joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140027e24
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, r8
call fcn.14001c694
test al, al
je 0x14001d1ac
mov rax, qword [rbx]
mov byte [rax], 1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x14001d061
mov edx, dword [r10 + 0x18]
test edx, edx
je 0x14001d061
mov ebx, dword [r10 + 0x20]
dec edx
mov r11d, 0x8ffb7742
lea rcx, [rbx + rdx*4]
mov r9d, dword [rcx + r8]
add r9, r8
mov cl, byte [r9]
inc r9
test cl, cl
je 0x14001d05d
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [r9]
inc r9
test cl, cl
jne 0x14001d03d
cmp r11d, 0x2a37a89a
je 0x14001d066
test edx, edx
jne 0x14001d020
mov rax, qword [rax]
jmp 0x14001cffc
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r8
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x14001d0f8
mov edx, dword [r9 + 0x18]
test edx, edx
je 0x14001d0f8
mov ebx, dword [r9 + 0x20]
dec edx
mov r11d, 0xbb16b8a6
lea rcx, [rbx + rdx*4]
mov r10d, dword [rcx + r8]
add r10, r8
mov cl, byte [r10]
inc r10
test cl, cl
je 0x14001d0f4
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [r10]
inc r10
test cl, cl
jne 0x14001d0d4
cmp r11d, 0x4250c7f0
je 0x14001d0fd
test edx, edx
jne 0x14001d0b7
mov rax, qword [rax]
jmp 0x14001d093
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x14001d18d
mov edx, dword [r9 + 0x18]
test edx, edx
je 0x14001d18d
mov edi, dword [r9 + 0x20]
dec edx
mov r11d, 0xcbb0e70a
lea rcx, [rdi + rdx*4]
mov r10d, dword [rcx + r8]
add r10, r8
mov cl, byte [r10]
inc r10
test cl, cl
je 0x14001d189
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [r10]
inc r10
test cl, cl
jne 0x14001d169
cmp r11d, 0xd9196e0e
je 0x14001d192
test edx, edx
jne 0x14001d14c
mov rax, qword [rax]
jmp 0x14001d128
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
call rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
add rcx, 8
jmp 0x14001cfc8
Function at 0x1400281f8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov eax, 1
shl rax, cl
cmp rdx, rax
jbe 0x140028237
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
mov rbp, qword [0x14003a1a8]
lea rax, [rdx - 1]
or rax, 1
mov ebx, 1
bsr rcx, rax
mov r8, rbp
inc ecx
shl rbx, cl
lea rcx, [0x14003a1b8]
lea rdx, [rbx + rbx]
call fcn.140024988
lea r8, [rbx - 1]
mov qword [0x14003a1d8], rbx
mov rbx, qword [0x14003a1a8]
mov qword [0x14003a1d0], r8
mov rbx, qword [rbx]
mov rdi, rbx
cmp rbx, rbp
je 0x1400283f1
mov rdi, qword [rdi]
lea r15, [rbx + 0x10]
cmp qword [r15 + 0x18], 0x10
mov rdx, r15
jb 0x1400282a3
mov rdx, qword [r15]
xor ecx, ecx
movabs r14, 0xcbf29ce484222325
cmp qword [r15 + 0x10], rcx
jbe 0x1400282d3
movzx eax, byte [rcx + rdx]
movabs r9, 0x100000001b3
xor r14, rax
inc rcx
imul r14, r9
cmp rcx, qword [r15 + 0x10]
jb 0x1400282b5
mov r12, qword [0x14003a1b8]
and r14, r8
add r14, r14
cmp qword [r12 + r14*8], rbp
jne 0x1400282f4
mov qword [r12 + r14*8], rbx
mov qword [r12 + r14*8 + 8], rbx
jmp 0x1400283dd
mov rsi, qword [r12 + r14*8 + 8]
lea rdx, [rsi + 0x10]
cmp qword [rdx + 0x18], 0x10
mov rax, qword [rdx + 0x10]
jb 0x14002830b
mov rdx, qword [rdx]
cmp qword [r15 + 0x18], 0x10
mov rcx, r15
jb 0x140028318
mov rcx, qword [r15]
cmp qword [r15 + 0x10], rax
jne 0x140028356
mov r8, qword [r15 + 0x10]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140028356
mov r8, qword [rsi]
cmp r8, rbx
je 0x1400282ea
mov rdx, qword [rbx + 8]
mov qword [rdx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], r8
mov rax, qword [r8 + 8]
mov qword [rax], rbx
mov qword [r8 + 8], rcx
mov qword [rdi + 8], rdx
mov qword [rbx + 8], rax
jmp 0x1400282ea
cmp qword [r12 + r14*8], rsi
je 0x1400283b8
mov rsi, qword [rsi + 8]
lea rdx, [rsi + 0x10]
cmp qword [rdx + 0x18], 0x10
mov rax, qword [rdx + 0x10]
jb 0x140028372
mov rdx, qword [rdx]
cmp qword [r15 + 0x18], 0x10
mov rcx, r15
jb 0x14002837f
mov rcx, qword [r15]
cmp qword [r15 + 0x10], rax
jne 0x140028356
mov r8, qword [r15 + 0x10]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140028356
mov r8, qword [rsi]
mov rdx, qword [rbx + 8]
mov qword [rdx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], r8
mov rax, qword [r8 + 8]
mov qword [rax], rbx
mov qword [r8 + 8], rcx
mov qword [rdi + 8], rdx
mov qword [rbx + 8], rax
jmp 0x1400283dd
mov rdx, qword [rbx + 8]
mov qword [rdx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rsi
mov rax, qword [rsi + 8]
mov qword [rax], rbx
mov qword [rsi + 8], rcx
mov qword [rdi + 8], rdx
mov qword [rbx + 8], rax
mov qword [r12 + r14*8], rbx
mov rbx, rdi
cmp rdi, rbp
je 0x1400283f1
mov r8, qword [0x14003a1d0]
jmp 0x14002828f
and qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call fcn.14002862c
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140028418
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov eax, 1
shl rax, cl
cmp rdx, rax
jbe 0x140028457
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
mov rbp, qword [0x14003a168]
lea rax, [rdx - 1]
or rax, 1
mov ebx, 1
bsr rcx, rax
mov r8, rbp
inc ecx
shl rbx, cl
lea rcx, [0x14003a178]
lea rdx, [rbx + rbx]
call fcn.140024988
lea rdx, [rbx - 1]
mov qword [0x14003a198], rbx
mov rbx, qword [0x14003a168]
mov qword [0x14003a190], rdx
mov rbx, qword [rbx]
mov rdi, rbx
cmp rbx, rbp
je 0x140028612
mov rdi, qword [rdi]
lea r15, [rbx + 0x10]
cmp qword [r15 + 0x18], 0x10
mov r8, r15
jb 0x1400284c3
mov r8, qword [r15]
xor ecx, ecx
movabs r14, 0xcbf29ce484222325
cmp qword [r15 + 0x10], rcx
jbe 0x1400284f4
movzx eax, byte [rcx + r8]
movabs r9, 0x100000001b3
xor r14, rax
inc rcx
imul r14, r9
cmp rcx, qword [r15 + 0x10]
jb 0x1400284d5
mov r12, qword [0x14003a178]
and r14, rdx
add r14, r14
cmp qword [r12 + r14*8], rbp
jne 0x140028515
mov qword [r12 + r14*8], rbx
mov qword [r12 + r14*8 + 8], rbx
jmp 0x1400285fe
mov rsi, qword [r12 + r14*8 + 8]
lea rdx, [rsi + 0x10]
cmp qword [rdx + 0x18], 0x10
mov rax, qword [rdx + 0x10]
jb 0x14002852c
mov rdx, qword [rdx]
cmp qword [r15 + 0x18], 0x10
mov rcx, r15
jb 0x140028539
mov rcx, qword [r15]
cmp qword [r15 + 0x10], rax
jne 0x140028577
mov r8, qword [r15 + 0x10]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140028577
mov r8, qword [rsi]
cmp r8, rbx
je 0x14002850b
mov rdx, qword [rbx + 8]
mov qword [rdx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], r8
mov rax, qword [r8 + 8]
mov qword [rax], rbx
mov qword [r8 + 8], rcx
mov qword [rdi + 8], rdx
mov qword [rbx + 8], rax
jmp 0x14002850b
cmp qword [r12 + r14*8], rsi
je 0x1400285d9
mov rsi, qword [rsi + 8]
lea rdx, [rsi + 0x10]
cmp qword [rdx + 0x18], 0x10
mov rax, qword [rdx + 0x10]
jb 0x140028593
mov rdx, qword [rdx]
cmp qword [r15 + 0x18], 0x10
mov rcx, r15
jb 0x1400285a0
mov rcx, qword [r15]
cmp qword [r15 + 0x10], rax
jne 0x140028577
mov r8, qword [r15 + 0x10]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140028577
mov r8, qword [rsi]
mov rdx, qword [rbx + 8]
mov qword [rdx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], r8
mov rax, qword [r8 + 8]
mov qword [rax], rbx
mov qword [r8 + 8], rcx
mov qword [rdi + 8], rdx
mov qword [rbx + 8], rax
jmp 0x1400285fe
mov rdx, qword [rbx + 8]
mov qword [rdx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rsi
mov rax, qword [rsi + 8]
mov qword [rax], rbx
mov qword [rsi + 8], rcx
mov qword [rdi + 8], rdx
mov qword [rbx + 8], rax
mov qword [r12 + r14*8], rbx
mov rbx, rdi
cmp rdi, rbp
je 0x140028612
mov rdx, qword [0x14003a190]
jmp 0x1400284af
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140028700
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rdi
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x14002875f
lea r8, [r9 + 8]
mov r11d, 0x7fffffff
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
and edx, r11d
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x14002871f
mov ecx, dword [r9]
jmp 0x14002883d
cmp ecx, 0x4e0
jb 0x14002883d
lea r10, [r9 + 0x9c4]
mov edi, 0xe3
mov eax, dword [r10]
mov r11d, 0x7fffffff
lea r8, [r10 + 4]
mov edx, dword [r8]
xor edx, eax
and edx, r11d
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 - 0x9c0], ecx
lea r10, [r8]
sub rdi, 1
jne 0x140028780
lea r10, [r9 + 0xd50]
mov edi, 0x18c
mov eax, dword [r10]
mov edx, eax
lea r8, [r10 + 4]
xor edx, dword [r8]
and edx, r11d
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd4c]
xor ecx, edx
mov dword [r10 - 0x9c0], ecx
lea r10, [r8]
sub rdi, 1
jne 0x1400287c9
mov edx, dword [r9 + 0x1380]
xor edx, dword [r9 + 4]
and edx, r11d
xor edx, dword [r9 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov rdi, qword [rsp + 8]
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
ret
Function at 0x140028880
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r15, rdx
mov qword [rsp + 0x20], rcx
mov rbp, r8
mov rdx, rcx
cmp r15, r8
je 0x140028a27
mov rax, qword [rcx + 8]
mov rsi, r15
mov r12, qword [rcx + 0x18]
lea rcx, [r15 + 0x10]
cmp qword [rcx + 0x18], 0x10
mov r14, qword [r15 + 8]
mov r10, qword [rcx + 0x10]
mov qword [rsp + 0x30], rax
jb 0x1400288d9
mov rcx, qword [rcx]
xor r8d, r8d
movabs r9, 0xcbf29ce484222325
movabs r11, 0x100000001b3
test r10, r10
je 0x140028909
movzx eax, byte [r8 + rcx]
inc r8
xor r9, rax
imul r9, r11
cmp r8, r10
jb 0x1400288f5
mov r13, qword [rdx + 0x30]
and r13, r9
add r13, r13
mov rax, qword [r12 + r13*8]
mov qword [rsp + 0x28], rax
mov rax, qword [r12 + r13*8 + 8]
mov qword [rsp + 0x38], rax
mov rbx, rsi
mov rdi, rsi
mov rsi, qword [rsi]
lea rcx, [rbx + 0x10]
call fcn.140019540
mov edx, 0x70
mov rcx, rbx
call fcn.140029564
mov r8, qword [rsp + 0x20]
dec qword [r8 + 0x10]
cmp rbx, qword [rsp + 0x38]
je 0x14002896e
cmp rsi, rbp
jne 0x140028926
cmp qword [rsp + 0x28], r15
jne 0x140028a20
mov qword [r12 + r13*8], rsi
jmp 0x140028a20
cmp qword [rsp + 0x28], r15
jne 0x140028983
mov rdx, qword [rsp + 0x30]
mov qword [r12 + r13*8], rdx
mov rax, rdx
jmp 0x140028986
mov rax, r14
mov qword [r12 + r13*8 + 8], rax
cmp rsi, rbp
je 0x140028a20
lea rcx, [rsi + 0x10]
cmp qword [rcx + 0x18], 0x10
mov r10, qword [rcx + 0x10]
jb 0x1400289a6
mov rcx, qword [rcx]
xor r9d, r9d
movabs rdx, 0xcbf29ce484222325
test r10, r10
je 0x1400289db
movabs r8, 0x100000001b3
movzx eax, byte [r9 + rcx]
inc r9
xor rdx, rax
imul rdx, r8
cmp r9, r10
jb 0x1400289c2
mov r8, qword [rsp + 0x20]
mov r15, qword [r8 + 0x30]
and r15, rdx
add r15, r15
mov r13, qword [r12 + r15*8 + 8]
mov rbx, rsi
mov rdi, rsi
mov rsi, qword [rsi]
lea rcx, [rbx + 0x10]
call fcn.140019540
mov edx, 0x70
mov rcx, rbx
call fcn.140029564
mov r8, qword [rsp + 0x20]
dec qword [r8 + 0x10]
cmp rbx, r13
je 0x140028a48
cmp rsi, rbp
jne 0x1400289ea
mov qword [r12 + r15*8], rsi
mov qword [r14], rsi
mov qword [rsi + 8], r14
lea r11, [rsp + 0x40]
mov rax, rbp
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rax, qword [rsp + 0x30]
mov qword [r12 + r15*8], rax
mov qword [r12 + r15*8 + 8], rax
jmp 0x14002898b
Function at 0x140028fc4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
cmp rdx, r8
je 0x1400291b5
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rdi, r8
mov rbx, rdx
mov rbp, rcx
lea r14, [rbx + 0x10]
mov rdx, r14
cmp qword [r14 + 0x18], 0x10
jb 0x140029003
mov rdx, qword [r14]
xor ecx, ecx
movabs r12, 0xcbf29ce484222325
cmp qword [r14 + 0x10], rcx
jbe 0x140029033
movzx eax, byte [rcx + rdx]
xor r12, rax
movabs r8, 0x100000001b3
imul r12, r8
inc rcx
cmp rcx, qword [r14 + 0x10]
jb 0x140029015
mov r9, r12
mov r8, r14
lea rdx, [rsp + 0x30]
mov rcx, rbp
call fcn.140028d04
cmp qword [rsp + 0x38], 0
jne 0x14002918c
movabs rax, 0x492492492492492
cmp qword [rbp + 0x10], rax
je 0x1400291b6
lea r13, [rbp + 8]
mov qword [rsp + 0x20], r13
and qword [rsp + 0x28], 0
mov ecx, 0x38
call fcn.140029520
mov r15, rax
mov qword [rsp + 0x28], rax
mov rdx, r14
lea rcx, [rax + 0x10]
call fcn.140023f58
nop
mov rax, qword [r14 + 0x20]
mov qword [r15 + 0x30], rax
mov r9, qword [rbp + 0x10]
lea rcx, [r9 + 1]
xorps xmm0, xmm0
test rcx, rcx
js 0x1400290b3
cvtsi2ss xmm0, rcx
jmp 0x1400290c8
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [rbp + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x1400290db
cvtsi2ss xmm1, rcx
jmp 0x1400290f0
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [rbp]
seta al
test al, al
je 0x140029128
mov rcx, rbp
call fcn.140027f00
lea r8, [r15 + 0x10]
mov r9, r12
lea rdx, [rsp + 0x40]
mov rcx, rbp
call fcn.140028d04
movups xmm0, xmmword [rax]
movdqu xmmword [rsp + 0x30], xmm0
mov r9, qword [rbp + 0x10]
and qword [rsp + 0x28], 0
mov rdx, qword [rsp + 0x30]
mov r8, qword [rdx + 8]
lea rax, [r9 + 1]
mov qword [rbp + 0x10], rax
mov qword [r15], rdx
mov qword [r15 + 8], r8
mov qword [r8], r15
mov qword [rdx + 8], r15
mov rcx, qword [rbp + 0x18]
mov rax, qword [rbp + 0x30]
and rax, r12
add rax, rax
mov r9, qword [rcx + rax*8]
cmp r9, qword [r13]
jne 0x14002916b
mov qword [rcx + rax*8], r15
jmp 0x14002917d
cmp r9, rdx
jne 0x140029176
mov qword [rcx + rax*8], r15
jmp 0x140029182
cmp qword [rcx + rax*8 + 8], r8
jne 0x140029182
mov qword [rcx + rax*8 + 8], r15
lea rcx, [rsp + 0x20]
call fcn.140027e7c
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x140028ff2
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rcx, str.unordered_map_set_too_long
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
Function at 0x140001154
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x10], 0
mov dword [rbp - 0x1c], 0x30
mov eax, dword [rbp - 0x1c]
mov rax, qword gs:[rax]
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
mov rax, qword [rax + 8]
mov qword [rbp - 0x18], rax
mov dword [rbp - 4], 0
jmp 0x1400011ac
mov rax, qword [rbp - 0x10]
cmp rax, qword [rbp - 0x18]
jne 0x14000119e
mov dword [rbp - 4], 1
jmp 0x1400011e3
mov ecx, 0x3e8
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov rax, qword [0x140044490]
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x40], 0
mov rcx, qword [rbp - 0x38]
mov rax, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x30]
lock cmpxchg qword [rdx], rcx
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x14000118b
mov rax, qword [0x1400444a0]
mov eax, dword [rax]
cmp eax, 1
jne 0x1400011fd
mov ecx, 0x1f
call fcn.140023d60
jmp 0x14000123c
mov rax, qword [0x1400444a0]
mov eax, dword [rax]
test eax, eax
jne 0x140001232
mov rax, qword [0x1400444a0]
mov dword [rax], 1
mov rax, qword [0x1400444e0]
mov rdx, rax
mov rax, qword [0x1400444d0]
mov rcx, rax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
jmp 0x14000123c
mov dword [0x140048024], 1
mov rax, qword [0x1400444a0]
mov eax, dword [rax]
cmp eax, 1
jne 0x140001270
mov rax, qword [0x1400444c0]
mov rdx, rax
mov rax, qword [0x1400444b0]
mov rcx, rax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
mov rax, qword [0x1400444a0]
mov dword [rax], 2
cmp dword [rbp - 4], 0
jne 0x140001294
mov rax, qword [0x140044490]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], 0
mov rdx, qword [rbp - 0x50]
mov rax, qword [rbp - 0x48]
xchg qword [rax], rdx
mov rax, qword [0x1400443e0]
mov rax, qword [rax]
test rax, rax
je 0x1400012bf
mov rax, qword [0x1400443e0]
mov rax, qword [rax]
mov r8d, 0
mov edx, 2
mov ecx, 0
call rax
call fcn.140022fe8
mov rax, qword [0x140044520]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call rax
mov rdx, qword [0x140044480]
mov qword [rdx], rax
lea rax, section..text
mov rcx, rax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__set_invalid_parameter_handler
call fcn.1400227e0
mov eax, dword [0x140048004]
lea rdx, [0x140048008]
mov ecx, eax
call fcn.14000147c
call fcn.140022577
mov rax, qword [0x140044410]
mov rax, qword [rax]
mov rdx, qword [0x140048010]
mov qword [rax], rdx
mov rcx, qword [0x140048010]
mov rdx, qword [0x140048008]
mov eax, dword [0x140048004]
mov r8, rcx
mov ecx, eax
call fcn.1400016d0
mov dword [0x14004801c], eax
mov eax, dword [0x140048020]
test eax, eax
jne 0x14000135d
mov eax, dword [0x14004801c]
mov ecx, eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
mov eax, dword [0x140048024]
test eax, eax
jne 0x14000136c
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
mov eax, dword [0x14004801c]
add rsp, 0x70
pop rbp
ret
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x140044440]
mov dword [rax], 1
mov rax, qword [0x140044450]
mov dword [rax], 1
mov rax, qword [0x140044460]
mov dword [rax], 1
mov rax, qword [0x140044400]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x1400227f0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.140023b50
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x1400234c2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x140048168]
test eax, eax
je 0x14002355a
lea rax, [0x140048140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x140048170]
mov qword [rbp - 8], rax
jmp 0x14002353e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x140023532
cmp qword [rbp - 0x10], 0
je 0x140023532
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x1400234f8
lea rax, [0x140048140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x14002355b
nop
add rsp, 0x30
pop rbp
ret
Function at 0x140023660
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x140023688
mov eax, 0
jmp 0x1400236d6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400236b1
mov eax, 0
jmp 0x1400236d6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x1400236d1
mov eax, 0
jmp 0x1400236d6
mov eax, 1
add rsp, 0x20
pop rbp
ret

Function at 0x1400236dc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x14002375a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x140023751
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x140023751
mov rax, qword [rbp - 8]
jmp 0x14002376f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x140023724
mov eax, 0
add rsp, 0x20
pop rbp
ret