joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140072f10
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rsi, r8
mov r14, rdx
mov rbp, rcx
test r8, r8
jg 0x140072f3e
xor eax, eax
jmp 0x140073025
cmp qword [rcx + 0x68], 0
je 0x140072f50
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x140073025
mov rdi, rsi
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
test rax, rax
je 0x140072f90
cmp rax, rsi
mov rbx, rsi
mov rcx, rbp
cmovb rbx, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, rbx
mov rcx, r14
mov rdx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebx
mov rcx, rbp
add r14, rbx
sub rdi, rbx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
cmp qword [rbp + 0x80], 0
je 0x14007301f
mov rcx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const___ptr64]
lea rcx, [rbp + 0x70]
cmp rax, rcx
jne 0x140072fca
mov rdx, qword [rbp + 0x88]
mov rcx, rbp
mov r9, qword [rbp + 0x90]
mov r8, rdx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::setg_char____ptr64__char____ptr64__char____ptr64____ptr64]
mov rcx, rdi
mov ebx, 0xfff
jmp 0x140072ffa
mov r9, qword [rbp + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
add r14, rax
mov rcx, rdi
cmp rax, rbx
jne 0x14007301f
cmp rdi, rbx
ja 0x140072fd4
test rcx, rcx
je 0x14007301f
mov r9, qword [rbp + 0x80]
mov r8, rdi
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
sub rsi, rdi
mov rax, rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140073040
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x14007306a
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x1400730da
mov rsi, rbx
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov rbp, rax
test rbx, rbx
jle 0x1400730d4
test rax, rax
jle 0x1400730b4
cmp rbx, rax
mov rcx, rdi
cmovl rbp, rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, rbp
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebp
mov rcx, rdi
add r14, rbp
sub rbx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
test rbx, rbx
jle 0x1400730d4
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1400730d4
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
sub rsi, rbx
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x140073418
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x14046e3c8]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140073487
cmp byte [rcx + 0x71], 0
je 0x140073487
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1400734dc
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400734a1
sub eax, 1
je 0x1400734a5
cmp eax, 2
jne 0x1400734dc
mov byte [rbx + 0x71], 0
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400106c0
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1400734d3
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1400734dc
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140073489
xor al, al
jmp 0x140073489
Function at 0x140074894
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov rax, qword [rdx + 0x28]
cmp byte [rax], 0x22
je 0x1400748d3
cmp byte [rax], 0x5b
je 0x1400748ce
cmp byte [rax], 0x66
je 0x1400748c9
cmp byte [rax], 0x6e
je 0x1400748c4
cmp byte [rax], 0x74
je 0x1400748bf
cmp byte [rax], 0x7b
jne fcn.1400751a8
jmp fcn.140074dec
jmp fcn.1400749c0
jmp fcn.140074914
jmp fcn.140074a74
jmp fcn.140075004
xor r9d, r9d
jmp fcn.140074b38
Function at 0x14007f644
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1a8
mov rax, qword [0x14046e3c8]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov eax, 0x88
movsxd r13, r9d
mov qword [rsp + 0x20], r8
mov ebp, edx
mov r12, rcx
mov esi, 0x64
sub esi, r13d
lea rcx, [rsp + 0x30]
lea r8d, [rax + 0x40]
add esi, esi
cmp r13d, r8d
cmove esi, eax
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov eax, esi
movsxd r14, esi
cdq
and edx, 7
add eax, edx
sar eax, 3
movsxd r15, eax
xor edi, edi
cmp ebp, esi
jl 0x14007f6e2
mov rcx, rdi
test r15, r15
jle 0x14007f6cc
mov rax, qword [r12 + rcx*8]
xor qword [rsp + rcx*8 + 0x30], rax
inc rcx
cmp rcx, r15
jl 0x14007f6bb
mov edx, 0x18
lea rcx, [rsp + 0x30]
call fcn.14007f784
sub ebp, esi
add r12, r14
jmp 0x14007f6af
movsxd rbx, ebp
lea rcx, [rsp + 0x100]
mov r8, rbx
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
inc ebp
mov byte [rsp + rbx + 0x100], 1
movsxd rax, ebp
lea rcx, [rsp + 0x100]
sub esi, ebp
add rcx, rax
movsxd r8, esi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
or byte [rsp + r14 + 0xff], 0x80
test r15, r15
jle 0x14007f73f
mov rax, qword [rsp + rdi*8 + 0x100]
xor qword [rsp + rdi*8 + 0x30], rax
inc rdi
cmp rdi, r15
jl 0x14007f72a
mov edx, 0x18
lea rcx, [rsp + 0x30]
call fcn.14007f784
mov rcx, qword [rsp + 0x20]
lea rdx, [rsp + 0x30]
mov r8, r13
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1400106c0
add rsp, 0x1a8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400800fc
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x20
mov r9d, 0x270
mov rbx, rcx
cmp dword [rcx], r9d
jne 0x14008014f
lea r8, [rcx + 8]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x140080114
jmp 0x14008015c
cmp dword [rcx], 0x4e0
jb 0x14008015c
call fcn.14008019c
mov eax, dword [rbx]
mov edx, dword [rbx + rax*4 + 4]
inc eax
mov dword [rbx], eax
mov ecx, edx
mov eax, dword [rbx + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 0x20
pop rbx
ret

Function at 0x14008019c
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
lea r10, [rcx + 0x9c4]
mov r9, rcx
mov eax, dword [r10]
mov r11d, 0xe3
lea r8, [r10 + 4]
mov edx, dword [r8]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 - 0x9c0], ecx
lea r10, [r8]
sub r11, 1
jne 0x1400801af
lea r10, [r9 + 0xd50]
mov r11d, 0x18c
mov eax, dword [r10]
lea r8, [r10 + 4]
mov edx, dword [r8]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd4c]
xor ecx, edx
mov dword [r10 - 0x9c0], ecx
lea r10, [r8]
sub r11, 1
jne 0x1400801fa
mov edx, dword [r9 + 0x1380]
xor edx, dword [r9 + 4]
btr edx, 0x1f
xor edx, dword [r9 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
and dword [r9], 0
and ecx, 0x9908b0df
shr edx, 1
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
ret
Function at 0x1400807dc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
call fcn.140013504
mov rdi, rax
cmp byte [rax + 0x10], 0
je 0x140080929
mov ecx, 0x20
call fcn.140010338
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140080828
lea rdx, [rbx + 0x18]
mov rcx, rax
call fcn.140162c4c
nop
mov qword [rbx + 0x38], rax
mov rcx, qword [rbx + 0x10]
call fcn.140013504
lea rdx, [rax + 0xe8]
mov rcx, qword [rbx + 0x38]
call fcn.140162ce8
mov bpl, al
mov ecx, 0xa8
call fcn.140010338
mov qword [rsp + 0x50], rax
lea r14, [rdi + 0x18]
test rax, rax
je 0x140080875
mov r9, qword [rbx + 0x38]
movzx r8d, word [rdi + 0x38]
mov rdx, r14
mov rcx, rax
call fcn.140162a08
nop
mov qword [rbx + 0x28], rax
mov rcx, rax
call fcn.140162b3c
mov esi, eax
mov ecx, eax
test eax, eax
jns 0x140080894
call fcn.140010ab0
movzx ecx, word [rdi + 0x38]
jmp 0x14008089b
lea rax, [0x1404119ce]
neg bpl
sbb r8d, r8d
and r8d, 0xfffffffc
add r8d, 0x24
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
mov r9, qword [r14]
lea rdx, str.HTTP_API
lea rcx, str.e_1_32m__e_0me_1_37m__13se_0me_1__dm_s:_d_e_1_31m_se_0m
call fcn.140012680
test esi, esi
jns 0x1400808d8
mov rcx, rbx
call fcn.140080940
xor al, al
jmp 0x14008092b
mov word [rbx + 0x30], si
mov edx, 1
xor ecx, ecx
lea r8d, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x140080929
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140080929
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [0x140709910], rax
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
mov qword [0x140709918], rcx
mov al, 1
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x140088264
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov edi, 1
mov dword [rbp + 0x30], edi
lea rcx, [rbp + 0x30]
call fcn.14008a510
mov ebx, eax
lea rcx, [0x140709a70]
call fcn.140057914
xchg dword [rax], ebx
test ebx, ebx
jne 0x14008843a
mov ecx, edi
call fcn.140010338
mov qword [rbp + 0x30], rax
lea rcx, [rbp - 0x18]
mov qword [rsp + 0x28], rcx
and dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x14008aa24]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x20], rax
test rax, rax
je 0x140088453
cmp dword [rbp - 0x18], ebx
je 0x140088462
call sub.MSVCP140.dll__Thrd_id
cmp dword [rbp - 0x18], eax
je 0x14008846a
movaps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp - 0x10], xmm0
xor edx, edx
lea rcx, [rbp - 0x10]
call sub.MSVCP140.dll__Thrd_join
test eax, eax
jne 0x140088475
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x20], xmm0
lea ebx, [rdi + 5]
cmp dword [0x14047e668], eax
jbe 0x140088361
lea rdx, str._____________________________________________
mov ecx, ebx
call fcn.1400126bc
cmp dword [0x14047e668], 0
jbe 0x140088361
lea rdx, str._________GhostRider_tuning_results_________
mov ecx, ebx
call fcn.1400126bc
cmp dword [0x14047e668], 0
jbe 0x140088361
lea rdx, str._____________________________________________
mov ecx, ebx
call fcn.1400126bc
lea rsi, str.cn_dark__512_KB_
xor edi, edi
mov r12, rbx
lea rax, [0x140000000]
lea r15, [rax + 0x46ee9c]
lea r14, [rax + 0x46ee98]
cmp dword [0x14047e668], 0
jbe 0x1400883be
movsd xmm0, qword [rdi + rax + 0x46ee90]
movsd qword [rsp + 0x28], xmm0
mov eax, dword [r15 + rdi]
mov dword [rsp + 0x20], eax
mov r9d, dword [r14 + rdi]
mov r8, qword [rsi]
lea rdx, str._24s___ux_u___.2f_h_s
mov ecx, ebx
call fcn.1400126bc
lea rax, [0x140000000]
mov r9d, dword [rdi + rax + 0x46eef8]
lea rcx, [rax + 0x46eefc]
add rcx, rdi
cmp r9d, dword [r14 + rdi]
jne 0x1400883e5
mov eax, dword [r15 + rdi]
cmp dword [rcx], eax
je 0x140088414
lea rax, [0x140000000]
cmp dword [0x14047e668], 0
jbe 0x140088414
movsd xmm0, qword [rdi + rax + 0x46eef0]
movsd qword [rsp + 0x28], xmm0
mov eax, dword [rcx]
mov dword [rsp + 0x20], eax
mov r8, qword [rsi]
lea rdx, str._24s___ux_u___.2f_h_s
mov ecx, ebx
call fcn.1400126bc
add rdi, 0x10
add rsi, 8
sub r12, 1
lea rax, [0x140000000]
jne 0x140088374
cmp dword [rbp - 0x18], 0
je 0x14008843a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
and dword [rbp - 0x18], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov ecx, edi
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
mov ecx, 5
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
mov ecx, 2
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x14008a514
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
mov ecx, reloc.WS2_32.dll_recv
call fcn.140010338
mov r9, rax
test rax, rax
je 0x14008a54d
mov rax, qword [rbx]
mov qword [r9], rax
mov rax, qword [rsi]
mov qword [r9 + 8], rax
jmp 0x14008a550
xor r9d, r9d
mov qword [rsp + 0x40], r9
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
and dword [rsp + 0x20], 0
lea r8, [0x14008a950]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
je 0x14008a58c
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
and dword [rbx], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3

Function at 0x140092030
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [0x14046ef60]
mov edx, 1
mov eax, dword [rsp + 0x40]
cmp ecx, edx
jbe 0x14009207b
mov rax, qword [0x140709ac8]
test rax, rax
je 0x140092076
sub cx, dx
call rax
movzx ecx, ax
mov eax, dword [0x14046ef60]
shl eax, 6
add eax, 0xffffffc0
add eax, ecx
jmp 0x14009207b
mov eax, ecx
shl eax, 6
add rsp, 0x58
ret
Function at 0x1400921c4
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
lea rcx, [0x140425960]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x1400922f7
lea rdx, str.GetActiveProcessorGroupCount
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetActiveProcessorCount
mov rcx, rbx
mov qword [0x140709ac0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetCurrentProcessorNumber
mov rcx, rbx
mov qword [0x140709ac8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetCurrentProcessorNumberEx
mov rcx, rbx
mov qword [0x140709ad0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetThreadGroupAffinity
mov rcx, rbx
mov qword [0x140709ad8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetThreadGroupAffinity
mov rcx, rbx
mov qword [0x140709ae8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetNumaAvailableMemoryNode
mov rcx, rbx
mov qword [0x140709af0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetNumaAvailableMemoryNodeEx
mov rcx, rbx
mov qword [0x140709af8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x140416248]
mov rcx, rbx
mov qword [0x140709b00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32QueryWorkingSetEx
mov rcx, rbx
mov qword [0x140709ae0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VirtualAllocExNuma
mov rcx, rbx
mov qword [0x140709b18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VirtualFreeEx
mov rcx, rbx
mov qword [0x140709b08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140709b10], rax
cmp qword [0x140709b18], 0
jne 0x14009232a
lea rcx, str.psapi.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x14009232a
lea rdx, str.QueryWorkingSetEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140709b18], rax
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.RtlGetVersion
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140709b30], rax
add rsp, 0x20
pop rbx
ret

Function at 0x140092ce4
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 0x40]
jmp qword [sym.imp.KERNEL32.dll_VirtualAlloc]
Function at 0x1400962a8
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x14046e3c8]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r12, rdx
mov r13, r8
lea rdx, [0x140413914]
mov rbx, rcx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
lea rdi, str._dev_stdin
lea rdx, [0x1404120c8]
cmovne rdi, rbx
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rbp, rax
test rax, rax
je 0x1400963d9
lea rdx, [rsp + 0x20]
mov rcx, rdi
mov esi, 0x1000
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
test eax, eax
jne 0x140096335
mov eax, 0x8000
test word [rsp + 0x26], ax
je 0x140096335
mov eax, dword [rsp + 0x34]
inc eax
movsxd rsi, eax
lea rcx, [rsi + 1]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
je 0x1400963d0
mov r9, rbp
mov r8, rsi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov r14, rax
mov byte [rax + rdi], 0
cmp rax, rsi
jne 0x1400963ae
add rsi, rsi
mov rcx, rdi
lea rdx, [rsi + 1]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov r15, rax
test rax, rax
je 0x1400963c7
mov rbx, rsi
lea rcx, [rax + r14]
shr rbx, 1
mov r9, rbp
mov r8, rbx
mov edx, 1
mov rdi, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
mov byte [rdi + r14], 0
cmp rax, rbx
je 0x14009636b
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea rax, [r14 + 1]
mov qword [r12], rdi
mov qword [r13], rax
xor eax, eax
jmp 0x1400963dc
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
or eax, 0xffffffff
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400106c0
mov rbx, qword [rsp + 0xb8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14009bef0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rdi, rdx
mov r12, rcx
mov r15, rdx
sub r15, qword [rcx]
mov rax, qword [rcx + 8]
sub rax, qword [rcx]
sar rax, 4
movabs rsi, 0xfffffffffffffff
cmp rax, rsi
je 0x14009c101
lea r8, [rax + 1]
mov qword [rsp + 0x38], r8
mov rcx, qword [rcx + 0x10]
sub rcx, qword [r12]
sar rcx, 4
mov rdx, rcx
shr rdx, 1
mov rax, rsi
sub rax, rdx
cmp rcx, rax
jbe 0x14009bf6a
mov qword [rsp + 0x98], rsi
mov rcx, 0xfffffffffffffff0
jmp 0x14009bf9c
lea rax, [rdx + rcx]
mov r14, r8
cmp rax, r8
cmovae r14, rax
cmp r14, rsi
ja 0x14009c107
mov rcx, r14
shl rcx, 4
mov rsi, r14
mov qword [rsp + 0x98], r14
cmp rcx, 0x1000
jb 0x14009bfab
call fcn.14000f290
mov rbx, rax
mov qword [rsp + 0x30], rax
jmp 0x14009bfce
test rcx, rcx
je 0x14009bfbf
call fcn.140010338
mov rbx, rax
mov qword [rsp + 0x30], rax
jmp 0x14009bfc6
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x98], r14
and r15, 0xfffffffffffffff0
lea r13, [r15 + rbx]
lea rax, [r13 + 0x10]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0xa8], rax
mov ecx, 0x18
call fcn.140010338
test rax, rax
je 0x14009c00e
mov rcx, qword [rsp + 0xa0]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movsd xmm1, qword [rcx + 0x10]
movsd qword [rax + 0x10], xmm1
mov qword [rsp + 0x48], rax
lea r14, [r13 + 8]
mov qword [rsp + 0x28], r14
and dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x14009c12c]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [r13], rax
test rax, rax
je 0x14009c0f2
mov qword [rsp + 0xa8], r13
mov rcx, qword [r12 + 8]
mov rax, qword [r12]
cmp rdi, rcx
jne 0x14009c07a
mov rdx, rbx
jmp 0x14009c073
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movdqu xmmword [rax], xmm0
movdqu xmmword [rdx], xmm1
lea rdx, [rdx + 0x10]
add rax, 0x10
cmp rax, rcx
jne 0x14009c05d
jmp 0x14009c0cc
mov rcx, rbx
jmp 0x14009c095
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movdqu xmmword [rax], xmm0
movdqu xmmword [rcx], xmm1
lea rcx, [rcx + 0x10]
add rax, 0x10
cmp rax, rdi
jne 0x14009c07f
mov qword [rsp + 0xa8], rbx
mov rax, qword [r12 + 8]
cmp rdi, rax
je 0x14009c0cc
sub r15, rdi
lea rcx, [r15 + rbx]
xorps xmm0, xmm0
movups xmm1, xmmword [rdi]
movdqu xmmword [rdi], xmm0
movdqu xmmword [rdi + rcx + 0x10], xmm1
add rdi, 0x10
cmp rdi, rax
jne 0x14009c0b3
mov r9, rsi
mov r8, qword [rsp + 0x38]
mov rdx, rbx
mov rcx, r12
call fcn.14009bd9c
mov rax, r13
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
and dword [r14], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
call fcn.140012d20
int3
call fcn.140002960
int3