joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45b900
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45b9bb
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rdx, [0x0045ba00]
mov qword [rsp + 0x10], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdi
lea rax, [rsp + 8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00463f40
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00464080
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0045b900
Function at 0x466200
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00c8fb00]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x00c8f548], 0
je 0x466236
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x00c8fe60]
aesenc xmm0, xmmword [0x00c8fe70]
aesenc xmm0, xmmword [0x00c8fe80]
movq rax, xmm0
ret
jmp 0x40a780
Function at 0x14000b710
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
push r14
xor r14d, r14d
push r13
push r12
push rbp
push rdi
push rsi
push rbx
mov rbx, rcx
mov rdx, rbx
sub rsp, 0x20
movsxd rax, dword [rcx + 0x3c]
mov ecx, dword [rcx + rax + 0x88]
call 0x140011920
mov rdx, rbx
mov esi, eax
add rsi, rbx
mov ecx, dword [rsi + 0x20]
call 0x140011920
mov ecx, dword [rsi + 0x24]
mov rdx, rbx
mov r12d, eax
call 0x140011920
mov r13d, dword [rsi + 0x18]
add r12, rbx
mov edi, eax
cmp r13, r14
je 0x14000b7cf
mov ecx, dword [r12 + r14*4]
mov rdx, rbx
call 0x140011920
mov ebp, eax
add rbp, rbx
mov rcx, rbp
call fcn.14000bc90
cmp eax, 0xa6caa1c5
jne 0x14000b7b4
mov ecx, dword [rsi + 0x1c]
mov rdx, rbx
add rdi, rbx
call 0x140011920
movzx edx, word [rdi + r14*2]
mov eax, eax
add rax, rbx
mov ecx, dword [rax + rdx*4]
add rsp, 0x20
mov rdx, rbx
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp 0x140011920
mov rcx, rbp
call fcn.14000bc90
mov edx, eax
lea rax, [r14 + 1]
cmp edx, 0xffe885ef
je 0x14000b783
mov r14, rax
jmp 0x14000b75e
add rsp, 0x20
xor eax, eax
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov eax, ecx
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
movzx edx, word [rcx + 0x14]
lea rdx, [rcx + rdx + 0x18]
cmp eax, dword [rdx + 0x14]
jb 0x14001196a
mov r9w, word [rcx + 6]
xor ecx, ecx
cmp r9w, cx
je 0x140011968
mov r8d, dword [rdx + 0xc]
cmp eax, r8d
jb 0x140011960
mov r10d, dword [rdx + 0x10]
add r10d, r8d
cmp eax, r10d
jae 0x140011960
add eax, dword [rdx + 0x14]
sub eax, r8d
ret
inc ecx
add rdx, 0x28
jmp 0x14001193e
xor eax, eax
ret

Function at 0x14000b830
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, qword [0x140019150]
push r12
xor edx, edx
push rbp
push rdi
push rsi
push rbx
mov rbx, qword [rax]
mov rax, qword [rbx + 0x7e0]
test rax, rax
je 0x14000b8e2
mov edx, dword [rbx + 0x796]
test edx, edx
jne 0x14000b8e2
movsxd rcx, dword [rax + 0x3c]
xor r8d, r8d
mov ecx, dword [rax + rcx + 0x88]
add rcx, rax
mov edi, dword [rcx + 0x20]
mov r10d, dword [rcx + 0x1c]
mov esi, dword [rcx + 0x24]
mov ebp, dword [rcx + 0x18]
xor ecx, ecx
add r10, rax
add rdi, rax
add rsi, rax
cmp r8d, ebp
jae 0x14000b8dc
mov r9d, dword [rdi + r8*4]
cmp word [rax + r9], 0x775a
jne 0x14000b8d7
test rcx, rcx
movzx r9d, word [rsi + r8*2]
jne 0x14000b8ae
mov ecx, dword [r10 + r9*4]
add rcx, rax
jmp 0x14000b8d7
mov r9d, dword [r10 + r9*4]
mov r11, rcx
add r9, rax
mov r12, r9
sub r11, r9
sub r12, rcx
cmp r9, rcx
mov r9d, r12d
cmovb r9d, r11d
test edx, edx
je 0x14000b8d4
cmp r9d, edx
jae 0x14000b8d7
mov edx, r9d
inc r8
jmp 0x14000b889
mov dword [rbx + 0x796], edx
pop rbx
mov eax, edx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x14000bc40
Capabilities:
Hash data using djb2

Disassembly:
xor eax, eax
test rcx, rcx
je 0x14000bc8f
mov r10, rcx
mov eax, 0x1505
mov r9b, byte [r10]
test edx, edx
jne 0x14000bc5c
test r9b, r9b
jne 0x14000bc71
ret
mov r11, r10
sub r11, rcx
cmp r11d, edx
jae 0x14000bc8f
test r9b, r9b
jne 0x14000bc71
inc r10
jmp 0x14000bc80
cmp r9b, 0x60
jbe 0x14000bc80
test r8d, r8d
je 0x14000bc80
sub r9d, 0x20
imul eax, eax, 0x21
movzx r9d, r9b
inc r10
add eax, r9d
jmp 0x14000bc4f
ret

Function at 0x14000bc90
Capabilities:
Hash data using djb2

Disassembly:
mov eax, 0x1505
movsx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14000bca6
imul eax, eax, 0x21
add eax, edx
jmp 0x14000bc95
ret

Function at 0x14000cdb0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rsi
xor eax, eax
push rbx
mov r8b, byte [rdx + rax]
mov byte [rcx + rax], r8b
mov r8b, byte [rdx + rax + 1]
mov byte [rcx + rax + 1], r8b
mov r8b, byte [rdx + rax + 2]
mov byte [rcx + rax + 2], r8b
mov r8b, byte [rdx + rax + 3]
mov byte [rcx + rax + 3], r8b
add rax, 4
cmp rax, 0x20
jne 0x14000cdb4
mov r11d, 8
lea r10, str.cw
lea rbx, [0x1400191a0]
mov esi, r11d
movzx r9d, byte [rcx + 0x1c]
movzx r8d, byte [rcx + 0x1d]
movzx edx, byte [rcx + 0x1e]
movzx eax, byte [rcx + 0x1f]
and esi, 7
jne 0x14000ce32
mov sil, byte [r10 + r8]
mov r8b, byte [r10 + rdx]
mov dl, byte [r10 + rax]
mov al, byte [r10 + r9]
mov r9d, r11d
shr r9d, 3
xor sil, byte [rbx + r9]
mov r9d, esi
jmp 0x14000ce47
cmp esi, 4
jne 0x14000ce47
mov r9b, byte [r10 + r9]
mov r8b, byte [r10 + r8]
mov dl, byte [r10 + rdx]
mov al, byte [r10 + rax]
xor r9b, byte [rcx]
xor r8b, byte [rcx + 1]
inc r11d
add rcx, 4
xor dl, byte [rcx - 2]
xor al, byte [rcx - 1]
mov byte [rcx + 0x1c], r9b
mov byte [rcx + 0x1d], r8b
mov byte [rcx + 0x1e], dl
mov byte [rcx + 0x1f], al
cmp r11d, 0x3c
jne 0x14000cdf8
pop rbx
pop rsi
ret
Function at 0x140011920
Capabilities:
Enumerate pe sections

Disassembly:
push r14
xor r14d, r14d
push r13
push r12
push rbp
push rdi
push rsi
push rbx
mov rbx, rcx
mov rdx, rbx
sub rsp, 0x20
movsxd rax, dword [rcx + 0x3c]
mov ecx, dword [rcx + rax + 0x88]
call 0x140011920
mov rdx, rbx
mov esi, eax
add rsi, rbx
mov ecx, dword [rsi + 0x20]
call 0x140011920
mov ecx, dword [rsi + 0x24]
mov rdx, rbx
mov r12d, eax
call 0x140011920
mov r13d, dword [rsi + 0x18]
add r12, rbx
mov edi, eax
cmp r13, r14
je 0x14000b7cf
mov ecx, dword [r12 + r14*4]
mov rdx, rbx
call 0x140011920
mov ebp, eax
add rbp, rbx
mov rcx, rbp
call fcn.14000bc90
cmp eax, 0xa6caa1c5
jne 0x14000b7b4
mov ecx, dword [rsi + 0x1c]
mov rdx, rbx
add rdi, rbx
call 0x140011920
movzx edx, word [rdi + r14*2]
mov eax, eax
add rax, rbx
mov ecx, dword [rax + rdx*4]
add rsp, 0x20
mov rdx, rbx
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp 0x140011920
mov rcx, rbp
call fcn.14000bc90
mov edx, eax
lea rax, [r14 + 1]
cmp edx, 0xffe885ef
je 0x14000b783
mov r14, rax
jmp 0x14000b75e
add rsp, 0x20
xor eax, eax
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov eax, ecx
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
movzx edx, word [rcx + 0x14]
lea rdx, [rcx + rdx + 0x18]
cmp eax, dword [rdx + 0x14]
jb 0x14001196a
mov r9w, word [rcx + 6]
xor ecx, ecx
cmp r9w, cx
je 0x140011968
mov r8d, dword [rdx + 0xc]
cmp eax, r8d
jb 0x140011960
mov r10d, dword [rdx + 0x10]
add r10d, r8d
cmp eax, r10d
jae 0x140011960
add eax, dword [rdx + 0x14]
sub eax, r8d
ret
inc ecx
add rdx, 0x28
jmp 0x14001193e
xor eax, eax
ret
Function at 0x140001480
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x14002edd0]
mov dword [rax], 1
mov rax, qword [0x14002ede0]
mov dword [rax], 1
mov rax, qword [0x14002edf0]
mov dword [rax], 1
mov rax, qword [0x14002edc0]
mov dword [rax], 1
mov rax, qword [0x14002ec00]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400014de
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x14000150a
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x140001530
cmp eax, 0x20b
je 0x140001557
jmp 0x140001586
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x140001543
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x14000158b
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x140001572
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x14000158b
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140001ea0
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
sub rsp, 0x28
mov r12, rcx
mov rcx, rdx
mov r13, rdx
call sub.msvcrt.dll_strlen
mov rcx, r13
mov r9, r12
mov edx, 1
mov r8, rax
call sub.msvcrt.dll_fwrite
mov rcx, r12
add rsp, 0x28
pop r12
pop r13
jmp fcn.14001ae18

Function at 0x140001f10
Capabilities:
Write file on windows

Disassembly:
push r12
sub rsp, 0x20
mov ecx, 2
call qword [fcn.14001b530]
mov r8d, 0x4b
mov edx, 1
lea rcx, str._GC__cannot_register_thread_local_variable__too_many_thread_local_variables
mov r12, rax
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rcx, r12
call fcn.14001ae18
mov ecx, 1
call sub.msvcrt.dll_exit
nop
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x140001f60
Capabilities:
Write file on windows

Disassembly:
push r12
sub rsp, 0x20
mov ecx, 2
call qword [fcn.14001b530]
mov r8d, 0x3f
mov edx, 1
lea rcx, str._GC__cannot_register_global_variable__too_many_global_variables
mov r12, rax
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rcx, r12
call fcn.14001ae18
mov ecx, 1
call sub.msvcrt.dll_exit
nop
nop word cs:[rax + rax]
nop dword [rax]
push rsi
push rbx
mov r10, qword [0x140040ec0]
movabs rax, 0xe7037ed1a0b428db
movabs rbx, 0xa0761d6478bd642f
mov r9, rcx
mov rcx, qword [r10]
xor rax, r9
mul rbx
movabs rbx, 0xeb44accab455d16d
xor rax, rdx
mul rbx
mov r11, rdx
xor r11, rax
cmp rdx, rax
mov eax, 0x12b9b0a1
cmove r11, rax
test rcx, rcx
je 0x140002130
mov r8, qword [rcx]
test r8, r8
je 0x140002130
sub r8, 1
mov rax, r8
and rax, r11
lea rdx, [rax + rax*2]
mov rdx, qword [rcx + rdx*8 + 0x10]
test rdx, rdx
je 0x140002055
nop dword [rax + rax]
cmp rdx, r11
jne 0x140002040
lea rdx, [rax + rax*2]
cmp r9, qword [rcx + rdx*8 + 0x18]
je 0x140002058
add rax, 1
and rax, r8
lea rdx, [rax + rax*2]
mov rdx, qword [rcx + rdx*8 + 0x10]
test rdx, rdx
jne 0x140002030
not rax
test rax, rax
js 0x140002130
sub qword [r10 + 8], 1
lea rdx, [rax + rax*2]
shl rdx, 3
mov qword [rcx + rdx + 0x10], 0
mov rcx, qword [r10]
add rcx, rdx
mov qword [rcx + 0x18], 0
add rdx, qword [r10]
mov byte [rdx + 0x20], 0
lea rdx, [rax + 1]
mov r11, qword [r10]
and rdx, r8
lea rcx, [rdx + rdx*2]
mov rcx, qword [r11 + rcx*8 + 0x10]
test rcx, rcx
jne 0x1400020cf
jmp 0x140002130
cmp rax, rcx
jl 0x1400020ba
cmp rax, rdx
jle 0x1400020e1
add rdx, 1
and rdx, r8
lea rcx, [rdx + rdx*2]
mov rcx, qword [r11 + rcx*8 + 0x10]
test rcx, rcx
je 0x140002130
and rcx, r8
cmp rcx, rdx
jle 0x1400020b0
cmp rax, rcx
jge 0x1400020e1
cmp rax, rdx
jg 0x1400020ba
lea rax, [rax + rax*2]
lea rcx, [r11 + rax*8]
lea rax, [rdx + rdx*2]
shl rax, 3
add r11, rax
movdqu xmm0, xmmword [r11 + 0x10]
movups xmmword [rcx + 0x10], xmm0
mov r11, qword [r11 + 0x20]
mov qword [rcx + 0x20], r11
mov rcx, qword [r10]
lea rax, [rcx + rax + 0x10]
mov qword [rax], 0
mov qword [rax + 8], 0
mov qword [rax + 0x10], 0
mov rax, rdx
mov rcx, qword [r10]
jmp 0x140002066
mov rcx, r9
pop rbx
pop rsi
jmp qword [0x140047da8]

Function at 0x140005020
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
sub rsp, 0x48
mov byte [rsp + 0x3f], 1
movzx eax, byte [rsp + 0x3f]
mov r12, rcx
mov qword [rsp + 0x28], rdx
test al, al
jne 0x140005050
add rsp, 0x48
pop r12
pop r13
ret
mov ecx, 2
call qword [fcn.14001b530]
mov r8, qword [rsp + 0x28]
mov rcx, r12
mov edx, 1
mov r13, rax
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rcx, r13
add rsp, 0x48
pop r12
pop r13
jmp fcn.14001ae18
Function at 0x14000b830
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
test rcx, rcx
je 0x14000b981
cmp qword [rcx + 8], 0
jns 0x14000b970
mov r8, qword [rcx]
test r8, r8
jle 0x14000b967
mov rax, rbx
mov rdx, rbx
sar rdx, 0x10
sar rax, 8
xor eax, edx
lea rdx, [r8 - 1]
xor eax, ebx
sar rbx, 0x18
xor eax, ebx
cmp rdx, 0xe
jbe 0x14000b989
movd xmm1, eax
mov r9, r8
mov rdx, rcx
punpcklbw xmm1, xmm1
and r9, 0xfffffffffffffff0
punpcklwd xmm1, xmm1
add r9, rcx
pshufd xmm1, xmm1, 0
nop dword [rax]
movdqu xmm0, xmmword [rdx + 0x10]
add rdx, 0x10
pxor xmm0, xmm1
movups xmmword [rdx], xmm0
cmp rdx, r9
jne 0x14000b8a0
mov r9, r8
and r9, 0xfffffffffffffff0
mov rdx, r9
cmp r9, r8
je 0x14000b967
mov r11, r8
sub r11, r9
lea r10, [r11 - 1]
cmp r10, 6
jbe 0x14000b910
lea rbx, [rcx + r9 + 0x10]
mov r9d, eax
movzx r10d, al
shl r9d, 8
movq xmm1, qword [rbx]
or r9d, r10d
movd xmm2, r9d
mov r9, r11
pshuflw xmm0, xmm2, 0
and r9, 0xfffffffffffffff8
pxor xmm0, xmm1
add rdx, r9
movq qword [rbx], xmm0
cmp r11, r9
je 0x14000b967
lea r9, [rdx + 1]
xor byte [rcx + rdx + 0x10], al
cmp r8, r9
jle 0x14000b967
xor byte [rcx + r9 + 0x10], al
lea r9, [rdx + 2]
cmp r8, r9
jle 0x14000b967
xor byte [rcx + r9 + 0x10], al
lea r9, [rdx + 3]
cmp r8, r9
jle 0x14000b967
xor byte [rcx + r9 + 0x10], al
lea r9, [rdx + 4]
cmp r8, r9
jle 0x14000b967
xor byte [rcx + r9 + 0x10], al
lea r9, [rdx + 5]
cmp r8, r9
jle 0x14000b967
add rdx, 6
xor byte [rcx + r9 + 0x10], al
cmp r8, rdx
jle 0x14000b967
xor byte [rcx + rdx + 0x10], al
mov rax, rcx
add rsp, 0x20
pop rbx
ret
call fcn.140006100
mov rcx, rax
test rax, rax
jne 0x14000b84c
xor eax, eax
add rsp, 0x20
pop rbx
ret
xor r9d, r9d
xor edx, edx
jmp 0x14000b8c8
Function at 0x14000b9a0
Capabilities:
Access peb ldr_data

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x40
mov r12, rcx
mov ebx, edx
lea rcx, [0x14002c660]
mov edx, 0x43c23163
call fcn.14000b1e0
mov edx, 0x68ef9349
mov rcx, rax
call fcn.14000b830
movzx esi, word [r12]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov r11, qword [rax + 0x20]
lea rdi, [rax + 0x20]
nop dword [rax + rax]
mov r10, qword [r11 + 0x50]
test si, si
je 0x14000ba3f
mov eax, esi
xor ecx, ecx
nop dword [rax]
movzx edx, word [r10 + rcx]
test dx, dx
je 0x14000ba3f
lea r9d, [rax - 0x41]
lea r8d, [rax + 0x20]
cmp r9w, 0x1a
lea r9d, [rdx - 0x41]
cmovb eax, r8d
lea r8d, [rdx + 0x20]
cmp r9w, 0x1a
cmovb edx, r8d
cmp ax, dx
jne 0x14000ba49
add rcx, 2
movzx eax, word [r12 + rcx]
test ax, ax
jne 0x14000ba00
cmp word [r10], si
je 0x14000bacb
mov r11, qword [r11]
cmp rdi, r11
jne 0x14000b9f0
xor r13d, r13d
test ebx, ebx
je 0x14000bacf
mov edx, 0x3b050011
lea rcx, [0x14002c760]
lea rbx, [rsp + 0x30]
call fcn.14000b1e0
mov edx, 0x3710a493
mov rcx, rax
call fcn.14000b830
mov rdx, r12
mov rcx, rbx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x28], 0
call qword [0x140040d20]
xor edx, edx
xor ecx, ecx
lea r9, [rsp + 0x28]
mov r8, rbx
call qword [0x140040d18]
test eax, eax
cmove r13, qword [rsp + 0x28]
mov rax, r13
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
mov r13, qword [r11 + 0x20]
mov rax, r13
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret

Function at 0x140010380
Capabilities:
Access peb ldr_data

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x40
mov edx, 0x43c23163
mov r12, rcx
mov rcx, qword [0x14002eac0]
call fcn.14000b1e0
mov edx, 0x68ef9349
mov rcx, rax
call fcn.14000b830
movzx ebx, word [r12]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov r11, qword [rax + 0x20]
lea rsi, [rax + 0x20]
nop dword [rax + rax]
mov r10, qword [r11 + 0x50]
test bx, bx
je 0x140010417
mov eax, ebx
xor ecx, ecx
nop dword [rax]
movzx edx, word [r10 + rcx]
test dx, dx
je 0x140010417
lea r9d, [rax - 0x41]
lea r8d, [rax + 0x20]
cmp r9w, 0x1a
lea r9d, [rdx - 0x41]
cmovb eax, r8d
lea r8d, [rdx + 0x20]
cmp r9w, 0x1a
cmovb edx, r8d
cmp ax, dx
jne 0x140010421
add rcx, 2
movzx eax, word [r12 + rcx]
test ax, ax
jne 0x1400103d8
cmp word [r10], bx
je 0x1400104a1
mov r11, qword [r11]
cmp rsi, r11
jne 0x1400103c8
mov rcx, qword [0x14002ead0]
mov edx, 0x3b050011
lea rbx, [rsp + 0x30]
call fcn.14000b1e0
mov edx, 0x3710a493
mov rcx, rax
call fcn.14000b830
mov rax, qword [0x14002ea00]
mov rdx, r12
mov rcx, rbx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x28], 0
call qword [rax]
mov rax, qword [0x14002e9c0]
xor edx, edx
xor ecx, ecx
lea r9, [rsp + 0x28]
mov r8, rbx
call qword [rax]
test eax, eax
mov eax, 0
cmove rax, qword [rsp + 0x28]
add rsp, 0x40
pop rbx
pop rsi
pop r12
ret
mov rax, qword [r11 + 0x20]
add rsp, 0x40
pop rbx
pop rsi
pop r12
ret
Function at 0x1400124b0
Capabilities:
Write file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, qword [fcn.14001b530]
mov rsi, qword [rcx]
mov ecx, 1
call r12
mov rdi, rax
test rsi, rsi
je 0x140012583
cmp qword [rsi], 0
lea r8, [rsi + 0x10]
mov rcx, rdi
lea rax, [0x14002d963]
lea rbp, [0x14002d960]
cmove r8, rax
mov rdx, rbp
call fcn.14000dda0
mov ebx, eax
movsxd rax, ebx
cmp rax, qword [rsi]
jge 0x140012527
cmp byte [rsi + rax + 0x10], 0
jne 0x140012568
xor ecx, ecx
mov rdx, rdi
call sub.msvcrt.dll_fputc
test eax, eax
jne 0x140012527
add ebx, 1
movsxd rax, ebx
cmp rax, qword [rsi]
jl 0x140012507
mov ecx, 1
call r12
mov r8d, 1
mov edx, 1
lea rcx, [0x14002d9b2]
mov r9, rax
call sub.msvcrt.dll_fwrite
mov ecx, 1
call r12
mov rcx, rax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.14001ae18
lea r8, [rsi + rax + 0x10]
mov rdx, rbp
mov rcx, rdi
call fcn.14000dda0
test eax, eax
jle 0x140012527
add ebx, eax
jmp 0x1400124ff
lea rbp, [0x14002d960]
lea r8, [0x14002d963]
mov rcx, rax
mov rdx, rbp
call fcn.14000dda0
mov ebx, eax
nop
test ebx, ebx
jns 0x140012527
movsxd rax, ebx
cmp byte [rax + 0x10], 0
jne 0x1400125d3
xor ecx, ecx
mov rdx, rdi
call sub.msvcrt.dll_fputc
test eax, eax
jne 0x140012527
add ebx, 1
test ebx, ebx
jns 0x140012527
movsxd rax, ebx
cmp byte [rax + 0x10], 0
je 0x1400125ad
lea r8d, [rbx + 0x10]
mov rdx, rbp
mov rcx, rdi
movsxd r8, r8d
call fcn.14000dda0
test eax, eax
jle 0x140012527
add ebx, eax
jmp 0x1400125a0

Function at 0x1400143e0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call fcn.14001b530
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call fcn.14001b530
mov r8, rbx
mov rdx, qword [rbp + 0x20]
mov rcx, rax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop

Function at 0x140015012
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x140048048]
test eax, eax
je 0x1400150aa
lea rax, [0x140048020]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x140048050]
mov qword [rbp - 8], rax
jmp 0x14001508e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x140015082
cmp qword [rbp - 0x10], 0
je 0x140015082
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140015048
lea rax, [0x140048020]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x1400150ab
nop
add rsp, 0x30
pop rbp
ret
Function at 0x1400151b0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400151d8
mov eax, 0
jmp 0x140015226
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140015201
mov eax, 0
jmp 0x140015226
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x140015221
mov eax, 0
jmp 0x140015226
mov eax, 1
add rsp, 0x20
pop rbp
ret

Function at 0x14001522c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x1400152aa
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x1400152a1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x1400152a1
mov rax, qword [rbp - 8]
jmp 0x1400152bf
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x140015274
mov eax, 0
add rsp, 0x20
pop rbp
ret