joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003dc70
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x340
mov rax, qword [0x1400ada20]
xor rax, rsp
mov qword [rsp + 0x330], rax
mov r15, rcx
mov ebp, r8d
mov rcx, qword [rcx + 0x5d158]
mov r12, rdx
xor edi, edi
xor esi, esi
mov rax, qword [rcx]
call qword [rax + 0x20]
add ebp, 3
mov r14, rax
movsxd r13, ebp
and r13, 0xfffffffffffffffc
jle 0x14003dd0a
xor ebx, ebx
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [r15 + 0x5d158]
mov rdx, qword [rcx]
call qword [rdx + 0x30]
movzx ecx, al
movzx eax, cl
and al, 0xf
mov byte [rsp + rbx + 0x30], al
cmp al, 0xc
ja 0x14003de03
shr ecx, 4
mov byte [rsp + rbx + 0x31], cl
cmp cl, 0xc
ja 0x14003de03
add rbx, 2
cmp rbx, r13
jl 0x14003dcd0
test bpl, 4
je 0x14003dd3b
mov rcx, qword [r15 + 0x5d158]
mov rax, qword [rcx]
call qword [rax + 0x30]
mov rcx, qword [r15 + 0x5d158]
shl eax, 8
movsxd rdi, eax
mov rax, qword [rcx]
call qword [rax + 0x30]
movsxd rcx, eax
mov esi, 0x10
add rdi, rcx
test r13, r13
jle 0x14003ddd6
xor r14d, r14d
nop word [rax + rax]
movzx ebp, byte [rsp + r14 + 0x30]
cmp esi, ebp
jge 0x14003dd88
xor ebx, ebx
nop dword [rax]
mov rcx, qword [r15 + 0x5d158]
mov rax, qword [rcx]
call qword [rax + 0x30]
mov ecx, ebx
movsxd rdx, eax
xor ecx, 8
add ebx, 8
add ecx, esi
shl rdx, cl
add rdi, rdx
cmp ebx, 0x20
jl 0x14003dd60
add esi, 0x20
mov ecx, 0x10
mov r8d, 0xffff
sub ecx, ebp
sub esi, ebp
sar r8d, cl
mov ecx, ebp
and r8d, edi
sar rdi, cl
test ebp, ebp
je 0x14003ddc5
lea ecx, [rbp - 1]
movzx eax, cl
bt r8d, eax
jb 0x14003ddc5
mov ecx, ebp
mov edx, 1
shl edx, cl
mov eax, 1
sub eax, edx
add r8d, eax
mov word [r12 + r14*2], r8w
inc r14
cmp r14, r13
jl 0x14003dd50
xor eax, eax
mov rcx, qword [rsp + 0x330]
xor rcx, rsp
call fcn.14007c510
mov rbx, qword [rsp + 0x390]
add rsp, 0x340
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [r15 + 0x5d158]
xor r8d, r8d
movsxd rdx, r14d
mov rax, qword [rcx]
call qword [rax + 0x18]
dec r13
lea rdi, [r12 + 4]
shr r13, 3
mov ebp, 0xffffff00
inc r13
mov esi, 0xfff
nop
mov r8d, 6
lea rdx, [rsp + 0x20]
mov rcx, r15
call sym.EURawImg.exe_protected:_void___cdecl_LibRaw::read_shorts_unsigned_short_int____ptr64__unsigned_int____ptr64
movzx r10d, word [rsp + 0x20]
lea rdi, [rdi + 0x10]
movzx r11d, word [rsp + 0x24]
movzx ecx, r10w
movzx ebx, word [rsp + 0x28]
movzx eax, r11w
movzx edx, word [rsp + 0x22]
and r10w, si
movzx r8d, word [rsp + 0x26]
and r11w, si
movzx r9d, word [rsp + 0x2a]
shr cx, 4
shr ax, 8
and cx, bp
and ax, 0xfff0
or cx, ax
movzx eax, bx
shr ax, 0xc
and bx, si
or cx, ax
movzx eax, r8w
mov word [rdi - 0x14], cx
and r8w, si
shr ax, 8
movzx ecx, dx
shr cx, 4
and ax, 0xfff0
and cx, bp
and dx, si
or cx, ax
movzx eax, r9w
shr ax, 0xc
and r9w, si
or cx, ax
mov word [rdi - 0x12], cx
mov word [rdi - 0x10], r10w
mov word [rdi - 0xe], dx
mov word [rdi - 0xc], r11w
mov word [rdi - 0xa], r8w
mov word [rdi - 8], bx
mov word [rdi - 6], r9w
sub r13, 1
jne 0x14003de30
lea eax, [r13 + 1]
jmp 0x14003ddd8
Function at 0x14003f820
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov rax, rdx
mov rbx, rcx
test rdx, rdx
jne 0x14003f851
lea eax, [rdx + 2]
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
lea rdx, [0x140095a78]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rdi, rax
mov qword [rsp + 0x58], rax
test rax, rax
jne 0x14003f881
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov eax, dword [rax]
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
cmp qword [rbx + 0x2f2d8], 0
jne 0x14003f8a4
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, 0xfffffffc
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
mov ecx, dword [rbx + 0x2f2c8]
sub ecx, 1
je 0x14003f916
cmp ecx, 1
mov rcx, rdi
je 0x14003f8c7
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, 0xfffffffa
jmp 0x14003f9c4
movzx eax, word [rbx + 0x2f2ce]
movzx r9d, word [rbx + 0x2f2cc]
xor r8d, r8d
cmp dword [rbx + 0x2f2d4], 1
setne r8b
add r8d, 5
mov dword [rsp + 0x20], eax
lea rdx, str.P_d_n_d__d_n255_n
call fcn.14000a570
mov r8d, dword [rbx + 0x2f2d0]
mov r9, rdi
mov edx, 1
mov rcx, qword [rbx + 0x2f2d8]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x14003f92f
mov r9d, dword [rbx + 0x2f2d0]
mov r8, qword [rbx + 0x2f2d8]
mov rdx, rdi
mov rcx, rbx
call sym.EURawImg.exe_protected:_void___cdecl_LibRaw::jpeg_thumb_writer_struct__iobuf____ptr64__char____ptr64__int____ptr64
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
jmp 0x14003f9c4
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140045a90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rbx, rcx
xor r8d, r8d
mov rcx, qword [rcx + 0x5d158]
movsxd rdx, dword [rbx + 0x256b8]
mov rax, qword [rcx]
call qword [rax + 0x18]
mov rcx, rbx
call sym.EURawImg.exe_protected:_unsigned_short_int___cdecl_LibRaw::get2_void____ptr64
mov rcx, rbx
movzx ebp, ax
call sym.EURawImg.exe_protected:_unsigned_short_int___cdecl_LibRaw::get2_void____ptr64
cmp dword [rbx + 0x256b4], 1
movzx r14d, ax
mov eax, 0x5555
mov esi, 0x1354
cmove si, ax
cmp dword [rbx + 0x256c8], 0
jne 0x140045b01
cmp dword [rbx + 0x256d0], 0
je 0x140045b9d
movzx edx, word [rbx + 0x10]
mov r8d, 2
add rdx, rdx
mov rcx, rbx
call sym.EURawImg.exe_protected:_void____ptr64___cdecl_LibRaw::calloc_unsigned_long_long_unsigned___int64___unsigned_long_long_unsigned___int64_____ptr64
movzx edx, word [rbx + 0x12]
mov r8d, 2
add rdx, rdx
mov qword [rbx + 0x2f420], rax
mov rcx, rbx
call sym.EURawImg.exe_protected:_void____ptr64___cdecl_LibRaw::calloc_unsigned_long_long_unsigned___int64___unsigned_long_long_unsigned___int64_____ptr64
movsxd rdx, dword [rbx + 0x256c8]
mov qword [rbx + 0x2f428], rax
test edx, edx
je 0x140045b6b
mov rcx, qword [rbx + 0x5d158]
xor r8d, r8d
mov rax, qword [rcx]
call qword [rax + 0x18]
movzx r8d, word [rbx + 0x10]
mov rcx, rbx
mov rdx, qword [rbx + 0x2f420]
add r8d, r8d
call sym.EURawImg.exe_protected:_void___cdecl_LibRaw::read_shorts_unsigned_short_int____ptr64__unsigned_int____ptr64
movsxd rdx, dword [rbx + 0x256d0]
test edx, edx
je 0x140045b9d
mov rcx, qword [rbx + 0x5d158]
xor r8d, r8d
mov rax, qword [rcx]
call qword [rax + 0x18]
movzx r8d, word [rbx + 0x12]
mov rcx, rbx
mov rdx, qword [rbx + 0x2f428]
add r8d, r8d
call sym.EURawImg.exe_protected:_void___cdecl_LibRaw::read_shorts_unsigned_short_int____ptr64__unsigned_int____ptr64
mov rcx, qword [rbx + 0x5d158]
xor r8d, r8d
mov rdx, qword [rbx + 0x5d200]
mov rax, qword [rcx]
call qword [rax + 0x18]
movzx r8d, word [rbx + 0x12]
mov rcx, rbx
movzx eax, word [rbx + 0x10]
mov rdx, qword [rbx + 0x2f3f0]
imul r8d, eax
call sym.EURawImg.exe_protected:_void___cdecl_LibRaw::read_shorts_unsigned_short_int____ptr64__unsigned_int____ptr64
cmp dword [rbx + 0x256b4], 0
je 0x140045c69
movzx ecx, word [rbx + 0x12]
xor r11d, r11d
movzx eax, word [rbx + 0x10]
imul ecx, eax
test ecx, ecx
jle 0x140045c69
mov qword [rsp + 0x30], rdi
mov r10d, r11d
movzx edi, si
not di
mov rdx, qword [rbx + 0x2f3f0]
lea r10, [r10 + 4]
movzx r8d, bp
add r11d, 2
xor r8w, word [rdx + r10 - 4]
movzx r9d, word [rdx + r10 - 2]
movzx eax, r8w
and ax, si
xor r9w, r14w
movzx ecx, r9w
and r8w, di
and cx, di
and r9w, si
or cx, ax
or r8w, r9w
mov word [rdx + r10 - 4], cx
mov rax, qword [rbx + 0x2f3f0]
mov word [r10 + rax - 2], r8w
movzx ecx, word [rbx + 0x12]
movzx eax, word [rbx + 0x10]
imul ecx, eax
cmp r11d, ecx
jl 0x140045c01
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1400576f0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rbp
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x1400ada20]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r15, rcx
mov r14d, 2
mov rcx, qword [rcx + 0x5d158]
mov ebp, edx
xorps xmm0, xmm0
lea rdx, [rsp + 0x30]
mov r9d, r14d
mov r8d, r14d
movups xmmword [rsp + 0x20], xmm0
mov rax, qword [rcx]
call qword [rax + 0x10]
xorps xmm0, xmm0
xorps xmm1, xmm1
sub ebp, r14d
je 0x140057833
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x98], rdi
movaps xmmword [rsp + 0x50], xmm6
movsd xmm6, qword [rsp + 0x28]
movaps xmmword [rsp + 0x40], xmm7
movsd xmm7, qword [rsp + 0x20]
mov rcx, qword [r15 + 0x5d158]
lea rbx, [rsp + 0x30]
mov r9d, 1
mov esi, r14d
mov rax, qword [rcx]
lea rdi, [rsi + rsi]
add rbx, rdi
lea r8d, [r9 + 1]
mov rdx, rbx
call qword [rax + 0x10]
movzx r8d, byte [rbx]
xor rsi, 2
movzx ecx, byte [rbx + 1]
movzx r9d, byte [rsp + rsi*2 + 0x30]
movzx edx, byte [rsp + rsi*2 + 0x31]
mov eax, r9d
shl eax, 8
or edx, eax
mov eax, r8d
shl eax, 8
or ecx, eax
movzx eax, byte [rsp + rsi*2 + 0x31]
sub edx, ecx
shl eax, 8
movzx ecx, byte [rsp + rdi + 0x31]
or eax, r9d
shl ecx, 8
or ecx, r8d
sub eax, ecx
movd xmm0, edx
cvtdq2pd xmm0, xmm0
inc r14d
and r14d, 3
movd xmm1, eax
mulsd xmm0, xmm0
cvtdq2pd xmm1, xmm1
addsd xmm0, xmm7
mulsd xmm1, xmm1
movaps xmm7, xmm0
addsd xmm1, xmm6
movaps xmm6, xmm1
sub ebp, 1
jne 0x140057771
movaps xmm7, xmmword [rsp + 0x40]
movaps xmm6, xmmword [rsp + 0x50]
mov rdi, qword [rsp + 0x98]
mov rsi, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x88]
comisd xmm1, xmm0
mov eax, 0x4949
mov ecx, 0x4d4d
cmova ax, cx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14007c510
add rsp, 0x60
pop r15
pop r14
pop rbp
ret
Function at 0x14006cf50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
mov ebp, r8d
mov rsi, rdx
mov rbx, rcx
test r9d, r9d
je 0x14006d0cf
mov rax, qword [rcx + 0x5d150]
xor r11d, r11d
mov dword [rax + 0x220], r11d
mov r9, qword [rcx + 0x5d150]
mov eax, dword [r9 + 0x220]
cmp eax, 4
jae 0x14006cfcd
mov ecx, dword [rsp + 0x50]
nop dword [rax]
imul ecx, ecx, 0x2e90edd
inc ecx
mov dword [r9 + rax*4 + 0x20], ecx
mov rax, qword [rbx + 0x5d150]
inc dword [rax + 0x220]
mov r9, qword [rbx + 0x5d150]
mov eax, dword [r9 + 0x220]
cmp eax, 4
jb 0x14006cfa0
mov eax, dword [r9 + 0x2c]
mov ecx, dword [r9 + 0x28]
add eax, eax
xor ecx, dword [r9 + 0x20]
shr ecx, 0x1f
or ecx, eax
mov dword [r9 + 0x2c], ecx
mov rax, qword [rbx + 0x5d150]
mov dword [rax + 0x220], 4
mov rax, qword [rbx + 0x5d150]
cmp dword [rax + 0x220], 0x7f
jae 0x14006d06d
nop word [rax + rax]
mov r10, qword [rbx + 0x5d150]
mov r9d, dword [r10 + 0x220]
lea eax, [r9 - 1]
lea edx, [r9 - 3]
mov r8d, dword [r10 + rdx*4 + 0x20]
lea ecx, [r9 - 2]
xor r8d, dword [r10 + rax*4 + 0x20]
lea eax, [r9 - 4]
mov eax, dword [r10 + rax*4 + 0x20]
xor eax, dword [r10 + rcx*4 + 0x20]
add eax, eax
shr r8d, 0x1f
or r8d, eax
mov dword [r10 + r9*4 + 0x20], r8d
mov rax, qword [rbx + 0x5d150]
inc dword [rax + 0x220]
mov rax, qword [rbx + 0x5d150]
cmp dword [rax + 0x220], 0x7f
jb 0x14006d010
mov dword [rax + 0x220], r11d
mov rcx, qword [rbx + 0x5d150]
mov eax, dword [rcx + 0x220]
cmp eax, 0x7f
jae 0x14006d0cf
mov qword [rsp + 0x30], rdi
nop dword [rax + rax]
mov ecx, dword [rcx + rax*4 + 0x20]
mov rdi, qword [rbx + 0x5d150]
call qword [sym.imp.WS2_32.dll_htonl]
mov ecx, dword [rdi + 0x220]
mov dword [rdi + rcx*4 + 0x20], eax
mov rax, qword [rbx + 0x5d150]
inc dword [rax + 0x220]
mov rcx, qword [rbx + 0x5d150]
mov eax, dword [rcx + 0x220]
cmp eax, 0x7f
jb 0x14006d090
mov rdi, qword [rsp + 0x30]
test ebp, ebp
je 0x14006d11b
mov r9, qword [rbx + 0x5d150]
lea rsi, [rsi + 4]
mov r8d, dword [r9 + 0x220]
lea eax, [r8 + 1]
lea ecx, [r8 - 0x3f]
and eax, 0x7f
and ecx, 0x7f
and r8d, 0x7f
mov edx, dword [r9 + rcx*4 + 0x20]
xor edx, dword [r9 + rax*4 + 0x20]
mov dword [r9 + r8*4 + 0x20], edx
xor dword [rsi - 4], edx
mov rax, qword [rbx + 0x5d150]
inc dword [rax + 0x220]
sub ebp, 1
jne 0x14006d0d3
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
Function at 0x14006d7d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
xor edi, edi
movsxd r12, r8d
mov ebp, 4
movsxd r15, edx
mov esi, edi
mov r14d, ebp
mov rbx, rcx
mov rcx, rbx
call sym.EURawImg.exe_protected:_unsigned_short_int___cdecl_LibRaw::get2_void____ptr64
movzx r9d, ax
mov rax, rsi
sar rax, 1
xor rax, rsi
inc rsi
mov dword [rbx + rax*4 + 0x2da64], r9d
sub r14, 1
jne 0x14006d803
test r15d, r15d
je 0x14006d842
mov rcx, qword [rbx + 0x5d158]
lea r8d, [r14 + 1]
mov rdx, r15
mov rax, qword [rcx]
call qword [rax + 0x18]
mov rsi, rdi
mov r14, rbp
mov rcx, rbx
call sym.EURawImg.exe_protected:_unsigned_short_int___cdecl_LibRaw::get2_void____ptr64
movzx ecx, ax
mov rax, rsi
sar rax, 1
xor rax, rsi
inc rsi
mov dword [rbx + rax*4 + 0x2db04], ecx
sub r14, 1
jne 0x14006d848
test r15d, r15d
je 0x14006d885
mov rcx, qword [rbx + 0x5d158]
lea r8d, [r14 + 1]
mov rdx, r15
mov rax, qword [rcx]
call qword [rax + 0x18]
mov rsi, rdi
mov r14, rbp
nop dword [rax + rax]
mov rcx, rbx
call sym.EURawImg.exe_protected:_unsigned_short_int___cdecl_LibRaw::get2_void____ptr64
movzx ecx, ax
mov rax, rsi
sar rax, 1
xor rax, rsi
inc rsi
mov dword [rbx + rax*4 + 0x2daf4], ecx
sub r14, 1
jne 0x14006d890
test r15d, r15d
je 0x14006d8cd
mov rcx, qword [rbx + 0x5d158]
lea r8d, [r14 + 1]
mov rdx, r15
mov rax, qword [rcx]
call qword [rax + 0x18]
mov rsi, rdi
mov r14, rbp
mov rcx, rbx
call sym.EURawImg.exe_protected:_unsigned_short_int___cdecl_LibRaw::get2_void____ptr64
movzx ecx, ax
mov rax, rsi
sar rax, 1
xor rax, rsi
inc rsi
mov dword [rbx + rax*4 + 0x2da84], ecx
sub r14, 1
jne 0x14006d8d3
test r15d, r15d
je 0x14006d910
mov rcx, qword [rbx + 0x5d158]
lea r8d, [r14 + 1]
mov rdx, r15
mov rax, qword [rcx]
call qword [rax + 0x18]
mov rsi, rdi
mov r14, rbp
mov rcx, rbx
call sym.EURawImg.exe_protected:_unsigned_short_int___cdecl_LibRaw::get2_void____ptr64
movzx ecx, ax
mov rax, rsi
sar rax, 1
xor rax, rsi
inc rsi
mov dword [rbx + rax*4 + 0x2db34], ecx
sub r14, 1
jne 0x14006d916
test r12d, r12d
je 0x14006d953
mov rcx, qword [rbx + 0x5d158]
lea r8d, [r14 + 1]
mov rdx, r12
mov rax, qword [rcx]
call qword [rax + 0x18]
mov rcx, rbx
call sym.EURawImg.exe_protected:_unsigned_short_int___cdecl_LibRaw::get2_void____ptr64
movzx ecx, ax
mov rax, rdi
sar rax, 1
xor rax, rdi
inc rdi
mov dword [rbx + rax*4 + 0x2da94], ecx
sub rbp, 1
jne 0x14006d953
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x24], 0x18
mov byte [rsp + 0x25], 0x11
mov byte [rsp + 0x26], 0x4e
mov byte [rsp + 0x27], 0x86
mov dword [rsp + 0x20], 0
jmp 0x14000102c
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
cmp rax, 0x31446
jae 0x14000108d
movsxd rax, dword [rsp + 0x20]
mov qword [rsp + 0x38], rax
lea rcx, section..data
movsxd rdx, dword [rsp + 0x20]
mov qword [rsp + 0x30], rdx
xor edx, edx
mov r8, qword [rsp + 0x30]
mov rax, r8
mov r8d, 4
div r8
mov rax, rdx
movsx eax, byte [rsp + rax + 0x24]
mov rdx, qword [rsp + 0x38]
movzx ecx, byte [rcx + rdx]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x20]
lea rdx, section..data
mov byte [rdx + rcx], al
jmp 0x140001022
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x31446
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
mov r8d, 0x31446
lea rdx, section..data
mov rcx, qword [rsp + 0x28]
call fcn.14000ebd0
call qword [rsp + 0x28]
xor eax, eax
add rsp, 0x48
ret

Function at 0x1400017fc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001846
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001846
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001846
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001846
cmp dword [rcx + 0x84], 0xe
jbe 0x140001846
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001848
xor al, al
add rsp, 0x28
ret

Function at 0x140004d88
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140004df7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140004df7
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140004df7
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140004df7
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140004df7
cmp dword [rcx + 0x84], 0xe
jbe 0x140004df7
cmp dword [rcx + 0xf8], 0
je 0x140004df7
mov ecx, ebx
call fcn.140004ea8
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140004c84
nop
cmp dword [rbp + 0x20], 0
je 0x140004e45
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140004e50
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x140004d88

Function at 0x140004f8c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140004d88
Function at 0x14001812c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140017f58

Function at 0x14001e7bc
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x14001e4e2
call fcn.140011b38
mov dword [rax], 0x16
call fcn.1400119e8
jmp 0x14001e62d
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x14001e62d
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x14001e62d
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x14001e511
lock or dword [rcx + 0x14], 0x10
jmp 0x14001e62d
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x14001e525
call fcn.14001eb80
mov esi, dword [rbx + 0x10]
cmp esi, 1
jne 0x14001e535
mov rax, qword [rbx]
mov bpl, byte [rax]
jmp 0x14001e538
xor bpl, bpl
mov rdi, qword [rbx + 8]
mov rcx, rbx
mov qword [rbx], rdi
call fcn.14001c378
mov r8d, dword [rbx + 0x20]
mov ecx, eax
mov rdx, rdi
call fcn.140020730
mov dword [rbx + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x14001e61b
mov eax, dword [rbx + 0x14]
test al, 6
jne 0x14001e5c9
mov rcx, rbx
call fcn.14001c378
cmp eax, 0xffffffff
je 0x14001e5b4
mov rcx, rbx
call fcn.14001c378
cmp eax, 0xfffffffe
je 0x14001e5b4
mov rcx, rbx
call fcn.14001c378
movsxd rdi, eax
lea r14, [0x140045840]
mov rcx, rbx
sar rdi, 6
call fcn.14001c378
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rdi*8]
lea rdx, [rax + rcx*8]
jmp 0x14001e5bb
lea rdx, [0x140043420]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14001e5c9
lock or dword [rbx + 0x14], 0x20
cmp dword [rbx + 0x20], 0x200
jne 0x14001e5ed
mov eax, dword [rbx + 0x14]
shr eax, 6
test al, 1
je 0x14001e5ed
mov eax, dword [rbx + 0x14]
shr eax, 8
test al, 1
jne 0x14001e5ed
mov dword [rbx + 0x20], 0x1000
mov rax, qword [rbx]
cmp esi, 1
jne 0x14001e60b
movzx ecx, byte [rax]
dec dword [rbx + 0x10]
shl cx, 8
movzx eax, bpl
or cx, ax
inc qword [rbx]
jmp 0x14001e616
movzx ecx, word [rax]
add dword [rbx + 0x10], 0xfffffffe
add qword [rbx], 2
movzx eax, cx
jmp 0x14001e632
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rbx + 0x14], eax
and dword [rbx + 0x10], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
jmp 0x14001e4ac

Function at 0x1800111ae
Capabilities:
Terminate process

Disassembly:
jmp 0x1800150f0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140008120
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
xor r8, r8
push r8
push rax
pushfq
push r8
push rdx
sub rsp, 0xa8
push r8
push r15
push r14
push r13
push r12
push rbx
push r8
push rsi
push rdi
push rbp
push rax
push rdx
sub rsp, 0x290
movdqa xmmword [rsp + 0x2f0], xmm6
movdqa xmmword [rsp + 0x300], xmm7
movdqa xmmword [rsp + 0x310], xmm8
movdqa xmmword [rsp + 0x320], xmm9
movdqa xmmword [rsp + 0x330], xmm10
movdqa xmmword [rsp + 0x340], xmm11
movdqa xmmword [rsp + 0x350], xmm12
movdqa xmmword [rsp + 0x360], xmm13
movdqa xmmword [rsp + 0x370], xmm14
movdqa xmmword [rsp + 0x380], xmm15
mov eax, dword [0x14096e4d8]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x30
add rax, rbx
lea rdx, [rsp + 0x20]
xor r8, r8
mov qword [rdx + 0x10], r8
mov byte [rdx + 0x19], 1
mov dword [rdx + 0x1c], 0xffffffff
mov byte [rdx + 0x18], 2
mov r8, qword [rax + 0x80]
mov qword [rdx], r8
mov qword [rax + 0x80], rdx
lea r8, [rsp + 0x290]
mov qword [rdx + 8], r8
call fcn.1401424f0
int3
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xd8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x120], rcx
mov qword [rsp + 0x128], rdx
mov qword [rsp + 0x130], r8
mov qword [rsp + 0x138], r9
mov eax, dword [0x14096e4d8]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x30
add rax, rbx
mov qword [rsp + 0xc0], rax
cmp rcx, qword [rax + 0x88]
sete byte [rsp + 0xd0]
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [r8 + 0x18]
mov rbx, qword [rax]
mov rax, qword [r8 + 0x20]
mov rbp, qword [rax]
mov rax, qword [r8 + 0x28]
mov rsi, qword [rax]
mov rax, qword [r8 + 0x30]
mov rdi, qword [rax]
mov rax, qword [r8 + 0x58]
mov r12, qword [rax]
mov rax, qword [r8 + 0x60]
mov r13, qword [rax]
mov rax, qword [r8 + 0x68]
mov r14, qword [rax]
mov rax, qword [r8 + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [r8 + 0x90]
movdqa xmm7, xmmword [r8 + 0xa0]
movdqa xmm8, xmmword [r8 + 0xb0]
movdqa xmm9, xmmword [r8 + 0xc0]
movdqa xmm10, xmmword [r8 + 0xd0]
movdqa xmm11, xmmword [r8 + 0xe0]
movdqa xmm12, xmmword [r8 + 0xf0]
movdqa xmm13, xmmword [r8 + 0x100]
movdqa xmm14, xmmword [r8 + 0x110]
movdqa xmm15, xmmword [r8 + 0x120]
mov rcx, qword [r8 + 0x78]
mov rdx, qword [rsp + 0x120]
call qword [rsp + 0x128]
mov r8, qword [rsp + 0x130]
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rdx + 0x70]
cmp rcx, 0
je 0x1400082b0
mov r9, qword [rdx + 0x68]
mov qword [r9], rcx
mov qword [rdx + 0x68], 0
mov qword [rdx + 0x70], 0
mov rcx, qword [rsp + 0x138]
mov r8, qword [r8 + 0x78]
xor r9d, r9d
mov rcx, qword [rcx]
cmp rcx, r9
je 0x1400082cc
cmp rcx, r8
jl 0x1400082bf
mov qword [rdx + 0x80], rcx
test dword [0x140965c58], 1
je 0x1400082fb
cmp byte [rsp + 0xd0], 0
je 0x1400082fb
mov rcx, 0x43
mov rdx, rax
mov rsp, r8
jmp 0x140007e20
mov rsp, r8
jmp rax