joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001320
Capabilities:
Access peb ldr_data
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
xor ebp, ebp
lea rsi, [0x14001e0fc]
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rsi]
xor bl, bl
mov edi, dword [rsi + 4]
xor cl, cl
cmp dword [0x14001e0d0], eax
jne 0x14000136c
mov bl, 1
call qword [0x14001e0d8]
movzx ecx, al
test bl, bl
je 0x1400013ba
test cl, cl
je 0x1400013ba
test edi, edi
jne 0x14000137c
mov al, 1
jmp 0x1400013bc
xor bl, bl
xor al, al
cmp dword [0x14001e0c0], edi
jne 0x140001395
mov bl, 1
call qword [0x14001e0c8]
test al, al
sete al
cmp dword [0x14001e0d0], edi
jne 0x1400013aa
mov bl, 1
call qword [0x14001e0d8]
test al, al
sete al
test bl, bl
jne 0x1400013bc
lea rcx, str.ERROR:_Removed_version_value_was_invalid._n
call fcn.140001010
xor al, al
mov rcx, qword [rsi - 0x14]
mov byte [rsi + 9], al
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r14, rax
test rax, rax
jne 0x1400013d9
mov byte [rsi + 8], al
jmp 0x140001499
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140001467
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140001467
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x8b5849cf
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140001462
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x140001440
cmp r8d, 0x956d875b
je 0x14000146c
test r9d, r9d
jne 0x140001420
mov rax, qword [rax]
jmp 0x1400013f0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov rcx, r14
mov rdx, qword [rsi - 0xc]
add rax, r10
call rax
test rax, rax
mov qword [rsi + 0xc], rax
setne al
mov byte [rsi + 8], al
inc ebp
add rsi, 0x30
cmp ebp, 2
jb 0x140001350
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1400014d0
Capabilities:
Access peb ldr_data
Encode data using xor
Get kernel32 base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x14001e040]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor ebp, ebp
lea rsi, [0x14001e0e0]
mov eax, ebp
mov rcx, rsi
cmp dword [rcx], 1
je 0x1400015b9
inc eax
add rcx, 0x30
cmp eax, 2
jb 0x140001501
mov rsi, rbp
xor eax, eax
lea rdi, [rsp + 0x30]
mov ecx, 0x30
rep stosb byte [rdi], al
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov r11d, dword [rcx + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x1400015b4
mov r8d, dword [r11 + 0x18]
test r8d, r8d
je 0x1400015b4
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r8d
mov edi, 0xfec57f61
lea rcx, [rbx + r8*4]
mov ecx, dword [rcx + r9]
add rcx, r9
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1400015af
nop dword [rax]
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, edi
imul edi, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x140001590
cmp edi, 0xdee32eb1
je 0x1400015d7
test r8d, r8d
jne 0x140001570
mov rax, qword [rax]
jmp 0x140001540
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rsi + rcx*8 + 0x24], bpl
je 0x140001515
mov rsi, qword [rsi + rcx*8 + 0x28]
jmp 0x140001518
mov ecx, dword [r11 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
call rax
mov r9d, 0x30
mov qword [rsp + 0x20], rbp
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, rax
call rsi
mov ecx, dword [rsp + 0x58]
test eax, eax
cmovne ecx, ebp
mov eax, ecx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140019620
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140002350
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0xc0
mov rax, qword [0x14001e040]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rbx, rcx
mov qword [r11 - 0x38], rcx
mov r8, qword [rcx + 0x10]
mov rcx, qword [rcx + 0x18]
mov rax, rcx
sub rax, r8
xor r15d, r15d
cmp rax, 3
jb 0x14000241f
lea rax, [r8 + 3]
mov qword [rbx + 0x10], rax
mov rdi, rbx
cmp rcx, 0xf
jbe 0x1400023b3
mov rdi, qword [rbx]
lea rax, [0x14001b5ef]
mov r14d, 3
lea rsi, [0x14001b5ec]
cmp rax, rdi
jbe 0x1400023e7
lea rax, [rdi + r8]
cmp rsi, rax
ja 0x1400023e7
cmp rdi, rsi
ja 0x1400023df
mov rbp, r15
jmp 0x1400023ea
mov rbp, rdi
sub rbp, rsi
jmp 0x1400023ea
mov rbp, r14
inc r8
lea rcx, [rdi + 3]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memmove
mov r8, rbp
mov rdx, rsi
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
sub r14, rbp
lea rdx, [rsi + 3]
add rdx, rbp
lea rcx, [rdi + rbp]
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
jmp 0x140002441
mov r14d, 3
mov qword [rsp + 0x28], r14
lea rsi, [0x14001b5ec]
mov qword [rsp + 0x20], rsi
mov edx, r14d
mov rcx, rbx
call fcn.1400190a0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
mov dword [rsp + 0x30], 0x70
mov dword [rsp + 0x34], 0x40
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x40], r15
lea rax, str.cmd.exe
mov qword [rsp + 0x48], rax
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x1400024a0
mov rax, qword [rbx]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], r15
mov dword [rsp + 0x60], r15d
mov qword [rsp + 0x68], r15
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x1400024d6
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0xa8]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x140002531
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14000252c
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000256d
mov rcx, r8
call fcn.1400198c4
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140019620
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140017fb0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [rcx + 0x1384], 0xffffffff
lea r9, [rcx + 8]
mov dword [rcx + 4], edx
mov r8d, 1
nop word [rax + rax]
mov eax, edx
lea r9, [r9 + 4]
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, r8d
inc r8
mov dword [r9 - 4], edx
cmp r8, 0x270
jb 0x140017fd0
mov dword [rcx], 0x270
mov rax, rcx
ret

Function at 0x140018760
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [rcx + 4], edx
lea r9, [rcx + 8]
mov eax, 1
nop dword [rax]
mov r8d, edx
lea r9, [r9 + 4]
shr r8d, 0x1e
xor r8d, edx
imul edx, r8d, 0x6c078965
add edx, eax
inc rax
mov dword [r9 - 4], edx
cmp rax, 0x270
jb 0x140018770
mov dword [rcx], 0x270
ret

Function at 0x140019480
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x1400194e1
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x1400194a0
mov ecx, dword [r9]
jmp 0x1400195c8
cmp ecx, 0x4e0
jb 0x1400195c8
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x140019500
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x140019550
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x14001a044
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001a08e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001a08e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001a08e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001a08e
cmp dword [rcx + 0x84], 0xe
jbe 0x14001a08e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001a090
xor al, al
add rsp, 0x28
ret
Function at 0x140001940
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
push r14
push r15
mov r15, rcx
mov r14, r8
mov rbp, rdx
sub r15, qword [r8 + 0x30]
je 0x140001acf
test byte [r8 + 0x5e], 0x40
jne 0x140001968
xor eax, eax
pop r15
pop r14
pop rbp
ret
movzx edx, word [r14 + 0x14]
movzx eax, word [r14 + 6]
add rdx, 0x18
mov r8d, dword [r8 + 0xb0]
add rdx, r14
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
cmp rdx, r9
jae 0x140001acf
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x1400019a3
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x1400019b7
add rdx, 0x28
cmp rdx, r9
jb 0x140001991
mov eax, 1
pop r15
pop r14
pop rbp
ret
mov qword [rsp + 0x30], rdi
mov edi, dword [rdx + 0x14]
sub rdi, rcx
mov qword [rsp + 0x38], r12
mov r12d, dword [r14 + 0xb4]
add rdi, r8
add rdi, rbp
add r12, rdi
test rdi, rdi
je 0x140001ac5
cmp rdi, r12
jae 0x140001ac5
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rsi
mov eax, dword [rdi + 4]
test eax, eax
je 0x140001abb
add eax, 0xfffffff8
shr eax, 1
je 0x140001aac
lea rbx, [rdi + 8]
mov esi, eax
nop
movzx r9d, word [rbx]
movzx eax, r9w
shr ax, 0xc
and r9d, 0x80000fff
jge 0x140001a32
dec r9d
or r9d, 0xfffff000
inc r9d
cmp ax, 3
je 0x140001a3e
cmp ax, 0xa
jne 0x140001a9e
movzx r11d, word [r14 + 0x14]
movzx r8d, word [r14 + 6]
add r11, 0x18
mov r10d, dword [rdi]
add r11, r14
mov rax, r11
lea rcx, [r8 + r8*4]
lea rdx, [r11 + rcx*8]
cmp r11, rdx
jae 0x140001a93
mov edx, dword [rax + 0xc]
cmp r10, rdx
jb 0x140001a74
mov ecx, dword [rax + 8]
add ecx, edx
cmp r10, rcx
jb 0x140001a85
lea rdx, [r8 + r8*4]
add rax, 0x28
lea rcx, [r11 + rdx*8]
cmp rax, rcx
jmp 0x140001a60
mov ecx, dword [rax + 0x14]
sub rcx, rdx
add rcx, r10
add rcx, rbp
jne 0x140001a96
mov rcx, rbp
movzx eax, r9w
add qword [rax + rcx], r15
add rbx, 2
sub rsi, 1
jne 0x140001a10
mov eax, dword [rdi + 4]
add rdi, rax
cmp rdi, r12
jb 0x1400019f3
mov rsi, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x30]
mov r12, qword [rsp + 0x38]
mov eax, 1
pop r15
pop r14
pop rbp
ret
Function at 0x1400021d0
Capabilities:
Encode data using xor
Execute command

Disassembly:
sub rsp, 0x68
cmp byte [0x1400045a9], 0
movups xmm3, xmmword [str.89gAWEL]
movzx eax, word [0x1400045a8]
mov word [rsp + 0x30], ax
movups xmmword [rsp + 0x20], xmm3
je 0x1400023fd
xor ecx, ecx
cmp dword [0x140006090], 2
jl 0x1400023bf
movdqa xmm5, xmmword [0x140004620]
movdqa xmm2, xmmword [0x1400045b0]
movdqa xmm4, xmmword [0x140004600]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm5
pmuldq xmm1, xmm5
movd eax, xmm3
movdqa xmm3, xmmword [0x1400045d0]
movaps xmmword [rsp + 0x50], xmm6
movdqa xmm6, xmmword [str.6666]
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
movaps xmmword [rsp + 0x40], xmm7
movdqa xmm7, xmmword [0x140004610]
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
movd xmm0, eax
andps xmm2, xmm4
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm7
xorps xmm2, xmm0
movd dword [rsp + 0x20], xmm2
movdqa xmm2, xmmword [0x1400045c0]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm5
pmuldq xmm1, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm3
pmulld xmm0, xmm6
psubd xmm2, xmm0
punpckldq xmm1, xmm3
movd xmm0, dword [rsp + 0x24]
andps xmm2, xmm4
pmuldq xmm1, xmm5
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm7
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm5
movd dword [rsp + 0x24], xmm2
movdqa xmm2, xmmword [0x1400045e0]
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm2
pmulld xmm0, xmm6
psubd xmm3, xmm0
punpckldq xmm1, xmm2
movd xmm0, dword [rsp + 0x28]
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
pmuldq xmm1, xmm5
paddb xmm3, xmm7
xorps xmm3, xmm0
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm5
movd dword [rsp + 0x28], xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
mov ecx, 0x10
pmulld xmm0, xmm6
movaps xmm6, xmmword [rsp + 0x50]
psubd xmm2, xmm0
movd xmm0, dword [rsp + 0x2c]
andps xmm2, xmm4
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm7
movaps xmm7, xmmword [rsp + 0x40]
xorps xmm2, xmm0
movd dword [rsp + 0x2c], xmm2
mov eax, ecx
lea r8, [rsp + 0x20]
add r8, rax
nop dword [rax]
mov eax, 0x4bda12f7
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x36
movzx eax, cl
inc ecx
sub al, dl
add al, 0x32
xor byte [r8 - 1], al
cmp ecx, 0x12
jl 0x1400023d0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rsp + 0x20]
call fcn.140002440
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140001d60
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor eax, eax
add rsp, 0x68
ret
Function at 0x1400365a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [rcx + 0x10], 2
mov r11, rcx
mov r8, qword [rdx]
movabs rax, 0x112e0be826d694b3
imul r8
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul eax, edx, 0x3b9aca00
lea r9, [rdx - 1]
sub r8d, eax
cmovns r9, rdx
test r8d, r8d
lea eax, [r8 + 0x3b9aca00]
cmovns eax, r8d
mov dword [rcx + 0xc], eax
movabs rax, 0x8888888888888889
imul r9
add rdx, r9
sar rdx, 5
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul eax, edx, 0x3c
lea r8d, [rdx - 1]
sub r9d, eax
lea eax, [r9 + 0x3c]
movzx ecx, al
movzx eax, r9b
cmovns ecx, eax
test r9d, r9d
mov byte [r11 + 0xb], cl
mov eax, 0x88888889
cmovns r8d, edx
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x3c
lea r9d, [rdx - 1]
sub r8d, eax
cmovns r9d, edx
test r8d, r8d
lea eax, [r8 + 0x3c]
movzx ecx, al
movzx eax, r8b
cmovns ecx, eax
mov eax, 0x2aaaaaab
imul r9d
mov byte [r11 + 0xa], cl
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
lea ecx, [rdx - 1]
shl eax, 3
sub r9d, eax
cmovns ecx, edx
test r9d, r9d
lea eax, [r9 + 0x18]
movzx edx, al
movzx eax, r9b
cmovns edx, eax
mov eax, 0x92492493
mov byte [r11 + 9], dl
imul ecx
mov eax, 0x92492493
add edx, ecx
sar edx, 2
mov r8d, edx
shr r8d, 0x1f
add edx, r8d
mov r8d, ecx
imul edx, edx, 7
sub r8d, edx
add r8d, 0xa
imul r8d
add edx, r8d
lea r10, [0x1400b2d00]
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 7
sub r8d, eax
mov eax, 0xb38cf9b1
mov byte [r11 + 5], r8b
imul ecx
add edx, ecx
sar edx, 8
mov r8d, edx
add edx, 0x12c
shr r8d, 0x1f
add r8d, edx
lea edx, [r8 + 1]
cmp dword [r10 + rdx*4], ecx
jg 0x14003671c
nop dword [rax + rax]
inc r8d
lea edx, [rdx + 1]
cmp dword [r10 + rdx*4], ecx
jle 0x140036710
cmp dword [r10 + r8*4], ecx
jle 0x14003672b
dec r8d
cmp dword [r10 + r8*4], ecx
jg 0x140036722
sub ecx, dword [r10 + r8*4]
lea r9d, [r8 + 0x686]
mov dword [r11], r9d
lea eax, [rcx + 1]
mov word [r11 + 6], ax
mov eax, r9d
and eax, 0x80000003
jge 0x140036752
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
jne 0x140036795
mov eax, 0x51eb851f
imul r9d
sar edx, 5
mov r8d, edx
shr r8d, 0x1f
add edx, r8d
imul r8d, edx, 0x64
cmp r9d, r8d
jne 0x140036791
mov eax, 0x51eb851f
imul r9d
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x190
cmp r9d, eax
jne 0x140036795
mov al, 1
jmp 0x140036797
xor al, al
test al, al
lea rdx, [0x1400b2cc0]
movzx eax, al
lea r10, [0x1400b2ce0]
cmove r10, rdx
xor eax, 1
inc eax
shl eax, 6
or eax, 2
mov dword [r11 + 0x10], eax
mov eax, ecx
cdq
inc ecx
and edx, 0x1f
add eax, edx
sar eax, 5
movsxd r9, eax
movzx r8d, word [r10 + r9*2 + 2]
cmp r8d, ecx
jg 0x1400367f1
nop dword [rax + rax]
movsxd rdx, r9d
inc r9d
movzx r8d, word [r10 + rdx*2 + 4]
cmp r8d, ecx
jle 0x1400367e0
lea eax, [r9 + 1]
mov byte [r11 + 4], al
movsxd rax, r9d
sub cl, byte [r10 + rax*2]
mov rax, r11
inc cl
mov dword [r11 + 0x14], 0
mov byte [r11 + 8], cl
ret
Function at 0x140037280
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x20
mov rdx, rcx
xor r8d, r8d
lea rcx, [rsp + 0x38]
call fcn.14005d980
mov ebx, eax
test eax, eax
js 0x1400372c6
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400372ba
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14005db40
mov ebx, eax
mov rcx, qword [rsp + 0x38]
call fcn.14005d970
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x140037380
Capabilities:
Clear file content

Disassembly:
mov rax, r8
mov r10, rdx
mov r8, rcx
mov rdx, rax
mov rcx, r10
xor r9d, r9d
jmp fcn.1400373d0

Function at 0x1400373a0
Capabilities:
Clear file content

Disassembly:
lea rax, [rdx - 1]
cmp rax, 2
jbe 0x1400373b0
mov eax, 0xfffffffe
ret
mov r8, rcx
or rdx, 0x780
lea rcx, [0x1400b36e8]
xor r9d, r9d
jmp fcn.1400373d0
Function at 0x14003d720
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
test rcx, rcx
jne 0x14003d736
xor eax, eax
add rsp, 0x30
pop rbx
ret
cmp rbx, 0x1000
jb 0x14003d9d8
movabs rax, 0xffff800000000000
test rax, rbx
jne 0x14003d9d8
cmp dword [rcx], 0x19750113
jne 0x14003d9d8
cmp byte [rcx + 0x60], 0
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
jne 0x14003d77e
lea rdx, [0x1400a8a58]
call fcn.14003ca60
xor ebp, ebp
mov qword [rsp + 0x50], rdi
cmp byte [rbx + 0xc8], bpl
je 0x14003d8e7
mov rax, qword [rbx + 0xe0]
test rax, rax
jne 0x14003d7b8
cmp byte [rbx + 0xc9], bpl
jne 0x14003d89c
cmp byte [rbx + 0xca], bpl
jne 0x14003d8ee
cmp rax, 1
jbe 0x14003d84d
mov ecx, dword [rbx + 0xcc]
lea rdi, [rax + rax]
lea rsi, [rax - 1]
mov rax, qword [rbx + 0xe0]
sub rdi, 2
mov r8, qword [rbx + rax*8 + 0xe8]
test ecx, ecx
jne 0x14003d807
mov qword [rsp + 0x20], r8
lea r9, [0x1400a1620]
mov r8, rdi
lea rdx, str._n_s___s__n
mov rcx, rbx
call fcn.14003d060
jmp 0x14003d838
cmp ecx, 2
mov rcx, rbx
jne 0x14003d82c
mov qword [rsp + 0x20], r8
lea r9, [0x1400a1620]
mov r8, rdi
lea rdx, str._s___s__n
call fcn.14003d060
jmp 0x14003d838
lea rdx, str.___s__n
call fcn.14003d060
mov dword [rbx + 0xcc], 2
mov ecx, 2
sub rsi, 1
jne 0x14003d7d0
cmp byte [rbx + 0xc9], bpl
jne 0x14003d89c
cmp byte [rbx + 0xca], bpl
je 0x14003d89c
mov eax, dword [rbx + 4]
lea r8, str.SubTests__u__SubTestsFailed__u__errors__u_
mov r9d, dword [rbx + 0xb8]
lea rdx, [0x1400b3ea0]
mov dword [rsp + 0x28], eax
mov rcx, rbx
mov eax, dword [rbx + 0xbc]
mov dword [rsp + 0x20], eax
call fcn.14003cd10
lea rdx, str.__Test__n
mov rcx, rbx
call fcn.14003d060
mov rcx, qword [rbx + 0xd0]
cmp rcx, 0xffffffffffffffff
je 0x14003d8b9
call fcn.140055900
mov qword [rbx + 0xd0], 0xffffffffffffffff
mov rcx, qword [rbx + 0xd8]
cmp rcx, 0xffffffffffffffff
je 0x14003d8d6
call fcn.140037250
mov qword [rbx + 0xd8], 0xffffffffffffffff
mov byte [rbx + 0xc8], bpl
mov dword [rbx + 0xcc], 2
mov qword [rbx + 0xe0], rbp
mov rcx, qword [0x1400f52a8]
call sub.KERNEL32.dll_TlsGetValue
cmp rax, rbx
jne 0x14003d90d
mov rcx, qword [0x1400f52a8]
xor edx, edx
call fcn.140066d60
mov eax, 0xe68afeec
lea rcx, [rbx + 0x68]
xchg dword [rbx], eax
call fcn.140051860
lea rcx, [rbx + 0x28]
call fcn.140051860
mov rsi, qword [rbx + 0x98]
mov qword [rbx + 0x98], rbp
test rsi, rsi
je 0x14003d986
nop dword [rax]
mov rdi, rsi
mov r8d, 3
mov rsi, qword [rsi]
mov rdx, qword [rdi + 0x28]
mov rcx, qword [rdi + 0x20]
call fcn.140066e70
mov rdx, qword [rdi + 0x38]
mov r8d, 3
mov rcx, qword [rdi + 0x30]
call fcn.140066e70
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
call fcn.140066e50
mov rcx, rdi
call fcn.140041950
test rsi, rsi
jne 0x14003d940
mov rcx, qword [rbx + 0xa0]
call fcn.140041e90
mov rcx, qword [rbx + 8]
mov qword [rbx + 0xa0], rbp
call fcn.140041e90
mov rcx, qword [rbx + 0xc0]
mov qword [rbx + 8], rbp
call fcn.140041e90
mov rcx, rbx
mov qword [rbx + 0xc0], rbp
call fcn.140041950
mov rdi, qword [rsp + 0x50]
xor eax, eax
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
add rsp, 0x30
pop rbx
ret
mov eax, 0xfffffffc
add rsp, 0x30
pop rbx
ret