joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1079fa0
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec edx
ror edx, 1
cmp rax, 0x4c4850a9
not edx
test eax, ecx
push r10
xor dword [rsp], edx
pop r10
test rbx, 0x2dc1dae
test r12b, r12b
movsxd rdx, edx
add rbx, rdx
jmp 0x10fa6a0
bswap edx
jmp 0x1042e87
push r11
push rcx
bswap r11
movsx r11w, r10b
push rsi
bswap r11w
movsx r11d, r12w
not r11b
push rdi
movsx r11w, dil
xchg r11b, r11b
push rbp
movsxd r11, r10d
push r12
movzx r11, r9w
movsx r11, r11w
movsx r11d, r9w
push r10
push r13
movzx r11, r14w
movsx r11w, dl
not r11b
push r14
movzx r10, bx
mov r10b, 0xf9
push r15
bswap r10d
jmp 0x110277f
push rbx
ret
push rbx
movzx r11, dx
push rdx
cwd
xchg dl, r11b
push r9
push r8
pushfq
push rax
not r10b
movabs r9, 0
push r9
setae al
rol r8d, cl
bt dx, 7
mov r8, qword [rsp + 0x90]
rdtsc
bt dx, sp
ror r8d, 1
dec r8d
not r8d
movsx r11, r11w
movzx ebx, ax
inc r8d
lahf
xor r8d, 0x29ae0ef0
ror r10b, 0x16
cdq
lea r8, [r8 + r9]
mov r11, rsp
ror al, 0x32
sub rsp, 0x180
ror bl, cl
bt r10w, 0xd7
rdtsc
and rsp, 0xfffffffffffffff0
rcl rax, cl
mov r10, r8
sar ah, cl
cwd
movzx edx, r11w
movabs rax, 0
ror dh, 0x92
and dx, 0x5dc0
movsx ebx, r9w
sub r10, rax
lea rbx, [0x01102821]
sub r8, 4
cdq
sal dl, 8
mov edx, dword [r8]
xor edx, r10d
jmp 0x104f313
Function at 0x14001a95c
Capabilities:
Hide graphical window

Disassembly:
mov r11, rsp
sub rsp, 0x68
and qword [r11 - 0x10], 0
mov rax, qword [0x1400e44b8]
lea rdx, str.218130_v3
mov qword [r11 - 0x18], rax
and qword [r11 - 0x20], 0
and qword [r11 - 0x28], 0
mov eax, 0x80000000
mov dword [rsp + 0x38], 0x64
mov dword [rsp + 0x30], 0x12c
mov dword [rsp + 0x28], eax
mov r9d, 0xcf0000
mov r8, rdx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExW]
and qword [rsp + 0x58], 0
mov rcx, qword [0x1400e44b8]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], 1
mov qword [rsp + 0x40], rax
and dword [rsp + 0x38], 0
and dword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea rdx, [0x1400ab2e0]
mov r9d, 0x50b008c4
xor r8d, r8d
xor ecx, ecx
mov qword [0x1400e4510], rax
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rcx, qword [0x1400e4510]
xor edx, edx
mov qword [0x1400e4508], rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1400e4510]
xor edx, edx
add rsp, 0x68
jmp qword [sym.imp.USER32.dll_ShowWindow]
Function at 0x14001ab60
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r15
lea rbp, [rsp - 0x1ff70]
mov eax, 0x20070
call fcn.140038c40
sub rsp, rax
lea rcx, [rsp + 0x50]
mov rsi, rdx
call fcn.14001e640
lea rdx, [rsp + 0x70]
xor bl, bl
mov ecx, 0x7fff
mov byte [rbp + 0x1ffa0], bl
xor dil, dil
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea r8, [rbp + 0x1ffb0]
mov rdx, rsi
call fcn.14001a624
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x14004f0da
mov eax, dword [0x1400e4570]
test eax, eax
je 0x14001acf2
mov r15d, 1
lea rcx, [0x1400e6320]
cmp eax, r15d
je 0x14004f0fc
lea rax, [rbp + 0x1ffa0]
lea r8, [0x1400e4570]
