joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c200
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x00584292], 0
jne 0x41c2e7
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x50]
test byte [rdx], al
mov esi, dword [rax + 0x64]
imul rbx, rsi
mov rsi, rbx
shr rbx, 0x20
shr rsi, 0x23
and ebx, 7
mov rdi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], r8b
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x41c2da
lea rbx, [0x00556678]
mov rdx, qword [rbx + rdx*8]
test byte [rdx], al
mov rbx, rcx
shr rbx, 0x10
and ebx, 0x3f
shr rcx, 0xd
and ecx, 7
mov esi, 1
shl esi, cl
shr rax, 0x16
and eax, 0xfffff
mov rax, qword [rdx + rax*8]
test byte [rax], al
movzx edx, byte [rax + rbx + 0x11440]
lea rax, [rax + rbx]
lea rax, [rax + 0x11440]
test sil, dl
jne 0x41c2c0
lock or byte [rax], sil
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1250], rdi
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call sym.runtime.panicIndexU
lea rax, [0x004a5a90]
mov ebx, 0x2c
call sym.runtime.throw
nop
int3

Function at 0x41e5c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41e6c6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x70], rcx
mov byte [rsp + 0x17], dil
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x18], 0
jmp 0x41e603
mov rax, qword [rsp + 0x60]
mov rcx, rdx
mov rbx, qword [rsp + 0x68]
movzx edi, byte [rsp + 0x17]
cmp qword [rsp + 0x18], rbx
jae 0x41e6bb
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call sym.runtime._scavengeIndex_.find
test rax, rax
je 0x41e6bb
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
lea rcx, [sym.runtime._pageAlloc_.scavenge.func1]
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x18]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x20]
mov qword [rsp], rbx
nop dword [rax]
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x005844a8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x70]
nop dword [rax]
test rdx, rdx
jne 0x41e6a9
xor eax, eax
jmp 0x41e6b3
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x70]
test al, al
je 0x41e5f1
mov rax, qword [rsp + 0x18]
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp sym.runtime._pageAlloc_.scavenge
Function at 0x42c680
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x42c906
push rbp
mov rbp, rsp
sub rsp, 0x38
test byte [rax], al
mov rcx, qword [rax + 0x1268]
lea rsi, [rax + 0x1278]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x42c8fa
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x1268], 0
cmp byte [0x00584292], 0
jne 0x42c6da
xor edx, edx
xor ebx, ebx
jmp 0x42c720
xor edx, edx
jmp 0x42c705
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x1278]
mov rax, rcx
call sym.runtime.shade
mov rdx, qword [rsp + 0x28]
inc rdx
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x42c6de
add rax, 0x1268
call sym.runtime._wbBuf_.reset
add rsp, 0x38
pop rbp
ret
inc rdx
nop
cmp rdx, rcx
jge 0x42c894
mov rsi, qword [rax + rdx*8 + 0x1278]
cmp rsi, 0x1000
jb 0x42c71b
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
call sym.runtime.findObject
test rax, rax
jne 0x42c76c
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42c71b
mov rsi, qword [rbx + 0x50]
test byte [rsi], al
mov r8, rcx
shr r8, 3
movzx r9d, byte [rsi + r8]
and ecx, 7
mov r10d, 1
shl r10d, cl
nop
add rsi, r8
test r10b, r9b
je 0x42c7ac
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42c71b
nop
lock or byte [rsi], r10b
mov rcx, qword [rbx + 0x18]
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
nop
nop
nop
cmp r8, 0x40
jae 0x42c8ed
lea r10, [0x00556678]
mov r8, qword [r10 + r8*8]
test byte [r8], al
mov r10, rcx
shr r10, 0x10
and r10d, 0x3f
shr rcx, 0xd
and ecx, 7
mov r11d, 1
shl r11d, cl
shr r9, 0x16
and r9d, 0xfffff
mov r8, qword [r8 + r9*8]
test byte [r8], al
movzx r9d, byte [r8 + r10 + 0x11440]
lea r8, [r8 + r10]
lea r8, [r8 + 0x11440]
test r11b, r9b
jne 0x42c82f
lock or byte [r8], r11b
movzx r8d, byte [rbx + 0x6a]
test r8b, 1
je 0x42c865
mov rax, qword [rsp + 0x48]
mov r8, qword [rax + 0x1250]
add r8, qword [rbx + 0x70]
mov qword [rax + 0x1250], r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42c71b
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x42c8e5
mov rbx, qword [rsp + 0x48]
mov qword [rbx + r8*8 + 0x1278], rax
inc r8
mov rax, rbx
mov rdx, qword [rsp + 0x28]
mov rbx, r8
jmp 0x42c71b
cmp rbx, 0x200
ja 0x42c8d4
lea rdx, [rax + 0x1278]
lea rsi, [rax + 0x1240]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call sym.runtime._gcWork_.putBatch
mov rax, qword [rsp + 0x48]
add rax, 0x1268
call sym.runtime._wbBuf_.reset
add rsp, 0x38
pop rbp
ret
mov rcx, rbx
mov edx, 0x200
nop dword [rax]
call sym.runtime.panicSliceAcap
mov rax, r8
call sym.runtime.panicIndex
mov rax, r8
mov ecx, 0x40
call sym.runtime.panicIndexU
mov edx, 0x200
nop
call sym.runtime.panicSliceAlenU
nop
mov qword [rsp + 8], rax
call sym.runtime.morestackc.abi0
mov rax, qword [rsp + 8]
jmp sym.runtime.wbBufFlush1
Function at 0x441420
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x441587
push rbp
mov rbp, rsp
sub rsp, 0x18
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x441432
cmp edx, ecx
jne 0x441575
nop word [rax + rax]
test rsi, rsi
jne 0x441575
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x441494
nop
call sym.runtime.nanotime1.abi0
xorps xmm15, xmm15
mov r14, qword [0x005844a8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call sym.runtime.updateTimerPMask
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx]
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1b
add edx, ebx
mov esi, edx
and edx, 0xffffffe0
sub ebx, edx
test ebx, ebx
jl 0x441570
mov rdx, qword [0x005314a8]
sar esi, 5
mov rax, rcx
mov ecx, ebx
mov edi, 1
shl edi, cl
movsxd rsi, esi
cmp ecx, 0x20
sbb r8d, r8d
and edi, r8d
cmp rdx, rsi
jbe 0x441565
mov rcx, qword [0x005314a0]
lea rcx, [rcx + rsi*4]
lock or dword [rcx], edi
mov rcx, qword [0x00531f10]
mov qword [rax + 8], rcx
mov rcx, rax
nop
mov qword [0x00531f10], rax
nop
mov edx, 1
lea rsi, [0x00531f18]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1228]
shr rdx, 0x3d
test dl, dl
jne 0x441553
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
nop
nop
xchg qword [rcx + 0x1228], rdx
add rsp, 0x18
pop rbp
ret
lea rax, [0x004a52d5]
mov ebx, 0x28
nop
call sym.runtime.throw
mov rax, rsi
mov rcx, rdx
call sym.runtime.panicIndex
call sym.runtime.panicshift
lea rax, [0x004a4685]
mov ebx, 0x23
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.runtime.pidleput
Function at 0x453600
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4536af
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [sym.runtime.callers.func1]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x005844a8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp sym.runtime.callers

Function at 0x45cbe0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x0058428b], 0
je 0x45cbee
jmp sym.aeshashbody
jmp sym.runtime.memhashFallback

Function at 0x45cc00
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x0058428b], 0
je 0x45cc15
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp sym.aeshashbody
jmp sym.runtime.strhashFallback

Function at 0x45cc20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x0058428b], 0
je 0x45cc55
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x00584800]
aesenc xmm0, xmmword [0x00584810]
aesenc xmm0, xmmword [0x00584820]
movq rax, xmm0
ret
jmp sym.runtime.memhash32Fallback

Function at 0x45cc60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x0058428b], 0
je 0x45cc96
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x00584800]
aesenc xmm0, xmmword [0x00584810]
aesenc xmm0, xmmword [0x00584820]
movq rax, xmm0
ret
jmp sym.runtime.memhash64Fallback

Function at 0x45e560
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov rdx, 2
jmp sym.sigtramp

Function at 0x45e960
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x45e994
mov rcx, 0x28
jmp 0x45e99f
shl rcx, 3
add rcx, 0x1480
mov qword [0x005844a8], rcx
pop rbp
ret
Function at 0x474020
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4740ea
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x005844a8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x4740cf
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x0048baa0]
xor ebx, ebx
mov rcx, rdx
call sym.runtime.makeslice
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call sym.syscall.encodeWTF16
inc rbx
cmp rcx, rbx
jae 0x4740be
mov edi, 1
lea rsi, [0x0048baa0]
call sym.runtime.growslice
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x004bf258]
lea rsi, [0x004beba8]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.syscall.UTF16FromString
Function at 0x140025450
Capabilities:
Log keystrokes

Disassembly:
push rbx
sub rsp, 0x20
movzx ebx, cx
mov eax, ebx
cmp ebx, 0x11c
ja 0x14002552e
je 0x140025526
sub eax, 0x1d
cmp eax, 0x36
ja case.0x140025553.286
lea rdx, [0x140000000]
cdqe
movzx eax, byte [rdx + rax + 0x25624]
mov ecx, dword [rdx + rax*4 + 0x255d8]
add rcx, rdx
jmp rcx
mov al, 0xa0
add rsp, 0x20
pop rbx
ret
mov al, 0xa2
add rsp, 0x20
pop rbx
ret
mov al, 0xa4
add rsp, 0x20
pop rbx
ret
mov al, 0x6a
add rsp, 0x20
pop rbx
ret
mov al, 0x6d
add rsp, 0x20
pop rbx
ret
mov al, 0x6b
add rsp, 0x20
pop rbx
ret
mov al, 0x2e
add rsp, 0x20
pop rbx
ret
mov al, reloc.WSOCK32.dll_ioctlsocket
add rsp, 0x20
pop rbx
ret
mov al, 0x2d
add rsp, 0x20
pop rbx
ret
mov al, 0x26
add rsp, 0x20
pop rbx
ret
mov al, 0x28
add rsp, 0x20
pop rbx
ret
mov al, 0x25
add rsp, 0x20
pop rbx
ret
mov al, 0x27
add rsp, 0x20
pop rbx
ret
mov al, 0x24
add rsp, 0x20
pop rbx
ret
mov al, reloc.OLEAUT32.dll_SafeArrayAllocDescriptor
add rsp, 0x20
pop rbx
ret
mov al, 0x21
add rsp, 0x20
pop rbx
ret
mov al, SafeArrayAllocDescriptor
add rsp, 0x20
pop rbx
ret
mov al, reloc.WSOCK32.dll_send
add rsp, 0x20
pop rbx
ret
mov al, 0xd
add rsp, 0x20
pop rbx
ret
sub eax, 0x11d
cmp eax, 0x40
ja case.0x140025553.286
lea rdx, [0x140000000]
cdqe
movzx eax, byte [rdx + rax + 0x25684]
mov ecx, dword [rdx + rax*4 + 0x2565c]
add rcx, rdx
jmp rcx
mov al, 0xa1
add rsp, 0x20
pop rbx
ret
mov al, 0xa3
add rsp, 0x20
pop rbx
ret
mov al, 0xa5
add rsp, 0x20
pop rbx
ret
mov al, 0x5b
add rsp, 0x20
pop rbx
ret
mov al, 0x5c
add rsp, 0x20
pop rbx
ret
mov al, 0x90
add rsp, 0x20
pop rbx
ret
mov al, reloc.WSOCK32.dll_WSAGetLastError
add rsp, 0x20
pop rbx
ret
mov al, 0x5d
add rsp, 0x20
pop rbx
ret
mov al, 0x2c
add rsp, 0x20
pop rbx
ret
bt bx, 8
jae 0x1400255bc
movzx ecx, bl
mov edx, 1
or ecx, 0xe000
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
test eax, eax
jne 0x1400255d0
movzx ecx, bl
mov edx, 1
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_MapVirtualKeyW]
add rsp, 0x20
pop rbx
ret
hlt
cmp byte [rsi - 0xa297dcd], 0xf4
or byte [rsi - 0x4bee4ea1], 0x9c
cdq
nop
push rdi
mov dh, 0x71
or esp, dword [rax - 0x119a773b]
jg 0x1402114a2
sub byte [rsi + 7], 0x7a
fidivr dword [rcx + 0x51]
jmp 0x1a3d368c6
jne 0x1402115dd
mov r12d, 0x9f3c76e2
mov ecx, 0x998fdf1d
mov fs, word [rdi]
mov ah, 0x9e
fmul dword [rbx - 0x5f]
enter 0xffffffffffffa267, 0xffffffffffffff8a
jl 0x140211504
xor eax, 0x6c218705
mov dword [rsi], eax
invalid
cld
cmp eax, 0xe4347434
or ah, byte [0x1b8db6dbb]
invalid
enter 0xfffffffffffff1fb, 0xffffffffffffffe0
or dword [rdi + 0x35], ebx
push rsi
invalid
or dl, bl
fadd dword [rbp - 0x14c1117f]
invalid
movabs eax, dword [0x741ec2470ead50a0]
js 0x140211608
push rax
lodsd eax, dword [rsi]
invalid
rcl dword [rsi + rbx*4], cl
imul eax, dword [rsp + rbx*2], 0xffffffbd
invalid
invalid
mov ebp, 0x1a4caf84
mov bl, 0x1e
xchg r15d, eax
std
js 0x1402115c6
invalid
fcomp qword [rbx]
mov ch, 0x1e
in al, 0xb3
invalid
and dword [rbp + 0x540899c0], 0xc729c7ac
push rdi
invalid
rcr byte [rcx - 0x3853abf8], 0x29
invalid
Function at 0x1400cf2d0
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x270
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x1400cf3c2
cmp word [rcx], 0
je 0x1400cf3c2
mov r8d, 4
lea rdx, str.__
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
test eax, eax
je 0x1400cf315
mov rax, rbx
mov r8, rbx
jmp 0x1400cf321
lea rax, [rbx + 8]
mov r8, rax
test rax, rax
je 0x1400cf360
movzx edx, word [rax]
test dx, dx
je 0x1400cf360
mov r9d, 0x3f
nop
lea rcx, [0x140110218]
movzx eax, r9w
nop dword [rax + rax]
cmp dx, ax
je 0x1400cf387
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x1400cf340
movzx edx, word [r8 + 2]
add r8, 2
test dx, dx
jne 0x1400cf330
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test rdi, rdi
je 0x1400cf370
mov dword [rdi], eax
cmp eax, 0xffffffff
setne al
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x1400cf3c2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
test rdi, rdi
je 0x1400cf3af
mov eax, dword [rsp + 0x20]
mov dword [rdi], eax
mov al, 1
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
mov rbx, qword [rsp + 0x280]
xor al, al
add rsp, 0x270
pop rdi
ret

Function at 0x1400cfb00
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x10020
call fcn.1400ecec0
sub rsp, rax
mov rdi, rdx
lea rcx, str.ComSpec
lea rdx, [rsp + 0x20]
mov r8d, 0x7fff
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebx, eax
test eax, eax
je 0x1400cfb5b
lea r8d, [rax + 1]
mov rcx, rdi
add r8, r8
lea rdx, [rsp + 0x20]
call sub.VCRUNTIME140.dll_memcpy
mov eax, ebx
mov rbx, qword [rsp + 0x10030]
add rsp, 0x10020
pop rdi
ret
xor eax, eax
mov word [rdi], ax
mov eax, ebx
mov rbx, qword [rsp + 0x10030]
add rsp, 0x10020
pop rdi
ret
Function at 0x140756580
Capabilities:
Encode data using xor

Disassembly:
jmp 0x14075658a
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x1407565b3
pop rbp
sub rbp, 0x33
sub rbp, 0x756580
sub rsp, 0x20
jmp 0x1407565d2
mov rax, 0x756580
add rax, rbp
add rax, 0x84
mov rcx, 0x647
mov rdx, 0xffffffffe1c883a2
xor byte [rax], dl
inc rax
dec rcx
jne 0x1407565f1
jmp 0x140756608
invalid
Function at 0x100088934
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xf0
mov qword [rsp + 0xd0], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rax, qword [0x100152198]
xor rax, rsp
mov qword [rsp + 0xe8], rax
mov rbp, r8
mov qword [rsp + 0x58], r8
mov rsi, rcx
mov qword [rsp + 0x88], rcx
lea rdx, [0x100153eb8]
mov eax, 5
mov rcx, qword [0x100153eb8]
cmp rcx, rdx
je 0x1000889c1
test byte [rcx + 0x1c], 1
je 0x1000889c1
cmp byte [rcx + 0x19], al
jb 0x1000889c1
mov rax, qword [r8]
mov edx, 0x36
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [0x10001e3b0]
mov rcx, qword [rcx + 0x10]
call fcn.100087218
xor r14d, r14d
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x90], r14
mov dword [rsp + 0x44], r14d
mov bl, r14b
mov byte [rsp + 0x40], bl
mov dword [rsp + 0x70], r14d
lea rdx, [rsp + 0x90]
mov rcx, qword [0x100158688]
call fcn.10003e044
mov r13d, eax
lea r12d, [r14 + 2]
mov rdi, qword [rsp + 0x90]
cmp eax, r14d
jl 0x100088e2e
lea rcx, [rsi + 0x50]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [rsp + 0x70], 1
lea r14, [rsi + 0x1e8]
mov qword [rsp + 0xb0], r14
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [rsp + 0xb8], 1
lea r15, [rsi + 0x1a0]
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x80]
mov rdx, qword [rbp]
mov rcx, r15
call fcn.10008bc04
test rax, rax
je 0x100088dab
mov rbp, qword [rax + 8]
and qword [rsp + 0x68], 0
and dword [rsp + 0x50], 0
mov rcx, qword [rbp]
mov rax, qword [rcx]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x68]
call qword [rax + 0x38]
mov ebx, eax
mov r10, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp r10, rax
je 0x100088b02
test byte [r10 + 0x1c], 4
je 0x100088b09
movzx edx, byte [r10 + 0x19]
mov ecx, r12d
test ebx, ebx
invalid
invalid
Function at 0x140001060
Capabilities:
Terminate process

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x430
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x420], rax
movsxd rbx, ecx
mov r15, rdx
xor ecx, ecx
call qword [sym.imp.libraw.dll_libraw_init]
mov rdi, rax
test rax, rax
jne 0x1400010b6
lea ecx, [rax + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Cannot_create_libraw_handle_n
call fcn.140001010
lea ecx, [rdi + 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [rsp + 0x450], rbp
mov qword [rsp + 0x460], rsi
mov qword [rsp + 0x468], r14
mov r14, rbx
mov dword [rax + 0x1428], 1
cmp rbx, 1
jle 0x140001217
mov esi, 1
nop word [rax + rax]
mov rdx, qword [r15 + rsi*8]
mov rcx, rdi
call qword [sym.imp.libraw.dll_libraw_open_file]
test eax, eax
je 0x140001132
mov ecx, eax
call qword [sym.imp.libraw.dll_libraw_strerror]
mov ecx, 2
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, qword [r15 + rsi*8]
lea rdx, str._s:_libraw___s_n
mov rcx, rax
mov r9, rbx
call fcn.140001010
jmp 0x14000120b
mov rdx, qword [r15 + rsi*8]
lea r9, [rdi + 0x104]
lea r8, [rdi + 0xc4]
lea rcx, str.Processing__s___s__s__n
call fcn.140001270
mov rcx, rdi
call qword [sym.imp.libraw.dll_libraw_unpack]
test eax, eax
jne 0x140001101
mov rcx, rdi
call qword [sym.imp.libraw.dll_libraw_dcraw_process]
test eax, eax
jne 0x140001101
mov rax, qword [r15 + rsi*8]
lea rdx, [rsp + 0x20]
sub rdx, rax
nop word [rax + rax]
movzx ecx, byte [rax]
mov byte [rdx + rax], cl
lea rax, [rax + 1]
test cl, cl
jne 0x140001180
lea rcx, [rsp + 0x20]
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140001196
mov eax, dword [str..ppm]
lea rdx, [rsp + 0x20]
mov dword [rcx], eax
movzx eax, byte [0x1400032bc]
mov byte [rcx + 4], al
lea rcx, str.Writing_to__s_n
call fcn.140001270
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.libraw.dll_libraw_dcraw_ppm_tiff_writer]
mov ebp, eax
test eax, eax
je 0x14000120b
mov ecx, eax
call qword [sym.imp.libraw.dll_libraw_strerror]
mov ecx, 2
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, qword [r15 + rsi*8]
lea rdx, str._s:_libraw___s_n
mov rcx, rax
mov r9, rbx
call fcn.140001010
cmp ebp, 0xfffe7960
jl 0x140001256
inc rsi
cmp rsi, r14
jl 0x1400010f0
mov rcx, rdi
call qword [sym.imp.libraw.dll_libraw_close]
mov rsi, qword [rsp + 0x460]
xor eax, eax
mov rbp, qword [rsp + 0x450]
mov r14, qword [rsp + 0x468]
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.140001360
add rsp, 0x430
pop r15
pop rdi
pop rbx
ret
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x140001c20
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001c6a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001c6a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001c6a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001c6a
cmp dword [rcx + 0x84], 0xe
jbe 0x140001c6a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001c6c
xor al, al
add rsp, 0x28
ret