joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180042820
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0xc0
mov rax, qword [0x18014e858]
xor ebx, ebx
mov rdi, rdx
mov rsi, rcx
test rax, rax
jne 0x180042a74
cmp dword [0x1800542c0], 2
mov ecx, ebx
movups xmm0, xmmword [0x18004a3f0]
movups xmm1, xmmword [0x18004a400]
mov eax, dword [0x18004a438]
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x78], eax
movups xmm0, xmmword [0x18004a410]
movzx eax, word [0x18004a43c]
movups xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x7c], ax
movsd xmm0, qword [0x18004a430]
movups xmmword [rsp + 0x40], xmm1
movups xmm1, xmmword [0x18004a420]
movsd qword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x60], xmm1
jl 0x180042a10
movdqa xmm5, xmmword [0x18004fda0]
lea rdx, [rsp + 0x30]
movdqa xmm4, xmmword [0x180050ef0]
mov eax, 4
movaps xmmword [r11 - 0x18], xmm6
movaps xmmword [r11 - 0x28], xmm7
movdqa xmm7, xmmword [0x18004fdc0]
movaps xmmword [r11 - 0x38], xmm8
movd xmm6, eax
mov eax, 0x1f
movaps xmmword [r11 - 0x48], xmm9
movdqa xmm9, xmmword [0x18004fdd0]
movd xmm8, eax
nop dword [rax + rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 0x10]
paddd xmm2, xmm5
add ecx, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm9
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rdx - 0x10]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
pxor xmm3, xmm0
movq qword [rdx - 0x10], xmm3
paddd xmm2, xmm5
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm9
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rdx - 8]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
pxor xmm3, xmm0
movq qword [rdx - 8], xmm3
cmp ecx, 0x20
jl 0x180042900
movaps xmm9, xmmword [rsp + 0x80]
movaps xmm8, xmmword [rsp + 0x90]
movaps xmm7, xmmword [rsp + 0xa0]
movaps xmm6, xmmword [rsp + 0xb0]
cmp ecx, 0x27
jge 0x180042a51
movsxd rax, ecx
lea r8, [rsp + 0x30]
lea r8, [r8 + rax*2]
nop dword [rax]
mov eax, 0x4d4873ed
lea r8, [r8 + 2]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul edx, eax, 0x35
movzx eax, cx
inc ecx
sub ax, dx
add ax, 0x36
xor word [r8 - 2], ax
cmp ecx, 0x27
jl 0x180042a20
mov rax, qword [0x18014e530]
lea r8, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor ecx, ecx
lea rdx, [r9 - 1]
call rax
mov qword [0x18014e858], rax
mov qword [rsp + 0xd8], rbx
test rax, rax
je 0x180042aae
mov r10, qword [rsi]
lea r8, [rsp + 0xd8]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
mov rdx, rax
mov rcx, rsi
call qword [r10 + 0x260]
mov rax, qword [rsp + 0xd8]
mov qword [rdi], rax
jmp 0x180042ab1
mov qword [rdi], rbx
lea r11, [rsp + 0xc0]
mov rax, rdi
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x180042ad0
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x18014e850]
xor ebx, ebx
mov rdi, rdx
mov rsi, rcx
test rax, rax
jne 0x180042d24
cmp dword [0x1800542c0], 2
mov ecx, ebx
movups xmm0, xmmword [0x18004a390]
movups xmm1, xmmword [0x18004a3a0]
mov eax, dword [0x18004a3e0]
movups xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [0x18004a3b0]
movups xmmword [rsp + 0x50], xmm0
movups xmm0, xmmword [0x18004a3d0]
movups xmmword [rsp + 0x40], xmm1
movups xmm1, xmmword [0x18004a3c0]
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x60], xmm1
mov dword [r11 - 0x58], eax
movzx eax, word [0x18004a3e4]
mov word [r11 - 0x54], ax
jl 0x180042cc0
movdqa xmm5, xmmword [0x18004fda0]
lea rdx, [rsp + 0x30]
movdqa xmm4, xmmword [0x180050ef0]
mov eax, 4
movaps xmmword [r11 - 0x18], xmm6
movaps xmmword [r11 - 0x28], xmm7
movdqa xmm7, xmmword [0x18004fdc0]
movaps xmmword [r11 - 0x38], xmm8
movd xmm6, eax
mov eax, 0x1f
movaps xmmword [r11 - 0x48], xmm9
movdqa xmm9, xmmword [0x18004fdd0]
movd xmm8, eax
nop dword [rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 0x10]
paddd xmm2, xmm5
add ecx, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm9
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rdx - 0x10]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
pxor xmm3, xmm0
movq qword [rdx - 0x10], xmm3
paddd xmm2, xmm5
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm9
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rdx - 8]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
pxor xmm3, xmm0
movq qword [rdx - 8], xmm3
cmp ecx, 0x28
jl 0x180042bb0
movaps xmm9, xmmword [rsp + 0x90]
movaps xmm8, xmmword [rsp + 0xa0]
movaps xmm7, xmmword [rsp + 0xb0]
movaps xmm6, xmmword [rsp + 0xc0]
cmp ecx, 0x2b
jge 0x180042d01
movsxd rax, ecx
lea r8, [rsp + 0x30]
lea r8, [r8 + rax*2]
nop dword [rax]
mov eax, 0x4d4873ed
lea r8, [r8 + 2]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul edx, eax, 0x35
movzx eax, cx
inc ecx
sub ax, dx
add ax, 0x36
xor word [r8 - 2], ax
cmp ecx, 0x2b
jl 0x180042cd0
mov rax, qword [0x18014e530]
lea r8, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor ecx, ecx
lea rdx, [r9 - 1]
call rax
mov qword [0x18014e850], rax
mov qword [rsp + 0xe8], rbx
test rax, rax
je 0x180042d5e
mov r10, qword [rsi]
lea r8, [rsp + 0xe8]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
mov rdx, rax
mov rcx, rsi
call qword [r10 + 0x260]
mov rax, qword [rsp + 0xe8]
mov qword [rdi], rax
jmp 0x180042d61
mov qword [rdi], rbx
lea r11, [rsp + 0xd0]
mov rax, rdi
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0xbcd470
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0xbcd47d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0xbcd48d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0xbcd475
lea eax, [rcx + 1]
jmp 0xbcd49b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0xbcd4ae
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0xbcd494
sub eax, 3
jb 0xbcd4ce
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0xbcd51d
sar eax, 1
movsxd rbp, eax
jb 0xbcd504
jmp 0xbcd4dc
add ebx, ebx
jne 0xbcd4da
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xbcd504
inc ecx
add ebx, ebx
jne 0xbcd4ea
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xbcd504
call r11
adc ecx, ecx
add ebx, ebx
jne 0xbcd4fd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0xbcd4ec
add ecx, 2
jmp 0xbcd509
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.00bcd432
jmp 0xbcd47d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x3e8e00
mov dl, 0x87
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0xbcd569
cmp rsi, rcx
jae 0xbcd571
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0xbcd550
cmp al, 0x8f
ja 0xbcd550
cmp byte [rsi - 2], 0xf
je 0xbcd556
sub al, 0xe8
cmp al, 1
ja 0xbcd53a
cmp rsi, rcx
jae 0xbcd571
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0xbcd540
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0xbcd571
lodsb al, byte [rsi]
jmp 0xbcd550
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x7c4000]
mov eax, dword [rdi]
or eax, eax
je 0xbcd5ce
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x7cd000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0xbcd57e
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0xbcd5c8
mov qword [rbx], rax
add rbx, 8
jmp 0xbcd59e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0xbcd612
cmp al, 0xef
ja 0xbcd5fa
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0xbcd5da
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0xbcd5e9
mov eax, dword [rdi]
add rdi, 4
jmp 0xbcd5e9
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0xbcd666
sub rsp, 0xffffffffffffff80
jmp 0x45b300
Function at 0x41e100
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x005c4392], 0
jne 0x41e1f0
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x48]
test byte [rdx], al
mov ecx, dword [rax + 0x5c]
imul rcx, rbx
mov rbx, rcx
shr rbx, 0x20
shr rcx, 0x23
and ebx, 7
mov rsi, rcx
mov rcx, rbx
mov edi, 1
shl edi, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], dil
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
add rdx, rcx
mov rbx, rdx
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x41e1e3
lea rsi, [0x00556498]
mov rdx, qword [rsi + rdx*8]
test byte [rdx], al
mov rsi, rcx
shr rsi, 0x10
and esi, 0x3f
shr rcx, 0xd
and ecx, 7
mov edi, 1
shl edi, cl
shr rbx, 0x16
and ebx, 0xfffff
mov rdx, qword [rdx + rbx*8]
test byte [rdx], al
movzx ebx, byte [rdx + rsi + 0x1040]
lea rdx, [rdx + rsi]
lea rdx, [rdx + 0x1040]
test dil, bl
jne 0x41e1be
lock or byte [rdx], dil
mov rcx, qword [r14 + 0x30]
mov rcx, qword [rcx + 0xa0]
test byte [rcx], al
mov rdx, qword [rcx + 0x1270]
add rdx, qword [rax + 0x68]
mov qword [rcx + 0x1270], rdx
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call sym.runtime.panicIndexU
lea rax, [0x004ad3dc]
mov ebx, 0x2c
nop dword [rax]
call sym.runtime.throw
nop
int3

Function at 0x420640
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x420746
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov byte [rsp + 0x70], dil
mov qword [rsp + 0x10], 0
jmp 0x420683
mov rax, qword [rsp + 0x58]
mov rcx, rdx
mov rbx, qword [rsp + 0x60]
movzx edi, byte [rsp + 0x70]
cmp qword [rsp + 0x10], rbx
jae 0x42073b
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call sym.runtime._scavengeIndex_.find
test rax, rax
je 0x42073b
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [sym.runtime._pageAlloc_.scavenge.func1]
mov qword [rsp + 0x18], rcx
lea rdx, [rsp + 0x10]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x18]
mov qword [rsp], rbx
nop dword [rax]
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x005c4590]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x68]
nop dword [rax]
test rdx, rdx
jne 0x420729
xor eax, eax
jmp 0x420733
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x68]
test al, al
je 0x420671
mov rax, qword [rsp + 0x10]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp sym.runtime._pageAlloc_.scavenge
Function at 0x4449c0
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x444b27
push rbp
mov rbp, rsp
sub rsp, 0x18
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x4449d2
cmp edx, ecx
jne 0x444b15
nop word [rax + rax]
test rsi, rsi
jne 0x444b15
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x444a34
nop
call sym.runtime.nanotime1.abi0
xorps xmm15, xmm15
mov r14, qword [0x005c4590]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call sym.runtime.updateTimerPMask
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx]
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1b
add edx, ebx
mov esi, edx
and edx, 0xffffffe0
sub ebx, edx
test ebx, ebx
jl 0x444b10
mov rdx, qword [0x0053f8e8]
sar esi, 5
mov rax, rcx
mov ecx, ebx
mov edi, 1
shl edi, cl
movsxd rsi, esi
cmp ecx, 0x20
sbb r8d, r8d
and edi, r8d
cmp rdx, rsi
jbe 0x444b05
mov rcx, qword [0x0053f8e0]
lea rcx, [rcx + rsi*4]
lock or dword [rcx], edi
mov rcx, qword [0x00540990]
mov qword [rax + 8], rcx
mov rcx, rax
nop
mov qword [0x00540990], rax
nop
mov edx, 1
lea rsi, [0x00540998]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1248]
shr rdx, 0x3d
test dl, dl
jne 0x444af3
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
nop
nop
xchg qword [rcx + 0x1248], rdx
add rsp, 0x18
pop rbp
ret
lea rax, [0x004acc22]
mov ebx, 0x28
nop
call sym.runtime.throw
mov rax, rsi
mov rcx, rdx
call sym.runtime.panicIndex
call sym.runtime.panicshift
lea rax, [0x004abf39]
mov ebx, 0x23
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.runtime.pidleput
Function at 0x47b820
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47b8ea
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x005c4590]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x47b8cf
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x00491ce0]
xor ebx, ebx
mov rcx, rdx
call sym.runtime.makeslice
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call sym.syscall.encodeWTF16
inc rbx
cmp rcx, rbx
jae 0x47b8be
mov edi, 1
lea rsi, [0x00491ce0]
call sym.runtime.growslice
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x004c8d78]
lea rsi, [0x004c8700]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.syscall.UTF16FromString
Function at 0x140005080
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14023db80]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140005153
cmp byte [rcx + 0x71], 0
je 0x140005153
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x14000514f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140005114
sub eax, 1
je 0x140005118
cmp eax, 2
jne 0x14000514f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140079720
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140005146
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000514f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400050fc
xor al, al
jmp 0x1400050fc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140079720
add rsp, 0x60
pop rbx
ret
Function at 0x140005c20
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x14023db80]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov esi, edx
mov rdi, rcx
cmp edx, 0xffffffff
jne 0x140005c4d
xor eax, eax
jmp 0x140005db6
mov qword [rsp + 0xa0], rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
test rax, rax
je 0x140005c8d
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::epptr_void_const___ptr64]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
cmp rax, rbx
jae 0x140005c8d
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], sil
mov eax, esi
jmp 0x140005dae
cmp qword [rdi + 0x80], 0
je 0x140005da9
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const___ptr64]
lea rcx, [rdi + 0x70]
cmp rax, rcx
jne 0x140005cc7
mov rdx, qword [rdi + 0x88]
mov rcx, rdi
mov r9, qword [rdi + 0x90]
mov r8, rdx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::setg_char____ptr64__char____ptr64__char____ptr64____ptr64]
mov rcx, qword [rdi + 0x68]
test rcx, rcx
jne 0x140005cf2
mov rdx, qword [rdi + 0x80]
movsx ecx, sil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x140005dae
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], sil
mov qword [rsp + 0x38], rax
lea rdx, [rdi + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140005d61
sub eax, 1
je 0x140005d61
cmp eax, 2
jne 0x140005da9
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rdi + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x140005dae
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rbx, rax
je 0x140005d8f
mov r9, qword [rdi + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x140005da9
lea rax, [rsp + 0x50]
mov byte [rdi + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, esi
mov eax, ecx
jmp 0x140005dae
mov eax, 0xffffffff
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140079720
mov rsi, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140005f00
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push r14
mov r14, rcx
mov rsi, r8
mov rbp, rdx
sub r14, qword [r8 + 0x30]
je 0x140006082
test byte [r8 + 0x5e], 0x40
jne 0x140005f2d
xor eax, eax
mov rbp, qword [rsp + 0x30]
pop r14
pop rsi
ret
movzx edx, word [rsi + 0x14]
movzx eax, word [rsi + 6]
add rdx, 0x18
mov r8d, dword [r8 + 0xb0]
add rdx, rsi
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
cmp rdx, r9
jae 0x140006082
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x140005f66
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x140005f7d
add rdx, 0x28
cmp rdx, r9
jb 0x140005f54
mov eax, 1
mov rbp, qword [rsp + 0x30]
pop r14
pop rsi
ret
mov qword [rsp + 0x18], rbx
mov ebx, dword [rdx + 0x14]
sub rbx, rcx
mov qword [rsp + 0x28], r15
mov r15d, dword [rsi + 0xb4]
add rbx, r8
add rbx, rbp
add r15, rbx
test rbx, rbx
je 0x140006078
cmp rbx, r15
jae 0x140006078
mov qword [rsp + 0x20], rdi
mov eax, dword [rbx + 4]
test eax, eax
je 0x140006073
add eax, 0xfffffff8
shr eax, 1
je 0x140006064
lea r11, [rbx + 8]
mov edi, eax
movzx r8d, word [r11]
movzx eax, r8w
shr ax, 0xc
and r8d, 0x80000fff
jge 0x140005ff2
dec r8d
or r8d, 0xfffff000
inc r8d
cmp ax, 3
je 0x140005ffe
cmp ax, 0xa
jne 0x140006056
movzx eax, word [rsi + 0x14]
movzx ecx, word [rsi + 6]
add rax, 0x18
mov r9d, dword [rbx]
add rax, rsi
lea rdx, [rcx + rcx*4]
lea r10, [rax + rdx*8]
cmp rax, r10
jae 0x14000604b
nop dword [rax]
mov edx, dword [rax + 0xc]
cmp r9, rdx
jb 0x140006032
mov ecx, dword [rax + 8]
add ecx, edx
cmp r9, rcx
jb 0x14000603d
add rax, 0x28
cmp rax, r10
jb 0x140006020
jmp 0x14000604b
mov ecx, dword [rax + 0x14]
sub rcx, rdx
add rcx, r9
add rcx, rbp
jne 0x14000604e
mov rcx, rbp
movzx eax, r8w
add qword [rax + rcx], r14
add r11, 2
sub rdi, 1
jne 0x140005fd0
mov eax, dword [rbx + 4]
add rbx, rax
cmp rbx, r15
jb 0x140005fb4
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
mov r15, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov eax, 1
pop r14
pop rsi
ret