joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140105200
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
nop
add rsp, 0x70768d8d
sub rsp, 0x70768dad
mov r8, qword [rcx + 0x648]
xor esi, esi
mov rbx, rcx
test r8, r8
je 0x14010523b
mov rdi, qword [rcx + 0x640]
jmp 0x140105242
mov rdi, rsi
nop dword [rax]
test r8, r8
je 0x14010525b
mov rax, qword [rbx + 0x640]
lea rcx, [rax + r8*8]
jmp 0x14010525e
mov rcx, rsi
cmp rdi, rcx
je 0x14010547d
mov rax, qword [rdi]
cmp qword [rax + 0x28], rdx
je 0x14010527d
add rdi, 8
jmp 0x140105242
test r8, r8
je 0x140105341
cmp rdi, qword [rbx + 0x640]
jb 0x140105341
mov rax, qword [rbx + 0x640]
lea rcx, [rax + r8*8]
cmp rdi, rcx
jae 0x140105341
mov rdx, rdi
nop word [rax + rax]
mov rcx, qword [rbx + 0x648]
test rcx, rcx
je 0x1401052d4
mov rax, qword [rbx + 0x640]
lea rax, [rax + rcx*8]
jmp 0x1401052d7
mov rax, rsi
neg rax
add rax, 8
neg rax
cmp rdx, rax
jae 0x1401052fa
mov rax, qword [rdx + 8]
mov qword [rdx], rax
sub rdx, 0xfffffffffffffff8
jmp 0x1401052b4
test rcx, rcx
je 0x140105341
lea rax, [rcx - 1]
mov qword [rbx + 0x648], rax
test rax, rax
jne 0x140105341
mov rcx, qword [rbx + 0x640]
test rcx, rcx
je 0x140105333
call fcn.140098be0
mov qword [rbx + 0x640], rsi
mov qword [rbx + 0x650], rsi
mov qword [rbx + 0x648], rsi
mov rcx, qword [rdi]
test rcx, rcx
je 0x140105363
mov rax, qword [rcx]
mov edx, 0x4572881b
xor edx, 0x60e5f16f
sub edx, 0x25977973
call qword [rax]
cmp qword [rbx + 0x648], rsi
je 0x14010547d
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1400efb00
mov rcx, qword [rsp + 0x30]
mov r10d, 0xf70dfe4
add r10d, 0x6a449e56
sub r10d, 0x79b57d9a
mov r8d, dword [rsp + 0x34]
mov eax, ecx
mov r9, qword [rbx + 0x648]
sub eax, r8d
cdq
idiv dword [rbx + 0x648]
cmp eax, r10d
cmovl r10d, eax
test r9, r9
je 0x14010542e
mov rdx, qword [rbx + 0x640]
lea r11, [rdx + r9*8]
cmp rdx, r11
je 0x14010542e
mov r9d, r10d
xor r9d, 0x237b4707
xor r8d, 0x237b4707
nop dword [rax]
mov rcx, qword [rdx]
mov eax, esi
xor eax, 0x237b4707
add esi, r10d
add rdx, 8
mov dword [rcx + 0x30], eax
mov dword [rcx + 0x34], 0x30cf9876
add dword [rcx + 0x34], 0x142b8881
sub dword [rcx + 0x34], 0x217fd9f0
mov dword [rcx + 0x38], r9d
mov dword [rcx + 0x3c], r8d
cmp rdx, r11
jne 0x1401053ea
mov rcx, qword [rsp + 0x30]
mov r8d, dword [rsp + 0x34]
mov rax, qword [rbx + 0x660]
test rax, rax
je 0x140105475
sub ecx, r8d
mov dword [rax + 0x14], 0x49324878
add dword [rax + 0x14], 0x10e735fe
xor dword [rax + 0x14], 0x7a3e22e7
add dword [rax + 0x14], 0x353ea76
xor ecx, 0x237b4707
xor r8d, 0x237b4707
mov dword [rax + 0x10], ecx
mov dword [rax + 0x18], r8d
mov dword [rax + 0x1c], r8d
mov rcx, rbx
call fcn.1400ef220
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
pop rdi
ret
Function at 0x140105559
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx]
mov rbx, rcx
call qword [rax + 0x78]
mov rdx, qword [rbx + 0x648]
mov rcx, rax
mov qword [rsp + 0x30], rax
call fcn.140101730
lea rcx, [rbx + 0x640]
lea rdx, [rsp + 0x30]
call fcn.1401050b0
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x1401054a0
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x648], 0
mov rbx, rcx
je 0x1401055d1
lea rdx, [rsp + 0x30]
call fcn.1400efb00
mov r8, qword [rsp + 0x30]
mov r11d, 0x258a146c
xor r11d, 0x5e129943
sub r11d, 0x7b988c8f
mov r9d, dword [rsp + 0x34]
mov eax, r8d
sub eax, r9d
cdq
idiv dword [rbx + 0x648]
mov rdx, qword [rbx + 0x648]
cmp eax, r11d
cmovl r11d, eax
xor r10d, r10d
test rdx, rdx
je 0x140105587
mov rax, qword [rbx + 0x640]
mov qword [rsp + 0x38], rdi
lea rdi, [rax + rdx*8]
cmp rax, rdi
je 0x140105582
mov r8d, r11d
xor r8d, 0x237b4707
xor r9d, 0x237b4707
nop word [rax + rax]
mov rdx, qword [rax]
mov ecx, r10d
xor ecx, 0x237b4707
add r10d, r11d
neg rax
add rax, 0xfffffffffffffff8
neg rax
mov dword [rdx + 0x30], ecx
mov dword [rdx + 0x34], 0x3c976ad0
xor dword [rdx + 0x34], 0x4e0fad1c
sub dword [rdx + 0x34], 0x4f1d80c5
mov dword [rdx + 0x38], r8d
mov dword [rdx + 0x3c], r9d
cmp rax, rdi
jne 0x140105536
mov r8, qword [rsp + 0x30]
mov r9d, dword [rsp + 0x34]
mov rdi, qword [rsp + 0x38]
mov rax, qword [rbx + 0x660]
test rax, rax
je 0x1401055c9
sub r8d, r9d
mov dword [rax + 0x14], 0x343430ff
add dword [rax + 0x14], 0x3cfb5dd5
xor dword [rax + 0x14], 0x5254c9d3
xor r8d, 0x237b4707
xor r9d, 0x237b4707
mov dword [rax + 0x10], r8d
mov dword [rax + 0x18], r9d
mov dword [rax + 0x1c], r9d
mov rcx, rbx
call fcn.1400ef220
add rsp, 0x20
pop rbx
ret
Function at 0x140118dc8
Capabilities:
Encode data using xor

Disassembly:
xchg rbp, rbx
mov qword [rsp + 0x10], rbp
xchg rbp, rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov dword [rsp - 0x3c], 0x2e01fc62
nop
push r12
mov qword [rsp], rbp
xchg r15, rsp
mov rbp, r15
xchg r15, rsp
add rsp, 0x33b15acb
sub rsp, 0x33b15b4b
xor esi, esi
xchg r14, r14
mov dword [rbp - 0x50], 0x10863117
xor dword [rbp - 0x50], 0x6d41e351
sub dword [rbp - 0x50], 0x4f8c9322
sub dword [rbp - 0x50], 0x2e2e3e41
mov dword [rbp - 0x4c], 0x8266f6a
xor dword [rbp - 0x4c], 0x1388fb35
add dword [rbp - 0x4c], 0x21fd42ba
add dword [rbp - 0x4c], 0x2b17a750
xor dword [rbp - 0x4c], 0x68997ee3
mov dword [rbp - 0x48], 0x46188731
sub dword [rbp - 0x48], 0x3b8f6a06
add dword [rbp - 0x48], 0x3aeb3b59
sub dword [rbp - 0x48], 0x456d578e
mov dword [rbp - 0x44], 0x4675f437
xor dword [rbp - 0x44], 0x45bd81ce
xor dword [rbp - 0x44], 0x6d604e8c
sub dword [rbp - 0x44], 0x6e533ae0
mov qword [rbp + 0x10], rsi
mov rbp, rbp
lea ebx, [rsi + 1]
xchg rcx, rax
mov rcx, qword [rbp + 0x10]
xchg rcx, rax
xchg r8, rcx
mov r8, qword [rbp + 0x10]
xchg r8, rcx
xchg rdx, rax
mov rdx, qword [rbp + 0x10]
xchg rdx, rax
and cl, 3
shl cl, 1
shl cl, 1
shl cl, 1
movzx edx, word [rbp + rax*2 - 0x50]
mov dword [rsp - 0x44], ebx
mov eax, 0x6e3f0785
xor eax, 0x28854e48
sub eax, 0x2d5e4779
add eax, 0x695d5f
shr eax, cl
movzx ecx, al
mov dword [rsp - 0x10], esi
mov rax, qword [rbp + 0x10]
xor cx, dx
mov word [rbp + rax*2 - 0x20], cx
mov rax, qword [rbp + 0x10]
xchg rsi, rsi
add rax, rbx
xchg rdx, rax
mov qword [rbp + 0x10], rdx
xchg rdx, rax
xchg rsp, rax
mov rsp, qword [rbp + 0x10]
xchg rsp, rax
cmp rax, 8
jb 0x140118e91
lea rax, [rbp - 0x20]
mov dword [rsp - 0x1c], 0x64c79c4f
mov word [rbp - 0x10], si
xorps xmm0, xmm0
xchg rdi, rax
mov qword [rbp - 0x38], rdi
xchg rdi, rax
lea r9, [rbp - 0x30]
mov dword [rsp - 0x30], ebx
mov dword [rbp - 0x40], 0x71d69caf
xor dword [rbp - 0x40], 0x14d80e77
sub dword [rbp - 0x40], 0xeb4c719
add dword [rbp - 0x40], 0x11ba3cb9
xor dword [rbp - 0x40], 0x68060868
lea r8, [rbp - 0x40]
mov dword [rsp + 0x20], esi
mov rdx, rdx
xor edx, edx
xor ecx, ecx
xchg r13, rbp
movups xmmword [r13 - 0x30], xmm0
xchg r13, rbp
call fcn.140133ad0
xchg rdi, rax
mov rax, rdi
xchg rdi, rax
test rax, rax
je 0x140118fb5
mov dword [rsp - 0x28], 0x456e7b54
mov rcx, rax
call fcn.14010f6dc
test al, al
je 0x140118fb5
mov dword [rsp - 0x24], esi
lea rdx, [rbp - 0x40]
xchg r14, rcx
mov r14, rdi
xchg r14, rcx
call fcn.14010e5f4
test al, al
jne 0x140118fb8
mov dword [rsp - 0xc], 0x100ca794
mov bl, sil
xor eax, eax
lea r11, [rsp + 0x80]
xchg rsi, rcx
mov rcx, qword [r11 + 0x20]
xchg rsi, rcx
lea rdi, [rbp - 0x20]
lea ecx, [rax + 8]
rep stosb byte [rdi], al
xchg rcx, rcx
xchg rdi, r12
mov r12, qword [r11 + 0x28]
xchg rdi, r12
mov al, bl
mov dword [rsp - 0x14], 0x46d31707
mov rbx, qword [r11 + 0x18]
xchg r13, rsp
mov r13, r11
xchg r13, rsp
nop
mov rbp, qword [rsp]
add rsp, 8
ret
Function at 0x140133ad0
Capabilities:
Execute syscall

Disassembly:
xchg r10, rsi
mov rsi, rcx
xchg rsi, r10
mov eax, dword [0x140143004]
mov rdi, rdi
cmp qword [0x140143018], 0
jne 0x14008d4c0
syscall
ret
jmp 0x14008dfeb

Function at 0x140133c50
Capabilities:
Hash data using murmur3

Disassembly:
xchg rcx, rbx
mov qword [rsp + 8], rcx
xchg rbx, rcx
mov qword [rsp + 0x10], rbp
mov dword [rsp - 0x38], ebx
mov qword [rsp + 0x18], rsi
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x50]
xchg rbp, rbp
test rcx, rcx
je 0x140133d53
movabs rax, 0x709cb3f32b9cd579
sub rax, 0x144d0b5c
xor rax, 0x710b6dcf
add rax, 0x37eeeb1e
movabs rdx, 0xde10096a604c4c94
sub rdx, 0x51231bbd
xor rdx, 0x676f13f3
sub rdx, 0x700ec48
add rdx, qword [0x140142310]
ror rdx, 0x27
ror rdx, 8
ror rdx, 1
ror rdx, 2
ror rdx, 1
ror rdx, 3
ror rdx, 1
sub rdx, rax
movabs rax, 0x238210721fa414f5
sub rax, 0x1af6c16c
add rax, 0x10c9b43c
add rax, 0x7fffffff
xor rax, 0x3b0fa7bf
ror rdx, 0x2e
ror rdx, 2
ror rdx, 1
ror rdx, 1
ror rdx, 1
add rax, rdx
mov dword [rsp - 0x3c], 0x585cc65a
movabs rdx, 0x480762451401d1bd
add rdx, 0x1a49b7ef
xor rdx, 0x38d7e339
add rdx, 0x7fffffff
add rdx, 0x10d7a9a0
xor rax, rdx
call rax
mov r12, r12
xchg rcx, r12
mov r12, qword [rbx + 0x48]
xchg rcx, r12
movabs rdi, 0x1d19b9493c5eecb1
sub rdi, 0xa68c250
add rdi, 0x9f98b70
xor rdi, 0x7d4f270c
add rdi, 0x7fffffff
sub rdi, 0x17846f3c
movabs rsi, 0x4cee04031cb91f7d
sub rsi, 0x9f28490
add rsi, 0x286cd61b
xor rsi, 0x3f93a054
movabs rbp, 0x1f1080c75ae242fb
xor rbp, 0x30e7585a
sub rbp, 0xcd6934f
sub rbp, 0x28b24e1d
add rbp, 0x4dde32eb
test rcx, rcx
mov dword [rsp - 0x10], 0x2bd6387b
je 0x140133e18
mov rax, qword [0x1401425c0]
xor rax, rdi
xchg rdi, rdi
rol rax, 0x2b
rol rax, 6
rol rax, 2
rol rax, 1
not rax
sub rax, rsi
mov rbp, rbp
xor rax, rbp
rol rax, 0xd
rol rax, 2
rol rax, 1
rol rax, 1
call rax
xchg rsp, rcx
mov rsp, qword [rbx + 0x40]
xchg rcx, rsp
test rcx, rcx
je 0x140133e74
mov rsi, rsi
mov rax, qword [0x1401425c0]
xor rax, rdi
rol rax, 2
rol rax, 0x11
rol rax, 0xb
rol rax, 1
rol rax, 3
rol rax, 0xc
rol rax, 1
rol rax, 3
rol rax, 1
rol rax, 1
not rax
sub rax, rsi
xor rax, rbp
mov rcx, rcx
rol rax, 0xf
rol rax, 1
rol rax, 1
call rax
xchg rbx, rbp
mov rbp, qword [rsp + 0x30]
xchg rbp, rbx
xchg r12, rbp
mov r12, qword [rsp + 0x38]
xchg r12, rbp
xchg rsi, r12
mov r12, qword [rsp + 0x40]
xchg rsi, r12
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x1401362c0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r11
mov qword [rsp + 8], r11
xchg r11, rbx
mov qword [rsp + 0x10], rsi
xchg rdx, rdi
mov qword [rsp + 0x18], rdx
xchg rdi, rdx
push rbp
nop
sub rsp, 8
mov qword [rsp], r12
nop
sub rsp, 8
mov qword [rsp], r14
xchg rdi, rbp
mov rdi, rsp
xchg rbp, rdi
nop
add rsp, 0x15564e5e
sub rsp, 0x15564ece
mov rdi, r8
xchg rsp, rdx
mov r14, rsp
xchg rdx, rsp
xchg rsi, rcx
mov rcx, rsi
xchg rsi, rcx
movabs r12, 0x654f3f3c18ca1566
xor r12, 0x44ecc839
sub r12, 0x446db036
xor r12, 0x4e19e0ad
sub r12, 0x3a796e2d
cmp r9d, 0x60001
mov dword [rsp - 0x18], ebp
jne 0x1401364c1
mov dword [rbp - 0x40], 0x5216e982
xor dword [rbp - 0x40], 0x4259bbac
xor dword [rbp - 0x40], 0x6a25cd8c
sub dword [rbp - 0x40], 0x207db138
xor edx, edx
mov dword [rbp - 0x3c], 0x61b153f9
sub dword [rbp - 0x3c], 0x6e1b89
sub dword [rbp - 0x3c], 0x4e9905ec
xor dword [rbp - 0x3c], 0xa2b5636
mov dword [rbp - 0x38], 0x634a46f8
sub dword [rbp - 0x38], 0x57458671
xor dword [rbp - 0x38], 0x36c02b6b
add dword [rbp - 0x38], 0xba501c06
mov ecx, edx
xchg r12, r12
mov eax, 0x26b79a5
add eax, 0x7a4a084c
sub eax, 0x6157dc48
xor eax, 0x3ce5d482
rol eax, cl
mov dword [rsp - 0x24], esi
xor al, byte [rbp + rdx - 0x40]
mov byte [rbp + rdx - 0x34], al
inc rdx
cmp rdx, 0xc
mov dword [rsp - 0x40], edx
jb 0x1401363a8
mov r9d, 0x4c83bbb8
xor r9d, 0x8e4cb4c
sub r9d, 0x13f2c3eb
sub r9d, 0xf03de9
xor r9d, 0x2f8460df
mov qword [rsp + 0x20], 0x15b10504
add qword [rsp + 0x20], 0xc55c26d
add qword [rsp + 0x20], 0x4d56f267
sub qword [rsp + 0x20], 0x6f5db9cc
lea r8, [rbp - 0x34]
xchg rsp, rsp
xchg rdx, rcx
mov rcx, rdi
xchg rdx, rcx
mov rcx, r14
mov r11, r11
call fcn.140133704
xchg rbx, rax
mov rax, rbx
xchg rbx, rax
lea rdi, [rbp - 0x34]
xor eax, eax
lea ecx, [rax + 0xc]
mov dword [rsp - 0x38], ebx
rep stosb byte [rdi], al
test rbx, rbx
je 0x1401364f2
lea rdx, [rbp - 0x28]
mov r14, r14
lea rcx, [rbx + 0xc]
call fcn.14008f8f8
test dword [rbp - 7], 0x1000
xchg rbx, rbx
jne 0x1401364f2
cmp byte [rbp - 0x1d], 0xe8
jne 0x1401364f2
xchg r10, r10
lea rdx, [rbx + 0xc]
mov rcx, r14
call fcn.140085160
movzx edx, byte [rbp - 0x28]
mov dword [rsp - 0x34], 0x3ea39393
add edx, dword [rbp - 0x13]
add edx, eax
mov rax, qword [rsi + 8]
xor rax, r12
xchg r10, r10
add rdx, rax
xor rdx, r12
mov qword [rsi + 0x20], rdx
mov r10, r10
cmp qword [rsi + 0x20], r12
setne al
lea r11, [rsp + 0x70]
mov r13, r13
xchg rbx, r12
mov r12, qword [r11 + 0x20]
xchg r12, rbx
mov rsi, qword [r11 + 0x28]
xchg r9, r9
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop r12
mov dword [rsp - 0x14], ebx
pop rbp
ret
xor al, al
jmp 0x1401364c8
Function at 0x140001480
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [str.td_f_]
mov dword [rax], 1
mov rax, qword [str.xd_f_]
mov dword [rax], 1
mov rax, qword [str.d_f_]
mov dword [rax], 1
mov rax, qword [str.Pd_f_]
mov dword [rax], 1
mov rax, qword [0x1400bd670]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400014de
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x14000150a
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x140001530
cmp eax, 0x20b
je 0x140001557
jmp 0x140001586
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x140001543
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x14000158b
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x140001572
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x14000158b
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140004e00
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
sub rsp, 0x28
xor r8d, r8d
mov r13, rcx
mov r12, rdx
test rdx, rdx
je 0x140004e21
mov rcx, rdx
call sub.msvcrt.dll_strlen
mov r8, rax
mov rcx, r12
mov r9, r13
mov edx, 1
call sub.msvcrt.dll_fwrite
mov rcx, r13
add rsp, 0x28
pop r12
pop r13
jmp fcn.140026950

Function at 0x14000bd80
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x30
cmp qword [0x1400c6150], 0
mov r12, rcx
mov rbx, rdx
je 0x14000bde0
lea r13, [rsp + 0x20]
mov rdx, rcx
mov rcx, r13
call fcn.14000bc10
mov r12, qword [rsp + 0x28]
mov rcx, r13
call qword [0x1400c6150]
test r12, r12
je 0x14000bdc4
test byte [r12 + 7], 0x40
je 0x14000be18
lea rcx, [0x140033300]
call fcn.140020f80
cmp byte [rax], 0
jne 0x14000be38
add rsp, 0x30
pop rbx
pop r12
pop r13
ret
mov ecx, 2
call qword [fcn.140027070]
mov rcx, r12
mov r8, rbx
mov edx, 1
mov r13, rax
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rcx, r13
add rsp, 0x30
pop rbx
pop r12
pop r13
jmp fcn.140026950
lea rcx, [0x140033320]
call fcn.140020f80
mov rdx, r12
mov rcx, rax
call fcn.140006eb0
jmp 0x14000bdc4
mov byte [rax], 0
lea rcx, [0x140033200]
call fcn.140020f80
xor r8d, r8d
mov rcx, rax
mov rax, qword [rax]
mov rdx, qword [rax + 0x38]
add rsp, 0x30
pop rbx
pop r12
pop r13
jmp fcn.14000a950
Function at 0x14000cfb0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
lea r14, [0x1400c6120]
xor r12d, r12d
lea rdi, [0x140033300]
mov rsi, rcx
mov rbx, rdx
lea rbp, [rsp + 0x20]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r13, qword [fcn.140027070]
jmp 0x14000cffa
add r12, 1
jo 0x14000d0c8
cmp r12, rbx
jge 0x14000d050
test r12, r12
js 0x14000d0a8
mov r15, r12
mov ecx, 1
call r13
shl r15, 4
xor r8d, r8d
mov rdx, rbp
add r15, rsi
mov rcx, rax
movdqu xmm0, xmmword [r15]
movaps xmmword [rsp + 0x20], xmm0
call fcn.14000ce60
mov rcx, rdi
call fcn.140020f80
cmp byte [rax], 0
je 0x14000cff0
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rbx, qword [fcn.140027070]
mov ecx, 1
call rbx
mov r8d, 1
mov edx, 1
lea rcx, [0x1400ba3a1]
mov r9, rax
call sub.msvcrt.dll_fwrite
mov ecx, 1
call rbx
mov rcx, rax
call fcn.140026950
mov rcx, r14
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rdx, [rbx - 1]
mov rcx, r12
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.14000acb0
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.140008470
Function at 0x14001fc30
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call fcn.140027070
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call fcn.140027070
mov r8, rbx
mov rdx, qword [rbp + 0x20]
mov rcx, rax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop

Function at 0x140020862
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x1400c6508]
test eax, eax
je 0x1400208fa
lea rax, [0x1400c64e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x1400c6510]
mov qword [rbp - 8], rax
jmp 0x1400208de
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x1400208d2
cmp qword [rbp - 0x10], 0
je 0x1400208d2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140020898
lea rax, [0x1400c64e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x1400208fb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x140020a00
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x140020a28
mov eax, 0
jmp 0x140020a76
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140020a51
mov eax, 0
jmp 0x140020a76
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x140020a71
mov eax, 0
jmp 0x140020a76
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x140020a7c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x140020afa
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x140020af1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x140020af1
mov rax, qword [rbp - 8]
jmp 0x140020b0f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x140020ac4
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140028464
Capabilities:
Print debug messages

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x90
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
cmp qword [rbp + 0x10], 0
je 0x1400285ae
mov rcx, qword [rbp + 0x10]
call fcn.14002ca3d
cmp eax, 1
jne 0x1400285a1
movabs rax, 0x6c6320726f727245
movabs rdx, 0x7520676e696e6165
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rdx
movabs rax, 0x6b5f6e6970732070
movabs rdx, 0x20726f6620737965
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rdx
movabs rax, 0x20646165726874
mov edx, 0
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rdx
mov qword [rbp - 0x40], 0
mov qword [rbp - 0x38], 0
mov qword [rbp - 0x30], 0
mov qword [rbp - 0x28], 0
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x18], 0
mov qword [rbp - 0x10], 0
mov word [rbp - 8], 0
mov byte [rbp - 6], 0
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call rax
mov ecx, eax
lea rax, [rbp - 0x70]
add rax, 0x27
mov r8d, 0xa
mov rdx, rax
mov rax, qword [sym.imp.msvcrt.dll__ultoa]
call rax
mov dword [rbp - 4], 0x27
jmp 0x140028557
add dword [rbp - 4], 1
mov eax, dword [rbp - 4]
cdqe
movzx eax, byte [rbp + rax - 0x70]
test al, al
je 0x14002856d
mov eax, dword [rbp - 4]
cmp eax, 0x69
jbe 0x140028553
mov eax, dword [rbp - 4]
cmp eax, 0x69
ja 0x14002858c
mov eax, dword [rbp - 4]
cdqe
mov byte [rbp + rax - 0x70], 0xa
mov eax, dword [rbp - 4]
add eax, 1
cdqe
mov byte [rbp + rax - 0x70], 0
lea rax, [rbp - 0x70]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rax
call sub.msvcrt.dll_abort
mov rax, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x18]
mov qword [rax], rdx
jmp 0x1400285af
nop
add rsp, 0x90
pop rbp
ret
Function at 0x1400297a5
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xffffffffffffffff
lea rax, [0x1400295cb]
mov rdx, rax
lea rax, [0x1400c6f90]
mov rcx, rax
call fcn.140028bd6
mov eax, dword [0x1400b90b0]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
je 0x1400297f8
mov rax, qword [rbp - 0x10]
jmp 0x140029958
call fcn.140028340
mov qword [rbp - 0x10], rax
mov rax, qword [0x1400ca050]
test rax, rax
je 0x140029814
cmp qword [rbp - 0x10], 0
jne 0x14002981e
mov eax, 0
jmp 0x140029958
mov rax, qword [rbp - 0x10]
mov dword [rax + 0x44], 1
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call rax
mov rdx, qword [rbp - 0x10]
mov dword [rdx + 0x70], eax
mov r9d, 0
mov r8d, 0
mov edx, 1
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateEventA]
call rax
mov rdx, qword [rbp - 0x10]
mov qword [rdx + 0x30], rax
mov rax, qword [rbp - 0x10]
mov qword [rax + 0x38], 0xffffffffffffffff
mov rax, qword [rbp - 0x10]
lea rcx, [rax + 0x68]
mov rax, qword [rbp - 8]
mov rdx, rax
call fcn.140028464
mov rax, qword [rbp - 0x10]
mov dword [rax + 0xb8], 0
mov rax, qword [rbp - 0x10]
mov qword [rax + 0x28], 0
mov rax, qword [rbp - 0x10]
lea rdi, [rax + 0x28]
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov rsi, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call rax
mov rbx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, rdi
mov r8, rsi
mov rdx, rbx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DuplicateHandle]
call rax
test eax, eax
jne 0x1400298f9
call sub.msvcrt.dll_abort
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x28]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetThreadPriority]
call rax
mov rdx, qword [rbp - 0x10]
mov dword [rdx + 0xc0], eax
mov rax, qword [rbp - 0x10]
mov dword [rax + 0xbc], 0
mov rax, qword [rbp - 0x10]
movzx edx, byte [rax + 0x40]
and edx, 0xffffffcf
or edx, 0x10
mov byte [rax + 0x40], dl
mov eax, dword [0x1400b90b0]
mov rdx, qword [rbp - 0x10]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
test eax, eax
jne 0x140029954
call sub.msvcrt.dll_abort
mov rax, qword [rbp - 0x10]
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret