joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1807a28ab
Capabilities:
Parse pe header

Disassembly:
xor dil, bl
mov eax, 0x43328a96
mov word [r11 + rdx - 0x289c8838], bx
inc rbp
mov ebx, dword [rsi + rbp*2 - 0xf5]
xadd al, dh
lea rsi, [rbp + rsi - 0x7d]
add r9, rcx
bts rax, rcx
jae 0x18072010f
ror r9d, 1
mov eax, 0x72bfaa0
neg r8b
adc r8b, sil
lea r9d, [rsi + r9 - 0x3c8cedf2]
push rbx
xor dword [rsp + rsi - 0x73db], r9d
pop rbx
or cl, 0x83
rol sil, 0xa1
movsxd r9, r9d
mov edi, eax
sbb ax, ax
cdq
add r11, r9
shl si, 9
sal r8, 0xcc
mov rcx, qword [rbp + rsi*4 - 0x1b800]
lea rbp, [rsi + rbp - 0x6df8]
neg rdx
btc rsi, rax
movzx r9d, dil
push rcx
mov ecx, edi
jae 0x1807c0e61
dec byte [rsp + rdi - 0x8130]
xor ax, 0x5abb
bts rsi, rsi
adc rsi, qword [rsp + rdi - 0x8133]
mov qword [rsp + rdi - 0x8123], rdx
dec ax
sal byte [rsp + rdi - 0x8131], 0xc7
rol ax, 1
bts edi, 0x93
sbb esi, dword [rsp + rdi - 0x88121]
js 0x1807bd0b7
movsx ebx, cl
add edx, 0xcda7c73e
dec qword [rsp + r9 - 0x56142f]
xchg dword [rsp + r9*8 - 0x2b0a1e6], ecx
xor edx, 0x3f8ff42f
movsx eax, byte [rsp + r9*2 - 0xac2868]
neg rax
lea edx, [rdx + rcx - 0x2f2a5043]
inc dword [rsp + rcx - 0x352d]
movsx ebp, byte [rsp + r9 - 0x56142d]
btr ecx, 8
not edx
mov qword [rsp + r9 - 0x56142e], rdi
sal word [rsp + r9 - 0x561439], 0xc8
btc bx, r9w
lea rax, [rcx + rbx*2 + 0x78bd1e24]
xor dword [rsp + r9 - 0x56142e], edx
mov rdi, qword [rsp + r9*4 - 0x15850e8]
mov qword [rsp + r9*2 - 0xac286c], rbx
rol rax, 0x68
bts ebp, r9d
movsxd rdx, edx
adc r10, rdx
mov edx, dword [r9 + r11 - 0x56143e]
call fcn.1806fa2e6
mov edx, 0x289c8836
movzx ebx, byte [rdx + rsi - 0x289c8837]
movsx r9d, dx
lea r8, [r9 - 0x6de487f1]
movzx ebp, r9b
xor bl, dil
or bp, r8w
add r9, 0xffffffffec3c98ab
or r8w, r8w
neg bl
dec bl
neg bl
add bl, 0xa1
movsx ecx, dx
jmp 0x18071509d
or r8w, 0x5d01
adc r11, rax
add r9w, 0x2711
btc r8, r8
mov qword [rsp + rdi - 0x7ec5], r8
movzx eax, word [rdi + r10 - 0x7ec1]
xor ax, bx
dec qword [rsp + rdi*2 - 0xfd7f]
not qword [rsp + rdi - 0x7eb5]
neg di
not ax
not r9
mov qword [rsp + rdi - 0x8131], r9
inc ax
jmp 0x180771a0d
xor ax, 0x650a
and r8b, r8b
movzx ecx, dil
neg ax
inc ax
ror cx, 0xe5
xor bx, ax
push rdx
not r9b
mov dword [rbp + rdx*4 - 0xe8], eax
bt di, r8w
neg word [rsp + rdx*2 - 0x6d]
lea r9, [rcx + r8*2 + 0xa2b410a]
mov r8d, dword [rdi + rbp - 0x88137]
lea rbp, [rbp + rdi*2 - 0x11026e]
dec rdi
movzx eax, byte [r10 + rdi - 0x88134]
lea r10, [r10 + rdi*2 - 0x11026d]
sar r9, 0xde
xor al, bl
xor al, 8
xadd byte [rsp + rdi - 0x8811b], sil
sal edx, 0xc5
not word [rsp + rdx - 0x759]
neg al
neg word [rsp + rdx - 0x75b]
xchg di, cx
adc al, dil
and dword [rsp + rdx - 0x75b], 0x402e3fa1
xor al, 0x2b
add r9d, ecx
push rdi
xor bl, al
add word [rsp + rdi*2 - 0x11aff2], di
add word [rsp + rdi*4 - 0x235fe4], cx
lea rax, [rsp + rax + 0x30]
mov dword [rax + rdi*2 - 0x11b002], r8d
and word [rsp + rdi*4 - 0x235fd7], r9w
mov qword [rsp + rdi*4 - 0x236004], r11
ret 0x28
popfq
neg eax
xadd ax, dx
jmp r11
Function at 0x1807a2e46
Capabilities:
Authenticate hmac

Disassembly:
movsxd rdx, edx
adc r10, rdx
movzx ecx, byte [rbp + rsi - 0x2000105]
cqo
mov qword [rsp + rbp*4 - 0x8000400], rdx
shr r8b, 0x82
lea rsi, [rsi + rbp - 0x2000105]
or word [rsp + rbp*4 - 0x80003fa], dx
dec ebx
sub byte [rsp + rbp - 0x20000fe], bh
xor cl, dil
dec edx
dec bpl
xor cl, dl
cwde
sub cl, 0x90
add qword [rsp + rbp - 0x20001ff], rbx
add byte [rsp + r9*2 + 1], bl
btr ebx, r9d
xor cl, dl
push rax
add rbp, r9
sub word [rsp + rbp*2 - 0x40003f1], r9w
adc cl, 0xb7
neg word [rsp + rbp*8 - 0x10000fee]
dec word [rsp + rbp*4 - 0x80007f6]
cdqe
rol cl, 1
xor dil, cl
inc dword [rsp + rbp*4 - 0x80007f5]
inc r8w
sar r8, 0xc3
lea rcx, [rsp + rcx + 0x10]
shl rbx, 0x51
bt bx, dx
mov r8w, word [rcx + r8*2 - 0x3f829c80]
xchg bx, ax
cdq
sbb ax, bp
mov word [r11 + rbp*2 - 0x40003f6], r8w
pop rax
jb 0x18074bcfc
mov esi, 0x81cf996
movsx eax, sil
cqo
movzx esi, byte [r10 + rdx*4]
cbw
movsx r9d, ax
mov edi, r9d
xor sil, bl
sar r9d, 0x94
movzx r8d, al
rol sil, 1
bt edx, 8
shr al, 0xe2
sar r9b, 0x46
xor sil, 0x85
inc r9d
sub sil, 0xa0
call fcn.1806e9dd1
pop rdi
movsxd r9, r9d
jp 0x1807200be

Function at 0x1807a3d21
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions
Parse pe header

Disassembly:
pop r9
popfq
pop rcx
lea rax, [r10 + rax*2 - 0x2ad5ed45]
cdq
xchg bpl, al
pop rbp
push r13
call fcn.18072cc6b

Function at 0x1807a41e4
Capabilities:
Authenticate hmac

Disassembly:
sar di, 0xe3
movzx edi, word [r10 + r9*2 - 0x4b4f0c22]
inc r8b
xchg word [rsp + r9*2 - 0x4b4f0c1d], r9w
mov qword [rsp + r9*2 - 0x4b4dfff8], rdx
lea r10, [r10 + r9*2 - 0x4b4dfffe]
xor di, bx
xchg word [rsp + r9*2 - 0x4b4dfff5], dx
add di, 0x95bf
call fcn.180703f03
mov ax, word [rbp + riz]
mov esi, 0x13697bd
lea r8, [rsi*4 - 0x7dd2df8]
mov cl, byte [rbp + rsi*4 - 0x4da5ef2]
lea rbp, [rsi + rbp - 0x13697bb]
sal ax, cl
movsx ecx, si
lea rdi, [rcx + rsi - 0x30ceaf7e]
mov word [rbp + rsi*4 - 0x4da5ef4], ax
movsx eax, di
shr cx, 0x83
mov r9d, r8d
mov esi, dword [r10 + rsi*2 - 0x26d2f7a]
sar ecx, cl
shl al, 0xa5
lea r10, [r10 + r8 + 0x302cf08]
jb 0x1806ef53e
mov qword [rsp + r9 - 0x25a78611], rsi
mov qword [rsp + r9 - 0x25a78611], rbx
xor dword [rsp + r9*2 - 0x4b4f0c22], ecx
add si, ax
push rdi
mov rbx, qword [rsp + r9*2 - 0x4b4f0c1a]
add r8, rax
movsxd rcx, ecx
add dl, 0x85
add r11, rcx
jmp 0x180728825

Function at 0x1807a57c4
Capabilities:
Authenticate hmac

Disassembly:
pop r9
pop rax
pop rdx
pop r8
pop rdx
pop r9
jne fcn.180764d25

Function at 0x1807a57f2
Capabilities:
Authenticate hmac

Disassembly:
movzx edx, r8b
mov r10, rsi
pop r8
pop rax
pop rsi
pop r9
pop r9
pop rdx
jb 0x180737954
Function at 0x1807a8f90
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions
Parse pe header

Disassembly:
not word [rsp + r8 - 0x1aff]
sete dl
mov r9d, dword [r10 + r8*2 - 0x3616]
btc r8w, dx
lea rsi, [rdi + rcx*4 - 0x1ef2d4e]
cmovb esi, ecx
lea r10, [r10 + r8 - 0x1b05]
push rsi
shl r8d, 0x43
xor r9d, ebx
lea r9d, [r9 + rcx*2 - 0x6390fee5]
mov qword [rsp + r8*2 - 0x1b088], rcx
xor r9d, 0x5ba80829
dec r9d
rol r9d, 3
not rsi
not dword [rsp + r8*2 - 0x1b08d]
bswap r9d
xor r9d, 0x7a67731
sal dil, 0x41
btr rdi, 0x1d
lea rax, [rdi*8 - 0x655cef80]
ror r9d, 1
shr cl, 0xa1
xadd byte [rsp + rcx - 0x8df4], dil
and rdx, rcx
inc r9d
not word [rsp + r8*8 - 0x6c22a]
mov qword [rsp + r8 - 0xd838], rbx
inc di
pop rax
shr cx, 0x8e
xor dword [rsp + r8*4 - 0x36118], r9d
sal rax, 0xad
mov rbx, qword [rsp + r8*2 - 0x1b088]
movsxd r9, r9d
adc r11, r9
movzx r9d, word [rsp + r8 - 0xd846]
shl si, 9
pop rcx
pop rsi
jne fcn.180739d94

Function at 0x1807adb57
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions
Hash data using murmur3
Parse pe header

Disassembly:
mov ecx, dword [r10 + riz]
mov r8d, 0x8b337428
movzx eax, r8b
lea r10, [r10 + rax*4 - 0x9c]
mov qword [rsp + rax*4 - 0xa0], r8
setns al
movzx esi, word [rsp + rax*2 + 2]
xor ecx, ebx
add word [rsp + rax + 2], ax
and word [rsp + rax*2 + 1], 0x83ab
ror ecx, 3
cdqe
lea ecx, [r8 + rcx - 0x222c7f26]
lea rdi, [rsi*4 - 0x437553f3]
bswap ecx
or byte [rsp + rax], sil
setp byte [rsp + rax + 1]
neg ecx
mov r9d, r8d
ror r9b, 3
cdqe
mov qword [rsp + rax*2 - 2], rbx
movzx ebx, sil
and ax, di
sar edi, 0x70
xor dword [rsp + rax*2 - 2], ecx
xor r9b, dil
btc r8w, r8w
bts r8w, si
pop rbx
inc si
sar sil, 0x65
xor r9, 0x3f215736
movsxd rcx, ecx
cmovs r8w, di
or rdi, 0x1e985e19
adc r11, rcx
lea rcx, [rsi + rax*2 - 0x6d57c6f9]
cdqe
and r8w, cx
jno fcn.180739d94
call fcn.18070499d
Function at 0x1807b1820
Capabilities:
Authenticate hmac

Disassembly:
movzx edx, si
bswap r8d
jmp 0x18071b2fa
pop r8
adc sil, 0x87
shl al, 0xc2
xor bl, sil
add dword [rsp + rdi - 0xb2], edi
lea rbp, [rdx + rbp + 0x7178ffe3]
setne al
xchg edi, r9d
mov qword [rdx + rbp + 0x7178ffeb], rsi
shl byte [rsp + rdx + 0x7178ffed], 0x41
shr dx, 0xaf
pop r8
jp fcn.180739d94
mov ecx, 0xd09283ba
mov rdx, rbp
mov qword [rbp + riz - 8], rdx
movzx esi, cx
movsx edi, cl
mov r8d, dword [r10 + rsi*2 - 0x10774]
shl edi, cl
adc rcx, rsi
lea r10, [r10 + rsi - 0x83b6]
sub ecx, ecx
xor r8d, ebx
not edi
movsx eax, di
sal edi, 0x8c
sbb r8d, ecx
jmp 0x18075ebb8

Function at 0x1807b5535
Capabilities:
Authenticate hmac

Disassembly:
mov rcx, qword [rsi + rbp - 0x34afb5b9]
movzx edx, al
jo 0x18072e5f1
mov rdi, qword [rcx + rsi - 0x34afb5b9]
push rax
shl r9w, 0x87
mov qword [rbp + rsi*2 - 0x695f6b72], rdi
mov qword [rsp + rdx - 0x72], r11
ret
add r10, 4
xor edi, ebx
movsx ecx, r9w
lea edi, [rdi + rcx*8 - 0x63933c3f]
mov qword [rsp + rcx - 0x6b30], rcx
xor edi, 0x5ba80829
push rcx
xor byte [rsp + rcx*4 - 0x1acb2], dl
xor qword [rsp + rcx*4 - 0x1acb8], rdx
dec edi
sal dx, 0x2a
rol edi, 3
bswap edi
movzx eax, byte [rsp + rcx - 0x6b25]
call fcn.1807b18c1
jne 0x18078417e
ror eax, 3
or ebp, ebp
pop rbp
pop rcx
push rdi
cmovp cx, dx
setge bl
xor dword [rsp + rcx - 0x443a], eax
ror r9w, 0x4a
call fcn.1807a9d51
pop rbx
xor cl, r8b
rol rcx, 0x2d
xadd cx, di
movsxd rax, eax
adc r11, rax
add r8d, r9d
mov eax, r8d
jbe 0x180718e92

Function at 0x1807b67c6
Capabilities:
Parse pe header

Disassembly:
lea rsp, [rsp + 0x30]
je 0x1807c369c
Function at 0x1807b71c9
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
and r9, rbp
mov qword [r11 + riz], r9
pop r8
pop rbx
jmp r10
jmp 0x180711f5a
call fcn.1807a90c7
mov ebx, dword [rsp + 2]
not r9
xchg ebx, r8d
mov dword [rsp], r8d
not rbp
ror r8, cl
jae 0x1806e3387
dec byte [rsp + rdx*2 + 0x17]
sar word [rsp + rdx*2 + 0xb], 0xad
mov dword [rbp + rdx*4 - 4], r9d
add dl, sil
shr rsi, 0xae
rol r8b, 2
lea rbp, [rbp + rdx - 0xcd]
inc dword [rsp + rdx - 0xbe]
call fcn.1807691dc
mov r8d, 0x8091b799
mov rbp, qword [r11 + riz]
lea r9, [r8*2 - 0x4c7d29fd]
movzx ecx, r9w
mov eax, ecx
mov rax, qword gs:[rbp + rcx*2 - 0x8a6a]
mov qword [r11 + rcx*8 - 0x229a8], rax
mov ebp, 0x101fba11
xor ecx, r9d
jl 0x1807b4595
mov r8d, 0xe4197113
mov rcx, qword [rbp + riz]
mov rdx, qword [rcx + riz]
mov qword [rbp + riz], rdx
movsx ecx, r8b
mov rcx, qword [rcx + rbp - 0x13]
movzx edx, byte [r10 + riz]
lea rsi, [r8 + r8*8 - 0x43647d6c]
mov eax, 0xa1a8c709
xor dl, bl
rol dl, 1
xor si, 0x12a
adc dl, 0x1f
push rax
mov r9d, r8d
rol r8d, 0xf9
xor dl, 0x9b
call fcn.1806dc235
mov qword [rsp], r11
shl dl, 0x25
push rbx
movzx ebx, dl
adc ebx, eax
bts rdx, rdx
jae 0x18079be4d
mov edx, ebx
xor ecx, ecx
jmp 0x1806e9f63
lea rsi, [rsi + rbp*2 - 0x203f7426]
mov ebx, ebp
mov r9d, dword [rsi + rbp*2 - 0x203f7422]
ror r8w, 0x45
jne 0x1807c8d80
xor bl, al
or dx, word [rsp + rdx - 0x579d8e21]
not dl
adc dl, byte [rsp + rdx - 0x579d8eca]
mov qword [rsp + rdx - 0x579d8eed], r10
sal rdx, 0x59
mov qword [rsp], 0x5b127b07
jae 0x18078383b
adc r9b, al
neg r8
sub r8w, 0x220d
rol r9b, cl
inc r8
xor r8d, ecx
push rcx
sbb r9b, 5
cqo
xor dil, r9b
call fcn.180776df9
and r8d, ebp
xor r9d, edi
movsx edx, r8b
rol r9d, 1
xor dx, 0x3f2e
not r9d
mov eax, 0x77a764b1
bt eax, eax
xor r9d, 0xbfa9de9c
not ebp
sal ebx, 0xf0
inc r8w
sbb r9d, 0xc08ec82f
push rdi
bt cx, 0xba
bts cx, 0x23
sbb r8b, al
xor dword [rsp + r8 - 0x118860], r9d
pop rdi
lea rbp, [rbp*2 - 0x47e6e5f5]
lea rdx, [rcx*2 + 0x602037ba]
movsxd r9, r9d
lea rcx, [rbx*4 - 0x13d47e6b]
push rax
inc dx
add r10, r9
mov qword [rsp + r8*8 - 0x8c4300], r10
ret
Function at 0x1807bd7d6
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey
Hash data using murmur3
Parse pe header

Disassembly:
movsx esi, r8b
rol r9, 0x8e
xor cl, bl
rol cl, 1
neg cl
btr edx, 0xb2
sub esi, edx
neg r9w
ror cl, 1
jmp 0x18077f060
mov qword [rsp + rcx*4 - 0x3f8], r11
ret 0x18
movzx r9d, di
movzx r8w, byte [rbp + rcx - 0xd]
not dword [rsp + rcx + 0x11]
pop rsi
add sil, dl
adc sil, byte [rcx + rbp - 0xb]
not r8b
not sil
xchg byte [rsp + rcx*2 - 6], cl
sal dword [rsp + rcx - 0xec], cl
or r8b, sil
movsx esi, dl
neg qword [rsp + rcx*2 - 0x1f9]
mov word [rbp + rcx*2 - 0x1f6], r8w
lea rbp, [rbp + rcx*2 - 0x1f6]
sar rsi, cl
je 0x18074f085
add cl, dl
xor bl, cl
cdq
shl al, 0xe6
add rcx, rsp
mov eax, dword [rcx + rax*2 + 0x3504500]
btc rdx, rsi
sbb dl, dh
lea rbp, [rbp + r8*4 - 0x5d569f04]
sar edx, 1
mov dword [rbp + r8 - 0x1755a7c0], eax
movsx eax, dx
cmova r8d, edx
call fcn.1807a5a65
jb 0x18075c9a0
xor edx, ebx
mov edi, 0xf41fb43e
and si, 0x73a0
xor edx, 0x9b0cf911
movsx r8d, sil
rol edx, 2
not edx
neg edx
xadd r8w, si
lea rsi, [rsi + r8*2 - 0x5be335fe]
movzx eax, dil
push rbx
sar al, 0xe1
xor dword [rsp + rax*2 - 0x3e], edx
cbw
cwde
mov ecx, r8d
pop rbx
shl ecx, 0xaf
inc r8d
movsxd rdx, edx
dec dil
add r11, rdx
mov esi, dword [rbp + rax*8 - 0xf8]
lea r8, [rax + r8*8 + 0x6bbecf0b]
dec edi
movzx edx, cx
lea rbp, [rbp + rax*2 - 0x3a]
sal edx, 0x74
xor edx, edx
xor cl, dl
movzx r8d, byte [rax + r10 - 0x1f]
lea r9, [rdi*8 + 0x38b959a0]
jge 0x1807703ce
movsxd rsi, esi
adc r11, rsi
mov cl, byte [r10 + r8*2 - 0x2eab4f80]
dec r9d
shl edi, 0x2c
lea rax, [rdi*4 - 0x1d822f2]
lea r10, [r8 + r10 - 0x1755a7bf]
jp 0x1807280ab
sar r8w, 0x8e
cmovae rcx, rdi
mov r9b, byte [rbp + rcx - 0xd]
mov qword [rsp + rcx*2 - 0x22], rsi
mov byte [rsp + rcx*2 - 0x10], cl
not al
sbb r8w, 0x1bae
push rdx
not r9b
rol dword [rsp + rcx + 0x10], cl
shr edi, 0x2b
and al, r9b
bt esi, 0x8b
mov word [rbp + rcx - 0xd], ax
jb 0x1807b830b

Function at 0x1807bd812
Capabilities:
Authenticate hmac

Disassembly:
adc dl, 0xb3
sar cl, 0x65
setae cl
ja 0x18070849f
mov ecx, 0x9786b784
push rcx
mov ebp, 0x3626b629
mov cx, word [rbp + r11 - 0x3626b629]
lea rbx, [rbp + rbp*4 + 0x538f3020]
lea rbp, [rbx*8 + 0x1b264686]
add r11, 2
push rbp
shr qword [rsp + 7], 0xc6
mov ecx, 0x4a13cda3
movzx edx, byte [r10 + rcx - 0x4a13cda3]
lea rdi, [rcx*2 - 0x3e60686c]
xor dl, bl
neg rcx
not dl
rol dl, 1
mov qword [rsp + rcx + 0x4a13cda3], rdi
push rcx
ror byte [rsp + rdi - 0x55c732cd], 0x46
adc dl, 4
mov r8d, 0x9a2d8a9a
neg dl
ror ecx, cl
lea rsi, [rcx - 0x77fd0662]
jb 0x1806dc286

Function at 0x1807c367c
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp], 0xffffffffe295b5ba
mov qword [rsp], rax

Function at 0x1807cabc3
Capabilities:
Parse pe header

Disassembly:
neg ecx
add ecx, 0x2c3a74a5
mov qword [rsp + 0x10], 0xffffffffb0a7482b
mov qword [rsp], 0xffffffff85101304
mov qword [rsp + 0x10], rdi
mov edi, dword [rsp]
sub byte [rsp], dil
xor dword [rsp + 0x10], ecx
ror rdi, 0x5a
btc rdi, rdi
mov rdi, qword [rsp + 0x10]
mov qword [rsp + 8], 0x4e0f95b6
movsxd rcx, ecx
jae 0x180726667
Function at 0x140001090
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
lea rcx, [0x1400032c0]
call fcn.140001010
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400011b0
lea rcx, [0x1400032c0]
call fcn.140001010
movdqa xmm0, xmmword [str.4444]
lea r8, section.vdata
movdqa xmmword [rsp + 0x20], xmm0
xor ecx, ecx
mov edx, dword [rsp + 0x20]
mov eax, 0x4a0
nop word [rax + rax]
movd xmm0, dword [rcx + r8]
movd xmm2, edx
movdqa xmm1, xmm2
xorps xmm1, xmm0
movd dword [rcx + r8], xmm1
movdqa xmm1, xmm2
movd xmm0, dword [rcx + r8 + 4]
xorps xmm1, xmm0
movd dword [rcx + r8 + 4], xmm1
movdqa xmm1, xmm2
movd xmm0, dword [rcx + r8 + 8]
xorps xmm1, xmm0
movd dword [rcx + r8 + 8], xmm1
movd xmm0, dword [rcx + r8 + 0xc]
xorps xmm2, xmm0
movd dword [rcx + r8 + 0xc], xmm2
add rcx, 0x10
cmp rcx, rax
jl 0x1400010e0
nop dword [rax + rax]
xor byte [rax + r8], 0x34
inc rax
cmp rax, 0x4ab
jl 0x140001140
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.EnumDateFormatsA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov rbx, rax
call fcn.1400011b0
test rbx, rbx
je 0x1400011a7
lea rcx, [0x1400032c0]
call fcn.140001010
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400011b0
xor r8d, r8d
lea rcx, [0x140001070]
xor edx, edx
call rbx
xor eax, eax
add rsp, 0x30
pop rbx
ret

Function at 0x140001ca0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001cea
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001cea
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001cea
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001cea
cmp dword [rcx + 0x84], 0xe
jbe 0x140001cea
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001cec
xor al, al
add rsp, 0x28
ret
Function at 0x1800071c4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
cmp qword [rsp + 0x70], 0
jne 0x1800071e1
xor eax, eax
jmp 0x1800072e8
mov rax, qword [rsp + 0x70]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x20], 0
jmp 0x18000724b
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x18]
cmp dword [rsp + 0x20], eax
jae 0x1800072e6
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x40]
call fcn.180007154
movzx eax, al
test eax, eax
je 0x1800072e1
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
movzx eax, word [rcx + rax*2]
mov rcx, qword [rsp + 0x50]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
jmp 0x1800072e8
jmp 0x180007241
xor eax, eax
add rsp, 0x68
ret
Function at 0x380b01cc0
Capabilities:
Access peb ldr_data

Disassembly:
push rdi
push rsi
mov rsi, rcx
push rbx
sub rsp, 0x20
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
mov rdi, qword [rax + 0x20]
mov rbx, rdi
mov rcx, qword [rbx + 0x50]
call fcn.380b01c85
mov eax, eax
cmp rsi, rax
jne 0x380b01cf8
mov rax, qword [rbx + 0x20]
jmp 0x380b01d09
mov rbx, qword [rbx]
test rbx, rbx
je 0x380b01d05
cmp rdi, rbx
jne 0x380b01ce2
or rax, 0xffffffffffffffff
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x380b01d11
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
mov r15, rdx
push r14
push r13
push r12
push rbp
xor ebp, ebp
push rdi
push rsi
push rbx
mov rbx, rcx
sub rsp, 0x28
movsxd rax, dword [rcx + 0x3c]
mov edi, dword [rax + rcx + 0x88]
add rdi, rcx
mov r14d, dword [rdi + 0x20]
mov r12d, dword [rdi + 0x1c]
mov r13d, dword [rdi + 0x24]
add r14, rcx
cmp ebp, dword [rdi + 0x18]
jae 0x380b01d7c
mov esi, ebp
xor edx, edx
mov ecx, dword [r14 + rsi*4]
add rcx, rbx
call fcn.380b01c40
cmp rax, r15
jne 0x380b01d78
add rsi, rsi
add rsi, rbx
movzx eax, word [rsi + r13]
lea rax, [rbx + rax*4]
mov eax, dword [rax + r12]
add rax, rbx
jmp 0x380b01d7c
inc ebp
jmp 0x380b01d46
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x380b023b0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop dword [rax]
Function at 0x380b02420
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x380b08064]
mov rbx, rcx
test esi, esi
jle 0x380b02550
mov rax, qword [0x380b08068]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x380b0246b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x380b024f5
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x380b02450
mov rcx, rbx
call dbg.__mingw_GetSectionForAddress
mov rdi, rax
test rax, rax
je 0x380b02572
mov rax, qword [0x380b08068]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call dbg._GetPEImageBase
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x380b08068]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x380b02557
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x380b024ee
lea edx, [rax - 0x40]
and edx, 0xffffffbf
jne 0x380b02500
add dword [0x380b08064], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x380b08068]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x380b024ee
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.int_pointer_to_int__nullptr_owxCLYNs
mov edx, eax
call dbg.__report_error
nop dword [rax]
xor esi, esi
jmp 0x380b02478
mov rax, qword [0x380b08068]
mov edx, dword [rdi + 8]
lea rcx, str.static_int_instance_count__0___Flush_cache_Kmqm
mov r8, qword [rax + rbx + 0x18]
call dbg.__report_error
mov rdx, rbx
lea rcx, str.___vector_TgDAgCFgYqqeROTsjMFsA
call dbg.__report_error
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x380b02900
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x380b080a0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x380b08080]
test rbx, rbx
je 0x380b0295c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test rsi, rsi
je 0x380b02953
test eax, eax
jne 0x380b02953
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x380b02938
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x380b02b70
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x380b02b88
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x380b02b90
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret