joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400446d0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
mov edx, 0x10
call qword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
je 0x14004470f
mov rax, qword [rbp - 0x20]
add rsp, 0x80
pop rbp
ret
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x30], rax
lea rax, [0x140032000]
mov qword [rbp - 0x28], rax
lea rax, [0x14006b6f8]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 1
mov qword [rbp - 0x40], 0
lea rax, [rbp - 0x30]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 1
lea rdx, str.library_std_src_syswindows_rand.rs
lea rcx, [rbp - 0x60]
call fcn.14005cd00
ud2

Function at 0x140046dc0
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
cmp qword [rdx], 0
jne 0x140046f0e
mov rsi, rcx
mov rbx, qword [rdi + 0x18]
mov rax, qword [rbx + 8]
test rax, rax
jne 0x140046df8
mov rdx, qword [rbx + 0x10]
lea rax, [rdx + 0xf]
cmp rax, 0xf
jbe 0x140046ef7
xor eax, eax
mov rdx, qword [rbx + 0x10]
cmp rax, rdx
je 0x140046ed9
sub rax, rdx
add rdx, qword [rbx]
mov r8, qword [rdi + 0x10]
mov ecx, 0xffffffff
cmp rax, rcx
cmovae rax, rcx
mov dword [rsp + 0x2c], 0
mov rcx, qword [rdi + 0x20]
mov qword [rsp + 0x20], r8
lea r9, [rsp + 0x2c]
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140046e5b
mov ecx, dword [rsp + 0x2c]
mov eax, 2
test rcx, rcx
je 0x140046e83
mov qword [rdi], rax
mov qword [rdi + 8], rcx
mov byte [rsi + 1], 1
xor eax, eax
jmp 0x140046ec5
call sub.KERNEL32.dll_GetLastError
mov rcx, rax
shl rcx, 0x20
or rcx, 2
mov qword [rsp + 0x40], rcx
cmp eax, 0x6d
je 0x140046e8b
cmp eax, 0x3e5
jne 0x140046ebf
lea rax, [rsp + 0x30]
jmp 0x140046e99
mov byte [rsi + 1], 0
xor eax, eax
jmp 0x140046ec5
mov qword [rsp + 0x30], 1
lea rax, [rsp + 0x38]
mov qword [rax], 0
lea rcx, [rsp + 0x40]
call fcn.14002b4a0
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
test rax, rax
je 0x140046ecf
cmp rax, 1
je 0x140046e42
mov qword [rsi + 8], rcx
mov al, 1
mov byte [rsi], al
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
mov eax, 1
jmp 0x140046e4c
mov r8d, 1
mov rcx, rbx
mov rdx, rax
call fcn.14005dd90
mov rax, qword [rbx + 8]
mov rdx, qword [rbx + 0x10]
jmp 0x140046e05
mov r8d, 0x10
mov rcx, rbx
call fcn.14005dd90
mov rax, qword [rbx + 8]
jmp 0x140046df8
mov qword [rsp + 0x40], 0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.14005e080
ud2

Function at 0x140053754
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140053580
Function at 0x10005c88c
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
push r13
sub rsp, 0xb0
xor ebx, ebx
mov dword [rsp + 0x20], ebx
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
mov r12d, ebx
xor eax, eax
lock cmpxchg qword [0x100082b00], rdi
je 0x10005c8ec
cmp rax, rdi
jne 0x10005c8df
mov r12d, 1
jmp 0x10005c8ec
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10005c8c5
mov eax, dword [0x100082af8]
cmp eax, 1
jne 0x10005c901
lea ecx, [rax + 0x1e]
call fcn.10018e000
jmp 0x10005c968
mov eax, dword [0x100082af8]
cmp eax, ebx
jne 0x10005c95e
mov dword [0x100082af8], 1
lea r13, [0x100001cb0]
lea rdi, [0x100001c98]
mov qword [rsp + 0x30], rdi
mov eax, ebx
mov dword [rsp + 0x24], ebx
cmp rdi, r13
jae 0x10005c950
cmp eax, ebx
jne 0x10005c950
mov rcx, qword [rdi]
cmp rcx, rbx
je 0x10005c945
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x10005c92e
cmp eax, ebx
je 0x10005c968
mov eax, 0xff
jmp 0x10005cab0
mov dword [0x100081a4c], 1
mov eax, dword [0x100082af8]
cmp eax, 1
jne 0x10005c990
lea rdx, [0x100001c90]
lea rcx, [0x100001b90]
call sub.msvcrt.dll__initterm
mov dword [0x100082af8], 2
cmp r12d, ebx
jne 0x10005c99f
mov rax, rbx
xchg qword [0x100082b00], rax
cmp qword [0x100082b18], rbx
je 0x10005c9c7
lea rcx, [0x100082b18]
call fcn.10005d32c
cmp eax, ebx
je 0x10005c9c7
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x100082b18]
mov rcx, qword [sym.imp.msvcrt.dll__wcmdln]
cmp qword [rcx], rbx
jne 0x10005c9dd
mov eax, 0xff
jmp 0x10005cab0
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
cmp word [rcx], 0x20
ja 0x10005ca62
cmp word [rcx], bx
je 0x10005c9f8
cmp edx, ebx
jne 0x10005ca62
cmp word [rcx], bx
je 0x10005ca0e
cmp word [rcx], 0x20
ja 0x10005ca0e
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x10005c9f8
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x100000000]
call fcn.100018f40
mov dword [0x100081a48], eax
cmp dword [0x100081a2c], ebx
jne 0x10005ca4c
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x100081a4c], ebx
jne 0x10005ca60
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x100081a48]
jmp 0x10005cab0
cmp word [rcx], 0x22
jne 0x10005ca75
mov eax, ebx
cmp edx, ebx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x10005c9e9
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r12, qword [r11 + 0x20]
mov rsp, r11
pop r13
ret
sub rsp, 0x28
call fcn.10005d440
add rsp, 0x28
jmp 0x10005c88c
Function at 0x34bfd6512
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp - 8], 0
cmp qword [rbp + 0x18], 0
je 0x34bfd6542
mov rax, qword [rbp + 0x18]
mov rcx, rax
call sym.nimCStrLen_1
mov rcx, rax
jmp 0x34bfd6547
mov ecx, 0
mov rdx, qword [rbp + 0x10]
mov rax, qword [rbp + 0x18]
mov r9, rdx
mov r8, rcx
mov edx, 1
mov rcx, rax
call sym.fwrite
mov qword [rbp - 8], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp + 0x10]
mov rcx, rax
call sym.fflush
mov dword [rbp - 0xc], eax
nop
add rsp, 0x30
pop rbp
ret

Function at 0x34bfdd4d5
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp - 8], 0
mov rdx, qword [rbp + 0x20]
mov rcx, qword [rbp + 0x10]
mov rax, qword [rbp + 0x18]
mov r9, rcx
mov r8, rdx
mov edx, 1
mov rcx, rax
call sym.fwrite
mov qword [rbp - 8], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp + 0x10]
mov rcx, rax
call sym.fflush
mov dword [rbp - 0xc], eax
nop
add rsp, 0x30
pop rbp
ret
Function at 0x34bfe0b9d
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xa0
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
lea rax, str.echoBinSafe
mov qword [rbp - 0x58], rax
lea rax, [0x34bff7f68]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], 0
mov word [rbp - 0x40], 0
lea rax, [rbp - 0x60]
mov rcx, rax
call sym.nimFrame_6
call sym.nimErrorFlag_4
mov qword [rbp - 0x10], rax
mov qword [rbp - 0x50], 0xac5
lea rax, [0x34c000080]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov qword [rbp - 0x18], 0
mov qword [rbp - 0x50], 0xd
lea rax, [0x34bff87d8]
mov qword [rbp - 0x48], rax
mov qword [rbp - 8], 0
mov qword [rbp - 0x50], 0xe
mov rax, qword [rbp - 8]
cmp rax, qword [rbp + 0x18]
jge 0x34bfe0d2a
mov qword [rbp - 0x50], 0xac6
lea rax, [0x34bff7f68]
mov qword [rbp - 0x48], rax
cmp qword [rbp - 8], 0
js 0x34bfe0c61
mov rax, qword [rbp - 8]
cmp rax, qword [rbp + 0x18]
jl 0x34bfe0c7a
mov rax, qword [rbp + 0x18]
lea rdx, [rax - 1]
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.raiseIndexError2
jmp 0x34bfe0dbb
mov rax, qword [rbp - 8]
shl rax, 4
mov rdx, rax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov ecx, 1
mov rax, qword [sym.__acrt_iob_func]
call rax
mov rcx, rax
mov rax, qword [rbp - 0x18]
mov rdx, qword [rax + 8]
mov rax, qword [rax]
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rdx
lea rax, [rbp - 0x80]
mov r8d, 0
mov rdx, rax
call sym.writeWindows__system_u9025
mov rax, qword [rbp - 0x10]
movzx eax, byte [rax]
movzx eax, al
test eax, eax
jne 0x34bfe0dba
mov qword [rbp - 0x50], 0x10
lea rax, [0x34bff87d8]
mov qword [rbp - 0x48], rax
mov edx, 0
mov rax, qword [rbp - 8]
add rax, 1
jno 0x34bfe0cff
mov edx, 1
mov rcx, rax
lea rax, [rbp - 0x68]
mov qword [rax], rcx
mov rax, rdx
and eax, 1
test al, al
je 0x34bfe0d1d
call sym.raiseOverflow
jmp 0x34bfe0dbb
mov rax, qword [rbp - 0x68]
mov qword [rbp - 8], rax
jmp 0x34bfe0c2f
nop
mov qword [rbp - 0x50], 0xae1
lea rax, [0x34bff7f68]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x20], 0
mov ecx, 1
mov rax, qword [sym.__acrt_iob_func]
call rax
mov r9, rax
mov r8d, 1
mov edx, 1
lea rax, [0x34bff8779]
mov rcx, rax
call sym.fwrite
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x50], 0xae2
mov dword [rbp - 0x24], 0
mov ecx, 1
mov rax, qword [sym.__acrt_iob_func]
call rax
mov rcx, rax
call sym.fflush
mov dword [rbp - 0x24], eax
mov qword [rbp - 0x50], 0xae6
lea rax, [0x34c000080]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x34bfe0dbb
nop
call sym.popFrame_6
nop
add rsp, 0xa0
pop rbp
ret

Function at 0x34bfefc00
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop dword [rax]
Function at 0x34bfefc70
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x34c000444]
test esi, esi
mov rbx, rcx
jle 0x34bfefda0
mov rax, qword [0x34c000448]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x34bfefcbb
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x34bfefd45
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x34bfefca0
mov rcx, rbx
call sym.__mingw_GetSectionForAddress
test rax, rax
mov rdi, rax
je 0x34bfefdc2
mov rax, qword [0x34c000448]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call sym._GetPEImageBase
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x34c000448]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x34bfefda7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x34bfefd3e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x34bfefd50
add dword [0x34c000444], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov r8d, 0x40
mov eax, 4
mov rcx, qword [rsp + 0x20]
cmove r8d, eax
mov rdx, qword [rsp + 0x38]
add rbx, qword [0x34c000448]
mov r9, rbx
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x34bfefd3e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
nop dword [rax]
xor esi, esi
jmp 0x34bfefcc8
mov rax, qword [0x34c000448]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [rdi + 8]
mov r8, qword [rax + rbx + 0x18]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call sym.__report_error
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x34bff0140
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x34c000480]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x34c000460]
test rbx, rbx
je 0x34bff019c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x34bff0193
test rsi, rsi
je 0x34bff0193
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x34bff0178
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x34bff03b0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [sym.imp.msvcrt.dll_exit]
call qword [rax]
nop
nop

Function at 0x34bff03c0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [sym.imp.msvcrt.dll__exit]
call qword [rax]
nop
nop
nop
Function at 0x34bff03d0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x34bff03e8
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x34bff03f0
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x34bff0400
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx r8d, word [rcx + 6]
movzx eax, word [rcx + 0x14]
test r8w, r8w
lea rax, [rcx + rax + 0x18]
je 0x34bff044d
lea ecx, [r8 - 1]
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rdx, r8
mov rcx, r8
jb 0x34bff0444
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x34bff044f
add rax, 0x28
cmp rax, r9
jne 0x34bff0430
xor eax, eax
ret

Function at 0x34bff0450
Capabilities:
Parse pe header

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
call sym.strlen
cmp rax, 8
ja 0x34bff04e0
mov rdx, qword [0x34bffb0a0]
xor ebx, ebx
cmp word [rdx], 0x5a4d
jne 0x34bff04ce
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x34bff04ce
cmp word [rax + 0x18], 0x20b
jne 0x34bff04ce
movzx edx, word [rax + 0x14]
lea rbx, [rax + rdx + 0x18]
movzx edx, word [rax + 6]
test dx, dx
je 0x34bff04e0
lea eax, [rdx - 1]
lea rax, [rax + rax*4]
lea rdi, [rbx + rax*8 + 0x28]
jmp 0x34bff04b9
add rbx, 0x28
cmp rbx, rdi
je 0x34bff04e0
mov r8d, 8
mov rdx, rsi
mov rcx, rbx
call sym.strncmp
test eax, eax
jne 0x34bff04b0
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor ebx, ebx
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x34bff04f0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x34bffb0a0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x34bff0510
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x34bff0518
ret
cmp word [r8 + 0x18], 0x20b
jne 0x34bff0510
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x34bff056d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x34bff0564
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x34bff0510
add rax, 0x28
cmp rax, r9
jne 0x34bff0550
xor eax, eax
ret

Function at 0x34bff0570
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x34bffb0a0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x34bff058f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x34bff0598
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x34bff058f
movzx ecx, word [rax + 6]
mov eax, ecx
ret
Function at 0x34bff05b0
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x34bffb0a0]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x34bff05d0
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x34bff05d8
ret
cmp word [rdx + 0x18], 0x20b
jne 0x34bff05d0
movzx r8d, word [rdx + 6]
movzx eax, word [rdx + 0x14]
test r8w, r8w
lea rax, [rdx + rax + 0x18]
je 0x34bff0620
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x34bff0617
test rcx, rcx
je 0x34bff05d0
sub rcx, 1
add rax, 0x28
cmp rax, rdx
jne 0x34bff0608
xor eax, eax
ret

Function at 0x34bff0630
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x34bffb0a0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x34bff064f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x34bff0658
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x34bff0670
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x34bffb0a0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x34bff0690
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x34bff0698
ret
cmp word [r8 + 0x18], 0x20b
jne 0x34bff0690
movzx r9d, word [r8 + 6]
sub rcx, rdx
movzx edx, word [r8 + 0x14]
test r9w, r9w
lea rdx, [r8 + rdx + 0x18]
je 0x34bff0690
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x34bff06e4
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x34bff06f0
add rdx, 0x28
cmp r9, rdx
jne 0x34bff06d0
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x34bff0700
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x34bffb0a0]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x34bff0722
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x34bff0730
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x34bff0722
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x34bff0722
movzx r10d, word [r8 + 6]
movzx edx, word [r8 + 0x14]
test r10w, r10w
lea rdx, [r8 + rdx + 0x18]
je 0x34bff0722
lea r8d, [r10 - 1]
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop word cs:[rax + rax]
mov r9d, dword [rdx + 0xc]
cmp rax, r9
mov r8, r9
jb 0x34bff0785
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x34bff0798
add rdx, 0x28
cmp rdx, r10
jne 0x34bff0770
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x34bff07a7
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x34bff07b7
mov edx, dword [rax + 0xc]
test edx, edx
je 0x34bff078e
test ecx, ecx
jg 0x34bff07a0
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x140005870
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
xchg rbp, rbp
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov dword [rsp - 0x14], 0x7f53d077
sub rsp, 0x40
mov rsi, qword [rdx + 8]
lea r14, [rdx + 8]
mov r9, r9
mov rdi, rdx
mov r15, rcx
cmp rsi, 4
jbe 0x1400058b7
mov dword [rsp - 0x10], edx
mov rdi, qword [rdx]
lea rcx, [rsi + 1]
mov eax, 0x7bec9e9
mov dword [rsp - 0x44], edx
xor eax, 0x262ec381
add eax, 0xb8cd406
xor eax, 0xa8d39b1
add eax, 0x50f76853
xchg r14, r14
xor eax, 0xa212543
xor eax, 0x72a87573
mul rcx
mov r14, r14
pushf
movabs rcx, 0xffffffff6a8e7100
sub rcx, 0x1d3099bf
mov dword [rsp - 0x20], esi
sub rcx, 0x352df2e4
add rcx, 0x2943508a
xor rcx, 0xd120c30
xchg rsp, rsp
add rcx, 0x2255d2c4
add rcx, 0x7fffffff
xor rcx, 0x1148f465
popf
mov dword [rsp - 0x38], 0x71ef0335
cmovo rax, rcx
mov rcx, rax
call fcn.140072200
mov r8, r8
xor r12d, r12d
mov rbx, rax
mov r9d, r12d
test rsi, rsi
mov dword [rsp - 0x14], ebx
je 0x1400059cb
sub rdi, rax
movzx ecx, r9b
lea rax, [rax + 2]
mov dword [rsp - 0x28], 0xe3240dc
and cl, 3
mov r8d, 0x3f62876f
add r8d, 0x2fa080e3
mov dword [rsp - 0x1c], 0x54204b77
add r8d, 0x478523f
sub r8d, 0x4cfbdba4
sub r8d, 0x128f969e
add r8d, 0x3d317616
mov dword [rsp - 0x18], 0x5ba63e04
shl cl, 3
inc r9
sar r8d, cl
movsx ecx, r8b
mov dword [rsp - 0x1c], esp
xor cx, word [rdi + rax - 2]
mov word [rax - 2], cx
cmp r9, rsi
jb 0x14000595d
mov r12, r12
mov word [rbx + rsi*2], r12w
mov r8, rbx
mov rax, qword [0x1400a2ec0]
mov dword [rsp - 0x24], edx
xor edx, edx
mov r14d, dword [r14]
mov ecx, 0x6ba3562d
sub ecx, 0x2d86d95d
mov dword [rsp - 0x2c], ebp
sub ecx, 0x17ea5404
sub ecx, 0x1f341bd1
add ecx, 0x32c83b1d
sub ecx, 0x39c54a2f
mov dword [rsp - 0x24], ebp
xor rax, qword [0x1400a2a90]
mov r9d, r14d
mov qword [rsp + 0x38], r12
mov dword [rsp - 0x20], ebp
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call rax
mov rdi, rdi
movsxd rbp, eax
lea edi, [rbp + 1]
movsxd rcx, edi
call fcn.140072200
xchg rcx, rcx
mov r10, qword [0x1400a2ec0]
mov r9d, r14d
xor r10, qword [0x1400a2a90]
mov dword [rsp - 0x30], ebp
mov r8, rbx
mov qword [rsp + 0x38], r12
xor edx, edx
xchg r12, r12
mov qword [rsp + 0x30], r12
mov ecx, 0x1feb77b
xor ecx, 0x7a7a73da
mov dword [rsp - 0x3c], 0x7a8338f1
sub ecx, 0x24080739
sub ecx, 0x47d99d93
xor ecx, 0x6af7ed45
mov dword [rsp - 0x28], esi
sub ecx, 0x6553f4a7
mov dword [rsp + 0x28], edi
mov rsi, rax
xchg r12, r12
mov qword [rsp + 0x20], rax
call r10
mov byte [rbp + rsi], r12b
mov r14, r14
mov rcx, rbx
mov qword [r15], rsi
call fcn.140072210
mov rbx, qword [rsp + 0x60]
mov dword [rsp - 0x1c], esi
mov rax, r15
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
mov r8, r8
mov byte [r15 + 8], 0x66
xor byte [r15 + 8], 0x22
xor byte [r15 + 8], 0x36
sub byte [r15 + 8], 0x4c
mov rbp, rbp
xor byte [r15 + 8], 0x64
sub byte [r15 + 8], 0x41
add rsp, 0x40
pop r15
mov rdi, rdi
pop r14
pop r12
ret
Function at 0x140013680
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov dword [rsp - 0x10], esi
push r14
push r15
sub rsp, 0x20
mov r8, qword [rdx + 8]
mov rsi, rsi
lea r15, [rdx + 8]
inc r8
mov rdi, rdx
mov dword [rsp - 0x3c], esp
mov r14, rcx
mov eax, 0x7256c9c8
xor eax, 0x21fa691b
sub eax, 0x1e47fc4
mov dword [rsp - 0x2c], 0x7be39056
sub eax, 0x4a574e13
sub eax, 0x770d2fa
mul r8
mov rcx, rcx
pushf
movabs rbx, 0xffffffff30c22f08
add rbx, 0x2a127ebd
xchg r9, r9
sub rbx, 0x1ed1a2d8
xor rbx, 0x718fc222
add rbx, 0x7fffffff
add rbx, 0x32733731
mov rdi, rdi
popf
cmovo rax, rbx
mov rcx, rax
mov dword [rsp - 0x34], ebx
call fcn.140072200
mov rsi, qword [r15]
mov rbp, rax
mov dword [rsp - 0x20], 0x6dfa1d28
cmp rsi, 4
jbe 0x14001373c
mov rdi, qword [rdi]
xchg r14, r14
lea rcx, [rsi + 1]
mov eax, 0x44d0807e
sub eax, 0x3aa7d271
mov r11, r11
add eax, 0xf03abc5
add eax, 0x3f80c5b
xor eax, 0x7d9d8545
xor eax, 0x52f6981e
xchg r8, r8
xor eax, 0x324f7b74
mul rcx
cmovo rax, rbx
mov rcx, rax
mov r8, r8
call fcn.140072200
xor r9d, r9d
mov rbx, rax
mov r8d, r9d
mov dword [rsp - 0x3c], edi
test rsi, rsi
je 0x1400137f3
mov rdx, rax
mov dword [rsp - 0x1c], 0x3dcdf439
sub rdi, rax
nop
movzx ecx, r8b
lea rdx, [rdx + 2]
mov dword [rsp - 0x38], 0x75feaca3
and cl, 3
mov eax, 0x2c016be6
add eax, 0x2fccb151
add eax, 0x15335ae0
xchg rsp, rsp
add eax, 0xc00dbe
sub eax, 0x1d361cff
sub eax, 0x36a0a71
mov dword [rsp - 0x44], edx
shl cl, 3
inc r8
sar eax, cl
xchg rsi, rsi
movsx eax, al
xor ax, word [rdi + rdx - 2]
mov word [rdx - 2], ax
mov rdx, rdx
cmp r8, rsi
jb 0x14001379c
mov word [rbx + rsi*2], r9w
mov r8, rbx
mov dword [rsp - 0x14], esi
mov rdx, qword [r15]
mov rcx, rbp
inc rdx
mov dword [rsp - 0x3c], esp
call fcn.140072ae0
mov rcx, rbx
call fcn.140072210
mov rsi, rsi
mov rbx, qword [rsp + 0x40]
mov rax, r14
mov rsi, qword [rsp + 0x50]
mov qword [r14], rbp
mov dword [rsp - 0x20], ebp
mov rbp, qword [rsp + 0x48]
mov byte [r14 + 8], 0xe
add byte [r14 + 8], 0xe
mov dword [rsp - 0x24], 0x65b85ad5
add byte [r14 + 8], 0x45
add byte [r14 + 8], 4
add byte [r14 + 8], 7
sub byte [r14 + 8], 0x6b
mov dword [rsp - 0x14], edi
add rsp, 0x20
pop r15
pop r14
pop rdi
mov dword [rsp - 0x1c], esp
ret
Function at 0x14002efd0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1400a3170]
mov r14, r14
lea rcx, [rsp + 0x20]
xor rax, qword [0x1400a2a90]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp - 0x14], 0x74cf1be0
xor edx, edx
call rax
test eax, eax
xchg rsi, rsi
je 0x14002f06e
nop word [rax + rax]
mov rax, qword [0x1400a3190]
mov dword [rsp - 0x40], ebx
lea rcx, [rsp + 0x20]
xor rax, qword [0x1400a2a90]
call rax
mov rax, qword [0x1400a31a0]
mov dword [rsp - 0xc], 0x62d0c517
lea rcx, [rsp + 0x20]
xor rax, qword [0x1400a2a90]
call rax
mov r10, r10
mov rax, qword [0x1400a3170]
lea rcx, [rsp + 0x20]
xor rax, qword [0x1400a2a90]
xchg r8, r8
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call rax
mov rsi, rsi
test eax, eax
jne 0x14002f00e
add rsp, 0x58
mov dword [rsp - 0x14], 0x44d89642
ret