joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140047560
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x40
call fcn.1400c4950
sub rsp, rax
mov rbx, rcx
mov ecx, dword [rcx + 0x60]
test cl, 0x20
jne 0x14004763d
mov rax, qword [rbx + 0x78]
cmp dword [rax + 8], 0
je 0x14004763d
test cl, 0x10
je 0x1400475af
mov r8, rdx
mov rcx, rbx
mov edx, 1
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
jmp fcn.14004f410
xor edi, edi
mov qword [rsp + 0x28], rdx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x20], edi
mov byte [rsp + 0x24], 0
call fcn.14004c380
mov ecx, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov r8d, dword [rbx + 0x44]
mov edx, 0xffffffff
test al, al
cmove ecx, edx
mov edx, dword [rbx + 0x40]
mov dword [rsp + 0x20], ecx
mov rcx, rbx
call fcn.14004ec00
test eax, eax
je 0x14004763d
mov rcx, qword [rbx + 0x78]
movsxd rdx, eax
mov r8, rdx
movzx edx, dx
sar r8, 0x10
mov rcx, qword [rcx]
shl rdx, 5
mov rcx, qword [rcx + r8*8]
mov edx, dword [rcx + rdx + 0x10]
mov dword [rbx + 0x44], eax
mov al, 1
mov dword [rbx + 0x40], edx
mov dword [rbx + 0x48], edi
mov qword [rbx + 0x58], rdi
mov dword [rbx + 0x54], 1
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov rbx, qword [rsp + 0x50]
xor al, al
add rsp, 0x40
pop rdi
ret
Function at 0x14007bb00
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x140276168]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdi, rdx
mov rsi, rcx
lea rcx, [rsp + 0x30]
call fcn.140017b80
nop
mov rdx, rdi
lea rcx, [rsp + 0x38]
call fcn.1400177f0
nop
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.14001a9d0
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140017c80
nop
lea rcx, [rsp + 0x20]
call fcn.140017c30
lea rcx, [rsp + 0x30]
call fcn.140019d20
mov rax, qword [rsi]
lea rdx, [rsp + 0x28]
mov rcx, rsi
call qword [rax + 0x170]
nop
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.14001af80
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140017fb0
nop
lea rcx, [rsp + 0x20]
call fcn.140017c30
nop
lea rcx, [rsp + 0x28]
call fcn.140017c30
lea rcx, [rsp + 0x30]
call fcn.1400181c0
test al, al
je 0x14007bbf1
lea rcx, [rsp + 0x30]
call fcn.140017e00
mov rbx, rax
mov rcx, rdi
call fcn.140017e00
mov rdx, rbx
mov rcx, rax
call fcn.1400e0e3c
test eax, eax
je 0x14007bbf1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.140017ce0
lea rcx, [rsp + 0x38]
call fcn.140017e00
mov r9, rax
mov edx, 0x1cd
mov r8d, 3
lea rcx, [rsp + 0x40]
call fcn.1401c48b0
nop
lea r8, [rsp + 0x40]
mov edx, 0x28
mov rcx, rsi
call fcn.140066dc0
nop
lea rcx, [rsp + 0x40]
call fcn.1401c4b30
nop
lea rcx, [rsp + 0x38]
call fcn.140017c30
nop
lea rcx, [rsp + 0x30]
call fcn.140017c30
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400c3d30
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x14009a370
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov ebp, r8d
mov r14, rdx
mov rdi, rcx
mov rbx, qword [rcx + 0x58]
test rbx, rbx
jne 0x14009a409
lea ecx, [rbx + 0x40]
call fcn.1400c4008
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14009a3b3
mov rcx, rax
call fcn.1400b6f90
mov rbx, rax
jmp 0x14009a3b5
xor ebx, ebx
test rbx, rbx
je 0x14009a3d9
cmp rbx, qword [rdi + 0x58]
jne 0x14009a3d9
mov r8d, 0x5d
lea rdx, str.C:Boost_1_67_0_boost_smart_ptr_scoped_ptr.hpp
lea rcx, str.p__0__p___px
call fcn.1400de9e0
mov rsi, qword [rdi + 0x58]
mov qword [rdi + 0x58], rbx
test rsi, rsi
je 0x14009a409
mov rcx, qword [rsi + 0x38]
call fcn.1400c3d50
mov rcx, qword [rsi + 0x30]
call fcn.1400c3d50
mov edx, 0x40
mov rcx, rsi
call fcn.1400c3d50
mov rbx, qword [rdi + 0x58]
test rbx, rbx
jne 0x14009a426
lea r8d, [rbx + 0x69]
lea rdx, str.C:Boost_1_67_0_boost_smart_ptr_scoped_ptr.hpp
lea rcx, str.px___0
call fcn.1400de9e0
nop
mov r8d, ebp
mov rdx, r14
mov rcx, qword [rdi + 0x58]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
jmp fcn.1400b7250
Function at 0x1400a4780
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xc0
mov rax, qword [0x140276168]
xor rax, rsp
mov qword [rsp + 0xb8], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
xor r8d, r8d
lea rdx, [rcx + 0x70]
lea rcx, [rsp + 0x88]
call fcn.140018e80
nop
lea rdx, [rdi + 0x70]
lea rcx, [rsp + 0x80]
call fcn.1400177f0
nop
mov rcx, rsi
call fcn.1400181c0
test al, al
je 0x1400a481f
xor r8d, r8d
mov rdx, rsi
lea rcx, [rsp + 0x38]
call fcn.140018e80
nop
mov rdx, rax
lea rcx, [rsp + 0x88]
call fcn.1400194a0
nop
lea rcx, [rsp + 0x38]
call fcn.140019400
mov rdx, rsi
lea rcx, [rsp + 0x80]
call fcn.140017ce0
nop
lea rcx, [rsp + 0xb0]
call fcn.1400181f0
test al, al
jne 0x1400a4842
mov edx, 0x471
lea rcx, str.WzSpanOut.c
call fcn.140015ac0
nop
jmp 0x1400a4849
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x70]
call fcn.1400177f0
nop
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x30]
call fcn.1400177f0
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x78]
call fcn.1400191f0
nop
lea rcx, [rsp + 0x30]
call fcn.140017c30
lea rcx, [rsp + 0x68]
call fcn.140017b80
nop
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x78]
call fcn.14001a680
movzx ebx, al
lea rcx, [rsp + 0x68]
call fcn.14001b590
test al, al
je 0x1400a48d5
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x70]
call fcn.140017fb0
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x78]
call fcn.14001a680
movzx ebx, al
test bl, bl
je 0x1400a4930
nop dword [rax]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x70]
call fcn.140017fb0
lea rcx, [rsp + 0x70]
call fcn.1400aa340
test al, al
jne 0x1400a4913
lea rcx, [rsp + 0x70]
call fcn.140017e00
mov rcx, rax
call fcn.1400e2868
test eax, eax
jne 0x1400a4967
lea rcx, [rsp + 0x70]
call fcn.140019d20
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x78]
call fcn.14001a680
test al, al
jne 0x1400a48e0
lea rdx, [rsp + 0x80]
lea rcx, [rdi + 0x10]
call fcn.1401c9020
mov dword [rsp + 0x20], 0x80
mov r9d, 2
xor r8d, r8d
mov edx, 0x40000000
lea rcx, [rdi + 0x10]
call fcn.1401c9370
cmp qword [rdi + 0x10], 0xffffffffffffffff
jne 0x1400a49a7
lea rcx, [rsp + 0x68]
call fcn.140017c30
nop
lea rcx, [rsp + 0x78]
call fcn.140011780
nop
lea rcx, [rsp + 0x70]
call fcn.140017c30
nop
lea rcx, [rsp + 0x80]
call fcn.140017c30
nop
lea rcx, [rsp + 0x88]
call fcn.140019400
xor al, al
jmp 0x1400a49f0
mov qword [rdi + 0xc0], 0
lea rcx, [rsp + 0x68]
call fcn.140017c30
nop
lea rcx, [rsp + 0x78]
call fcn.140011780
nop
lea rcx, [rsp + 0x70]
call fcn.140017c30
nop
lea rcx, [rsp + 0x80]
call fcn.140017c30
nop
lea rcx, [rsp + 0x88]
call fcn.140019400
mov al, 1
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.1400c3d30
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400ac630
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xb0
mov rax, qword [0x140276168]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rdi, rdx
mov rbx, rcx
mov dword [rbp - 0x41], 0
xor r8d, r8d
lea rcx, [rbp + 0xf]
call fcn.140018e80
nop
lea rcx, [rbp + 0x37]
call fcn.1400181f0
test al, al
je 0x1400ac80e
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 0xf]
call fcn.14001b0f0
mov rsi, rax
lea rdx, str.CORRUPT.
lea rcx, [rbp - 0x19]
call fcn.140017a90
mov r14, rax
lea rdx, [rbp + 0xf]
lea rcx, [rbp - 0x49]
call fcn.1400177f0
mov dword [rbp - 0x41], 1
lea rcx, [rbp + 0x17]
call fcn.1400181c0
test al, al
je 0x1400ac6dd
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 0x49]
call fcn.140017fb0
lea rcx, [rbp - 0x49]
call fcn.140019d20
mov r8, r14
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 0x29]
call fcn.140017e10
nop
mov r8, rsi
mov rdx, rax
lea rcx, [rbp - 9]
call fcn.140017e10
nop
lea rcx, [rbp - 0x29]
call fcn.140017c30
nop
lea rcx, [rbp - 0x49]
call fcn.140017c30
nop
lea rcx, [rbp - 0x19]
call fcn.140017c30
nop
lea rcx, [rbp - 0x39]
call fcn.140017c30
mov rcx, rdi
call fcn.140017e00
mov r9, rax
mov edx, 0x15f
mov r8d, 3
lea rcx, [rbp - 1]
call fcn.1401c48b0
nop
lea rcx, [rbp - 9]
call fcn.140017e00
mov rdx, rax
lea rcx, [rbp - 1]
call fcn.1401c5110
mov rsi, qword [rbx + 0x58]
mov byte [rbp - 0x39], 0
mov qword [rbp - 0x31], rsi
lea rdx, [rsi + 0x40]
mov rcx, rsi
call fcn.140081f00
test al, al
jne 0x1400ac85a
mov rcx, rsi
call fcn.1400ac1a0
test al, al
je 0x1400ac83b
mov byte [rbp - 0x39], 1
mov r9d, 0x14
lea r8, [0x140296f18]
lea rdx, [rbp - 1]
mov rcx, qword [rbx + 8]
call fcn.140066880
cmp eax, 7
jne 0x1400ac7bf
mov rcx, rdi
call fcn.140017e00
mov rcx, rax
call fcn.1400e0e0c
jmp 0x1400ac7f0
lea rcx, [rbp - 9]
call fcn.140017e00
mov rcx, rax
call fcn.1400e0e0c
lea rcx, [rbp - 9]
call fcn.140017e00
mov rbx, rax
mov rcx, rdi
call fcn.140017e00
mov rdx, rbx
mov rcx, rax
call fcn.1400e0e3c
nop
lea rcx, [rbp - 0x39]
call fcn.1400abce0
nop
lea rcx, [rbp - 1]
call fcn.1401c4b30
nop
lea rcx, [rbp - 9]
call fcn.140017c30
nop
lea rcx, [rbp + 0xf]
call fcn.140019400
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.1400c3d30
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
mov edx, 8
lea rcx, [rbp - 0x29]
call fcn.140028790
lea rdx, [0x140270368]
lea rcx, [rbp - 0x29]
call fcn.1400c74cc
int3
mov edx, 8
lea rcx, [rbp - 0x19]
call fcn.140028790
lea rdx, [0x140270368]
lea rcx, [rbp - 0x19]
call fcn.1400c74cc
int3
Function at 0x1400b6890
Capabilities:
Enumerate pe sections

Disassembly:
mov r9, rcx
cmp r8d, 0x2a
jge 0x1400b689c
xor eax, eax
ret
movzx ecx, byte [rdx + 1]
shl cx, 8
movzx eax, byte [rdx]
or cx, ax
mov word [r9 + 0x10], cx
movzx ecx, byte [rdx + 3]
shl cx, 8
movzx eax, byte [rdx + 2]
or cx, ax
mov word [r9 + 0x12], cx
movzx ecx, byte [rdx + 5]
movzx eax, byte [rdx + 4]
shl cx, 8
or cx, ax
mov word [r9 + 0x14], cx
movzx ecx, byte [rdx + 7]
movzx eax, byte [rdx + 6]
shl cx, 8
or cx, ax
mov word [r9 + 0x16], cx
movzx ecx, byte [rdx + 9]
movzx eax, byte [rdx + 8]
shl cx, 8
or cx, ax
mov word [r9 + 0x18], cx
movzx ecx, byte [rdx + 0xb]
movzx eax, byte [rdx + 0xa]
shl cx, 8
or cx, ax
mov word [r9 + 0x1a], cx
movzx eax, byte [rdx + 0xe]
movzx ecx, byte [rdx + 0xf]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xd]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xc]
shl ecx, 8
or ecx, eax
mov dword [r9 + 0x1c], ecx
movzx eax, byte [rdx + 0x12]
movzx ecx, byte [rdx + 0x13]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x11]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x10]
shl ecx, 8
or ecx, eax
mov dword [r9 + 0x20], ecx
movzx eax, byte [rdx + 0x16]
movzx ecx, byte [rdx + 0x17]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x15]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x14]
shl ecx, 8
or ecx, eax
mov dword [r9 + 0x24], ecx
movzx ecx, byte [rdx + 0x19]
movzx eax, byte [rdx + 0x18]
shl cx, 8
or cx, ax
mov word [r9 + 0x28], cx
movzx ecx, byte [rdx + 0x1b]
movzx eax, byte [rdx + 0x1a]
shl cx, 8
or cx, ax
mov word [r9 + 0x2a], cx
movzx ecx, byte [rdx + 0x1d]
movzx eax, byte [rdx + 0x1c]
shl cx, 8
or cx, ax
mov word [r9 + 0x2c], cx
movzx ecx, byte [rdx + 0x1f]
movzx eax, byte [rdx + 0x1e]
shl cx, 8
or cx, ax
mov word [r9 + 0x2e], cx
movzx ecx, byte [rdx + 0x21]
movzx eax, byte [rdx + 0x20]
shl cx, 8
or cx, ax
mov word [r9 + 0x30], cx
movzx eax, byte [rdx + 0x24]
movzx ecx, byte [rdx + 0x25]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x23]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x22]
shl ecx, 8
or ecx, eax
mov dword [r9 + 0x34], ecx
movzx eax, byte [rdx + 0x28]
movzx ecx, byte [rdx + 0x29]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x27]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x26]
shl ecx, 8
or ecx, eax
mov eax, 0x2a
mov dword [r9 + 0x38], ecx
ret
Function at 0x1400b7250
Capabilities:
Enumerate pe sections

Disassembly:
mov r9, rcx
cmp r8d, 0x1a
jge 0x1400b725c
xor eax, eax
ret
movzx ecx, byte [rdx + 1]
movzx eax, byte [rdx]
shl cx, 8
or cx, ax
mov word [r9 + 0x10], cx
movzx ecx, byte [rdx + 3]
movzx eax, byte [rdx + 2]
shl cx, 8
or cx, ax
mov word [r9 + 0x12], cx
movzx ecx, byte [rdx + 5]
movzx eax, byte [rdx + 4]
shl cx, 8
or cx, ax
mov word [r9 + 0x14], cx
movzx ecx, byte [rdx + 7]
movzx eax, byte [rdx + 6]
shl cx, 8
or cx, ax
mov word [r9 + 0x16], cx
movzx ecx, byte [rdx + 9]
movzx eax, byte [rdx + 8]
shl cx, 8
or cx, ax
mov word [r9 + 0x18], cx
movzx eax, byte [rdx + 0xc]
movzx ecx, byte [rdx + 0xd]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xa]
shl ecx, 8
or ecx, eax
mov dword [r9 + 0x1c], ecx
movzx eax, byte [rdx + 0x10]
movzx ecx, byte [rdx + 0x11]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xf]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xe]
shl ecx, 8
or ecx, eax
mov dword [r9 + 0x20], ecx
movzx eax, byte [rdx + 0x14]
movzx ecx, byte [rdx + 0x15]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x13]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x12]
shl ecx, 8
or ecx, eax
mov dword [r9 + 0x24], ecx
movzx ecx, byte [rdx + 0x17]
movzx eax, byte [rdx + 0x16]
shl cx, 8
or cx, ax
mov word [r9 + 0x28], cx
movzx eax, byte [rdx + 0x18]
movzx ecx, byte [rdx + 0x19]
shl cx, 8
or cx, ax
mov eax, 0x1a
mov word [r9 + 0x2a], cx
ret

Function at 0x1400c11e8
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x1400c1216
xor eax, eax
jmp 0x1400c12fc
cmp qword [rcx + 0x68], 0
je 0x1400c1227
call fcn.1400093f0
jmp 0x1400c12fc
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x1400c123e
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400c1240
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400c1272
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.1400c7640
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x1400c12f6
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x1400c12a9
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x1400c12d2
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.1400e155c
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x1400c12f6
cmp rsi, rbx
ja 0x1400c12b0
test rsi, rsi
je 0x1400c12f6
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.1400e155c
sub rsi, rax
sub rbp, rsi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1400c4ee0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [case.0x1400c272e.20]
test rax, rax
je 0x1400c4f2a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400c4f2a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400c4f2a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400c4f2a
cmp dword [rcx + 0x84], 0xe
jbe 0x1400c4f2a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400c4f2c
xor al, al
add rsp, 0x28
ret

Function at 0x1400dccc0
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1400dcb2b
xor ecx, ecx
call qword [case.0x1400c272e.20]
test rax, rax
je 0x1400dcb2b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400dcb2b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400dcb2b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400dcb2b
cmp dword [rcx + 0x84], 0xe
jbe 0x1400dcb2b
cmp dword [rcx + 0xf8], 0
je 0x1400dcb2b
mov ecx, ebx
call fcn.1400dcbdc
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1400dc9b8
nop
cmp dword [rbp + 0x20], 0
je 0x1400dcb79
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400dcb84
int3
xor r8d, r8d
xor edx, edx
jmp 0x1400dcabc
Function at 0x1400fe740
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x140276168]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x30], rcx
lea rax, [rcx + 0x128]
mov qword [rsp + 0x28], rax
cmp qword [rax], 0
jne 0x1400fe793
mov edx, 0xa6
lea rcx, str...LinkNodesWzStdEncrypt.c
call fcn.140015ac0
nop
jmp 0x1400fe79a
cmp qword [rbx + 0x158], 0
jne 0x1400fe7b6
mov edx, 0xa7
lea rcx, str...LinkNodesWzStdEncrypt.c
call fcn.140015ac0
nop
jmp 0x1400fe7bd
mov rdx, qword [rsp + 0x28]
mov rdx, qword [rdx]
lea rcx, [rbx + 0x140]
call fcn.140123200
nop
mov r15, qword [rsp + 0x30]
nop word [rax + rax]
xor r9d, r9d
mov r8d, 0x7fffffff
lea rdx, [rsp + 0x30]
lea rcx, [rbx + 0x140]
call fcn.140123030
mov rdi, rax
test rax, rax
je 0x1400fe8da
xor esi, esi
nop dword [rax + rax]
movzx r11d, word [rbx + 0x174]
movzx ecx, r11w
or cx, 2
movzx eax, cx
xor ax, 1
movzx ecx, cx
movzx edx, ax
imul edx, ecx
movzx r10d, dx
shr r10d, 8
mov r9, qword [rsp + 0x30]
mov r8, qword [rbx + 0x160]
movzx ecx, byte [r9 + rsi]
movzx eax, byte [rbx + 0x16c]
xor rcx, rax
mov eax, dword [rbx + 0x16c]
shr eax, 8
xor eax, dword [r8 + rcx*4]
mov dword [rbx + 0x16c], eax
movzx eax, al
add eax, dword [rbx + 0x170]
imul edx, eax, 0x8088405
inc edx
mov dword [rbx + 0x170], edx
shr rdx, 0x18
movzx eax, r11b
xor rdx, rax
mov eax, dword [rbx + 0x174]
shr eax, 8
xor eax, dword [r8 + rdx*4]
mov dword [rbx + 0x174], eax
xor byte [r9 + rsi], r10b
inc rsi
cmp rsi, rdi
jb 0x1400fe810
mov rdx, rdi
lea rcx, [rbx + 0x140]
call fcn.140123100
mov rcx, rbx
call fcn.140126740
lea rcx, [r15 + 0x130]
call fcn.140122e30
add qword [rbx + 0x150], rdi
jmp 0x1400fe7e0
lea rcx, [r15 + 0x130]
call fcn.140122e00
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400c3d30
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x1400fe970
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rax, qword [0x140276168]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rsi, rdx
mov rdi, rcx
test rdx, rdx
je 0x1400feb49
cmp r8d, 0xc
jb 0x1400feb49
mov qword [rsp + 0x70], rbx
xor ebx, ebx
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x40], r14
mov rcx, qword [rdi + 0x158]
call fcn.140123750
sar eax, 0x16
mov byte [rsp + rbx + 0x20], al
inc rbx
cmp rbx, 0xb
jl 0x1400fe9b0
lea rbx, [rsp + 0x20]
mov r14, rsi
sub rbx, rsi
mov ebp, 0xb
nop dword [rax]
movzx eax, byte [rdi + 0x16c]
movzx r8d, word [rdi + 0x174]
movzx r11d, byte [rbx + r14]
lea r14, [r14 + 1]
mov r9, qword [rdi + 0x160]
mov ecx, r11d
xor rcx, rax
movzx r10d, r8w
mov eax, dword [rdi + 0x16c]
or r10w, 2
shr eax, 8
xor eax, dword [r9 + rcx*4]
mov dword [rdi + 0x16c], eax
movzx eax, al
add eax, dword [rdi + 0x170]
imul edx, eax, 0x8088405
movzx eax, r8b
movzx ecx, r10w
inc edx
mov dword [rdi + 0x170], edx
shr rdx, 0x18
xor rdx, rax
mov eax, dword [rdi + 0x174]
shr eax, 8
xor eax, dword [r9 + rdx*4]
mov dword [rdi + 0x174], eax
movzx eax, r10w
xor ax, 1
movzx edx, ax
imul edx, ecx
shr dx, 8
xor dl, r11b
mov byte [r14 - 1], dl
sub rbp, 1
jne 0x1400fe9e0
mov ecx, dword [rdi + 0x16c]
movzx r8d, word [rdi + 0x174]
movzx r11d, byte [rdi + 0x16b]
movzx r10d, r8w
movzx eax, byte [rdi + 0x16c]
or r10w, 2
mov r9, qword [rdi + 0x160]
xor rax, r11
shr ecx, 8
xor ecx, dword [r9 + rax*4]
movzx eax, cl
add eax, dword [rdi + 0x170]
imul edx, eax, 0x8088405
mov dword [rdi + 0x16c], ecx
movzx eax, r8b
movzx ecx, r10w
inc edx
mov dword [rdi + 0x170], edx
shr rdx, 0x18
xor rdx, rax
mov eax, dword [rdi + 0x174]
shr eax, 8
xor eax, dword [r9 + rdx*4]
mov dword [rdi + 0x174], eax
movzx eax, r10w
xor ax, 1
movzx edx, ax
imul edx, ecx
shr dx, 8
xor dl, r11b
mov byte [rsi + 0xb], dl
mov rcx, qword [rdi + 0x158]
call fcn.140123640
mov rcx, qword [rdi + 0x158]
call fcn.140123750
mov rcx, qword [rdi + 0x158]
and eax, 0xfffffff
mov edx, eax
call fcn.140124660
mov r14, qword [rsp + 0x40]
mov al, 1
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
jmp 0x1400feb4b
xor al, al
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400c3d30
add rsp, 0x48
pop rdi
pop rsi
ret
Function at 0x1400fec00
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x18], r8d
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x140276168]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdx
mov rcx, rdx
call fcn.1400181c0
test al, al
jne 0x1400fec52
mov edx, 0x5b
lea rcx, str...LinkNodesWzStdEncrypt.c
call fcn.140015ac0
nop
jmp 0x1400fec65
mov rcx, rbx
call fcn.140126710
mov dword [rbx + 0x168], esi
mov dword [rbx + 0x16c], 0x12345678
mov dword [rbx + 0x170], 0x23456789
mov dword [rbx + 0x174], 0x34567890
lea rcx, [rsp + 0x30]
call fcn.140016d10
nop
xor esi, esi
mov rcx, rdi
call fcn.140018090
test rax, rax
je 0x1400fed3a
mov r14d, esi
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140018080
movzx ecx, byte [rax + r14]
mov r8, qword [rbx + 0x160]
movzx eax, byte [rbx + 0x16c]
xor rcx, rax
mov eax, dword [rbx + 0x16c]
shr eax, 8
xor eax, dword [r8 + rcx*4]
mov dword [rbx + 0x16c], eax
movzx eax, al
add eax, dword [rbx + 0x170]
imul edx, eax, 0x8088405
inc edx
mov dword [rbx + 0x170], edx
shr rdx, 0x18
movzx eax, byte [rbx + 0x174]
xor rdx, rax
mov eax, dword [rbx + 0x174]
shr eax, 8
xor eax, dword [r8 + rdx*4]
mov dword [rbx + 0x174], eax
inc esi
lea r14, [r14 + 1]
mov rcx, rdi
call fcn.140018090
movsxd rcx, esi
cmp rcx, rax
jb 0x1400fecb2
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1400174a0
nop
lea rcx, [rsp + 0x30]
call fcn.140016ee0
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400c3d30
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop r14
pop rdi
pop rsi
ret