joyce8/EMBER2024-capa huggingface dataset:
Function at 0x434030
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov qword [rsp + 0x18], rax
mov rcx, qword [rax + 0x30]
mov edx, dword [rcx + 0xd0]
inc edx
mov dword [rcx + 0xd0], edx
mov byte [rax + 0xc5], 1
mov qword [rax + 0x10], 0xfffffffffffffade
mov rcx, qword [rax + 0x30]
mov rdx, qword [rcx + 0xa0]
mov edx, dword [rdx + 0x1c]
mov dword [rcx + 0x2ec], edx
mov byte [rax + 0xc7], 1
mov rcx, qword [rax + 0x30]
mov rdx, qword [rcx + 0xa0]
test byte [rcx], al
mov ecx, dword [rdx + 0x1c]
inc ecx
mov dword [rdx + 0x1c], ecx
lea rcx, [rsp + 0x70]
mov qword [rsp], rcx
call dbg.runtime.getcallerpc
mov rax, qword [rsp + 8]
lea rcx, [rsp + 0x70]
mov rdx, rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp], rax
mov qword [rsp + 8], rdx
call dbg.runtime.save
mov rax, qword [rsp + 0x18]
mov rcx, qword [rax + 0x38]
mov qword [rax + 0x70], rcx
mov rcx, qword [rax + 0x40]
mov qword [rax + 0x78], rcx
mov rcx, qword [rax + 0x70]
mov rdx, qword [rax]
cmp rcx, rdx
jae 0x43421c
mov rdx, qword [rax + 0x38]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
lea rbx, [0x00452850]
mov qword [rsp + 0x38], rbx
mov rbx, qword [rsp + 0x10]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x38]
mov qword [rsp], rcx
call dbg.runtime.systemstack
mov rax, qword [rsp + 0x18]
mov qword [rsp], rax
movabs rcx, 0x300000002
mov qword [rsp + 8], rcx
call dbg.runtime.casgstatus
mov rax, qword [rsp + 0x18]
mov rcx, qword [rax + 0x70]
mov rdx, qword [rax]
cmp rcx, rdx
jae 0x43420d
lea rcx, [0x004529c0]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov qword [rsp], rcx
call dbg.runtime.systemstack
lea rax, [0x00566b98]
mov qword [rsp], rax
call dbg.runtime.systemstack
lea rax, [rsp + 0x70]
mov qword [rsp], rax
call dbg.runtime.getcallerpc
mov rax, qword [rsp + 8]
lea rcx, [rsp + 0x70]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call dbg.runtime.save
mov rax, qword [rsp + 0x18]
mov rax, qword [rax + 0x30]
mov ecx, dword [rax + 0xd0]
dec ecx
mov dword [rax + 0xd0], ecx
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov rdx, qword [rax + 8]
cmp rdx, rcx
jb 0x43418d
jmp 0x4341b6
mov rdx, qword [rax + 8]
cmp rdx, rcx
jb 0x4340f7
jmp 0x43415b
Function at 0x446410
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x446596
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov rax, qword [rsp + 0x58]
test rax, rax
je 0x446562
mov ecx, dword [rax + 0x18]
mov dword [rsp + 0x10], ecx
mov qword [rsp], rax
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 8], rcx
mov rdx, qword [rsp + 0x68]
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], 0
movzx ebx, byte [rsp + 0x70]
mov byte [rsp + 0x28], bl
call dbg.runtime.pcvalue
movsxd rax, dword [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x58]
mov edx, dword [rcx + 0x1c]
mov dword [rsp + 0x10], edx
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 8], rcx
mov rdx, qword [rsp + 0x68]
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], 0
movzx edx, byte [rsp + 0x70]
mov byte [rsp + 0x28], dl
call dbg.runtime.pcvalue
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
cmp rcx, 0xffffffffffffffff
jne 0x4464fd
lea rax, [0x0055cb38]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
mov dword [rsp + 0x88], 0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
cmp eax, 0xffffffff
je 0x4464d0
mov rdx, qword [rsp + 0x60]
mov rbx, qword [rdx + 0x38]
mov rsi, qword [rdx + 0x30]
cmp rcx, rbx
jge 0x4464d0
mov rbx, qword [rdx + 8]
mov rdx, qword [rdx]
jae 0x44658f
mov ecx, dword [rsi + rcx*4]
cmp rcx, rbx
jae 0x44658f
mov dword [rsp + 0x3c], eax
lea rax, [rdx + rcx]
mov qword [rsp], rax
call dbg.runtime.gostringnocopy
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x10]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rcx
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x88], eax
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
lea rax, [0x0055cb38]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
mov dword [rsp + 0x88], 0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
call dbg.runtime.panicindex
ud2
call dbg.runtime.morestack_noctxt
jmp dbg.runtime.funcline1
Function at 0x446620
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4467e6
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
mov rax, qword [rsp + 0x70]
mov ecx, dword [rax + 0x14]
mov dword [rsp + 0x10], ecx
mov qword [rsp], rax
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 8], rcx
mov rdx, qword [rsp + 0x80]
mov qword [rsp + 0x18], rdx
mov rbx, qword [rsp + 0x88]
mov qword [rsp + 0x20], rbx
mov byte [rsp + 0x28], 1
call dbg.runtime.pcvalue
mov eax, dword [rsp + 0x30]
test eax, 7
jne 0x4466a2
mov dword [rsp + 0x90], eax
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov dword [rsp + 0x3c], eax
mov rax, qword [rsp + 0x70]
mov qword [rsp], rax
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 8], rcx
call dbg.runtime.funcname
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x10]
mov qword [rsp + 0x58], rcx
mov rdx, qword [rsp + 0x70]
mov rbx, qword [rdx]
mov qword [rsp + 0x50], rbx
movsxd rdx, dword [rdx + 0x14]
mov qword [rsp + 0x48], rdx
call dbg.runtime.printlock
lea rax, [0x0055f10a]
mov qword [rsp], rax
mov qword [rsp + 8], 0x10
call dbg.runtime.printstring
mov rax, qword [rsp + 0x58]
mov qword [rsp], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 8], rax
call dbg.runtime.printstring
lea rax, [0x0055cb28]
mov qword [rsp], rax
mov qword [rsp + 8], 1
call dbg.runtime.printstring
mov rax, qword [rsp + 0x50]
mov qword [rsp], rax
call dbg.runtime.printhex
lea rax, [0x0055cb28]
mov qword [rsp], rax
mov qword [rsp + 8], 1
call dbg.runtime.printstring
mov rax, qword [rsp + 0x80]
mov qword [rsp], rax
call dbg.runtime.printhex
lea rax, [0x0055cb28]
mov qword [rsp], rax
mov qword [rsp + 8], 1
call dbg.runtime.printstring
mov rax, qword [rsp + 0x48]
mov qword [rsp], rax
call dbg.runtime.printhex
lea rax, [0x0055cb28]
mov qword [rsp], rax
mov qword [rsp + 8], 1
call dbg.runtime.printstring
mov eax, dword [rsp + 0x3c]
movsxd rcx, eax
mov qword [rsp], rcx
call dbg.runtime.printint
lea rax, [0x0055cb45]
mov qword [rsp], rax
mov qword [rsp + 8], 1
call dbg.runtime.printstring
call dbg.runtime.printunlock
mov eax, dword [rsp + 0x3c]
jmp 0x446691
call dbg.runtime.morestack_noctxt
jmp dbg.runtime.funcspdelta

Function at 0x446ec0
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x18], rax
lea rcx, [rax + 0x340]
test byte [rcx], al
mov rdx, qword [rsp + 0x30]
mov qword [rax + 0x340], rdx
mov rdx, qword [rsp + 0x38]
mov qword [rax + 0x348], rdx
lea rdx, [rsp + 0x40]
mov qword [rax + 0x350], rdx
mov rdx, qword [0x00614218]
mov qword [rsp], rdx
mov qword [rsp + 8], rcx
call dbg.runtime.cgocall
mov rax, qword [rsp + 0x18]
mov rcx, qword [rax + 0x358]
mov rdx, qword [rax + 0x360]
mov rax, qword [rax + 0x368]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], rax
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
Function at 0x44cab0
Capabilities:
Access peb ldr_data

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x44cbb0
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
lea rax, [rsp + 0x78]
mov rcx, rax
mov qword [rsp + 0x18], rcx
mov qword [rsp], rax
call dbg.runtime.getcallerpc
mov rax, qword [rsp + 8]
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
mov qword [rsp + 0x10], 0
mov qword [rsp + 0x20], 0
lea rdi, [rsp + 0x28]
xorps xmm0, xmm0
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0045645d
mov rbp, qword [rbp]
lea rdx, [0x00453040]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x10]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rcx
lea rax, [rsp + 0x78]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x20]
mov qword [rsp], rax
call dbg.runtime.systemstack
mov rax, qword [rsp + 0x10]
mov qword [rsp + 0x98], rax
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
call dbg.runtime.morestack_noctxt
jmp dbg.runtime.callers
Function at 0x46c990
Capabilities:
Encode data using base64

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x46ca9a
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rcx + 8]
lea rbx, [rdx + 0x2e]
neg rbx
imul rbx, rbx, 0x1c
movabs rax, 0x5816058160581606
mov rsi, rdx
imul rbx
sar rbx, 0x3f
sar rdx, 5
sub rdx, rbx
lea rbx, [rdx + 0x15c]
sar rbx, 0x3f
shr rbx, 0x3d
lea rdx, [rbx + rdx + 0x15c]
sar rdx, 3
jmp 0x46ca07
mov rdx, rax
cmp rdx, 0x57
jae 0x46ca93
lea rax, [rdx + rdx*2]
lea rbx, [0x00609b60]
mov rdi, qword [rbx + rax*8 + 8]
mov r8, rax
shl rax, 3
lea r9, [rsi + rdi + 0x40]
cmp r9, 0xffffffffffffffc4
jge 0x46ca39
lea rax, [rdx + 1]
jmp 0x46ca04
cmp r9, 0xffffffffffffffe0
jle 0x46ca45
lea rax, [rdx - 1]
jmp 0x46ca04
mov qword [rsp + 0x20], rdx
mov rdx, qword [rbx + r8*8]
movzx eax, byte [rbx + rax + 0x10]
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rdi
mov byte [rsp + 0x18], al
mov qword [rsp], rcx
call dbg.strconv.(*extFloat).Multiply
mov rax, qword [rsp + 0x20]
mov rcx, rax
shl rax, 3
add rax, 0xfffffffffffffea4
neg rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rcx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
call dbg.runtime.panicindex
ud2
call dbg.runtime.morestack_noctxt
jmp dbg.strconv.(*extFloat).frexp10
Function at 0x4cf440
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4cf56a
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
xor eax, eax
xor ecx, ecx
mov rdx, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
jmp 0x4cf485
add rax, 2
lea ecx, [r9 + 1]
mov rdi, qword [rsp + 0x78]
cmp rax, rdi
jge 0x4cf509
lea r8, [rax + 1]
cmp r8, rdi
jae 0x4cf563
mov r8, qword [rsp + 0x70]
mov r9d, dword [r8 + rax*4 + 4]
cmp rax, rdi
jae 0x4cf563
mov r10d, dword [r8 + rax*4]
dec r10d
cmp ecx, r10d
jg 0x4cf47d
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x3c], r9d
mov qword [rsp], rbx
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], ecx
mov dword [rsp + 0x1c], r10d
call dbg.regexp/syntax.appendRange
mov rbx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov r9d, dword [rsp + 0x3c]
jmp 0x4cf47d
cmp ecx, 0x10ffff
jle 0x4cf533
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x90], rdx
mov qword [rsp + 0x98], rsi
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp], rbx
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], ecx
mov dword [rsp + 0x1c], 0x10ffff
call dbg.regexp/syntax.appendRange
mov rbx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
jmp 0x4cf511
call dbg.runtime.panicindex
ud2
call dbg.runtime.morestack_noctxt
jmp dbg.regexp/syntax.appendNegatedClass
Function at 0x4cf580
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4cf7a8
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
mov qword [rsp + 0x58], rdx
xor ebx, ebx
mov rsi, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x90]
mov r8, qword [rsp + 0x80]
jmp 0x4cf63e
mov dword [rsp + 0x44], r9d
mov qword [rsp], r8
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdi
mov dword [rsp + 0x18], r9d
mov dword [rsp + 0x1c], r9d
call dbg.regexp/syntax.appendRange
mov eax, dword [rsp + 0x44]
mov r11d, dword [rsp + 0x4c]
lea r9d, [r11 + rax]
mov r8, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r10d, dword [rsp + 0x48]
cmp r9d, r10d
jle 0x4cf5d8
add rcx, 6
inc rbx
cmp rbx, rdx
jge 0x4cf6b2
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x68], rcx
movzx r9d, word [rcx]
movzx r10d, word [rcx + 2]
movzx r11d, word [rcx + 4]
cmp r11d, 1
je 0x4cf66d
mov dword [rsp + 0x4c], r11d
mov dword [rsp + 0x48], r10d
jmp 0x4cf632
mov qword [rsp], r8
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdi
mov dword [rsp + 0x18], r9d
mov dword [rsp + 0x1c], r10d
call dbg.regexp/syntax.appendRange
mov r8, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
jmp 0x4cf637
mov rcx, qword [rax + 0x18]
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x58], rax
xor edx, edx
jmp 0x4cf720
mov dword [rsp + 0x40], r10d
mov qword [rsp], r8
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdi
mov dword [rsp + 0x18], r10d
mov dword [rsp + 0x1c], r10d
call dbg.regexp/syntax.appendRange
mov ebx, dword [rsp + 0x38]
mov eax, dword [rsp + 0x40]
lea r10d, [rax + rbx]
mov r8, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x50]
mov r9d, dword [rsp + 0x3c]
cmp r10d, r9d
jle 0x4cf6c3
add rcx, 0xc
inc rdx
cmp rdx, rax
jge 0x4cf786
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x60], rcx
mov ebx, dword [rcx + 8]
mov r9d, dword [rcx + 4]
mov r10d, dword [rcx]
cmp ebx, 1
je 0x4cf749
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x3c], r9d
jmp 0x4cf714
mov qword [rsp], r8
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdi
mov dword [rsp + 0x18], r10d
mov dword [rsp + 0x1c], r9d
call dbg.regexp/syntax.appendRange
mov r8, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x50]
jmp 0x4cf719
mov qword [rsp + 0xa0], r8
mov qword [rsp + 0xa8], rsi
mov qword [rsp + 0xb0], rdi
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
call dbg.runtime.morestack_noctxt
jmp dbg.regexp/syntax.appendTable
Function at 0x1400018c8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd rdi, dword [rcx + 0x3c]
mov ebp, edx
add rdi, rcx
mov r12, rcx
mov r8d, edx
mov rcx, rdi
xor ebx, ebx
mov eax, dword [rdi + 0x8c]
mov r13d, dword [rdi + 0x88]
mov edx, r13d
mov dword [rsp + 0x70], eax
call fcn.1400028ec
test eax, eax
je 0x140001a11
mov esi, eax
mov r8d, ebp
add rsi, r12
mov rcx, rdi
mov edx, dword [rsi + 0x1c]
call fcn.1400028ec
mov r15d, eax
test eax, eax
je 0x140001a11
mov edx, dword [rsi + 0x24]
mov r8d, ebp
mov rcx, rdi
call fcn.1400028ec
mov r14d, eax
test eax, eax
je 0x140001a11
mov edx, dword [rsi + 0x20]
mov r8d, ebp
mov rcx, rdi
call fcn.1400028ec
test eax, eax
je 0x140001a11
add r15, r12
mov eax, eax
add r14, r12
mov qword [rsp + 0x20], r15
mov r15d, dword [rsi + 0x18]
add rax, r12
mov qword [rsp + 0x88], r14
mov r14d, ebx
mov qword [rsp + 0x28], rax
test r15d, r15d
je 0x140001a11
mov esi, r14d
mov r8d, ebp
mov rcx, rdi
mov edx, dword [rax + rsi*4]
call fcn.1400028ec
test eax, eax
je 0x1400019f2
mov rdx, qword [rsp + 0x20]
mov ecx, eax
mov rax, qword [rsp + 0x88]
add rcx, r12
movzx eax, word [rax + rsi*2]
mov r9d, dword [rdx + rax*4]
cmp r9d, r13d
jb 0x1400019d0
mov eax, dword [rsp + 0x70]
add eax, r13d
cmp r9d, eax
jb 0x1400019f2
mov r8, qword [rsp + 0x80]
sub r8, rcx
movzx eax, byte [rcx]
movzx edx, byte [rcx + r8]
sub eax, edx
jne 0x1400019ee
inc rcx
test edx, edx
jne 0x1400019db
test eax, eax
je 0x140001a01
inc r14d
cmp r14d, r15d
jae 0x140001a11
mov rax, qword [rsp + 0x28]
jmp 0x140001990
mov r8d, ebp
mov edx, r9d
mov rcx, rdi
call fcn.1400028ec
mov ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x140001b20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
movsxd rax, dword [rcx + 0x3c]
mov rbp, rdx
xor r8d, r8d
mov edx, dword [rax + rcx + 0x88]
add rdx, rcx
mov esi, dword [rdx + 0x1c]
mov r10d, dword [rdx + 0x20]
add rsi, rcx
mov r9d, dword [rdx + 0x24]
add r10, rcx
add r9, rcx
test ebp, 0xffff0000
jne 0x140001b6b
movzx eax, bp
sub eax, dword [rdx + 0x10]
jmp 0x140001ba9
mov edx, dword [rdx + 0x18]
jmp 0x140001b9f
mov eax, dword [r10]
dec edx
add rax, rcx
mov rdi, rbp
sub rdi, rax
movzx r11d, byte [rax]
movzx ebx, byte [rax + rdi]
sub r11d, ebx
jne 0x140001b92
inc rax
test ebx, ebx
jne 0x140001b7e
test r11d, r11d
je 0x140001ba5
add r10, 4
add r9, 2
test edx, edx
jne 0x140001b70
jmp 0x140001bb0
movzx eax, word [r9]
mov r8d, dword [rsi + rax*4]
add r8, rcx
mov rbx, qword [rsp + 8]
mov rax, r8
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
Function at 0x140002080
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], r8
push rsi
push rdi
push r14
sub rsp, 0x20
mov rdi, rcx
mov ebp, edx
mov ecx, 0xc0000001
test rdi, rdi
je 0x14000213a
mov eax, 0x5a4d
cmp word [rdi], ax
jne 0x14000213a
movsxd rax, dword [rdi + 0x3c]
add rax, rdi
je 0x14000213a
cmp dword [rax], 0x4550
jne 0x14000213a
mov rax, qword [rax + 0x90]
test eax, eax
je 0x14000213a
mov ebx, eax
add rbx, rdi
jmp 0x14000211d
mov r14d, dword [rbx]
mov ecx, 0xc0000001
mov esi, dword [rbx + 0x10]
add r14, rdi
add rsi, rdi
mov rax, qword [r14]
test rax, rax
je 0x140002119
sub r14, rsi
lea rcx, [rdi + 2]
add rcx, rax
call fcn.140001f58
cmp eax, ebp
je 0x140002125
add rsi, 8
mov rax, qword [r14 + rsi]
test rax, rax
jne 0x1400020f7
mov ecx, 0xc0000001
add rbx, 0x14
cmp dword [rbx + 0xc], 0
jne 0x1400020db
jmp 0x14000213a
mov r8d, 8
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.14000280c
xor ecx, ecx
mov rbx, qword [rsp + 0x40]
mov eax, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x1400026bc
Capabilities:
Delete file

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
and qword [rax - 0x58], 0
lea r9, [rbp + 0x17]
and qword [rbp + 0x6f], 0
lea r8, [rbp + 0x27]
and qword [rbp + 0x67], 0
xorps xmm0, xmm0
and qword [rbp + 0x2f], 0
mov edx, 0x110000
mov dword [rax - 0x60], 0x100
and qword [rax - 0x68], 0
and dword [rax - 0x70], 0
and dword [rax - 0x78], 0
and qword [rax - 0x80], 0
mov dword [rsp + 0x40], 0x60
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 4
mov qword [rbp + 0x37], rcx
lea rcx, [rbp + 0x6f]
mov dword [rsp + 0x28], 0x80
and qword [rsp + 0x20], 0
mov dword [rbp + 0x27], 0x30
mov dword [rbp + 0x3f], 0x240
movdqu xmmword [rbp + 0x47], xmm0
call qword [sym.imp.ntoskrnl.exe_IoCreateFileEx]
mov ebx, eax
test eax, eax
js 0x1400027d5
mov r8, qword [sym.imp.ntoskrnl.exe_IoFileObjectType]
lea rax, [rbp + 0x67]
and qword [rsp + 0x30], 0
xor r9d, r9d
mov rcx, qword [rbp + 0x6f]
mov edx, 0x110000
mov qword [rsp + 0x28], rax
mov r8, qword [r8]
mov dword [rsp + 0x20], 0x454c4946
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandleWithTag]
mov ebx, eax
test eax, eax
js 0x1400027c9
mov rax, qword [rbp + 0x67]
xor edx, edx
mov rcx, qword [rax + 0x28]
and qword [rcx + 0x10], 0
mov rcx, qword [rbp + 0x67]
mov rcx, qword [rcx + 0x28]
call qword [sym.imp.ntoskrnl.exe_MmFlushImageSection]
test al, al
je 0x1400027bf
lea rcx, [rbp + 0x27]
call qword [sym.imp.ntoskrnl.exe_ZwDeleteFile]
mov ebx, eax
mov rcx, qword [rbp + 0x67]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rbp + 0x6f]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ObCloseHandle]
mov eax, ebx
mov rbx, qword [rsp + 0xe0]
add rsp, 0xc0
pop rbp
ret
Function at 0x1400028ec
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
movzx r10d, word [rcx + 0x14]
xor r9d, r9d
movzx ebx, word [rcx + 6]
add r10, 0x18
add r10, rcx
mov edi, r8d
movzx r11d, r9w
cmp r9w, bx
jae 0x14000294b
mov r8d, dword [r10 + 0xc]
cmp r8d, edx
ja 0x14000292a
mov ecx, dword [r10 + 8]
add ecx, r8d
cmp ecx, edx
ja 0x14000293a
add r10, 0x28
inc r11w
cmp r11w, bx
jb 0x140002916
jmp 0x14000294b
mov eax, dword [r10 + 0x14]
sub eax, r8d
add edx, eax
cmp edx, edi
sbb r9d, r9d
and r9d, edx
mov rbx, qword [rsp + 8]
mov eax, r9d
mov rdi, qword [rsp + 0x10]
ret

Function at 0x14000295c
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
xor r13d, r13d
mov ebp, r9d
mov r15, r8
mov r12, rdx
mov rdi, rcx
mov r10d, r13d
test rcx, rcx
je 0x140002a30
test rdx, rdx
je 0x140002a30
test r8, r8
je 0x140002a30
test r9d, r9d
je 0x140002a30
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140002a30
movsxd rbx, dword [rcx + 0x3c]
add rbx, rcx
cmp dword [rbx], 0x4550
jne 0x140002a30
movzx r14d, word [rbx + 0x14]
mov esi, r13d
add r14, rbx
cmp r13w, word [rbx + 6]
jae 0x140002a2b
mov eax, esi
lea rdx, [rax + rax*4]
test dword [r14 + rdx*8 + 0x3c], 0x20000000
je 0x140002a21
cmp dword [r14 + rdx*8 + 0x18], 0x7865742e
jne 0x140002a21
cmp byte [r14 + rdx*8 + 0x1c], 0x74
jne 0x140002a21
mov ecx, dword [r14 + rdx*8 + 0x24]
mov r9, r15
mov edx, dword [r14 + rdx*8 + 0x20]
add rcx, rdi
mov r8, r12
mov dword [rsp + 0x20], ebp
call fcn.140002c1c
mov r10, rax
test rax, rax
jne 0x140002a2b
movzx ecx, word [rbx + 6]
inc esi
cmp esi, ecx
jb 0x1400029d9
mov rax, r10
jmp 0x140002a32
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x140002b04
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rdi, rcx
mov r14, r8
xor ecx, ecx
mov r15, rdx
test rdi, rdi
je 0x140002b88
movsxd r9, dword [rdi + 0x3c]
lea rbx, [rdi + 0x18]
add rbx, r9
xor esi, esi
movzx eax, word [r9 + rdi + 0x14]
movzx ebp, word [r9 + rdi + 6]
add rbx, rax
test ebp, ebp
je 0x140002b88
mov eax, dword [rbx]
cmp eax, 0x7865742e
jne 0x140002b5b
cmp byte [rbx + 4], 0x74
je 0x140002b62
cmp eax, 0x45474150
jne 0x140002b7e
mov ecx, dword [rbx + 0xc]
mov r9, r14
mov edx, dword [rbx + 8]
add rcx, rdi
mov r8, r15
call fcn.140002ba4
mov rcx, rax
test rax, rax
jne 0x140002b88
inc esi
add rbx, 0x28
cmp esi, ebp
jb 0x140002b4c
mov rbx, qword [rsp + 0x40]
mov rax, rcx
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret