joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140023b50
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x158
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xd0], 0xfffffffffffffffe
mov rsi, r9
mov rdi, rcx
mov dword [r9], 0
mov dword [rbp + 0xcc], 0xffffffff
mov dword [rbp + 0xc8], 4
lea rbx, [rbp - 0x48]
mov rcx, rbx
call fcn.140022090
mov rcx, rbx
call fcn.140022330
lea rcx, [rbp + 0xc8]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0xcc]
mov rcx, rdi
mov rdx, rax
xor r8d, r8d
call sub.ADVAPI32.dll_RegQueryValueExW
test eax, eax
jne 0x140023c19
mov edi, dword [rbp + 0x120]
lea rcx, [rbp - 0x48]
call fcn.140022270
cmp dword [rbp + 0xcc], edi
sete cl
lea r8, [0x140023d80]
xor edx, edx
call fcn.140057ee0
mov eax, dword [rbp + 0xcc]
cmp eax, 4
je 0x140023c0d
cmp eax, 5
jne 0x140023cb0
mov eax, dword [rsi]
bswap eax
mov dword [rsi], eax
add rsp, 0x158
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov edi, eax
lea rcx, [0x1400beb30]
call fcn.14002da30
mov rsi, rax
lea rax, [0x140094df0]
mov qword [rsi], rax
mov qword [rsi + 8], 0
movups xmm0, xmmword [0x140094e58]
movups xmmword [rsi + 0x10], xmm0
movups xmm0, xmmword [0x140094e68]
movups xmmword [rsi + 0x20], xmm0
movups xmm0, xmmword [0x140094e78]
movups xmmword [rsi + 0x30], xmm0
movups xmm0, xmmword [0x140094e88]
movups xmmword [rsi + 0x40], xmm0
mov rax, qword [0x140094e98]
mov qword [rsi + 0x50], rax
lea rax, str.stdwindows_registry.d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0x281
mov qword [rsp + 0x20], reloc.WS2_32.dll_shutdown
lea r9, str.Cannot_read_the_requested_value
mov r8d, 0x1f
mov rcx, rsi
mov edx, edi
call fcn.140022450
mov rcx, rsi
call fcn.140011610
lea rcx, [0x1400beb30]
call fcn.14002da30
mov rsi, rax
lea rax, [0x140094df0]
mov qword [rsi], rax
mov qword [rsi + 8], 0
movups xmm0, xmmword [0x140094e58]
movups xmmword [rsi + 0x10], xmm0
movups xmm0, xmmword [0x140094e68]
movups xmmword [rsi + 0x20], xmm0
movups xmm0, xmmword [0x140094e78]
movups xmmword [rsi + 0x30], xmm0
movups xmm0, xmmword [0x140094e88]
movups xmmword [rsi + 0x40], xmm0
mov rax, qword [0x140094e98]
mov qword [rsi + 0x50], rax
lea rax, str.stdwindows_registry.d
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x297
lea r8, str.Cannot_read_the_given_value_as_a_32_bit_integer
mov edx, gethostbyaddr
mov r9d, reloc.WS2_32.dll_shutdown
mov rcx, rsi
call fcn.140022a40
mov rcx, rsi
call fcn.140011610
int3
Function at 0x140023e20
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x158
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xd0], 0xfffffffffffffffe
mov rsi, r9
mov rdi, rcx
mov qword [r9], 0
mov dword [rbp + 0xcc], 0xffffffff
mov dword [rbp + 0xc8], 8
lea rbx, [rbp - 0x48]
mov rcx, rbx
call fcn.140022090
mov rcx, rbx
call fcn.140022330
lea rcx, [rbp + 0xc8]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0xcc]
mov rcx, rdi
mov rdx, rax
xor r8d, r8d
call sub.ADVAPI32.dll_RegQueryValueExW
test eax, eax
jne 0x140023edc
mov esi, dword [rbp + 0x120]
lea rcx, [rbp - 0x48]
call fcn.140022270
cmp dword [rbp + 0xcc], esi
sete cl
lea r8, [0x140024050]
xor edx, edx
call fcn.140057ee0
cmp dword [rbp + 0xcc], 0xb
jne 0x140023f73
add rsp, 0x158
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov esi, eax
lea rcx, [0x1400beb30]
call fcn.14002da30
mov rdi, rax
lea rax, [0x140094df0]
mov qword [rdi], rax
mov qword [rdi + 8], 0
movups xmm0, xmmword [0x140094e58]
movups xmmword [rdi + 0x10], xmm0
movups xmm0, xmmword [0x140094e68]
movups xmmword [rdi + 0x20], xmm0
movups xmm0, xmmword [0x140094e78]
movups xmmword [rdi + 0x30], xmm0
movups xmm0, xmmword [0x140094e88]
movups xmmword [rdi + 0x40], xmm0
mov rax, qword [0x140094e98]
mov qword [rdi + 0x50], rax
lea rax, str.stdwindows_registry.d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0x2a5
mov qword [rsp + 0x20], reloc.WS2_32.dll_shutdown
lea r9, str.Cannot_read_the_requested_value
mov r8d, 0x1f
mov rcx, rdi
mov edx, esi
call fcn.140022450
mov rcx, rdi
call fcn.140011610
lea rcx, [0x1400beb30]
call fcn.14002da30
mov rsi, rax
lea rax, [0x140094df0]
mov qword [rsi], rax
mov qword [rsi + 8], 0
movups xmm0, xmmword [0x140094e58]
movups xmmword [rsi + 0x10], xmm0
movups xmm0, xmmword [0x140094e68]
movups xmmword [rsi + 0x20], xmm0
movups xmm0, xmmword [0x140094e78]
movups xmmword [rsi + 0x30], xmm0
movups xmm0, xmmword [0x140094e88]
movups xmmword [rsi + 0x40], xmm0
mov rax, qword [0x140094e98]
mov qword [rsi + 0x50], rax
lea rax, str.stdwindows_registry.d
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x2b0
lea r8, str.Cannot_read_the_given_value_as_a_64_bit_integer
mov edx, gethostbyaddr
mov r9d, reloc.WS2_32.dll_shutdown
mov rcx, rsi
call fcn.140022a40
mov rcx, rsi
call fcn.140011610
int3
Function at 0x1400240f0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x170
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xe8], 0xfffffffffffffffe
mov rsi, r9
mov rbx, r8
mov r14, rdx
mov rdi, rcx
xorps xmm0, xmm0
movups xmmword [r9], xmm0
mov dword [rbp + 0xe4], 0xffffffff
lea rcx, [0x1400b72e8]
mov edx, 0x64
call fcn.14002e9f0
mov r15, rdx
mov qword [rbp + 0xd0], 0x64
mov qword [rbp + 0xd8], rdx
mov ecx, 0x64
call fcn.140003aa0
mov dword [rbp + 0xe0], eax
lea r12, [rbp - 0x40]
mov rcx, r12
mov rdx, r14
mov r8, rbx
call fcn.140022090
mov rcx, r12
call fcn.140022330
lea r14, [rbp + 0xe0]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0xe4]
mov rcx, rdi
mov rdx, rax
xor r8d, r8d
call sub.ADVAPI32.dll_RegQueryValueExW
mov ebx, eax
cmp eax, 0xea
jne 0x1400241f3
mov edx, dword [rbp + 0xe0]
lea rcx, [rbp + 0xd0]
call fcn.140015e90
lea rcx, [rbp - 0x40]
call fcn.140022330
mov rcx, qword [rbp + 0xd8]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0xe4]
mov rcx, rdi
mov rdx, rax
xor r8d, r8d
call sub.ADVAPI32.dll_RegQueryValueExW
mov ebx, eax
test ebx, ebx
jne 0x140024264
mov eax, dword [rbp + 0x150]
cmp dword [rbp + 0xe4], eax
sete cl
lea r8, [0x1400243e0]
xor edx, edx
call fcn.140057ee0
cmp dword [rbp + 0xe4], 3
jne 0x1400242f9
mov edx, dword [rbp + 0xe0]
lea rcx, [rbp + 0xd0]
call fcn.140015e90
mov rax, qword [rbp + 0xd0]
mov qword [rsi], rax
mov rax, qword [rbp + 0xd8]
mov qword [rsi + 8], rax
lea rcx, [rbp - 0x40]
call fcn.140022270
nop
add rsp, 0x170
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
lea rcx, [0x1400beb30]
call fcn.14002da30
mov rsi, rax
lea rax, [0x140094df0]
mov qword [rsi], rax
mov qword [rsi + 8], 0
movups xmm0, xmmword [0x140094e58]
movups xmmword [rsi + 0x10], xmm0
movups xmm0, xmmword [0x140094e68]
movups xmmword [rsi + 0x20], xmm0
movups xmm0, xmmword [0x140094e78]
movups xmmword [rsi + 0x30], xmm0
movups xmm0, xmmword [0x140094e88]
movups xmmword [rsi + 0x40], xmm0
mov rax, qword [0x140094e98]
mov qword [rsi + 0x50], rax
lea rax, str.stdwindows_registry.d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0x2c7
mov qword [rsp + 0x20], reloc.WS2_32.dll_shutdown
lea r9, str.Cannot_read_the_requested_value
mov r8d, 0x1f
mov rcx, rsi
mov edx, ebx
call fcn.140022450
mov rcx, rsi
call fcn.140011610
lea rcx, [0x1400beb30]
call fcn.14002da30
mov rsi, rax
lea rax, [0x140094df0]
mov qword [rsi], rax
mov qword [rsi + 8], 0
movups xmm0, xmmword [0x140094e58]
movups xmmword [rsi + 0x10], xmm0
movups xmm0, xmmword [0x140094e68]
movups xmmword [rsi + 0x20], xmm0
movups xmm0, xmmword [0x140094e78]
movups xmmword [rsi + 0x30], xmm0
movups xmm0, xmmword [0x140094e88]
movups xmmword [rsi + 0x40], xmm0
mov rax, qword [0x140094e98]
mov qword [rsi + 0x50], rax
lea rax, str.stdwindows_registry.d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0x2d3
mov qword [rsp + 0x20], reloc.WS2_32.dll_shutdown
lea r9, str.Cannot_read_the_given_value_as_a_string
mov r8d, 0x27
mov rcx, rsi
xor edx, edx
call fcn.140022450
mov rcx, rsi
call fcn.140011610
int3
Function at 0x140024480
Capabilities:
Set registry value

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x168
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xe0], 0xfffffffffffffffe
mov esi, r9d
mov rdi, rcx
mov r14, qword [rbp + 0x140]
mov r15d, dword [rbp + 0x148]
mov qword [rbp + 0xd0], rdx
mov qword [rbp + 0xd8], r8
lea rbx, [rbp - 0x40]
mov rcx, rbx
call fcn.140022090
mov rcx, rbx
call fcn.140022330
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r14
mov rcx, rdi
mov rdx, rax
xor r8d, r8d
mov r9d, esi
call sub.ADVAPI32.dll_RegSetValueExW
test eax, eax
jne 0x140024511
lea rcx, [rbp - 0x40]
call fcn.140022270
nop
add rsp, 0x168
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov esi, eax
lea rcx, [0x1400beb30]
call fcn.14002da30
mov rdi, rax
lea rax, [0x140094df0]
mov qword [rdi], rax
mov qword [rdi + 8], 0
movups xmm0, xmmword [0x140094e58]
movups xmmword [rdi + 0x10], xmm0
movups xmm0, xmmword [0x140094e68]
movups xmmword [rdi + 0x20], xmm0
movups xmm0, xmmword [0x140094e78]
movups xmmword [rdi + 0x30], xmm0
movups xmm0, xmmword [0x140094e88]
movups xmmword [rdi + 0x40], xmm0
mov rax, qword [0x140094e98]
mov qword [rdi + 0x50], rax
lea rax, [0x140095022]
mov qword [rsp + 0x20], rax
lea rdx, str.Value_cannot_be_set:__
lea r8, [rbp + 0xd0]
mov ecx, reloc.WS2_32.dll_shutdown
mov r9d, 1
call fcn.1400158b0
mov r9, rdx
lea rcx, str.stdwindows_registry.d
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], 0x2de
mov qword [rsp + 0x20], reloc.WS2_32.dll_shutdown
mov rcx, rdi
mov edx, esi
mov r8, rax
call fcn.140022450
mov rcx, rdi
call fcn.140011610
int3

Function at 0x1400265e0
Capabilities:
Hash data using murmur3

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, r8
test rcx, rcx
je 0x140026663
mov rdi, rdx
mov rbx, rcx
xor r14d, r14d
movabs r15, 0x87c37b91114253d5
movabs r12, 0x88a129ea80000000
movabs r13, 0x4cf5ad432745937f
jmp 0x140026656
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, rax
imul rcx, r15
imul rax, r12
shr rcx, 0x21
or rcx, rax
imul rcx, r13
xor rcx, rsi
rol rcx, 0x1b
lea rsi, [rcx + rcx*4]
add rsi, 0x52dce729
inc r14
cmp rbx, r14
je 0x140026663
mov rcx, qword [rdi + r14*8]
test rcx, rcx
jne 0x140026620
xor eax, eax
jmp 0x140026626
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400267d0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, r8
call fcn.140042990
mov rcx, rax
and rcx, 0xfffffffffffffffc
je 0x14002682d
mov r8, rdx
add r8, rcx
xor r9d, r9d
nop
mov r10d, dword [rdx + r9]
imul r11d, r10d, 0xcc9e2d51
imul r10d, r10d, 0x16a88000
shr r11d, 0x11
or r11d, r10d
imul r10d, r11d, 0x1b873593
xor r10d, esi
rol r10d, 0xd
lea esi, [r10 + r10*4]
add esi, 0xe6546b64
add r9, 4
cmp rcx, r9
jne 0x1400267f0
mov rdx, r8
mov r8d, eax
and r8d, 3
xor ecx, ecx
cmp r8, 1
je 0x14002685b
cmp r8d, 2
je 0x14002684f
cmp r8d, 3
jne 0x140026879
movzx ecx, byte [rdx + 2]
shl ecx, 0x10
movzx r8d, byte [rdx + 1]
shl r8d, 8
or ecx, r8d
movzx edx, byte [rdx]
xor edx, ecx
imul ecx, edx, 0xcc9e2d51
imul edx, edx, 0x16a88000
shr ecx, 0x11
or ecx, edx
imul ecx, ecx, 0x1b873593
xor esi, ecx
xor eax, esi
mov ecx, eax
shr ecx, 0x10
xor ecx, eax
imul eax, ecx, 0x85ebca6b
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul ecx, ecx, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor eax, ecx
add rsp, 0x20
pop rsi
ret

Function at 0x140031810
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
test rdx, rdx
je 0x140031854
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
add rsi, 8
nop dword [rax]
mov r8d, dword [rsi - 8]
mov rdx, qword [rsi]
mov rcx, qword [rbx]
mov qword [rsp + 0x20], 0
xor r9d, r9d
call sub.KERNEL32.dll_WriteFile
add rsi, 0x10
dec rdi
jne 0x140031830
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret

Function at 0x1400322e0
Capabilities:
Resume thread

Disassembly:
push rsi
sub rsp, 0x20
mov eax, dword [0x1400c2a1c]
dec eax
cmp byte [0x1400c2a18], 0
mov rsi, qword [0x1400c2958]
mov dword [0x1400c2a1c], eax
jne 0x140032312
test rsi, rsi
je 0x140032312
test eax, eax
je 0x140032345
add rsp, 0x20
pop rsi
ret
test eax, eax
jne 0x140032334
jmp 0x14003232f
mov rcx, rsi
call fcn.14000ffa0
mov rsi, qword [rsi + 0xb8]
test rsi, rsi
jne 0x140032320
lea rcx, [0x1400c2968]
add rsp, 0x20
pop rsi
jmp fcn.140001e70
mov eax, dword [0x1400c2dc8]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rcx, qword [rax + 0x178]
add rsp, 0x20
pop rsi
jmp fcn.14000ffa0
Function at 0x140043570
Capabilities:
Query environment variable

Disassembly:
push rsi
sub rsp, 0x830
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
mov rcx, qword [str._NT_SYMBOL_PATH]
lea rdx, [rsp + 0x30]
mov r8d, 0x800
call sub.KERNEL32.dll_GetEnvironmentVariableA
test eax, eax
je 0x1400435c3
mov edx, eax
lea rsi, [rsp + 0x20]
lea r8, [rsp + 0x30]
mov rcx, rsi
call fcn.1400592a0
lea r8, [0x14009b805]
mov edx, 1
mov rcx, rsi
call fcn.1400592a0
mov rcx, qword [str._NT_ALTERNATE_SYMBOL_PATH]
lea rdx, [rsp + 0x30]
mov r8d, 0x800
call sub.KERNEL32.dll_GetEnvironmentVariableA
test eax, eax
je 0x140043606
mov edx, eax
lea rsi, [rsp + 0x20]
lea r8, [rsp + 0x30]
mov rcx, rsi
call fcn.1400592a0
lea r8, [0x14009b805]
mov edx, 1
mov rcx, rsi
call fcn.1400592a0
mov rcx, qword [str.SYSTEMROOT]
lea rdx, [rsp + 0x30]
mov r8d, 0x800
call sub.KERNEL32.dll_GetEnvironmentVariableA
test eax, eax
je 0x140043649
mov edx, eax
lea rsi, [rsp + 0x20]
lea r8, [rsp + 0x30]
mov rcx, rsi
call fcn.1400592a0
lea r8, [0x14009b805]
mov edx, 1
mov rcx, rsi
call fcn.1400592a0
lea r8, [0x14009b807]
lea rcx, [rsp + 0x20]
mov edx, 1
call fcn.1400592a0
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
add rsp, 0x830
pop rsi
ret

Function at 0x140043e50
Capabilities:
Enumerate pe sections

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
xor ebx, ebx
mov edx, 0
test bl, bl
jne 0x140043f4d
movzx eax, word [rcx]
xor ebx, ebx
mov edx, 0
cmp eax, 0x5a4d
jne 0x140043f4d
movsxd rax, dword [rcx + 0x3c]
cmp word [rcx + rax + 6], 0
je 0x140043f57
lea rsi, str..minfo
mov ebp, 6
lea r12, [rcx + rax]
mov r15, rcx
movzx eax, word [rcx + rax + 0x14]
lea r14, [rax + r12]
add r14, 0x18
xor ebx, ebx
mov rdi, r14
xor r13d, r13d
cmp ebp, 8
jne 0x140043f12
nop word cs:[rax + rax]
mov ecx, 6
mov r8d, 6
mov rdx, rsi
mov r9, rdi
call fcn.140014e80
test al, al
jne 0x140043f32
inc r13
movzx eax, word [r12 + 6]
add rdi, 0x28
cmp r13, rax
jb 0x140043ed0
jmp 0x140043f59
inc r13
movzx eax, word [r12 + 6]
add rdi, 0x28
cmp r13, rax
jae 0x140043f59
mov ecx, 6
mov r8d, 6
mov rdx, rsi
mov r9, rdi
call fcn.140014e80
test al, al
je 0x140043f00
cmp byte [rdi + rbp], 0
jne 0x140043f00
lea rax, [r13*4]
add rax, r13
mov ebx, dword [r14 + rax*8 + 8]
mov eax, dword [r14 + rax*8 + 0xc]
add r15, rax
mov rdx, r15
cmp rbx, 8
jae 0x140043f61
xor eax, eax
jmp 0x140043fa8
xor ebx, ebx
xor edx, edx
cmp rbx, 8
jb 0x140043f53
mov rax, rbx
shr rax, 3
xor esi, esi
xor ecx, ecx
nop dword [rax]
cmp qword [rdx + rcx*8], 1
sbb rsi, 0xffffffffffffffff
inc rcx
cmp rax, rcx
jne 0x140043f70
cmp rsi, rax
je 0x140043fa8
mov rdi, rax
mov r14, rdx
lea rcx, [rsi*8]
call fcn.14006f9ec
mov rcx, rax
cmp rbx, 8
jae 0x140043fb9
mov rax, rsi
mov rdx, rcx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor eax, eax
xor edx, edx
mov r8, r14
mov r9, rdi
jmp 0x140043fd8
inc rdx
cmp r9, rdx
je 0x140043fa2
mov r10, qword [r8 + rdx*8]
test r10, r10
je 0x140043fd0
mov qword [rcx + rax*8], r10
inc rax
jmp 0x140043fd0
Function at 0x140043ff0
Capabilities:
Enumerate pe sections

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
xor eax, eax
mov edx, 0
cmp rdi, 9
jae 0x1400440de
mov rsi, r8
movzx r8d, word [rcx]
xor eax, eax
mov edx, 0
cmp r8d, 0x5a4d
jne 0x1400440de
movsxd rax, dword [rcx + 0x3c]
cmp word [rcx + rax + 6], 0
je 0x1400440da
lea r12, [rcx + rax]
mov r15, rcx
movzx eax, word [rcx + rax + 0x14]
lea r14, [rax + r12]
add r14, 0x18
mov rbx, r14
xor r13d, r13d
cmp rdi, 8
jne 0x1400440a2
nop
mov rcx, rdi
mov rdx, rsi
mov r8, rdi
mov r9, rbx
call fcn.140014e80
test al, al
jne 0x1400440bd
inc r13
movzx eax, word [r12 + 6]
add rbx, 0x28
cmp r13, rax
jb 0x140044060
xor edx, edx
xor eax, eax
jmp 0x1400440de
inc r13
movzx eax, word [r12 + 6]
add rbx, 0x28
cmp r13, rax
jae 0x140044087
mov rcx, rdi
mov rdx, rsi
mov r8, rdi
mov r9, rbx
call fcn.140014e80
test al, al
je 0x140044090
cmp byte [rbx + rdi], 0
jne 0x140044090
mov rdx, r15
lea rcx, [r13*4]
add rcx, r13
mov eax, dword [r14 + rcx*8 + 8]
mov ecx, dword [r14 + rcx*8 + 0xc]
add rdx, rcx
jmp 0x1400440de
xor eax, eax
xor edx, edx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140044c50
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
xor edx, edx
mov r8d, 2
call fcn.140069edc
test eax, eax
jne 0x140044ccc
mov rcx, rsi
call fcn.14006a1e8
cmp eax, 0xffffffff
je 0x140044ccc
mov ebx, eax
test eax, eax
je 0x140044cbf
movsxd rdx, ebx
mov rcx, rdi
call fcn.140014df0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
call fcn.140069edc
mov r8, qword [rdi]
mov rcx, qword [rdi + 8]
mov edx, 1
mov r9, rsi
call fcn.14006ea58
cmp rax, qword [rdi]
jne 0x140044ccc
mov rcx, rsi
call fcn.140069844
cmp eax, 0xffffffff
jne 0x140044ccc
test ebx, ebx
setne al
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
ud2

Function at 0x140045640
Capabilities:
Get memory capacity

Disassembly:
push rsi
sub rsp, 0x60
mov rsi, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x20], 0x40
lea rcx, [rsp + 0x20]
call sub.KERNEL32.dll_GlobalMemoryStatusEx
test eax, eax
je 0x1400456bd
mov rax, qword [rsp + 0x28]
shr rax, 2
movabs rcx, 0x28f5c28f5c28f5c3
mul rcx
shr rdx, 2
mov ecx, dword [rsp + 0x24]
cmp ecx, 0x5f
jb 0x1400456a5
mov al, 1
cmp rdx, rsi
jae 0x1400456a5
add rsp, 0x60
pop rsi
ret
cmp ecx, 0x5a
jb 0x1400456bd
add rdx, rdx
lea rax, [rdx + rdx*4]
cmp rax, rsi
setb al
add rsp, 0x60
pop rsi
ret
xor eax, eax
add rsp, 0x60
pop rsi
ret
Function at 0x14004c620
Capabilities:
Link many functions at runtime

Disassembly:
push rsi
sub rsp, 0x20
lea rax, [0x1400c2d40]
cmp qword [0x1400c2d38], 0
je 0x14004c63c
add rsp, 0x20
pop rsi
ret
mov rsi, rax
lea rcx, str.dbghelp.dll
call sub.KERNEL32.dll_LoadLibraryA
mov qword [0x1400c2d38], rax
test rax, rax
je 0x14004c81a
lea rdx, str.SymInitialize
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1400c2d40], rax
mov rcx, qword [0x1400c2d38]
lea rdx, str.SymCleanup
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1400c2d48], rax
mov rcx, qword [0x1400c2d38]
lea rdx, str.StackWalk64
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1400c2d50], rax
mov rcx, qword [0x1400c2d38]
lea rdx, str.SymGetOptions
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1400c2d58], rax
mov rcx, qword [0x1400c2d38]
lea rdx, str.SymSetOptions
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1400c2d60], rax
mov rcx, qword [0x1400c2d38]
lea rdx, str.SymFunctionTableAccess64
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1400c2d68], rax
mov rcx, qword [0x1400c2d38]
lea rdx, str.SymGetLineFromAddr64
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1400c2d70], rax
mov rcx, qword [0x1400c2d38]
lea rdx, str.SymGetModuleBase64
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1400c2d78], rax
mov rcx, qword [0x1400c2d38]
lea rdx, str.SymGetModuleInfo64
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1400c2d80], rax
mov rcx, qword [0x1400c2d38]
lea rdx, str.SymGetSymFromAddr64
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1400c2d88], rax
mov rcx, qword [0x1400c2d38]
lea rdx, str.UnDecorateSymbolName
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1400c2d90], rax
mov rcx, qword [0x1400c2d38]
lea rdx, str.SymLoadModule64
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1400c2d98], rax
mov rcx, qword [0x1400c2d38]
lea rdx, str.SymGetSearchPath
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1400c2da0], rax
mov rcx, qword [0x1400c2d38]
lea rdx, str.SymSetSearchPath
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1400c2da8], rax
mov rcx, qword [0x1400c2d38]
lea rdx, str.SymUnloadModule64
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1400c2db0], rax
mov rcx, qword [0x1400c2d38]
lea rdx, str.SymRegisterCallback64
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1400c2db8], rax
mov rcx, qword [0x1400c2d38]
lea rdx, str.ImagehlpApiVersion
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1400c2dc0], rax
mov rax, rsi
add rsp, 0x20
pop rsi
ret
xor eax, eax
add rsp, 0x20
pop rsi
ret
Function at 0x1400585d0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push rbp
push rax
mov rbp, rsp
mov byte [rbp + 7], 0
mov rax, qword gs:[0x60]
mov al, byte [rax + 2]
mov byte [rbp + 7], al
cmp byte [rbp + 7], 0
setne al
add rsp, 8
pop rbp
ret

Function at 0x14005b2bc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14005b306
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14005b306
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14005b306
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14005b306
cmp dword [rcx + 0x84], 0xe
jbe 0x14005b306
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14005b308
xor al, al
add rsp, 0x28
ret

Function at 0x14005d040
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14005d068
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14005d068
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x1400682ac
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, edx
mov rbp, rcx
test r8, r8
jne 0x1400682e3
call fcn.14006908c
mov dword [rax], reloc.WS2_32.dll_shutdown
call fcn.140072d90
xor eax, eax
jmp 0x140068371
mov rdx, r9
mov rcx, r8
call fcn.140068394
mov rbx, rax
test rax, rax
je 0x14006836e
lea rax, [rsp + 0x50]
mov rdx, rsi
mov qword [rsp + 0x28], rax
lea r8, [0x1400683f8]
mov eax, dword [rsp + 0x60]
mov r9, rbx
mov rcx, rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x14006835b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400690cc
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140068342
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x140068351
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call fcn.140072c78
jmp 0x14006836e
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14006836b
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
mov rdi, rdx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret