joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ab6e0
Capabilities:
Execute syscall
Hash data using murmur3

Disassembly:
push rbx
mov qword [rsp], rbx
add rsp, 0xffffffffffffffe0
xchg rdx, rdx
mov rbx, rcx
mov rcx, qword [rcx + 0x1a8]
cmp rcx, 0xffffffffffffffff
xchg rbp, rbp
je 0x1400ab775
mov rax, qword [rbx + 0x258]
movabs rdx, 0xc7c830e92561b44f
add rdx, 0x33f2f076
sub rdx, 0x8e96d06
sub rdx, 0x16aa958c
sub rdx, 0x360b9bac
rol rax, 1
rol rax, 1
rol rax, 2
add rdx, rax
mov dword [rsp - 0x10], ebx
movabs rax, 0xe80b487233e6276d
add rax, 0x1ea71404
sub rax, 0xff6e28f
add rax, 0x771a0563
xor rdx, rax
ror rdx, 9
ror rdx, 3
ror rdx, 2
ror rdx, 4
ror rdx, 1
call rdx
xchg rcx, rbp
mov rbp, qword [rbx + 0x198]
xchg rbp, rcx
test rcx, rcx
je 0x1400ab7bc
cmp qword [rbx + 0x1a0], 0
mov dword [rsp - 0x18], 0x79ab6558
jne 0x1400ab7bc
mov rcx, qword [rcx + 0x20]
call fcn.14007fbb0
xchg rcx, r8
mov r8, qword [rbx + 0x198]
xchg r8, rcx
call fcn.14007fbb0
mov rcx, qword [rbx + 0x1a0]
xchg r12, r12
test rcx, rcx
je 0x1400ab8a7
mov rax, qword [rbx + 0x248]
movabs rdx, 0x34f86a65777510e7
sub rdx, 0xe915b47
sub rdx, 0x143024e6
add rdx, 0xe190838
xor rdx, 0x662dce6d
rol rax, 0x1f
rol rax, 0xf
rol rax, 4
rol rax, 1
rol rax, 1
rol rax, 1
rol rax, 1
sub rax, rdx
movabs rdx, 0xe1587a70a0c3523
sub rdx, 0x7fdb6eb
add rdx, 0x53a09a32
xor rdx, 0x4231bb9e
add rdx, 0x181ec3cf
rol rax, 0x1d
rol rax, 0xd
rol rax, 1
rol rax, 3
rol rax, 1
rol rax, 1
add rax, rdx
mov rdx, rdx
movabs rdx, 0xa8ff13df218ee4fd
add rdx, 0x3241b74a
sub rdx, 0xdcca8d
xor rdx, 0xda50833
add rdx, 0x7fffffff
add rdx, 0xf2f25fe
rol rax, 6
rol rax, 0x17
rol rax, 0xd
rol rax, 3
rol rax, 0xa
rol rax, 1
rol rax, 1
add rax, rdx
mov r12, r12
call rax
cmp qword [rbx + 0x200], 0
je 0x1400ab99f
mov rdi, rdi
xchg r8, rax
mov r8, qword [rbx + 0x210]
xchg r8, rax
movabs rcx, 0x772d2b252fb5e8d5
xor rcx, 0x4e6dd172
sub rcx, 0x31b80752
sub rcx, 0x212e4a79
xor rax, rcx
mov rbp, rbp
movabs rcx, 0x20cd09c158650e4c
add rcx, 0x66766f7
add rcx, 0x1352048e
sub rcx, 0x3b061669
xor rcx, 0x4b014531
rol rax, 0xb
rol rax, 8
add rax, rcx
movabs rcx, 0x1847483e20ebe8cc
add rcx, 0x4e1dbb04
sub rcx, 0x27511089
add rcx, 0x36036a86
add rcx, 0x7fffffff
add rcx, 0x1e92378
ror rax, 0xc
ror rax, 0xd
ror rax, 3
ror rax, 1
ror rax, 2
ror rax, 1
xor rax, rcx
rol rax, 0xd
rol rax, 6
rol rax, 3
rol rax, 3
rol rax, 1
rol rax, 1
not rax
mov dword [rsp - 0xc], 0x1b0b769a
call rax
xchg rsp, rcx
mov rsp, qword [rbx + 0x200]
xchg rcx, rsp
call fcn.140077680
and qword [rbx + 0x200], 0
mov r8, r8
mov rcx, qword [rbx + 0x1f0]
add rsp, 0x20
nop
mov rbx, qword [rsp]
add rsp, 8
jmp fcn.140077700
Function at 0x1400adf4c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
xchg rsi, r8
mov qword [rsp + 0x18], r8
xchg r8, rsi
mov qword [rsp + 0x20], rdi
nop
mov qword [rsp - 8], rbp
sub rsp, 8
xchg r10, rbp
mov r10, rsp
xchg r10, rbp
add rsp, 0xffffffffffffffb0
xor esi, esi
mov dword [rbp - 0x30], 0x657a5982
xor dword [rbp - 0x30], 0x1325f8f8
sub dword [rbp - 0x30], 0x5e67d571
xor dword [rbp - 0x30], 0x7fb35676
xor dword [rbp - 0x30], 0x68409a78
mov dword [rbp - 0x2c], 0x562b19e
xor dword [rbp - 0x2c], 0x53993ff7
sub dword [rbp - 0x2c], 0x1ae2209f
add dword [rbp - 0x2c], 0x717dd92
sub dword [rbp - 0x2c], 0x42c04a71
xchg r11, rbx
mov r11, rcx
xchg rbx, r11
mov dword [rbp - 0x28], 0x11ed8e1
xor dword [rbp - 0x28], 0x707068a3
sub dword [rbp - 0x28], 0xa13a784
sub dword [rbp - 0x28], 0x2d0ec222
sub dword [rbp - 0x28], 0x3a074639
mov dword [rbp - 0x24], 0xa93a8cb
xor dword [rbp - 0x24], 0x49d59b3c
add dword [rbp - 0x24], 0x253e2646
sub dword [rbp - 0x24], 0x683a5946
mov dword [rbp - 0x20], 0x1e282166
xor dword [rbp - 0x20], 0x4112acfb
sub dword [rbp - 0x20], 0x5bf6ad06
xor dword [rbp - 0x20], 0x358e0ab
xchg rsi, r12
mov qword [rbp + 0x10], r12
xchg rsi, r12
xchg r11, rax
mov r11, qword [rbp + 0x10]
xchg r11, rax
xchg rcx, r15
mov r15, qword [rbp + 0x10]
xchg rcx, r15
xchg r8, rax
mov r8, qword [rbp + 0x10]
xchg r8, rax
and cl, 3
shl cl, 2
shl cl, 1
movzx edx, word [rbp + rax*2 - 0x30]
mov eax, 0xf1c6aa4
add eax, 0x21689cc1
xor eax, 0x15bab2a8
add eax, 0x539279bb
sub eax, 0x49f8b838
shr eax, cl
movzx ecx, al
xchg rbx, rbx
mov rax, qword [rbp + 0x10]
xor cx, dx
mov word [rbp + rax*2 - 0x1c], cx
mov rdx, rdx
xchg r9, rax
mov r9, qword [rbp + 0x10]
xchg r9, rax
inc rax
mov r13, r13
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
cmp rax, 0xa
xchg r15, r15
jb 0x1400ae036
xor edx, edx
mov word [rbp - 8], si
lea rcx, [rbp - 0x1c]
xchg rdi, rdi
call fcn.140075150
mov r8, rax
xchg rsi, rax
mov qword [rbx + 0x200], rsi
xchg rsi, rax
xor eax, eax
xchg r15, r15
lea rdi, [rbp - 0x1c]
lea ecx, [rax + 0xa]
rep stosb byte [rdi], al
test r8, r8
mov dword [rsp - 0x14], 0x78c126fc
je 0x1400ae13a
lea rdx, [rbx + 0x208]
xchg rcx, r8
mov r8, rcx
xchg rcx, r8
call fcn.1400ae800
mov dword [rsp - 0x18], 0x37deb1d2
test al, al
jne 0x1400ae130
xchg rcx, rsi
mov rsi, qword [rbx + 0x200]
xchg rcx, rsi
call fcn.140077680
mov dword [rsp - 0x24], ebp
xor al, al
mov qword [rbx + 0x200], rsi
jmp 0x1400ae13a
mov al, 0x35
add al, 0x34
sub al, 0x5b
xor al, 0x5e
xor al, 0x51
mov rbx, qword [rsp + 0x68]
xchg rbx, rbx
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
neg rsp
add rsp, 0xffffffffffffffb0
neg rsp
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
Function at 0x1400ae5ec
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp - 0x3c], 0x54e37397
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x2f2c130
add rsp, 0x2f2bff0
xchg r8, rdi
mov r8, rdi
xchg r8, rdi
xchg rcx, rbx
mov rcx, rbx
xchg rcx, rbx
mov r8d, 0x5478fc58
sub r8d, 0xa156011
xor r8d, 0x210a8b7a
add r8d, 0x32ceacf
xor r8d, 0x6e96030c
lea rcx, [rsp + 0x40]
xor edx, edx
mov dword [rsp - 0x10], esi
call fcn.140080180
mov r10, qword [rbx + 0x238]
lea r8, [rsp + 0x40]
mov dword [rsp - 0x38], edx
mov edx, dword [rdi + 0x10]
movabs rcx, 0x74bd573831f6ece5
sub rcx, 0x151ee0fa
add rcx, 0x850dc6c
add rcx, 0x7fffffff
xor rcx, 0x2d779331
sub r10, rcx
mov dword [rsp + 0x30], 0xda41a3e
xor dword [rsp + 0x30], 0x11090fdd
add dword [rsp + 0x30], 0x5a93d0e6
sub dword [rsp + 0x30], 0x7740e6c7
and dword [rsp + 0x28], 0
mov dword [rsp - 0x30], 0x320163ee
movabs rcx, 0x1d166fd746683c6f
xor rcx, 0x18610d26
sub rcx, 0x44f1cae5
add rcx, 0x7600d739
and qword [rsp + 0x20], 0
mov r9d, 0x3382b153
add r9d, 0x48f2a832
xor r9d, 0x3b4c7f4e
sub r9d, 0x1fcb53d4
sub r9d, 0x276dd1f7
ror r10, 1
ror r10, 0x22
ror r10, 3
ror r10, 1
add r10, rcx
xchg rdx, rcx
mov rdx, qword [rdi + 0x20]
xchg rdx, rcx
not r10
mov dword [rsp - 0x24], esi
rol r10, 0xe
rol r10, 7
rol r10, 0x10
rol r10, 1
rol r10, 1
call r10
mov dword [rsp - 0x44], 0x6b2e2a5e
test eax, eax
jne 0x1400ae7e0
or eax, 0xffffffff
lea rbx, [rsp + 0x40]
xchg r12, r12
cmp byte [rsp + 0x40], 0
mov dword [rsp + 0x150], eax
je 0x1400ae7b0
xchg rbx, r14
mov rdx, r14
xchg r14, rbx
lea rcx, [rsp + 0x150]
mov r8d, 0x48f239b4
add r8d, 0x13a0e5b2
sub r8d, 0x465d39ad
xor r8d, 0x1635e5b8
inc rbx
call fcn.140078ce0
cmp byte [rbx], 0
mov dword [rsp - 0xc], esi
jne 0x1400ae768
mov eax, dword [rsp + 0x150]
not eax
xchg r15, r15
cmp eax, 0xa2ca6717
je 0x1400ae7d1
cmp eax, 0xd7b7e7a8
sete al
mov dword [rsp - 0x14], ecx
jmp 0x1400ae7e5
mov al, 0x74
sub al, 0x24
sub al, 0x40
add al, 0x1c
sub al, 0x2b
jmp 0x1400ae7e5
xor al, al
mov rbx, rbx
mov rbx, qword [rsp + 0x158]
sub rsp, 0xfffffffffffffec0
nop
mov rdi, qword [rsp]
add rsp, 8
ret

Function at 0x1400b2b40
Capabilities:
Encrypt data using curve25519

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov dword [rsp - 0x30], 0x4ad8e35
sub rsp, 0x3d79e5c4
add rsp, 0x3d79e504
xchg r13, rax
mov r13, r8
xchg r13, rax
xchg rdx, r13
mov rbx, r13
xchg r13, rdx
xchg rdx, r8
mov rdx, r8
xchg r8, rdx
xchg rcx, rdi
mov rcx, rdi
xchg rcx, rdi
mov edx, 0x6f82bfff
xor edx, 0xc154095
sub edx, 0x3ebfb66e
sub edx, 0x18cf87b2
sub edx, 0xc08c12a
xchg rsp, rax
mov rcx, rsp
xchg rsp, rax
call fcn.1400b33a0
movzx eax, byte [rbx + 0x1f]
lea rcx, [rsp + 0x20]
mov dword [rsp - 0x10], 0x27dfbd9b
and byte [rbx], 0xf8
and al, 0x3f
or al, 0x40
mov rdx, rbx
mov dword [rsp - 0x1c], 0x309040db
mov byte [rbx + 0x1f], al
call fcn.1400b6a00
lea rdx, [rsp + 0x20]
mov dword [rsp - 0x28], 0x47c0e550
xchg r13, rcx
mov r13, rdi
xchg r13, rcx
call fcn.1400b6920
xchg rdx, rbx
mov rdx, qword [rsp + 0xd0]
xchg rdx, rbx
sub rsp, 0xffffffffffffff40
mov dword [rsp - 0x20], ecx
pop rdi
ret
Function at 0x1400c8c10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp - 0x38], 0x856fe78
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
xchg r10, rsp
mov rbp, r10
xchg r10, rsp
neg rsp
sub rsp, 0xffffffffffffff80
neg rsp
xor esi, esi
xchg r9, r9
mov dword [rbp - 0x50], 0x75e6830c
add dword [rbp - 0x50], 0x5f5368a
sub dword [rbp - 0x50], 0x65605c0e
xor dword [rbp - 0x50], 0x6068023d
xor dword [rbp - 0x50], 0x76365fb5
mov dword [rbp - 0x4c], 0x80aeeae
add dword [rbp - 0x4c], 0x73a65f0
add dword [rbp - 0x4c], 0x324e405b
sub dword [rbp - 0x4c], 0x41269463
mov dword [rbp - 0x48], 0x5b00a0a0
xor dword [rbp - 0x48], 0x10f0071
xor dword [rbp - 0x48], 0x423e6e9b
xor dword [rbp - 0x48], 0x181ece5f
mov dword [rbp - 0x44], 0x613384fb
xor dword [rbp - 0x44], 0x5985cb09
add dword [rbp - 0x44], 0x463e2db5
xor dword [rbp - 0x44], 0x7e967d2e
xchg rsi, r9
mov qword [rbp + 0x10], r9
xchg rsi, r9
lea ebx, [rsi + 1]
xchg r15, rax
mov r15, qword [rbp + 0x10]
xchg r15, rax
xchg r8, rcx
mov r8, qword [rbp + 0x10]
xchg rcx, r8
mov rax, qword [rbp + 0x10]
and cl, 3
mov rbx, rbx
shl cl, 2
shl cl, 1
movzx edx, word [rbp + rax*2 - 0x50]
mov dword [rsp - 0x14], 0x3364f312
mov eax, 0x5e946de
add eax, 0x4e442515
xor eax, 0x72a00ec
add eax, 0x25c078fe
xor eax, 0x561e934d
shr eax, cl
mov dword [rsp - 0x2c], edx
movzx ecx, al
xchg r14, rax
mov r14, qword [rbp + 0x10]
xchg r14, rax
xor cx, dx
mov word [rbp + rax*2 - 0x20], cx
mov rdx, rdx
xchg rdi, rax
mov rdi, qword [rbp + 0x10]
xchg rdi, rax
add rax, rbx
xchg rdx, rax
mov qword [rbp + 0x10], rdx
xchg rdx, rax
mov rax, qword [rbp + 0x10]
mov dword [rsp - 0x10], edx
cmp rax, 8
jb 0x1400c8ccc
lea rax, [rbp - 0x20]
mov rsp, rsp
mov word [rbp - 0x10], si
xorps xmm0, xmm0
xchg r12, rax
mov qword [rbp - 0x38], r12
xchg r12, rax
lea r9, [rbp - 0x30]
mov dword [rbp - 0x40], 0x6d116954
sub dword [rbp - 0x40], 0x4c4d57b8
add dword [rbp - 0x40], 0x577b909b
sub dword [rbp - 0x40], 0x22ffd5db
xor dword [rbp - 0x40], 0x552dcc4c
lea r8, [rbp - 0x40]
mov dword [rsp + 0x20], esi
mov r13, r13
xor edx, edx
xor ecx, ecx
xchg rbp, rsi
movups xmmword [rsi - 0x30], xmm0
xchg rbp, rsi
call fcn.1400ce380
mov rdi, rax
xchg r11, r11
test rax, rax
je 0x1400c8ded
xchg rcx, rbx
mov rbx, rax
xchg rbx, rcx
call fcn.1400bfdcc
mov r12, r12
test al, al
je 0x1400c8ded
lea rdx, [rbp - 0x40]
xchg rcx, rdi
mov rdi, rcx
xchg rdi, rcx
call fcn.1400bec7c
mov dword [rsp - 0x18], ebx
test al, al
jne 0x1400c8df0
mov bl, sil
xor eax, eax
mov rdi, rdi
lea r11, [rsp + 0x80]
xchg r14, rsi
mov r14, qword [r11 + 0x20]
xchg rsi, r14
lea rdi, [rbp - 0x20]
lea ecx, [rax + 8]
mov rsi, rsi
rep stosb byte [rdi], al
xchg rcx, rdi
mov rcx, qword [r11 + 0x28]
xchg rdi, rcx
mov al, bl
mov rbx, qword [r11 + 0x18]
mov dword [rsp - 0x34], esp
mov rsp, r11
pop rbp
ret
Function at 0x1400ce380
Capabilities:
Execute syscall

Disassembly:
xchg r10, rdx
mov rdx, rcx
xchg rdx, r10
mov eax, dword [0x1400da104]
cmp qword [0x1400da118], 0
jne 0x14007e960
mov r9, r9
syscall
ret
jmp 0x14007f455
Function at 0x1400029d0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140003d40
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.140003d40
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x140002a40
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x1400080a4]
mov rbx, rcx
test esi, esi
jle 0x140002b70
mov rax, qword [0x1400080a8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x140002a8b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140002b15
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140002a70
mov rcx, rbx
call fcn.140003490
mov rdi, rax
test rax, rax
je 0x140002b92
mov rax, qword [0x1400080a8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.1400035d0
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1400080a8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140002b77
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140002b0e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140002b20
add dword [0x1400080a4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1400080a8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140002b0e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.1400029d0
nop dword [rax]
xor esi, esi
jmp 0x140002a98
mov rax, qword [0x1400080a8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.1400029d0
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.1400029d0
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140003100
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x140008100]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400080e0]
test rbx, rbx
je 0x14000315c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x140003153
test rsi, rsi
je 0x140003153
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140003138
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x140003490
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140005a70]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400034b0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400034b8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400034b0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14000350d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140003504
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400034b0
add rax, 0x28
cmp rax, r9
jne 0x1400034f0
xor eax, eax
ret

Function at 0x140003510
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140005a70]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14000352f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140003538
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14000352f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x1400035d0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140005a70]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x1400035ef
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x1400035f8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x140027de0
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001b784
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001b784
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140027f30
cmp rax, 0xffffffffffffffff
je 0x140027f30
xor edi, edi
test rbp, rbp
jle 0x140027edb
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001dd70
mov rbx, rax
test rax, rax
jne 0x140027e68
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140027ed1
mov edx, 0x8000
mov ecx, r14d
call fcn.140015928
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001c460
cmp eax, 0xffffffff
je 0x140027eb1
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140027e78
mov edx, r15d
mov ecx, r14d
call fcn.140015928
jmp 0x140027ed1
cmp byte [rsi + 0x38], dil
je 0x140027ec8
cmp dword [rsi + 0x34], 5
jne 0x140027ec8
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140027ed1
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.140019e48
jmp 0x140027f44
jns 0x140027f44
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001b784
cmp rax, 0xffffffffffffffff
jne 0x140027efc
cmp byte [rsi + 0x30], dil
je 0x140027f44
mov edi, dword [rsi + 0x2c]
jmp 0x140027f44
mov ecx, r14d
call fcn.140016f28
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140027f44
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140027f44
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140027f3d
mov eax, dword [rsi + 0x2c]
jmp 0x140027f42
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001b784
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x1401ea55d
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
inc dword [0x1400a4008]
pushfq
call 0x1401e12a0
cmp dword [0x1400a4008], 0
jmp 0x1401e4469
pop word [rsp + 0xa]
lea rsp, [rsp + 0xe]
mov word [rsp + 1], r15w
jmp 0x1401e4490
push r13
push qword [rsp + 1]
mov qword [rsp + 1], r15
push qword [rsp + 4]
jmp 0x1401e4438
je 0x1401e12b6
lea rsp, [rsp + 0x10]
add rsp, 8
jmp 0x1401e444e
call 0x1401ea00d
jmp 0x1401ea57a
mov qword [rsp + 7], r14
lea rsp, [rsp + 1]
lea rsp, [rsp + 0x18]
jmp 0x1401ea601
pop qword [rsp + 0x10]
jmp 0x1401ea547
pop rax
sub rax, 0x1ea00d
push rax
jmp 0x1401e132b
mov rax, qword [rax + riz]
mov rax, qword [rax + riz + 0x10]
push rax
jmp 0x1401ea008
mov rax, qword gs:[0x60]
mov rax, qword [rax + riz + 0x18]
mov rax, qword [rax + riz + 0x30]
jmp 0x1401ea5b5
Function at 0x14017d6a2
Capabilities:
Execute anti-debugging instructions

Disassembly:
stc
lea rsp, [rsp + 2]
lea rsp, [rsp + 0x30]
jmp 0x14017d68c

Function at 0x14017d8d3
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsf bp, cx
mov r11d, ebx
sub rsp, 2
cpuid
jmp 0x14017d8fe
mov r10w, word [rsp + 5]
inc si
add rsp, 0
xchg dx, ax
mov qword [rsp], rbx
jmp 0x14017d8bd
mov r11b, 0xcd
cmc
setb al
mov r8, 0x120d1ce5
rdtsc
jmp 0x14017d986
sub rsp, 0x10
sub bl, al
mov word [rsp + 5], r10w
clc
lea rsp, [rsp + 2]
mov qword [rsp + 7], r13
jmp 0x14017d8e8
pop r12w
xchg byte [rsp + 1], r12b
mov r11b, r10b
xchg byte [rsp + 1], sil
mov r12, 0xffffffff8caa39ca
shr edx, cl
jmp 0x14017d930
bswap r11
mov r15, qword [rsp]
bsf r13w, r10w
not ax
pushfq
not bx
jmp 0x14017d946

Function at 0x14017df09
Capabilities:
Execute anti-debugging instructions

Disassembly:
add rsp, 9
xchg qword [rsp + 0xb], r10
mov rax, 0x3cb5569e
sub rsp, 0x11
mov eax, dword [rsp + 0x25]
neg r14
jmp 0x14017ded7
lea r15, [rax + riz - 0x92]
pop word [rsp + 0x1a]
bswap r15d
rdtsc
pop rcx
mov r10, rbp
jmp 0x14017de86
xchg qword [rsp + 0x10], rbx
mov byte [rsp + 2], r12b
jmp 0x14017df62
lea r13, [r8 + riz + 0x57d03082]
xchg bx, r14w
not r8d
dec r8w
mov r14b, 0xe6
mov dword [rsp + 1], r13d
jmp 0x14017dec1
jmp 0x14017dea9
mov r13w, bp
clc
call fcn.14017df0b
mov rbp, qword [rsp + 0xd]
cpuid
bsr rcx, rax
xchg byte [rsp + 0xb], dl
bswap r10
xchg rcx, r15
jmp 0x14017df97
lea r10, [r12 + 0x6a4f7ede]
xchg byte [rsp + 0x26], cl
mov qword [rsp + 9], r15
rdtsc
push word [rsp + 9]
mov dword [rsp + 0xe], r15d
jmp 0x14017df2e
cmc
mov r8b, 0xc7
xchg bp, cx
call fcn.14017dfdd
stosd dword [rdi], eax
sub eax, 0xdb37c4bd
mov esp, 0x4e81168f
lea ecx, [rbx*4]
lea r9, [r11*4]
pop r15
add rsp, 0xb
lea r9, [r11 + riz - 0xb1]
mov byte [rsp + 0x13], sil
pop bx
jmp 0x14017df81
Function at 0x14017ec48
Capabilities:
Execute anti-debugging instructions

Disassembly:
add rsp, 0x1a
mov r9, rcx
mov eax, ecx
jmp 0x14017ecac
pop word [rsp + 2]
lea rdx, [rax + r15]
lea rcx, [r14 + rbp]
jmp 0x14017edae
sub rsp, 0x11
lea rsp, [rsp + 0xf]
xchg word [rsp + 0xb], ax
lea rbp, [rcx + rsi]
xchg dword [rsp + 8], r8d
mov ebx, dword [rsp + 8]
jmp 0x14017ec96
xchg word [rsp + 1], cx
stc
lea r11, [rbp + riz]
mov dword [rsp], r13d
jmp 0x14017ed7d
add rsp, 5
mov r14b, byte [rsp + 5]
xchg r15w, r11w
mov r13w, 0x1446
rcl r9b, cl
mov r13w, word [rsp + 2]
jmp 0x14017ece7
xchg qword [rsp + 7], rcx
lea r11, [rdx + riz - 0x3ae0]
mov r12b, byte [rsp + 1]
lea r12, [rbx + riz - 0x7a]
bswap rsi
jmp 0x14017ed55
setne r14b
xchg dword [rsp], edx
xchg rsi, rbp
not r14w
sub rsp, 0x12
xchg r10, rbp
jmp 0x14017ed1a
lea rcx, [rbx + riz + 0x25cf33fe]
bsr r10, rdi
mov r12w, r14w
mov byte [rsp + 0xf], bl
mov sil, r13b
mov esi, 0xbbc2d89d
jmp 0x14017ed96
add rsp, 5
dec rax
mov byte [rsp], r12b
push r9w
lea r12, [r8 + riz]
mov r14w, r9w
jmp 0x14017ed3e
xchg ecx, r13d
rdtsc
xchg word [rsp + 9], dx
xchg word [rsp + 7], r14w
jmp 0x14017edc8
pop word [rsp + 3]
mov r8b, cl
xchg esi, ecx
xchg dword [rsp + 1], r13d
mov cl, 0x33
lea r15, [r8 + r8]
jmp 0x14017ecfd
sub rsp, 6
xchg byte [rsp + 0xa], r10b
lea r8, [r15 + riz + 0xde]
mov ebp, r10d
lea r8, [rdi + r13]
std
jmp 0x14017efb7
mov si, word [rsp]
mov edx, dword [rsp]
mov rbp, r11
mov rbx, qword [rsp + 0x30]
jmp 0x14017ee4c
mov al, byte [rsp]
push r8
mov r13, qword [rsp + 0x27]
mov dl, 0x2f
inc r9d
mov cl, 0x89
jmp 0x14017ee0d
mov r11, qword [rsp + 0x38]
xchg r15d, r8d
lea rdx, [rcx + r13]
xchg r14d, ebp
jmp 0x14017eeac
mov eax, 0x4db85fb1
bsf rbp, r13
mov al, 0x2c
stc
bts dx, bp
bts r12, rdi
jmp 0x14017ee36
xchg r11, r9
bswap r8
cpuid
lea rdx, [rdx*8]
lea rsi, [rdx + riz + 0x3c86]
neg r9d
jmp 0x14017ee23
mov rcx, qword [rsp + 0x45]
mov rsi, rbp
xchg r8d, eax
mov r14d, 0x498a9632
jmp 0x14017eedb
bswap r14
mov r14d, dword [rsp]
mov r9, 0xffffffff8a89229c
mov r15b, 0xdd
mov r15d, r10d
inc r10d
jmp 0x14017ee92
mov r10d, 0xc64b1781
mov dx, bp
shr r15, 0x1e
jmp 0x14017ef0d
rcr rsi, 0x3c
mov r8, r10
dec r14d
mov rbp, qword [rsp + 0x58]
lea r9, [r10 + riz + 0x7331c013]
mov r15, r13
jmp 0x14017eec5
stc
rdtsc
lea rdx, [r11 + r14]
mov r8, qword [rsp + 0x68]
cld
jmp 0x14017ef20
mov r10, qword [rsp + 0x60]
bswap r15
xchg r8, r15
bswap rdx
stc
mov dl, 0xc3
jmp 0x14017eef7
mov r14w, word [rsp]
call fcn.14017ef76
invalid
lea r9, [r14*8]
mov rsi, qword [rsp + 8]
push word [rsp + 0xd]
not rbp
setle r10b
mov r15d, dword [rsp + 3]
jmp 0x14017ee75
pop word [rsp + 2]
mov word [rsp + 0xb], cx
lea rsp, [rsp + 2]
pop word [rsp + 0xa]
not rbp
xchg edx, eax
jmp 0x14017ef36
Function at 0x14017fe13
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
call fcn.14017f03a
pop word [rsp + 0x14]
lea rsp, [rsp + 5]
lea rsp, [rsp + 0x30]
jmp 0x14017fe30
push ax
pop word [rsp + 0xb]
pop qword [rsp + 0x13]
mov qword [rsp + 0xa], r14
mov qword [rsp + 2], r10
push r13
jmp 0x14017fdd7
mov qword [rsp + 5], rsp
jmp 0x14017fded
mov rax, qword [rax + riz]
jmp 0x14017ff73
mov rax, qword gs:[0x60]
mov rax, qword [rax + riz + 0x18]
mov rax, qword [rax + riz + 0x30]
jmp 0x14017fe1a
mov rax, qword [rax + riz + 0x10]
push rax
jmp 0x14017f035