joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001000
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x310
mov rax, qword [0x1400ca008]
xor rax, rsp
mov qword [rsp + 0x300], rax
mov rax, qword [0x1400cbbd0]
xor ebx, ebx
test rax, rax
jne 0x1400010b6
mov edx, 0x106
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
dec eax
cmp eax, 0x103
ja 0x140001192
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, eax
lea r8d, [rbx + 0x5c]
lea eax, [rdx - 1]
cmp word [rsp + rax*2 + 0x30], r8w
je 0x140001085
mov word [rsp + rdx*2 + 0x30], r8w
inc edx
lea rcx, [rsp + 0x30]
lea rcx, [rcx + rdx*2]
lea rdx, str.version.dll
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x1400cbbd0], rax
test rax, rax
je 0x140001192
lea rdx, str.GetFileVersionInfoSizeW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400cbbd0]
lea rdx, str.GetFileVersionInfoW
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400cbbd0]
lea rdx, str.VerQueryValueW
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbp, rax
test rdi, rdi
je 0x140001192
test r14, r14
je 0x140001192
test rax, rax
je 0x140001192
xor edx, edx
lea rcx, [0x1400cbbe0]
call rdi
mov esi, eax
test eax, eax
je 0x140001192
mov ecx, esi
call fcn.14000b38e
mov rdi, rax
test rax, rax
je 0x140001192
mov r9, rax
lea rcx, [0x1400cbbe0]
mov r8d, esi
xor edx, edx
call r14
test eax, eax
je 0x140001183
lea r9, [rsp + 0x20]
mov qword [rsp + 0x28], rbx
lea r8, [rsp + 0x28]
mov dword [rsp + 0x20], ebx
lea rdx, [0x1400259f0]
mov rcx, rdi
call rbp
test eax, eax
je 0x140001183
mov rax, qword [rsp + 0x28]
mov ebx, dword [rax + 8]
mov rcx, rdi
call fcn.14000b37a
mov eax, ebx
jmp 0x140001194
xor eax, eax
mov rcx, qword [rsp + 0x300]
xor rcx, rsp
call fcn.140009348
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x1400014b9
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], r8
push rbx
sub rsp, 0x30
lea rax, [r11 + 0x20]
mov dword [rsp + 0x58], 0x208
mov qword [r11 - 0x10], rax
lea r9, [r11 + 0x18]
lea rax, [0x1400cbbe0]
xor ebx, ebx
xor r8d, r8d
mov qword [r11 - 0x18], rax
mov dword [rsp + 0x50], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [rsp + 0x50], 1
je 0x140001505
xor eax, eax
jmp 0x14000150c
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x140001514
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
mov rbx, r8
mov rcx, r8
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r9d, 1
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140006ac9
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rbx, qword [r8]
mov rdi, r8
mov rsi, rdx
mov r14, rcx
test rbx, rbx
je 0x140006b47
and qword [r8], 0
mov r15d, 0x400000
and dword [rsp + 0x60], 0
lea r9, [rsp + 0x60]
mov rcx, qword [r14]
mov r8d, ebx
cmp rbx, r15
mov rdx, rsi
cmova r8d, r15d
and qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [rsp + 0x60]
add qword [rdi], rdx
add rsi, rdx
sub rbx, rdx
test eax, eax
je 0x140006b5d
test edx, edx
je 0x140006b47
test rbx, rbx
jne 0x140006afb
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140006b49

Function at 0x140009a17
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x140009ace
movsxd rcx, dword [0x14000003c]
lea rdx, [0x140000000]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x140009ace
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140009ace
sub r8, rdx
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
add rdx, rax
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x140009ac7
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x140009abe
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jae 0x140009abe
test rdx, rdx
je 0x140009ac7
cmp dword [rdx + 0x24], 0
jge 0x140009ab7
xor al, al
jmp 0x140009ad7
mov al, 1
jmp 0x140009ad7
add rdx, 0x28
jmp 0x140009a76
xor al, al
jmp 0x140009ad7
xor al, al
jmp 0x140009ad7
add rsp, 0x18
ret

Function at 0x140009e65
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140009ecb
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140009ecb
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140009ecb
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140009ecb
cmp dword [rcx + 0x84], 0xe
jbe 0x140009ecb
cmp dword [rcx + 0xf8], 0
je 0x140009ecb
mov al, 1
jmp 0x140009ecd
xor al, al
add rsp, 0x28
ret

Function at 0x14000c03d
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
call fcn.14000f471
cmp eax, 1
je 0x14000c07f
mov rax, qword gs:[0x60]
mov edx, dword [rax + 0xbc]
shr edx, 8
test dl, 1
jne 0x14000c07f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
call fcn.14000c091
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x14000c16d
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14000bf61
Function at 0x14000d58f
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x14000d5ad
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
lea ecx, [r8 + 1]
call fcn.14000d338
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000417
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x14000f281
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor r14d, r14d
mov rbx, rax
test rax, rax
je 0x14000f371
mov rsi, rax
cmp word [rax], r14w
je 0x14000f2e0
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], r14w
jne 0x14000f2c0
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], r14w
jne 0x14000f2bc
mov qword [rsp + 0x38], r14
sub rsi, rbx
mov qword [rsp + 0x30], r14
add rsi, 2
sar rsi, 1
mov r8, rbx
mov r9d, esi
mov dword [rsp + 0x28], r14d
xor edx, edx
mov qword [rsp + 0x20], r14
xor ecx, ecx
call fcn.14000f1c3
movsxd rbp, eax
test eax, eax
je 0x14000f371
mov rcx, rbp
call fcn.14000cbfd
mov rdi, rax
test rax, rax
je 0x14000f361
mov qword [rsp + 0x38], r14
mov r9d, esi
mov qword [rsp + 0x30], r14
mov r8, rbx
mov dword [rsp + 0x28], ebp
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
call fcn.14000f1c3
test eax, eax
je 0x14000f361
mov rsi, rdi
mov rdi, r14
jmp 0x14000f364
mov rsi, r14
mov rcx, rdi
call fcn.14000cbb5
jmp 0x14000f374
mov rsi, r14
test rbx, rbx
je 0x14000f386
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
mov rax, rsi
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14001d72b
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140019acb

Function at 0x180cc8058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.180cc81df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x180cc8089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180cc806f
add dl, dl
jne 0x180cc8096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180cc80f6
xor eax, eax
add dl, dl
jne 0x180cc80a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180cc81ad
add dl, dl
jne 0x180cc80b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180cc80c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180cc80d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180cc80dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x180cc80ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x180cc807e
mov eax, 1
add dl, dl
jne 0x180cc8106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180cc8113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180cc80fb
sub eax, ebx
mov ebx, 1
jne 0x180cc814c
mov ecx, 1
add dl, dl
jne 0x180cc812e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180cc813b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180cc8123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180cc807e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x180cc8168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180cc8175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180cc815d
cmp eax, 0x7d00
jae 0x180cc819b
cmp eax, 0x500
jb 0x180cc8196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180cc807e
cmp eax, 0x7f
ja 0x180cc819e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180cc807e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x180cc81d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x180cc807e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400017ec
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140001838
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140001830
cmp dword [rcx + 0x3c], edx
jl 0x140001830
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140001830
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140001838
mov rax, rdx
add rsp, 0x18
ret

Function at 0x14000b000
Capabilities:
Encode data using xor

Disassembly:
xor rcx, rcx
sub rcx, 0xffffffffffff9d74
lea rax, [entry0]
movabs rbx, 0x14d2f7e9fbfb10d7
xor qword [rax + 0x27], rbx
sub rax, 0xfffffffffffffff8
loop 0x14000b01b
invalid
Function at 0x140002773
Capabilities:
Read file on windows

Disassembly:
push rdi
push rsi
sub rsp, 0x38
mov rsi, rcx
mov rcx, rdx
mov edx, 1
mov r9, rsi
mov rdi, r8
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
cmp rdi, rax
je 0x1400027a6
mov rcx, rsi
mov qword [rsp + 0x28], rax
call fcn.1400026b5
mov rax, qword [rsp + 0x28]
add rsp, 0x38
pop rsi
pop rdi
ret

Function at 0x140002ab5
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov rcx, rdx
mov edx, 1
mov r9, rbx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rcx, rbx
mov qword [rsp + 0x28], rax
call fcn.1400026b5
mov rax, qword [rsp + 0x28]
add rsp, 0x30
pop rbx
ret

Function at 0x14000310b
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
xor r8d, r8d
test rdx, rdx
mov rsi, rcx
mov rbx, rdx
je 0x14000312a
mov rcx, rdx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov r8, rax
mov rcx, rbx
mov r9, rsi
mov edx, 1
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp 0x14002cea8
jmp qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]

Function at 0x1400038fe
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rsi, rcx
mov qword [rsp + 0x28], rdx
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, qword [rsp + 0x28]
mov rcx, rsi
mov edx, 1
mov rbx, rax
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rcx, rbx
add rsp, 0x38
pop rbx
pop rsi
jmp 0x14002cea8

Function at 0x140004865
Capabilities:
Write file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
xor ebx, ebx
mov rdi, rcx
mov rbp, rdx
cmp rbx, rbp
jl 0x1400048bd
mov ecx, 1
call rsi
mov r8d, 1
mov edx, 1
lea rcx, [0x14002f446]
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov ecx, 1
call rsi
mov rcx, rax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp 0x14002cea8
mov r12, qword [rdi + rbx*8]
mov ecx, 1
inc rbx
call rsi
xor r8d, r8d
mov rcx, rax
mov rdx, r12
call fcn.1400047d0
jmp 0x14000487e
Function at 0x140009e30
Capabilities:
Hash data using murmur3

Disassembly:
xor r10d, r10d
mov rax, rdx
mov r8, rdx
mov r9, rcx
cqo
mov ecx, 4
idiv rcx
mov rcx, r8
xor eax, eax
sub rcx, rdx
cmp rcx, rax
jg 0x140009e74
xor eax, eax
cmp r8, 0xfffffffffffffffd
cmovge rax, rcx
mov ecx, 4
mov r11, rax
mov rax, r8
cqo
add r9, r11
idiv rcx
xor ecx, ecx
jmp 0x140009e9d
mov edx, dword [r9 + rax]
add rax, 4
imul edx, edx, 0xcc9e2d51
rol edx, 0xf
imul edx, edx, 0x1b873593
xor edx, r10d
rol edx, 0xd
lea edx, [rdx + rdx*4]
lea r10d, [rdx - 0x19ab949c]
jmp 0x140009e4e
test rdx, rdx
jle 0x140009eb1
dec rdx
shl ecx, 8
movzx eax, byte [r9 + rdx]
or ecx, eax
jmp 0x140009e9d
imul eax, ecx, 0xcc9e2d51
xor r10d, r8d
rol eax, 0xf
imul eax, eax, 0x1b873593
xor eax, r10d
mov edx, eax
shr edx, 0x10
xor eax, edx
imul eax, eax, 0x85ebca6b
mov edx, eax
shr edx, 0xd
xor edx, eax
imul edx, edx, 0xc2b2ae35
mov eax, edx
shr eax, 0x10
xor eax, edx
ret
xor edx, edx
test rcx, rcx
je 0x140009ef6
mov rdx, qword [rcx]
add rcx, 0x10
jmp 0x140009e30

Function at 0x140009ee8
Capabilities:
Hash data using murmur3

Disassembly:
xor r10d, r10d
mov rax, rdx
mov r8, rdx
mov r9, rcx
cqo
mov ecx, 4
idiv rcx
mov rcx, r8
xor eax, eax
sub rcx, rdx
cmp rcx, rax
jg 0x140009e74
xor eax, eax
cmp r8, 0xfffffffffffffffd
cmovge rax, rcx
mov ecx, 4
mov r11, rax
mov rax, r8
cqo
add r9, r11
idiv rcx
xor ecx, ecx
jmp 0x140009e9d
mov edx, dword [r9 + rax]
add rax, 4
imul edx, edx, 0xcc9e2d51
rol edx, 0xf
imul edx, edx, 0x1b873593
xor edx, r10d
rol edx, 0xd
lea edx, [rdx + rdx*4]
lea r10d, [rdx - 0x19ab949c]
jmp 0x140009e4e
test rdx, rdx
jle 0x140009eb1
dec rdx
shl ecx, 8
movzx eax, byte [r9 + rdx]
or ecx, eax
jmp 0x140009e9d
imul eax, ecx, 0xcc9e2d51
xor r10d, r8d
rol eax, 0xf
imul eax, eax, 0x1b873593
xor eax, r10d
mov edx, eax
shr edx, 0x10
xor eax, edx
imul eax, eax, 0x85ebca6b
mov edx, eax
shr edx, 0xd
xor edx, eax
imul edx, edx, 0xc2b2ae35
mov eax, edx
shr eax, 0x10
xor eax, edx
ret
xor edx, edx
test rcx, rcx
je 0x140009ef6
mov rdx, qword [rcx]
add rcx, 0x10
jmp 0x140009e30

Function at 0x14000a22f
Capabilities:
Link many functions at runtime

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
test rcx, rcx
mov rsi, rcx
mov rdi, rdx
mov rbx, r8
jne 0x14000a25c
cmp qword [0x140043018], 0
jne 0x14000a299
call fcn.140008462
mov qword [0x140043018], rax
jmp 0x14000a299
mov rcx, rdx
call fcn.14000a0a0
mov rcx, rsi
mov rdx, rax
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
jne 0x14000a2e6
test rbx, rbx
je 0x14000a244
cmp qword [rbx], 0
jle 0x14000a244
mov rcx, rbx
call fcn.14000a0a0
mov rcx, rsi
mov rdx, rax
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
je 0x14000a244
jmp 0x14000a2e6
mov rsi, qword [0x140043018]
test rsi, rsi
jne 0x14000a2a9
xor eax, eax
jmp 0x14000a2e6
mov rcx, rdi
call fcn.14000a0a0
mov rcx, rsi
mov rdx, rax
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
jne 0x14000a2e6
test rbx, rbx
je 0x14000a2a5
cmp qword [rbx], 0
jle 0x14000a2a5
mov rcx, rbx
call fcn.14000a0a0
mov rcx, rsi
mov rdx, rax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp sub.KERNEL32.dll_GetProcAddress
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
Function at 0x14000a2ee
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov qword [rsp + 0x28], rdx
call fcn.14000a10c
mov r8, qword [rsp + 0x28]
mov rdx, rbx
mov rcx, rax
add rsp, 0x30
pop rbx
jmp fcn.14000a22f

Function at 0x14000a4ec
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov qword [rsp + 0x28], rdx
call fcn.14000a0b7
mov r8, qword [rsp + 0x28]
mov rdx, rbx
mov rcx, rax
add rsp, 0x30
pop rbx
jmp fcn.14000a22f
Function at 0x140014600
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov rax, qword gs:[0x60]
movzx rax, byte [rax + 2]
ret

Function at 0x14001897f
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
xor eax, eax
xor esi, esi
lea rbp, [rsp + 0x50]
mov rbx, rcx
mov ecx, 4
add qword [rbx + 0x410], r8
mov rdi, rbp
mov r12, rdx
mov r14, r8
rep stosd dword [rdi], eax
mov r13, r9
lea rax, [rbx + 0x3d8]
mov qword [rsp + 0x38], rax
lea rax, [rbx + 0x3c8]
mov qword [rsp + 0x40], rax
lea rax, [rbx + 0x3f8]
mov qword [rsp + 0x48], rax
test r14, r14
jle 0x140018a6d
mov rcx, qword [rsp + 0x38]
mov r11d, 0x10
mov edx, 0x10
mov r9, rbp
cmp r14, r11
mov r15, r11
cmovle r15, r14
xor edi, edi
call fcn.14001838e
mov rdx, qword [rsp + 0x38]
mov r8d, 0x10
mov rcx, rbx
mov qword [rsp + 0x20], 0x10
call fcn.140017e67
lea rcx, [r12 + rsi]
lea r8, [r13 + rsi]
mov dl, byte [rbp + rdi]
xor dl, byte [rcx + rdi]
mov byte [r8 + rdi], dl
inc rdi
cmp rdi, r15
jne 0x140018a2b
mov qword [rsp + 0x20], rcx
mov r8, qword [rsp + 0x40]
add rsi, rdi
sub r14, rdi
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x28], rdi
mov r9d, 0x10
mov edx, 0x10
call fcn.140018548
jmp 0x1400189d9
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140023a70
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call fcn.14002cb60
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop
nop dword [rax]
Function at 0x140023ae0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x1400495e4]
test esi, esi
mov rbx, rcx
jle 0x140023c10
mov rax, qword [0x1400495e8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x140023b2b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140023bb5
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140023b10
mov rcx, rbx
call fcn.140024550
test rax, rax
mov rdi, rax
je 0x140023c32
mov rax, qword [0x1400495e8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.140024690
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1400495e8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140023c17
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140023bae
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140023bc0
add dword [0x1400495e4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov r8d, 0x40
mov eax, 4
mov rcx, qword [rsp + 0x20]
cmove r8d, eax
mov rdx, qword [rsp + 0x38]
add rbx, qword [0x1400495e8]
mov r9, rbx
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140023bae
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140023a70
nop dword [rax]
xor esi, esi
jmp 0x140023b38
mov rax, qword [0x1400495e8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [rdi + 8]
mov r8, qword [rax + rbx + 0x18]
call fcn.140023a70
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.140023a70
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x1400241a0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x140049640]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140049620]
test rbx, rbx
je 0x1400241fc
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x1400241f3
test rsi, rsi
je 0x1400241f3
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1400241d8
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140024410
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
call qword [rax]
nop
nop
sub rsp, 0x28
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__exit]
call qword [rax]
nop
nop
nop
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140024448
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x140024450
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret
Function at 0x140024420
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
call qword [rax]
nop
nop
sub rsp, 0x28
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__exit]
call qword [rax]
nop
nop
nop
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140024448
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x140024450
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140024430
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
call qword [rax]
nop
nop
sub rsp, 0x28
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__exit]
call qword [rax]
nop
nop
nop
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140024448
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x140024450
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140024550
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14003a300]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140024570
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140024578
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140024570
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x1400245cd
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x1400245c4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140024570
add rax, 0x28
cmp rax, r9
jne 0x1400245b0
xor eax, eax
ret

Function at 0x1400245d0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14003a300]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x1400245ef
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400245f8
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x1400245ef
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140024690
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14003a300]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x1400246af
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x1400246b8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret