joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140007f80
Capabilities:
Resume thread
Suspend thread

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x508
mov rbx, rcx
mov ecx, dword [0x140031a78]
test ecx, ecx
je 0x140007fc0
mov edx, dword [0x140031a60]
test edx, edx
jne 0x140007fc0
lea rax, [0x14005c300]
cmp rbx, rax
jne 0x1400081f0
nop word [rax + rax]
mov rbp, qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov r13, qword [sym.imp.KERNEL32.dll_SuspendThread]
xor esi, esi
lea r12, [rsp + 0x2c]
mov r14, qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov r15, qword [sym.imp.KERNEL32.dll_ResumeThread]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x10]
mov rdx, r12
call rbp
test eax, eax
je 0x140008003
cmp dword [rsp + 0x2c], 0x103
jne 0x140008090
mov rcx, qword [rbx + 0x10]
call r13
cmp eax, 0xffffffff
je 0x140008050
mov dword [rsp + 0x60], 0x100003
mov rcx, qword [rbx + 0x10]
lea rdx, [rsp + 0x30]
call r14
test eax, eax
jne 0x1400080f8
mov rcx, qword [rbx + 0x10]
call r15
cmp eax, 0xffffffff
jne 0x140008050
lea rcx, str.ResumeThread_failed_in_suspend_loop
call fcn.140002260
call qword [sym.imp.KERNEL32.dll_DebugBreak]
nop dword [rax]
lea edi, [rsi + 1]
cmp esi, 1
ja 0x140008060
mov esi, edi
jmp 0x140007fe8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp edi, 0xf423f
jle 0x140008058
lea rcx, str.SuspendThread_loop_failed
mov esi, edi
call fcn.140002260
call qword [sym.imp.KERNEL32.dll_DebugBreak]
jmp 0x140007fe8
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbx + 8]
lea rcx, [0x140031260]
mov edx, eax
shr edx, 8
xor edx, eax
movzx edx, dl
mov rax, qword [rcx + rdx*8]
cmp rbx, rax
je 0x14000821a
nop dword [rax + rax]
mov rcx, rax
mov rax, qword [rax]
cmp rbx, rax
jne 0x1400080c0
mov rax, qword [rbx]
mov qword [rcx], rax
mov eax, dword [0x140031a60]
test eax, eax
jne 0x1400081c0
add rsp, 0x508
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
movdqu xmm2, xmmword [rsp + 0xd8]
mov byte [rbx + 0x3b], 1
movdqu xmm0, xmmword [rsp + 0xc8]
movdqu xmm3, xmmword [rsp + 0x118]
movdqu xmm1, xmmword [rsp + 0x108]
movdqu xmm4, xmmword [rsp + 0xa8]
shufpd xmm0, xmm2, 1
movups xmmword [rbx + 0x68], xmm0
mov rax, qword [rsp + 0x120]
movdqa xmm0, xmm2
movdqu xmm2, xmmword [rsp + 0xe8]
shufpd xmm1, xmm3, 1
movups xmmword [rbx + 0x48], xmm4
movdqu xmm3, xmmword [rsp + 0xf8]
movdqu xmm5, xmmword [rsp + 0xb8]
mov qword [rbx + 0xb8], rax
shufpd xmm0, xmm2, 1
mov rax, qword [rsp + 0xc8]
movdqu xmm4, xmmword [rsp + 0x108]
movups xmmword [rbx + 0x78], xmm0
movdqa xmm0, xmm2
movups xmmword [rbx + 0x58], xmm5
shufpd xmm0, xmm3, 1
movups xmmword [rbx + 0x88], xmm0
movdqa xmm0, xmm3
shufpd xmm0, xmm4, 1
mov qword [rbx + 0x40], rax
movups xmmword [rbx + 0x98], xmm0
movups xmmword [rbx + 0xa8], xmm1
jmp 0x1400080df
shr rcx, 0xc
mov edx, 1
lea r8, [0x140031ec0]
and ecx, 0x3ffff
mov rax, rcx
shl rdx, cl
shr rax, 6
add rax, 0x1c79
lock or qword [r8 + rax*8], rdx
jmp 0x1400080df
cmp qword [0x140031e88], 0
jne 0x140007fc0
mov rcx, rbx
xor r8d, r8d
mov edx, 1
and rcx, 0xfffffffffffff000
call fcn.140007e20
jmp 0x140007fc0
mov rax, qword [rbx]
mov qword [rcx + rdx*8], rax
jmp 0x1400080df
Function at 0x140008230
Capabilities:
Resume thread

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rsi, [0x140031260]
mov rdi, qword [sym.imp.KERNEL32.dll_ResumeThread]
mov r13, qword [sym.imp.KERNEL32.dll_DebugBreak]
lea r12, [rsi + 0x800]
nop dword [rax + rax]
mov rbx, qword [rsi]
test rbx, rbx
je 0x1400082cc
lea rbp, str.ResumeThread_failed
jmp 0x140008280
mov rbx, qword [rbx]
test rbx, rbx
je 0x1400082cc
cmp byte [rbx + 0x3b], 0
je 0x140008278
mov rcx, qword [rbx + 0x10]
call rdi
cmp eax, 0xffffffff
jne 0x14000829c
mov rcx, rbp
call fcn.140002260
call r13
mov edx, dword [0x140031a78]
test edx, edx
je 0x1400082c0
mov eax, dword [0x140031a60]
test eax, eax
jne 0x1400082c0
lea rax, [0x14005c300]
cmp rbx, rax
jne 0x1400082e8
nop dword [rax]
mov byte [rbx + 0x3b], 0
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140008280
add rsi, 8
cmp rsi, r12
jne 0x140008260
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
cmp qword [0x140031e88], 0
jne 0x1400082c0
mov rcx, rbx
xor r8d, r8d
mov edx, 1
and rcx, 0xfffffffffffff000
call fcn.140007e20
jmp 0x1400082c0
Function at 0x140008e20
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov ebx, dword [0x140031a74]
test ebx, ebx
jne 0x140008ecb
mov r11d, dword [0x140031a78]
test r11d, r11d
je 0x140008ed8
mov r10d, dword [0x140031f90]
test r10d, r10d
je 0x140008ed8
lea esi, [rcx + rcx*4]
mov ebx, dword [0x1400605f0]
add esi, esi
cmp esi, ebx
jg 0x140008e77
jmp 0x1400090c3
add ebx, 1
cmp esi, ebx
je 0x140008eb3
xor ecx, ecx
call fcn.140005cb0
test eax, eax
je 0x140008e70
cmp ebx, esi
jge 0x140008eb3
mov r9d, dword [0x140060638]
test r9d, r9d
jg 0x140008ea2
cmp dword [0x140025260], 0xf423f
jne 0x140009070
lea rcx, [fcn.140001810]
call fcn.140008310
call fcn.1400064a0
mov ebx, dword [0x1400605f0]
test ebx, ebx
jle 0x140008ecb
sub ebx, esi
js 0x140009038
mov dword [0x1400605f0], ebx
add rsp, 0x28
pop rbx
pop rsi
ret
call fcn.140002b50
test eax, eax
je 0x140008ecb
mov r8d, dword [0x140031a78]
test r8d, r8d
je 0x140009047
mov ecx, dword [0x1400605f4]
test ecx, ecx
jne 0x140008f0d
mov eax, dword [0x1400605f8]
cmp eax, dword [0x140025248]
jl 0x140009062
mov edx, dword [0x140031e94]
test edx, edx
jne 0x1400090a2
call fcn.140003650
mov edx, 1
xor ecx, ecx
call fcn.140004720
mov rbx, qword [0x140031f28]
test rbx, rbx
je 0x140008fa3
nop dword [rax + rax]
mov r11d, 0x3ff
jmp 0x140008f78
test byte [rax + 0x19], 4
jne 0x140008f6f
mov rcx, qword [rbx + 0x2010]
xor edx, edx
shl rcx, 0xa
add rcx, r11
shl rcx, 0xc
call fcn.140001ea0
sub r11, 1
test r11, r11
js 0x140008f97
mov rax, qword [rbx + r11*8]
cmp rax, 0xfff
ja 0x140008f50
lea rdx, [r11 - 1]
sub r11, rax
test rax, rax
cmove r11, rdx
test r11, r11
jns 0x140008f78
mov rbx, qword [rbx + 0x2000]
test rbx, rbx
jne 0x140008f40
mov dword [0x140031f98], 0
mov dword [0x140031f90], 5
mov qword [0x140031f80], 0
mov dword [0x1400605f8], 0
mov dword [0x1400605fc], 1
cmp dword [0x140025260], 0xf423f
jne 0x14000900c
lea rcx, [fcn.140001810]
call fcn.140008310
test eax, eax
jne 0x14000902d
mov eax, dword [0x1400605fc]
test eax, eax
jne 0x140008ecb
add dword [0x140060638], 1
jmp 0x140008ecb
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x140025260], 0xf423f
mov dword [0x14006063c], eax
je 0x140008fe2
lea rcx, [0x140004200]
jmp 0x140008fe9
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.1400064a0
mov dword [0x1400605f0], 0
jmp 0x140008ecb
lea rcx, [fcn.140001810]
call fcn.1400090e0
mov dword [0x1400605f8], 0
jmp 0x140008ecb
add eax, 1
mov dword [0x1400605f8], eax
jmp 0x140008fd6
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rcx, [0x140004200]
mov dword [0x14006063c], eax
call fcn.140008310
test eax, eax
jne 0x140008eae
add dword [0x140060638], 1
mov ebx, dword [0x1400605f0]
jmp 0x140008eb9
mov eax, dword [0x140031a88]
mov r8d, dword [0x140031f00]
lea rcx, str._Full_mark_for_collection__lu_after__lu_allocd_bytes_n
lea edx, [rax + 1]
call fcn.1400035a0
jmp 0x140008f1b
test ebx, ebx
jle 0x140008ecb
sub ebx, esi
jmp 0x140008ec5
Function at 0x14000a750
Capabilities:
Query environment variable

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x160
mov ebx, dword [0x14005c520]
mov dword [0x1400311f0], 1
test ebx, ebx
jne 0x14000a791
mov dword [0x1400311f0], 0
add rsp, 0x160
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov esi, ebx
lea r14, [rsp + 0x20]
xor r12d, r12d
shl rsi, 3
lea rdi, [0x14005c3e0]
mov rcx, r14
mov r8, rsi
mov rdx, rdi
lea rbp, [0x140031ec0]
call sub.ucrtbase.dll_memcpy
mov r8, rsi
xor edx, edx
mov rcx, rdi
mov dword [0x14005c520], 0
add rsi, r14
call sub.ucrtbase.dll_memset
mov edx, ebx
lea rcx, str.Found__u_leaked_objects:_n
lea rbx, [0x140025040]
call fcn.1400033d0
nop word [rax + rax]
mov r13, qword [r14]
mov rcx, r13
call fcn.140003460
test r13, r13
je 0x14000a8f6
mov rdx, r13
mov r9, r13
shr rdx, 0x16
and r9, 0xfffffffffffff000
mov rax, rdx
and eax, 0x7ff
mov rax, qword [rbp + rax*8 + 0x263d0]
cmp rdx, qword [rax + 0x2010]
je 0x14000a930
mov rcx, qword [0x140031f78]
jmp 0x14000a854
mov rax, qword [rax + 0x2018]
cmp rdx, qword [rax + 0x2010]
je 0x14000a930
cmp rax, rcx
jne 0x14000a840
mov rax, r9
shr rax, 0xc
and eax, 0x3ff
mov rdx, qword [rcx + rax*8]
mov rcx, qword [0x140031f18]
mov rax, qword [rdx + 0x20]
movzx edx, byte [rdx + 0x18]
mov r8, rax
add rcx, rax
shr r8, 4
cmp rax, 0x80f
ja 0x14000a978
mov qword [0x140031f18], rcx
cmp edx, 2
jne 0x14000a8a1
sub qword [0x140060618], rax
mov rcx, rdx
shl rcx, 5
mov r10d, dword [rbx + rcx + 0x1c]
test r10d, r10d
je 0x14000a8e0
cmp rax, 8
jbe 0x14000a8e0
sub rax, 8
lea rcx, [r13 + 8]
cmp eax, 8
jae 0x14000a940
test al, 4
jne 0x14000a9b4
test eax, eax
je 0x14000a8e0
mov byte [r13 + 8], 0
test al, 2
jne 0x14000a9cb
nop
shl rdx, 5
mov rax, qword [rbx + rdx]
lea rax, [rax + r8*8]
mov rdx, qword [rax]
mov qword [r13], rdx
mov qword [rax], r13
add r14, 8
cmp rsi, r14
jne 0x14000a7f0
lea rcx, str.GC_ABORT_ON_LEAK
call sub.ucrtbase.dll_getenv
test rax, rax
je 0x14000a775
lea rcx, str.Leaked_or_smashed_objects_encountered
call fcn.140002260
call qword [sym.imp.KERNEL32.dll_DebugBreak]
jmp 0x14000a775
mov rcx, rax
jmp 0x14000a859
lea rdi, [r13 + 0x10]
mov r9d, eax
mov qword [r13 + 8], 0
mov qword [rcx + r9 - 8], 0
and rdi, 0xfffffffffffffff8
sub rcx, rdi
add ecx, eax
mov eax, ecx
shr eax, 3
mov ecx, eax
mov rax, r12
rep stosq qword [rdi], rax
jmp 0x14000a8e0
lea r8, [rax + 0xfff]
mov qword [0x140031f18], rcx
shr r8, 0xc
cmp edx, 2
jne 0x14000a996
sub qword [0x140060618], rax
cmp r8, 1
jbe 0x14000a9a7
shl r8, 0xc
sub qword [0x140031ee0], r8
mov rcx, r9
call fcn.1400037f0
jmp 0x14000a8f6
mov eax, eax
mov dword [r13 + 8], 0
mov dword [rcx + rax - 4], 0
jmp 0x14000a8e0
mov eax, eax
xor r9d, r9d
mov word [rcx + rax - 2], r9w
jmp 0x14000a8e0
Function at 0x140012a80
Capabilities:
Get file attributes
Write file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov r13, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov r9d, r8d
mov rdi, rcx
mov rbp, rdx
mov ecx, 0xfde9
mov qword [rsp + 0x38], 0
mov r12d, r8d
mov r8, rdx
xor edx, edx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call r13
movsxd rsi, eax
lea ecx, [rsi + 1]
movsxd rcx, ecx
call fcn.140011790
mov rbx, rax
test rax, rax
je 0x140012b39
mov r9d, r12d
mov r8, rbp
xor edx, edx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x38], 0
mov ecx, 0xfde9
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rax
call r13
mov byte [rbx + rsi], 0
mov rcx, rbx
call sub.ucrtbase.dll_strlen
mov dword [rdi + 0xc], 0
mov dword [rdi + 8], eax
mov rax, rdi
mov qword [rdi], rbx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov edx, 0x10
lea rcx, str.tos2:_nil_string
call fcn.1400210f0
nop
nop dword [rax + rax]
Function at 0x140012b50
Capabilities:
Get file attributes
Write file on windows

Disassembly:
push r14
mov eax, 0x4060
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.140023c00
sub rsp, rax
movaps xmmword [rsp + 0x4050], xmm6
xor r12d, r12d
mov r8d, 0x200
mov rax, r12
mov rbx, rcx
lea rdi, [rsp + 0x60]
mov ecx, 0x3fe
mov qword [rsp + 0x50], 0
rep stosq qword [rdi], rax
lea rsi, [rsp + 0x50]
mov qword [rsp + 0x58], 0
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rcx, rsi
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test ah, 4
je 0x140012c88
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov r8d, 1
mov rcx, rsi
mov dword [rsp + 0x28], pe_nt_image_headers64
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x140012c88
lea rdi, [rsp + 0x2060]
mov ecx, 0x3fe
mov rax, r12
xor r9d, r9d
rep stosq qword [rdi], rax
mov r8d, 0x2000
mov rcx, r13
lea rdi, [rsp + 0x2050]
mov qword [rsp + 0x2050], 0
mov rdx, rdi
mov qword [rsp + 0x2058], 0
call qword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
cmp eax, 0x1fff
jbe 0x140012cd0
mov edx, 0x3e
lea rcx, str.os.executable___saw_that_the_executable_file_path_was_too_long
call fcn.140020fd0
lea rcx, [rsp + 0x40]
mov rdx, rsi
mov r8d, ebp
call fcn.140012a80
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140012ca2
mov rdx, rsi
lea rcx, [rsp + 0x40]
mov r8d, ebp
call fcn.140012a80
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov qword [rbx], rdi
mov qword [rbx + 8], rsi
movaps xmm6, xmmword [rsp + 0x4050]
mov rax, rbx
add rsp, 0x4060
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
lea rsi, [rsp + 0x40]
mov r8d, eax
mov rdx, rdi
mov rcx, rsi
lea rdi, [0x1400284a3]
call fcn.140012a80
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rcx, rsi
mov r9d, 4
mov dword [rsp + 0x20], r8d
mov rbp, r8
sar rbp, 0x20
call fcn.140021220
mov rsi, qword [rsp + 0x48]
mov r12, qword [rsp + 0x40]
mov eax, 1
test esi, esi
jne 0x140012d50
movd xmm6, esi
movd xmm0, eax
punpckldq xmm6, xmm0
cmp ebp, 0xfa1d05ee
je 0x140012d80
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx], rdi
movq qword [rbx + 8], xmm6
jmp 0x140012ca9
lea ecx, [rsi + 1]
movsxd r14, esi
movsxd rcx, ecx
call fcn.140011790
mov r8, r14
mov rdx, r12
mov rdi, rax
mov rcx, rax
call sub.ucrtbase.dll_memcpy
mov byte [rdi + r14], 0
xor eax, eax
jmp 0x140012d21
mov ecx, 1
lea r14, [0x140028308]
mov ebp, 0x1e
call qword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov r12, rax
nop word [rax + rax]
mov r8, rbp
mov rcx, r14
mov r9, r12
mov edx, 1
call sub.ucrtbase.dll_fwrite
sub rbp, rax
add r14, rax
test rbp, rbp
jg 0x140012da0
jmp 0x140012d35
Function at 0x14001dde0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, qword [0x14002c600]
mov rsi, qword [rbx + 0x78]
mov rax, qword [rbx + 0x88]
sub rax, rsi
cmp rax, 0x7fff
ja 0x14001deb4
mov rax, qword [0x14002c790]
mov rdx, qword [0x14002c7f0]
cmp dword [rax], 1
mov r8d, dword [rdx]
mov rdx, qword [0x14002c800]
sbb eax, eax
and eax, 0xffffffc4
cmp qword [rdx], 1
mov edx, 0x10000
lea r9d, [rax + 0x40]
adc rdx, 0
or r8d, 0x3000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test eax, 0xfff
je 0x14001ded0
lea rcx, str.Bad_VirtualAlloc_result
call fcn.140002260
mov rdi, qword [sym.imp.KERNEL32.dll_DebugBreak]
call rdi
mov rax, qword [rbx + 0xf0]
cmp rax, 0x3ff
jbe 0x14001de8b
lea rcx, str.Too_many_heap_sections
call fcn.140002260
call rdi
mov rax, qword [rbx + 0xf0]
lea rdx, [rax + 1]
mov qword [rbx + rax*8 + 0x163d0], rsi
lea rax, [rsi + 0x10000]
add qword [rbx + 0x38], 0x10000
mov qword [rbx + 0xf0], rdx
mov qword [rbx + 0x88], rax
lea rax, [rsi + 0x8000]
mov qword [rbx + 0x78], rax
mov rax, rsi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
cmp qword [rbx + 0xf0], 0x3ff
jbe 0x14001deef
lea rcx, str.Too_many_heap_sections
call fcn.140002260
call qword [sym.imp.KERNEL32.dll_DebugBreak]
test rsi, rsi
jne 0x14001df30
mov edx, 0x8000
lea rcx, str.GC_Warning:_Out_of_memory___trying_to_allocate_requested_amount___ld_bytes_..._n
call fcn.140003590
mov ecx, 0x8000
call fcn.1400025d0
mov rsi, rax
test rax, rax
je 0x14001debf
add qword [rbx + 0x38], 0x8000
mov rax, rsi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov rax, qword [rbx + 0xf0]
jmp 0x14001de8b
Function at 0x14001df40
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, qword [0x14002c600]
mov rsi, qword [rbx + 0x78]
mov rax, qword [rbx + 0x88]
sub rax, rsi
cmp rax, 0x201f
ja 0x14001e014
mov rax, qword [0x14002c790]
mov rdx, qword [0x14002c7f0]
cmp dword [rax], 1
mov r8d, dword [rdx]
mov rdx, qword [0x14002c800]
sbb eax, eax
and eax, 0xffffffc4
cmp qword [rdx], 1
mov edx, 0x10000
lea r9d, [rax + 0x40]
adc rdx, 0
or r8d, 0x3000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test eax, 0xfff
je 0x14001e030
lea rcx, str.Bad_VirtualAlloc_result
call fcn.140002260
mov rdi, qword [sym.imp.KERNEL32.dll_DebugBreak]
call rdi
mov rax, qword [rbx + 0xf0]
cmp rax, 0x3ff
jbe 0x14001dfeb
lea rcx, str.Too_many_heap_sections
call fcn.140002260
call rdi
mov rax, qword [rbx + 0xf0]
lea rdx, [rax + 1]
mov qword [rbx + rax*8 + 0x163d0], rsi
lea rax, [rsi + 0x10000]
add qword [rbx + 0x38], 0x10000
mov qword [rbx + 0xf0], rdx
mov qword [rbx + 0x88], rax
lea rax, [rsi + 0x2020]
mov qword [rbx + 0x78], rax
mov rax, rsi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
cmp qword [rbx + 0xf0], 0x3ff
jbe 0x14001e04f
lea rcx, str.Too_many_heap_sections
call fcn.140002260
call qword [sym.imp.KERNEL32.dll_DebugBreak]
test rsi, rsi
jne 0x14001e090
mov edx, 0x2020
lea rcx, str.GC_Warning:_Out_of_memory___trying_to_allocate_requested_amount___ld_bytes_..._n
call fcn.140003590
mov ecx, 0x2020
call fcn.1400025d0
mov rsi, rax
test rax, rax
je 0x14001e01f
add qword [rbx + 0x38], 0x2020
mov rax, rsi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov rax, qword [rbx + 0xf0]
jmp 0x14001dfeb
Function at 0x140020000
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov eax, dword [rsp + 0xa0]
lea r13d, [rax + 1]
mov eax, dword [rsp + 0xa8]
mov r14, rcx
mov rcx, rdx
lea esi, [rax + 1]
mov dword [rsp + 0x2c], r9d
mov rbx, rdx
mov r12d, r8d
mov r15d, esi
call fcn.1400111e0
mov edi, eax
sub r15d, eax
xor eax, eax
cmp esi, edi
cmovle r15d, eax
lea ecx, [rdi + r15 + 8]
test ecx, ecx
cmovs ecx, eax
xor ebp, ebp
movsxd rcx, ecx
call fcn.140011ce0
mov r9d, dword [rsp + 0x2c]
mov rsi, rax
test r9b, r9b
je 0x140020074
mov byte [rax], 0x2d
mov ebp, 1
xor r9d, r9d
cmp edi, 1
setle r9b
cmp r13d, edi
jge 0x140020270
mov rax, qword [0x14002ca30]
mov rdx, qword [rax + 8]
mov eax, edi
sub eax, r13d
cdqe
mov rcx, qword [rdx + rax*8 - 8]
lea r10, [rcx + rcx*4]
mov rcx, qword [rdx + rax*8]
mov rax, rbx
xor edx, edx
add r10, rbx
div rcx
xor edx, edx
mov r11, rax
mov rax, r10
div rcx
mov rbx, rax
cmp r11, rax
jb 0x140020280
mov r10d, r13d
lea r11d, [r13 + rbp]
sub r10d, r9d
cmp r10d, 1
jle 0x140020298
movabs r8, 0xcccccccccccccccd
movsxd rax, r11d
lea r9, [rsi + rax - 1]
lea rcx, [rsi + rax]
lea eax, [r10 - 2]
sub r9, rax
nop word [rax + rax]
mov rax, rbx
sub rcx, 1
mul r8
shr rdx, 3
lea rax, [rdx + rdx*4]
add rax, rax
sub rbx, rax
add ebx, 0x30
mov byte [rcx + 1], bl
mov rbx, rdx
cmp rcx, r9
jne 0x140020100
mov edx, dword [rsp + 0xa0]
lea ebp, [rbp + r10 - 1]
sub r10d, 1
test edx, edx
je 0x140020237
mov eax, r11d
add ebp, 1
sub eax, r10d
add r10d, 1
cdqe
mov byte [rsi + rax], 0x2e
sub r11d, r10d
js 0x14002017e
movabs rax, 0xcccccccccccccccd
movsxd r11, r11d
add ebp, 1
mul rbx
shr rdx, 3
lea rax, [rdx + rdx*4]
add rax, rax
sub rbx, rax
add ebx, 0x30
mov byte [rsi + r11], bl
test r15d, r15d
je 0x140020199
movsxd rcx, ebp
movsxd r8, r15d
mov edx, 0x30
add ebp, r15d
add rcx, rsi
call sub.ucrtbase.dll_memset
add edi, r12d
lea eax, [rbp + 1]
movsxd rdx, ebp
mov r9d, 0x2b
cdqe
mov r8d, edi
lea ecx, [rbp + 2]
add rdx, rsi
add rax, rsi
sub r8d, 1
jns 0x1400201cb
mov r8d, 1
mov r9d, 0x2d
sub r8d, edi
mov r10d, 0xcccccccd
mov byte [rdx], 0x65
mov byte [rax], r9b
mov eax, r8d
imul rax, r10
shr rax, 0x23
lea edx, [rax + rax*4]
mov r9d, eax
mov eax, r8d
add edx, edx
sub eax, edx
mov edx, r9d
imul rdx, r10
shr rdx, 0x23
lea r11d, [rdx + rdx*4]
mov r10d, edx
mov edx, r9d
add r11d, r11d
sub edx, r11d
cmp r8d, 0x63
jle 0x14002021e
movsxd rcx, ecx
add r10d, 0x30
mov byte [rsi + rcx], r10b
lea ecx, [rbp + 3]
add edx, 0x30
movsxd r8, ecx
lea ebp, [rcx + 2]
add eax, 0x30
mov byte [rsi + r8], dl
lea edx, [rcx + 1]
movsxd rdx, edx
mov byte [rsi + rdx], al
movsxd rax, ebp
mov byte [rsi + rax], 0
test rsi, rsi
je 0x1400202b4
mov rax, r14
mov dword [r14 + 0xc], 0
mov qword [r14], rsi
mov dword [r14 + 8], ebp
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r13d, edi
jmp 0x1400200c8
mov eax, dword [rsp + 0xa0]
add r12d, 1
lea r13d, [rax + 2]
jmp 0x1400200c8
mov eax, dword [rsp + 0xa0]
test eax, eax
je 0x140020237
xor r10d, r10d
test r13d, r13d
jle 0x140020151
jmp 0x14002013e
call fcn.140016f90
nop
nop word [rax + rax]
Function at 0x140020d80
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
mov rdi, rcx
lea ecx, [r8 + 1]
mov rsi, rdx
mov ebx, r8d
movsxd rcx, ecx
call fcn.140011790
mov rdx, rax
test ebx, ebx
jle 0x140020f80
lea eax, [rbx - 1]
cmp eax, 0xe
jbe 0x140020fa9
mov ecx, ebx
movdqa xmm6, xmmword [0x14002c270]
xor eax, eax
pxor xmm3, xmm3
shr ecx, 4
movdqa xmm5, xmmword [0x14002c280]
movdqa xmm4, xmmword [0x14002c290]
shl rcx, 4
nop
movdqu xmm2, xmmword [rsi + rax]
movdqa xmm0, xmm2
movdqa xmm1, xmm2
paddb xmm0, xmm6
paddb xmm1, xmm4
psubusb xmm0, xmm5
pcmpeqb xmm0, xmm3
pand xmm1, xmm0
pandn xmm0, xmm2
por xmm0, xmm1
movups xmmword [rdx + rax], xmm0
add rax, 0x10
cmp rcx, rax
jne 0x140020de0
mov eax, ebx
and eax, 0xfffffff0
mov ecx, eax
cmp ebx, eax
je 0x140020fb2
mov r8d, ebx
sub r8d, ecx
lea r9d, [r8 - 1]
cmp r9d, 6
jbe 0x140020e89
movq xmm0, qword [0x14002c270]
movq xmm2, qword [rsi + rcx]
movq xmm3, qword [0x14002c280]
movq xmm1, qword [0x14002c290]
paddb xmm0, xmm2
paddb xmm1, xmm2
psubusb xmm0, xmm3
pxor xmm3, xmm3
pcmpeqb xmm0, xmm3
pand xmm1, xmm0
pandn xmm0, xmm2
por xmm0, xmm1
movq qword [rdx + rcx], xmm0
mov ecx, r8d
and ecx, 0xfffffff8
add eax, ecx
and r8d, 7
je 0x140020f80
movsxd r8, eax
movzx ecx, byte [rsi + r8]
lea r10d, [rcx - 0x61]
lea r9d, [rcx - 0x20]
cmp r10b, 0x1a
cmovb ecx, r9d
mov byte [rdx + r8], cl
lea ecx, [rax + 1]
cmp ebx, ecx
jle 0x140020f80
movsxd rcx, ecx
movzx r8d, byte [rsi + rcx]
lea r10d, [r8 - 0x61]
lea r9d, [r8 - 0x20]
cmp r10b, 0x1a
cmovb r8d, r9d
mov byte [rdx + rcx], r8b
lea ecx, [rax + 2]
cmp ebx, ecx
jle 0x140020f80
movsxd rcx, ecx
movzx r8d, byte [rsi + rcx]
lea r10d, [r8 - 0x61]
lea r9d, [r8 - 0x20]
cmp r10b, 0x1a
cmovb r8d, r9d
mov byte [rdx + rcx], r8b
lea ecx, [rax + 3]
cmp ecx, ebx
jge 0x140020f80
movsxd rcx, ecx
movzx r8d, byte [rsi + rcx]
lea r10d, [r8 - 0x61]
lea r9d, [r8 - 0x20]
cmp r10b, 0x1a
cmovb r8d, r9d
mov byte [rdx + rcx], r8b
lea ecx, [rax + 4]
cmp ecx, ebx
jge 0x140020f80
movsxd rcx, ecx
movzx r8d, byte [rsi + rcx]
lea r10d, [r8 - 0x61]
lea r9d, [r8 - 0x20]
cmp r10b, 0x1a
cmovb r8d, r9d
mov byte [rdx + rcx], r8b
lea ecx, [rax + 5]
cmp ebx, ecx
jle 0x140020f80
movsxd rcx, ecx
movzx r8d, byte [rsi + rcx]
lea r10d, [r8 - 0x61]
lea r9d, [r8 - 0x20]
cmp r10b, 0x1a
cmovb r8d, r9d
add eax, 6
mov byte [rdx + rcx], r8b
cmp ebx, eax
jle 0x140020f80
cdqe
movzx ecx, byte [rsi + rax]
lea r9d, [rcx - 0x61]
lea r8d, [rcx - 0x20]
cmp r9b, 0x1a
cmovb ecx, r8d
mov byte [rdx + rax], cl
movsxd rax, ebx
mov byte [rdx + rax], 0
test rdx, rdx
je 0x140020fbb
mov dword [rdi + 0xc], 0
mov rax, rdi
mov qword [rdi], rdx
mov dword [rdi + 8], ebx
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
xor ecx, ecx
xor eax, eax
jmp 0x140020e25
movsxd rax, ebx
mov byte [rdx + rax], 0
jmp 0x140020f8c
call fcn.140016f90
nop
nop word cs:[rax + rax]
nop dword [rax]