joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140056700
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
mov ecx, 3
call fcn.140061d20
cmp eax, 1
je 0x140056732
mov ecx, 3
call fcn.140061d20
test eax, eax
jne 0x1400567e6
cmp dword [reloc.OLEAUT32.dll_SysReAllocString], 1
jne 0x1400567e6
mov qword [rsp + 0x48], rbx
lea rbx, reloc.OLEAUT32.dll_SysReAllocString
mov qword [rsp + 0x30], rdi
mov rax, rbx
xor edi, edi
cmp dword [rax], 0xfc
je 0x14005675e
add edi, 1
add rax, 0x10
cmp edi, 0x17
jb 0x140056748
jmp 0x1400567d2
cmp edi, 0x17
jae 0x1400567d2
mov ecx, 3
call fcn.140061d20
cmp eax, 1
je 0x140056789
mov ecx, 3
call fcn.140061d20
test eax, eax
jne 0x1400567d2
cmp dword [reloc.OLEAUT32.dll_SysReAllocString], 1
jne 0x1400567d2
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
test rax, rax
mov r11, rax
je 0x1400567d2
cmp rax, 0xffffffffffffffff
je 0x1400567d2
movsxd rcx, edi
xor eax, eax
lea r9, [rsp + 0x40]
add rcx, rcx
mov qword [rsp + 0x20], rax
mov rdx, qword [rbx + rcx*8 + 8]
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0xff
call fcn.1400564c0
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
add rsp, 0x38
ret

Function at 0x140056947
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1400960c0]
jne 0x14005117a
rol rcx, 0x10
test cx, 0xffff
jne 0x140051176
repz ret
ror rcx, 0x10
jmp 0x1400568a0
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14024b3c0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x14024b4b8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140056925
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14024b3c0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140056947
mov rax, qword [rsp + 0x88]
mov qword [0x14024b4b8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14024b458], rax
mov rax, qword [0x14024b4b8]
mov qword [0x14024b330], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14024b440], rax
mov dword [0x14024b320], 0xc0000409
mov dword [0x14024b324], 1
mov rax, qword [0x1400960c0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1400960c8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14024b3b8], eax
mov ecx, 1
call fcn.140059150
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14006c2a0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14024b3b8], 0
jne 0x1400569ce
mov ecx, 1
call fcn.140059150
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x14005e910
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x30
mov eax, dword [0x14024be4c]
xor r12d, r12d
test eax, eax
mov ebp, r12d
jne 0x14005e96c
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
mov rdi, rax
je 0x14005e94c
mov dword [0x14024be4c], 1
jmp 0x14005e97f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x14005e966
mov dword [0x14024be4c], 2
jmp 0x14005e9e9
mov eax, dword [0x14024be4c]
cmp eax, 1
jne 0x14005e9e0
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
mov rdi, rax
je 0x14005e9ba
cmp word [rdi], bp
mov rax, rdi
je 0x14005e999
add rax, 2
cmp word [rax], bp
jne 0x14005e987
add rax, 2
cmp word [rax], bp
jne 0x14005e987
sub eax, edi
add eax, 2
movsxd rsi, eax
mov rcx, rsi
call fcn.140056290
test rax, rax
mov rbx, rax
jne 0x14005e9c1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x14005eadb
mov r8, rsi
mov rdx, rdi
mov rcx, rax
call fcn.140053ce0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbx
jmp 0x14005eadb
cmp eax, 2
je 0x14005e9e9
test eax, eax
jne 0x14005e9ba
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
test rax, rax
mov rsi, rax
je 0x14005e9ba
cmp byte [rax], bpl
mov rbx, rax
je 0x14005ea38
nop
or r9d, 0xffffffff
mov r8, rbx
xor ecx, ecx
lea edx, [r9 + 2]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x14005e9ba
or rcx, 0xffffffffffffffff
add ebp, eax
mov rdi, rbx
xor eax, eax
repne scasb al, byte [rdi]
not rcx
add rbx, rcx
cmp byte [rbx], al
jne 0x14005ea00
add ebp, 1
mov edx, 2
movsxd rcx, ebp
call fcn.140056300
test rax, rax
mov r12, rax
jne 0x14005ea5d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
jmp 0x14005eadb
cmp byte [rsi], 0
mov qword [rsp + 0x50], r13
mov rbx, rax
mov r13, rsi
je 0x14005eac5
nop
or r9d, 0xffffffff
mov eax, ebp
mov rcx, rbx
sub rcx, r12
lea edx, [r9 + 2]
mov r8, r13
sar rcx, 1
sub eax, ecx
xor ecx, ecx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x14005eaee
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r13
repne scasb al, byte [rdi]
mov rdi, rbx
not rcx
add r13, rcx
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
cmp byte [r13], al
not rcx
lea rbx, [rbx + rcx*2]
jne 0x14005ea70
mov rcx, rsi
mov word [rbx], 0
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov rax, r12
mov r13, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
mov rcx, r12
call fcn.140051460
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
jmp 0x14005ead6
Function at 0x1400619a0
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r13
push r14
sub rsp, 0x50
mov edi, r8d
mov r13, rdx
mov r14, rcx
call fcn.1400556a0
xor ebx, ebx
cmp qword [0x14024be58], rbx
mov rbp, rax
mov dword [rsp + 0x98], ebx
mov dword [rsp + 0x30], ebx
jne 0x140061acc
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rsi, rax
je 0x140061bdf
lea rdx, [0x14006c510]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140061bdf
mov rcx, rax
call fcn.1400555d0
lea rdx, [0x14006c500]
mov rcx, rsi
mov qword [0x14024be58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.1400555d0
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x14024be60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.1400555d0
lea rcx, [rsp + 0x98]
mov qword [0x14024be68], rax
call fcn.140052cf0
test eax, eax
je 0x140061a7f
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.140051c00
cmp dword [rsp + 0x98], 2
jne 0x140061acc
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.1400555d0
test rax, rax
mov qword [0x14024be78], rax
je 0x140061acc
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.1400555d0
mov qword [0x14024be70], rax
mov rcx, qword [0x14024be70]
mov qword [rsp + 0x80], r12
cmp rcx, rbp
je 0x140061b78
cmp qword [0x14024be78], rbp
je 0x140061b78
call fcn.140055790
mov rcx, qword [0x14024be78]
mov rsi, rax
call fcn.140055790
test rsi, rsi
mov r12, rax
je 0x140061b78
test rax, rax
je 0x140061b78
call rsi
test rax, rax
je 0x140061b43
lea rcx, [rsp + 0x34]
mov r9d, SafeArrayGetDim
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140061b43
test byte [rsp + 0x40], 1
jne 0x140061b78
lea rcx, [rsp + 0x30]
call fcn.140052d40
test eax, eax
je 0x140061b65
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.140051c00
cmp dword [rsp + 0x30], 4
jb 0x140061b72
bts edi, 0x15
jmp 0x140061bb6
bts edi, 0x12
jmp 0x140061bb6
mov rcx, qword [0x14024be60]
cmp rcx, rbp
je 0x140061bb6
call fcn.140055790
test rax, rax
je 0x140061bb6
call rax
test rax, rax
mov rbx, rax
je 0x140061bb6
mov rcx, qword [0x14024be68]
cmp rcx, rbp
je 0x140061bb6
call fcn.140055790
test rax, rax
je 0x140061bb6
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14024be58]
call fcn.140055790
mov r12, qword [rsp + 0x80]
test rax, rax
je 0x140061bdf
mov r9d, edi
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x140061be1
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop r14
pop r13
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400645b0
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1400960c0]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x20]
mov r9d, 6
mov edx, 0x1004
mov byte [rsp + 0x26], 0
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x1400645f7
or eax, 0xffffffff
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140051160
add rsp, 0x38
ret
lea rcx, [rsp + 0x20]
call fcn.140053520
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140051160
add rsp, 0x38
ret
Function at 0x1400680b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x20
xor ebx, ebx
test rcx, rcx
mov r14, rdx
mov rbp, rcx
je 0x140068164
movsxd rax, dword [rcx + 0x3c]
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rdi
mov edi, dword [rax + rcx + 0x88]
mov esi, ebx
add rdi, rcx
cmp dword [rdi + 0x18], ebx
jbe 0x14006815f
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r13
mov r13, rbx
mov r12, rbx
nop
nop
mov eax, dword [rdi + 0x20]
mov rdx, r14
add rax, r13
mov ecx, dword [rax + rbp]
add rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x14006812f
mov eax, dword [rdi + 0x24]
mov ecx, dword [rdi + 0x1c]
add rax, r12
add rcx, rbp
movzx edx, word [rax + rbp]
mov ebx, dword [rcx + rdx*4]
add rbx, rbp
add esi, 1
add r13, 4
add r12, 2
cmp esi, dword [rdi + 0x18]
jb 0x140068100
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x50]
mov rax, rbx
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
mov rax, rbx
jmp 0x14006814c
mov rax, rbx
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
Function at 0x14048d3c4
Capabilities:
Execute anti-debugging instructions

Disassembly:
push r8
ret
xor edx, ebp
stc
cmc
rol edx, 3
cmc
test bp, dx
xor edx, 0x744815b8
stc
cmc
rol edx, 2
test r8d, r11d
cmp r14b, 0x93
cmp r12, r8
add edx, 0x646e7ffc
xor edx, 0x3d036225
clc
ror edx, 1
cmp r8b, r11b
bswap edx
cmp sp, r9w
push rbp
movzx ebp, r14w
xor dword [rsp], edx
jmp 0x14050c553
push rax
movzx ax, al
mov ah, 0x89
push rbx
movzx eax, r10w
cmovb bx, bp
push r8
cdqe
cwde
movzx r8w, sil
push rdx
rdtsc
cqo
push rdi
push r10
setp dil
push rcx
push r11
cwd
cmovo edx, ebx
xchg r8, r8
push rsi
pushfq
and sil, bpl
rdtsc
bt ax, r13w
push r15
neg al
bt r8d, 0x71
push r12
rcr r8b, cl
sub edi, 0x1e2934a4
push r13
adc di, r13w
and sil, 0x73
lahf
push r9
sar dh, cl
push rbp
neg sil
sbb bpl, dl
movsx r8, r8w
push r14
sal bl, 0x65
movzx rbx, di
movsx bp, r9b
movabs rdi, 0
not r8d
inc r9b
push rdi
mov dh, 0x85
mov rbx, qword [rsp + 0x90]
sar bpl, cl
not ebx
movsx si, dl
mov edx, 0x1c256cd8
movzx rdx, r8w
neg ebx
lahf
dec ebx
cdq
neg ebx
cwde
lea rbx, [rbx + rdi]
movabs rsi, 0x100000000
bsf rbp, rsi
add rbx, rsi
bsr r8w, cx
mov r9, 0x39cd5a94
mov r9, rsp
movsx ax, bl
sub bpl, 6
sub rsp, 0x180
cmc
xor ax, si
and rsp, 0xfffffffffffffff0
mov rbp, rbx
movabs rax, 0
neg dh
cwd
movzx rdx, dx
sub rbp, rax
adc dx, si
mov dx, 0x2dd3
dec dx
lea r8, [0x14048d4d5]
rcr dh, cl
not edx
mov edx, dword [rbx]
add rbx, 4
jmp 0x14047a473
pop rbp
stc
movsxd rdx, edx
add r8, rdx
jmp 0x1404662d9
Function at 0x140026020
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x14000003c]
lea rsi, [0x140000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x140026098
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x140026098
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x140026098
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x14002608c
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x1400260aa
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x14002607a
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x14002609a

Function at 0x140027528
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140027572
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140027572
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140027572
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140027572
cmp dword [rcx + 0x84], 0xe
jbe 0x140027572
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140027574
xor al, al
add rsp, 0x28
ret

Function at 0x140030548
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400302ac

Function at 0x140f5f390
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140f5f39a
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x140f5f3c3
pop rbp
sub rbp, 0x33
sub rbp, 0xf5f390
sub rsp, 0x20
jmp 0x140f5f3e2
mov rax, 0xf5f390
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0x6f700366
xor byte [rax], dl
inc rax
dec rcx
jne 0x140f5f401
jmp 0x140f5f418
out dx, eax
invalid
Function at 0x14001137a
Capabilities:
Terminate process

Disassembly:
jmp 0x140017040
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140011465
Capabilities:
Parse pe header

Disassembly:
jmp 0x140018390
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400183b0
xor al, al
jmp 0x140018431
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400183c3
xor al, al
jmp 0x140018431
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400183ed
xor al, al
jmp 0x140018431
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140018401
xor al, al
jmp 0x140018431
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140018413
xor al, al
jmp 0x140018431
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001842f
xor al, al
jmp 0x140018431
mov al, 1
add rsp, 0x38
ret
Function at 0x140007204
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.140007194
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140020140]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14001f588]
jmp 0x140007240
cmp qword [rbx + 0x18], rdi
je 0x140007247
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140007237
jmp 0x140007261
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x14001f588]
call fcn.140011838
lea rcx, [0x140020140]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [rsi], esp
movsb byte [rdi], byte [rsi]
cmp byte [rsi + 0x54], ch
push rsp
push rsp
push rdx
or byte [0xf98b538a], ah
jp 0x14003d5e5
mov edi, 0x8ff6e090
jle 0x14003d628
invalid
out 0xc7, al
je 0x14003d5cd
xchg rcx, rax
imul edi, dword [rdx], 0x1d7af52e
cmc
jp 0x14003d613
push rbp
push rcx
fdiv dword [rbx - 0xd]
adc dword [rsi + 0x62665fcf], esp
pop rdi
invalid
invalid
mov word fs:[rdx - 0x1c], ds
adc ecx, dword [rcx - 0x6c517b78]
mov dword [rax + 0x3393ae84], ecx
invalid
mov ah, 0xab
mov dword [rax + 0x3393ae84], ecx
adc dh, byte [rbx + rbp*4 - 0x412091b7]
test byte [rsi - 0x4bedcc6d], ch
stosd dword [rdi], eax
outsb dx, byte [rsi]
fistp qword [rsi - 0x467f7d65]
jmp 0x127ea9c55
wait
invalid
enter 0xffffffffffffb5b4, 0x61
sub dil, byte [rbp - 0x13]
fisttp qword [rax + 2]
xchg byte [rdi], ah
invalid
invalid
movsd dword [rdi], dword [rsi]
sbb byte [rcx + rbx + 0x4cdda09], dh
cmpsb byte [rsi], byte [rdi]
cmpsb byte [rsi], byte [rdi]
jrcxz 0x14003d5f3
add dword [rdx - 0x5c], edi
xchg edx, eax
mov dh, byte [rdx + rdx]
call 0xfa59221e
push rdx
cmp dword [rax + riz - 0x4582cbbe], esi
sar byte [rcx + 0x64], cl
jns 0x14003d6b5
invalid
invalid
and bh, byte [rcx + 0x7d7e0515]
sub ebp, dword ds:[r8]
in al, 0x2d
cmpsb byte [rsi], byte [rdi]
adc ch, byte [rbp - 0x76aace48]
xlatb
jbe 0x14003d608
and ah, byte [rbx - 0x38]
or dl, byte [rsi + 0xc5493ac]
push rsp
or al, 0xa
invalid
invalid
invalid
Function at 0x1400168e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140016a6b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [0x14009fb58]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.140034da0
xorps xmm15, xmm15
mov r14, qword [0x1401e9258]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x140016945
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x140016954
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x140016973
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x140016983
cmp rbx, 0x1000
jae 0x14001694b
jmp 0x1400169ed
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x140016995
xor edx, edx
jmp 0x1400169e4
mov rcx, qword [0x14009fb58]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.140034da0
xorps xmm15, xmm15
mov r14, qword [0x1401e9258]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x140016979
jmp 0x140016968
call fcn.140067920
xorps xmm15, xmm15
mov r14, qword [0x1401e9258]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.140038e40
lea rax, [0x1400cb866]
mov ebx, 0x18
nop dword [rax]
call fcn.1400396c0
mov rax, qword [rsp + 0x38]
call fcn.140039400
lea rax, [0x1400cbbbd]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.1400396c0
mov rax, qword [rsp + 0x30]
call fcn.140039400
call fcn.140039080
call fcn.140038ea0
lea rax, [0x1400cd8f1]
mov ebx, 0x21
call fcn.1400373a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.140064200
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.1400168e0
Function at 0x140016aa0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140016cc6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [0x14009fb50]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.140034e20
xorps xmm15, xmm15
mov r14, qword [0x1401e9258]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x140016b13
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x140016b22
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x140016b45
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x140016b55
cmp rbx, 0x1000
jae 0x140016b19
nop
jmp 0x140016bd8
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x140016b6d
xor esi, esi
jmp 0x140016bca
mov rax, qword [0x14009fb50]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.140034e20
xorps xmm15, xmm15
mov r14, qword [0x1401e9258]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x140016b4b
jmp 0x140016b36
call fcn.140067920
xorps xmm15, xmm15
mov r14, qword [0x1401e9258]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x140016c60
nop dword [rax + rax]
call fcn.140038e40
lea rax, [0x1400cbbd6]
mov ebx, 0x19
call fcn.1400396c0
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.140039400
lea rax, [0x1400cbbbd]
mov ebx, 0x19
call fcn.1400396c0
mov eax, dword [rsp + 0x34]
call fcn.140039400
nop
call fcn.140039080
call fcn.140038ea0
lea rax, [0x1400c8ee5]
mov ebx, 0xd
call fcn.1400373a0
nop dword [rax + rax]
cmp eax, 0x5af
je 0x140016c00
call fcn.140038e40
lea rax, [0x1400cbbd6]
mov ebx, 0x19
call fcn.1400396c0
mov rax, qword [rsp + 0x38]
call fcn.140039400
lea rax, [0x1400cbbbd]
mov ebx, 0x19
call fcn.1400396c0
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.140039400
call fcn.140039080
call fcn.140038ea0
lea rax, [0x1400cd218]
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.1400373a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.140064200
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.140016aa0