joyce8/EMBER2024-capa huggingface dataset:
Function at 0x102778c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x10277d9
cmp rcx, 0xffffffffffffffff
je 0x10277d9
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x10277d1
cmp dword [rcx + 0x3c], edx
jl 0x10277d1
cmp dword [rcx + 0x3c], 0x10000000
jae 0x10277d1
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x10277d9
mov rax, rdx
add rsp, 0x18
ret

Function at 0x1027a24
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x530
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x1027a8f
and qword [rsp + 0x38], 0
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x50]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov r8, rbx
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlVirtualUnwind]
jmp 0x1027aaf
mov rax, qword [rsp + 0x538]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x538]
mov qword [rsp + 0xf8], rax
lea rcx, [0x01001d78]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add rsp, 0x530
pop rbx
ret
Function at 0x140022a10
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xe0
mov rax, qword [0x1400a3020]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rsi, rcx
mov qword [rbp - 0x71], rcx
xor r15d, r15d
mov dword [rbp - 0x79], r15d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x59], xmm0
movups xmmword [rbp - 0x49], xmm0
movups xmmword [rbp - 0x39], xmm0
movups xmmword [rbp - 0x29], xmm0
mov qword [rbp - 0x19], rax
mov dword [rbp - 0x19], eax
mov qword [rbp - 0x11], r15
mov dword [rbp - 9], 0x6a09e667
mov dword [rbp - 5], 0xbb67ae85
mov dword [rbp - 1], 0x3c6ef372
mov dword [rbp + 3], 0xa54ff53a
mov dword [rbp + 7], 0x510e527f
mov dword [rbp + 0xb], 0x9b05688c
mov dword [rbp + 0xf], 0x1f83d9ab
mov dword [rbp + 0x13], 0x5be0cd19
mov r14, qword [rdx]
mov rdi, qword [rdx + 8]
sub rdi, r14
mov ebx, r15d
je 0x140022afc
mov edx, r15d
nop word [rax + rax]
mov ecx, eax
movzx eax, byte [rdx + r14]
mov byte [rbp + rcx - 0x59], al
mov eax, dword [rbp - 0x19]
inc eax
mov dword [rbp - 0x19], eax
cmp eax, 0x40
jne 0x140022af3
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x59]
call fcn.140002b90
add qword [rbp - 0x11], 0x200
mov eax, r15d
mov dword [rbp - 0x19], eax
inc ebx
mov edx, ebx
cmp rdx, rdi
jb 0x140022ac0
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 0x59]
call fcn.1400030e0
nop
mov qword [rsi], r15
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], 0
mov dword [rbp - 0x79], 2
lea rbx, [rbp + 0x17]
mov edi, 0x20
nop dword [rax]
movzx r9d, byte [rbx]
lea r8, [0x140091498]
mov edx, 3
lea rcx, [rbp - 0x69]
call fcn.14001f7f0
lea rax, [rbp - 0x69]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140022b54
lea rdx, [rbp - 0x69]
mov rcx, rsi
call fcn.140006c20
inc rbx
sub rdi, 1
jne 0x140022b30
mov rax, rsi
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1400477d0
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140022ba0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0xa0
mov rax, qword [0x1400a3020]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rsi, rdx
mov rdi, rcx
cmp qword [rcx + 0x18], 8
jb 0x140022bd1
mov rcx, qword [rcx]
xor ebp, ebp
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rbp + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0x88], rax
cmp rax, 0xffffffffffffffff
je 0x140022cfe
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
lea ecx, [rax - 1]
cmp ecx, 0xfffffffd
ja 0x140022cd8
mov edx, eax
mov rcx, rsi
call fcn.140001bd0
mov dword [rsp + 0x60], ebp
mov rdx, qword [rsi]
mov r8, qword [rsi + 8]
sub r8, rdx
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140022c8d
mov rcx, qword [rsi + 8]
sub rcx, qword [rsi]
mov eax, dword [rsp + 0x60]
cmp rcx, rax
jne 0x140022c8d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1400477d0
mov rbx, qword [rsp + 0xd0]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret
lea rdx, str.file_read__:_ReadFile_failed_for
lea rcx, [rsp + 0x68]
call fcn.1400024c0
nop
mov rdx, rdi
lea rcx, [rsp + 0x68]
call fcn.140007750
lea rcx, [rsp + 0x68]
call fcn.140002490
mov rdx, rax
mov r8b, 1
lea rcx, [rsp + 0x40]
call fcn.140002360
lea rdx, [0x1400a14d0]
lea rcx, [rsp + 0x40]
call fcn.140049b34
nop
xor r8d, r8d
lea rdx, str.file_read__:_GetFileSize_failed_or_file_size_zero
lea rcx, [rsp + 0x40]
call fcn.140002360
lea rdx, [0x1400a14d0]
lea rcx, [rsp + 0x40]
call fcn.140049b34
int3
lea rdx, str.file_read__:_CreateFile_failed_for
lea rcx, [rsp + 0x68]
call fcn.1400024c0
nop
mov rdx, rdi
lea rcx, [rsp + 0x68]
call fcn.140007750
lea rcx, [rsp + 0x68]
call fcn.140002490
mov rdx, rax
mov r8b, 1
lea rcx, [rsp + 0x40]
call fcn.140002360
lea rdx, [0x1400a14d0]
lea rcx, [rsp + 0x40]
call fcn.140049b34
int3
Function at 0x140022d50
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0xa0
mov rax, qword [0x1400a3020]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rsi, rdx
mov rdi, rcx
cmp qword [rcx + 0x18], 8
jb 0x140022d81
mov rcx, qword [rcx]
xor ebp, ebp
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [rbp + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0x88], rax
cmp rax, 0xffffffffffffffff
je 0x140022e22
mov rdx, qword [rsi]
mov rax, qword [rsi + 8]
cmp rdx, rax
jne 0x140022def
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1400477d0
mov rbx, qword [rsp + 0xd0]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret
mov dword [rsp + 0x60], ebp
sub rax, rdx
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x60]
mov r8d, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140022e6d
mov rcx, qword [rsi + 8]
sub rcx, qword [rsi]
mov eax, dword [rsp + 0x60]
cmp rcx, rax
jne 0x140022e6d
jmp 0x140022dc3
lea rdx, str.file_write__:_CreateFile_failed_for
lea rcx, [rsp + 0x68]
call fcn.1400024c0
nop
mov rdx, rdi
lea rcx, [rsp + 0x68]
call fcn.140007750
lea rcx, [rsp + 0x68]
call fcn.140002490
mov rdx, rax
mov r8b, 1
lea rcx, [rsp + 0x40]
call fcn.140002360
lea rdx, [0x1400a14d0]
lea rcx, [rsp + 0x40]
call fcn.140049b34
nop
lea rdx, str.file_write__:_WriteFile_failed_for
lea rcx, [rsp + 0x68]
call fcn.1400024c0
nop
mov rdx, rdi
lea rcx, [rsp + 0x68]
call fcn.140007750
lea rcx, [rsp + 0x68]
call fcn.140002490
mov rdx, rax
mov r8b, 1
lea rcx, [rsp + 0x40]
call fcn.140002360
lea rdx, [0x1400a14d0]
lea rcx, [rsp + 0x40]
call fcn.140049b34
int3
Function at 0x1400272a0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [0x1400a3020]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, rdx
mov rbx, rcx
mov edx, 0x1000
mov rcx, r8
mov r14, r8
call fcn.140001bd0
mov rcx, qword [r14]
xor edx, edx
mov r8, qword [r14 + 8]
sub r8, rcx
call fcn.14004a2e0
mov r8, qword [r14]
lea rax, [rsp + 0x30]
mov r9, qword [r14 + 8]
xor esi, esi
sub r9, r8
mov qword [rsp + 0x30], rsi
mov rdx, rdi
mov qword [rsp + 0x20], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x140027315
cmp qword [rsp + 0x30], rsi
je 0x140027357
mov rdx, qword [r14]
mov r8, qword [r14 + 8]
lea rax, [rdx + 0x40]
cmp rax, r8
jae 0x140027351
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x140027351
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
cmp rcx, rdx
jb 0x140027351
lea rax, [rcx + 8]
cmp rax, r8
jae 0x140027351
cmp dword [rcx], 0x4550
cmovne rcx, rsi
mov rsi, rcx
test rsi, rsi
setne al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400477d0
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x1400404f0
Capabilities:
Capture screenshot

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x1400a3020]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x50], rdx
mov r13, rcx
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov ecx, 0x4e
mov qword [rsp + 0x60], rax
mov r14, rax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 0x4f
mov esi, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 0x4c
mov ebp, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 0x4d
mov edi, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov rcx, r14
mov ebx, eax
call qword [sym.imp.USER32.dll_GetWindowDC]
mov rcx, rax
mov r15, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov r8d, ebp
mov edx, esi
mov rcx, r15
mov r12, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov rdx, rax
mov rcx, r12
mov r14, rax
call qword [sym.imp.GDI32.dll_SelectObject]
mov dword [rsp + 0x40], 0xcc0020
mov r9d, esi
mov dword [rsp + 0x38], ebx
xor r8d, r8d
mov dword [rsp + 0x30], edi
xor edx, edx
mov qword [rsp + 0x28], r15
mov rcx, r12
mov dword [rsp + 0x20], ebp
call qword [sym.imp.GDI32.dll_BitBlt]
xorps xmm0, xmm0
lea r8, [rsp + 0x68]
mov edx, 0x20
mov rcx, r14
movups xmmword [rsp + 0x68], xmm0
movups xmmword [rsp + 0x78], xmm0
call qword [sym.imp.GDI32.dll_GetObjectW]
mov rbx, qword [rsp + 0x50]
xor edi, edi
mov ecx, dword [rsp + 0x70]
mov eax, dword [rsp + 0x6c]
mov dword [rbx + 4], eax
shl eax, 5
add eax, 0x1f
mov dword [rbx + 8], ecx
cdq
mov dword [rbx], 0x28
and edx, 0x1f
mov qword [rbx + 0xc], 0x200001
add edx, eax
mov qword [rbx + 0x14], rdi
sar edx, 5
imul edx, ecx
mov rcx, r13
mov qword [rbx + 0x1c], rdi
mov dword [rbx + 0x24], edi
shl edx, 2
add rdx, 0x36
call fcn.140001bd0
mov rax, qword [r13]
mov r9d, ebp
add rax, 0x36
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rbx
xor r8d, r8d
mov rdx, r14
mov qword [rsp + 0x20], rax
mov rcx, r12
call qword [sym.imp.GDI32.dll_GetDIBits]
mov dword [rsp + 0x56], edi
mov eax, dword [r13 + 8]
mov rdx, r15
sub eax, dword [r13]
mov rcx, qword [r13]
mov dword [rsp + 0x52], eax
mov eax, 0x4d42
mov word [rsp + 0x50], ax
movsd xmm0, qword [rsp + 0x50]
movsd qword [rcx], xmm0
mov dword [rsp + 0x5a], 0x36
mov eax, dword [rsp + 0x58]
mov dword [rcx + 8], eax
movzx eax, word [rsp + 0x5c]
mov word [rcx + 0xc], ax
movups xmm0, xmmword [rbx]
mov rax, qword [r13]
mov rcx, qword [rsp + 0x60]
movups xmmword [rax + 0xe], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rax + 0x1e], xmm1
movsd xmm0, qword [rbx + 0x20]
movsd qword [rax + 0x2e], xmm0
call qword [sym.imp.USER32.dll_ReleaseDC]
mov rcx, r12
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rcx, r14
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1400477d0
mov rbx, qword [rsp + 0xe0]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140041520
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x1400a3020]
xor rax, rsp
mov qword [rbp + 0x50], rax
mov r12, rdx
mov r13, rcx
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x100
call fcn.14004a2e0
movzx r10d, byte [r13]
xor eax, eax
xor r15d, r15d
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
mov edi, r15d
movups xmmword [rsp + 0x30], xmm0
test r10b, r10b
je 0x140041616
mov ecx, dword [rsp + 0x44]
lea rbx, [rsp + 0x50]
mov r9d, dword [rsp + 0x3c]
mov r11, r13
mov r8d, dword [rsp + 0x38]
nop dword [rax + rax]
movzx edx, r10b
lea r11, [r11 + 1]
imul eax, edx, 7
lea rbx, [rbx + 4]
sub eax, r8d
add r8d, edx
add r9d, eax
mov dword [rsp + 0x38], r8d
mov eax, ecx
lea rcx, [rsp + 0x30]
add rcx, rax
mov dword [rsp + 0x3c], r9d
movzx eax, byte [rcx]
sub r8d, eax
mov dword [rsp + 0x38], r8d
mov byte [rcx], r10b
mov ecx, dword [rsp + 0x44]
mov eax, dword [rsp + 0x40]
inc ecx
mov r8d, dword [rsp + 0x38]
cmp ecx, 7
mov r9d, dword [rsp + 0x3c]
movzx r10d, byte [r11]
cmove ecx, r15d
shl eax, 5
inc edi
xor eax, edx
mov dword [rsp + 0x44], ecx
mov dword [rsp + 0x40], eax
add eax, r8d
add eax, r9d
mov dword [rbx - 4], eax
test r10b, r10b
jne 0x1400415a0
movzx r8d, byte [r12]
xor eax, eax
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movsxd r14, edi
mov esi, r15d
movups xmmword [rsp + 0x30], xmm0
test r8b, r8b
je 0x140041748
mov ecx, dword [rsp + 0x44]
mov r9, r12
mov r10d, dword [rsp + 0x38]
mov r11d, dword [rsp + 0x3c]
mov qword [rsp + 0x28], r12
nop
movzx edx, r8b
imul eax, edx, 7
sub eax, r10d
add r10d, edx
add r11d, eax
mov dword [rsp + 0x38], r10d
mov eax, ecx
lea rcx, [rsp + 0x30]
add rcx, rax
mov dword [rsp + 0x3c], r11d
movzx eax, byte [rcx]
sub r10d, eax
mov dword [rsp + 0x38], r10d
mov byte [rcx], r8b
mov ecx, dword [rsp + 0x44]
mov eax, dword [rsp + 0x40]
inc ecx
mov r10d, dword [rsp + 0x38]
cmp ecx, 7
mov r11d, dword [rsp + 0x3c]
cmove ecx, r15d
shl eax, 5
xor eax, edx
mov dword [rsp + 0x20], ecx
mov dword [rsp + 0x44], ecx
mov dword [rsp + 0x40], eax
lea r15d, [rax + r10]
add r15d, r11d
cmp esi, 6
jl 0x140041725
mov edi, 6
mov ebx, edi
cmp rbx, r14
jge 0x140041725
cmp dword [rsp + rbx*4 + 0x50], r15d
jne 0x140041708
movsxd rax, esi
lea rcx, [r12 - 6]
add rcx, rax
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rcx + rax], 0
jne 0x1400416e0
cmp rax, 7
jb 0x140041708
movsxd rax, edi
lea rdx, [r13 - 6]
add rdx, rax
mov r8d, 7
call fcn.14005bb90
test eax, eax
je 0x140041741
inc edi
inc rbx
cmp rbx, r14
jl 0x1400416c6
mov r9, qword [rsp + 0x28]
mov r10d, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x20]
mov r11d, dword [rsp + 0x3c]
movzx r8d, byte [r9 + 1]
inc r9
inc esi
mov qword [rsp + 0x28], r9
test r8b, r8b
je 0x140041748
xor r15d, r15d
jmp 0x140041650
mov eax, 1
jmp 0x14004174a
xor eax, eax
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.1400477d0
mov rbx, qword [rsp + 0x1b0]
add rsp, 0x160
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140042590
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x50
mov rax, qword [0x1400a3020]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r14, rcx
mov r8, rdx
cmp qword [rdx + 0x18], 8
jb 0x1400425c9
mov r8, qword [rdx]
mov rax, qword [rdx + 0x10]
lea r8, [r8 + rax*2]
jb 0x1400425d6
mov rdx, qword [rdx]
xor edi, edi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], dil
lea rcx, [rsp + 0x20]
call fcn.14001f290
nop
lea rsi, [rsp + 0x20]
mov r8, qword [rsp + 0x20]
mov r10, qword [rsp + 0x38]
cmp r10, 0x10
cmovae rsi, r8
lea rbp, [rsp + 0x20]
cmovae rbp, r8
mov r9, qword [rsp + 0x30]
add rbp, r9
lea rbx, [rsp + 0x20]
cmp r10, 0x10
cmovae rbx, r8
cmp rbx, rbp
je 0x14004265a
sub rsi, rbx
movsx ecx, byte [rbx]
call fcn.140058adc
mov byte [rbx + rsi], al
inc rbx
cmp rbx, rbp
jne 0x140042638
mov r10, qword [rsp + 0x38]
mov r9, qword [rsp + 0x30]
mov r8, qword [rsp + 0x20]
lea rdx, [rsp + 0x20]
cmp r10, 0x10
cmovae rdx, r8
movabs rcx, 0xcbf29ce484222325
test r9, r9
je 0x140042693
movabs r11, 0x100000001b3
movzx eax, byte [rdi + rdx]
xor rcx, rax
imul rcx, r11
inc rdi
cmp rdi, r9
jb 0x140042680
mov r9, qword [r14 + 0x28]
mov rax, qword [r9 + 8]
mov rdx, r9
cmp byte [rax + 0x19], 0
jne 0x1400426bc
cmp qword [rax + 0x20], rcx
jae 0x1400426b0
mov rax, qword [rax + 0x10]
jmp 0x1400426b6
mov rdx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1400426a4
cmp byte [rdx + 0x19], 0
jne 0x1400426c8
cmp rcx, qword [rdx + 0x20]
jae 0x1400426cb
mov rdx, r9
cmp rdx, r9
setne bl
cmp r10, 0x10
jb 0x140042704
lea rdx, [r10 + 1]
mov rax, r8
cmp rdx, 0x1000
jb 0x1400426fc
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004272f
mov rcx, r8
call fcn.1400477f0
movzx eax, bl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400477d0
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
call fcn.14004e14c
int3
Function at 0x140045d58
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x1400a3020]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov edi, 0xffff
xor r14d, r14d
movzx esi, dx
mov rbx, rcx
cmp di, dx
jne 0x140045d9c
movzx eax, r14w
jmp 0x140045ed2
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x140045dd8
mov rax, qword [rcx + 0x58]
movsxd r9, dword [rax]
lea rdx, [r8 + r9*2]
cmp r8, rdx
jae 0x140045dd8
lea ecx, [r9 - 1]
mov dword [rax], ecx
movzx eax, si
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], si
jmp 0x140045ed2
cmp qword [rcx + 0x80], r14
je 0x140045ecf
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x140045e16
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140045e3f
movzx ecx, si
mov rdx, qword [rbx + 0x80]
call fcn.14005eb98
cmp ax, di
je 0x140045ecf
movzx edi, si
jmp 0x140045ecf
lea r8, [rbp + 0xf]
mov word [rbp + 7], si
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rbp + 9]
lea r8, [rbp + 0x3f]
mov qword [rsp + 0x30], r8
lea r8, [rbp + 0x1f]
mov rax, qword [rax + 0x38]
mov qword [rsp + 0x28], r8
lea r8, [rbp + 0x17]
mov qword [rsp + 0x20], r8
lea r8, [rbp + 7]
call qword [0x14007c6f0]
test eax, eax
je 0x140045e94
sub eax, 1
je 0x140045e94
cmp eax, 2
jne 0x140045ecf
movzx ecx, word [rbp + 7]
jmp 0x140045e22
mov r14, qword [rbp + 0xf]
lea rax, [rbp + 0x1f]
sub r14, rax
je 0x140045ebe
mov r9, qword [rbx + 0x80]
lea rcx, [rbp + 0x1f]
mov r8, r14
mov edx, 1
call fcn.14004eb64
cmp r14, rax
jne 0x140045ecf
lea rax, [rbp + 7]
mov byte [rbx + 0x72], 1
cmp qword [rbp + 0x17], rax
movzx eax, si
jne 0x140045ed2
movzx eax, di
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.1400477d0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x140062370
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14006219c
Function at 0x140066e38
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x140066b5e
call fcn.14005775c
mov dword [rax], 0x16
call fcn.14004e12c
jmp 0x140066ca9
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140066ca9
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x140066ca9
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x140066b8d
lock or dword [rcx + 0x14], 0x10
jmp 0x140066ca9
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x140066ba1
call fcn.140068514
mov esi, dword [rbx + 0x10]
cmp esi, 1
jne 0x140066bb1
mov rax, qword [rbx]
mov bpl, byte [rax]
jmp 0x140066bb4
xor bpl, bpl
mov rdi, qword [rbx + 8]
mov rcx, rbx
mov qword [rbx], rdi
call fcn.1400654ac
mov r8d, dword [rbx + 0x20]
mov ecx, eax
mov rdx, rdi
call fcn.140068b54
mov dword [rbx + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x140066c97
mov eax, dword [rbx + 0x14]
test al, 6
jne 0x140066c45
mov rcx, rbx
call fcn.1400654ac
cmp eax, 0xffffffff
je 0x140066c30
mov rcx, rbx
call fcn.1400654ac
cmp eax, 0xfffffffe
je 0x140066c30
mov rcx, rbx
call fcn.1400654ac
movsxd rdi, eax
lea r14, [0x1400a5f10]
mov rcx, rbx
sar rdi, 6
call fcn.1400654ac
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rdi*8]
lea rdx, [rax + rcx*8]
jmp 0x140066c37
lea rdx, [0x1400a3260]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x140066c45
lock or dword [rbx + 0x14], 0x20
cmp dword [rbx + 0x20], 0x200
jne 0x140066c69
mov eax, dword [rbx + 0x14]
shr eax, 6
test al, 1
je 0x140066c69
mov eax, dword [rbx + 0x14]
shr eax, 8
test al, 1
jne 0x140066c69
mov dword [rbx + 0x20], 0x1000
mov rax, qword [rbx]
cmp esi, 1
jne 0x140066c87
movzx ecx, byte [rax]
dec dword [rbx + 0x10]
shl cx, 8
movzx eax, bpl
or cx, ax
inc qword [rbx]
jmp 0x140066c92
movzx ecx, word [rax]
add dword [rbx + 0x10], 0xfffffffe
add qword [rbx], 2
movzx eax, cx
jmp 0x140066cae
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rbx + 0x14], eax
and dword [rbx + 0x10], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
jmp 0x140066b28