joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140f58058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140f581df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140f58089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f5806f
add dl, dl
jne 0x140f58096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f580f6
xor eax, eax
add dl, dl
jne 0x140f580a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f581ad
add dl, dl
jne 0x140f580b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f580c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f580d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f580dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140f580ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140f5807e
mov eax, 1
add dl, dl
jne 0x140f58106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f58113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f580fb
sub eax, ebx
mov ebx, 1
jne 0x140f5814c
mov ecx, 1
add dl, dl
jne 0x140f5812e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140f5813b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f58123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f5807e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140f58168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140f58175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f5815d
cmp eax, 0x7d00
jae 0x140f5819b
cmp eax, 0x500
jb 0x140f58196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f5807e
cmp eax, 0x7f
ja 0x140f5819e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f5807e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140f581d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140f5807e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14000ec58
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [0x1400100b0]
test rax, rax
je 0x14000eca2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000eca2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000eca2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000eca2
cmp dword [rcx + 0x84], 0xe
jbe 0x14000eca2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000eca4
xor al, al
add rsp, 0x28
ret
Function at 0x180001000
Capabilities:
Resolve function by djb2 hash

Disassembly:
push rbp
mov rbp, rsp
push r15
push r14
push r13
push r12
push rdi
push rsi
mov esi, ecx
push rbx
mov rbx, rdx
and rsp, 0xfffffffffffffff0
sub rsp, 0x2a0
mov dword [rdx], 0
mov edx, 0x104
lea rdi, [rsp + 0x80]
mov rcx, rdi
call fcn.1800012f0
test eax, eax
je 0x180001270
lea r15, [rsp + 0x190]
lea r8, [rsp + 0x73]
mov rdx, rdi
movabs rax, 0x706572746c756166
mov qword [rsp + 0x73], rax
mov rcx, r15
movabs rax, 0x6c6c642e706572
mov qword [rsp + 0x78], rax
call fcn.1800021c0
test eax, eax
je 0x180001270
mov edx, 0xeb96c5fa
mov ecx, 0x7040ee75
call fcn.180001400
mov edx, 0x71019921
mov ecx, 0x7040ee75
mov qword [rsp + 0x50], rax
call fcn.180001400
mov edx, 0x7891c520
mov ecx, 0x7040ee75
mov rdi, rax
call fcn.180001400
mov edx, 0x3870ca07
mov ecx, 0x7040ee75
mov r13, rax
call fcn.180001400
mov edx, 0x53ef6bf2
mov ecx, 0x7040ee75
mov r14, rax
call fcn.180001400
mov edx, 0x382c0f97
mov ecx, 0x7040ee75
mov r12, rax
call fcn.180001400
mov ecx, 0x7040ee75
mov edx, 0x668fcf2e
mov qword [rsp + 0x58], rax
call fcn.180001400
mov r10, qword [rsp + 0x50]
mov qword [rsp + 0x48], rax
mov rcx, rax
test r10, r10
je 0x180001270
test rdi, rdi
je 0x180001270
test r13, r13
je 0x180001270
test r14, r14
je 0x180001270
test r12, r12
sete al
cmp qword [rsp + 0x58], 0
sete dl
or al, dl
jne 0x180001270
test rcx, rcx
je 0x180001270
mov rcx, r15
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov r8d, 1
mov dword [rsp + 0x28], pe_nt_image_headers64
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
call r10
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x180001270
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x60], 0
mov qword [rsp + 0x50], rcx
mov rdx, rcx
mov rcx, rax
call r13
cmp eax, 0xffffffff
je 0x180001262
sub eax, esi
lea r13, [rsp + 0x64]
xor r9d, r9d
mov rcx, r15
mov edx, eax
mov r8, r13
mov dword [rsp + 0x64], 0
call r12
mov r9, qword [rsp + 0x50]
lea rdx, [rsp + 0x68]
mov rcx, r15
mov qword [rsp + 0x20], 0
mov r8d, 8
call rdi
test eax, eax
je 0x180001262
xor r9d, r9d
mov edx, dword [rsp + 0x68]
mov r8, r13
mov rcx, r15
call r12
xor ecx, ecx
movsxd rdx, dword [rsp + 0x6c]
mov r9d, 4
mov r8d, 0x1000
mov rax, qword [rsp + 0x58]
call rax
mov r9, qword [rsp + 0x50]
mov r8d, dword [rsp + 0x6c]
mov rcx, r15
mov qword [rsp + 0x20], 0
mov rsi, rax
mov rdx, rax
call rdi
test eax, eax
je 0x180001250
mov eax, dword [rsp + 0x6c]
mov rcx, r15
mov dword [rbx], eax
call r14
jmp 0x180001272
mov rax, qword [rsp + 0x48]
mov r8d, 0x8000
xor edx, edx
mov rcx, rsi
call rax
mov rcx, r15
call r14
nop dword [rax + rax]
xor esi, esi
lea rsp, [rbp - 0x38]
mov rax, rsi
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x180001360
Capabilities:
Access peb ldr_data
Hash data using djb2

Disassembly:
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov r11, qword [rax + 0x20]
mov r10, r11
nop dword [rax]
mov r8, qword [r10 + 0x50]
test r8, r8
je 0x1800013e5
movzx eax, word [r8]
test ax, ax
je 0x1800013f0
mov rdx, r8
nop dword [rax]
lea r9d, [rax - 0x41]
cmp r9w, 0x19
ja 0x1800013a1
add eax, 0x20
mov word [rdx], ax
movzx eax, word [rdx + 2]
add rdx, 2
test ax, ax
jne 0x180001390
movzx edx, word [r8]
test dx, dx
je 0x1800013f0
mov eax, 0x1505
nop dword [rax]
mov r9d, eax
add r8, 2
shl r9d, 5
add eax, r9d
add eax, edx
movzx edx, word [r8]
test dx, dx
jne 0x1800013c0
cmp ecx, eax
je 0x1800013f9
mov r10, qword [r10]
cmp r11, r10
jne 0x180001378
xor eax, eax
ret
mov eax, 0x1505
cmp ecx, eax
jne 0x1800013dd
mov rax, qword [r10 + 0x20]
ret
Function at 0x180001400
Capabilities:
Hash data using djb2
Resolve function by djb2 hash
Resolve function by parsing pe exports

Disassembly:
push rsi
mov esi, ecx
push rbx
mov ebx, edx
sub rsp, 0x38
call fcn.180001360
test rax, rax
jne 0x180001430
mov ecx, 0x7040ee75
call fcn.180001360
test rax, rax
jne 0x180001440
add rsp, 0x38
xor eax, eax
pop rbx
pop rsi
ret
add rsp, 0x38
mov edx, ebx
mov rcx, rax
pop rbx
pop rsi
jmp 0x180001d30
mov edx, 0x5fbff0fb
mov rcx, rax
call 0x180001d30
test rax, rax
je 0x180001423
cmp esi, 0x6b0c494c
je 0x1800014c8
cmp esi, 0x5a6bd3f3
je 0x180001528
cmp esi, 0xf92c2394
je 0x180001500
cmp esi, 0xe6ab711e
je 0x180001538
cmp esi, 0xa70d9427
je 0x180001568
cmp esi, 0x67208a49
je 0x180001577
cmp esi, 0xd6501ac
jne 0x180001423
movabs rsi, 0x2e32336c6c656853
lea rcx, [rsp + 0x23]
mov qword [rsp + 0x23], rsi
mov dword [rsp + 0x2b], 0x6c6c64
call rax
mov rcx, rax
jmp 0x1800014e9
movabs rsi, 0x642e6e6f6d6c7255
mov qword [rsp + 0x23], rsi
lea rcx, [rsp + 0x23]
mov dword [rsp + 0x2a], 0x6c6c64
call rax
mov rcx, rax
test rcx, rcx
je 0x180001423
add rsp, 0x38
mov edx, ebx
pop rbx
pop rsi
jmp 0x180001d30
mov edx, 0x6c
lea rcx, [rsp + 0x23]
movabs rsi, 0x6c642e3233656c4f
mov qword [rsp + 0x23], rsi
mov word [rsp + 0x2b], dx
call rax
mov rcx, rax
jmp 0x1800014e9
movabs rsi, 0x642e323372657355
jmp 0x1800014d2
movabs rsi, 0x3233747561656c6f
lea rcx, [rsp + 0x23]
mov qword [rsp + 0x23], rsi
movabs rsi, 0x6c6c642e323374
mov qword [rsp + 0x28], rsi
call rax
mov rcx, rax
jmp 0x1800014e9
movabs rsi, 0x2e697061776c6853
jmp 0x1800014a8
movabs rsi, 0x3233697061766461
lea rcx, [rsp + 0x23]
mov qword [rsp + 0x23], rsi
movabs rsi, 0x6c6c642e323369
mov qword [rsp + 0x28], rsi
call rax
mov rcx, rax
jmp 0x1800014e9
push rdi
push rsi
push rbx
movsxd rax, dword [rcx + 0x3c]
mov edi, dword [rcx + rax + 0x88]
add rdi, rcx
mov r9d, dword [rdi + 0x20]
mov ebx, dword [rdi + 0x18]
add r9, rcx
test ebx, ebx
je 0x180001dab
mov r11, rcx
mov esi, edx
xor r10d, r10d
nop word [rax + rax]
mov eax, dword [r9]
mov edx, 0x1505
add rax, r11
lea rcx, [rax + 1]
movzx eax, byte [rax]
test al, al
je 0x180001d9a
nop word cs:[rax + rax]
mov r8d, edx
shl r8d, 5
add edx, r8d
add edx, eax
mov rax, rcx
add rcx, 1
movzx eax, byte [rax]
test al, al
jne 0x180001d80
cmp esi, edx
je 0x180001db1
add r10, 1
add r9, 4
cmp r10, rbx
jne 0x180001d60
pop rbx
xor eax, eax
pop rsi
pop rdi
ret
mov edx, dword [rdi + 0x24]
lea rcx, [r11 + r10*2]
mov eax, dword [rdi + 0x1c]
pop rbx
pop rsi
movzx edx, word [rcx + rdx]
pop rdi
lea rdx, [r11 + rdx*4]
mov eax, dword [rdx + rax]
add rax, r11
ret
Function at 0x180001d30
Capabilities:
Hash data using djb2
Resolve function by parsing pe exports

Disassembly:
push rsi
mov esi, ecx
push rbx
mov ebx, edx
sub rsp, 0x38
call fcn.180001360
test rax, rax
jne 0x180001430
mov ecx, 0x7040ee75
call fcn.180001360
test rax, rax
jne 0x180001440
add rsp, 0x38
xor eax, eax
pop rbx
pop rsi
ret
add rsp, 0x38
mov edx, ebx
mov rcx, rax
pop rbx
pop rsi
jmp 0x180001d30
mov edx, 0x5fbff0fb
mov rcx, rax
call 0x180001d30
test rax, rax
je 0x180001423
cmp esi, 0x6b0c494c
je 0x1800014c8
cmp esi, 0x5a6bd3f3
je 0x180001528
cmp esi, 0xf92c2394
je 0x180001500
cmp esi, 0xe6ab711e
je 0x180001538
cmp esi, 0xa70d9427
je 0x180001568
cmp esi, 0x67208a49
je 0x180001577
cmp esi, 0xd6501ac
jne 0x180001423
movabs rsi, 0x2e32336c6c656853
lea rcx, [rsp + 0x23]
mov qword [rsp + 0x23], rsi
mov dword [rsp + 0x2b], 0x6c6c64
call rax
mov rcx, rax
jmp 0x1800014e9
movabs rsi, 0x642e6e6f6d6c7255
mov qword [rsp + 0x23], rsi
lea rcx, [rsp + 0x23]
mov dword [rsp + 0x2a], 0x6c6c64
call rax
mov rcx, rax
test rcx, rcx
je 0x180001423
add rsp, 0x38
mov edx, ebx
pop rbx
pop rsi
jmp 0x180001d30
mov edx, 0x6c
lea rcx, [rsp + 0x23]
movabs rsi, 0x6c642e3233656c4f
mov qword [rsp + 0x23], rsi
mov word [rsp + 0x2b], dx
call rax
mov rcx, rax
jmp 0x1800014e9
movabs rsi, 0x642e323372657355
jmp 0x1800014d2
movabs rsi, 0x3233747561656c6f
lea rcx, [rsp + 0x23]
mov qword [rsp + 0x23], rsi
movabs rsi, 0x6c6c642e323374
mov qword [rsp + 0x28], rsi
call rax
mov rcx, rax
jmp 0x1800014e9
movabs rsi, 0x2e697061776c6853
jmp 0x1800014a8
movabs rsi, 0x3233697061766461
lea rcx, [rsp + 0x23]
mov qword [rsp + 0x23], rsi
movabs rsi, 0x6c6c642e323369
mov qword [rsp + 0x28], rsi
call rax
mov rcx, rax
jmp 0x1800014e9
push rdi
push rsi
push rbx
movsxd rax, dword [rcx + 0x3c]
mov edi, dword [rcx + rax + 0x88]
add rdi, rcx
mov r9d, dword [rdi + 0x20]
mov ebx, dword [rdi + 0x18]
add r9, rcx
test ebx, ebx
je 0x180001dab
mov r11, rcx
mov esi, edx
xor r10d, r10d
nop word [rax + rax]
mov eax, dword [r9]
mov edx, 0x1505
add rax, r11
lea rcx, [rax + 1]
movzx eax, byte [rax]
test al, al
je 0x180001d9a
nop word cs:[rax + rax]
mov r8d, edx
shl r8d, 5
add edx, r8d
add edx, eax
mov rax, rcx
add rcx, 1
movzx eax, byte [rax]
test al, al
jne 0x180001d80
cmp esi, edx
je 0x180001db1
add r10, 1
add r9, 4
cmp r10, rbx
jne 0x180001d60
pop rbx
xor eax, eax
pop rsi
pop rdi
ret
mov edx, dword [rdi + 0x24]
lea rcx, [r11 + r10*2]
mov eax, dword [rdi + 0x1c]
pop rbx
pop rsi
movzx edx, word [rcx + rdx]
pop rdi
lea rdx, [r11 + rdx*4]
mov eax, dword [rdx + rax]
add rax, r11
ret
Function at 0x180001e10
Capabilities:
Resolve function by djb2 hash

Disassembly:
push rbp
mov edx, 0x663cecb0
mov ecx, 0x7040ee75
mov rbp, rsp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
and rsp, 0xfffffffffffffff0
sub rsp, 0x290
mov dword [rsp + 0x58], 0
lea r13, [rsp + 0x65]
call fcn.180001400
mov edx, 0xeb96c5fa
mov ecx, 0x7040ee75
mov rsi, rax
call fcn.180001400
mov edx, 0x381741f1
mov ecx, 0xd6501ac
mov r12, rax
call fcn.180001400
mov edx, 0x668fcf2e
mov ecx, 0x7040ee75
mov rdi, rax
call fcn.180001400
mov ecx, 0x7040ee75
mov edx, 0x3870ca07
mov rbx, rax
call fcn.180001400
mov rcx, r13
mov r14, rax
movabs rax, 0x317070615f6e7572
mov qword [rsp + 0x65], rax
mov dword [rsp + 0x6c], 0xa0d31
call fcn.180002240
test rsi, rsi
je 0x180002058
test r12, r12
je 0x180002050
test rbx, rbx
je 0x18000208f
test rdi, rdi
je 0x180002094
test r14, r14
je 0x1800020ed
lea r13, [rsp + 0x58]
mov ecx, 0x28
mov rdx, r13
call section..text
mov rcx, rax
test rax, rax
je 0x1800020ed
mov r8d, 0x8000
xor edx, edx
call rbx
mov rdx, r13
mov ecx, 0x20
call section..text
mov r15, rax
test rax, rax
je 0x1800020ed
lea rcx, [rsp + 0x70]
mov edx, 0x104
mov qword [rsp + 0x48], rcx
call fcn.1800012f0
mov rdx, qword [rsp + 0x48]
lea rax, [rsp + 0x180]
mov r8, r15
mov rcx, rax
mov qword [rsp + 0x48], rax
call fcn.1800021c0
mov r8d, 0x8000
xor edx, edx
mov rcx, r15
mov dword [rsp + 0x44], eax
call rbx
mov r10d, dword [rsp + 0x44]
test r10d, r10d
je 0x1800020ed
mov rcx, qword [rsp + 0x48]
call fcn.1800012b0
test eax, eax
jne 0x180002012
mov rcx, qword [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 2
call r12
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x1800020ed
mov rdx, r13
mov ecx, 0x18
call section..text
mov r13, rax
test rax, rax
je 0x1800020ed
mov r8d, dword [rsp + 0x58]
lea r9, [rsp + 0x5c]
mov rdx, rax
mov rcx, r12
mov dword [rsp + 0x5c], 0
mov qword [rsp + 0x20], 0
call rsi
xor edx, edx
mov rcx, r13
mov r8d, 0x8000
mov esi, eax
call rbx
mov rcx, r12
call r14
test esi, esi
je 0x1800020ed
mov byte [rsp + 0x64], 0
mov r8, qword [rsp + 0x48]
xor r9d, r9d
xor ecx, ecx
mov dword [rsp + 0x60], 0x6e65706f
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
call rdi
jmp 0x1800020ed
test rsi, rsi
jne 0x180002065
nop dword [rax]
mov rcx, r13
call fcn.180002240
test r12, r12
jne 0x18000208f
movabs rax, 0x337070615f6e7572
lea rcx, [rsp + 0x180]
mov qword [rsp + 0x180], rax
mov dword [rsp + 0x187], 0xa0d33
call fcn.180002240
test rdi, rdi
jne 0x1800020be
movabs rax, 0x347070615f6e7572
lea rcx, [rsp + 0x180]
mov qword [rsp + 0x180], rax
mov dword [rsp + 0x187], 0xa0d34
call fcn.180002240
test rbx, rbx
jne 0x1800020ed
movabs rax, 0x357070615f6e7572
lea rcx, [rsp + 0x180]
mov qword [rsp + 0x180], rax
mov dword [rsp + 0x187], 0xa0d35
call fcn.180002240
lea rsp, [rbp - 0x38]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x180002100
Capabilities:
Resolve function by djb2 hash

Disassembly:
push rdi
mov edx, 0x5a153f58
mov ecx, 0x7040ee75
push rsi
push rbx
sub rsp, 0x30
mov qword [rsp + 0x24], 0xb848
mov dword [rsp + 0x2c], 0xe0ff0000
call fcn.180001400
mov edx, 0x844ff18d
mov ecx, 0x7040ee75
mov rbx, rax
call fcn.180001400
test rbx, rbx
je 0x1800021b5
mov rsi, rax
test rax, rax
je 0x1800021b5
xor ecx, ecx
lea rdi, [rsp + 0x20]
call rbx
mov r8d, 4
mov dword [rsp + 0x20], 0
mov r9, rdi
movsxd rdx, dword [rax + 0x3c]
mov ebx, dword [rdx + rax + 0x28]
mov edx, 0xc
add rbx, rax
lea rax, [0x1800015b0]
mov qword [rsp + 0x26], rax
mov rcx, rbx
call rsi
lea r8, [rsp + 0x24]
lea r10, [rbx + 0xc]
mov rax, rbx
sub r8, rbx
mov rdx, rax
movzx ecx, byte [rax + r8]
add rax, 1
mov byte [rdx], cl
cmp r10, rax
jne 0x180002190
mov r8d, dword [rsp + 0x20]
mov r9, rdi
mov edx, 0xc
mov rcx, rbx
call rsi
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret

Function at 0x180002240
Capabilities:
Resolve function by djb2 hash

Disassembly:
push rbp
mov edx, 0x104
mov rbp, rsp
push r15
push r14
push r13
push r12
push rdi
push rsi
mov rsi, rcx
push rbx
and rsp, 0xfffffffffffffff0
sub rsp, 0x270
lea rdi, [rsp + 0x50]
mov rcx, rdi
call fcn.1800012f0
test eax, eax
jne 0x180002288
lea rsp, [rbp - 0x38]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov edx, 0xeb96c5fa
mov ecx, 0x7040ee75
call fcn.180001400
mov edx, 0x663cecb0
mov ecx, 0x7040ee75
mov rbx, rax
call fcn.180001400
mov edx, 0x3870ca07
mov ecx, 0x7040ee75
mov r12, rax
call fcn.180001400
mov edx, 0xd2c4ab0a
mov ecx, 0x7040ee75
mov r14, rax
call fcn.180001400
mov r13, rax
test rbx, rbx
je 0x180002273
test r12, r12
je 0x180002273
test r14, r14
je 0x180002273
test rax, rax
je 0x180002273
lea r15, [rsp + 0x160]
lea r8, [rsp + 0x48]
mov rdx, rdi
movabs rax, 0x7478742e676f6c
mov rcx, r15
mov qword [rsp + 0x48], rax
call fcn.1800021c0
test eax, eax
je 0x180002273
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov r8d, 1
mov rcx, r15
mov dword [rsp + 0x28], pe_nt_image_headers64
mov edx, 4
mov dword [rsp + 0x20], 4
call rbx
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180002273
mov rcx, rsi
call r13
mov rcx, rbx
lea r9, [rsp + 0x44]
mov rdx, rsi
mov dword [rsp + 0x44], 0
mov r8d, eax
mov qword [rsp + 0x20], 0
call r12
mov rcx, rbx
call r14
jmp 0x180002273
Function at 0x4163c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41654b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x005de198]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x416425
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x416434
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x416453
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x416463
cmp rbx, 0x1000
jae 0x41642b
jmp 0x4164cd
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x416475
xor edx, edx
jmp 0x4164c4
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x005de198]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x416459
jmp 0x416448
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x005de198]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call sym.runtime.printlock
lea rax, [0x004b77c7]
mov ebx, 0x18
nop dword [rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x004b7b07]
mov ebx, 0x19
nop dword [rax + rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x30]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x004b98cd]
mov ebx, 0x21
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.runtime.sysUnusedOS
Function at 0x416580
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4167a6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x005de198]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x4165f3
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x416602
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x416625
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x416635
cmp rbx, 0x1000
jae 0x4165f9
nop
jmp 0x4166b8
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x41664d
xor esi, esi
jmp 0x4166aa
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x005de198]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x41662b
jmp 0x416616
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x005de198]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x416740
nop dword [rax + rax]
call sym.runtime.printlock
lea rax, [0x004b7b20]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call sym.runtime.printuint
lea rax, [0x004b7b07]
mov ebx, 0x19
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
call sym.runtime.printuint
nop
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x004b4e5e]
mov ebx, 0xd
call sym.runtime.throw
nop dword [rax + rax]
cmp eax, 0x5af
je 0x4166e0
call sym.runtime.printlock
lea rax, [0x004b7b20]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x004b7b07]
mov ebx, 0x19
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
nop dword [rax]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x004b918b]
mov ebx, 0x1f
nop dword [rax + rax]
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp sym.runtime.sysUsedOS