joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140103950
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x14018d558]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r15, rcx
mov rbx, r8
inc r8
movabs rax, 0x5851f42d4c957f2d
imul r8, rax
movabs rcx, 0x810a978a59f5a1fc
mov rsi, rdx
mov qword [rbp - 0x50], r8
lea rdi, [r15 + 0x20]
mov rax, r8
mov r14d, 8
xor rax, rcx
movabs rcx, 0xa77099df38c2d846
mov qword [rbp - 0x48], rax
mov rax, r8
xor rax, rcx
movabs rcx, 0x8126b91cbf22495c
mov qword [rbp - 0x40], rax
mov rax, r8
xor rax, rcx
movabs rcx, 0x494d2597179f8a62
mov qword [rbp - 0x38], rax
mov rax, r8
xor rax, rcx
movabs rcx, 0x9237efb9ceaaec0c
mov qword [rbp - 0x30], rax
mov rax, r8
xor rax, rcx
movabs rcx, 0x2f2a56746ce62d78
mov qword [rbp - 0x28], rax
mov rax, r8
xor rax, rcx
mov qword [rbp - 0x20], rax
movabs rax, 0x84853bf7b62ce54e
xor r8, rax
mov qword [rbp - 0x18], r8
nop dword [rax]
nop word [rax + rax]
and ebx, 0x3fffff
shl rbx, 6
add rbx, qword [r15]
prefetchnta byte [rbx]
mov rdx, rdi
lea rcx, [rbp - 0x50]
call fcn.140105bd0
mov rax, qword [rbx]
xor qword [rbp - 0x50], rax
mov rax, qword [rbx + 8]
xor qword [rbp - 0x48], rax
mov rax, qword [rbx + 0x10]
xor qword [rbp - 0x40], rax
mov rax, qword [rbx + 0x18]
xor qword [rbp - 0x38], rax
mov rax, qword [rbx + 0x20]
xor qword [rbp - 0x30], rax
mov rax, qword [rbx + 0x28]
xor qword [rbp - 0x28], rax
mov rax, qword [rbx + 0x30]
xor qword [rbp - 0x20], rax
mov rax, qword [rbx + 0x38]
movsxd rbx, dword [rdi + 0x1814]
add rdi, 0x1878
xor qword [rbp - 0x18], rax
mov rbx, qword [rbp + rbx*8 - 0x50]
sub r14, 1
jne 0x140103a30
movaps xmm0, xmmword [rbp - 0x50]
movaps xmm1, xmmword [rbp - 0x40]
movups xmmword [rsi], xmm0
movaps xmm0, xmmword [rbp - 0x30]
movups xmmword [rsi + 0x10], xmm1
movaps xmm1, xmmword [rbp - 0x20]
movups xmmword [rsi + 0x20], xmm0
movups xmmword [rsi + 0x30], xmm1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400d2c70
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140103b20
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [0x14021789c]
lea r8, [rcx + 0x40]
mov r9, rdx
mov rcx, r9
lea edx, [rax*8 + 0x80]
jmp 0x14010a3d0
mov rax, rsp
sub rsp, 0x98
movdqu xmm2, xmmword [rcx]
lea r9, [rdx + r8]
movdqu xmm3, xmmword [rcx + 0x10]
movdqu xmm4, xmmword [rcx + 0x20]
movdqu xmm5, xmmword [rcx + 0x30]
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movdqa xmm7, xmmword [0x140217920]
movaps xmmword [rax - 0x38], xmm8
movdqa xmm8, xmmword [0x140217930]
movaps xmmword [rax - 0x48], xmm9
movdqa xmm9, xmmword [0x140217940]
aesdec xmm2, xmm7
aesenc xmm3, xmm7
movaps xmmword [rax - 0x58], xmm10
movdqa xmm10, xmmword [0x140217950]
aesdec xmm2, xmm8
aesenc xmm3, xmm8
movaps xmmword [rax - 0x68], xmm11
movdqa xmm11, xmmword [0x140217960]
aesdec xmm4, xmm11
aesenc xmm5, xmm11
movaps xmmword [rax - 0x78], xmm12
movaps xmmword [rsp + 0x10], xmm13
movaps xmmword [rsp], xmm14
lea rax, [r8 + 0x80]
movdqa xmm12, xmmword [0x140217970]
movdqa xmm13, xmmword [0x140217980]
movdqa xmm14, xmmword [0x140217990]
aesdec xmm4, xmm12
aesenc xmm5, xmm12
aesdec xmm2, xmm9
aesenc xmm3, xmm9
aesdec xmm4, xmm13
aesdec xmm2, xmm10
movdqu xmmword [r8], xmm2
aesenc xmm3, xmm10
movdqu xmmword [r8 + 0x10], xmm3
aesenc xmm5, xmm13
aesdec xmm4, xmm14
movdqu xmmword [r8 + 0x20], xmm4
aesenc xmm5, xmm14
movdqu xmmword [r8 + 0x30], xmm5
aesdec xmm2, xmm7
aesenc xmm3, xmm7
aesdec xmm4, xmm11
aesenc xmm5, xmm11
aesdec xmm2, xmm8
aesenc xmm3, xmm8
aesdec xmm4, xmm12
aesenc xmm5, xmm12
aesdec xmm2, xmm9
aesenc xmm3, xmm9
aesdec xmm4, xmm13
aesdec xmm2, xmm10
movdqu xmmword [r8 + 0x40], xmm2
aesenc xmm3, xmm10
movdqu xmmword [r8 + 0x50], xmm3
aesenc xmm5, xmm13
aesdec xmm4, xmm14
movdqu xmmword [r8 + 0x60], xmm4
aesenc xmm5, xmm14
movdqu xmmword [r8 + 0x70], xmm5
movdqa xmm6, xmmword [0x14017bb40]
cmp rax, r9
jae 0x14010a60a
nop word [rax + rax]
aesdec xmm2, xmm7
aesenc xmm3, xmm7
aesdec xmm4, xmm11
aesenc xmm5, xmm11
aesdec xmm2, xmm8
aesenc xmm3, xmm8
aesdec xmm4, xmm12
aesenc xmm5, xmm12
aesdec xmm2, xmm9
aesenc xmm3, xmm9
aesdec xmm2, xmm10
movdqa xmm0, xmm6
movdqa xmm1, xmm6
andps xmm0, xmm2
movdqu xmmword [rax], xmm0
movdqa xmm0, xmm6
aesenc xmm3, xmm10
andps xmm1, xmm3
movdqu xmmword [rax + 0x10], xmm1
movdqa xmm1, xmm6
aesdec xmm4, xmm13
aesenc xmm5, xmm13
aesdec xmm4, xmm14
aesenc xmm5, xmm14
andps xmm0, xmm4
andps xmm1, xmm5
movdqu xmmword [rax + 0x20], xmm0
movdqu xmmword [rax + 0x30], xmm1
add rax, 0x40
cmp rax, r9
jb 0x14010a570
movaps xmm7, xmmword [rsp + 0x70]
lea r11, [rsp + 0x98]
movaps xmm6, xmmword [r11 - 0x18]
movaps xmm8, xmmword [r11 - 0x38]
movaps xmm9, xmmword [r11 - 0x48]
movaps xmm10, xmmword [r11 - 0x58]
movaps xmm11, xmmword [r11 - 0x68]
movaps xmm12, xmmword [r11 - 0x78]
movaps xmm13, xmmword [rsp + 0x10]
movaps xmm14, xmmword [rsp]
mov rsp, r11
ret
Function at 0x140103cc0
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
mov r8, qword [rcx + 0xab0]
mov rax, rdx
mov edx, dword [0x140217898]
mov rcx, rax
jmp 0x1401080b0
sub rsp, 0x28
movdqa xmm4, xmmword [0x14017bbb0]
lea r10, [rdx + r8]
movdqa xmm5, xmmword [0x14017bb60]
mov r9, rcx
movdqu xmm0, xmmword [rcx]
movdqu xmm1, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rcx + 0x20]
movdqu xmm3, xmmword [rcx + 0x30]
movaps xmmword [rsp + 0x10], xmm6
movdqa xmm6, xmmword [0x14017bb70]
movaps xmmword [rsp], xmm7
movdqa xmm7, xmmword [0x14017bb80]
cmp r8, r10
jae 0x140108134
lea rcx, [r8 + 0x20]
aesdec xmm0, xmm4
aesenc xmm1, xmm5
aesdec xmm2, xmm6
aesenc xmm3, xmm7
movdqu xmmword [rcx - 0x20], xmm0
movdqu xmmword [rcx - 0x10], xmm1
movdqu xmmword [rcx], xmm2
movdqu xmmword [rcx + 0x10], xmm3
lea rcx, [rcx + 0x40]
lea rax, [rcx - 0x20]
cmp rax, r10
jb 0x140108100
movaps xmm6, xmmword [rsp + 0x10]
movaps xmm7, xmmword [rsp]
movdqu xmmword [r9], xmm0
movdqu xmmword [r9 + 0x10], xmm1
movdqu xmmword [r9 + 0x20], xmm2
movdqu xmmword [r9 + 0x30], xmm3
add rsp, 0x28
ret

Function at 0x140105020
Capabilities:
Hash data using sha512

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x14018d558]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x14010511e
lea rax, [rdx - 1]
cmp rax, 0x3f
ja 0x140105105
xor eax, eax
mov byte [rsp + 0x20], dil
xor edx, edx
mov qword [rsp + 0x32], rax
mov r8d, 0xf0
mov dword [rsp + 0x3a], eax
mov word [rsp + 0x3e], ax
mov word [rsp + 0x21], 0x100
mov byte [rsp + 0x23], 1
mov dword [rsp + 0x24], 0
mov word [rsp + 0x30], 0
call fcn.1400d4e70
movaps xmm0, xmmword [0x14017b820]
mov rax, qword [rsp + 0x20]
movups xmmword [rbx], xmm0
movaps xmm1, xmmword [0x14017b830]
movups xmmword [rbx + 0x10], xmm1
movaps xmm0, xmmword [0x14017b840]
movups xmmword [rbx + 0x20], xmm0
movaps xmm1, xmmword [0x14017b850]
xorps xmm0, xmm0
movups xmmword [rbx + 0x30], xmm1
xor qword [rbx], rax
mov rax, qword [rsp + 0x30]
xor qword [rbx + 0x10], rax
mov rax, qword [rsp + 0x38]
xor qword [rbx + 0x18], rax
movq rax, xmm0
xor qword [rbx + 0x20], rax
xor qword [rbx + 8], 0
psrldq xmm0, 8
movq rax, xmm0
xor qword [rbx + 0x28], rax
movzx eax, dil
mov dword [rbx + 0xe4], eax
xor eax, eax
jmp 0x140105123
cmp byte [rcx + 0xe8], 0
je 0x140105116
mov qword [rcx + 0x58], 0xffffffffffffffff
mov qword [rcx + 0x50], 0xffffffffffffffff
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400d2c70
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret
Function at 0x14010b330
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x68
movdqa xmm2, xmmword [0x14017bbc0]
mov r10, rcx
movdqa xmm3, xmmword [0x14017bba0]
mov rax, rcx
movdqa xmm4, xmmword [0x14017bbd0]
mov r11, r8
movdqa xmm5, xmmword [0x14017bb90]
lea r8, [rcx + 0x1c00]
movdqu xmm0, xmmword [r9]
lea rcx, [rdx - 0x1c00]
movdqu xmm1, xmmword [r9 + 0x10]
add rcx, rax
movaps xmmword [rsp + 0x50], xmm6
mov edx, 2
movdqu xmm6, xmmword [r9 + 0x20]
movaps xmmword [rsp + 0x40], xmm7
movdqu xmm7, xmmword [r9 + 0x30]
movaps xmmword [rsp + 0x30], xmm8
movdqa xmm8, xmmword [0x14017bbb0]
movaps xmmword [rsp + 0x20], xmm9
movdqa xmm9, xmmword [0x14017bb60]
movaps xmmword [rsp + 0x10], xmm10
movdqa xmm10, xmmword [0x14017bb70]
movaps xmmword [rsp], xmm11
movdqa xmm11, xmmword [0x14017bb80]
nop
cmp rax, rcx
jae 0x14010b483
nop dword [rax]
aesenc xmm2, xmmword [rax]
aesdec xmm3, xmmword [rax + 0x10]
aesenc xmm4, xmmword [rax + 0x20]
aesdec xmm5, xmmword [rax + 0x30]
aesenc xmm2, xmmword [rax + 0x40]
aesdec xmm3, xmmword [rax + 0x50]
aesenc xmm4, xmmword [rax + 0x60]
aesdec xmm5, xmmword [rax + 0x70]
aesdec xmm0, xmm8
movdqu xmmword [rax], xmm0
aesenc xmm1, xmm9
movdqu xmmword [rax + 0x10], xmm1
aesdec xmm6, xmm10
movdqu xmmword [rax + 0x20], xmm6
aesenc xmm7, xmm11
movdqu xmmword [rax + 0x30], xmm7
aesdec xmm0, xmm8
movdqu xmmword [rax + 0x40], xmm0
aesenc xmm1, xmm9
movdqu xmmword [rax + 0x50], xmm1
aesdec xmm6, xmm10
aesenc xmm7, xmm11
movdqu xmmword [rax + 0x60], xmm6
movdqu xmmword [rax + 0x70], xmm7
prefetcht0 byte [r8]
prefetcht0 byte [r8 + 0x40]
sub rax, 0xffffffffffffff80
lea r8, [r8 + 0x80]
cmp rax, rcx
jb 0x14010b3e0
add rcx, 0x1c00
mov r8, r10
sub rdx, 1
jne 0x14010b3d0
movaps xmm8, xmmword [rsp + 0x30]
movaps xmm9, xmmword [rsp + 0x20]
movaps xmm10, xmmword [rsp + 0x10]
movaps xmm11, xmmword [rsp]
movdqu xmmword [r9], xmm0
movdqa xmm0, xmmword [0x14017bb50]
movdqu xmmword [r9 + 0x10], xmm1
movdqa xmm1, xmmword [0x14017bbe0]
movdqu xmmword [r9 + 0x20], xmm6
movaps xmm6, xmmword [rsp + 0x50]
movdqu xmmword [r9 + 0x30], xmm7
movaps xmm7, xmmword [rsp + 0x40]
aesenc xmm2, xmm0
aesdec xmm3, xmm0
aesenc xmm4, xmm0
aesdec xmm5, xmm0
aesenc xmm2, xmm1
aesdec xmm3, xmm1
aesenc xmm4, xmm1
aesdec xmm5, xmm1
movdqu xmmword [r11], xmm2
movdqu xmmword [r11 + 0x10], xmm3
movdqu xmmword [r11 + 0x20], xmm4
movdqu xmmword [r11 + 0x30], xmm5
add rsp, 0x68
ret
Function at 0x1400112b2
Capabilities:
Terminate process

Disassembly:
jmp 0x140015010
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x14001136b
Capabilities:
Parse pe header

Disassembly:
jmp 0x140016360
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140016380
xor al, al
jmp 0x140016401
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140016393
xor al, al
jmp 0x140016401
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400163bd
xor al, al
jmp 0x140016401
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400163d1
xor al, al
jmp 0x140016401
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400163e3
xor al, al
jmp 0x140016401
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400163ff
xor al, al
jmp 0x140016401
mov al, 1
add rsp, 0x38
ret
Function at 0x140014240
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.1400114f6
movzx eax, al
test eax, eax
jne 0x140014260
mov ecx, 7
call fcn.140011438
nop
mov byte [rsp + 0x20], 0
call fcn.140011456
mov byte [rsp + 0x21], al
cmp dword [0x1400208b8], 1
jne 0x140014284
mov ecx, 7
call fcn.140011438
nop
jmp 0x1400142dc
cmp dword [0x1400208b8], 0
jne 0x1400142d7
mov dword [0x1400208b8], 1
lea rdx, [0x14001c660]
lea rcx, [0x14001c330]
call fcn.140011235
test eax, eax
je 0x1400142b8
mov eax, 0xff
jmp 0x1400143e1
lea rdx, [0x14001c220]
lea rcx, [section..rdata]
call fcn.140011447
mov dword [0x1400208b8], 2
jmp 0x1400142dc
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.14001141f
call fcn.140011398
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140014339
mov rcx, qword [rsp + 0x30]
call fcn.1400111cc
movzx eax, al
test eax, eax
je 0x140014339
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140027020]
nop
call fcn.1400113cf
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x14001436d
mov rcx, qword [rsp + 0x38]
call fcn.1400111cc
movzx eax, al
test eax, eax
je 0x14001436d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.1400114ab
nop
call fcn.140014490
mov dword [rsp + 0x28], eax
call fcn.14001136b
movzx eax, al
test eax, eax
jne 0x14001438c
mov ecx, dword [rsp + 0x28]
call fcn.14001106e
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14001439b
call fcn.1400114ba
nop
xor edx, edx
mov cl, 1
call fcn.1400111b3
mov eax, dword [rsp + 0x28]
jmp 0x1400143e1
add rsp, 0x68
ret
Function at 0x140131000
Capabilities:
Encode data using xor
Execute anti-debugging instructions
Get number of processors
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
jmp 0x1401310ae
sub rsp, 8
mov qword [rsp], r14
push rsi
mov qword [rsp + 8], rcx
nop
sub rsp, 8
mov qword [rsp], rbp
nop
jmp 0x1401310c2
mov qword [rsp - 8], rbx
sub rsp, 8
push rdi
nop
sub rsp, 8
mov qword [rsp], r13
nop
jmp 0x140131029
Function at 0x402650
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x00408624]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x4027d8
mov rax, qword [0x00408628]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x40269c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x402725
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x402680
mov rcx, rbx
call fcn.004032f0
test rax, rax
mov r12, rax
je 0x40280d
mov rax, qword [0x00408628]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call fcn.00403420
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x00408628]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x4027f0
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x40271e
sub eax, 0x40
and eax, 0xffffffbf
jne 0x402780
add dword [0x00408624], 1
cmp edi, 8
jae 0x402753
test dil, 4
jne 0x4027c4
test edi, edi
je 0x402748
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x4027df
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x402748
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x40276c
jmp 0x402748
add rsi, qword [0x00408628]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x40271e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.004037e0
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x402748
xor esi, esi
jmp 0x4026a7
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x402748
mov rax, qword [0x00408628]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call fcn.004037e0
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.004037e0
nop
nop dword [rax]

Function at 0x402f60
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00408900]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004088e0]
test rbx, rbx
je 0x402fb4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x402fab
test rsi, rsi
je 0x402fab
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x402f90
lea rcx, [0x00408900]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x4032f0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x00405d20]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x40335d
mov rcx, r8
call fcn.004031d0
test eax, eax
je 0x40335d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x40335d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x403354
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x40335f
add rax, 0x28
cmp rax, r9
jne 0x403340
xor eax, eax
add rsp, 0x28
ret

Function at 0x4037e0
Capabilities:
Write file on windows

Disassembly:
lea rcx, [0x00401540]
jmp 0x401510
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.004036b0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.004036b0
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
jmp 0x401530
Function at 0x140004a90
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rdx
mov rdx, rcx
mov rcx, rax
jmp 0x14000f0c0
mov rax, qword gs:[0x30]
mov r10, rcx
mov r8, qword [rax + 0x60]
mov r9, qword [r8 + 0x18]
add r9, 0x20
mov rax, qword [r9]
nop dword [rax + rax]
cmp qword [rax + 0x20], rdx
je 0x14000f0fd
test rdx, rdx
je 0x14000f0fd
mov rax, qword [rax]
cmp rax, r9
jne 0x14000f0e0
mov qword [rcx], 0
xor eax, eax
ret
mov rcx, qword [rax + 0x40]
mov qword [r10], rcx
movzx eax, word [rax + 0x38]
shr eax, 1
ret
Function at 0x140005800
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
xor r8, r8
push r8
push rax
pushfq
push r8
push rdx
sub rsp, 0xa8
push r8
push r15
push r14
push r13
push r12
push rbx
push r8
push rsi
push rdi
push rbp
push rax
push rdx
sub rsp, 0x280
movdqa xmmword [rsp + 0x2e0], xmm6
movdqa xmmword [rsp + 0x2f0], xmm7
movdqa xmmword [rsp + 0x300], xmm8
movdqa xmmword [rsp + 0x310], xmm9
movdqa xmmword [rsp + 0x320], xmm10
movdqa xmmword [rsp + 0x330], xmm11
movdqa xmmword [rsp + 0x340], xmm12
movdqa xmmword [rsp + 0x350], xmm13
movdqa xmmword [rsp + 0x360], xmm14
movdqa xmmword [rsp + 0x370], xmm15
mov eax, dword [0x14027c984]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x30
add rax, rbx
lea rdx, [rsp + 0x20]
xor r8, r8
mov qword [rdx + 0x10], r8
mov byte [rdx + 0x19], 1
mov dword [rdx + 0x1c], 0xffffffff
mov byte [rdx + 0x18], 2
mov r8, qword [rax + 0x80]
mov qword [rdx], r8
mov qword [rax + 0x80], rdx
lea r8, [rsp + 0x280]
mov qword [rdx + 8], r8
call fcn.1400a2fac
int3
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xd8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x120], rcx
mov qword [rsp + 0x128], rdx
mov qword [rsp + 0x130], r8
mov qword [rsp + 0x138], r9
mov eax, dword [0x14027c984]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x30
add rax, rbx
mov qword [rsp + 0xc0], rax
cmp rcx, qword [rax + 0x88]
sete byte [rsp + 0xd0]
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [r8 + 0x18]
mov rbx, qword [rax]
mov rax, qword [r8 + 0x20]
mov rbp, qword [rax]
mov rax, qword [r8 + 0x28]
mov rsi, qword [rax]
mov rax, qword [r8 + 0x30]
mov rdi, qword [rax]
mov rax, qword [r8 + 0x58]
mov r12, qword [rax]
mov rax, qword [r8 + 0x60]
mov r13, qword [rax]
mov rax, qword [r8 + 0x68]
mov r14, qword [rax]
mov rax, qword [r8 + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [r8 + 0x90]
movdqa xmm7, xmmword [r8 + 0xa0]
movdqa xmm8, xmmword [r8 + 0xb0]
movdqa xmm9, xmmword [r8 + 0xc0]
movdqa xmm10, xmmword [r8 + 0xd0]
movdqa xmm11, xmmword [r8 + 0xe0]
movdqa xmm12, xmmword [r8 + 0xf0]
movdqa xmm13, xmmword [r8 + 0x100]
movdqa xmm14, xmmword [r8 + 0x110]
movdqa xmm15, xmmword [r8 + 0x120]
mov rcx, qword [r8 + 0x78]
mov rdx, qword [rsp + 0x120]
call qword [rsp + 0x128]
mov r8, qword [rsp + 0x130]
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rdx + 0x70]
cmp rcx, 0
je 0x140005990
mov r9, qword [rdx + 0x68]
mov qword [r9], rcx
mov qword [rdx + 0x68], 0
mov qword [rdx + 0x70], 0
mov rcx, qword [rsp + 0x138]
mov r8, qword [r8 + 0x78]
xor r9d, r9d
mov rcx, qword [rcx]
cmp rcx, r9
je 0x1400059ac
cmp rcx, r8
jl 0x14000599f
mov qword [rdx + 0x80], rcx
test dword [0x140276668], 1
je 0x1400059db
cmp byte [rsp + 0xd0], 0
je 0x1400059db
mov rcx, 0x43
mov rdx, rax
mov rsp, r8
jmp 0x140005500
mov rsp, r8
jmp rax