joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180003ec0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x10], 0
mov qword [rsp + 8], 0
mov qword [rsp + 0x18], 0
mov qword [rsp + 0x20], 0
mov rax, qword [0x18001ac30]
mov qword [rsp + 0x10], rax
jp 0x180003f29
push rsi
push rsp
push rbp
pop rbp
pop rsp
pop rsi
jnp 0x180003f29
add al, byte [rdx]
test al, 0x2b
wait
xchg edx, eax
xchg ebx, eax
int1
wait
add dh, bl
xchg edx, eax
xchg ebx, eax
test al, 0x2b
sub al, 0xf1
hlt
mov rax, qword [rsp + 0x10]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x180003f3f
xor eax, eax
jmp 0x18000407f
mov rax, qword [rsp + 0x10]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x10]
add rcx, rax
mov rax, rcx
mov qword [rsp + 8], rax
jne 0x180003f84
nop
je 0x180003f84
in al, 0xe4
hlt
mov rax, qword [rsp + 8]
cmp dword [rax], 0x4550
je 0x180003f98
xor eax, eax
jmp 0x18000407f
mov dword [rsp], 0
jmp 0x180003fa9
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
mov rax, qword [rsp + 8]
movzx eax, word [rax + 6]
cmp dword [rsp], eax
jae 0x180004054
mov rax, qword [rsp + 8]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 8]
lea rax, [rcx + rax + 0x18]
mov ecx, dword [rsp]
imul rcx, rcx, 0x28
add rax, rcx
mov qword [rsp + 0x18], rax
jl 0x180004009
push rbx
push rsp
push rsp
nop
pop rsp
pop rsp
pop rbx
jge 0x180004009
xchg edx, eax
wait
invalid
mov rax, qword [rsp + 0x18]
cmp dword [rax + 0x24], 0xe0000020
jne 0x18000404f
jnp 0x180004043
push rcx
push rsi
pop rsi
pop rcx
jp 0x180004043
test al, 0xc6
test al, 0xf3
wait
add ah, ah
in al, 0xf1
xchg edx, eax
int1
xchg ebx, eax
int1
wait
invalid
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x20], rax
jmp 0x180004054
jmp 0x180003fa1
cmp qword [rsp + 0x20], 0
jne 0x180004060
xor eax, eax
jmp 0x18000407f
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0xc]
mov rcx, qword [0x18001ac30]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
add rsp, 0x38
ret
Function at 0x180013e40
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x10], 0
mov qword [rsp + 0x18], 0
mov qword [rsp + 8], 0
mov qword [rsp], 0
mov qword [rsp + 0x20], 0
mov rax, qword gs:[0x60]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x10]
mov rax, qword [rax + 0x238]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x18]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
mov qword [rsp], rax
mov rax, qword [rsp]
movzx eax, word [rax]
cmp eax, 0x5a4d
jne 0x180013eed
mov rax, qword [rsp]
cmp dword [rax + 0x3c], 0
jle 0x180013eed
mov rax, qword [rsp]
cmp dword [rax + 0x3c], 0x190
jge 0x180013eed
mov rax, qword [rsp]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
cmp dword [rax], 0x4550
jne 0x180013eed
jmp 0x180013efc
mov rax, qword [rsp + 8]
dec rax
mov qword [rsp + 8], rax
jmp 0x180013e99
mov rax, qword [rsp + 8]
add rsp, 0x38
ret

Function at 0x180013f10
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov dword [rsp], 0
mov dword [rsp + 8], 0
mov dword [rsp], 0xffffffff
jge 0x180013f64
push rcx
pop rcx
jl 0x180013f64
hlt
mov dword [rsp + 4], 0
jmp 0x180013f78
mov eax, dword [rsp + 4]
inc eax
mov dword [rsp + 4], eax
mov eax, dword [rsp + 0x28]
cmp dword [rsp + 4], eax
jae 0x180014043
jge 0x180013fb2
push rbp
push rsp
push rsp
nop
pop rsp
pop rsp
pop rbp
jl 0x180013fb2
int1
invalid
mov eax, dword [rsp + 4]
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + rax]
mov ecx, dword [rsp]
xor ecx, eax
mov eax, ecx
and eax, 0xff
mov dword [rsp + 8], eax
je 0x180013ffb
push rdx
push rcx
pop rcx
pop rdx
jne 0x180013ffb
int1
sub ebp, dword [rbx]
xchg edx, eax
invalid
mov eax, dword [rsp]
shr eax, 8
mov ecx, dword [rsp + 8]
lea rdx, [0x18001a810]
xor eax, dword [rdx + rcx*4]
mov dword [rsp], eax
jl 0x18001403e
push rbx
push rsi
push rax
push rdx
pop rdx
pop rax
pop rsi
pop rbx
jge 0x18001403e
wait
sub al, 0xc7
xchg edx, eax
invalid
jmp 0x180013f6e
je 0x18001406f
push rbp
push rcx
push rax
pop rax
pop rcx
pop rbp
jne 0x18001406f
int1
xchg ebx, eax
sub edx, dword [rbx + 0x2c93cece]
hlt
mov eax, dword [rsp]
xor eax, 0xffffffff
mov dword [rsp], eax
jp 0x1800140a4
push rcx
push rcx
push rdx
nop
pop rdx
pop rcx
pop rcx
jnp 0x1800140a4
xchg edx, eax
test al, 0xf1
sub ebp, dword [rax - 0xe1b6d58]
test al, 0x2c
in al, 0x9b
wait
xchg ebx, eax
mov bh, 0xf3
invalid
mov rax, qword [rsp + 0x30]
mov ecx, dword [rsp]
mov dword [rax], ecx
xor eax, eax
add rsp, 0x18
ret
Function at 0x1800140c0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x24], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
jnp 0x18001413d
jp 0x18001413d
in al, 2
int1
test al, 0xf1
int1
invalid
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x180014156
mov eax, 1
jmp 0x1800143d4
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x38]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
jl 0x18001419b
push rdi
push rsp
push rsi
push rdx
pop rdx
pop rsi
pop rsp
pop rdi
jge 0x18001419b
invalid
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x1800141b2
mov eax, 1
jmp 0x1800143d4
mov dword [rsp + 0x20], 0
jmp 0x1800141c6
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 6]
cmp dword [rsp + 0x20], eax
jae 0x1800143a9
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x30]
lea rax, [rcx + rax + 0x18]
mov ecx, dword [rsp + 0x20]
imul rcx, rcx, 0x28
add rax, rcx
mov qword [rsp + 0x40], rax
jge 0x180014228
push rcx
push rsi
pop rsi
pop rcx
jl 0x180014228
in al, 0x93
invalid
mov r8d, 0x10
xor edx, edx
lea rcx, [rsp + 0x50]
call qword [0x18001ace8]
jp 0x180014267
nop
jnp 0x180014267
sub al, 0xf2
invalid
mov rax, qword [rsp + 0x40]
mov r8d, 8
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [0x18001ad78]
jne 0x1800142ac
push rdi
push rdi
push rdx
pop rdx
pop rdi
pop rdi
je 0x1800142ac
sub al, 0xf1
invalid
jg 0x1800142d8
push rbp
push rsi
push rdx
push rax
pop rax
pop rdx
pop rsi
pop rbp
jle 0x1800142d8
in al, 0xc6
add dl, byte [rdx - 0x64d40bfe]
invalid
lea rdx, [0x18001af60]
lea rcx, [rsp + 0x50]
call qword [0x18001b028]
test eax, eax
jne 0x1800143a4
mov dword [rsp + 0x24], 1
jnp 0x180014326
jp 0x180014326
xchg edx, eax
invalid
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
jns 0x18001436a
push rbx
pop rbx
js 0x18001436a
wait
xchg edx, eax
xchg edx, eax
test al, 0xf1
add al, bh
invalid
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0x10]
mov dword [rsp + 0x28], eax
jnp 0x1800143a2
push rax
push rcx
push rbp
nop
pop rbp
pop rcx
pop rax
jp 0x1800143a2
add dh, bl
hlt
jmp 0x1800143a9
jmp 0x1800141bc
cmp dword [rsp + 0x24], 0
jne 0x1800143b7
mov eax, 1
jmp 0x1800143d4
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x48]
mov qword [rax], rcx
mov rax, qword [rsp + 0x80]
mov ecx, dword [rsp + 0x28]
mov dword [rax], ecx
xor eax, eax
add rsp, 0x68
ret
Function at 0x140011208
Capabilities:
Terminate process

Disassembly:
jmp 0x140014730
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret
Function at 0x14001128f
Capabilities:
Parse pe header

Disassembly:
jmp 0x140015a80
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140015aa0
xor al, al
jmp 0x140015b21
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140015ab3
xor al, al
jmp 0x140015b21
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140015add
xor al, al
jmp 0x140015b21
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140015af1
xor al, al
jmp 0x140015b21
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140015b03
xor al, al
jmp 0x140015b21
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140015b1f
xor al, al
jmp 0x140015b21
mov al, 1
add rsp, 0x38
ret
Function at 0x140013970
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.1400113d9
movzx eax, al
test eax, eax
jne 0x140013990
mov ecx, 7
call fcn.14001132f
nop
mov byte [rsp + 0x20], 0
call fcn.140011348
mov byte [rsp + 0x21], al
cmp dword [0x14001f868], 1
jne 0x1400139b4
mov ecx, 7
call fcn.14001132f
nop
jmp 0x140013a0c
cmp dword [0x14001f868], 0
jne 0x140013a07
mov dword [0x14001f868], 1
lea rdx, [0x14001b660]
lea rcx, [0x14001b330]
call fcn.1400111a9
test eax, eax
je 0x1400139e8
mov eax, 0xff
jmp 0x140013b11
lea rdx, [0x14001b220]
lea rcx, [section..rdata]
call fcn.14001133e
mov dword [0x14001f868], 2
jmp 0x140013a0c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.14001131b
call fcn.1400112b2
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140013a69
mov rcx, qword [rsp + 0x30]
call fcn.14001115e
movzx eax, al
test eax, eax
je 0x140013a69
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140026020]
nop
call fcn.1400112e4
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x140013a9d
mov rcx, qword [rsp + 0x38]
call fcn.14001115e
movzx eax, al
test eax, eax
je 0x140013a9d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.140011393
nop
call fcn.140013bc0
mov dword [rsp + 0x28], eax
call fcn.14001128f
movzx eax, al
test eax, eax
jne 0x140013abc
mov ecx, dword [rsp + 0x28]
call fcn.14001105a
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x140013acb
call fcn.14001139d
nop
xor edx, edx
mov cl, 1
call fcn.14001114f
mov eax, dword [rsp + 0x28]
jmp 0x140013b11
add rsp, 0x68
ret
Function at 0x140028a5c
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001bef8
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001bef8
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140028bac
cmp rax, 0xffffffffffffffff
je 0x140028bac
xor edi, edi
test rbp, rbp
jle 0x140028b57
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001eb84
mov rbx, rax
test rax, rax
jne 0x140028ae4
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140028b4d
mov edx, 0x8000
mov ecx, r14d
call fcn.1400197a0
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001cbe0
cmp eax, 0xffffffff
je 0x140028b2d
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140028af4
mov edx, r15d
mov ecx, r14d
call fcn.1400197a0
jmp 0x140028b4d
cmp byte [rsi + 0x38], dil
je 0x140028b44
cmp dword [rsi + 0x34], 5
jne 0x140028b44
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140028b4d
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001a0e4
jmp 0x140028bc0
jns 0x140028bc0
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001bef8
cmp rax, 0xffffffffffffffff
jne 0x140028b78
cmp byte [rsi + 0x30], dil
je 0x140028bc0
mov edi, dword [rsi + 0x2c]
jmp 0x140028bc0
mov ecx, r14d
call fcn.1400182d0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140028bc0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140028bc0
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140028bb9
mov eax, dword [rsi + 0x2c]
jmp 0x140028bbe
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001bef8
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x140029cb0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140029cd8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140029cd8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x14006bd10
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [0x1401743c0]
test rax, rax
je 0x14006bd5a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14006bd5a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14006bd5a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14006bd5a
cmp dword [rcx + 0x84], 0xe
jbe 0x14006bd5a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14006bd5c
xor al, al
add rsp, 0x28
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140fb26e0]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x140fb26f0]
mov dword [rax], 1
mov rax, qword [0x140fb2700]
mov dword [rax], 1
mov rax, qword [0x140fb2660]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x140fb26d0]
mov dword [0x140fc500c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x140fb27b0]
mov edx, dword [rdx]
mov dword [rax], edx
call sym.__p__commode
mov rdx, qword [0x140fb2790]
mov edx, dword [rdx]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x140fb2640]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [sym._matherr]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a

Function at 0x1400025b0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
push rsi
sub rsp, 0xa0
mov rax, qword [0x1400a9008]
movzx eax, byte [rax]
cmp al, 1
jne 0x1400025d3
add rsp, 0xa0
pop rsi
jmp sym._ZN71__LT_aes..autodetect..Aes128_u20_as_u20_cipher..block..BlockDecrypt_GT_20decrypt_with_backend5inner17h51d0458cc2ced9dfE.l
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [rdx]
movaps xmmword [rsp + 0x20], xmm0
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x20]
mov rdx, rcx
mov rcx, rax
mov rsi, r8
mov r8, r9
call sym.aes::soft::fixslice::aes128_decrypt::h0a01be70208ddca1
movups xmm0, xmmword [rsp + 0x60]
movups xmmword [rsi], xmm0
add rsp, 0xa0
pop rsi
ret
Function at 0x140004d80
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, rdx
movzx edx, word [rdx]
cmp edx, 0x5a4d
jne 0x140004df8
movsxd rdx, dword [rax + 0x3c]
test rdx, rdx
je 0x140004dfe
cmp edx, 0x40
jb 0x140004e69
cmp rdx, r8
ja 0x140004e7a
lea r8, [rax + rdx]
movzx r9d, word [rax + rdx + 0x18]
cmp r9d, 0x10b
je 0x140004e04
cmp r9d, 0x20b
jne 0x140004e30
mov r9b, 2
cmp dword [r8], 0x4550
jne 0x140004e2b
movzx r10d, word [r8 + 4]
mov r9b, 3
cmp r10d, 0x8664
jne 0x140004e2b
mov r10d, 1
mov r9b, 4
test byte [r8 + 0x16], 2
je 0x140004e2b
jmp 0x140004e46
xor eax, eax
mov byte [rcx], al
jmp 0x140004e33
mov al, 1
mov byte [rcx], al
jmp 0x140004e33
mov r9b, 2
cmp dword [r8], 0x4550
jne 0x140004e2b
movzx r10d, word [r8 + 4]
mov r9b, 3
cmp r10d, 0x14c
jne 0x140004e2b
mov r9b, 4
test byte [r8 + 0x16], 2
jne 0x140004e43
mov byte [rcx], r9b
jmp 0x140004e33
mov byte [rcx], 5
mov qword [rcx + 0x18], 2
mov rax, rcx
add rsp, 0x28
ret
xor r10d, r10d
add rdx, 0xffffffffffffffc0
mov qword [rcx], rax
add rax, 0x40
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rdx
mov qword [rcx + 0x18], r10
mov qword [rcx + 0x20], r8
mov rax, rcx
add rsp, 0x28
ret
lea r8, [0x140f8be90]
mov ecx, 0x40
call sym.core::slice::index::slice_index_order_fail::hb6f495100651f9f8
lea rax, [0x140f8be90]
mov rcx, rdx
mov rdx, r8
mov r8, rax
call sym.core::slice::index::slice_end_index_len_fail::h829dac2b01cd87d1
int3
Function at 0x140004e90
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
movzx eax, word [rdx]
cmp eax, 0x5a4d
jne 0x140004f1b
movsxd rax, dword [rdx + 0x3c]
test rax, rax
je 0x140004f20
cmp eax, 0x40
jb 0x140005016
cmp rax, r8
ja 0x14000502a
lea rsi, [rdx + rax]
movzx r10d, word [rdx + rax + 0x18]
cmp r10d, 0x20b
je 0x140004f25
mov r9b, 5
cmp r10d, 0x10b
jne 0x140004f4a
mov r9b, 2
cmp dword [rsi], 0x4550
jne 0x140004f4a
movzx r10d, word [rsi + 4]
mov r9b, 3
cmp r10d, 0x14c
jne 0x140004f4a
mov r9b, 4
test byte [rsi + 0x16], 2
je 0x140004f4a
lea r9, [rax + 0xf8]
cmp r9, r8
ja 0x14000503f
xor edi, edi
jmp 0x140004f83
xor r9d, r9d
jmp 0x140004f4a
mov r9b, 1
jmp 0x140004f4a
mov r9b, 2
cmp dword [rsi], 0x4550
jne 0x140004f4a
movzx r10d, word [rsi + 4]
mov r9b, 3
cmp r10d, 0x8664
jne 0x140004f4a
mov r9b, 4
test byte [rsi + 0x16], 2
jne 0x140004f6e
mov byte [rcx], r9b
mov r8d, 2
mov eax, 0x18
mov qword [rcx + rax], r8
mov rax, rcx
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r9, [rax + 0x108]
mov edi, 1
cmp r9, r8
ja 0x14000503f
mov r11, r8
sub r11, r9
movzx ebx, word [rsi + 6]
lea r10d, [rbx*8]
lea r10, [r10 + r10*4]
mov r14, r11
sub r14, r10
jb 0x140005054
add rax, 0xffffffffffffffc0
lea r11, [rdx + 0x40]
add r9, rdx
mov r15, rdx
shr r15, 8
add r10, r9
mov ebp, ebx
shr ebp, 8
mov byte [rcx], dl
mov r12, rdx
shr r12, 0x38
mov byte [rcx + 7], r12b
mov r12, rdx
shr r12, 0x28
mov word [rcx + 5], r12w
mov dword [rcx + 1], r15d
mov qword [rcx + 8], r11
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], rdi
mov qword [rcx + 0x20], rsi
mov qword [rcx + 0x28], r9
mov byte [rcx + 0x30], bl
mov dword [rcx + 0x31], ebp
mov byte [rcx + 0x37], 0
mov word [rcx + 0x35], 0
mov qword [rcx + 0x38], r10
mov qword [rcx + 0x40], r14
mov qword [rcx + 0x48], rdx
mov eax, 0x50
jmp 0x140004f58
lea r8, [0x140f8be90]
mov ecx, 0x40
mov rdx, rax
call sym.core::slice::index::slice_index_order_fail::hb6f495100651f9f8
lea r9, [0x140f8be90]
mov rcx, rax
mov rdx, r8
mov r8, r9
call sym.core::slice::index::slice_end_index_len_fail::h829dac2b01cd87d1
lea rax, [0x140f8bf10]
mov rcx, r9
mov rdx, r8
mov r8, rax
call sym.core::slice::index::slice_start_index_len_fail::h5f4d386d5ac67311
lea r8, [0x140f8bf98]
mov rcx, r10
mov rdx, r11
call sym.core::slice::index::slice_start_index_len_fail::h5f4d386d5ac67311
int3
Function at 0x140006fb0
Capabilities:
Query or enumerate registry key

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
mov eax, 0x1060
call sym.___chkstk_ms
sub rsp, rax
mov rdi, rdx
mov rsi, rcx
mov rax, qword [rdx]
mov ebx, dword [rdx + 8]
mov r14, qword [rax]
mov dword [rsp + 0x44], 0x800
lea r15, [rsp + 0x60]
mov r8d, 0x1000
mov rcx, r15
xor edx, edx
call sub.msvcrt.dll_memset
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x20], xmm0
lea r9, [rsp + 0x44]
mov rcx, r14
mov edx, ebx
mov r8, r15
call sub.ADVAPI32.dll_RegEnumKeyExW
test eax, eax
je 0x14000702d
cmp eax, 0x103
jne 0x140007065
movabs rax, 0x8000000000000000
or rax, 1
mov qword [rsi], rax
jmp 0x140007098
mov r8d, dword [rsp + 0x44]
cmp r8, 0x801
jae 0x1400070aa
lea rcx, [rsp + 0x48]
lea rdx, [rsp + 0x60]
call sym.alloc::string::String::from_utf16::hb0a032b3375bfef6
mov rcx, qword [rsp + 0x48]
movabs rax, 0x8000000000000000
cmp rcx, rax
je 0x140007079
mov rax, qword [rsp + 0x50]
jmp 0x140007083
movabs rcx, 0x8000000000000000
shl rax, 0x20
or rax, 2
jmp 0x140007088
movabs rax, 0x900000002
mov rdx, qword [rsp + 0x58]
inc ebx
mov dword [rdi + 8], ebx
mov qword [rsi], rcx
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rdx
mov rax, rsi
add rsp, 0x1060
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rax, [0x140f8c160]
mov edx, 0x800
mov rcx, r8
mov r8, rax
call sym.core::slice::index::slice_end_index_len_fail::h829dac2b01cd87d1
int3
Function at 0x14000a9e0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 8
mov qword [rsp + 0x40], 0
lea r14, [rdx + rcx]
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x20], xmm0
add rbx, r14
je 0x14000aac6
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], rdi
mov r8d, 8
xor r14d, r14d
lea r15, [rsp + 0x30]
jmp 0x14000aa72
shl r13, 0x20
or r12, r13
shl rdi, 0x20
or rbp, rdi
sub rbp, r12
mov qword [r8 + r14*8], rbp
inc r14
mov qword [rsp + 0x40], r14
cmp rbx, r14
je 0x14000aab5
rdtsc
mov r13, rdx
mov r12, rax
xor eax, eax
xor ecx, ecx
mov r9, rbx
cpuid
xchg rbx, r9
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x24], r9d
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x2c], edx
rdtsc
mov rdi, rdx
mov rbp, rax
cmp r14, qword [rsp + 0x30]
jne 0x14000aa50
mov rcx, r15
call sym.alloc::raw_vec::RawVec_T_A_::grow_one::h3e8f7513723b2211
mov r8, qword [rsp + 0x38]
jmp 0x14000aa50
mov r15, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x50]
mov r14, qword [rsp + 0x48]
jmp 0x14000aacc
mov r15d, 8
mov eax, dword [rsp + 0x2c]
mov eax, dword [rsp + 0x28]
mov eax, dword [rsp + 0x20]
mov eax, dword [rsp + 0x24]
test rbx, rbx
je 0x14000aaeb
bsr rax, rbx
xor rax, 0x3f
jmp 0x14000aaf0
mov eax, 0x40
mov r9d, 0x40
sub r9d, eax
mov rcx, r15
mov rdx, rbx
xor r8d, r8d
call sym.core::slice::sort::recurse::h5bbfaccf7b626921
cmp r14, rdi
jb 0x14000abed
cmp r14, rbx
ja 0x14000ac01
test rsi, rsi
je 0x14000ab2a
cmp rsi, 4
jae 0x14000ab2e
xor ebx, ebx
xor eax, eax
jmp 0x14000ab83
xor ebx, ebx
jmp 0x14000ab9c
mov rax, rsi
and rax, 0xfffffffffffffffc
lea rcx, [r15 + rdi*8]
add rcx, 0x10
pxor xmm0, xmm0
xor edx, edx
pxor xmm1, xmm1
nop word [rax + rax]
movdqu xmm2, xmmword [rcx + rdx*8 - 0x10]
paddq xmm0, xmm2
movdqu xmm2, xmmword [rcx + rdx*8]
paddq xmm1, xmm2
add rdx, 4
cmp rax, rdx
jne 0x14000ab50
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rbx, xmm0
cmp rax, rsi
je 0x14000ab9c
lea rcx, [r15 + rdi*8]
nop word [rax + rax]
add rbx, qword [rcx + rax*8]
inc rax
cmp rsi, rax
jne 0x14000ab90
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x14000abb8
shl rdx, 3
mov r8d, 8
mov rcx, r15
call sym.__rust_dealloc
cmp rsi, 1
adc rsi, 0
mov rax, rbx
or rax, rsi
shr rax, 0x20
je 0x14000abd6
mov rax, rbx
xor edx, edx
div rsi
jmp 0x14000abdc
mov eax, ebx
xor edx, edx
div esi
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r8, [0x140f8c520]
mov rcx, rdi
mov rdx, r14
call sym.core::slice::index::slice_index_order_fail::hb6f495100651f9f8
jmp 0x14000ac13
lea r8, [0x140f8c520]
mov rcx, r14
mov rdx, rbx
call sym.core::slice::index::slice_end_index_len_fail::h829dac2b01cd87d1
ud2