joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002ad00
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002ad4a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002ad4a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002ad4a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002ad4a
cmp dword [rcx + 0x84], 0xe
jbe 0x14002ad4a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14002ad4c
xor al, al
add rsp, 0x28
ret
Function at 0x140626058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1406261df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140626089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14062606f
add dl, dl
jne 0x140626096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406260f6
xor eax, eax
add dl, dl
jne 0x1406260a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406261ad
add dl, dl
jne 0x1406260b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406260c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406260d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406260dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1406260ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14062607e
mov eax, 1
add dl, dl
jne 0x140626106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140626113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406260fb
sub eax, ebx
mov ebx, 1
jne 0x14062614c
mov ecx, 1
add dl, dl
jne 0x14062612e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14062613b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140626123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14062607e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140626168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140626175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14062615d
cmp eax, 0x7d00
jae 0x14062619b
cmp eax, 0x500
jb 0x140626196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14062607e
cmp eax, 0x7f
ja 0x14062619e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14062607e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1406261d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14062607e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20

Function at 0x1800012b0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x1800012d8
xor eax, eax
lea r8, section..text
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x38
ret
Function at 0x1400012dc
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x140003638], rbx
je 0x140001328
cmp rax, rbx
jne 0x14000131b
mov ebx, 1
mov esi, ebx
jmp 0x14000132d
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x140001300
mov ebx, 1
mov eax, dword [0x140003640]
cmp eax, ebx
jne 0x140001343
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x1400013a8
mov eax, dword [0x140003640]
test eax, eax
jne 0x1400013a2
mov dword [0x140003640], ebx
lea r15, [0x1400022c0]
lea rdi, [0x1400022a8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x140001394
test eax, eax
jne 0x140001398
cmp qword [rdi], 0
je 0x140001389
mov rax, qword [rdi]
mov rcx, qword [0x140002288]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x14000136a
test eax, eax
je 0x1400013a8
mov eax, 0xff
jmp 0x140001484
mov dword [0x140003044], ebx
mov eax, dword [0x140003640]
cmp eax, ebx
jne 0x1400013cf
lea rdx, [0x1400022a0]
lea rcx, [0x140002290]
call sub.msvcrt.dll__initterm
mov dword [0x140003640], 2
test esi, esi
jne 0x1400013dc
xor eax, eax
xchg qword [0x140003638], rax
cmp qword [0x140003648], 0
je 0x140001410
lea rcx, [0x140003648]
call fcn.140001650
test eax, eax
je 0x140001410
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140003648]
mov r9, qword [0x140002288]
call r9
mov r8, qword [0x140003058]
mov rdx, qword [0x140003050]
mov ecx, dword [0x140003048]
call fcn.14000119c
mov dword [0x140003040], eax
cmp dword [0x140003060], 0
jne 0x140001440
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140003044], 0
jne 0x140001455
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140003040]
jmp 0x140001484
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.140153000
add rsp, 0x28
jmp 0x1400012dc

Function at 0x140001550
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000159c
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140001594
cmp dword [rcx + 0x3c], edx
jl 0x140001594
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140001594
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x14000159c
mov rax, rdx
add rsp, 0x18
ret
Function at 0x140009880
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
test rcx, rcx
je 0x1400098a5
test rdx, rdx
je 0x1400098b7
cmp rdx, 0x40
jae 0x1400098c5
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov edx, 0x40
call fcn.14000a740
test al, al
jne 0x1400098a5
mov eax, 0x5a4d
cmp word [rdi], ax
jne 0x1400098a5
movsxd rax, dword [rdi + 0x3c]
cmp eax, 0x400
jg 0x1400098a5
lea rbx, [rax + rdi]
mov rcx, rax
test rsi, rsi
je 0x14000990a
test rbx, rbx
je 0x1400098a5
cmp rbx, rdi
jb 0x1400098a5
add rax, 0xf8
cmp rax, rsi
ja 0x1400098a5
cmp rax, 0xf8
jb 0x1400098a5
cmp rax, rcx
jb 0x1400098a5
jmp 0x14000991b
mov edx, 0xf8
mov rcx, rbx
call fcn.14000a740
test al, al
jne 0x1400098a5
mov rsi, qword [rsp + 0x38]
xor eax, eax
cmp dword [rbx], 0x4550
cmovne rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140009940
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x140009a3e
mov edx, 0x40
call fcn.14000a740
test al, al
jne 0x140009a3e
mov edi, 0x5a4d
cmp word [rbx], di
jne 0x140009a3e
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140009a3e
lea rsi, [rbx + rax]
mov edx, 0xf8
mov rcx, rsi
call fcn.14000a740
test al, al
jne 0x140009a3e
cmp dword [rsi], 0x4550
jne 0x140009a3e
test rsi, rsi
je 0x140009a3e
mov edx, 0x40
mov rcx, rbx
call fcn.14000a740
test al, al
jne 0x140009a2b
cmp word [rbx], di
jne 0x140009a2b
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140009a2b
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.14000a740
test al, al
jne 0x140009a2b
cmp dword [rdi], 0x4550
jne 0x140009a2b
test rdi, rdi
je 0x140009a2b
mov edx, 0xf8
mov rcx, rdi
call fcn.14000a740
test al, al
jne 0x140009a2b
xor eax, eax
mov ecx, 0x20b
cmp word [rdi + 0x18], cx
cmovne rax, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140009a50
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x140009b33
mov edx, 0x40
call fcn.14000a740
test al, al
jne 0x140009b33
mov edi, 0x5a4d
cmp word [rbx], di
jne 0x140009b33
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140009b33
lea rsi, [rbx + rax]
mov edx, 0xf8
mov rcx, rsi
call fcn.14000a740
test al, al
jne 0x140009b33
cmp dword [rsi], 0x4550
jne 0x140009b33
test rsi, rsi
je 0x140009b33
mov edx, 0x40
mov rcx, rbx
call fcn.14000a740
test al, al
jne 0x140009b33
cmp word [rbx], di
jne 0x140009b33
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140009b33
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.14000a740
test al, al
jne 0x140009b33
cmp dword [rdi], 0x4550
jne 0x140009b33
test rdi, rdi
je 0x140009b33
mov edx, 0xf8
mov rcx, rdi
call fcn.14000a740
test al, al
jne 0x140009b33
xor eax, eax
mov ecx, 0x20b
cmp word [rdi + 0x18], cx
cmove rax, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140009b50
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebp, edx
mov rbx, rcx
test rcx, rcx
je 0x140009c3c
mov edx, 0x40
call fcn.14000a740
test al, al
jne 0x140009c3c
mov edi, 0x5a4d
cmp word [rbx], di
jne 0x140009c3c
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140009c3c
lea rsi, [rbx + rax]
mov edx, 0xf8
mov rcx, rsi
call fcn.14000a740
test al, al
jne 0x140009c3c
cmp dword [rsi], 0x4550
jne 0x140009c3c
test rsi, rsi
je 0x140009c3c
mov edx, 0x40
mov rcx, rbx
call fcn.14000a740
test al, al
jne 0x140009c2a
cmp word [rbx], di
jne 0x140009c2a
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140009c2a
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.14000a740
test al, al
jne 0x140009c2a
cmp dword [rdi], 0x4550
jne 0x140009c2a
test rdi, rdi
je 0x140009c2a
mov edx, 0xf8
mov rcx, rdi
call fcn.14000a740
test al, al
jne 0x140009c2a
mov eax, 0x20b
cmp word [rdi + 0x18], ax
lea rax, [rbp + 0x11]
je 0x140009c2e
lea rax, [rbp + 0xf]
lea rax, [rsi + rax*8]
xor ecx, ecx
cmp dword [rax], ecx
cmove rax, rcx
jmp 0x140009c3e
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140009c60
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov edi, 0x5a4d
test rcx, rcx
je 0x140009cd7
mov edx, 0x40
call fcn.14000a740
test al, al
jne 0x140009cd7
cmp word [rbx], di
jne 0x140009cd7
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140009cd7
lea rsi, [rbx + rax]
mov edx, 0xf8
mov rcx, rsi
call fcn.14000a740
test al, al
jne 0x140009cd7
cmp dword [rsi], 0x4550
jne 0x140009cd7
test rsi, rsi
je 0x140009cd7
mov edx, 0xf8
mov rcx, rsi
call fcn.14000a740
test al, al
je 0x140009cd1
xor esi, esi
jmp 0x140009cde
movzx esi, word [rsi + 0x18]
jmp 0x140009cde
xor esi, esi
test rbx, rbx
je 0x140009d52
mov edx, 0x40
mov rcx, rbx
call fcn.14000a740
test al, al
jne 0x140009d52
cmp word [rbx], di
jne 0x140009d52
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140009d52
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.14000a740
test al, al
jne 0x140009d52
cmp dword [rdi], 0x4550
jne 0x140009d52
test rdi, rdi
je 0x140009d52
mov eax, 0x20b
cmp si, ax
jne 0x140009d3f
mov rax, qword [rdi + 0x30]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov eax, dword [rdi + 0x34]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140009d70
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x140009e74
mov edx, 0x40
call fcn.14000a740
test al, al
jne 0x140009e74
mov esi, 0x5a4d
cmp word [rbx], si
jne 0x140009e74
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140009e74
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.14000a740
test al, al
jne 0x140009e74
cmp dword [rdi], 0x4550
jne 0x140009e74
mov edx, 0x40
mov rcx, rbx
call fcn.14000a740
test al, al
jne 0x140009e59
cmp word [rbx], si
jne 0x140009e59
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140009e59
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.14000a740
test al, al
jne 0x140009e59
cmp dword [rdi], 0x4550
jne 0x140009e59
test rdi, rdi
je 0x140009e59
mov edx, 0xf8
mov rcx, rdi
call fcn.14000a740
test al, al
jne 0x140009e59
mov eax, 0x20b
cmp word [rdi + 0x18], ax
jne 0x140009e59
mov rcx, rbx
call fcn.140009a50
mov eax, dword [rax + 0x50]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, rbx
call fcn.140009940
mov eax, dword [rax + 0x50]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140009e90
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
mov rbp, rdx
mov rbx, rcx
test rcx, rcx
je 0x140009f61
call fcn.140009880
mov rsi, rax
test rax, rax
je 0x140009f61
mov edx, 0x40
mov qword [rsp + 0x30], rdi
mov rcx, rbx
call fcn.14000a740
test al, al
jne 0x140009f22
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x140009f22
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140009f22
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.14000a740
test al, al
jne 0x140009f22
cmp dword [rdi], 0x4550
jne 0x140009f22
test rdi, rdi
je 0x140009f22
mov edx, 0xf8
mov rcx, rdi
call fcn.14000a740
test al, al
jne 0x140009f22
mov eax, 0x20b
lea rax, [rsi + 4]
test rax, rax
je 0x140009f4a
cmp rax, rbx
jb 0x140009f4a
mov rcx, rax
sub rcx, rbx
lea rdx, [rcx + 0x14]
cmp rdx, rbp
ja 0x140009f4a
cmp rdx, 0x14
jb 0x140009f4a
cmp rdx, rcx
jae 0x140009f4c
xor eax, eax
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
mov rbx, qword [rsp + 0x38]
xor eax, eax
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
Function at 0x140009f80
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, r8
mov rbp, rdx
mov rdi, rcx
call fcn.140009880
test rax, rax
jne 0x140009fb4
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rbx
mov rdx, rbp
mov rcx, rdi
mov qword [rsp + 0x38], rsi
call fcn.140009e90
test rax, rax
je 0x14000a0d6
cmp word [rax + 2], 0
je 0x14000a0d6
test rdi, rdi
je 0x14000a11c
mov edx, 0x40
mov rcx, rdi
call fcn.14000a740
test al, al
jne 0x14000a11c
mov ebx, 0x5a4d
cmp word [rdi], bx
jne 0x14000a11c
movsxd rax, dword [rdi + 0x3c]
cmp eax, 0x400
jg 0x14000a11c
lea rsi, [rdi + rax]
mov edx, 0xf8
mov rcx, rsi
call fcn.14000a740
test al, al
jne 0x14000a11c
cmp dword [rsi], 0x4550
jne 0x14000a11c
test rsi, rsi
je 0x14000a11c
mov edx, 0x40
mov rcx, rdi
call fcn.14000a740
test al, al
jne 0x14000a096
cmp word [rdi], bx
jne 0x14000a096
movsxd rax, dword [rdi + 0x3c]
cmp eax, 0x400
jg 0x14000a096
lea rbx, [rdi + rax]
mov edx, 0xf8
mov rcx, rbx
call fcn.14000a740
test al, al
jne 0x14000a096
cmp dword [rbx], 0x4550
jne 0x14000a096
test rbx, rbx
je 0x14000a096
mov edx, 0xf8
mov rcx, rbx
call fcn.14000a740
mov esi, dword [rsi + 0x50]
test rsi, rsi
je 0x14000a11c
mov r9d, 4
mov r8d, 0x3000
mov edx, esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
je 0x14000a11c
mov r9d, esi
mov r8, rax
mov rdx, rbp
mov rcx, rdi
call fcn.14000a140
test al, al
je 0x14000a11c
mov qword [r14], rsi
jmp 0x14000a11e
mov eax, 0x1000
mov rsi, rbp
cmp rbp, rax
cmovb rsi, rax
test rsi, rsi
je 0x14000a11c
mov r9d, 4
mov r8d, 0x3000
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
je 0x14000a11c
mov r8, rbp
mov rdx, rdi
mov rcx, rax
call fcn.1400809d0
mov qword [r14], rsi
jmp 0x14000a11e
xor ebx, ebx
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14000a140
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rsi, r9
mov r12, r8
mov r13, rdx
mov rdi, rcx
test rcx, rcx
je 0x14000a34c
test r8, r8
je 0x14000a34c
call fcn.140009880
mov r15, rax
test rax, rax
je 0x14000a34c
mov edx, 0x40
mov rcx, rdi
call fcn.14000a740
test al, al
jne 0x14000a1e9
mov eax, 0x5a4d
cmp word [rdi], ax
jne 0x14000a1e9
movsxd rax, dword [rdi + 0x3c]
cmp eax, 0x400
jg 0x14000a1e9
lea rbx, [rdi + rax]
mov edx, 0xf8
mov rcx, rbx
call fcn.14000a740
test al, al
jne 0x14000a1e9
cmp dword [rbx], 0x4550
jne 0x14000a1e9
test rbx, rbx
je 0x14000a1e9
mov edx, 0xf8
mov rcx, rbx
call fcn.14000a740
test al, al
jne 0x14000a1e9
mov eax, 0x20b
movzx eax, word [r15 + 0x14]
xor r11d, r11d
add rax, r15
mov r14d, r11d
movzx ebp, r11w
lea rdx, [rax + 0x18]
mov eax, dword [r15 + 0x54]
mov qword [rsp + 0x20], rdx
mov dword [rsp + 0x60], eax
cmp r11w, word [r15 + 6]
jae 0x14000a32f
nop word [rax + rax]
movzx eax, bp
lea rcx, [rax + rax*4]
lea rbx, [rdx + rcx*8]
test rbx, rbx
je 0x14000a34c
cmp rbx, rdi
jb 0x14000a34c
mov rcx, rbx
sub rcx, rdi
lea rax, [rcx + 0x28]
cmp rax, r13
ja 0x14000a34c
cmp rax, 0x28
jb 0x14000a34c
cmp rax, rcx
jb 0x14000a34c
cmp rax, rsi
ja 0x14000a34c
mov ecx, dword [rbx + 0x14]
test ecx, ecx
je 0x14000a31d
mov eax, dword [rbx + 0x10]
test eax, eax
je 0x14000a31d
mov r9d, dword [rbx + 0xc]
mov edx, ecx
mov r8d, eax
add rcx, rdi
add rax, r9
lea r10, [r9 + r12]
cmp rax, rsi
jbe 0x14000a2aa
mov rax, rsi
mov r8, r11
sub rax, r9
cmp rsi, r9
cmova r8, rax
cmp r9, rsi
jb 0x14000a2b8
test r8, r8
jne 0x14000a34c
lea rax, [rdx + r8]
cmp rax, rsi
ja 0x14000a34c
test rcx, rcx
je 0x14000a318
cmp rcx, rdi
jb 0x14000a318
cmp rax, r13
ja 0x14000a318
cmp rax, r8
jb 0x14000a318
cmp rax, rdx
jb 0x14000a318
test r10, r10
je 0x14000a318
cmp r10, r12
jb 0x14000a318
lea rax, [r9 + r8]
cmp rax, rsi
ja 0x14000a318
cmp rax, r8
jb 0x14000a318
cmp rax, r9
jb 0x14000a318
mov rdx, rcx
mov rcx, r10
call fcn.1400809d0
test r14d, r14d
je 0x14000a311
cmp dword [rbx + 0x14], r14d
jae 0x14000a315
mov r14d, dword [rbx + 0x14]
xor r11d, r11d
mov rdx, qword [rsp + 0x20]
inc bp
cmp bp, word [r15 + 6]
jb 0x14000a220
mov eax, dword [rsp + 0x60]
test eax, eax
cmove eax, r14d
mov r8d, eax
cmp r8, rsi
ja 0x14000a34c
mov rdx, rdi
mov rcx, r12
call fcn.1400809d0
mov al, 1
jmp 0x14000a34e
xor al, al
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14000a390
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r14, rdx
mov r12, r8
mov edx, 5
mov rsi, rcx
call fcn.140009b50
test rax, rax
je 0x14000a602
test rsi, rsi
je 0x14000a602
cmp rax, rsi
jb 0x14000a602
mov rcx, rax
sub rcx, rsi
lea rdx, [rcx + 8]
cmp rdx, r14
ja 0x14000a602
cmp rdx, 8
jb 0x14000a602
cmp rdx, rcx
jb 0x14000a602
mov ecx, dword [rax + 4]
mov edx, 0x40
mov ebx, dword [rax]
mov dword [rsp + 0x20], ecx
mov rcx, rsi
mov dword [rsp + 0x78], ebx
call fcn.14000a740
test al, al
jne 0x14000a466
mov eax, 0x5a4d
cmp word [rsi], ax
jne 0x14000a466
movsxd rax, dword [rsi + 0x3c]
cmp eax, 0x400
jg 0x14000a466
lea rbx, [rsi + rax]
mov edx, 0xf8
mov rcx, rbx
call fcn.14000a740
test al, al
jne 0x14000a462
cmp dword [rbx], 0x4550
jne 0x14000a462
test rbx, rbx
je 0x14000a462
mov edx, 0xf8
mov rcx, rbx
call fcn.14000a740
mov ebx, dword [rsp + 0x78]
mov r10d, dword [rsp + 0x20]
xor r13d, r13d
test r10d, r10d
je 0x14000a5fe
mov r11d, 0x1000
nop dword [rax]
lea eax, [rbx + r13]
lea r15, [rax + rsi]
mov ecx, eax
test r15, r15
je 0x14000a602
cmp r15, rsi
jb 0x14000a602
add rax, 8
cmp rax, r14
ja 0x14000a602
cmp rax, 8
jb 0x14000a602
cmp rax, rcx
jb 0x14000a602
mov eax, dword [r15 + 4]
test eax, eax
je 0x14000a5fe
mov r9d, dword [r15]
lea rbp, [rax - 8]
shr rbp, 1
lea rax, [r15 + 8]
mov dword [rsp + 0x24], r9d
test rax, rax
je 0x14000a602
cmp rax, rsi
jb 0x14000a602
sub rax, rsi
lea rbx, [rax + 2]
cmp rbx, r14
ja 0x14000a602
cmp rbx, 2
jb 0x14000a602
cmp rbx, rax
jb 0x14000a602
test rbp, rbp
je 0x14000a5ed
xor r8d, r8d
test rbp, rbp
je 0x14000a5ed
mov rax, rbx
nop dword [rax + rax]
lea rdx, [rsi - 2]
add rdx, rax
je 0x14000a569
cmp rdx, rsi
jb 0x14000a569
cmp rax, r14
ja 0x14000a569
cmp rax, 2
jb 0x14000a569
lea rcx, [rax - 2]
cmp rax, rcx
jb 0x14000a569
cmp word [rdx], r11w
jae 0x14000a569
add rax, 2
inc r8
cmp r8, rbp
jb 0x14000a530
jmp 0x14000a5ed
xor edi, edi
nop dword [rax + rax]
lea rcx, [rsi - 2]
add rcx, rbx
je 0x14000a5dd
cmp rcx, rsi
jb 0x14000a5dd
cmp rbx, r14
ja 0x14000a5dd
cmp rbx, 2
jb 0x14000a5dd
lea rax, [rbx - 2]
cmp rbx, rax
jb 0x14000a5dd
movzx eax, word [rcx]
mov ecx, eax
shr eax, 0xc
and ecx, 0xfff
test eax, eax
je 0x14000a5dd
cmp eax, 3
je 0x14000a5ae
cmp eax, 0xa
jne 0x14000a602
add ecx, r9d
cmp rcx, r14
jae 0x14000a602
test r12, r12
je 0x14000a5d1
mov rax, qword [r12]
lea rdx, [rcx + rsi]
mov rcx, r12
call qword [rax]
test al, al
je 0x14000a602
mov r9d, dword [rsp + 0x24]
add rbx, 2
inc rdi
cmp rdi, rbp
jb 0x14000a570
test rdi, rdi
je 0x14000a602
mov r10d, dword [rsp + 0x20]
mov r11d, 0x1000
add r13d, dword [r15 + 4]
mov ebx, dword [rsp + 0x78]
cmp r13d, r10d
jb 0x14000a480
mov al, 1
jmp 0x14000a604
xor al, al
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14000a630
Capabilities:
Parse pe header

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x50
mov rax, qword [0x1401c6a40]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbp, r8
mov r14, rdx
mov rbx, rcx
test rcx, rcx
je 0x14000a738
mov qword [rsp + 0x78], rsi
call fcn.140009c60
mov rsi, rax
cmp rbp, rax
je 0x14000a734
mov edx, 0x40
mov qword [rsp + 0x80], rdi
mov rcx, rbx
call fcn.14000a740
test al, al
jne 0x14000a6d7
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x14000a6d7
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x14000a6d7
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.14000a740
test al, al
jne 0x14000a6d7
cmp dword [rdi], 0x4550
jne 0x14000a6d7
test rdi, rdi
je 0x14000a6d7
mov edx, 0xf8
mov rcx, rdi
call fcn.14000a740
test al, al
jne 0x14000a6d7
movzx eax, word [rdi + 0x18]
jmp 0x14000a6d9
xor eax, eax
mov ecx, 0x20b
mov qword [rsp + 0x30], rsi
cmp ax, cx
mov qword [rsp + 0x38], rbp
lea rax, vtable.ApplyRelocCallback.0
mov rdx, r14
lea r8, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov rcx, rbx
sete byte [rsp + 0x28]
call fcn.14000a390
mov rdi, qword [rsp + 0x80]
test al, al
setne al
mov rsi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140035800
add rsp, 0x50
pop r14
pop rbp
pop rbx
ret
mov al, 1
jmp 0x14000a719
xor al, al
jmp 0x14000a71e