joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400aa080
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x190
mov rdi, rcx
cmp dword [r8 + 0x20], 0xffffffff
jne 0x1400aa2d7
movzx eax, word [rdx + 0x3a]
mov r8d, dword [rdx + 0x40]
cmp ax, 0x3b
je 0x1400aa0fb
cmp ax, 0x37
je 0x1400aa138
mov r9, rdx
mov r8d, 0xfffffff6
lea rdx, [rsp + 0x20]
call fcn.1400e7010
mov rbx, rax
lea rdx, str.Target_of_NonWritable_decoration_must_be_a_memory_object_declaration__a_variable_or_a_function_parameter_
mov rcx, rax
call fcn.14002dd70
mov ebx, dword [rbx + 0x160]
lea rcx, [rsp + 0x20]
call fcn.1400604a0
mov eax, ebx
mov rbx, qword [rsp + 0x1a0]
add rsp, 0x190
pop rdi
ret
mov rcx, qword [rdx + 0x18]
mov rax, qword [rdx + 0x20]
sub rax, rcx
sar rax, 4
cmp rax, 2
jbe 0x1400aa2ea
movzx ecx, word [rcx + 0x20]
mov rax, qword [rdx]
mov r9d, dword [rax + rcx*4]
cmp r9d, 7
je 0x1400aa12b
cmp r9d, 6
jne 0x1400aa138
cmp byte [rdi + 0x41b], 0
jne 0x1400aa2d7
movzx r9d, r8b
movabs rax, 0xcbf29ce484222325
xor r9, rax
movabs r10, 0x100000001b3
imul r9, r10
mov eax, r8d
shr eax, 8
movzx ecx, al
xor r9, rcx
imul r9, r10
mov eax, r8d
shr eax, 0x10
movzx ecx, al
xor r9, rcx
imul r9, r10
mov rax, r8
shr rax, 0x18
xor r9, rax
imul r9, r10
mov rcx, qword [rdi + 0x568]
and rcx, r9
shl rcx, 4
add rcx, qword [rdi + 0x550]
mov rax, qword [rcx + 8]
mov r10, qword [rdi + 0x540]
cmp rax, r10
je 0x1400aa1d2
mov rcx, qword [rcx]
cmp r8d, dword [rax + 0x10]
je 0x1400aa1c2
cmp rax, rcx
je 0x1400aa1d2
mov rax, qword [rax + 8]
cmp r8d, dword [rax + 0x10]
jne 0x1400aa1b3
test rax, rax
cmove rax, r10
cmp rax, r10
jne 0x1400aa2d7
mov rcx, qword [rdi + 0x5e8]
and rcx, r9
shl rcx, 4
add rcx, qword [rdi + 0x5d0]
mov rax, qword [rcx + 8]
mov r10, qword [rdi + 0x5c0]
cmp rax, r10
je 0x1400aa21f
mov rcx, qword [rcx]
cmp r8d, dword [rax + 0x10]
je 0x1400aa20f
cmp rax, rcx
je 0x1400aa21f
mov rax, qword [rax + 8]
cmp r8d, dword [rax + 0x10]
jne 0x1400aa200
test rax, rax
cmove rax, r10
cmp rax, r10
jne 0x1400aa2d7
mov rcx, qword [rdi + 0x668]
and rcx, r9
shl rcx, 4
add rcx, qword [rdi + 0x650]
mov rax, qword [rcx + 8]
mov r9, qword [rdi + 0x640]
cmp rax, r9
je 0x1400aa26b
mov rcx, qword [rcx]
cmp r8d, dword [rax + 0x10]
je 0x1400aa25f
nop dword [rax]
cmp rax, rcx
je 0x1400aa26b
mov rax, qword [rax + 8]
cmp r8d, dword [rax + 0x10]
jne 0x1400aa250
test rax, rax
cmove rax, r9
cmp rax, r9
jne 0x1400aa2d7
mov r9, rdx
mov r8d, 0xfffffff6
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1400e7010
mov rbx, rax
lea rdx, str.Target_of_NonWritable_decoration_is_invalid:_must_point_to_a_storage_image__uniform_block_
mov rcx, rax
call fcn.14002dd70
lea rax, str.storage_buffer__or_variable_in_Private_or_Function_storage_class
lea rdx, str.or_storage_buffer
cmp byte [rdi + 0x41b], 0
cmovne rdx, rax
mov rcx, rbx
call fcn.14002dd70
mov ebx, dword [rbx + 0x160]
lea rcx, [rsp + 0x20]
call fcn.1400604a0
mov eax, ebx
mov rbx, qword [rsp + 0x1a0]
add rsp, 0x190
pop rdi
ret
xor eax, eax
mov rbx, qword [rsp + 0x1a0]
add rsp, 0x190
pop rdi
ret
call fcn.14005fd00
int3
Function at 0x1400bfbd0
Capabilities:
Hash data using fnv

Disassembly:
mov r10, rcx
movzx r9d, dl
movabs r11, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov eax, edx
imul r9, r11
shr eax, 8
movzx r8d, al
mov eax, edx
xor r9, r8
shr eax, 0x10
mov r8, qword [r10 + 0x468]
imul r9, r11
movzx ecx, al
xor r9, rcx
mov eax, edx
mov rcx, qword [r10 + 0x490]
imul r9, r11
shr rax, 0x18
xor r9, rax
imul r9, r11
and rcx, r9
shl rcx, 4
add rcx, qword [r10 + 0x478]
mov rax, qword [rcx + 8]
cmp rax, r8
je 0x1400bfc6f
mov rcx, qword [rcx]
cmp edx, dword [rax + 0x10]
je 0x1400bfc5e
nop dword [rax + rax]
cmp rax, rcx
je 0x1400bfc6f
mov rax, qword [rax + 8]
cmp edx, dword [rax + 0x10]
jne 0x1400bfc50
test rax, rax
cmove rax, r8
cmp rax, r8
je 0x1400bfc6f
add rax, 0x18
ret
xor eax, eax
ret

Function at 0x1400bfc80
Capabilities:
Hash data using fnv

Disassembly:
mov r10, rcx
movzx r9d, dl
movabs r11, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov eax, edx
imul r9, r11
shr eax, 8
movzx r8d, al
mov eax, edx
xor r9, r8
shr eax, 0x10
mov r8, qword [r10 + 0x4a8]
imul r9, r11
movzx ecx, al
xor r9, rcx
mov eax, edx
mov rcx, qword [r10 + 0x4d0]
imul r9, r11
shr rax, 0x18
xor r9, rax
imul r9, r11
and rcx, r9
shl rcx, 4
add rcx, qword [r10 + 0x4b8]
mov rax, qword [rcx + 8]
cmp rax, r8
je 0x1400bfd1f
mov rcx, qword [rcx]
cmp edx, dword [rax + 0x10]
je 0x1400bfd0e
nop dword [rax + rax]
cmp rax, rcx
je 0x1400bfd1f
mov rax, qword [rax + 8]
cmp edx, dword [rax + 0x10]
jne 0x1400bfd00
test rax, rax
cmove rax, r8
cmp rax, r8
je 0x1400bfd1f
add rax, 0x18
ret
xor eax, eax
ret
Function at 0x1400e12d0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r14d, r9d
mov qword [rsp + 0x50], rbx
mov esi, r8d
lea r15, [0x140000000]
mov edi, edx
mov rbp, rcx
movabs r13, 0xcbf29ce484222325
movabs r12, 0x100000001b3
lea eax, [rsi - 0x15]
cmp eax, 1
ja case.0x1400e136a.26
mov edx, edi
mov rcx, rbp
call fcn.1400e1ef0
mov rbx, rax
test rax, rax
je case.0x1400e136a.26
movzx eax, word [rax + 0x3a]
cmp eax, esi
je 0x1400e14ce
cmp eax, 0x14ee
ja case.0x1400e136a.26
je case.0x1400e136a.23
add eax, 0xffffffe9
cmp eax, 0xa
ja case.0x1400e136a.26
cdqe
mov ecx, dword [r15 + rax*4 + 0xe14fc]
add rcx, r15
jmp rcx
mov eax, edi
movzx edx, dil
xor rdx, r13
shr eax, 8
imul rdx, r12
movzx ecx, al
mov eax, edi
xor rdx, rcx
shr eax, 0x10
imul rdx, r12
movzx ecx, al
xor rdx, rcx
mov eax, edi
mov rcx, qword [rbp + 0xa8]
imul rdx, r12
shr rax, 0x18
xor rdx, rax
imul rdx, r12
and rcx, rdx
mov rdx, qword [rbp + 0x80]
shl rcx, 4
add rcx, qword [rbp + 0x90]
mov rax, qword [rcx + 8]
cmp rax, rdx
je 0x1400e13e0
mov rcx, qword [rcx]
cmp edi, dword [rax + 0x10]
je 0x1400e13e2
nop
cmp rax, rcx
je 0x1400e13e0
mov rax, qword [rax + 8]
cmp edi, dword [rax + 0x10]
jne 0x1400e13d0
jmp 0x1400e13e2
xor eax, eax
test rax, rax
cmove rax, rdx
cmp rax, rdx
jne case.0x1400e136a.26
mov rcx, qword [rbx + 0x18]
mov rax, qword [rbx + 0x20]
sub rax, rcx
sar rax, 4
cmp rax, 2
jbe 0x1400e14f3
movzx ecx, word [rcx + 0x20]
mov rax, qword [rbx]
mov edi, dword [rax + rcx*4]
jmp 0x1400e1312
mov rcx, qword [rbx + 0x18]
mov rax, qword [rbx + 0x20]
sub rax, rcx
sar rax, 4
cmp rax, 1
jbe 0x1400e14f3
movzx ecx, word [rcx + 0x10]
mov rax, qword [rbx]
mov edi, dword [rax + rcx*4]
jmp 0x1400e1312
mov rcx, qword [rbx + 0x20]
mov edi, 1
mov r8, qword [rbx + 0x18]
mov rax, rcx
sub rax, r8
sar rax, 4
cmp rax, rdi
jbe case.0x1400e136a.26
mov edx, edi
sub rcx, r8
sar rcx, 4
cmp rcx, rdx
jbe 0x1400e14f3
mov rax, qword [rbx]
add rdx, rdx
mov r9d, r14d
movzx ecx, word [r8 + rdx*8]
mov r8d, esi
mov edx, dword [rax + rcx*4]
mov rcx, rbp
call fcn.1400e12d0
test al, al
jne 0x1400e14ca
mov rcx, qword [rbx + 0x20]
inc edi
mov r8, qword [rbx + 0x18]
mov rax, rcx
sub rax, r8
mov edx, edi
sar rax, 4
cmp rdx, rax
jb 0x1400e1460
xor al, al
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov al, 1
jmp 0x1400e14ad
mov rcx, qword [rbx + 0x18]
mov rax, qword [rbx + 0x20]
sub rax, rcx
sar rax, 4
cmp rax, 1
jbe 0x1400e14f3
mov rax, qword [rbx]
movzx ecx, word [rcx + 0x10]
cmp dword [rax + rcx*4], r14d
sete al
jmp 0x1400e14ad
call fcn.14005fd00
int3
Function at 0x1400e1ef0
Capabilities:
Hash data using fnv

Disassembly:
mov r10, rcx
movzx r9d, dl
movabs r11, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov eax, edx
imul r9, r11
shr eax, 8
movzx r8d, al
mov eax, edx
xor r9, r8
shr eax, 0x10
mov r8, qword [r10 + 0x198]
imul r9, r11
movzx ecx, al
xor r9, rcx
mov eax, edx
mov rcx, qword [r10 + 0x1c0]
imul r9, r11
shr rax, 0x18
xor r9, rax
imul r9, r11
and rcx, r9
shl rcx, 4
add rcx, qword [r10 + 0x1a8]
mov rax, qword [rcx + 8]
cmp rax, r8
je 0x1400e1f8f
mov rcx, qword [rcx]
cmp edx, dword [rax + 0x10]
je 0x1400e1f7e
nop dword [rax + rax]
cmp rax, rcx
je 0x1400e1f8f
mov rax, qword [rax + 8]
cmp edx, dword [rax + 0x10]
jne 0x1400e1f70
test rax, rax
cmove rax, r8
cmp rax, r8
je 0x1400e1f8f
mov rax, qword [rax + 0x18]
ret
xor eax, eax
ret

Function at 0x1400e1fd0
Capabilities:
Hash data using fnv

Disassembly:
mov r10, rcx
movzx r9d, dl
movabs r11, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov eax, edx
imul r9, r11
shr eax, 8
movzx r8d, al
mov eax, edx
xor r9, r8
shr eax, 0x10
mov r8, qword [r10 + 0x4e8]
imul r9, r11
movzx ecx, al
xor r9, rcx
mov eax, edx
mov rcx, qword [r10 + 0x510]
imul r9, r11
shr rax, 0x18
xor r9, rax
imul r9, r11
and rcx, r9
shl rcx, 4
add rcx, qword [r10 + 0x4f8]
mov rax, qword [rcx + 8]
cmp rax, r8
je 0x1400e206f
mov rcx, qword [rcx]
cmp edx, dword [rax + 0x10]
je 0x1400e205e
nop dword [rax + rax]
cmp rax, rcx
je 0x1400e206f
mov rax, qword [rax + 8]
cmp edx, dword [rax + 0x10]
jne 0x1400e2050
test rax, rax
cmove rax, r8
cmp rax, r8
je 0x1400e206f
add rax, 0x18
ret
lea rax, [r10 + 0x520]
ret

Function at 0x1400e2a10
Capabilities:
Hash data using fnv

Disassembly:
mov r10, rcx
movzx r9d, dl
movabs r11, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov eax, edx
imul r9, r11
shr eax, 8
movzx r8d, al
mov eax, edx
xor r9, r8
shr eax, 0x10
mov r8, qword [r10 + 0x198]
imul r9, r11
movzx ecx, al
xor r9, rcx
mov eax, edx
mov rcx, qword [r10 + 0x1c0]
imul r9, r11
shr rax, 0x18
xor r9, rax
imul r9, r11
and rcx, r9
shl rcx, 4
add rcx, qword [r10 + 0x1a8]
mov rax, qword [rcx + 8]
cmp rax, r8
je 0x1400e2aac
mov rcx, qword [rcx]
cmp edx, dword [rax + 0x10]
je 0x1400e2aae
nop dword [rax + rax]
cmp rax, rcx
je 0x1400e2aac
mov rax, qword [rax + 8]
cmp edx, dword [rax + 0x10]
jne 0x1400e2a90
test rax, rax
cmove rax, r8
cmp rax, r8
setne al
ret
xor eax, eax
test rax, rax
cmove rax, r8
cmp rax, r8
setne al
ret
Function at 0x1400e2d40
Capabilities:
Hash data using fnv

Disassembly:
mov r10, rcx
movzx r9d, dl
movabs r11, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov eax, edx
imul r9, r11
shr eax, 8
movzx r8d, al
mov eax, edx
xor r9, r8
shr eax, 0x10
mov r8, qword [r10 + 0x80]
imul r9, r11
movzx ecx, al
xor r9, rcx
mov eax, edx
mov rcx, qword [r10 + 0xa8]
imul r9, r11
shr rax, 0x18
xor r9, rax
imul r9, r11
and rcx, r9
shl rcx, 4
add rcx, qword [r10 + 0x90]
mov rax, qword [rcx + 8]
cmp rax, r8
je 0x1400e2ddc
mov rcx, qword [rcx]
cmp edx, dword [rax + 0x10]
je 0x1400e2dde
nop dword [rax + rax]
cmp rax, rcx
je 0x1400e2ddc
mov rax, qword [rax + 8]
cmp edx, dword [rax + 0x10]
jne 0x1400e2dc0
test rax, rax
cmove rax, r8
cmp rax, r8
setne al
ret
xor eax, eax
test rax, rax
cmove rax, r8
cmp rax, r8
setne al
ret

Function at 0x1400e3e40
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
movabs r11, 0x100000001b3
movzx r9d, dl
mov r10, rcx
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov eax, edx
imul r9, r11
mov rbx, qword [r10 + 0x50]
shr eax, 8
movzx r8d, al
mov eax, edx
xor r9, r8
shr eax, 0x10
mov r8, qword [r10 + 0x40]
imul r9, r11
movzx ecx, al
xor r9, rcx
mov eax, edx
imul r9, r11
shr rax, 0x18
xor r9, rax
imul r9, r11
and r9, qword [r10 + 0x68]
mov r11, r9
shl r11, 4
add r11, rbx
mov rcx, qword [r11 + 8]
cmp rcx, r8
je 0x1400e3f25
mov rax, qword [r11]
cmp edx, dword [rcx + 0x10]
je 0x1400e3ece
nop dword [rax + rax]
cmp rcx, rax
je 0x1400e3f25
mov rcx, qword [rcx + 8]
cmp edx, dword [rcx + 0x10]
jne 0x1400e3ec0
test rcx, rcx
je 0x1400e3f25
add r9, r9
mov rax, qword [rbx + r9*8]
cmp qword [r11 + 8], rcx
jne 0x1400e3ef9
cmp rax, rcx
jne 0x1400e3eef
mov qword [rbx + r9*8], r8
mov qword [r11 + 8], r8
jmp 0x1400e3f05
mov r8, qword [rcx + 8]
mov qword [r11 + 8], r8
jmp 0x1400e3f05
cmp rax, rcx
jne 0x1400e3f05
mov rax, qword [rcx]
mov qword [rbx + r9*8], rax
mov rdx, qword [rcx]
dec qword [r10 + 0x48]
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov edx, 0x18
call fcn.1400ec648
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x1400e72b0
Capabilities:
Hash data using fnv

Disassembly:
mov r10, rcx
movzx r9d, dl
movabs r11, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov eax, edx
imul r9, r11
shr eax, 8
movzx r8d, al
mov eax, edx
xor r9, r8
shr eax, 0x10
mov r8, qword [r10 + 0x428]
imul r9, r11
movzx ecx, al
xor r9, rcx
mov eax, edx
mov rcx, qword [r10 + 0x450]
imul r9, r11
shr rax, 0x18
xor r9, rax
imul r9, r11
and rcx, r9
shl rcx, 4
add rcx, qword [r10 + 0x438]
mov rax, qword [rcx + 8]
cmp rax, r8
je 0x1400e734f
mov rcx, qword [rcx]
cmp edx, dword [rax + 0x10]
je 0x1400e733e
nop dword [rax + rax]
cmp rax, rcx
je 0x1400e734f
mov rax, qword [rax + 8]
cmp edx, dword [rax + 0x10]
jne 0x1400e7330
test rax, rax
cmove rax, r8
cmp rax, r8
je 0x1400e734f
mov rax, qword [rax + 0x18]
ret
xor eax, eax
ret
Function at 0x1400e7530
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
mov r10d, r8d
mov rbx, rdx
mov r9, rcx
xor esi, esi
mov dword [rsp + 0x20], esi
mov qword [rdx], rsi
mov qword [rdx + 8], rsi
mov qword [rdx + 0x10], rsi
mov dword [rsp + 0x20], 1
movzx r8d, r8b
movabs rax, 0xcbf29ce484222325
xor r8, rax
movabs rdx, 0x100000001b3
imul r8, rdx
mov eax, r10d
shr eax, 8
movzx ecx, al
xor r8, rcx
imul r8, rdx
mov eax, r10d
shr eax, 0x10
movzx ecx, al
xor r8, rcx
imul r8, rdx
mov eax, r10d
shr rax, 0x18
xor r8, rax
imul r8, rdx
mov rcx, qword [r9 + 0xe8]
and rcx, r8
shl rcx, 4
add rcx, qword [r9 + 0xd0]
mov rax, qword [rcx + 8]
mov rdx, qword [r9 + 0xc0]
cmp rax, rdx
je 0x1400e7641
mov rcx, qword [rcx]
cmp r10d, dword [rax + 0x10]
je 0x1400e75f5
cmp rax, rcx
je 0x1400e7641
mov rax, qword [rax + 8]
cmp r10d, dword [rax + 0x10]
jne 0x1400e75e6
test rax, rax
cmove rax, rdx
cmp rax, rdx
je 0x1400e7641
add rax, 0x18
cmp rbx, rax
je 0x1400e7641
mov rdi, qword [rax + 8]
mov rbp, qword [rax]
sub rdi, rbp
mov rdx, rdi
sar rdx, 3
test rdx, rdx
je 0x1400e762b
mov rcx, rbx
call fcn.140045990
mov rsi, qword [rbx]
mov r8, rdi
mov rdx, rbp
mov rcx, rsi
call fcn.1400ee610
lea rax, [rdi + rsi]
mov qword [rbx + 8], rax
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x1400f3074
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x1400f2f07
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400f2f07
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400f2f07
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400f2f07
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400f2f07
cmp dword [rcx + 0x84], 0xe
jbe 0x1400f2f07
cmp dword [rcx + 0xf8], 0
je 0x1400f2f07
mov ecx, ebx
call fcn.1400f2fa8
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.1400f2d98
cmp dword [rbp + 0x20], 0
je 0x1400f2f54
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400f2f5c
int3
xor r8d, r8d
xor edx, edx
jmp 0x1400f2ea0

Function at 0x14010ee6c
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14010ee8c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400f2ccc
or eax, 0xffffffff
jmp 0x14010ee8e
xor eax, eax
add rsp, 0x28
ret
Function at 0x14000aa20
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14000aa2d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14000aa3d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14000aa25
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x14000aa55
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14000aa42
sub eax, 3
jb 0x14000aa6f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14000aaa6
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x14000aa96
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14000aa94
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14000aa83
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.14000a9e2
jmp 0x14000aa2d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x1e00
mov dl, 1
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14000aaf2
cmp rsi, rcx
jae 0x14000aafa
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14000aad9
cmp al, 0x8f
ja 0x14000aad9
cmp byte [rsi - 2], 0xf
je 0x14000aadf
sub al, 0xe8
cmp al, 1
ja 0x14000aac3
cmp rsi, rcx
jae 0x14000aafa
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14000aac9
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14000aafa
lodsb al, byte [rsi]
jmp 0x14000aad9
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x8000]
mov eax, dword [rdi]
or eax, eax
je 0x14000ab57
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xa1dc]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14000ab07
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14000ab51
mov qword [rbx], rax
add rbx, 8
jmp 0x14000ab27
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14000ab91
cmp al, 0xef
ja 0x14000ab83
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14000ab63
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x14000ab72
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x21f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14000abe5
sub rsp, 0xffffffffffffff80
jmp 0x1400021ec
Function at 0x1407b66f2
Capabilities:
Encode data using xor

Disassembly:
add r10, 0xc
xor r9d, r9d
mov qword [rsp], 0x591bb199
test rax, rax
lea rsp, [rsp + 8]
je 0x1407b676b
mov edi, 0x653c869b
sal dil, 0xe7
push rdi
mov qword [rsp + rdi - 0x653c8680], rsi
lea rdi, [0x14078cc98]
movzx esi, byte [rcx]
push 0xffffffff8d91c114
xor esi, r9d
and esi, 0xff
mov esi, dword [rdi + rsi*4]
shr r9d, 8
push 0x448f9516
xor r9d, esi
inc rcx
xor r9d, 0x17083f8c
dec rax
mov word [rsp + 8], 0xa38e
lea rsp, [rsp + 0x10]
jne 0x1407b672b
pop rsi
not r9d
call fcn.1407a0a70
Function at 0x140004060
Capabilities:
Enumerate pe sections

Disassembly:
push rbx
push rbp
push r13
push r14
mov eax, 0x1078
call fcn.1400259e0
sub rsp, rax
mov rax, qword [0x140037010]
xor rax, rsp
mov qword [rsp + 0x1050], rax
mov rbp, rdx
mov qword [rsp + 0x38], r9
mov rdx, qword [rsp + 0x10c0]
xor r14d, r14d
mov qword [rsp + 0x30], rdx
mov r13, r8
mov qword [rsp + 0x40], rcx
test r8, r8
je 0x1400040e2
mov r9d, 0x1000
lea rdx, [rsp + 0x50]
call fcn.140002630
test al, al
jne 0x1400040ea
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Cant_read_module_headers
call fcn.140005fb0
lea rdx, [0x140006190]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rdx, r14
jmp 0x1400041d2
mov qword [rsp + 0x10a8], rsi
mov qword [rsp + 0x1070], rdi
mov rdi, 0xffffffffffffffff
mov qword [rsp + 0x1068], r12
mov qword [rsp + 0x1060], r15
inc rdi
cmp byte [rdi + rbp], r14b
jne 0x140004111
movsxd rax, dword [rsp + 0x8c]
lea rcx, [rsp + 0x50]
add rcx, rax
mov esi, r14d
movzx eax, word [rcx + 0x14]
lea r12, [rcx + 0x18]
movzx r15d, word [rcx + 6]
add r12, rax
test r15d, r15d
je 0x14000418c
nop dword [rax]
nop word [rax + rax]
mov eax, esi
mov r8, rdi
mov rdx, rbp
lea rcx, [rax + rax*4]
lea rbx, [r12 + rcx*8]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140004185
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], r14b
jne 0x140004173
cmp rdi, rax
je 0x14000420c
inc esi
cmp esi, r15d
jb 0x140004150
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Cant_find_section
call fcn.140005fb0
lea rdx, [0x140006190]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rdx, r14
mov r12, qword [rsp + 0x1068]
mov rdi, qword [rsp + 0x1070]
mov rsi, qword [rsp + 0x10a8]
mov r15, qword [rsp + 0x1060]
mov rax, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov r8d, r14d
mov qword [rsp + 0x20], rax
call fcn.140003ee0
mov rcx, qword [rsp + 0x1050]
xor rcx, rsp
call fcn.1400247c0
add rsp, 0x1078
pop r14
pop r13
pop rbp
pop rbx
ret
mov eax, dword [rbx + 0xc]
test eax, eax
je 0x14000418c
mov ecx, dword [rbx + 8]
mov edx, eax
lea rax, [rsp + 0x50]
add rax, rdx
je 0x14000418c
test ecx, ecx
je 0x14000418c
mov r14d, ecx
add rdx, r13
jmp 0x1400041b2