joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003250
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x400]
sub rsp, 0x500
mov rax, qword [0x140046020]
xor rax, rsp
mov qword [rbp + 0x3f0], rax
mov rdi, rcx
xor r12d, r12d
mov r14d, r12d
lea rdx, [rbp - 0x70]
lea rcx, [0x14003fa70]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x140003408
nop dword [rax]
test byte [rbp - 0x70], 0x10
jne 0x1400033ea
inc r14d
lea rdx, [rbp + 0x1e0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rdx, [rbp - 0x44]
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
mov edx, dword [rbp - 0x50]
mov dword [rsp + 0x30], edx
mov eax, dword [rbp - 0x54]
mov dword [rsp + 0x34], eax
mov ecx, eax
shl rcx, 0x20
or rcx, rdx
cmp rcx, 0x7fff800
ja 0x140003436
mov rsi, qword [rdi + 8]
cmp rsi, qword [rdi + 0x10]
je 0x1400033bb
lea rax, [rsp + 0x40]
mov qword [rbp - 0x80], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
lea rax, [rbp + 0x1e0]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140003340
lea rdx, [rbp + 0x1e0]
lea rcx, [rsp + 0x40]
call fcn.1400082e0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r12
lea rax, [rbp - 0x44]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140003380
lea rdx, [rbp - 0x44]
lea rcx, [rsp + 0x60]
call fcn.1400082e0
nop
mov rbx, qword [rsp + 0x30]
mov r9, rbx
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x60]
mov rcx, rsi
call fcn.1400027b0
add qword [rdi + 8], 0x48
jmp 0x1400033e0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x1e0]
lea r8, [rbp - 0x44]
mov rdx, rsi
mov rcx, rdi
call fcn.140009850
mov rbx, qword [rsp + 0x30]
cmp rbx, qword [rdi + 0x38]
jbe 0x1400033ea
mov qword [rdi + 0x38], rbx
lea rdx, [rbp - 0x70]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400032b0
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, r14d
mov rcx, qword [rbp + 0x3f0]
xor rcx, rsp
call fcn.14000e520
lea r11, [rsp + 0x500]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
lea rdx, [rbp - 0x44]
lea rcx, [rsp + 0x60]
call fcn.140004da0
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1400024f0
lea rdx, [0x1400448b0]
lea rcx, [rsp + 0x40]
call fcn.1400102d4
int3
Function at 0x14000b8ec
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x140046020]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov edi, 0xffff
xor r14d, r14d
movzx esi, dx
mov rbx, rcx
cmp di, dx
jne 0x14000b930
movzx eax, r14w
jmp 0x14000ba65
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x14000b96c
mov rax, qword [rcx + 0x58]
movsxd r9, dword [rax]
lea rdx, [r8 + r9*2]
cmp r8, rdx
jae 0x14000b96c
lea ecx, [r9 - 1]
mov dword [rax], ecx
movzx eax, si
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], si
jmp 0x14000ba65
cmp qword [rcx + 0x80], r14
je 0x14000ba62
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x14000b9aa
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14000b9d3
movzx ecx, si
mov rdx, qword [rbx + 0x80]
call fcn.140017374
cmp ax, di
je 0x14000ba62
movzx edi, si
jmp 0x14000ba62
lea r8, [rbp + 0xf]
mov word [rbp + 7], si
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rbp + 9]
lea r8, [rbp + 0x3f]
mov qword [rsp + 0x30], r8
lea r8, [rbp + 0x1f]
mov rax, qword [rax + 0x38]
mov qword [rsp + 0x28], r8
lea r8, [rbp + 0x17]
mov qword [rsp + 0x20], r8
lea r8, [rbp + 7]
call qword [0x1400312f8]
test eax, eax
je 0x14000ba28
sub eax, 1
je 0x14000ba28
cmp eax, 2
jne 0x14000ba62
movzx ecx, word [rbp + 7]
jmp 0x14000b9b6
mov r14, qword [rbp + 0xf]
lea rax, [rbp + 0x1f]
sub r14, rax
je 0x14000ba52
mov r9, qword [rbx + 0x80]
lea rcx, [rbp + 0x1f]
mov r8, r14
mov edx, 1
call fcn.14001811c
cmp r14, rax
jne 0x14000ba62
lea rax, [rbp + 7]
mov byte [rbx + 0x72], 1
cmp qword [rbp + 0x17], rax
cmovne di, si
movzx eax, di
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.14000e520
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14000d7e4
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x14000d812
xor eax, eax
jmp 0x14000d8f8
cmp qword [rcx + 0x68], 0
je 0x14000d823
call fcn.14000d914
jmp 0x14000d8f8
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14000d83a
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14000d83c
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14000d86e
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.1400103b0
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x14000d8f2
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x14000d8a5
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x14000d8ce
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.14001887c
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x14000d8f2
cmp rsi, rbx
ja 0x14000d8ac
test rsi, rsi
je 0x14000d8f2
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.14001887c
sub rsi, rax
sub rbp, rsi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x14000d9d8
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x14000da07
call fcn.14000da98
jmp 0x14000da7e
mov rax, qword [rcx + 0x40]
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x14000da1e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14000da20
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14000da78
test ecx, ecx
jle 0x14000da59
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call fcn.1400103b0
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x14000da78
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14000da78
mov r8, rbx
mov edx, 1
mov rcx, r15
call fcn.14001811c
sub rbx, rax
sub rsi, rbx
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x14000f290
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000f2da
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000f2da
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000f2da
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000f2da
cmp dword [rcx + 0x84], 0xe
jbe 0x14000f2da
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000f2dc
xor al, al
add rsp, 0x28
ret
Function at 0x14001cd8c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14001cbb8

Function at 0x1400235d4
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x1400232fa
call fcn.1400169d8
mov dword [rax], 0x16
call fcn.140016888
jmp 0x140023445
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140023445
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x140023445
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x140023329
lock or dword [rcx + 0x14], 0x10
jmp 0x140023445
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x14002333d
call fcn.140023998
mov esi, dword [rbx + 0x10]
cmp esi, 1
jne 0x14002334d
mov rax, qword [rbx]
mov bpl, byte [rax]
jmp 0x140023350
xor bpl, bpl
mov rdi, qword [rbx + 8]
mov rcx, rbx
mov qword [rbx], rdi
call fcn.1400210f0
mov r8d, dword [rbx + 0x20]
mov ecx, eax
mov rdx, rdi
call fcn.140025548
mov dword [rbx + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x140023433
mov eax, dword [rbx + 0x14]
test al, 6
jne 0x1400233e1
mov rcx, rbx
call fcn.1400210f0
cmp eax, 0xffffffff
je 0x1400233cc
mov rcx, rbx
call fcn.1400210f0
cmp eax, 0xfffffffe
je 0x1400233cc
mov rcx, rbx
call fcn.1400210f0
movsxd rdi, eax
lea r14, [0x140048690]
mov rcx, rbx
sar rdi, 6
call fcn.1400210f0
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rdi*8]
lea rdx, [rax + rcx*8]
jmp 0x1400233d3
lea rdx, [0x1400463c0]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1400233e1
lock or dword [rbx + 0x14], 0x20
cmp dword [rbx + 0x20], 0x200
jne 0x140023405
mov eax, dword [rbx + 0x14]
shr eax, 6
test al, 1
je 0x140023405
mov eax, dword [rbx + 0x14]
shr eax, 8
test al, 1
jne 0x140023405
mov dword [rbx + 0x20], 0x1000
mov rax, qword [rbx]
cmp esi, 1
jne 0x140023423
movzx ecx, byte [rax]
dec dword [rbx + 0x10]
shl cx, 8
movzx eax, bpl
or cx, ax
inc qword [rbx]
jmp 0x14002342e
movzx ecx, word [rax]
add dword [rbx + 0x10], 0xfffffffe
add qword [rbx], 2
movzx eax, cx
jmp 0x14002344a
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rbx + 0x14], eax
and dword [rbx + 0x10], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
jmp 0x1400232c4
Function at 0x2fc4d6990
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4d7392
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f9108]
test eax, eax
je 0x2fc4d742a
lea rax, [0x2fc4f90e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f9110]
mov qword [rbp - 8], rax
jmp 0x2fc4d740e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d7402
cmp qword [rbp - 0x10], 0
je 0x2fc4d7402
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d73c8
lea rax, [0x2fc4f90e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d742b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d7530
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d7558
mov eax, 0
jmp 0x2fc4d75a6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d7581
mov eax, 0
jmp 0x2fc4d75a6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d75a1
mov eax, 0
jmp 0x2fc4d75a6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d75ac
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d762a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d7621
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d7621
mov rax, qword [rbp - 8]
jmp 0x2fc4d763f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d75f4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140011208
Capabilities:
Terminate process

Disassembly:
jmp 0x1400130e0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x14001128f
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014430
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014450
xor al, al
jmp 0x1400144d1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014463
xor al, al
jmp 0x1400144d1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001448d
xor al, al
jmp 0x1400144d1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400144a1
xor al, al
jmp 0x1400144d1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400144b3
xor al, al
jmp 0x1400144d1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400144cf
xor al, al
jmp 0x1400144d1
mov al, 1
add rsp, 0x38
ret
Function at 0x140002f10
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x1400065e0], rbx
je 0x140002f5c
cmp rax, rbx
jne 0x140002f4f
mov ebx, 1
mov esi, ebx
jmp 0x140002f61
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140002f34
mov ebx, 1
mov eax, dword [0x1400065e8]
cmp eax, ebx
jne 0x140002f77
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x140002fdc
mov eax, dword [0x1400065e8]
test eax, eax
jne 0x140002fd6
mov dword [0x1400065e8], ebx
lea r15, [0x1400043f8]
lea rdi, [0x1400043e0]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x140002fc8
test eax, eax
jne 0x140002fcc
cmp qword [rdi], 0
je 0x140002fbd
mov rax, qword [rdi]
mov rcx, qword [0x1400043c0]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x140002f9e
test eax, eax
je 0x140002fdc
mov eax, 0xff
jmp 0x1400030b8
mov dword [0x140006024], ebx
mov eax, dword [0x1400065e8]
cmp eax, ebx
jne 0x140003003
lea rdx, [0x1400043d8]
lea rcx, [0x1400043c8]
call sub.msvcrt.dll__initterm
mov dword [0x1400065e8], 2
test esi, esi
jne 0x140003010
xor eax, eax
xchg qword [0x1400065e0], rax
cmp qword [0x1400065f0], 0
je 0x140003044
lea rcx, [0x1400065f0]
call fcn.1400032c0
test eax, eax
je 0x140003044
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x1400065f0]
mov r9, qword [0x1400043c0]
call r9
mov r8, qword [0x140006038]
mov rdx, qword [0x140006030]
mov ecx, dword [0x140006028]
call fcn.140002ac4
mov dword [0x140006020], eax
cmp dword [0x140006040], 0
jne 0x140003074
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140006024], 0
jne 0x140003089
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140006020]
jmp 0x1400030b8
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.140096000
add rsp, 0x28
jmp 0x140002f10

Function at 0x1400031ac
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400031f8
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400031f0
cmp dword [rcx + 0x3c], edx
jl 0x1400031f0
cmp dword [rcx + 0x3c], 0x10000000
jae 0x1400031f0
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x1400031f8
mov rax, rdx
add rsp, 0x18
ret
Function at 0x140001230
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rdi, rcx
mov qword [rsp + 0x30], rcx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
lea r14d, [rbp + 4]
mov rax, qword gs:[0x58]
mov rsi, qword [rax]
mov r15d, 0x20
mov eax, dword [r15 + rsi]
mov r12d, 0x30
test al, 1
jne 0x1400012c9
or eax, 1
mov dword [r15 + rsi], eax
mov ebx, r12d
add rbx, rsi
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov edx, eax
mov dword [rbx + 0x1384], 0xffffffff
mov dword [rbx + 4], eax
lea ecx, [rbp + 1]
lea r8, [rbx + 8]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [r8], edx
inc rcx
lea r8, [r8 + 4]
cmp rcx, 0x270
jb 0x1400012a1
mov dword [rbx], 0x270
mov eax, dword [r15 + rsi]
mov ecx, 0x10
test al, 2
jne 0x1400012ea
or eax, 2
mov dword [r15 + rsi], eax
mov qword [rsi + rcx], rbp
mov qword [rsi + rcx + 8], 0xf
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rbp
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov dword [rsp + 0x20], 1
lea r15, [rsi + rcx]
mov ebx, r12d
add rbx, rsi
lea r12, str.0123456789ABCDEF
nop dword [rax + rax]
dec r14
mov qword [rsp + 0x28], rbx
mov rbp, qword [r15]
mov rdx, qword [r15 + 8]
sub rdx, rbp
cmp rdx, 0xffffffffffffffff
jne 0x140001355
mov rcx, rbx
call fcn.14000f430
mov esi, eax
shl rsi, 0x20
mov rcx, rbx
call fcn.14000f430
mov eax, eax
or rsi, rax
jmp 0x140001365
inc rdx
lea rcx, [rsp + 0x28]
call fcn.14000f280
mov rsi, rax
lea rax, [rsi + rbp]
movzx r9d, byte [rax + r12]
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x14000139a
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0xf
jbe 0x14000138f
mov rax, qword [rdi]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x1400013a2
mov rcx, rdi
call fcn.14000ec20
test r14, r14
jne 0x140001320
mov rax, rdi
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14000f430
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x14000f491
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x14000f450
mov ecx, dword [r9]
jmp 0x14000f578
cmp ecx, 0x4e0
jb 0x14000f578
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x14000f4b0
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x14000f500
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret

Function at 0x1400100f4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001013e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001013e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001013e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001013e
cmp dword [rcx + 0x84], 0xe
jbe 0x14001013e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140010140
xor al, al
add rsp, 0x28
ret