joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002934c
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001c944
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001c944
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14002949c
cmp rax, 0xffffffffffffffff
je 0x14002949c
xor edi, edi
test rbp, rbp
jle 0x140029447
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001f258
mov rbx, rax
test rax, rax
jne 0x1400293d4
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14002943d
mov edx, 0x8000
mov ecx, r14d
call fcn.14001a278
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001d620
cmp eax, 0xffffffff
je 0x14002941d
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400293e4
mov edx, r15d
mov ecx, r14d
call fcn.14001a278
jmp 0x14002943d
cmp byte [rsi + 0x38], dil
je 0x140029434
cmp dword [rsi + 0x34], 5
jne 0x140029434
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14002943d
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001b00c
jmp 0x1400294b0
jns 0x1400294b0
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001c944
cmp rax, 0xffffffffffffffff
jne 0x140029468
cmp byte [rsi + 0x30], dil
je 0x1400294b0
mov edi, dword [rsi + 0x2c]
jmp 0x1400294b0
mov ecx, r14d
call fcn.140018730
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400294b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1400294b0
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1400294a9
mov eax, dword [rsi + 0x2c]
jmp 0x1400294ae
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001c944
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x1004010e0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call sub.cygwin1.dll___getreent
mov rcx, qword [rax + 0x18]
lea r9, str._______________Q_msgkey____M_shmkey____S_semkey__...
lea r8, str.usage:_ipcrm___q_msqid____m_shmid____s_semid_
lea rdx, str._s_n_s_n
call sub.cygwin1.dll_fprintf
mov ecx, 1
call sub.cygwin1.dll_exit
nop
nop word cs:[rax + rax]
Function at 0x140004dac
Capabilities:
Link many functions at runtime

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov r13d, edx
lea rdx, str.Py_Initialize
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
Function at 0x14015905f
Capabilities:
Encode data using xor

Disassembly:
mov r8d, 0x5a3abd09
pop r8
push 0x2bd2891
not esi
jmp 0x140144ad0
lea rsp, [rsp + 8]
jmp fcn.1401500ac
mov dword [r9], esi
jmp 0x140144233
lea rsp, [rsp + 0x10]
je 0x14013ee7b
mov r10d, 0xb23f6e05
jmp 0x14015d783
push r10
mov qword [rsp], r8
lea r10, [0x1401362e0]
movzx r8d, byte [rcx]
push 0x210051b1
xor r8d, esi
and r8d, 0xff
mov r8d, dword [r10 + r8*4]
shr esi, 8
neg dword [rsp]
xor esi, r8d
inc rcx
xor esi, 0xb42e1190
dec r11
not dword [rsp + 3]
lea rsp, [rsp + 8]
jne 0x14015d790
jmp 0x14013ee73
Function at 0x1400151bc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x14001523a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x140015231
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x140015231
mov rax, qword [rbp - 8]
jmp 0x14001524f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x140015204
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140001008
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
lea rcx, str._JAVA_LAUNCHER_DEBUG
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x140001069
lea rcx, str.Windows_original_main_args:_n
call fcn.140001148
xor ebx, ebx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
cmp dword [rax], ebx
jle 0x140001069
xor edi, edi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argv]
mov edx, ebx
lea rcx, str.wwwd_args__d____s_n
mov r8, qword [rax]
mov r8, qword [rdi + r8]
call fcn.140001148
inc ebx
lea rdi, [rdi + 8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
cmp ebx, dword [rax]
jl 0x14000103e
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
call sub.jli.dll_JLI_CmdToArgs
call sub.jli.dll_JLI_GetStdArgc
movsxd rdi, eax
lea ecx, [rdi + 1]
movsxd rcx, ecx
shl rcx, 3
call sub.jli.dll_JLI_MemAlloc
mov rbx, rax
call sub.jli.dll_JLI_GetStdArgs
xor r9d, r9d
test edi, edi
jle 0x1400010b5
xor edx, edx
mov r9d, edi
mov rcx, qword [rax]
lea rax, [rax + 0x10]
mov qword [rbx + rdx*8], rcx
inc rdx
cmp rdx, rdi
jl 0x1400010a2
mov rcx, qword [str.java]
movsxd rax, r9d
and qword [rbx + rax*8], 0
test rcx, rcx
jne 0x1400010cc
mov rcx, qword [rbx]
mov rax, qword [section..data]
test rax, rax
jne 0x1400010db
mov rax, qword [rbx]
and dword [rsp + 0x68], 0
lea r9, str._J_ms8m
mov byte [rsp + 0x60], 0
mov r8d, 2
mov byte [rsp + 0x58], 0
mov rdx, rbx
mov byte [rsp + 0x50], 1
mov qword [rsp + 0x48], rcx
mov ecx, edi
mov qword [rsp + 0x40], rax
lea rax, [0x1400022cc]
mov qword [rsp + 0x38], rax
lea rax, [0x1400022d0]
mov qword [rsp + 0x30], rax
lea rax, str._lib_tools.jar
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r8d
call sub.jli.dll_JLI_Launch
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x1400053b0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
movzx ebp, r8b
mov rbx, rcx
cmp edx, 0x10
jae 0x140005442
test rcx, rcx
je 0x140005442
mov edx, 0x40
call fcn.14000aa90
test al, al
jne 0x140005442
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x140005442
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140005442
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.14000aa90
test al, al
jne 0x140005442
cmp dword [rdi], 0x4550
jne 0x140005442
test rdi, rdi
je 0x140005442
mov rcx, rbx
call fcn.140005980
movzx ecx, al
lea rax, [rsi + 0xf]
lea rax, [rax + rcx*2]
lea rax, [rdi + rax*8]
test bpl, bpl
jne 0x140005444
xor ecx, ecx
cmp dword [rax], ecx
cmove rax, rcx
jmp 0x140005444
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140005460
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x1400054cd
mov edx, 0x40
call fcn.14000aa90
test al, al
jne 0x1400054cd
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x1400054cd
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x1400054cd
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.14000aa90
test al, al
jne 0x1400054cd
cmp dword [rdi], 0x4550
jne 0x1400054cd
test rdi, rdi
je 0x1400054cd
mov rcx, rbx
call fcn.140005980
mov eax, dword [rdi + 0x28]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x1400054e0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov edi, 0x5a4d
test rcx, rcx
je 0x140005557
mov edx, 0x40
call fcn.14000aa90
test al, al
jne 0x140005557
cmp word [rbx], di
jne 0x140005557
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140005557
lea rsi, [rbx + rax]
mov edx, 0xf8
mov rcx, rsi
call fcn.14000aa90
test al, al
jne 0x140005557
cmp dword [rsi], 0x4550
jne 0x140005557
test rsi, rsi
je 0x140005557
mov edx, 0xf8
mov rcx, rsi
call fcn.14000aa90
test al, al
je 0x140005551
xor esi, esi
jmp 0x14000555e
movzx esi, word [rsi + 0x18]
jmp 0x14000555e
xor esi, esi
test rbx, rbx
je 0x1400055d2
mov edx, 0x40
mov rcx, rbx
call fcn.14000aa90
test al, al
jne 0x1400055d2
cmp word [rbx], di
jne 0x1400055d2
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x1400055d2
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.14000aa90
test al, al
jne 0x1400055d2
cmp dword [rdi], 0x4550
jne 0x1400055d2
test rdi, rdi
je 0x1400055d2
mov eax, 0x20b
cmp si, ax
jne 0x1400055bf
mov rax, qword [rdi + 0x30]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov eax, dword [rdi + 0x34]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400055f0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x140005677
mov edx, 0x40
call fcn.14000aa90
test al, al
jne 0x140005677
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x140005677
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140005677
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.14000aa90
test al, al
jne 0x140005677
cmp dword [rdi], 0x4550
jne 0x140005677
mov rcx, rbx
call fcn.140005980
mov rcx, rbx
test al, al
je 0x140005664
call fcn.140005720
mov eax, dword [rax + 0x50]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call fcn.140005690
mov eax, dword [rax + 0x50]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x140005690
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x140005705
mov edx, 0x40
call fcn.14000aa90
test al, al
jne 0x140005705
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x140005705
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140005705
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.14000aa90
test al, al
jne 0x140005705
cmp dword [rdi], 0x4550
jne 0x140005705
test rdi, rdi
je 0x140005705
mov rcx, rbx
call fcn.140005980
xor ecx, ecx
test al, al
cmove rcx, rdi
mov rax, rcx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x140005720
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x140005795
mov edx, 0x40
call fcn.14000aa90
test al, al
jne 0x140005795
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x140005795
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140005795
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.14000aa90
test al, al
jne 0x140005795
cmp dword [rdi], 0x4550
jne 0x140005795
test rdi, rdi
je 0x140005795
mov rcx, rbx
call fcn.140005980
xor ecx, ecx
test al, al
cmovne rcx, rdi
mov rax, rcx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x1400057b0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
test rcx, rcx
je 0x1400057e1
test rdx, rdx
je 0x1400057f3
mov r9d, 0x40
mov r8, rcx
call fcn.14000aa60
test al, al
jne 0x140005801
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov edx, 0x40
call fcn.14000aa90
test al, al
jne 0x1400057e1
mov eax, 0x5a4d
cmp word [rdi], ax
jne 0x1400057e1
movsxd rax, dword [rdi + 0x3c]
cmp eax, 0x400
jg 0x1400057e1
lea rbx, [rdi + rax]
test rsi, rsi
je 0x140005839
mov r9d, 0xf8
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call fcn.14000aa60
test al, al
je 0x1400057e1
jmp 0x14000584a
mov edx, 0xf8
mov rcx, rbx
call fcn.14000aa90
test al, al
jne 0x1400057e1
mov rsi, qword [rsp + 0x38]
xor eax, eax
cmp dword [rbx], 0x4550
cmovne rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400058f0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x140005973
mov edx, 0x40
call fcn.14000aa90
test al, al
jne 0x140005973
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x140005973
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140005973
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.14000aa90
test al, al
jne 0x140005973
cmp dword [rdi], 0x4550
jne 0x140005973
test rdi, rdi
je 0x140005973
mov rcx, rbx
call fcn.140005980
movzx ecx, al
add rcx, 0xa
shl rcx, 4
add rcx, rdi
cmp dword [rcx], 0
je 0x140005973
test rcx, rcx
setne al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor al, al
add rsp, 0x20
pop rdi
ret

Function at 0x140005980
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x1400059ff
mov edx, 0x40
call fcn.14000aa90
test al, al
jne 0x1400059ff
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x1400059ff
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x1400059ff
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.14000aa90
test al, al
jne 0x1400059ff
cmp dword [rdi], 0x4550
jne 0x1400059ff
test rdi, rdi
je 0x1400059ff
mov edx, 0xf8
mov rcx, rdi
call fcn.14000aa90
test al, al
jne 0x1400059ff
mov eax, 0x20b
cmp word [rdi + 0x18], ax
sete al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor al, al
add rsp, 0x20
pop rdi
ret
Function at 0x140009710
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x50
mov r14, rdx
mov r15, rcx
xor r12d, r12d
mov qword [rax - 0x38], r12
mov dword [rax - 0x40], 0x80
mov dword [rax - 0x48], 3
xor r9d, r9d
mov edx, 0x80000000
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400098a1
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor edx, edx
mov r8d, 2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rsi, rax
test rax, rax
je 0x140009898
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
mov edx, 4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbp, rax
test rax, rax
je 0x14000988f
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
mov rax, qword [r14]
test rax, rax
je 0x1400097d4
cmp rax, rbx
cmovbe rbx, rax
mov rdx, rbx
mov rcx, rbp
call fcn.14000aa90
test al, al
je 0x1400098a5
lea rdx, str.____Mapping_of
lea rcx, [0x140047bb0]
call fcn.140005a10
mov rcx, rax
mov rdx, r15
call fcn.1400073a0
mov rcx, rax
lea rdx, str._is_invalid_
call fcn.140005a10
mov r14, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
mov rcx, qword [rcx + rax + 0x40]
mov rbx, qword [rcx + 8]
mov qword [rsp + 0x48], rbx
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 8]
nop
lea rcx, [rsp + 0x40]
call fcn.140006810
mov r8, qword [rax]
mov dl, 0xa
mov rcx, rax
call qword [r8 + 0x40]
movzx r15d, al
test rbx, rbx
je 0x140009872
mov r8, qword [rbx]
mov rcx, rbx
call qword [r8 + 0x10]
test rax, rax
je 0x140009872
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
movzx edx, r15b
mov rcx, r14
call fcn.140009a00
mov rcx, r14
call fcn.1400095e0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400098e9
mov rcx, rbx
call fcn.14000aa10
mov r15, rax
test rax, rax
je 0x1400098c5
mov r8, rbx
mov rdx, rbp
mov rcx, rax
call sub.msvcrt.dll_memcpy
jmp 0x1400098c8
mov rbx, r12
mov qword [r14], rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, r15
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x14000a7e0
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
push rbp
push r13
lea rbp, [r11 - 0x5f]
sub rsp, 0xa8
mov rax, qword [0x140044140]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov dword [rbp + 0xf], 0x74726956
xor r13d, r13d
mov dword [rbp + 0x13], 0x416c6175
mov dword [rbp + 0x17], 0x636f6c6c
mov byte [rbp + 0x1b], 0
mov rax, qword gs:[0x30]
mov qword [rbp - 1], rcx
mov qword [r11 - 0x28], r12
mov r12d, r13d
mov qword [r11 - 0x30], r14
mov rcx, qword [rax + 0x60]
mov qword [r11 - 0x38], r15
mov r11d, r13d
mov dword [rbp - 0x25], edx
mov qword [rbp + 7], r8
mov rax, qword [rcx + 0x18]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
mov rcx, qword [rax]
mov r14, qword [rcx + 0x30]
movsxd rax, dword [r14 + 0x3c]
mov ecx, dword [rax + r14 + 0x88]
add rcx, r14
mov r8d, dword [rcx + 0x14]
mov r15d, dword [rcx + 0x1c]
mov edx, dword [rcx + 0x20]
add r15, r14
mov eax, dword [rcx + 0x24]
add rdx, r14
mov r9d, dword [rcx + 0x18]
add rax, r14
mov dword [rbp - 0x29], r9d
mov qword [rbp - 0x11], rdx
mov qword [rbp - 0x21], rax
mov qword [rbp - 9], r8
test r8, r8
je 0x14000a9b4
mov qword [rsp + 0xd8], rbx
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0x98], rdi
cmp dword [r15 + r12*4], r13d
je 0x14000a97e
mov ecx, r9d
mov rsi, r13
mov qword [rbp - 0x19], rcx
test r9d, r9d
je 0x14000a97e
nop
movzx edi, word [rax + rsi*2]
cmp rdi, r12
jne 0x14000a96a
mov ebx, dword [rdx + rsi*4]
lea r8, [rbp - 0x39]
add rbx, r14
mov dword [rbp - 0x39], 0x50746547
mov dword [rbp - 0x35], 0x41636f72
mov rax, 0xffffffffffffffff
mov dword [rbp - 0x31], 0x65726464
mov word [rbp - 0x2d], 0x7373
mov byte [rbp - 0x2b], r13b
nop dword [rax]
inc rax
cmp byte [r8 + rax], r13b
jne 0x14000a910
mov r10d, r13d
mov r9, r13
test rax, rax
je 0x14000a966
lea rcx, [rbp - 0x39]
sub rbx, rcx
nop dword [rax + rax]
mov r8d, r10d
lea rcx, [rbp - 0x39]
add rcx, r9
inc r10d
movzx edx, byte [rcx + rbx]
cmp dl, byte [rcx]
cmovne r10d, r8d
movsxd rcx, r10d
cmp rcx, rax
jne 0x14000a956
mov r11d, dword [r15 + rdi*4]
add r11, r14
inc r9
cmp r9, rax
jb 0x14000a930
mov rcx, qword [rbp - 0x19]
mov rdx, qword [rbp - 0x11]
mov rax, qword [rbp - 0x21]
inc rsi
cmp rsi, rcx
jb 0x14000a8d0
mov r8, qword [rbp - 9]
mov r9d, dword [rbp - 0x29]
inc r12
cmp r12, r8
jb 0x14000a8b2
mov rdi, qword [rsp + 0x98]
mov rsi, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0xd8]
test r11, r11
je 0x14000a9b4
lea rdx, [rbp + 0xf]
mov rcx, r14
call r11
mov r13, rax
mov rax, qword [rbp - 1]
mov r15, qword [rsp + 0x80]
mov r14, qword [rsp + 0x88]
mov r12, qword [rsp + 0x90]
test rax, rax
je 0x14000a9e9
mov r9d, dword [rbp - 0x25]
mov r8d, 0x3000
mov rcx, qword [rbp + 7]
mov rdx, rax
call r13
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.140022050
add rsp, 0xa8
pop r13
pop rbp
ret
jmp 0x14000a7e0
Function at 0x14000aa00
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
push rbp
push r13
lea rbp, [r11 - 0x5f]
sub rsp, 0xa8
mov rax, qword [0x140044140]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov dword [rbp + 0xf], 0x74726956
xor r13d, r13d
mov dword [rbp + 0x13], 0x416c6175
mov dword [rbp + 0x17], 0x636f6c6c
mov byte [rbp + 0x1b], 0
mov rax, qword gs:[0x30]
mov qword [rbp - 1], rcx
mov qword [r11 - 0x28], r12
mov r12d, r13d
mov qword [r11 - 0x30], r14
mov rcx, qword [rax + 0x60]
mov qword [r11 - 0x38], r15
mov r11d, r13d
mov dword [rbp - 0x25], edx
mov qword [rbp + 7], r8
mov rax, qword [rcx + 0x18]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
mov rcx, qword [rax]
mov r14, qword [rcx + 0x30]
movsxd rax, dword [r14 + 0x3c]
mov ecx, dword [rax + r14 + 0x88]
add rcx, r14
mov r8d, dword [rcx + 0x14]
mov r15d, dword [rcx + 0x1c]
mov edx, dword [rcx + 0x20]
add r15, r14
mov eax, dword [rcx + 0x24]
add rdx, r14
mov r9d, dword [rcx + 0x18]
add rax, r14
mov dword [rbp - 0x29], r9d
mov qword [rbp - 0x11], rdx
mov qword [rbp - 0x21], rax
mov qword [rbp - 9], r8
test r8, r8
je 0x14000a9b4
mov qword [rsp + 0xd8], rbx
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0x98], rdi
cmp dword [r15 + r12*4], r13d
je 0x14000a97e
mov ecx, r9d
mov rsi, r13
mov qword [rbp - 0x19], rcx
test r9d, r9d
je 0x14000a97e
nop
movzx edi, word [rax + rsi*2]
cmp rdi, r12
jne 0x14000a96a
mov ebx, dword [rdx + rsi*4]
lea r8, [rbp - 0x39]
add rbx, r14
mov dword [rbp - 0x39], 0x50746547
mov dword [rbp - 0x35], 0x41636f72
mov rax, 0xffffffffffffffff
mov dword [rbp - 0x31], 0x65726464
mov word [rbp - 0x2d], 0x7373
mov byte [rbp - 0x2b], r13b
nop dword [rax]
inc rax
cmp byte [r8 + rax], r13b
jne 0x14000a910
mov r10d, r13d
mov r9, r13
test rax, rax
je 0x14000a966
lea rcx, [rbp - 0x39]
sub rbx, rcx
nop dword [rax + rax]
mov r8d, r10d
lea rcx, [rbp - 0x39]
add rcx, r9
inc r10d
movzx edx, byte [rcx + rbx]
cmp dl, byte [rcx]
cmovne r10d, r8d
movsxd rcx, r10d
cmp rcx, rax
jne 0x14000a956
mov r11d, dword [r15 + rdi*4]
add r11, r14
inc r9
cmp r9, rax
jb 0x14000a930
mov rcx, qword [rbp - 0x19]
mov rdx, qword [rbp - 0x11]
mov rax, qword [rbp - 0x21]
inc rsi
cmp rsi, rcx
jb 0x14000a8d0
mov r8, qword [rbp - 9]
mov r9d, dword [rbp - 0x29]
inc r12
cmp r12, r8
jb 0x14000a8b2
mov rdi, qword [rsp + 0x98]
mov rsi, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0xd8]
test r11, r11
je 0x14000a9b4
lea rdx, [rbp + 0xf]
mov rcx, r14
call r11
mov r13, rax
mov rax, qword [rbp - 1]
mov r15, qword [rsp + 0x80]
mov r14, qword [rsp + 0x88]
mov r12, qword [rsp + 0x90]
test rax, rax
je 0x14000a9e9
mov r9d, dword [rbp - 0x25]
mov r8d, 0x3000
mov rcx, qword [rbp + 7]
mov rdx, rax
call r13
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.140022050
add rsp, 0xa8
pop r13
pop rbp
ret
jmp 0x14000a7e0