lea rdx, [0x1400e4598]
mov qword [rsp + 0x20], rax
call fcn.14001cb64
test al, al
je 0x14001acfb
mov al, byte [0x1400e6320]
mov rcx, qword [0x1400e4598]
mov dil, byte [0x1400e6321]
lea r9, [rbp + 0x1ffb8]
lea r8, [rbp + 0xff70]
mov edx, 0x7fff
mov byte [0x1400e4574], al
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov rdx, qword [rbp + 0x1ffb8]
lea rcx, [0x1400e4550]
call fcn.14001edf8
mov bl, byte [rbp + 0x1ffa0]
mov r8d, dword [0x1400e4570]
lea rdx, [0x1400e4598]
call fcn.14000bdc0
test eax, eax
jne 0x14004f120
cmp dil, r15b
je 0x14004f143
call fcn.14001aa30
call fcn.14001a95c
cmp byte [0x1400e4574], 0
jne 0x14001ac9f
lea rcx, [0x1400e4f50]
call fcn.14000175c
lea rcx, [0x1400e45c0]
mov edx, r15d
call fcn.14000bea0
cmp byte [0x1400e4574], 0
jne 0x14001acc3
lea rcx, [0x1400e4f50]
call fcn.1400018ac
lea rcx, [0x1400e6320]
call fcn.14001cbfc
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea rcx, [rsp + 0x50]
call fcn.14001c29c
add rsp, 0x20070
pop r15
pop rdi
pop rsi
pop rbx
pop rbp
ret
or dword [0x1400e44c0], 0xffffffff
jmp 0x14001accf
mov dword [0x1400e44c0], r15d
jmp 0x14001accf
lea r8, [0x1400cf2a4]
lea rdx, str.This_is_a_third_party_compiled_218130_script.
mov r9d, reloc.WSOCK32.dll_recv
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
nop
jmp 0x14001acda
mov r8, qword [0x1400e4578]
or r9d, 0xffffffff
mov edx, r15d
call fcn.14001cab8
mov al, byte [0x1400e44c8]
mov byte [0x1400e6322], al
jmp 0x14001ac5c
lea rcx, [0x1400e6320]
call fcn.14001cbfc
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov dword [0x1400e44c0], r15d
jmp 0x14001acda
call fcn.1400749b0
test al, al
jne 0x14001ac80
cmp byte [rbp + 0x1ffb0], al
jne 0x14001ac80
lea rcx, [rsp + 0x50]
call fcn.14001a3c8
lea rdx, [0x1400cb8a0]
lea rcx, [rsp + 0x30]
call fcn.14001f0bc
lea rcx, [rsp + 0x30]
test bl, bl
je 0x14004f1ab
lea rdx, [0x1400cf2d8]
call fcn.14001ef20
lea rdx, [0x1400e4598]
lea rcx, [rsp + 0x30]
call fcn.14001ec60
lea rdx, [0x1400cf2d8]
lea rcx, [rsp + 0x30]
jmp 0x14004f1ae
mov rdx, rsi
call fcn.14001ef20
mov rbx, qword [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r8, qword [rsp + 0x50]
mov rcx, rax
lea rax, [rsp + 0x70]
lea rdx, str.runas
mov r9, rbx
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0x30]
call fcn.14001c29c
nop
jmp 0x14001acc3
Function at 0x14000b4c0
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x140019060]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov dword [rsp + 0x30], 0x114
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x14000b500
mov eax, 0xff
jmp 0x14000b6ab
mov r8d, dword [rsp + 0x3c]
and r8d, 0x7fff
mov r9d, dword [rsp + 0x40]
cmp r9d, 2
je 0x14000b51c
bts r8d, 0xf
mov edx, dword [rsp + 0x34]
mov ecx, edx
shl ecx, 8
mov eax, dword [rsp + 0x38]
add ecx, eax
mov dword [0x14001acc8], r9d
mov dword [0x14001acd0], ecx
mov dword [0x14001acd4], edx
mov dword [0x14001acd8], eax
mov dword [0x14001accc], r8d
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x14000b593
movsxd rax, dword [0x14000003c]
lea rcx, [0x140000000]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x14000b593
mov ecx, 0x20b
cmp word [rax + 0x18], cx
jne 0x14000b593
xor ebx, ebx
cmp dword [rax + 0x84], 0xe
jbe 0x14000b595
cmp dword [rax + 0xf8], ebx
setne bl
jmp 0x14000b595
xor ebx, ebx
mov dword [rsp + 0x20], ebx
mov edi, 1
mov ecx, edi
call fcn.14000d244
test eax, eax
jne 0x14000b5cb
cmp dword [0x14001a71c], 2
je 0x14000b5b7
call fcn.14000d028
mov ecx, 0x1c
call fcn.14000d074
mov ecx, 0xff
call fcn.14000cc40
call fcn.14000cb0c
test eax, eax
jne 0x14000b5f7
cmp dword [0x14001a71c], 2
je 0x14000b5e2
call fcn.14000d028
mov ecx, 0x10
call fcn.14000d074
mov ecx, 0xff
call fcn.14000cc40
nop
call fcn.14000d2b8
test eax, eax
jns 0x14000b60a
mov ecx, 0x1b
call fcn.14000cc5c
call sub.KERNEL32.dll_GetCommandLineW
mov qword [0x14001c8d0], rax
call fcn.14000da58
mov qword [0x14001a720], rax
call fcn.14000d554
test eax, eax
jns 0x14000b635
mov ecx, 8
call fcn.14000cc5c
call fcn.14000d834
test eax, eax
jns 0x14000b648
mov ecx, 9
call fcn.14000cc5c
mov ecx, edi
call fcn.14000cccc
test eax, eax
je 0x14000b65a
mov ecx, eax
call fcn.14000cc5c
mov r8, qword [0x14001acb8]
mov qword [0x14001ace8], r8
mov rdx, qword [0x14001acb0]
mov ecx, dword [0x14001acac]
call fcn.1400070f4
mov edi, eax
mov dword [rsp + 0x24], eax
test ebx, ebx
jne 0x14000b68b
mov ecx, eax
call fcn.14000d018
call fcn.14000ccb8
jmp 0x14000b6a9
mov eax, edi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14015b000
mov rbx, qword [rsp + 0x170]
add rsp, 0x160
pop rdi
ret
sub rsp, 0x28
call fcn.14000d980
add rsp, 0x28
jmp 0x14000b4c0

Function at 0x14000c1ac
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x140713160
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1407132e7
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140713191
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140713177
add dl, dl
jne 0x14071319e
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407131fe
xor eax, eax
add dl, dl
jne 0x1407131ad
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407132b5
add dl, dl
jne 0x1407131be
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407131cb
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407131d8
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407131e5
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1407131f2
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140713186
mov eax, 1
add dl, dl
jne 0x14071320e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14071321b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140713203
sub eax, ebx
mov ebx, 1
jne 0x140713254
mov ecx, 1
add dl, dl
jne 0x140713236
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140713243
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14071322b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140713186
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140713270
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14071327d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140713265
cmp eax, 0x7d00
jae 0x1407132a3
cmp eax, 0x500
jb 0x14071329e
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140713186
cmp eax, 0x7f
ja 0x1407132a6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140713186
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1407132da
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140713186
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001fb0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x140007100]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400070e0]
test rbx, rbx
je 0x140002004
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x140001ffb
test r12, r12
je 0x140001ffb
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140001fe0
lea rcx, [0x140007100]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140002340
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x140004400]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x1400023b9
mov rcx, r10
call fcn.140002210
test eax, eax
je 0x1400023b9
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x1400023b6
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x1400023ad
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x1400023b9
add r8, 0x28
cmp r8, r9
jne 0x140002398
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret

Function at 0x140002810
Capabilities:
Create thread

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbp, rcx
lea rcx, str.KERNEL32.DLL
mov esi, edx
call fcn.140002930
mov rdi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VirtualAllocEx
mov r12, rax
mov rcx, rax
call rdi
mov rcx, r12
lea rdx, str.WriteProcessMemory
mov rbx, rax
call rdi
mov rcx, r12
lea rdx, str.VirtualProtectEx
mov r13, rax
call rdi
mov dword [rsp + 0x38], 4
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rsi
xor edx, edx
mov r9d, 0x3000
mov r12, rax
mov dword [rsp + 0x20], 4
mov rcx, rax
call rbx
mov r9, rsi
mov r8, rbp
mov rcx, r12
mov qword [rsp + 0x20], 0
mov rbx, rax
mov rdx, rax
call r13
lea rax, [rsp + 0x38]
mov r8, rsi
mov rdx, rbx
mov rcx, r12
mov qword [rsp + 0x20], rax
mov r9d, 0x20
call rdi
lea rax, [rsp + 0x3c]
xor r9d, r9d
mov r8, rbx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x140002930
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov r12, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov r15, qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
lea rdi, [rax + 0x20]
mov r14, qword [rax + 0x20]
mov qword [rsp + 0x48], rdi
mov rdi, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rbp, rcx
movzx r9d, word [r14 + 0x38]
mov r8, qword [r14 + 0x40]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call r12
mov esi, eax
call rdi
mov r8d, esi
mov edx, 8
mov rcx, rax
call r15
movzx r9d, word [r14 + 0x38]
mov r8, qword [r14 + 0x40]
xor edx, edx
mov rbx, rax
xor ecx, ecx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rax
call r12
mov rcx, rbx
call qword [sym.imp.USER32.dll_CharUpperA]
mov rdx, rbp
mov rcx, rbx
call sub.msvcrt.dll_strstr
mov rsi, qword [sym.imp.KERNEL32.dll_HeapFree]
test rax, rax
je 0x140002a17
mov r13, qword [r14 + 0x20]
call rdi
mov r8, rbx
xor edx, edx
mov rcx, rax
call rsi
jmp 0x140002a31
call rdi
mov r8, rbx
xor edx, edx
mov rcx, rax
call rsi
mov r14, qword [r14]
cmp qword [rsp + 0x48], r14
jne 0x140002972
mov rax, r13
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400055bd
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 0x60]
mov rax, qword [rbx + 0x18]
mov r14, qword [rax + 0x10]
mov eax, 0x62e2db23
mov ebp, 0x337c5ee8
mov r15d, 0x12dd9862
cmp eax, 0x1c22a4be
jg 0x140005618
cmp eax, 0xe0ffd7b9
je 0x140005646
cmp eax, 0xf2229e3e
je 0x14000566e
cmp eax, 0x12dd9862
jne 0x1400055f1
mov rdi, qword [r14 + 0x30]
mov eax, 0xf2229e3e
jmp 0x1400055f1
cmp eax, 0x1c22a4bf
je 0x140005650
cmp eax, 0x337c5ee8
je 0x140005665
cmp eax, 0x62e2db23
jne 0x1400055f1
mov rdx, qword [r14 + 0x60]
mov rcx, rsi
call fcn.140006c5f
test eax, eax
mov eax, 0xe0ffd7b9
cmove eax, r15d
jmp 0x1400055f1
mov r14, qword [r14]
mov eax, 0x1c22a4bf
jmp 0x1400055f1
mov rax, qword [rbx + 0x18]
add rax, 0x10
cmp r14, rax
mov eax, 0x62e2db23
cmove eax, ebp
jmp 0x1400055f1
mov eax, 0xf2229e3e
xor edi, edi
jmp 0x1400055f1
mov rax, rdi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400059fe
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, rdx
mov qword [rsp + 0x28], rcx
call fcn.140007e72
mov rbx, rax
mov qword [rsp + 0x30], rsi
test rsi, rsi
mov eax, 0x275fe7bc
mov ebp, 0x20dbd73c
cmove ebp, eax
mov eax, 0xcf07a1b4
mov ecx, eax
cmp eax, 0xfbe8e626
jle 0x140005a8e
cmp ecx, 0x3440f7b9
jg 0x140005ad2
test dword [rax], eax
add byte [rax], al
cmp ecx, 0x147ef02a
jg 0x140005b59
cmp ecx, 0xfbe8e627
je 0x140005c35
cmp ecx, 0x1015665d
je 0x140005c4e
mov eax, ecx
cmp ecx, 0x1097649d
jne 0x140005a38
cmp byte [rbx + 1], 0x5a
mov eax, 0x1015665d
mov ecx, 0x147ef02b
cmove eax, ecx
jmp 0x140005a38
cmp ecx, 0xd2a7a206
jle 0x140005b0e
cmp ecx, 0xe14ca518
jg 0x140005b95
cmp ecx, 0xd2a7a207
je 0x140005c58
cmp ecx, 0xd4632404
je 0x140005c67
mov eax, ecx
cmp ecx, 0xd839d482
jne 0x140005a38
mov eax, 0x1015665d
jmp 0x140005a38
cmp ecx, 0x684fafcb
jg 0x140005bc5
cmp ecx, 0x3440f7ba
je 0x140005c88
cmp ecx, 0x64b5cec2
je 0x140005c9d
mov eax, ecx
cmp ecx, 0x651abe93
jne 0x140005a38
mov eax, 0x64b5cec2
jmp 0x140005a38
cmp ecx, 0x93460535
jle 0x140005bfb
cmp ecx, 0x93460536
je 0x140005ca9
cmp ecx, 0xb926c1f7
je 0x140005cbb
mov eax, ecx
cmp ecx, 0xcf07a1b4
jne 0x140005a38
test rbx, rbx
lea rbx, [rbx - 1]
mov eax, 0x3440f7ba
mov ecx, 0xfbe8e627
cmove eax, ecx
jmp 0x140005a38
cmp ecx, 0x147ef02b
je 0x140005cd3
test byte [rsi + 1], ch
add byte [rax], al
cmp ecx, 0x20dbd73c
je 0x140005cef
mov eax, ecx
cmp ecx, 0x275fe7bc
jne 0x140005a38
mov r14d, dword [r15 + 0xc]
add r14, rbx
mov eax, 0x80c011a3
mov esi, 1
jmp 0x140005a38
cmp ecx, 0xe14ca519
je 0x140005d04
cmp ecx, 0xed5b1a69
je 0x140005d1d
mov eax, ecx
cmp ecx, 0xf31223a2
jne 0x140005a38
mov eax, 0xfbe8e627
jmp 0x140005a38
mov eax, ebp
cmp ecx, 0x684fafcc
je 0x140005a38
cmp ecx, 0x75a8cf72
je 0x140005d36
mov eax, ecx
cmp ecx, 0x7b17a501
jne 0x140005a38
add r15, 0x28
mov eax, 0x651abe93
jmp 0x140005a38
cmp ecx, 0x80c011a3
je 0x140005d40
cmp ecx, 0x89a80948
jne 0x140005d4e
movsxd rax, dword [r12 + 0x3c]
cmp dword [rbx + rax], 0x4550
lea r13, [rbx + rax]
mov eax, 0x75a8cf72
mov ecx, 0xf31223a2
cmove eax, ecx
jmp 0x140005a38
movzx eax, word [r13 + 0x14]
lea r15, [rax + r13]
add r15, 0x18
mov eax, 0xe14ca519
xor edi, edi
jmp 0x140005a38
mov eax, 0xcf07a1b4
jmp 0x140005a38
mov eax, 0x80c011a3
mov esi, 4
jmp 0x140005a38
mov rcx, r15
mov rdx, qword [rsp + 0x28]
call fcn.140006673
test eax, eax
mov eax, 0x7b17a501
mov ecx, 0x684fafcc
cmove eax, ecx
jmp 0x140005a38
cmp byte [rbx], 0x4d
mov eax, 0x1015665d
mov ecx, 0x1097649d
cmove eax, ecx
invalid
wait
std
Function at 0x140005a53
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, rdx
mov qword [rsp + 0x28], rcx
call fcn.140007e72
mov rbx, rax
mov qword [rsp + 0x30], rsi
test rsi, rsi
mov eax, 0x275fe7bc
mov ebp, 0x20dbd73c
cmove ebp, eax
mov eax, 0xcf07a1b4
mov ecx, eax
cmp eax, 0xfbe8e626
jle 0x140005a8e
cmp ecx, 0x3440f7b9
jg 0x140005ad2
test dword [rax], eax
add byte [rax], al
cmp ecx, 0x147ef02a
jg 0x140005b59
cmp ecx, 0xfbe8e627
je 0x140005c35
cmp ecx, 0x1015665d
je 0x140005c4e
mov eax, ecx
cmp ecx, 0x1097649d
jne 0x140005a38
cmp byte [rbx + 1], 0x5a
mov eax, 0x1015665d
mov ecx, 0x147ef02b
cmove eax, ecx
jmp 0x140005a38
cmp ecx, 0xd2a7a206
jle 0x140005b0e
cmp ecx, 0xe14ca518
jg 0x140005b95
cmp ecx, 0xd2a7a207
je 0x140005c58
cmp ecx, 0xd4632404
je 0x140005c67
mov eax, ecx
cmp ecx, 0xd839d482
jne 0x140005a38
mov eax, 0x1015665d
jmp 0x140005a38
cmp ecx, 0x684fafcb
jg 0x140005bc5
cmp ecx, 0x3440f7ba
je 0x140005c88
cmp ecx, 0x64b5cec2
je 0x140005c9d
mov eax, ecx
cmp ecx, 0x651abe93
jne 0x140005a38
mov eax, 0x64b5cec2
jmp 0x140005a38
cmp ecx, 0x93460535
jle 0x140005bfb
cmp ecx, 0x93460536
je 0x140005ca9
cmp ecx, 0xb926c1f7
je 0x140005cbb
mov eax, ecx
cmp ecx, 0xcf07a1b4
jne 0x140005a38
test rbx, rbx
lea rbx, [rbx - 1]
mov eax, 0x3440f7ba
mov ecx, 0xfbe8e627
cmove eax, ecx
jmp 0x140005a38
cmp ecx, 0x147ef02b
je 0x140005cd3
test byte [rsi + 1], ch
add byte [rax], al
cmp ecx, 0x20dbd73c
je 0x140005cef
mov eax, ecx
cmp ecx, 0x275fe7bc
jne 0x140005a38
mov r14d, dword [r15 + 0xc]
add r14, rbx
mov eax, 0x80c011a3
mov esi, 1
jmp 0x140005a38
cmp ecx, 0xe14ca519
je 0x140005d04
cmp ecx, 0xed5b1a69
je 0x140005d1d
mov eax, ecx
cmp ecx, 0xf31223a2
jne 0x140005a38
mov eax, 0xfbe8e627
jmp 0x140005a38
mov eax, ebp
cmp ecx, 0x684fafcc
je 0x140005a38
cmp ecx, 0x75a8cf72
je 0x140005d36
mov eax, ecx
cmp ecx, 0x7b17a501
jne 0x140005a38
add r15, 0x28
mov eax, 0x651abe93
jmp 0x140005a38
cmp ecx, 0x80c011a3
je 0x140005d40
cmp ecx, 0x89a80948
jne 0x140005d4e
movsxd rax, dword [r12 + 0x3c]
cmp dword [rbx + rax], 0x4550
lea r13, [rbx + rax]
mov eax, 0x75a8cf72
mov ecx, 0xf31223a2
cmove eax, ecx
jmp 0x140005a38
movzx eax, word [r13 + 0x14]
lea r15, [rax + r13]
add r15, 0x18
mov eax, 0xe14ca519
xor edi, edi
jmp 0x140005a38
mov eax, 0xcf07a1b4
jmp 0x140005a38
mov eax, 0x80c011a3
mov esi, 4
jmp 0x140005a38
mov rcx, r15
mov rdx, qword [rsp + 0x28]
call fcn.140006673
test eax, eax
mov eax, 0x7b17a501
mov ecx, 0x684fafcc
cmove eax, ecx
jmp 0x140005a38
cmp byte [rbx], 0x4d
mov eax, 0x1015665d
mov ecx, 0x1097649d
cmove eax, ecx
invalid
wait
std
Function at 0x140005b59
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, rdx
mov qword [rsp + 0x28], rcx
call fcn.140007e72
mov rbx, rax
mov qword [rsp + 0x30], rsi
test rsi, rsi
mov eax, 0x275fe7bc
mov ebp, 0x20dbd73c
cmove ebp, eax
mov eax, 0xcf07a1b4
mov ecx, eax
cmp eax, 0xfbe8e626
jle 0x140005a8e
cmp ecx, 0x3440f7b9
jg 0x140005ad2
test dword [rax], eax
add byte [rax], al
cmp ecx, 0x147ef02a
jg 0x140005b59
cmp ecx, 0xfbe8e627
je 0x140005c35
cmp ecx, 0x1015665d
je 0x140005c4e
mov eax, ecx
cmp ecx, 0x1097649d
jne 0x140005a38
cmp byte [rbx + 1], 0x5a
mov eax, 0x1015665d
mov ecx, 0x147ef02b
cmove eax, ecx
jmp 0x140005a38
cmp ecx, 0xd2a7a206
jle 0x140005b0e
cmp ecx, 0xe14ca518
jg 0x140005b95
cmp ecx, 0xd2a7a207
je 0x140005c58
cmp ecx, 0xd4632404
je 0x140005c67
mov eax, ecx
cmp ecx, 0xd839d482
jne 0x140005a38
mov eax, 0x1015665d
jmp 0x140005a38
cmp ecx, 0x684fafcb
jg 0x140005bc5
cmp ecx, 0x3440f7ba
je 0x140005c88
cmp ecx, 0x64b5cec2
je 0x140005c9d
mov eax, ecx
cmp ecx, 0x651abe93
jne 0x140005a38
mov eax, 0x64b5cec2
jmp 0x140005a38
cmp ecx, 0x93460535
jle 0x140005bfb
cmp ecx, 0x93460536
je 0x140005ca9
cmp ecx, 0xb926c1f7
je 0x140005cbb
mov eax, ecx
cmp ecx, 0xcf07a1b4
jne 0x140005a38
test rbx, rbx
lea rbx, [rbx - 1]
mov eax, 0x3440f7ba
mov ecx, 0xfbe8e627
cmove eax, ecx
jmp 0x140005a38
cmp ecx, 0x147ef02b
je 0x140005cd3
test byte [rsi + 1], ch
add byte [rax], al
cmp ecx, 0x20dbd73c
je 0x140005cef
mov eax, ecx
cmp ecx, 0x275fe7bc
jne 0x140005a38
mov r14d, dword [r15 + 0xc]
add r14, rbx
mov eax, 0x80c011a3
mov esi, 1
jmp 0x140005a38
cmp ecx, 0xe14ca519
je 0x140005d04
cmp ecx, 0xed5b1a69
je 0x140005d1d
mov eax, ecx
cmp ecx, 0xf31223a2
jne 0x140005a38
mov eax, 0xfbe8e627
jmp 0x140005a38
mov eax, ebp
cmp ecx, 0x684fafcc
je 0x140005a38
cmp ecx, 0x75a8cf72
je 0x140005d36
mov eax, ecx
cmp ecx, 0x7b17a501
jne 0x140005a38
add r15, 0x28
mov eax, 0x651abe93
jmp 0x140005a38
cmp ecx, 0x80c011a3
je 0x140005d40
cmp ecx, 0x89a80948
jne 0x140005d4e
movsxd rax, dword [r12 + 0x3c]
cmp dword [rbx + rax], 0x4550
lea r13, [rbx + rax]
mov eax, 0x75a8cf72
mov ecx, 0xf31223a2
cmove eax, ecx
jmp 0x140005a38
movzx eax, word [r13 + 0x14]
lea r15, [rax + r13]
add r15, 0x18
mov eax, 0xe14ca519
xor edi, edi
jmp 0x140005a38
mov eax, 0xcf07a1b4
jmp 0x140005a38
mov eax, 0x80c011a3
mov esi, 4
jmp 0x140005a38
mov rcx, r15
mov rdx, qword [rsp + 0x28]
call fcn.140006673
test eax, eax
mov eax, 0x7b17a501
mov ecx, 0x684fafcc
cmove eax, ecx
jmp 0x140005a38
cmp byte [rbx], 0x4d
mov eax, 0x1015665d
mov ecx, 0x1097649d
cmove eax, ecx
invalid
wait
std