joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002770
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [rcx], 0
mov rbx, rcx
jne 0x1400027ab
lea rax, str.eprintln_NIL_
mov dword [rsp + 0x28], 0xd
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x2c], 1
call fcn.140002770
add rsp, 0x30
pop rbx
ret
mov qword [rsp + 0x48], rsi
mov ecx, 1
mov qword [rsp + 0x50], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
movsxd rax, dword [rbx + 8]
mov byte [rsp + 0x40], 0xa
movups xmm1, xmmword [rbx]
test eax, eax
jle 0x14000283f
mov ecx, 1
movq rdi, xmm1
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rsi, rax
test rbx, rbx
jle 0x14000283f
nop dword [rax]
nop word [rax + rax]
mov r9, rsi
mov r8, rbx
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add rdi, rax
sub rbx, rax
test rbx, rbx
jg 0x140002820
mov ebx, 1
lea rdi, [rsp + 0x40]
mov ecx, ebx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea ecx, [rbx + 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rsi, rax
nop dword [rax]
mov r9, rsi
mov r8, rbx
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add rdi, rax
sub rbx, rax
test rbx, rbx
jg 0x140002860
mov rdi, qword [rsp + 0x50]
mov ecx, 2
mov rsi, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
add rsp, 0x30
pop rbx
jmp qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
Function at 0x1400028b0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x70
movaps xmm2, xmm1
mov rbx, rcx
movss dword [rsp + 0x88], xmm2
mov eax, dword [rsp + 0x88]
cmp eax, 0x80000000
jne 0x1400028f4
lea rax, str._0.0
mov qword [rcx], rax
mov rax, rcx
mov dword [rcx + 8], 4
mov dword [rcx + 0xc], 1
add rsp, 0x70
pop rbx
ret
test eax, eax
jne 0x140002919
lea rax, [0x140088880]
mov qword [rcx], rax
mov rax, rbx
mov dword [rcx + 8], 3
mov dword [rcx + 0xc], 1
add rsp, 0x70
pop rbx
ret
xorps xmm0, xmm0
comiss xmm0, xmm2
jbe 0x140002928
xorps xmm1, xmmword [0x14008a580]
comiss xmm1, dword [0x1400891ac]
jb 0x140002a48
movss xmm0, dword [0x1400891ec]
comiss xmm0, xmm1
jbe 0x140002a48
movaps xmmword [rsp + 0x60], xmm6
lea rcx, [rsp + 0x30]
mov r8d, 6
movaps xmmword [rsp + 0x50], xmm7
movaps xmm1, xmm2
call fcn.140081c60
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
movups xmm6, xmmword [rax]
movaps xmmword [rsp + 0x20], xmm6
call fcn.140084110
movdqa xmm0, xmm6
psrldq xmm0, 0xc
movups xmm7, xmmword [rax]
movd eax, xmm0
cmp eax, 0xfa1d05ee
jne 0x140002a1d
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x90], rsi
lea rsi, str.double_string.free___detected_n
mov qword [rsp + 0x98], rdi
mov edi, 0x1e
lea ecx, [rdi - 0x1d]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rbp, rax
nop word [rax + rax]
mov r9, rbp
mov r8, rdi
mov edx, 1
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add rsi, rax
sub rdi, rax
test rdi, rdi
jg 0x1400029d0
mov rdi, qword [rsp + 0x98]
mov rax, rbx
mov rsi, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x80]
movaps xmm6, xmmword [rsp + 0x60]
movups xmmword [rbx], xmm7
movaps xmm7, xmmword [rsp + 0x50]
add rsp, 0x70
pop rbx
ret
cmp eax, 1
je 0x140002a32
movq rcx, xmm6
test rcx, rcx
je 0x140002a32
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
movaps xmm6, xmmword [rsp + 0x60]
mov rax, rbx
movups xmmword [rbx], xmm7
movaps xmm7, xmmword [rsp + 0x50]
add rsp, 0x70
pop rbx
ret
mov r8d, 8
lea rcx, [rsp + 0x40]
movaps xmm1, xmm2
call fcn.140081c60
movups xmm0, xmmword [rax]
mov rax, rbx
movups xmmword [rbx], xmm0
add rsp, 0x70
pop rbx
ret
Function at 0x140002a70
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x70
movsd qword [rsp + 0x80], xmm1
mov rbx, rcx
mov rax, qword [rsp + 0x80]
movabs rcx, 0x8000000000000000
movaps xmm2, xmm1
cmp rax, rcx
jne 0x140002abd
lea rax, str._0.0
mov qword [rbx], rax
mov rax, rbx
mov dword [rbx + 8], 4
mov dword [rbx + 0xc], 1
add rsp, 0x70
pop rbx
ret
test rax, rax
jne 0x140002ae3
lea rax, [0x140088880]
mov qword [rbx], rax
mov rax, rbx
mov dword [rbx + 8], 3
mov dword [rbx + 0xc], 1
add rsp, 0x70
pop rbx
ret
xorps xmm0, xmm0
comisd xmm0, xmm2
jbe 0x140002af3
xorps xmm1, xmmword [0x14008a570]
comisd xmm1, xmmword [0x1400891b8]
jb 0x140002c0a
movsd xmm0, qword [0x1400891c8]
comisd xmm0, xmm1
jbe 0x140002c0a
movaps xmmword [rsp + 0x60], xmm6
lea rcx, [rsp + 0x30]
mov r8d, 0x12
movaps xmmword [rsp + 0x50], xmm7
movaps xmm1, xmm2
call fcn.1400828d0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
movups xmm6, xmmword [rax]
movaps xmmword [rsp + 0x20], xmm6
call fcn.140084110
movdqa xmm0, xmm6
psrldq xmm0, 0xc
movups xmm7, xmmword [rax]
movd eax, xmm0
cmp eax, 0xfa1d05ee
jne 0x140002bdf
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0x90], rsi
lea rsi, str.double_string.free___detected_n
mov qword [rsp + 0x98], rdi
mov edi, 0x1e
lea ecx, [rdi - 0x1d]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rbp, rax
mov r9, rbp
mov r8, rdi
mov edx, 1
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add rsi, rax
sub rdi, rax
test rdi, rdi
jg 0x140002b92
mov rdi, qword [rsp + 0x98]
mov rax, rbx
mov rsi, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x88]
movaps xmm6, xmmword [rsp + 0x60]
movups xmmword [rbx], xmm7
movaps xmm7, xmmword [rsp + 0x50]
add rsp, 0x70
pop rbx
ret
cmp eax, 1
je 0x140002bf4
movq rcx, xmm6
test rcx, rcx
je 0x140002bf4
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
movaps xmm6, xmmword [rsp + 0x60]
mov rax, rbx
movups xmmword [rbx], xmm7
movaps xmm7, xmmword [rsp + 0x50]
add rsp, 0x70
pop rbx
ret
mov r8d, 0x11
lea rcx, [rsp + 0x40]
movaps xmm1, xmm2
call fcn.1400828d0
movups xmm0, xmmword [rax]
mov rax, rbx
movups xmmword [rbx], xmm0
add rsp, 0x70
pop rbx
ret
Function at 0x14007fea0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xc0
mov rsi, qword [rdx]
xor eax, eax
mov edi, dword [rdx + 8]
mov r13, rdx
mov r12, rcx
mov dword [rsp + 0x28], eax
mov r8, rsi
mov qword [rsp + 0x20], rax
mov r9d, edi
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r14d, eax
lea r15d, [rax + rax]
lea edx, [r15 + 2]
movsxd rcx, edx
call fcn.1400047a0
mov rbx, rax
test rax, rax
je 0x14007ff2f
mov dword [rsp + 0x28], r14d
mov r9d, edi
mov r8, rsi
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rcx, r15d
xor eax, eax
mov word [rcx + rbx], ax
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wremove]
cmp eax, 0xffffffff
jne 0x14008008a
movups xmm0, xmmword [r13]
lea rax, str.Failed_to_remove__
mov byte [r12], 1
mov qword [rbp - 0x19], rax
xor r13d, r13d
lea rax, [0x140088a6c]
mov dword [rbp - 0x11], 0x12
mov qword [rbp + 0xf], rax
xor eax, eax
mov qword [rbp + 0x2b], rax
mov dword [rbp + 0x33], eax
mov dword [rbp - 0xd], 1
mov dword [rbp - 9], 0xfe10
movups xmmword [rbp - 1], xmm0
mov dword [rbp + 0x17], 3
mov qword [rbp + 0x1b], 1
mov dword [rbp + 0x27], r13d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
mov r15, rax
test rax, rax
jne 0x14007ffbb
lea r15, [0x140088494]
mov ebx, r13d
jmp 0x14007ffcb
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], r13b
jne 0x14007ffc2
lea r8, [rbp - 0x19]
mov edx, 2
lea rcx, [rbp - 0x39]
call fcn.140080e60
movsxd rdi, dword [rax + 8]
movups xmm0, xmmword [rax]
lea r14d, [rdi + rbx]
movaps xmmword [rbp - 0x59], xmm0
movsxd rcx, r14d
inc rcx
call fcn.1400047a0
mov rdx, qword [rbp - 0x59]
mov r8, rdi
mov rcx, rax
mov rsi, rax
call sub.VCRUNTIME140.dll_memcpy
movsxd r8, ebx
lea rcx, [rdi + rsi]
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
movsxd rcx, r14d
mov qword [rbp - 0x59], rsi
mov dword [rbp - 0x51], r14d
mov qword [rbp - 0x4d], r13
mov byte [rcx + rsi], r13b
mov ecx, 0x18
call fcn.140001fa0
movups xmm0, xmmword [rbp - 0x59]
movsd xmm1, qword [rbp - 0x49]
movups xmmword [rax], xmm0
movsd qword [rax + 0x10], xmm1
mov qword [rbp - 0x39], rax
mov qword [rbp - 0x29], rax
add rax, 0x10
mov byte [r12 + 0x28], r13b
mov qword [rbp - 0x21], rax
xor eax, eax
movups xmm1, xmmword [rbp - 0x29]
mov dword [rbp - 0x31], 3
movups xmm0, xmmword [rbp - 0x39]
movups xmmword [r12 + 8], xmm0
movups xmmword [r12 + 0x18], xmm1
mov dword [r12 + 0x29], eax
mov word [r12 + 0x2d], ax
mov byte [r12 + 0x2f], al
jmp 0x14008009e
xorps xmm0, xmm0
movups xmmword [r12], xmm0
movups xmmword [r12 + 0x10], xmm0
movups xmmword [r12 + 0x20], xmm0
lea r11, [rsp + 0xc0]
mov rax, r12
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140080d00
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
cmp qword [rcx], 0
jne 0x140080d35
lea rax, str.println_NIL_
mov dword [rsp + 0x28], 0xc
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x2c], 1
call fcn.140080d00
add rsp, 0x38
ret
movsxd rax, dword [rcx + 8]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x40], 0xa
movups xmm1, xmmword [rcx]
test eax, eax
jle 0x140080d8f
mov ecx, 1
movq rdi, xmm1
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rsi, rax
test rbx, rbx
jle 0x140080d8f
nop
mov r9, rsi
mov r8, rbx
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add rdi, rax
sub rbx, rax
test rbx, rbx
jg 0x140080d70
mov ebx, 1
lea rdi, [rsp + 0x40]
mov ecx, ebx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rsi, rax
nop dword [rax]
nop dword [rax + rax]
mov r9, rsi
mov r8, rbx
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add rdi, rax
sub rbx, rax
test rbx, rbx
jg 0x140080db0
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
add rsp, 0x38
ret
Function at 0x140083eb0
Capabilities:
Write file on windows

Disassembly:
push rbp
push r12
push r14
sub rsp, 0xa0
lea eax, [r8 - 2]
mov rbp, rdx
mov r14, rcx
cmp eax, 0x22
ja 0x140084075
test rdx, rdx
jne 0x140083efd
lea rax, [0x1400884e8]
mov dword [rcx + 8], 1
mov qword [rcx], rax
mov rax, rcx
mov dword [rcx + 0xc], 1
add rsp, 0xa0
pop r14
pop r12
pop rbp
ret
mov qword [rsp + 0xc0], rbx
lea rax, [0x140088494]
mov qword [rsp + 0xc8], rsi
xor r12d, r12d
mov qword [rsp + 0xd0], rdi
mov qword [rsp + 0x98], r13
mov qword [rsp + 0x90], r15
mov qword [rcx], rax
mov dword [rcx + 8], r12d
mov dword [rcx + 0xc], 1
movsxd r13, r8d
movups xmm0, xmmword [r14]
xor edx, edx
mov rax, rbp
div r13
mov ecx, 2
mov rbp, rax
mov rax, qword [0x140090280]
movups xmmword [rsp + 0x30], xmm0
movzx ebx, byte [rdx + rax]
call fcn.1400047a0
movups xmm0, xmmword [r14]
mov r15, rax
mov byte [rax], bl
movsxd rbx, dword [r14 + 8]
mov byte [rax + 1], r12b
movaps xmmword [rsp + 0x20], xmm0
lea esi, [rbx + 1]
movsxd rcx, esi
inc rcx
call fcn.1400047a0
movzx ecx, byte [r15]
mov r8, rbx
mov rdx, qword [rsp + 0x20]
mov rdi, rax
mov byte [rax], cl
lea rcx, [rax + 1]
call sub.VCRUNTIME140.dll_memcpy
movsxd rcx, esi
mov byte [rcx + rdi], r12b
mov qword [r14], rdi
mov dword [r14 + 8], esi
mov dword [r14 + 0xc], r12d
movups xmm1, xmmword [rsp + 0x30]
movdqa xmm0, xmm1
psrldq xmm0, 0xc
movd eax, xmm0
cmp eax, 0xfa1d05ee
jne 0x140084011
mov ebx, 0x1e
lea rdi, str.double_string.free___detected_n
lea ecx, [rbx - 0x1d]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rsi, rax
nop word [rax + rax]
mov r9, rsi
mov r8, rbx
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add rdi, rax
sub rbx, rax
test rbx, rbx
jg 0x140083ff0
jmp 0x140084026
cmp eax, 1
je 0x140084026
movq rcx, xmm1
test rcx, rcx
je 0x140084026
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test r15, r15
je 0x140084034
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test rbp, rbp
jne 0x140083f40
mov r15, qword [rsp + 0x90]
mov rax, r14
mov r13, qword [rsp + 0x98]
mov rdi, qword [rsp + 0xd0]
mov rsi, qword [rsp + 0xc8]
mov rbx, qword [rsp + 0xc0]
add rsp, 0xa0
pop r14
pop r12
pop rbp
ret
lea rax, str.invalid_radix:
mov dword [rsp + 0x58], r8d
mov qword [rsp + 0x40], rax
lea r8, [rsp + 0x40]
xor eax, eax
mov dword [rsp + 0x48], 0xf
mov qword [rsp + 0x5c], rax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x64], eax
xor r12d, r12d
lea rax, str._._It_should_be___2_and___36
mov dword [rsp + 0x4c], 1
mov qword [rsp + 0x68], rax
xor eax, eax
mov dword [rsp + 0x50], 0xfe07
mov dword [rsp + 0x70], 0x1e
mov qword [rsp + 0x74], 1
lea edx, [rax + 2]
mov dword [rsp + 0x80], r12d
mov qword [rsp + 0x84], rax
mov dword [rsp + 0x8c], eax
call fcn.140080e60
lea rcx, [rsp + 0x30]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x30], xmm0
call fcn.1400020c0
int3
Function at 0x140084a10
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [rcx + 0xc]
mov rbx, rcx
cmp eax, 0xfa1d05ee
jne 0x140084a7f
mov ebx, 0x1e
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
lea rdi, str.double_string.free___detected_n
lea ecx, [rbx - 0x1d]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rsi, rax
nop word [rax + rax]
mov r9, rsi
mov r8, rbx
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add rdi, rax
sub rbx, rax
test rbx, rbx
jg 0x140084a50
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
cmp eax, 1
je 0x140084aa0
mov rcx, qword [rcx]
test rcx, rcx
je 0x140084aa0
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx], 0
mov dword [rbx + 0xc], 0xfa1d05ee
add rsp, 0x20
pop rbx
ret

Function at 0x1400877e4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14008782e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14008782e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14008782e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14008782e
cmp dword [rcx + 0x84], 0xe
jbe 0x14008782e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140087830
xor al, al
add rsp, 0x28
ret
Function at 0x140002910
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140004460
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.140004460
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x140002980
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x14000a0a4]
mov rbx, rcx
test esi, esi
jle 0x140002ab0
mov rax, qword [0x14000a0a8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x1400029cb
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140002a55
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x1400029b0
mov rcx, rbx
call fcn.1400033d0
mov rdi, rax
test rax, rax
je 0x140002ad2
mov rax, qword [0x14000a0a8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.140003510
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x14000a0a8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140002ab7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140002a4e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140002a60
add dword [0x14000a0a4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x14000a0a8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140002a4e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140002910
nop dword [rax]
xor esi, esi
jmp 0x1400029d8
mov rax, qword [0x14000a0a8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140002910
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.140002910
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140003040
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x14000a100]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14000a0e0]
test rbx, rbx
je 0x14000309c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x140003093
test rsi, rsi
je 0x140003093
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140003078
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x1400033d0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140006ac0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400033f0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400033f8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400033f0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14000344d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140003444
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400033f0
add rax, 0x28
cmp rax, r9
jne 0x140003430
xor eax, eax
ret

Function at 0x140003450
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140006ac0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14000346f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140003478
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14000346f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140003510
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140006ac0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14000352f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140003538
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x140001550
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
lea rbp, [rcx + 2]
mov qword [rsp + 0x20], 4
mov qword [rsp + 0x18], rbp
nop word [rax + rax]
movzx r9d, byte [rbp - 1]
movzx edx, byte [rbp - 2]
movzx ebx, r9b
movzx r8d, byte [rbp]
movzx eax, dl
shr al, 7
movzx r10d, r8b
movzx eax, al
add r10b, r10b
imul eax, eax, 0x1b
add bl, bl
movzx ecx, byte [rbp + 1]
mov byte [rsp], dl
add dl, dl
mov byte [rsp + 0x80], r9b
mov byte [rsp + 0x88], r8b
xor dl, al
mov dword [rsp + 8], eax
movzx eax, dl
movzx esi, dl
shr al, 7
add sil, sil
movzx eax, al
imul eax, eax, 0x1b
xor sil, al
mov dword [rsp + 4], eax
movzx eax, r9b
shr al, 7
movzx eax, al
imul r14d, eax, 0x1b
xor bl, r14b
movzx eax, bl
movzx r9d, bl
shr al, 7
add r9b, r9b
movzx eax, al
imul eax, eax, 0x1b
xor r9b, al
mov dword [rsp + 0xc], eax
movzx eax, r8b
shr al, 7
movzx eax, al
imul r12d, eax, 0x1b
xor r10b, r12b
movzx eax, r10b
movzx r8d, r10b
shr al, 7
xor r10b, dl
movzx eax, al
add r8b, r8b
imul ebp, eax, 0x1b
movzx eax, cl
shr al, 7
add cl, cl
movzx eax, al
imul r13d, eax, 0x1b
xor r8b, bpl
xor cl, r13b
mov dword [rsp + 0x10], r13d
movzx eax, cl
shr al, 7
movzx eax, al
imul r15d, eax, 0x1b
movzx eax, cl
add al, al
xor al, r15b
xor r10b, al
mov byte [rsp + 0x78], al
shr al, 7
xor r10b, r8b
movzx eax, al
xor r10b, r9b
imul edi, eax, 0x1b
xor r10b, sil
movzx eax, r8b
mov byte [rsp + 1], r10b
shr al, 7
movzx eax, al
imul r11d, eax, 0x1b
movzx eax, r9b
shr al, 7
movzx eax, al
imul r10d, eax, 0x1b
movzx eax, sil
xor byte [rsp + 0x78], cl
shr al, 7
movzx eax, al
imul edx, eax, 0x1b
mov r13, qword [rsp + 0x18]
movzx eax, byte [rsp + 1]
xor al, byte [rsp + 0x80]
xor al, byte [rsp]
add al, al
movzx ecx, byte [rsp + 0x78]
xor al, dl
xor cl, r8b
xor al, r10b
mov r8d, dword [rsp + 0xc]
xor al, r11b
xor cl, r9b
xor al, dil
movzx r9d, byte [r13 + 1]
xor al, bpl
xor cl, bl
xor al, r14b
movzx ebx, byte [rsp + 0x88]
xor al, byte [rsp + 4]
xor cl, sil
xor al, byte [rsp + 8]
xor al, byte [r13 + 1]
xor al, byte [rsp + 0x88]
xor al, byte [rsp + 0x80]
movzx esi, byte [rsp + 0x80]
mov byte [r13 - 2], al
movzx eax, cl
xor al, bl
xor cl, r9b
xor al, sil
add al, al
xor al, dl
xor al, r10b
xor al, r11b
xor al, dil
xor al, r15b
xor al, r12b
xor al, r8b
xor al, r14b
mov r14, r13
movzx r14d, byte [rsp]
xor al, r9b
xor al, bl
xor cl, r14b
xor al, r14b
add cl, cl
mov byte [r13 - 1], al
xor cl, dl
mov r13d, dword [rsp + 0x10]
xor cl, r10b
movzx eax, byte [rsp + 1]
xor cl, r11b
xor al, r9b
xor cl, dil
xor al, bl
xor cl, r15b
add al, al
xor cl, r13b
xor al, dl
xor cl, r8b
xor cl, byte [rsp + 8]
xor al, r10b
xor al, r11b
xor al, dil
xor al, r13b
xor al, bpl
mov rbp, qword [rsp + 0x18]
xor al, r12b
xor al, byte [rsp + 4]
xor al, r9b
xor al, sil
xor al, r14b
mov byte [rbp], al
xor cl, bl
xor cl, sil
xor cl, r14b
mov byte [rbp + 1], cl
add rbp, 4
sub qword [rsp + 0x20], 1
mov qword [rsp + 0x18], rbp
jne 0x140001580
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400017e0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov r10, rdx
mov rsi, rdx
sub r10, rcx
mov rbx, rcx
mov r8, rcx
mov r11d, 4
nop dword [rax]
mov r9d, 4
nop word [rax + rax]
movzx eax, byte [r10 + r8 + 0xa0]
xor byte [r8], al
inc r8
sub r9, 1
jne 0x140001820
sub r11, 1
jne 0x140001810
mov dil, 9
lea rbp, [0x140035240]
movzx eax, byte [rbx + 9]
mov r8, rbx
movzx ecx, byte [rbx + 0xd]
mov r9d, 4
mov byte [rbx + 0xd], al
movzx eax, byte [rbx + 5]
mov byte [rbx + 9], al
movzx eax, byte [rbx + 1]
mov byte [rbx + 5], al
movzx eax, byte [rbx + 0xa]
mov byte [rbx + 1], cl
movzx ecx, byte [rbx + 2]
mov byte [rbx + 2], al
movzx eax, byte [rbx + 0xe]
mov byte [rbx + 0xa], cl
movzx ecx, byte [rbx + 6]
mov byte [rbx + 6], al
movzx eax, byte [rbx + 7]
mov byte [rbx + 0xe], cl
movzx ecx, byte [rbx + 3]
mov byte [rbx + 3], al
movzx eax, byte [rbx + 0xb]
mov byte [rbx + 7], al
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xb], al
mov byte [rbx + 0xf], cl
nop dword [rax]
nop word [rax + rax]
mov rcx, r8
mov edx, 4
nop dword [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 4]
movzx eax, byte [rax + rbp]
mov byte [rcx - 4], al
sub rdx, 1
jne 0x1400018c0
inc r8
sub r9, 1
jne 0x1400018b0
movzx r8d, dil
lea r9d, [rdx + 4]
shl r8, 4
mov rax, rbx
sub r8, rbx
add r8, rsi
nop dword [rax]
nop word [rax + rax]
mov edx, 4
nop word [rax + rax]
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
inc rax
sub rdx, 1
jne 0x140001910
sub r9, 1
jne 0x140001900
test dil, dil
je 0x14000193c
mov rcx, rbx
call fcn.140001550
add dil, 0xff
jmp 0x140001845
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret