012e0c
lea r8, [rbp + 0x150]
lea rdx, str.Failed_Failed_to_map_view_of_file__s_n
lea rcx, [rbp + 0x360]
call fcn.140012b80
mov rcx, rbx
call fcn.14000e2d5
cmp qword [rbx + 0x18], 0
jne 0x140012e2c
lea rcx, [rbp + 0x360]
call fcn.14000e023
lea rcx, [rbp + 0x360]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov r9d, edi
lea r8, str.TakeDump
lea rdx, str.GlobalDumpToolException__s__d_event
lea rcx, [rsp + 0x40]
call fcn.140012af0
lea r8, [rsp + 0x40]
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenEventW]
mov qword [rbx + 0x20], rax
inc rax
test rax, 0xfffffffffffffffe
jne 0x140012ea2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, [rsp + 0x40]
lea rdx, str.Failed_to_open_event:__s_0x_x_n
lea rcx, [rbp + 0x360]
call fcn.140012b80
lea rcx, [rbp + 0x360]
call fcn.14000e023
lea rcx, [rbp + 0x360]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov r9d, edi
lea r8, str.DumpTaken
lea rdx, str.GlobalDumpToolException__s__d_event
lea rcx, [rsp + 0x40]
call fcn.140012af0
lea r8, [rsp + 0x40]
xor edx, edx
mov ecx, 0x100002
call qword [sym.imp.KERNEL32.dll_OpenEventW]
mov qword [rbx + 0x28], rax
lea rcx, [rax + 1]
test rcx, 0xfffffffffffffffe
jne 0x140012f1a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, [rsp + 0x40]
lea rdx, str.Failed_to_open_event:__s_0x_x_n
lea rcx, [rbp + 0x360]
call fcn.140012b80
lea rcx, [rbp + 0x360]
call fcn.14000e023
lea rcx, [rbp + 0x360]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rax, rbx
mov rcx, qword [rbp + 0xb60]
xor rcx, rsp
call fcn.14000e1b3
lea r11, [rsp + 0xc70]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14000e1e0
Capabilities:
Terminate process

Disassembly:
jmp 0x1400150e0
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x14000e212
Capabilities:
Allocate or change rwx memory

Disassembly:
mov rcx, 0x5e105d6f
jmp 0x140002f19
dec rcx
jmp 0x1400031c2
jne 0x140002f19
jmp 0x140003427
jmp 0x140003c99
jmp 0x140003d32
jmp 0x140003dbe
jmp 0x140003dde
jmp 0x140003e4c
jmp 0x140003e87
jmp 0x140003f07
jmp 0x140003f37
jmp 0x140003f86
jmp 0x140003fe8
jmp 0x140004012
jmp 0x14000408e
jmp 0x14000409a
jmp 0x140004138
jmp 0x14000416b
jmp 0x1400041a2
jmp 0x1400041d9
jmp 0x14000424c
jmp 0x1400042c3
jmp 0x14000430f
xor rcx, rcx
nop
nop
nop
mov rdx, 0x8e88
nop
nop
nop
nop
nop
mov r8d, 0x1000
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
nop
nop
nop
call 0x14000433c
pop rsi
add rsi, 0xe3c
nop
nop
nop
nop
nop
mov rdi, rax
mov rcx, 0x8e88
rep movsb byte [rdi], byte [rsi]
nop
nop
jmp rax
xor rcx, rcx
jmp 0x1400024fa

Function at 0x14000e26c
Capabilities:
Parse pe header

Disassembly:
jmp 0x140015eb8
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x140015f03
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140015f03
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140015f03
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140015f03
cmp dword [rcx + 0x84], 0xe
jbe 0x140015f03
cmp dword [rcx + 0xf8], 0
je 0x140015f03
mov al, 1
jmp 0x140015f05
xor al, al
add rsp, 0x28
ret