joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100402870
Capabilities:
Get file attributes
Terminate process
Write file on windows

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0xb0
cmp byte [rcx], 0x2d
mov r12, rcx
mov rsi, rdx
jne 0x1004028b0
cmp byte [rcx + 1], 0
jne 0x1004028b0
call sub.msys_2.0.dll___getreent
mov r8, rsi
lea rdx, str._stdin_
mov rcx, qword [rax + 8]
add rsp, 0xb0
pop rbx
pop rsi
pop r12
jmp fcn.1004021a0
lea rdx, [rsp + 0x30]
mov rcx, r12
call sub.msys_2.0.dll_stat
cmp eax, 0xffffffff
je 0x10040292c
mov ebx, dword [rsp + 0x40]
and ebx, 0xf000
cmp ebx, 0x4000
je 0x10040296c
lea eax, [rbx - 0x1000]
test eax, 0xffffe000
je 0x1004028ed
cmp ebx, 0x8000
jne 0x10040296c
lea rdx, [0x10040e43b]
mov rcx, r12
call sub.msys_2.0.dll_fopen
test rax, rax
je 0x100402998
cmp ebx, 0x8000
je 0x100402920
test rsi, rsi
je 0x10040296c
mov r8, rsi
mov rdx, r12
mov rcx, rax
call fcn.1004021a0
add rsp, 0xb0
pop rbx
pop rsi
pop r12
ret
call sub.msys_2.0.dll___errno
mov ecx, dword [rax]
call sub.msys_2.0.dll_strerror
mov rsi, qword [0x10040d010]
mov rbx, rax
call sub.msys_2.0.dll___getreent
mov r9, r12
mov r8, rsi
lea rdx, str._s:__s__s_n
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x20], rbx
call sub.msys_2.0.dll_fprintf
mov ecx, 1
call sub.msys_2.0.dll_exit
mov rbx, qword [0x10040d010]
call sub.msys_2.0.dll___getreent
mov r9, r12
lea rdx, str._s:__s_is_not_a_file_n
mov rcx, qword [rax + 0x18]
mov r8, rbx
call sub.msys_2.0.dll_fprintf
mov ecx, 1
call sub.msys_2.0.dll_exit
mov rbx, qword [0x10040d010]
call sub.msys_2.0.dll___getreent
mov r9, r12
lea rdx, str._s:_Cant_open__s_n
mov rcx, qword [rax + 0x18]
mov r8, rbx
call sub.msys_2.0.dll_fprintf
mov ecx, 1
call sub.msys_2.0.dll_exit
nop
nop word cs:[rax + rax]
Function at 0x1004029d0
Capabilities:
Write file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x420
mov r13, rcx
test rcx, rcx
je 0x100402ba0
mov edx, 0x2f
call sub.msys_2.0.dll_strchr
mov r12, rax
test rax, rax
je 0x100402ae8
mov rcx, r13
xor edx, edx
mov edi, 2
xor r12d, r12d
call fcn.100402870
lea rbx, [rsp + 0x20]
mov r13, rax
xor esi, esi
jmp 0x100402a39
mov rcx, rbx
call fcn.100401fe0
test rax, rax
jne 0x100402b60
mov r8, r13
mov edx, 0x400
mov rcx, rbx
call sub.msys_2.0.dll_fgets
test rax, rax
jne 0x100402a28
cmp edi, 2
je 0x100402b73
cmp edi, 3
jne 0x100402b90
mov rcx, r13
call sub.msys_2.0.dll_fclose
cmp byte [0x10041704c], 0
je 0x100402ad0
test r12, r12
je 0x100402ba0
mov r9, qword [0x100417058]
mov r8d, 0x1f
mov edx, 1
lea rcx, str.Entries_that_will_be_compiled:_n
call sub.msys_2.0.dll_fwrite
mov r9, qword [r12]
test r9, r9
je 0x100402ad0
xor ebx, ebx
lea rsi, str._u:_s_n
nop word [rax + rax]
add ebx, 1
mov rcx, qword [0x100417058]
mov rdx, rsi
mov r8d, ebx
call sub.msys_2.0.dll_fprintf
mov eax, ebx
mov r9, qword [r12 + rax*8]
test r9, r9
jne 0x100402ab0
mov rax, r12
add rsp, 0x420
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov edi, 1
mov ebp, 2
mov rcx, r13
xor r14d, r14d
xor esi, esi
jmp 0x100402b03
add esi, 1
mov eax, esi
add rax, r13
movsx ebx, byte [rax]
cmp ebx, 0x2c
je 0x100402b14
test ebx, ebx
jne 0x100402b00
cmp edi, 1
je 0x100402b58
mov byte [rax], 0
call fcn.100401fe0
test rax, rax
je 0x100402b31
mov edx, r14d
add r14d, 1
mov qword [r12 + rdx*8], rax
lea ecx, [rsi + 1]
add rcx, r13
test ebx, ebx
jne 0x100402b00
cmp edi, 1
je 0x100402bb2
cmp ebp, 3
je 0x100402a68
add ebp, 1
add edi, 1
jmp 0x100402af2
add r14d, 1
jmp 0x100402b37
test r12, r12
je 0x100402ba8
mov edx, esi
mov qword [r12 + rdx*8], rax
add esi, 1
jmp 0x100402a39
lea ecx, [rsi + 1]
mov edx, 8
call sub.msys_2.0.dll_calloc
mov r12, rax
test rax, rax
je 0x100402bcc
mov rcx, r13
call sub.msys_2.0.dll_rewind
add edi, 1
jmp 0x100402a1d
xor r12d, r12d
jmp 0x100402ad0
mov rcx, rax
call sub.msys_2.0.dll_free
jmp 0x100402b6b
lea ecx, [r14 + 1]
mov edx, 8
call sub.msys_2.0.dll_calloc
mov r12, rax
test rax, rax
jne 0x100402b49
lea rcx, str.make_namelist
call fcn.100401fc0
nop
nop dword [rax]

Function at 0x100407220
Capabilities:
Terminate process

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rax, qword [rcx + 8]
lea rdi, [r8 + 1]
mov rsi, r8
mov r8, qword [rcx + 0x10]
mov r12, rdx
lea rdx, [rax + rdi]
mov rbx, rcx
mov rcx, qword [rcx]
cmp r8, rdx
jae 0x10040726b
lea rdx, [r8 + rdx + 0x400]
mov qword [rbx + 0x10], rdx
call qword [sym.imp.msys_ncursesw6.dll__nc_doalloc]
mov qword [rbx], rax
mov rcx, rax
test rax, rax
je 0x100407292
mov rax, qword [rbx + 8]
add rcx, rax
mov r8, rdi
mov rdx, r12
call sub.msys_2.0.dll_strncpy
mov rax, qword [rbx]
add rsi, qword [rbx + 8]
mov qword [rbx + 8], rsi
mov byte [rax + rsi], 0
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
ret
lea rcx, str.strncpy_DYN
call sub.msys_2.0.dll_perror
mov ecx, 1
call sub.msys_2.0.dll_exit
nop
nop dword [rax]
Function at 0x100407360
Capabilities:
Terminate process

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rdi, qword [sym.imp.msys_ncursesw6.dll__nc_doalloc]
xor ebx, ebx
lea rsi, [0x1004170a0]
mov ebp, ecx
test ecx, ecx
jle 0x1004073e7
nop
mov rax, qword [0x1004170a8]
mov rdx, qword [0x1004170b0]
mov rcx, qword [rsi]
lea r8, [rax + 2]
cmp r8, rdx
jbe 0x1004073bd
lea rdx, [r8 + rdx + 0x400]
mov qword [0x1004170b0], rdx
call rdi
mov qword [rsi], rax
mov rcx, rax
test rax, rax
je 0x1004073f0
mov rax, qword [0x1004170a8]
mov edx, 9
add ebx, 1
mov word [rcx + rax], dx
mov rax, qword [0x1004170a8]
lea rdx, [rax + 1]
mov qword [0x1004170a8], rdx
mov rdx, qword [rsi]
mov byte [rdx + rax + 1], 0
cmp ebx, ebp
jne 0x100407380
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rcx, str.strncpy_DYN
call sub.msys_2.0.dll_perror
mov ecx, 1
call sub.msys_2.0.dll_exit
nop
nop word [rax + rax]
Function at 0x140006c5c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140006ca6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140006ca6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140006ca6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140006ca6
cmp dword [rcx + 0x84], 0xe
jbe 0x140006ca6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140006ca8
xor al, al
add rsp, 0x28
ret
Function at 0x401760
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
movsxd rbp, dword [0x00407054]
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
test ebp, ebp
jle 0x40187a
mov rax, qword [0x00407058]
xor r9d, r9d
add rax, 8
mov r10, qword [rax]
cmp rbx, r10
jb 0x4017ae
mov rdx, qword [rax + 8]
mov r11d, dword [rdx + 8]
add r10, r11
cmp rbx, r10
jb 0x401860
add r9d, 1
add rax, 0x18
cmp r9d, ebp
jne 0x401792
mov rcx, rbx
call dbg.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x4018b2
lea rbp, [rbp + rbp*2]
shl rbp, 3
mov r13, rbp
add r13, qword [0x00407058]
mov qword [r13 + 0x10], rax
mov dword [r13], 0
call dbg._GetPEImageBase
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
lea rdx, [rsp + 0x20]
mov qword [r13 + 8], rax
mov rax, qword [0x00407058]
mov rcx, qword [rax + rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x401895
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x401859
sub eax, 0x40
and eax, 0xffffffbf
je 0x401859
mov r9, rbp
add r9, qword [0x00407058]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x401881
add dword [0x00407054], 1
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.memcpy
xor ebp, ebp
jmp 0x4017bb
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
mov rax, qword [0x00407058]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbp + 8]
call dbg.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call dbg.__report_error
nop
nop word cs:[rax + rax]

Function at 0x402490
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x4024a0
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x4024b0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x4024f1
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x4024e8
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x4024f3
add rax, 0x28
cmp rax, r9
jne 0x4024d4
xor eax, eax
repz ret

Function at 0x4025a0
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [0x004042f0]
cmp word [rbx], 0x5a4d
je 0x4025c0
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov rsi, rcx
mov rcx, rbx
call sym._ValidateImageBase.part.0
test eax, eax
je 0x4025b4
sub rsi, rbx
mov rcx, rbx
mov rdx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp dbg._FindPESection
Function at 0x140001470
Capabilities:
Query or enumerate registry key

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x248
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rdi, rcx
movsxd rbp, r9d
mov ecx, 0xc8
mov rsi, r8
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
xor edx, edx
mov r8d, 0xc8
mov rcx, rax
mov rbx, rax
call sub.VCRUNTIME140.dll_memset
mov r9d, 0xffffffff
mov dword [rsp + 0x28], 0xc8
mov r8, rdi
mov qword [rsp + 0x20], rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movzx eax, word [0x140003380]
lea rcx, [rsp + 0x4b]
movsd xmm0, qword [str.Softwarea_]
xor edx, edx
mov word [rsp + 0x48], ax
mov r8d, 0xd7
movzx eax, byte [0x140003382]
mov byte [rsp + 0x4a], al
movsd qword [rsp + 0x40], xmm0
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x40]
dec rdx
cmp byte [rdx + 1], 0
lea rdx, [rdx + 1]
jne 0x140001514
xor eax, eax
movzx ecx, byte [rdi + rax]
mov byte [rdx + rax], cl
lea rax, [rax + 1]
test cl, cl
jne 0x140001520
lea rcx, [rsp + 0x40]
dec rcx
nop word [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140001540
movzx eax, word [0x140003384]
lea r9, [rsp + 0x30]
mov word [rcx], ax
xor r8d, r8d
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x20], 1
mov edx, 0xf003f
call qword [sym.imp.SHLWAPI.dll_SHRegCreateUSKeyA]
test eax, eax
jne 0x140001616
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x38]
mov qword [rsp + 0x240], r14
lea r8, [rsp + 0x130]
xor r14d, r14d
mov dword [rsp + 0x38], 0x100
xor edx, edx
mov dword [rsp + 0x20], r14d
mov ebx, r14d
call qword [sym.imp.SHLWAPI.dll_SHRegEnumUSKeyA]
test eax, eax
jne 0x140001600
nop word [rax + rax]
mov r8, rbp
lea rdx, [rsp + 0x130]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x38]
inc ebx
mov dword [rsp + 0x38], 0x100
mov edx, ebx
mov dword [rsp + 0x20], r14d
lea r8, [rsp + 0x130]
call qword [sym.imp.SHLWAPI.dll_SHRegEnumUSKeyA]
test eax, eax
je 0x1400015c0
mov r14, qword [rsp + 0x240]
cmp eax, 0x103
jne 0x140001616
mov eax, 1
jmp 0x140001618
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140001940
add rsp, 0x248
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140001790
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rsi, rdx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
je 0x140001847
movsxd r13, dword [rax + 0x3c]
mov r12d, dword [r13 + rax + 0x88]
mov r15d, dword [r12 + rax + 0x1c]
mov r10d, dword [r12 + rax + 0x20]
add r15, rax
mov r11d, dword [r12 + rax + 0x24]
add r10, rax
add r11, rax
test esi, 0xffff0000
jne 0x1400017fe
movzx eax, si
sub eax, dword [r12 + rbx + 0x10]
mov eax, dword [r15 + rax*4]
add rax, rbx
jmp 0x140001849
mov edi, dword [r12 + rax + 0x18]
xor r14d, r14d
mov r9d, r14d
test edi, edi
je 0x140001847
nop dword [rax]
mov eax, dword [r10]
mov r8, rsi
movzx ebp, word [r11]
add rax, rbx
sub r8, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140001833
inc rax
test ecx, ecx
jne 0x140001820
test edx, edx
je 0x140001866
inc r9d
add r11, 2
add r10, 4
cmp r9d, edi
jb 0x140001810
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ecx, dword [r15 + rbp*4]
cmp r12, rcx
ja 0x14000191e
mov eax, dword [r13 + rbx + 0x8c]
add eax, r12d
cmp rcx, rax
jae 0x14000191e
lea rbp, [rcx + rbx]
mov rcx, rbp
lea rdx, [0x1400033a8]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
mov rdi, rax
lea rsi, [rax + 1]
mov rax, 0xffffffffffffffff
sub rsi, rbp
mov rcx, rsi
add rcx, 4
lea edx, [rax + 2]
cmovb rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rbx, rax
test rax, rax
je 0x140001847
mov r8, rsi
mov rdx, rbp
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
movzx ecx, word [0x1400033ac]
mov word [rbx + rsi], cx
movzx ecx, byte [0x1400033ae]
mov byte [rbx + rsi + 2], cl
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x14000190d
lea rdx, [rdi + 1]
mov rcx, rbx
call fcn.140001790
mov r14, rax
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, r14
jmp 0x140001849
lea rax, [rcx + rbx]
jmp 0x140001849
Function at 0x140001230
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rdi, rcx
mov qword [rsp + 0x30], rcx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
lea r14d, [rbp + 4]
mov rax, qword gs:[0x58]
mov rsi, qword [rax]
mov r15d, 0x20
mov eax, dword [r15 + rsi]
mov r12d, 0x30
test al, 1
jne 0x1400012c9
or eax, 1
mov dword [r15 + rsi], eax
mov ebx, r12d
add rbx, rsi
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov edx, eax
mov dword [rbx + 0x1384], 0xffffffff
mov dword [rbx + 4], eax
lea ecx, [rbp + 1]
lea r8, [rbx + 8]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [r8], edx
inc rcx
lea r8, [r8 + 4]
cmp rcx, 0x270
jb 0x1400012a1
mov dword [rbx], 0x270
mov eax, dword [r15 + rsi]
mov ecx, 0x10
test al, 2
jne 0x1400012ea
or eax, 2
mov dword [r15 + rsi], eax
mov qword [rsi + rcx], rbp
mov qword [rsi + rcx + 8], 0xf
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rbp
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov dword [rsp + 0x20], 1
lea r15, [rsi + rcx]
mov ebx, r12d
add rbx, rsi
lea r12, str.0123456789ABCDEF
nop dword [rax + rax]
dec r14
mov qword [rsp + 0x28], rbx
mov rbp, qword [r15]
mov rdx, qword [r15 + 8]
sub rdx, rbp
cmp rdx, 0xffffffffffffffff
jne 0x140001355
mov rcx, rbx
call fcn.14000f550
mov esi, eax
shl rsi, 0x20
mov rcx, rbx
call fcn.14000f550
mov eax, eax
or rsi, rax
jmp 0x140001365
inc rdx
lea rcx, [rsp + 0x28]
call fcn.14000f3a0
mov rsi, rax
lea rax, [rsi + rbp]
movzx r9d, byte [rax + r12]
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x14000139a
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0xf
jbe 0x14000138f
mov rax, qword [rdi]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x1400013a2
mov rcx, rdi
call fcn.14000ed40
test r14, r14
jne 0x140001320
mov rax, rdi
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14000f550
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x14000f5b1
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x14000f570
mov ecx, dword [r9]
jmp 0x14000f698
cmp ecx, 0x4e0
jb 0x14000f698
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x14000f5d0
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x14000f620
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret

Function at 0x140010214
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001025e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001025e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001025e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001025e
cmp dword [rcx + 0x84], 0xe
jbe 0x14001025e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140010260
xor al, al
add rsp, 0x28
ret

Function at 0x140a3d2d8
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140a3d2e2
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x140a3d30b
pop rbp
sub rbp, 0x33
sub rbp, 0xa3d2d8
sub rsp, 0x20
jmp 0x140a3d32a
mov rax, 0xa3d2d8
add rax, rbp
add rax, 0x84
mov rcx, 0x647
mov rdx, 0x55007f6b
xor byte [rax], dl
inc rax
dec rcx
jne 0x140a3d349
jmp 0x140a3d360
and esp, edx
invalid
Function at 0x14000ca84
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x14000cab2
xor eax, eax
jmp 0x14000cb98
cmp qword [rcx + 0x68], 0
je 0x14000cac3
call fcn.14000cbb4
jmp 0x14000cb98
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14000cada
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14000cadc
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14000cb0e
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.140011540
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x14000cb92
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x14000cb45
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x14000cb6e
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.14001d43c
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x14000cb92
cmp rsi, rbx
ja 0x14000cb4c
test rsi, rsi
je 0x14000cb92
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.14001d43c
sub rsi, rax
sub rbp, rsi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x140010364
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400103ae
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400103ae
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400103ae
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400103ae
cmp dword [rcx + 0x84], 0xe
jbe 0x1400103ae
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400103b0
xor al, al
add rsp, 0x28
ret
Function at 0x140015d50
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140015bbb
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140015bbb
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140015bbb
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140015bbb
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140015bbb
cmp dword [rcx + 0x84], 0xe
jbe 0x140015bbb
cmp dword [rcx + 0xf8], 0
je 0x140015bbb
mov ecx, ebx
call fcn.140015c6c
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140015a48
nop
cmp dword [rbp + 0x20], 0
je 0x140015c09
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140015c14
int3
xor r8d, r8d
xor edx, edx
jmp 0x140015b4c