joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140040830
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x40
xor ebp, ebp
lea r9, [rsp + 0x68]
mov r14, rcx
mov dword [rsp + 0x68], ebp
xor r8d, r8d
xor edx, edx
mov ebx, ebp
lea ecx, [rbp + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x1400408ae
nop
test rbx, rbx
je 0x140040876
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x68]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rsp + 0x68]
lea r9, [rsp + 0x68]
mov rdx, rax
mov ecx, 0xb
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x140040860
test eax, eax
jns 0x1400408d3
test rbx, rbx
je 0x1400408d8
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
add rsp, 0x40
pop r14
pop rbp
pop rbx
ret
test rbx, rbx
jne 0x1400408e3
xor eax, eax
add rsp, 0x40
pop r14
pop rbp
pop rbx
ret
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x70], rdi
mov edi, ebp
cmp dword [rbx], ebp
jbe 0x1400409b4
nop word [rax + rax]
mov esi, edi
lea rdx, [rbx + 0x30]
imul rax, rsi, 0x128
mov qword [rsp + 0x20], rbp
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], 0xf
movzx ecx, word [rax + rbx + 0x2e]
add rcx, rax
add rdx, rcx
inc r8
cmp byte [rdx + r8], bpl
jne 0x140040932
lea rcx, [rsp + 0x20]
call fcn.140003f70
cmp qword [r14 + 0x18], 0x10
mov rdx, r14
jb 0x140040952
mov rdx, qword [r14]
cmp qword [rsp + 0x38], 0x10
lea rcx, [rsp + 0x20]
cmovae rcx, qword [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x1400409da
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400409aa
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400409a5
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140040a2b
call fcn.1400539ec
inc edi
cmp edi, dword [rbx]
jb 0x140040900
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rbp
pop rbx
ret
imul rax, rsi, 0x128
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
mov rdi, qword [rax + rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140040a37
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040a32
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140040a32
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400539ec
mov rax, rdi
jmp 0x1400409c7
Function at 0x140040b90
Capabilities:
Execute command

Disassembly:
push rbx
sub rsp, 0x50
call fcn.140038890
mov rcx, rax
mov rbx, rax
call fcn.14003e330
test rax, rax
jne 0x140040bcb
mov rcx, rbx
call fcn.140039fd0
mov rcx, rbx
call fcn.14003b0f0
mov rcx, rbx
call fcn.14003a730
mov rcx, rbx
call fcn.1400395d0
mov rcx, rbx
call fcn.1400395d0
lea rcx, [0x1400cad84]
add rsp, 0x50
pop rbx
jmp qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]

Function at 0x140040bf0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
xor r8d, r8d
mov dword [rbp - 0x30], 0xf870f86
mov eax, r8d
mov dword [rbp - 0x2c], 0xf810ff2
mov dword [rbp - 0x28], 0xf8b0f98
mov edx, 0xfda
mov dword [rbp - 0x24], 0xfb10fb8
mov dword [rbp - 0x20], 0xfbc0fa6
mov dword [rbp - 0x1c], 0xfd70f82
mov dword [rbp - 0x18], 0xf900f87
mov dword [rbp - 0x14], 0xf9a0f9a
mov dword [rbp - 0x10], 0xfdc0faf
mov dword [rbp - 0xc], 0xfda0f88
mov dword [rbp - 8], 0xfbe
mov byte [rbp - 4], 1
nop word [rax + rax]
lea ecx, [rdx + rax]
xor word [rbp + rax*2 - 0x30], cx
inc rax
cmp rax, 0x15
jb 0x140040c60
mov qword [rsp + 0x30], r8
lea rcx, [rbp - 0x30]
mov dword [rsp + 0x28], r8d
xor r9d, r9d
mov byte [rbp - 4], r8b
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1400fb818], rax
dec rax
cmp rax, 0xfffffffffffffffd
setbe al
add rsp, 0x70
pop rbp
ret

Function at 0x140040cc0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x260
xor edx, edx
mov rdi, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140040d24
nop dword [rax + rax]
mov rdx, rdi
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov rcx, rbx
test eax, eax
je 0x140040d44
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140040d00
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1400fb814]
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
mov rbx, qword [rsp + 0x270]
mov dword [0x1400fb814], eax
add rsp, 0x260
pop rdi
ret
Function at 0x140040d70
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x80
mov rsi, rcx
mov ebx, r8d
mov rcx, qword [0x1400fb838]
mov rdi, rdx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x140040da6
lea ecx, [rax - 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov eax, dword [0x1400fb814]
lea r8, [rsp + 0x40]
xor ecx, ecx
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], rcx
mov eax, 0x999fcf6c
mov qword [rsp + 0x30], rcx
mov edx, 0x3727e64
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x70], rax
lea r9d, [rcx + 0x40]
movabs rax, 0x1001fcf9c
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x44], ecx
mov rcx, qword [0x1400fb818]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], 0x85ccc4c
mov qword [rsp + 0x68], 0x85dfc6c
call qword [0x1400fbbb0]
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140045d50
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 0x18], r8
push rbp
lea rbp, [rax - 0xc8]
sub rsp, 0x1c0
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
movaps xmmword [rax - 0x48], xmm9
mov rbx, r8
mov rsi, rcx
movsxd rax, edx
lea rdx, [rax + rax*2]
shl rdx, 4
add rdx, qword [r8 + 0x10]
lea rcx, [rbp]
call fcn.140052650
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rbp - 0x60], xmm0
mov rdi, qword [rbx + 8]
add rdi, 0x250
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
xorps xmm1, xmm1
movups xmmword [rbp - 0x30], xmm1
movups xmmword [rbp - 0x20], xmm0
mov rcx, qword [0x1400fb838]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x140045df1
lea ecx, [rax - 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor ecx, ecx
mov dword [rsp + 0x44], ecx
mov qword [rsp + 0x48], rdi
lea rax, [rbp - 0x40]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0x30
mov eax, dword [0x1400fb814]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x60], 0x85ccc4c
mov qword [rsp + 0x68], 0x85dfc6c
mov eax, 0x999fcf6c
mov qword [rsp + 0x70], rax
movabs rax, 0x1001fcf9c
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rcx
lea r9d, [rcx + 0x40]
lea r8, [rsp + 0x40]
mov edx, 0x3727e64
mov rcx, qword [0x1400fb818]
call qword [0x1400fbbb0]
movups xmm0, xmmword [rbp - 0x40]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rbp - 0x30]
movups xmmword [rbp + 0x10], xmm1
movups xmm0, xmmword [rbp - 0x20]
movups xmmword [rbp + 0x20], xmm0
lea rdx, [rbp - 0x40]
lea rcx, [rbp]
call fcn.1400453e0
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
movups xmm8, xmmword [rax + 0x20]
movups xmm9, xmmword [rax + 0x30]
lea rdx, [rbp]
lea rcx, [rbp - 0x80]
call fcn.1400453e0
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x50], xmm7
movaps xmmword [rsp + 0x60], xmm8
movaps xmmword [rsp + 0x70], xmm9
movups xmm0, xmmword [rax]
movaps xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rbp - 0x70], xmm1
movups xmm0, xmmword [rax + 0x20]
movaps xmmword [rbp - 0x60], xmm0
movups xmm1, xmmword [rax + 0x30]
movaps xmmword [rbp - 0x50], xmm1
lea r8, [rsp + 0x40]
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x40]
call fcn.140045560
movups xmm1, xmmword [rax + 0x30]
movss dword [rsi], xmm1
movaps xmm0, xmm1
shufps xmm0, xmm1, 0x55
movss dword [rsi + 4], xmm0
shufps xmm1, xmm1, 0xaa
movss dword [rsi + 8], xmm1
mov rcx, rbx
call fcn.140045970
mov rax, rsi
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
mov rsp, r11
pop rbp
ret
Function at 0x14004a230
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x1040
call fcn.140054af0
sub rsp, rax
mov rdi, rcx
mov ebx, edx
mov rcx, qword [0x1400fb7e8]
mov eax, edx
sar eax, 0x10
add rcx, 0xa56bfc0
lea r8d, [rax*8 + 0x10]
add rcx, r8
call fcn.140052760
movzx edx, bx
lea rcx, [rsp + 0x830]
mov r8d, 0x808
lea rbx, [rax + rdx*4]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x808
lea rdx, [rsp + 0x830]
mov rcx, rbx
call fcn.140040d70
lea rcx, [rsp + 0x20]
mov r8d, 0x808
lea rdx, [rsp + 0x830]
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [0x1400fb738]
call fcn.140052760
mov qword [rsp + 0x1050], rax
mov ecx, 0x16d
movzx eax, word [rsp + 0x834]
xor r10d, r10d
shr ax, 1
cmp ax, cx
ja 0x14004a325
movzx r9d, r10w
cmp r10w, ax
jae 0x14004a325
movzx ecx, r9w
lea r8, [rsp + 0x26]
add r8, rcx
movzx ecx, r9b
and ecx, 3
inc r9w
movzx edx, byte [rsp + rcx + 0x1050]
xor dl, byte [r8]
xor dl, al
mov byte [r8], dl
movzx eax, word [rsp + 0x24]
shr ax, 1
cmp r9w, ax
jb 0x14004a2f0
mov qword [rdi], r10
lea rax, [rsp + 0x26]
mov qword [rdi + 0x10], r10
mov r8, 0xffffffffffffffff
mov qword [rdi + 0x18], 0xf
mov byte [rdi], r10b
inc r8
cmp byte [rax + r8], r10b
jne 0x14004a343
lea rdx, [rsp + 0x26]
mov rcx, rdi
call fcn.140003f70
mov rbx, qword [rsp + 0x1058]
mov rax, rdi
add rsp, 0x1040
pop rdi
ret
Function at 0x14004f2d0
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
cmp byte [0x1400fbcb1], 0
je 0x14004f4ed
mov qword [rsp + 0xd8], rbx
xor ebx, ebx
mov ecx, ebx
mov dword [rbp - 9], 0x92909a8c
mov dword [rbp - 5], 0xb5ae9e8c
mov dword [rbp - 1], 0x100c3c2
nop dword [rax]
lea eax, [rcx - 0x26]
xor byte [rbp + rcx - 9], al
inc rcx
cmp rcx, 0xa
jb 0x14004f310
lea rdx, [rbp - 9]
mov byte [rbp + 2], bl
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov edx, 0x7f00
mov dword [rbp + 7], 0x50
mov qword [0x1400fb838], rax
xor ecx, ecx
lea rax, [0x14004ea10]
mov dword [rbp + 0xb], 3
mov qword [rbp + 0xf], rax
mov qword [rbp + 0x17], rbx
mov qword [rbp + 0x1f], rbx
call qword [sym.imp.USER32.dll_LoadIconW]
mov edx, 0x7f00
xor ecx, ecx
mov qword [rbp + 0x27], rax
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [rbp + 0x2f], rax
xorps xmm0, xmm0
mov edx, 0x7f00
movdqa xmmword [rbp + 0x37], xmm0
lea rax, [0x1400cb948]
xor ecx, ecx
mov qword [rbp + 0x47], rax
call qword [sym.imp.USER32.dll_LoadIconW]
lea rcx, [rbp + 7]
mov qword [rbp + 0x4f], rax
call qword [sym.imp.USER32.dll_RegisterClassExA]
mov rcx, qword [0x1400fb838]
test rcx, rcx
je 0x14004f4f6
lea rdx, [0x1400fb828]
call qword [sym.imp.USER32.dll_GetClientRect]
mov rcx, qword [0x1400fb838]
lea rdx, [rbp + 0x67]
call qword [sym.imp.USER32.dll_ClientToScreen]
mov eax, dword [rbp + 0x67]
lea r8, str.ft4lswrt
movd xmm1, dword [0x1400fb834]
lea rdx, str.ft4lswrt
movd xmm2, dword [0x1400fb830]
mov r9d, 0x90000000
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
cvtdq2ps xmm1, xmm1
mov dword [0x1400fb828], eax
mov eax, dword [rbp + 0x6b]
mov dword [0x1400fb82c], eax
cvtdq2ps xmm2, xmm2
movss dword [0x1400fb7fc], xmm1
subss xmm1, dword [0x1400cbdd0]
movss dword [0x1400fb70c], xmm2
subss xmm2, dword [0x1400cbdd0]
cvttss2si ecx, xmm1
cvttss2si eax, xmm2
mov dword [rsp + 0x38], ecx
mov ecx, 0x80028
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov edx, 0xffffffec
mov r8d, 0x800a0
mov rcx, rax
mov qword [0x1400fbce8], rax
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov rcx, qword [0x1400fbce8]
mov r9d, 2
mov r8b, 0xff
xor edx, edx
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
movdqa xmm0, xmmword [0x1400cbfd0]
lea rdx, [rbp - 9]
mov rcx, qword [0x1400fbce8]
movdqu xmmword [rbp - 9], xmm0
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov rcx, qword [0x1400fbce8]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1400fbce8]
call qword [sym.imp.USER32.dll_UpdateWindow]
call fcn.14004eeb0
mov rbx, qword [rsp + 0xd8]
add rsp, 0xc0
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x140050a50
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
xor edx, edx
cmp byte [rcx + 0x45], dl
je 0x140050a84
mov r8d, edx
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 - 0x26]
xor byte [r8 + rcx], al
inc r8
cmp r8, 0x44
jb 0x140050a70
mov byte [rcx + 0x45], dl
lea rax, [rcx + 0x44]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 0xf
mov byte [rbx], dl
cmp rcx, rax
je 0x140050aaf
mov rdx, rcx
mov r8d, 0x44
mov rcx, rbx
call fcn.140003f70
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x140050ac0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
xor edx, edx
cmp byte [rcx + 0x43], dl
je 0x140050af4
mov r8d, edx
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 - 0x26]
xor byte [r8 + rcx], al
inc r8
cmp r8, 0x42
jb 0x140050ae0
mov byte [rcx + 0x43], dl
lea rax, [rcx + 0x42]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 0xf
mov byte [rbx], dl
cmp rcx, rax
je 0x140050b1f
mov rdx, rcx
mov r8d, 0x42
mov rcx, rbx
call fcn.140003f70
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x140050b30
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
xor edx, edx
cmp byte [rcx + 0x41], dl
je 0x140050b64
mov r8d, edx
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 - 0x26]
xor byte [r8 + rcx], al
inc r8
cmp r8, 0x40
jb 0x140050b50
mov byte [rcx + 0x41], dl
lea rax, [rcx + 0x40]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 0xf
mov byte [rbx], dl
cmp rcx, rax
je 0x140050b8f
mov rdx, rcx
mov r8d, 0x40
mov rcx, rbx
call fcn.140003f70
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x140052580
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x80
mov rbx, rcx
xorps xmm0, xmm0
mov rcx, qword [0x1400fb838]
movss dword [rsp + 0x98], xmm0
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x1400525b3
lea ecx, [rax - 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor ecx, ecx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x38], rcx
lea rax, [rsp + 0x98]
mov qword [rsp + 0x50], rax
lea r8, [rsp + 0x40]
mov eax, dword [0x1400fb814]
mov edx, 0x3727e64
mov qword [rsp + 0x30], rcx
lea r9d, [rcx + 0x40]
mov dword [rsp + 0x40], eax
mov eax, 0x999fcf6c
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x70], rax
movabs rax, 0x1001fcf9c
mov dword [rsp + 0x44], ecx
mov qword [rsp + 0x20], rcx
mov rcx, qword [0x1400fb818]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x58], 4
mov qword [rsp + 0x60], 0x85ccc4c
mov qword [rsp + 0x68], 0x85dfc6c
call qword [0x1400fbbb0]
movss xmm0, dword [rsp + 0x98]
add rsp, 0x80
pop rbx
ret
Function at 0x140052650
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xb0
xorps xmm0, xmm0
mov rbx, rcx
mov rcx, qword [0x1400fb838]
xorps xmm1, xmm1
movups xmmword [rsp + 0x40], xmm0
mov rdi, rdx
movups xmmword [rsp + 0x50], xmm1
movups xmmword [rsp + 0x60], xmm0
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x140052693
lea ecx, [rax - 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor ecx, ecx
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x38], rcx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x80], rax
lea r8, [rsp + 0x70]
mov eax, dword [0x1400fb814]
mov edx, 0x3727e64
mov qword [rsp + 0x30], rcx
lea r9d, [rcx + 0x40]
mov dword [rsp + 0x70], eax
mov eax, 0x999fcf6c
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0xa0], rax
movabs rax, 0x1001fcf9c
mov dword [rsp + 0x74], ecx
mov qword [rsp + 0x20], rcx
mov rcx, qword [0x1400fb818]
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0x88], 0x30
mov qword [rsp + 0x90], 0x85ccc4c
mov qword [rsp + 0x98], 0x85dfc6c
call qword [0x1400fbbb0]
movups xmm0, xmmword [rsp + 0x40]
mov rax, rbx
movups xmm1, xmmword [rsp + 0x50]
movups xmmword [rbx], xmm0
movups xmm0, xmmword [rsp + 0x60]
movups xmmword [rbx + 0x10], xmm1
movups xmmword [rbx + 0x20], xmm0
mov rbx, qword [rsp + 0xc0]
add rsp, 0xb0
pop rdi
ret

Function at 0x140052760
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
mov rbx, rcx
xor edi, edi
mov rcx, qword [0x1400fb838]
mov qword [rsp + 0x98], rdi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x140052795
lea ecx, [rdi - 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [0x1400fb818]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x50], rax
lea r8, [rsp + 0x40]
mov eax, dword [0x1400fb814]
mov r9d, 0x40
mov dword [rsp + 0x40], eax
mov edx, 0x3727e64
mov qword [rsp + 0x38], rdi
mov eax, 0x999fcf6c
mov qword [rsp + 0x70], rax
movabs rax, 0x1001fcf9c
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x58], 8
mov qword [rsp + 0x60], 0x85ccc4c
mov qword [rsp + 0x68], 0x85dfc6c
mov qword [rsp + 0x20], rdi
call qword [0x1400fbbb0]
mov rax, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret
Function at 0x140052840
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
mov rbx, rcx
xor edi, edi
mov rcx, qword [0x1400fb838]
mov qword [rsp + 0x98], rdi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x140052875
lea ecx, [rdi - 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [0x1400fb818]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x50], rax
lea r8, [rsp + 0x40]
mov eax, dword [0x1400fb814]
mov r9d, 0x40
mov dword [rsp + 0x40], eax
mov edx, 0x3727e64
mov qword [rsp + 0x38], rdi
mov eax, 0x999fcf6c
mov qword [rsp + 0x70], rax
movabs rax, 0x1001fcf9c
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x58], 8
mov qword [rsp + 0x60], 0x85ccc4c
mov qword [rsp + 0x68], 0x85dfc6c
mov qword [rsp + 0x20], rdi
call qword [0x1400fbbb0]
mov r8, qword [rsp + 0x98]
movabs rax, 0xffffffff00000000
mov rcx, r8
movabs rdx, 0xffffff8000000000
and rcx, rax
movabs r9, 0xffffff7fffffffff
lea rax, [rcx + rdx]
test r9, rax
jne 0x140052948
add rdx, rcx
mov rcx, r8
and ecx, 0xffffff
add rcx, qword [0x1400fb800]
test r9, rdx
cmove r8, rcx
mov rbx, qword [rsp + 0x90]
mov rax, r8
add rsp, 0x80
pop rdi
ret

Function at 0x140052960
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
mov rbx, rcx
xor edi, edi
mov rcx, qword [0x1400fb838]
mov dword [rsp + 0x98], edi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x140052994
lea ecx, [rdi - 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [0x1400fb818]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x50], rax
lea r8, [rsp + 0x40]
mov eax, dword [0x1400fb814]
mov r9d, 0x40
mov dword [rsp + 0x40], eax
mov edx, 0x3727e64
mov qword [rsp + 0x38], rdi
mov eax, 0x999fcf6c
mov qword [rsp + 0x70], rax
movabs rax, 0x1001fcf9c
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x58], 4
mov qword [rsp + 0x60], 0x85ccc4c
mov qword [rsp + 0x68], 0x85dfc6c
mov qword [rsp + 0x20], rdi
call qword [0x1400fbbb0]
mov eax, dword [rsp + 0x98]
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret
Function at 0x140052a30
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
mov rbx, rcx
xor edi, edi
mov rcx, qword [0x1400fb838]
mov dword [rsp + 0x98], edi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x140052a64
lea ecx, [rdi - 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [0x1400fb818]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x50], rax
lea r8, [rsp + 0x40]
mov eax, dword [0x1400fb814]
mov r9d, 0x40
mov dword [rsp + 0x40], eax
mov edx, 0x3727e64
mov qword [rsp + 0x38], rdi
mov eax, 0x999fcf6c
mov qword [rsp + 0x70], rax
movabs rax, 0x1001fcf9c
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x58], 4
mov qword [rsp + 0x60], 0x85ccc4c
mov qword [rsp + 0x68], 0x85dfc6c
mov qword [rsp + 0x20], rdi
call qword [0x1400fbbb0]
movsxd rcx, dword [rsp + 0x98]
movabs rax, 0xffffffff00000000
mov r8, rcx
movabs r9, 0xffffff8000000000
and r8, rax
movabs r10, 0xffffff7fffffffff
mov rdx, rcx
lea rax, [r8 + r9]
test r10, rax
jne 0x140052b3d
mov rax, rdx
lea rcx, [r8 + r9]
and eax, 0xffffff
add rax, qword [0x1400fb800]
test r10, rcx
cmove rdx, rax
mov rcx, rdx
mov rbx, qword [rsp + 0x90]
mov eax, ecx
add rsp, 0x80
pop rdi
ret