joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c4550
Capabilities:
Hash data with md5

Disassembly:
push rbp
sub rsp, 0x10
lea rbp, [rsp + 0x10]
mov qword [rbp - 8], rcx
mov eax, dword [0x140110ad0]
or eax, dword [0x140110ad4]
xor eax, 0x3ea8ea0a
imul eax, eax, 0x3845f5df
sub eax, 0xef51ed1c
cmp eax, 0x3a5793eb
je 0x1400c4614
mov eax, dword [0x140110ad8]
mov ecx, dword [0x140110adc]
xor edx, edx
div ecx
mov rdx, qword [rbp - 8]
add eax, 0xf49072be
xor eax, 0x68857291
mov ecx, 0xa0e4e2d3
imul rax, rcx
shr rax, 0x3f
mov dword [rbp - 0xc], eax
mov eax, 0x10
call fcn.1400ec140
sub rsp, rax
mov eax, dword [rbp - 0xc]
mov rcx, rsp
mov qword [rcx], rdx
mov rdx, qword [rcx]
mov dword [rdx + 0x14], 0
mov rdx, qword [rcx]
mov dword [rdx + 0x10], 0
mov rdx, qword [rcx]
mov dword [rdx], 0x67452301
mov rdx, qword [rcx]
mov dword [rdx + 4], 0xefcdab89
mov rdx, qword [rcx]
mov dword [rdx + 8], 0x98badcfe
mov rcx, qword [rcx]
mov dword [rcx + 0xc], 0x10325476
cmp eax, 0x98f8defc
je 0x1400c4614
mov rsp, rbp
pop rbp
ret
mov rcx, qword [rbp - 8]
mov eax, 0x10
call fcn.1400ec140
sub rsp, rax
mov rax, rsp
mov qword [rax], rcx
mov rcx, qword [rax]
mov dword [rcx + 0x14], 0
mov rcx, qword [rax]
mov dword [rcx + 0x10], 0
mov rcx, qword [rax]
mov dword [rcx], 0x67452301
mov rcx, qword [rax]
mov dword [rcx + 4], 0xefcdab89
mov rcx, qword [rax]
mov dword [rcx + 8], 0x98badcfe
mov rax, qword [rax]
mov dword [rax + 0xc], 0x10325476
jmp 0x1400c4585
Function at 0x1400c6ca0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x20
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x10], rdx
mov dword [rsp + 0xc], r8d
mov dword [rsp + 8], 0
mov dword [rsp + 4], 0
mov eax, dword [rsp + 4]
cmp eax, dword [rsp + 0xc]
jae 0x1400c6dd8
mov rax, qword [rsp + 0x10]
mov ecx, dword [rsp + 8]
mov eax, dword [rax + rcx*4]
and eax, 0xff
mov dl, al
mov rax, qword [rsp + 0x18]
mov ecx, dword [rsp + 4]
mov byte [rax + rcx], dl
mov rax, qword [rsp + 0x10]
mov ecx, dword [rsp + 8]
mov eax, dword [rax + rcx*4]
shr eax, 8
and eax, 0xff
mov dl, al
mov rax, qword [rsp + 0x18]
mov ecx, dword [rsp + 4]
add ecx, 1
mov ecx, ecx
mov byte [rax + rcx], dl
mov rax, qword [rsp + 0x10]
mov ecx, dword [rsp + 8]
mov eax, dword [rax + rcx*4]
shr eax, 0x10
and eax, 0xff
mov dl, al
mov rax, qword [rsp + 0x18]
mov ecx, dword [rsp + 4]
add ecx, 2
mov ecx, ecx
mov byte [rax + rcx], dl
mov rax, qword [rsp + 0x10]
mov ecx, dword [rsp + 8]
mov eax, dword [rax + rcx*4]
shr eax, 0x18
and eax, 0xff
mov dl, al
mov rax, qword [rsp + 0x18]
mov ecx, dword [rsp + 4]
add ecx, 3
mov ecx, ecx
mov byte [rax + rcx], dl
mov eax, dword [0x140110c00]
xor edx, edx
div dword [0x140110c04]
imul eax, eax, 0xd6f74a2b
xor eax, 0xc52b80a3
imul eax, eax, 0x22c9fae
cmp eax, 0xe178c59e
jae 0x1400c6e2b
mov eax, dword [0x140110c08]
or eax, dword [0x140110c0c]
add eax, 0x7ae04234
mov ecx, 0x2ff3112e
xor edx, edx
div ecx
mov ecx, 0x2443b960
xor edx, edx
div ecx
mov ecx, dword [rsp + 8]
add ecx, 1
mov dword [rsp + 8], ecx
mov ecx, dword [rsp + 4]
add ecx, 4
mov dword [rsp + 4], ecx
cmp eax, 0x918de446
jae 0x1400c6e2b
jmp 0x1400c6cc3
mov eax, dword [0x140110c10]
add eax, dword [0x140110c14]
or eax, 0x6e0afa7a
or eax, 0x8ba8fc25
or eax, 0x9e9a18e1
cmp eax, 0xb018a8db
je 0x1400c6e46
mov eax, dword [0x140110c18]
and eax, dword [0x140110c1c]
imul eax, eax, 0xce086f20
imul eax, eax, 0xd9927656
add eax, 0x4a4255a9
cmp eax, 0xfe7c5aca
jae 0x1400c6dfe
add rsp, 0x20
ret
mov eax, dword [rsp + 8]
add eax, 1
mov dword [rsp + 8], eax
mov eax, dword [rsp + 4]
add eax, 4
mov dword [rsp + 4], eax
jmp 0x1400c6d8f
jmp 0x1400c6dfe
Function at 0x1400c7160
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x20
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x10], rdx
mov dword [rsp + 0xc], r8d
mov dword [rsp + 8], 0
mov dword [rsp + 4], 0
mov eax, dword [rsp + 4]
cmp eax, dword [rsp + 0xc]
jae 0x1400c7270
mov eax, dword [0x140110c70]
or eax, dword [0x140110c74]
mov ecx, 0xaffe13fd
xor edx, edx
div ecx
mov ecx, 0xbbaf9d86
xor edx, edx
div ecx
mov ecx, 0xbe805f3f
xor edx, edx
div ecx
cmp eax, 0x73ae94b0
ja 0x1400c72ce
mov eax, dword [0x140110c78]
sub eax, dword [0x140110c7c]
and eax, 0xac37c862
xor eax, 0xf966dfb8
mov ecx, 0xfddb59b6
xor edx, edx
div ecx
mov rcx, qword [rsp + 0x10]
mov edx, dword [rsp + 4]
movzx r8d, byte [rcx + rdx]
mov rcx, qword [rsp + 0x10]
mov edx, dword [rsp + 4]
add edx, 1
mov edx, edx
movzx ecx, byte [rcx + rdx]
shl ecx, 8
or r8d, ecx
mov rcx, qword [rsp + 0x10]
mov edx, dword [rsp + 4]
add edx, 2
mov edx, edx
movzx ecx, byte [rcx + rdx]
shl ecx, 0x10
or r8d, ecx
mov rcx, qword [rsp + 0x10]
mov edx, dword [rsp + 4]
add edx, 3
mov edx, edx
movzx ecx, byte [rcx + rdx]
shl ecx, 0x18
or r8d, ecx
mov rcx, qword [rsp + 0x18]
mov edx, dword [rsp + 8]
mov dword [rcx + rdx*4], r8d
cmp eax, 0x287a8754
ja 0x1400c71c3
jmp 0x1400c7255
mov eax, dword [rsp + 8]
add eax, 1
mov dword [rsp + 8], eax
mov eax, dword [rsp + 4]
add eax, 4
mov dword [rsp + 4], eax
jmp 0x1400c7183
mov eax, dword [0x140110c80]
sub eax, dword [0x140110c84]
mov ecx, 0x72d158f1
xor edx, edx
div ecx
imul eax, eax, 0xc48cbfae
mov ecx, 0x108000ec
xor edx, edx
div ecx
cmp eax, 0xf22b5035
jae 0x1400c7331
mov eax, dword [0x140110c88]
or eax, dword [0x140110c8c]
mov ecx, 0x1a463727
xor edx, edx
div ecx
add eax, 0xe8675855
sub eax, 0xc5418056
cmp eax, 0xfb07f090
ja 0x1400c729f
add rsp, 0x20
ret
mov rax, qword [rsp + 0x10]
mov ecx, dword [rsp + 4]
movzx edx, byte [rax + rcx]
mov rax, qword [rsp + 0x10]
mov ecx, dword [rsp + 4]
add ecx, 1
mov ecx, ecx
movzx eax, byte [rax + rcx]
shl eax, 8
or edx, eax
mov rax, qword [rsp + 0x10]
mov ecx, dword [rsp + 4]
add ecx, 2
mov ecx, ecx
movzx eax, byte [rax + rcx]
shl eax, 0x10
or edx, eax
mov rax, qword [rsp + 0x10]
mov ecx, dword [rsp + 4]
add ecx, 3
mov ecx, ecx
movzx eax, byte [rax + rcx]
shl eax, 0x18
or edx, eax
mov rax, qword [rsp + 0x18]
mov ecx, dword [rsp + 8]
mov dword [rax + rcx*4], edx
jmp 0x1400c71c3
jmp 0x1400c729f
Function at 0x1400cf240
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x20
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x10], rdx
mov dword [rsp + 0xc], r8d
mov dword [rsp + 8], 0
mov eax, dword [0x1401114f4]
or eax, dword [0x1401114f8]
xor eax, 0x7b0756a3
sub eax, 0x35f3f05a
imul eax, eax, 0xef488990
cmp eax, 0xcf1d7d7d
je 0x1400cf350
mov eax, dword [0x1401114fc]
xor eax, dword [0x140111500]
add eax, 0x7cdb2fc
sub eax, 0x408ae9fd
xor eax, 0xd05ad2d5
mov ecx, dword [rsp + 8]
cmp ecx, dword [rsp + 0xc]
setl cl
mov byte [rsp + 7], cl
cmp eax, 0xfb70cd0a
ja 0x1400cf282
mov al, byte [rsp + 7]
test al, 1
jne 0x1400cf2c8
jmp 0x1400cf339
mov rax, qword [rsp + 0x18]
movsxd rcx, dword [rsp + 8]
movzx eax, byte [rax + rcx]
sar eax, 4
movsxd rcx, eax
lea rax, str.0123456789ABCDEF
mov dl, byte [rax + rcx]
mov rax, qword [rsp + 0x10]
mov ecx, dword [rsp + 8]
shl ecx, 1
movsxd rcx, ecx
mov byte [rax + rcx], dl
mov rax, qword [rsp + 0x18]
movsxd rcx, dword [rsp + 8]
movzx eax, byte [rax + rcx]
and eax, 0xf
movsxd rcx, eax
lea rax, str.0123456789ABCDEF
mov dl, byte [rax + rcx]
mov rax, qword [rsp + 0x10]
mov ecx, dword [rsp + 8]
shl ecx, 1
add ecx, 1
movsxd rcx, ecx
mov byte [rax + rcx], dl
mov eax, dword [rsp + 8]
add eax, 1
mov dword [rsp + 8], eax
jmp 0x1400cf25b
mov rax, qword [rsp + 0x10]
mov ecx, dword [rsp + 8]
shl ecx, 1
movsxd rcx, ecx
mov byte [rax + rcx], 0
add rsp, 0x20
ret
jmp 0x1400cf282
Function at 0x1400d53c0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov qword [rbp + 0x28], r9
mov qword [rbp + 0x20], r8
mov eax, dword [0x140111e4c]
imul eax, dword [0x140111e50]
and eax, 0xbbd04c73
sub eax, 0xe006877c
add eax, 0xf92eb53e
cmp eax, 0x2136f681
je 0x1400d54b0
mov r8, qword [rbp - 0x10]
mov r9, qword [rbp - 8]
mov eax, dword [0x140111e54]
mov ecx, dword [0x140111e58]
and eax, ecx
xor eax, 0xb1d9fc5a
imul eax, eax, 0x2fa8c97c
mov dword [rbp - 0x18], eax
mov eax, 0x10
mov qword [rbp - 0x28], rax
call fcn.1400ec140
sub rsp, rax
mov rax, qword [rbp - 0x28]
mov rcx, rsp
call fcn.1400ec140
sub rsp, rax
mov rax, qword [rbp - 0x28]
mov rdx, rsp
call fcn.1400ec140
sub rsp, rax
mov rax, qword [rbp - 0x28]
mov r10, rsp
mov qword [rbp - 0x20], r10
call fcn.1400ec140
sub rsp, rax
mov rax, rsp
mov qword [rcx], r9
mov qword [rdx], r8
lea r8, [rbp + 0x20]
mov qword [rax], r8
mov rcx, qword [rcx]
mov rdx, qword [rdx]
mov r8, qword [rax]
sub rsp, 0x20
call fcn.1400f03a0
mov rcx, qword [rbp - 0x20]
add rsp, 0x20
mov edx, eax
mov eax, dword [rbp - 0x18]
mov dword [rcx], edx
mov ecx, dword [rcx]
mov dword [rbp - 0x14], ecx
cmp eax, 0xd4f2bcfe
je 0x1400d5401
mov eax, dword [rbp - 0x14]
mov rsp, rbp
pop rbp
ret
mov r8, qword [rbp - 0x10]
mov r9, qword [rbp - 8]
mov eax, 0x10
mov qword [rbp - 0x38], rax
call fcn.1400ec140
sub rsp, rax
mov rax, qword [rbp - 0x38]
mov rcx, rsp
call fcn.1400ec140
sub rsp, rax
mov rax, qword [rbp - 0x38]
mov rdx, rsp
call fcn.1400ec140
sub rsp, rax
mov rax, qword [rbp - 0x38]
mov r10, rsp
mov qword [rbp - 0x30], r10
call fcn.1400ec140
sub rsp, rax
mov rax, rsp
mov qword [rcx], r9
mov qword [rdx], r8
lea r8, [rbp + 0x20]
mov qword [rax], r8
mov rcx, qword [rcx]
mov rdx, qword [rdx]
mov r8, qword [rax]
sub rsp, 0x20
call fcn.1400f03a0
add rsp, 0x20
mov ecx, eax
mov rax, qword [rbp - 0x30]
mov dword [rax], ecx
jmp 0x1400d5401
Function at 0x1400e1a30
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov eax, dword [0x140114284]
and eax, dword [0x140114288]
and eax, 0xc0fae130
add eax, 0xd2636f62
mov ecx, 0xac258246
xor edx, edx
div ecx
cmp eax, 0xf2f58e3a
je 0x1400e1c3e
mov r8, qword [rbp - 0x10]
mov r9, qword [rbp - 8]
mov eax, dword [0x14011428c]
mov ecx, dword [0x140114290]
sub eax, ecx
imul eax, eax, 0xd2648982
add eax, 0x905da0e8
mov dword [rbp - 0x34], eax
mov eax, 0x10
mov qword [rbp - 0x40], rax
call fcn.1400ec140
sub rsp, rax
mov rax, qword [rbp - 0x40]
mov rdx, rsp
call fcn.1400ec140
sub rsp, rax
mov eax, dword [rbp - 0x34]
mov rcx, rsp
mov qword [rbp - 0x30], rcx
mov qword [rdx], r9
mov qword [rcx], r8
mov rdx, qword [rdx]
mov qword [rbp - 0x28], rdx
mov rdx, qword [rcx]
mov qword [rbp - 0x20], rdx
cmp qword [rcx], 0
setne cl
mov byte [rbp - 0x11], cl
cmp eax, 0x52e7137e
je 0x1400e1a6c
mov al, byte [rbp - 0x11]
test al, 1
jne 0x1400e1af3
jmp 0x1400e1b6d
mov eax, dword [0x140114294]
and eax, dword [0x140114298]
xor eax, 0x230c8bf2
sub eax, 0xad416b15
sub eax, 0x87c21c69
cmp eax, 0xcb6ec9e7
jbe 0x1400e1c74
mov rax, qword [rbp - 0x30]
mov ecx, dword [0x14011429c]
xor ecx, dword [0x1401142a0]
or ecx, 0xffbd0366
add ecx, 0xdd4ca55
and ecx, 0x1dc8ed8
mov dword [rbp - 0x48], ecx
mov rcx, qword [rax]
sub rsp, 0x20
call sub.msvcrt.dll_strlen
add rsp, 0x20
mov rcx, rax
mov eax, dword [rbp - 0x48]
mov dword [rbp - 0x44], ecx
cmp eax, 0xd39cb097
ja 0x1400e1c74
mov eax, dword [rbp - 0x44]
mov dword [rbp - 0x4c], eax
jmp 0x1400e1bc7
mov eax, dword [0x1401142a4]
sub eax, dword [0x1401142a8]
and eax, 0xf8f48a98
xor eax, 0x2828d7aa
xor eax, 0xdd5caf97
cmp eax, 0x523efb3b
je 0x1400e1c8d
mov eax, dword [0x1401142ac]
sub eax, dword [0x1401142b0]
or eax, 0x242057d9
mov ecx, 0x33c31b97
xor edx, edx
div ecx
add eax, 0x2d792fe2
cmp eax, 0xe49051b1
jae 0x1400e1c8d
xor eax, eax
mov dword [rbp - 0x4c], eax
jmp 0x1400e1bc7
mov eax, dword [rbp - 0x4c]
mov dword [rbp - 0x50], eax
mov eax, dword [0x1401142b4]
and eax, dword [0x1401142b8]
xor eax, 0x260bb1d6
imul eax, eax, 0xb28b358
add eax, 0x5583b784
cmp eax, 0xc0be39f8
jbe 0x1400e1c92
mov r8d, dword [rbp - 0x50]
mov rdx, qword [rbp - 0x20]
mov rcx, qword [rbp - 0x28]
mov eax, dword [0x1401142bc]
xor eax, dword [0x1401142c0]
sub eax, 0x67e7a76b
add eax, 0x2d8ca339
and eax, 0xf378ba5a
mov dword [rbp - 0x54], eax
sub rsp, 0x20
call fcn.1400e1cb0
mov eax, dword [rbp - 0x54]
add rsp, 0x20
cmp eax, 0x9c462ea2
je 0x1400e1bf4
mov rsp, rbp
pop rbp
ret
mov rcx, qword [rbp - 0x10]
mov r8, qword [rbp - 8]
mov eax, 0x10
mov qword [rbp - 0x60], rax
call fcn.1400ec140
sub rsp, rax
mov rax, qword [rbp - 0x60]
mov rdx, rsp
call fcn.1400ec140
sub rsp, rax
mov rax, rsp
mov qword [rdx], r8
mov qword [rax], rcx
jmp 0x1400e1a6c
mov rax, qword [rbp - 0x30]
mov rcx, qword [rax]
sub rsp, 0x20
call sub.msvcrt.dll_strlen
add rsp, 0x20
jmp 0x1400e1b19
jmp 0x1400e1b93
mov r8d, dword [rbp - 0x50]
mov rdx, qword [rbp - 0x20]
mov rcx, qword [rbp - 0x28]
sub rsp, 0x20
call fcn.1400e1cb0
add rsp, 0x20
jmp 0x1400e1bf4
Function at 0x1400e2230
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov qword [rbp + 0x28], r9
mov qword [rbp + 0x20], r8
mov eax, dword [0x140114344]
and eax, dword [0x140114348]
or eax, 0x48081acd
or eax, 0x4a84458c
sub eax, 0x20da93a4
cmp eax, 0x9c773e44
jb 0x1400e2323
mov r8, qword [rbp - 0x10]
mov r9, qword [rbp - 8]
mov eax, dword [0x14011434c]
mov ecx, dword [0x140114350]
sub eax, ecx
or eax, 0x92882897
xor eax, 0x6cb871ff
add eax, 0x83c08c42
mov dword [rbp - 0x18], eax
mov eax, 0x10
mov qword [rbp - 0x28], rax
call fcn.1400ec140
sub rsp, rax
mov rax, qword [rbp - 0x28]
mov rcx, rsp
call fcn.1400ec140
sub rsp, rax
mov rax, qword [rbp - 0x28]
mov rdx, rsp
call fcn.1400ec140
sub rsp, rax
mov rax, qword [rbp - 0x28]
mov r10, rsp
mov qword [rbp - 0x20], r10
call fcn.1400ec140
sub rsp, rax
mov rax, rsp
mov qword [rcx], r9
mov qword [rdx], r8
lea r8, [rbp + 0x20]
mov qword [rax], r8
mov rcx, qword [rcx]
mov rdx, qword [rdx]
mov r8, qword [rax]
sub rsp, 0x20
call fcn.1400f03f0
mov rcx, qword [rbp - 0x20]
add rsp, 0x20
mov edx, eax
mov eax, dword [rbp - 0x18]
mov dword [rcx], edx
mov ecx, dword [rcx]
mov dword [rbp - 0x14], ecx
cmp eax, 0x1f09ab7a
jb 0x1400e2270
mov eax, dword [rbp - 0x14]
mov rsp, rbp
pop rbp
ret
mov r8, qword [rbp - 0x10]
mov r9, qword [rbp - 8]
mov eax, 0x10
mov qword [rbp - 0x38], rax
call fcn.1400ec140
sub rsp, rax
mov rax, qword [rbp - 0x38]
mov rcx, rsp
call fcn.1400ec140
sub rsp, rax
mov rax, qword [rbp - 0x38]
mov rdx, rsp
call fcn.1400ec140
sub rsp, rax
mov rax, qword [rbp - 0x38]
mov r10, rsp
mov qword [rbp - 0x30], r10
call fcn.1400ec140
sub rsp, rax
mov rax, rsp
mov qword [rcx], r9
mov qword [rdx], r8
lea r8, [rbp + 0x20]
mov qword [rax], r8
mov rcx, qword [rcx]
mov rdx, qword [rdx]
mov r8, qword [rax]
sub rsp, 0x20
call fcn.1400f03f0
add rsp, 0x20
mov ecx, eax
mov rax, qword [rbp - 0x30]
mov dword [rax], ecx
jmp 0x1400e2270
Function at 0x1400eb3a0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.1400f8860
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.1400f8860
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x1400eb410
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x140124cc4]
mov rbx, rcx
test esi, esi
jle 0x1400eb540
mov rax, qword [0x140124cc8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x1400eb45b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x1400eb4e5
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x1400eb440
mov rcx, rbx
call fcn.1400ebe60
mov rdi, rax
test rax, rax
je 0x1400eb562
mov rax, qword [0x140124cc8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.1400ebfa0
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x140124cc8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400eb547
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x1400eb4de
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x1400eb4f0
add dword [0x140124cc4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x140124cc8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400eb4de
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.1400eb3a0
nop dword [rax]
xor esi, esi
jmp 0x1400eb468
mov rax, qword [0x140124cc8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.1400eb3a0
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.1400eb3a0
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x1400ebad0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x140124d20]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140124d00]
test rbx, rbx
je 0x1400ebb2c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x1400ebb23
test rsi, rsi
je 0x1400ebb23
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1400ebb08
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x1400ebe60
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140117c40]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400ebe80
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400ebe88
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400ebe80
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x1400ebedd
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1400ebed4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400ebe80
add rax, 0x28
cmp rax, r9
jne 0x1400ebec0
xor eax, eax
ret

Function at 0x1400ebee0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140117c40]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x1400ebeff
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400ebf08
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x1400ebeff
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x1400ebfa0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140117c40]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x1400ebfbf
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x1400ebfc8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x4157c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41594b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00432400
xorps xmm15, xmm15
mov r14, qword [0x005db558]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x415825
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x415834
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x415853
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x415863
cmp rbx, 0x1000
jae 0x41582b
jmp 0x4158cd
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x415875
xor edx, edx
jmp 0x4158c4
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00432400
xorps xmm15, xmm15
mov r14, qword [0x005db558]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x415859
jmp 0x415848
call fcn.00463e80
xorps xmm15, xmm15
mov r14, qword [0x005db558]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.004364a0
lea rax, [0x004ad251]
mov ebx, 0x18
nop dword [rax]
call fcn.00436d20
mov rax, qword [rsp + 0x38]
call fcn.00436a60
lea rax, [0x004ad559]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00436d20
mov rax, qword [rsp + 0x30]
call fcn.00436a60
call fcn.004366e0
call fcn.00436500
lea rax, [0x004af172]
mov ebx, 0x21
call fcn.00434a00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460760
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004157c0
Function at 0x415980
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x415ba6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00432480
xorps xmm15, xmm15
mov r14, qword [0x005db558]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x4159f3
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x415a02
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x415a25
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x415a35
cmp rbx, 0x1000
jae 0x4159f9
nop
jmp 0x415ab8
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x415a4d
xor esi, esi
jmp 0x415aaa
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00432480
xorps xmm15, xmm15
mov r14, qword [0x005db558]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x415a2b
jmp 0x415a16
call fcn.00463e80
xorps xmm15, xmm15
mov r14, qword [0x005db558]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x415b40
nop dword [rax + rax]
call fcn.004364a0
lea rax, [0x004ad572]
mov ebx, 0x19
call fcn.00436d20
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.00436a60
lea rax, [0x004ad559]
mov ebx, 0x19
call fcn.00436d20
mov eax, dword [rsp + 0x34]
call fcn.00436a60
nop
call fcn.004366e0
call fcn.00436500
lea rax, [0x004aab38]
mov ebx, 0xd
call fcn.00434a00
nop dword [rax + rax]
cmp eax, 0x5af
je 0x415ae0
call fcn.004364a0
lea rax, [0x004ad572]
mov ebx, 0x19
call fcn.00436d20
mov rax, qword [rsp + 0x38]
call fcn.00436a60
lea rax, [0x004ad559]
mov ebx, 0x19
call fcn.00436d20
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.00436a60
call fcn.004366e0
call fcn.00436500
lea rax, [0x004aea51]
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.00434a00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460760
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00415980