joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140012c00
Capabilities:
Allocate or change rwx memory
Terminate process

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x70
lea rbp, [rsp + 0x70]
mov qword [rbp - 0x10], 0xfffffffffffffffe
lea r8, [rdx + 0xfff]
and r8, 0xfffffffffffff000
mov qword [rbp - 0x18], rcx
mov rcx, qword [rcx]
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov r9d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rsi, rax
test rax, rax
je 0x140012ca9
mov rdi, qword [rbp - 0x18]
mov rax, qword [rdi + 0x20]
cmp rax, 0x10
jb 0x140012c8a
mov rcx, qword [rdi + 8]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140012c85
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140012d0c
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140031ab8
mov qword [rdi + 0x18], 0
mov qword [rdi + 0x20], 0xf
mov byte [rdi + 8], 0
mov rax, rsi
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x48], eax
mov qword [rbp - 0x38], 2
lea rax, [rbp - 0x48]
mov qword [rbp - 0x30], rax
lea rax, str._panic__Allocation_failed:_:x_n
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], 0x21
lea rcx, [rbp - 0x28]
lea rdx, [rbp - 0x38]
call fcn.140019260
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
jmp 0x140012d12
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x1400137e0
Capabilities:
Enumerate process modules

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x2178
call fcn.140031c20
sub rsp, rax
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x20e0], xmm6
mov qword [rbp + 0x20d8], 0xfffffffffffffffe
mov rsi, rdx
mov r8d, ecx
xor ebx, ebx
mov ecx, 0x410
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x140013a3e
mov rdi, rax
lea rdx, [rbp - 0x60]
lea r9, [rbp + 0x20d4]
mov rcx, rax
mov r8d, 0x2000
call sub.KERNEL32.dll_K32EnumProcessModules
xor ebx, ebx
test eax, eax
je 0x140013a3e
cmp dword [rbp + 0x20d4], 8
jb 0x140013a3e
xor r13d, r13d
lea rbx, [rbp + 0x1fa0]
xorps xmm6, xmm6
lea r14, [rbp + 0x20b0]
mov qword [rbp + 0x20a8], rsi
jmp 0x1400138ae
add r15, 0x28
mov rdx, r15
mov rcx, rax
call fcn.140031ab8
test r12b, r12b
jne 0x140013a3c
inc r13
mov eax, dword [rbp + 0x20d4]
shr eax, 3
cmp r13, rax
jae 0x140013a38
mov rdx, qword [rbp + r13*8 - 0x60]
mov rcx, rdi
mov r8, rbx
mov r9d, 0x104
call sub.KERNEL32.dll_K32GetModuleFileNameExA
test eax, eax
je 0x140013899
movaps xmmword [rbp + 0x20c0], xmm6
movaps xmmword [rbp + 0x20b0], xmm6
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
test rax, rax
js 0x140013a5b
mov r15, rax
cmp rax, 0xf
ja 0x140013920
mov qword [rbp + 0x20c0], r15
mov qword [rbp + 0x20c8], 0xf
mov rcx, r14
mov rdx, rbx
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
add r15, rbp
add r15, 0x20b0
jmp 0x14001399a
mov rsi, rdi
mov rdi, r14
mov r14, r15
or r14, 0xf
cmp r14, 0x17
mov eax, 0x16
cmovb r14, rax
cmp r14, 0xfff
jb 0x14001395b
lea rcx, [r14 + 0x28]
call fcn.140031a74
lea r12, [rax + 0x27]
and r12, 0xffffffffffffffe0
mov qword [r12 - 8], rax
jmp 0x140013967
lea rcx, [r14 + 1]
call fcn.140031a74
mov r12, rax
mov qword [rbp + 0x20b0], r12
mov qword [rbp + 0x20c0], r15
mov qword [rbp + 0x20c8], r14
mov rcx, r12
mov rdx, rbx
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
add r15, r12
mov r14, rdi
mov rdi, rsi
mov rsi, qword [rbp + 0x20a8]
mov byte [r15], 0
mov r8, qword [rsi + 0x10]
mov rax, qword [rbp + 0x20c0]
mov r15, qword [rbp + 0x20c8]
sub rax, r8
jae 0x1400139d0
xor r12d, r12d
cmp r15, 0x10
jb 0x140013890
jmp 0x140013a05
cmp qword [rsi + 0x18], 0x10
mov rdx, rsi
jb 0x1400139dd
mov rdx, qword [rsi]
mov rcx, r14
cmp r15, 0x10
jb 0x1400139ed
mov rcx, qword [rbp + 0x20b0]
add rcx, rax
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
sete r12b
cmp r15, 0x10
jb 0x140013890
mov rcx, qword [rbp + 0x20b0]
lea rdx, [r15 + 1]
cmp rdx, 0x1000
jb 0x14001388b
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jb 0x140013881
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
xor ebx, ebx
jmp 0x140013a3e
mov bl, 1
mov eax, ebx
movaps xmm6, xmmword [rbp + 0x20e0]
add rsp, 0x2178
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.14000bcd0
int3
Function at 0x1400179a0
Capabilities:
Resume thread
Terminate process

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x70
mov r14, qword [rsp + 0xe8]
mov rdi, qword [rsp + 0xe0]
mov r11, qword [rsp + 0xd8]
mov r10, qword [rsp + 0xd0]
mov ebp, dword [rsp + 0xc8]
mov eax, dword [rsp + 0xc0]
mov rbx, qword [rsp + 0x100]
test rbx, rbx
lea rsi, [0x140033300]
cmovne rsi, rbx
test r14, r14
jne 0x140017a09
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], 0
lea r14, [rsp + 0x50]
mov ebx, ebp
or ebx, 4
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x30], r10
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], eax
call rsi
test eax, eax
je 0x140017a89
mov rdi, qword [rsp + 0xf8]
mov ebx, dword [rsp + 0xf0]
mov rcx, qword [r14]
mov rdx, rdi
mov r8d, ebx
call fcn.140015340
test eax, eax
jne 0x140017a66
mov ecx, dword [r14 + 0x10]
mov edx, ebx
mov r8, rdi
mov r9, rsi
call fcn.140016ae0
test eax, eax
je 0x140017a8d
test bpl, 4
jne 0x140017a75
mov rcx, qword [r14 + 8]
call sub.KERNEL32.dll_ResumeThread
mov esi, 1
lea rax, [rsp + 0x50]
cmp r14, rax
mov r14, rax
jne 0x140017aad
jmp 0x140017a9c
xor esi, esi
jmp 0x140017aad
mov rcx, qword [r14]
mov edx, 0xffffffff
call sub.KERNEL32.dll_TerminateProcess
xor esi, esi
mov rcx, qword [r14]
call sub.KERNEL32.dll_CloseHandle
mov rcx, qword [r14 + 8]
call sub.KERNEL32.dll_CloseHandle
mov eax, esi
add rsp, 0x70
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x14001a350
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0x98
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x10], 0xfffffffffffffffe
mov r9, r8
mov rsi, rdx
mov edx, 1
mov r8, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rax, rsi
jae 0x14001a3db
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov edx, dword [rax]
mov qword [rbp - 0x60], 0
lea rax, [rbp - 0x10]
mov qword [rbp - 0x58], rax
lea rax, str.cannot_write_to_file
mov qword [rbp], rax
mov qword [rbp + 8], 0x14
lea rcx, [rbp - 0x38]
mov r8, rbp
lea r9, [rbp - 0x60]
call fcn.1400185e0
mov byte [rbp - 0x10], 1
cmp byte [rbp - 0x10], 0
jne 0x14001a3e6
lea rax, vtable.std::exception.0
mov qword [rbp - 0x38], rax
lea rcx, [rbp - 0x30]
call sub.VCRUNTIME140.dll___std_exception_destroy
nop
add rsp, 0x98
pop rsi
pop rbp
ret
lea rsi, [rbp - 0x60]
lea rdx, [rbp - 0x38]
mov rcx, rsi
call fcn.14001b8c0
lea rdx, [0x14003ebe8]
mov rcx, rsi
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x14001a470
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
movd edx, xmm0
mov r11d, edx
and r11d, 0x7fffff
shr edx, 0x17
and edx, 0xff
je 0x14001a4a5
add edx, 0xffffff6a
test r11d, r11d
je 0x14001a644
or r11d, 0x800000
jmp 0x14001a4b3
mov edx, 0xffffff6b
test r11d, r11d
je 0x14001a6de
imul r9d, edx, 0x4d105
sar r9d, 0x14
mov eax, 1
sub eax, r9d
mov ecx, 0x20
sub ecx, r9d
lea r8, [0x1400357c0]
mov r10, qword [r8 + rcx*8]
imul r8d, eax, 0x1a934f
sar r8d, 0x13
add r8d, edx
mov ecx, r8d
not cl
mov rbx, r10
shr rbx, cl
lea edi, [r11 + r11]
lea eax, [r11*2 + 1]
mov ecx, r8d
shl eax, cl
shl rax, 0x20
mul r10
mov rax, rdx
shr rax, 0x20
imul rsi, rax, 0x51eb851f
shr rsi, 0x25
imul ebp, esi, 0xffffff9c
add ebp, eax
cmp ebp, ebx
jae 0x14001a542
test ebp, ebp
jne 0x14001a57b
test r11b, 1
je 0x14001a57b
mov eax, edx
test rax, rax
jne 0x14001a57b
dec esi
mov ebp, 0x64
jmp 0x14001a5d4
ja 0x14001a5d4
lea eax, [rdi - 1]
imul rax, r10
mov cl, 0x40
sub cl, r8b
movzx ecx, cl
xor edx, edx
bt rax, rcx
setb dl
lea ecx, [r8 + 0x20]
neg ecx
shr rax, cl
xor ecx, ecx
test eax, eax
sete cl
not r11d
and r11d, ecx
or r11d, edx
je 0x14001a5d4
inc r9d
imul eax, esi, 0xc28f5c29
rol eax, 0x1e
xor ecx, ecx
cmp eax, 0x28f5c28
ja 0x14001a5b5
xor ecx, ecx
nop word cs:[rax + rax]
mov esi, eax
add ecx, 2
imul eax, eax, 0xc28f5c29
rol eax, 0x1e
cmp eax, 0x28f5c29
jb 0x14001a5a0
imul eax, esi, 0xcccccccd
ror eax, 1
xor edx, edx
cmp eax, 0x1999999a
setb dl
cmovae eax, esi
or edx, ecx
add r9d, edx
jmp 0x14001a73e
lea eax, [rsi + rsi*4]
shr ebx, 1
sub ebp, ebx
imul edx, ebp, 0x199a
add edx, 0x8002
movzx ecx, dx
shr edx, 0x10
lea eax, [rdx + rax*2]
cmp ecx, 0x1999
ja 0x14001a73e
mov ecx, edi
imul r10, rcx
mov cl, 0x40
sub cl, r8b
movzx ecx, cl
bt r10, rcx
setb cl
test bpl, 1
sete r11b
xor r11b, cl
je 0x14001a734
add r8d, 0x20
neg r8d
mov ecx, r8d
shr r10, cl
test r10d, r10d
sete cl
and edx, 1
and dl, cl
movzx ecx, dl
sub eax, ecx
jmp 0x14001a73e
imul r9d, edx, 0x9a209
add r9d, 0xfffc01e1
sar r9d, 0x15
imul r8d, r9d, 0xffe56cb1
sar r8d, 0x13
add r8d, edx
mov eax, 0x1f
sub eax, r9d
lea rcx, [0x1400357c0]
mov rax, qword [rcx + rax*8]
mov rcx, rax
shr rcx, 0x19
mov r11, rax
sub r11, rcx
mov cl, 0x28
sub cl, r8b
shr r11, cl
mov rsi, rax
shr rsi, 0x18
add rsi, rax
shr rsi, cl
mov ecx, edx
and ecx, 0xfffffffe
xor r10d, r10d
cmp ecx, 2
setne r10b
add r10d, r11d
mov r11d, esi
mov ecx, 0xcccccccd
imul rcx, r11
shr rcx, 0x23
lea r11d, [rcx + rcx]
lea r11d, [r11 + r11*4]
cmp r11d, r10d
jae 0x14001a6e5
mov cl, 0x27
sub cl, r8b
shr rax, cl
inc eax
shr eax, 1
cmp edx, 0xffffffdd
jne 0x14001a738
and eax, 0xfffffffe
jmp 0x14001a73e
xor eax, eax
xor r9d, r9d
jmp 0x14001a73e
inc r9d
imul eax, ecx, 0xc28f5c29
rol eax, 0x1e
xor edx, edx
cmp eax, 0x28f5c28
ja 0x14001a715
xor edx, edx
nop dword [rax]
mov ecx, eax
add edx, 2
imul eax, eax, 0xc28f5c29
rol eax, 0x1e
cmp eax, 0x28f5c29
jb 0x14001a700
imul eax, ecx, 0xcccccccd
ror eax, 1
xor r8d, r8d
cmp eax, 0x1999999a
setb r8b
cmovae eax, ecx
or r8d, edx
add r9d, r8d
jmp 0x14001a73e
dec eax
jmp 0x14001a73e
cmp eax, r10d
adc eax, 0
shl r9, 0x20
mov eax, eax
or rax, r9
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x14002e370
Capabilities:
Resume thread

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
movaps xmmword [rsp + 0x30], xmm6
mov esi, dword [0x1400468c8]
call sub.KERNEL32.dll_GetCurrentThreadId
mov ecx, eax
mov eax, 0x10dd
cmp esi, ecx
jne 0x14002e4b3
mov rdi, qword [0x1400468d0]
test rdi, rdi
je 0x14002e419
lea rsi, [rsp + 0x28]
xorps xmm6, xmm6
jmp 0x14002e3c3
mov rbx, qword [rdi]
mov rcx, rdi
call fcn.140031ab0
mov rdi, rbx
test rbx, rbx
je 0x14002e419
mov r8d, dword [rdi + 0x28]
mov rcx, qword [rdi + 0x18]
mov rax, qword [rdi + 0x20]
movzx edx, byte [rax + 0x3e]
mov r9, rsi
call sub.KERNEL32.dll_VirtualProtect
cmp dword [rdi + 8], 0
jne 0x14002e3b0
mov rax, qword [rdi + 0x20]
test rax, rax
je 0x14002e3b0
mov rcx, rax
and rcx, 0xffffffffffff0000
movups xmmword [rax + 0x50], xmm6
movups xmmword [rax + 0x40], xmm6
movups xmmword [rax + 0x30], xmm6
movups xmmword [rax + 0x20], xmm6
movups xmmword [rax + 0x10], xmm6
movups xmmword [rax], xmm6
mov rdx, qword [rcx + 0x10]
mov qword [rax + 0x48], rdx
mov qword [rcx + 0x10], rax
jmp 0x14002e3b0
mov qword [0x1400468d0], 0
call sub.KERNEL32.dll_GetCurrentProcess
mov rdi, qword [0x1400468f0]
test rdi, rdi
je 0x14002e470
mov rsi, rax
lea rbx, [rsp + 0x2c]
nop dword [rax]
mov edx, 0x10000
mov rcx, rdi
mov r8d, 0x20
mov r9, rbx
call sub.KERNEL32.dll_VirtualProtect
mov r8d, 0x10000
mov rcx, rsi
mov rdx, rdi
call sub.KERNEL32.dll_FlushInstructionCache
mov rdi, qword [rdi + 8]
test rdi, rdi
jne 0x14002e440
mov rsi, qword [0x1400468d8]
test rsi, rsi
je 0x14002e49c
nop dword [rax]
mov rcx, qword [rsi + 8]
call sub.KERNEL32.dll_ResumeThread
mov rdi, qword [rsi]
mov rcx, rsi
call fcn.140031ab0
mov rsi, rdi
test rdi, rdi
jne 0x14002e480
mov qword [0x1400468d8], 0
mov dword [0x1400468c8], 0
xor eax, eax
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
Function at 0x14002f840
Capabilities:
Allocate or change rwx memory

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
movaps xmmword [rsp + 0x50], xmm6
movzx eax, cx
mov edi, 0x10000
sub rdi, rax
test rax, rax
cmove rdi, rax
add rdi, rcx
cmp rdi, rdx
jae 0x14002f93f
mov rsi, rdx
xorps xmm6, xmm6
lea rbx, [rsp + 0x20]
jmp 0x14002f890
add rdi, 0x8000000
cmp rdi, rsi
jae 0x14002f93f
cmp rdi, qword [0x140046728]
jb 0x14002f8a2
cmp rdi, qword [0x140046730]
jbe 0x14002f880
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm6
movaps xmmword [rsp + 0x20], xmm6
mov r8d, 0x30
mov rcx, rdi
mov rdx, rbx
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
je 0x14002f93f
cmp dword [rsp + 0x40], 0x10000
mov rax, qword [rsp + 0x38]
jne 0x14002f920
cmp rax, 0x10000
jb 0x14002f920
mov edx, 0x10000
mov rcx, rdi
mov r8d, 0x3000
mov r9d, 0x40
call sub.KERNEL32.dll_VirtualAlloc
mov r14, rax
test rax, rax
jne 0x14002f942
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
je 0x14002f942
add rdi, 0x10000
jmp 0x14002f887
add rax, qword [rsp + 0x20]
movzx ecx, ax
mov edi, 0x10000
sub rdi, rcx
test rcx, rcx
cmove rdi, rcx
add rdi, rax
jmp 0x14002f887
xor r14d, r14d
mov rax, r14
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x14002f960
Capabilities:
Parse pe header

Disassembly:
push rsi
push rdi
sub rsp, 0x58
test rcx, rcx
je 0x14002fa36
mov rsi, rcx
test rdx, rdx
je 0x14002f97e
mov qword [rdx], 0
movzx eax, byte [rsi]
cmp al, 0xff
je 0x14002fa3a
cmp al, 0xeb
jne 0x14002faa9
movsx rax, byte [rsi + 1]
lea rdi, [rsi + rax]
add rdi, 2
movzx eax, byte [rsi + rax + 2]
cmp eax, 0xe9
je 0x14002faae
cmp eax, 0xff
jne 0x14002fab9
cmp byte [rdi + 1], 0x25
jne 0x14002fab9
movsxd rsi, dword [rdi + 2]
lea rdx, [rsp + 0x28]
mov r8d, 0x30
mov rcx, rdi
call sub.KERNEL32.dll_VirtualQuery
mov rax, qword [rsp + 0x30]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x14002fab9
movsxd rdx, dword [rax + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x14002fab9
lea rcx, [rdi + rsi]
add rcx, 6
mov r8d, dword [rax + rdx + 0xe8]
add r8, rax
cmp r8, rcx
ja 0x14002fab9
mov eax, dword [rax + rdx + 0xec]
add r8, rax
cmp r8, rcx
jbe 0x14002fab9
mov rdi, qword [rcx]
jmp 0x14002fab9
xor edi, edi
jmp 0x14002fab9
cmp byte [rsi + 1], 0x25
jne 0x14002fa9e
movsxd rdi, dword [rsi + 2]
lea rdx, [rsp + 0x28]
mov r8d, 0x30
mov rcx, rsi
call sub.KERNEL32.dll_VirtualQuery
mov rax, qword [rsp + 0x30]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x14002fa9e
movsxd rdx, dword [rax + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x14002fa9e
lea rcx, [rsi + rdi]
add rcx, 6
mov r8d, dword [rax + rdx + 0xe8]
add r8, rax
cmp r8, rcx
ja 0x14002fa9e
mov eax, dword [rax + rdx + 0xec]
add r8, rax
cmp r8, rcx
jbe 0x14002fa9e
mov rsi, qword [rcx]
movzx eax, byte [rsi]
cmp al, 0xeb
je 0x14002f991
mov rdi, rsi
jmp 0x14002fab9
movsxd rax, dword [rdi + 1]
add rdi, rax
add rdi, 5
mov rax, rdi
add rsp, 0x58
pop rdi
pop rsi
ret
Function at 0x14002fcb0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x48
movdqa xmmword [rsp + 0x30], xmm6
cmp byte [0x140046950], 0
je 0x14002fccf
xor eax, eax
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
mov rax, qword [0x140046948]
test rax, rax
jne 0x14002fcc5
pxor xmm6, xmm6
movdqu xmmword [0x140046930], xmm6
movdqu xmmword [0x140046920], xmm6
movdqu xmmword [0x140046910], xmm6
movdqu xmmword [0x140046900], xmm6
mov qword [0x140046940], 0
call sub.KERNEL32.dll_GetCurrentProcess
mov qword [0x140046900], rax
lea rcx, str.dbghelp.dll
xor edx, edx
xor r8d, r8d
call sub.KERNEL32.dll_LoadLibraryExW
mov qword [0x140046908], rax
test rax, rax
je 0x14002febc
lea rdx, str.ImagehlpApiVersionEx
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x140046910], rax
mov rcx, qword [0x140046908]
lea rdx, str.SymInitialize
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x140046918], rax
mov rcx, qword [0x140046908]
lea rdx, str.SymSetOptions
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x140046920], rax
mov rcx, qword [0x140046908]
lea rdx, str.SymGetOptions
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x140046928], rax
mov rcx, qword [0x140046908]
lea rdx, str.SymLoadModule64
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x140046930], rax
mov rcx, qword [0x140046908]
lea rdx, str.SymGetModuleInfo64
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x140046938], rax
mov rcx, qword [0x140046908]
lea rdx, str.SymFromName
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x140046940], rax
mov qword [rsp + 0x28], 0xc
mov rdx, qword [0x140046910]
movdqu xmm0, xmmword [0x140046930]
movq xmm1, rdx
movq xmm2, qword [0x140046918]
punpcklqdq xmm2, xmm1
pcmpeqd xmm0, xmm6
pshufd xmm1, xmm0, 0xb1
pand xmm1, xmm0
pcmpeqd xmm2, xmm6
pshufd xmm0, xmm2, 0xb1
pand xmm0, xmm2
packssdw xmm0, xmm1
movmskps ecx, xmm0
test ecx, ecx
jne 0x14002fea2
test rax, rax
je 0x14002fea2
lea rcx, [rsp + 0x28]
call rdx
cmp word [rsp + 0x28], 0xc
jb 0x14002fea2
mov rcx, qword [0x140046900]
xor edx, edx
xor r8d, r8d
call qword [0x140046918]
test eax, eax
je 0x14002fea2
mov rax, qword [0x140046928]
test rax, rax
je 0x14002fe8a
cmp qword [0x140046920], 0
je 0x14002fe8a
call rax
and eax, 0xffffd8f8
lea ecx, [rax + 0x2704]
call qword [0x140046920]
lea rax, [0x140046900]
mov qword [0x140046948], rax
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
mov rcx, qword [0x140046908]
mov byte [0x140046950], 1
test rcx, rcx
je 0x14002fec3
call sub.KERNEL32.dll_FreeLibrary
jmp 0x14002fec3
mov byte [0x140046950], 1
xorps xmm0, xmm0
movups xmmword [0x140046930], xmm0
movups xmmword [0x140046920], xmm0
movups xmmword [0x140046910], xmm0
mov qword [0x140046940], 0
xor eax, eax
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x1400303a0
Capabilities:
Parse pe header

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rsi, rcx
test rcx, rcx
je 0x1400303e0
movzx eax, word [rsi]
cmp eax, 0x5a4d
jne 0x1400303f4
movsxd rdi, dword [rsi + 0x3c]
cmp dword [rsi + rdi], 0x4550
jne 0x140030402
cmp word [rsi + rdi + 0x14], 0
je 0x140030410
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov esi, dword [rsi + rdi + 0x50]
jmp 0x14003041c
xor ecx, ecx
call sub.KERNEL32.dll_GetModuleHandleW
mov rsi, rax
movzx eax, word [rsi]
cmp eax, 0x5a4d
je 0x1400303be
xor esi, esi
mov ecx, 0xc1
call sub.KERNEL32.dll_SetLastError
jmp 0x14003041c
xor esi, esi
mov ecx, 0xbf
call sub.KERNEL32.dll_SetLastError
jmp 0x14003041c
xor esi, esi
mov ecx, 0xc0
call sub.KERNEL32.dll_SetLastError
mov eax, esi
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret

Function at 0x140030450
Capabilities:
Parse pe header

Disassembly:
push rbp
push rsi
sub rsp, 0x58
lea rbp, [rsp + 0x50]
xorps xmm0, xmm0
movaps xmmword [rbp - 0x10], xmm0
movaps xmmword [rbp - 0x20], xmm0
movaps xmmword [rbp - 0x30], xmm0
lea rdx, [rbp - 0x30]
mov r8d, 0x30
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
je 0x1400304cd
cmp dword [rbp - 0x10], 0x1000
jne 0x1400304c1
mov eax, dword [rbp - 0xc]
cmp al, 1
je 0x1400304c1
and eax, 0x100
jne 0x1400304c1
mov rsi, qword [rbp - 0x28]
movzx eax, word [rsi]
cmp eax, 0x5a4d
jne 0x1400304e3
movsxd rax, dword [rsi + 0x3c]
cmp dword [rsi + rax], 0x4550
jne 0x1400304ef
cmp word [rsi + rax + 0x14], 0
je 0x1400304fb
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
jmp 0x1400304d9
mov ecx, 0xc1
call sub.KERNEL32.dll_SetLastError
jmp 0x1400304d7
mov ecx, 0xc1
call sub.KERNEL32.dll_SetLastError
xor esi, esi
mov rax, rsi
add rsp, 0x58
pop rsi
pop rbp
ret
mov ecx, 0xc1
call sub.KERNEL32.dll_SetLastError
jmp 0x1400304d7
mov ecx, 0xbf
call sub.KERNEL32.dll_SetLastError
jmp 0x1400304d7
mov ecx, 0xc0
call sub.KERNEL32.dll_SetLastError
jmp 0x1400304d7
Function at 0x140030730
Capabilities:
Parse pe header

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov rbx, r9
mov qword [rbp], r8
mov rdi, rdx
mov r14, rcx
test rcx, rcx
je 0x140030896
movzx eax, word [r14]
cmp eax, 0x5a4d
jne 0x1400308af
movsxd rax, dword [r14 + 0x3c]
cmp dword [r14 + rax], 0x4550
jne 0x1400308bd
cmp word [r14 + rax + 0x14], 0
je 0x1400308cb
mov edx, dword [r14 + rax + 0x90]
mov rcx, r14
call fcn.140030720
test rax, rax
jne 0x1400307ca
xor esi, esi
mov ecx, 0xc0
call sub.KERNEL32.dll_SetLastError
jmp 0x140030905
test rbx, rbx
je 0x1400307c2
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call rbx
mov rax, qword [rbp - 8]
add rax, 0x14
mov r12d, dword [rax]
test r12d, r12d
je 0x1400308d9
mov qword [rbp - 8], rax
mov edx, dword [rax + 0xc]
mov rcx, r14
call fcn.140030720
mov rsi, rax
test rax, rax
je 0x1400308f9
mov rcx, r14
mov edx, r12d
call fcn.140030720
mov r12, rax
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0x10]
mov rcx, r14
call fcn.140030720
mov r13, rax
mov rcx, qword [rax]
call fcn.140030450
cmp qword [rbp], 0
je 0x140030834
mov rcx, rdi
mov rdx, rax
mov r8, rsi
call qword [rbp]
test eax, eax
je 0x1400308e0
test r12, r12
je 0x1400307c2
xor esi, esi
jmp 0x140030842
inc esi
mov r15d, esi
mov rdx, qword [r12 + r15*8]
test rdx, rdx
je 0x1400307b0
js 0x140030870
add edx, 2
mov rcx, r14
call fcn.140030720
xor edx, edx
test rbx, rbx
jne 0x14003087a
jmp 0x140030840
movzx edx, dx
xor eax, eax
test rbx, rbx
je 0x140030840
lea r9, [r15*8]
add r9, r13
mov rcx, rdi
mov r8, rax
call rbx
test eax, eax
jne 0x140030840
jmp 0x1400307b5
xor ecx, ecx
call sub.KERNEL32.dll_GetModuleHandleW
mov r14, rax
movzx eax, word [r14]
cmp eax, 0x5a4d
je 0x14003076a
xor esi, esi
mov ecx, 0xc1
call sub.KERNEL32.dll_SetLastError
jmp 0x140030905
xor esi, esi
mov ecx, 0xbf
call sub.KERNEL32.dll_SetLastError
jmp 0x140030905
xor esi, esi
mov ecx, 0xc0
call sub.KERNEL32.dll_SetLastError
jmp 0x140030905
cmp qword [rbp], 0
je 0x1400308eb
mov rcx, rdi
xor edx, edx
xor r8d, r8d
call qword [rbp]
mov esi, 1
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
jmp 0x140030905
xor esi, esi
mov ecx, 0xc0
call sub.KERNEL32.dll_SetLastError
mov eax, esi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret