joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001c400
Capabilities:
Compute adler32 checksum

Disassembly:
sub rsp, 0x68
mov r11, r8
mov r10, rdx
mov eax, ecx
test r8, r8
jne 0x14001c41e
mov eax, 1
vzeroupper
add rsp, 0x68
ret
test r9, r9
je 0x14001c65f
mov qword [rsp + 0x70], rbx
mov ebx, ecx
mov qword [rsp + 0x60], rdi
mov edi, 0x15b0
vmovaps xmmword [rsp + 0x50], xmm6
vmovaps xmmword [rsp + 0x40], xmm7
vmovdqu ymm7, ymmword [0x140044300]
vmovaps xmmword [rsp + 0x30], xmm8
vmovdqu ymm8, ymmword [0x1400442e0]
vmovaps xmmword [rsp + 0x20], xmm9
vmovdqu ymm9, ymmword [0x1400442c0]
movzx r8d, cx
mov ecx, dword [rsp + 0x90]
shr ebx, 0x10
cmp r9, 0x10
jb 0x14001c5af
cmp r9, 0x20
jb 0x14001c583
vpxor xmm6, xmm6, xmm6
nop
cmp r9, rdi
mov rax, r9
vmovd xmm2, r8d
cmova rax, rdi
and rax, 0xffffffffffffffe0
sub r9, rax
vmovd xmm3, ebx
vmovdqu ymm5, ymm2
vmovdqu ymm4, ymm6
cmp rax, 0x20
jb 0x14001c4fa
shr rax, 5
nop dword [rax]
vmovdqu ymm0, ymmword [r11]
add r11, 0x20
vpsadbw ymm1, ymm0, ymm6
test ecx, ecx
je 0x14001c4da
vmovdqu ymmword [r10], ymm0
add r10, 0x20
vpaddd ymm2, ymm1, ymm2
vpmaddubsw ymm0, ymm0, ymm7
vpmaddwd ymm1, ymm0, ymm8
vpaddd ymm4, ymm4, ymm5
vpaddd ymm3, ymm1, ymm3
vmovdqu ymm5, ymm2
sub rax, 1
jne 0x14001c4c0
vpermd ymm1, ymm9, ymm2
vpunpckhqdq xmm0, xmm1, xmm1
vpaddd xmm2, xmm0, xmm1
vpshufd xmm1, xmm2, 1
vpaddd xmm0, xmm1, xmm2
vmovd r8d, xmm0
vpslld ymm0, ymm4, 5
vpaddd ymm2, ymm0, ymm3
vextracti128 xmm1, ymm2, 1
vpaddd xmm1, xmm1, xmm2
vpunpckhqdq xmm0, xmm1, xmm1
vpaddd xmm2, xmm0, xmm1
mov eax, 0x80078071
mul r8d
vpshufd xmm1, xmm2, 1
shr edx, 0xf
imul eax, edx, 0xfff1
vpaddd xmm0, xmm1, xmm2
vmovd ebx, xmm0
sub r8d, eax
mov eax, 0x80078071
mul ebx
shr edx, 0xf
imul eax, edx, 0xfff1
sub ebx, eax
cmp r9, 0x20
jae 0x14001c490
mov eax, ebx
shl eax, 0x10
or eax, r8d
test r9, r9
jne 0x14001c476
jmp 0x14001c63d
test ecx, ecx
mov ecx, eax
je 0x14001c59c
mov r8, r11
mov rdx, r10
vzeroupper
call fcn.14001c170
jmp 0x14001c63d
mov r8, r9
mov rdx, r11
vzeroupper
call fcn.14001b690
jmp 0x14001c63d
test ecx, ecx
je 0x14001c5ee
test r9, r9
je 0x14001c5d8
sub r11, r10
nop dword [rax + rax]
movzx eax, byte [r11 + r10]
mov byte [r10], al
lea r10, [r10 + 1]
add r8d, eax
add ebx, r8d
sub r9, 1
jne 0x14001c5c0
mov eax, 0x80078071
mul r8d
shr edx, 0xf
imul ecx, edx, 0xfff1
sub r8d, ecx
jmp 0x14001c628
test r9, r9
je 0x14001c614
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r11]
lea r11, [r11 + 1]
add r8d, eax
add ebx, r8d
sub r9, 1
jne 0x14001c600
mov eax, 0x80078071
mul r8d
shr edx, 0xf
imul eax, edx, 0xfff1
sub r8d, eax
mov eax, 0x80078071
mul ebx
shr edx, 0xf
imul eax, edx, 0xf
add eax, ebx
shl eax, 0x10
or eax, r8d
vmovaps xmm8, xmmword [rsp + 0x30]
vmovaps xmm7, xmmword [rsp + 0x40]
vmovaps xmm6, xmmword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x70]
vmovaps xmm9, xmmword [rsp + 0x20]
vzeroupper
add rsp, 0x68
ret
Function at 0x140028f88
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140028ff7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140028ff7
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140028ff7
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140028ff7
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140028ff7
cmp dword [rcx + 0x84], 0xe
jbe 0x140028ff7
cmp dword [rcx + 0xf8], 0
je 0x140028ff7
mov ecx, ebx
call fcn.1400290b4
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140028e84
nop
cmp dword [rbp + 0x20], 0
je 0x140029045
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140029050
int3
xor r8d, r8d
lea edx, [r8 + 2]
jmp 0x140028f88

Function at 0x140029198
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140028f88
Function at 0x14002e050
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002e09a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002e09a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002e09a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002e09a
cmp dword [rcx + 0x84], 0xe
jbe 0x14002e09a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14002e09c
xor al, al
add rsp, 0x28
ret
Function at 0x140038298
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1400382c8
xor eax, eax
jmp 0x14003838b
mov rbp, rbx
cmp word [rax], si
je 0x1400382ed
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1400382d4
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1400382d0
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140028dd4
movsxd r14, eax
test eax, eax
jne 0x14003832b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1400382c1
mov rcx, r14
call fcn.140023478
mov rdi, rax
test rax, rax
jne 0x140038344
xor ecx, ecx
call fcn.140020e88
jmp 0x140038320
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140028dd4
test eax, eax
jne 0x140038375
mov rcx, rdi
call fcn.140020e88
jmp 0x14003837f
xor ecx, ecx
call fcn.140020e88
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x1400121b0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x140040040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov esi, 0xffff
movzx edi, dx
mov rbx, rcx
cmp si, dx
jne 0x1400121e1
xor eax, eax
jmp 0x14001232b
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x14001221e
mov r9, qword [rcx + 0x58]
movsxd r10, dword [r9]
lea rdx, [r8 + r10*2]
cmp r8, rdx
jae 0x14001221e
lea ecx, [r10 - 1]
movzx eax, di
mov dword [r9], ecx
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], di
jmp 0x14001232b
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xb0], rbp
je 0x140012320
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x140012265
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140012273
movzx ecx, di
jmp 0x1400122c7
lea rax, [rsp + 0x40]
mov word [rsp + 0x50], di
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x52]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__wchar_t_const____ptr64__wchar_t_const____ptr64__wchar_t_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400122e0
sub eax, 1
je 0x1400122e0
cmp eax, 2
jne 0x140012320
movzx ecx, word [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputwc]
cmp ax, si
cmove di, si
movzx eax, di
jmp 0x140012323
mov rbp, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rbp, rax
je 0x14001230e
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbp
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbp, rax
jne 0x140012320
lea rax, [rsp + 0x50]
mov byte [rbx + 0x72], 1
cmp qword [rsp + 0x48], rax
cmovne si, di
movzx eax, si
mov rbp, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14001edd0
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret
Function at 0x140012880
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140040040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140012955
cmp byte [rcx + 0x72], 0
je 0x140012955
mov rax, qword [rcx]
mov qword [rsp + 0x78], rdi
mov edi, 0xffff
mov edx, edi
call qword [rax + 0x18]
cmp di, ax
je 0x140012951
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140012916
sub eax, 1
je 0x14001291a
cmp eax, 2
jne 0x140012951
mov byte [rbx + 0x72], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14001edd0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x72], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140012948
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140012951
cmp byte [rbx + 0x72], 0
sete al
jmp 0x1400128fe
xor al, al
jmp 0x1400128fe
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14001edd0
add rsp, 0x60
pop rbx
ret

Function at 0x140014d40
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x140014d61
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x140014d8e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140014d90
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140014de9
test ecx, ecx
jle 0x140014dc9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140014de9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140014de9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
add al, bh
xor eax, esi
stc
cmc
sub eax, 0x2f840b05
cmc
xor eax, 0x55934dcf
jmp 0x1401323ce
push r10
ret
rol eax, 3
stc
not eax
test bl, r11b
push rsi
mov sil, 0x20
rcl sil, 0x8b
movsx si, r10b
xor dword [rsp], eax
movsx esi, bp
shr si, cl
and sil, r14b
pop rsi
test sil, r8b
movsxd rax, eax
cmp r15b, r13b
add r10, rax
jmp 0x1400e2130
Function at 0x140014e10
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140014e32
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je case.default.0x140014e41
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140014e64
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140014e66
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140014ea2
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140014f3e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140014edd
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x140014f1e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x140014f3e
cmp rbx, rax
ja 0x140014ef0
test rbx, rbx
je 0x140014f3e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
ret 0xcafe
Function at 0x140015370
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140040040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14001539d
xor eax, eax
jmp 0x140015509
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x1400153d7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x1400153d7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140015509
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1400154fc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14001541a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140015445
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140015501
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400154b4
sub eax, 1
je 0x1400154b4
cmp eax, 2
jne 0x1400154fc
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140015501
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1400154e2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1400154fc
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140015501
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14001edd0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140015670
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140040040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140015743
cmp byte [rcx + 0x71], 0
je 0x140015743
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14001573f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140015704
sub eax, 1
je 0x140015708
cmp eax, 2
jne 0x14001573f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14001edd0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140015736
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14001573f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400156ec
xor al, al
jmp 0x1400156ec
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14001edd0
add rsp, 0x60
pop rbx
ret
Function at 0x140015e70
Capabilities:
Access pe header
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov r9, rcx
lea r8, str.Remapping_image_at_0x_IX_n
xor edx, edx
mov rdi, rcx
call fcn.140016860
mov rcx, rdi
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov rbx, rax
test rax, rax
jne 0x140015ec0
mov r9, rdi
lea r8, str.RtlImageNtHeader_failed.__BaseAddress__0x_IX__n
mov edx, 2
call fcn.140016860
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, rbx
mov qword [rsp + 0x30], rsi
call fcn.140015fd0
mov esi, eax
test eax, eax
jne 0x140015ef6
lea r8, str.RmppVerifyPeSectionAlignment_failed._n
mov edx, 2
call fcn.140016ae0
mov eax, esi
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov edx, dword [rbx + 0x50]
xor ecx, ecx
mov r9d, 0x40
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x140015f41
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.VirtualAlloc_failed:__u_n
mov edx, 2
mov r9d, eax
call fcn.140016d70
mov rsi, qword [rsp + 0x30]
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rdx, rsi
mov rcx, rbx
call fcn.1400162d0
lea rax, [0x140016350]
mov rcx, rsi
sub rax, rdi
add rax, rsi
call rax
mov ebx, eax
test eax, eax
jne 0x140015f6d
lea r8, str.RmppRemapImageRoutine_failed._n
jmp 0x140015f82
mov rcx, rdi
call fcn.1400166a0
mov ebx, eax
test eax, eax
jne 0x140015f8c
lea r8, str.RmppValidateRemappedImageProtection_failed._n
mov edx, 2
call fcn.140016ae0
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
jne 0x140015fbb
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.VirtualFree_failed:__u_n
mov edx, 2
mov r9d, eax
call fcn.140016d70
mov rsi, qword [rsp + 0x30]
mov eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400165e0
Capabilities:
Map section object

Disassembly:
mov r11, rsp
sub rsp, 0x78
mov rax, qword [0x140040040]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x48], eax
lea rax, [r11 - 0x20]
mov dword [rsp + 0x40], 0x400000
mov dword [rsp + 0x38], 2
mov qword [r11 - 0x48], rax
lea rax, [r11 - 0x18]
mov qword [r11 - 0x28], rdx
mov rdx, 0xffffffffffffffff
mov qword [r11 - 0x20], r8
lea r8, [r11 - 0x28]
mov qword [r11 - 0x18], r9
xor r9d, r9d
mov qword [r11 - 0x50], rax
mov qword [r11 - 0x58], 0
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
mov r9d, eax
test eax, eax
jns 0x140016687
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
call fcn.1400174f0
xor eax, eax
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14001edd0
add rsp, 0x78
ret
mov eax, 1
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14001edd0
add rsp, 0x78
ret

Function at 0x1400166a0
Capabilities:
Access pe header

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
lea r8, str.Validating_remapped_image_protection._n
xor edx, edx
mov rdi, rcx
call fcn.140016ae0
mov rcx, rdi
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rax, rax
jne 0x1400166ec
mov r9, rdi
lea r8, str.RtlImageNtHeader_failed.__BaseAddress__0x_IX__n
mov edx, 2
call fcn.140016860
xor ebx, ebx
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbp
xor ebx, ebx
movzx ebp, word [rax + 0x14]
add rbp, rax
mov qword [rsp + 0x38], rsi
nop
movzx eax, bx
lea rcx, [rax + rax*4]
mov ecx, dword [rbp + rcx*8 + 0x24]
add rcx, rdi
call fcn.140016770
mov esi, eax
test eax, eax
je 0x140016745
inc bx
cmp bx, 6
jb 0x140016700
mov rcx, rdi
call fcn.140016770
mov ebx, eax
test eax, eax
jne 0x140016758
lea r8, str.RmppValidateRemappedPeSectionProtection_failed._n
mov edx, 2
call fcn.140016ae0
mov eax, ebx
jmp 0x140016758
lea r8, str.RmppValidateRemappedPeSectionProtection_failed._n
mov edx, 2
call fcn.140016ae0
mov eax, esi
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140016770
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x140040040]
xor rax, rsp
mov qword [rsp + 0x68], rax
xorps xmm0, xmm0
mov dword [rsp + 0x30], 0
mov r8d, 0x30
lea rdx, [rsp + 0x38]
movups xmmword [rsp + 0x38], xmm0
mov rbx, rcx
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x1400167ec
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.VirtualQuery_failed:__u__BaseAddress__0x_IX__n
mov qword [rsp + 0x20], rbx
mov r9d, eax
mov edx, 2
call fcn.140017780
xor eax, eax
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14001edd0
add rsp, 0x70
pop rbx
ret
mov rdx, qword [rsp + 0x50]
lea r9, [rsp + 0x30]
mov eax, 0x40
mov r8d, 1
cmp dword [rsp + 0x5c], eax
mov rcx, rbx
cmovne r8d, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x14001683b
mov ecx, dword [rsp + 0x30]
mov r9, rbx
mov dword [rsp + 0x20], ecx
call fcn.140017a10
xor eax, eax
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14001edd0
add rsp, 0x70
pop rbx
ret
mov eax, 1
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14001edd0
add rsp, 0x70
pop rbx
ret

Function at 0x140019220
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [rcx + 0x40]
mov edx, 0x38
cmp eax, edx
mov r8d, 0x40
mov rbx, rcx
cmovb r8d, edx
mov byte [rax + rcx], 0x80
lea rcx, [rax + 1]
cmp rcx, r8
jae 0x140019257
sub r8, rcx
xor edx, edx
add rcx, rbx
call sub.VCRUNTIME140.dll_memset
cmp dword [rbx + 0x40], 0x38
jb 0x140019279
mov rcx, rbx
call fcn.140018ff0
xorps xmm2, xmm2
xor eax, eax
movups xmmword [rbx], xmm2
movups xmmword [rbx + 0x10], xmm2
movups xmmword [rbx + 0x20], xmm2
mov qword [rbx + 0x30], rax
mov eax, dword [rbx + 0x44]
mov ecx, dword [rbx + 0x40]
mov dword [rbx + 0x38], 0
lea edx, [rax + rcx*8]
mov rcx, rbx
mov eax, edx
mov dword [rbx + 0x44], edx
shr eax, 8
mov byte [rbx + 0x3e], al
mov eax, edx
mov byte [rbx + 0x3f], dl
shr eax, 0x10
shr edx, 0x18
mov byte [rbx + 0x3d], al
mov byte [rbx + 0x3c], dl
add rsp, 0x20
pop rbx
jmp fcn.140018ff0