joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800116e4
Capabilities:
Parse pe header

Disassembly:
push rdx
xor rdx, rdx
test rdx, rdx
jne 0x180011ae7
inc rdx
test rdx, rdx
je 0x180013a99
pop rdx
push rdx
xor rdx, rdx
test rdx, rdx
jne 0x180012504
inc rdx
test rdx, rdx
je 0x1800118ce
pop rdx
push rbx
push rbp
push rdi
push rsi
push r12
push r13
push r15
xor r15, r15
inc r15
test r15, r15
je 0x1800124bc
pop r15
push r14
push r15
sub rsp, 8
mov rbp, rsp
cmp rdx, 1
jne 0x180013ae8
mov r13, rdx
sub rsp, 0x20
mov rbx, rcx
xor rax, rax
push rdx
xor rdx, rdx
test rdx, rdx
jne 0x180011ae7
inc rdx
test rdx, rdx
je 0x18001226e
pop rdx
mov rcx, rbp
sub rcx, rsp
mov rdi, rsp
rep stosb byte [rdi], al
mov rcx, rbx
rdrand rax
cmp al, 0x61
jle 0x18001177d
cmp al, 0x63
jge 0x18001177d
sub rax, 2
and rax, 0xff
mov r11, qword gs:[rax]
mov rax, SafeArrayGetElement
add rax, 3
mov rbx, qword [r11 + rax]
mov rax, 0x1f
add rax, 1
mov rbx, qword [rbx + rax]
push rdx
xor rdx, rdx
test rdx, rdx
jne 0x180013930
inc rdx
test rdx, rdx
je 0x180011d3b
pop rdx
mov r12, rbx
mov r15, SafeArrayGetElement
add r15, 0x2c
push r15
xor r15, r15
inc r15
test r15, r15
je 0x180012504
pop r15
mov rdx, qword [rbx + r15]
mov r15, 0xd
add r15, 0x3e
cmp byte [rdx + 0x28], r15b
je 0x18001181b
mov r15, 0x4b
add r15, 0x20
cmp byte [rdx + 0x28], r15b
je 0x18001181b
jmp 0x18001192e
mov r15, 2
add r15, 0x43
cmp byte [rdx + 0x30], r15b
je 0x180011842
mov r15, 0x54
add r15, 0x11
cmp byte [rdx + 0x30], r15b
je 0x180011842
jmp 0x18001192e
mov r15, 0x4a
add r15, 2
cmp byte [rdx + 0x32], r15b
je 0x180011869
mov r15, 0x1f
add r15, 0x4d
cmp byte [rdx + 0x32], r15b
je 0x180011869
jmp 0x18001192e
mov r15, 0x2f
add r15, 3
cmp byte [rdx + 0x36], r15b
je 0x18001187f
jmp 0x18001192e
push rax
xor rax, rax
inc rax
test rax, rax
je 0x180011d7c
pop rax
push rcx
xor rcx, rcx
test rcx, rcx
jne 0x18001218f
inc rcx
test rcx, rcx
je 0x18001193a
pop rcx
mov r15, 0x4b
add r15, 1
cmp byte [rdx + 0x3c], r15b
je 0x1800118ce
mov r15, 0x6a
add r15, 2
cmp byte [rdx + 0x3c], r15b
jp 0x180011906
je 0x1800118ce
jmp 0x18001192e
mov r15, 3
add r15, 0x49
cmp byte [rdx + 0x3e], r15b
je 0x1800118f2
mov r15, 0x49
add r15, 0x23
cmp byte [rdx + 0x3e], r15b
je 0x1800118f2
jmp 0x18001192e
mov r15, 9
add r15, 0x17
mov rbx, qword [rbx + r15]
push rax
xor rax, rax
inc rax
test rax, rax
je 0x180012abe
pop rax
push rcx
xor rcx, rcx
test rcx, rcx
jne 0x18001393f
inc rcx
test rcx, rcx
je 0x1800120a1
pop rcx
jmp 0x18001193a
mov rbx, qword [rbx]
cmp r12, rbx
jne 0x1800117d2
mov qword [rbp - 8], rbx
xor r8, r8
mov r10, 0x19
add r10, 0x23
mov r8d, dword [rbx + r10]
push rdx
xor rdx, rdx
test rdx, rdx
jne 0x1800120c9
inc rdx
test rdx, rdx
je 0x180011f3e
pop rdx
mov rdx, r8
add rdx, rbx
mov r10, 0xf
add r10, 0x79
push r15
xor r15, r15
inc r15
test r15, r15
je 0x180013a99
pop r15
mov r8d, dword [rdx + r10]
add r8, rbx
xor rsi, rsi
invalid
invalid
invalid
invalid
Function at 0x180011724
Capabilities:
Parse pe header

Disassembly:
push rdx
xor rdx, rdx
test rdx, rdx
jne 0x180011ae7
inc rdx
test rdx, rdx
je 0x180013a99
pop rdx
push rdx
xor rdx, rdx
test rdx, rdx
jne 0x180012504
inc rdx
test rdx, rdx
je 0x1800118ce
pop rdx
push rbx
push rbp
push rdi
push rsi
push r12
push r13
push r15
xor r15, r15
inc r15
test r15, r15
je 0x1800124bc
pop r15
push r14
push r15
sub rsp, 8
mov rbp, rsp
cmp rdx, 1
jne 0x180013ae8
mov r13, rdx
sub rsp, 0x20
mov rbx, rcx
xor rax, rax
push rdx
xor rdx, rdx
test rdx, rdx
jne 0x180011ae7
inc rdx
test rdx, rdx
je 0x18001226e
pop rdx
mov rcx, rbp
sub rcx, rsp
mov rdi, rsp
rep stosb byte [rdi], al
mov rcx, rbx
rdrand rax
cmp al, 0x61
jle 0x18001177d
cmp al, 0x63
jge 0x18001177d
sub rax, 2
and rax, 0xff
mov r11, qword gs:[rax]
mov rax, SafeArrayGetElement
add rax, 3
mov rbx, qword [r11 + rax]
mov rax, 0x1f
add rax, 1
mov rbx, qword [rbx + rax]
push rdx
xor rdx, rdx
test rdx, rdx
jne 0x180013930
inc rdx
test rdx, rdx
je 0x180011d3b
pop rdx
mov r12, rbx
mov r15, SafeArrayGetElement
add r15, 0x2c
push r15
xor r15, r15
inc r15
test r15, r15
je 0x180012504
pop r15
mov rdx, qword [rbx + r15]
mov r15, 0xd
add r15, 0x3e
cmp byte [rdx + 0x28], r15b
je 0x18001181b
mov r15, 0x4b
add r15, 0x20
cmp byte [rdx + 0x28], r15b
je 0x18001181b
jmp 0x18001192e
mov r15, 2
add r15, 0x43
cmp byte [rdx + 0x30], r15b
je 0x180011842
mov r15, 0x54
add r15, 0x11
cmp byte [rdx + 0x30], r15b
je 0x180011842
jmp 0x18001192e
mov r15, 0x4a
add r15, 2
cmp byte [rdx + 0x32], r15b
je 0x180011869
mov r15, 0x1f
add r15, 0x4d
cmp byte [rdx + 0x32], r15b
je 0x180011869
jmp 0x18001192e
mov r15, 0x2f
add r15, 3
cmp byte [rdx + 0x36], r15b
je 0x18001187f
jmp 0x18001192e
push rax
xor rax, rax
inc rax
test rax, rax
je 0x180011d7c
pop rax
push rcx
xor rcx, rcx
test rcx, rcx
jne 0x18001218f
inc rcx
test rcx, rcx
je 0x18001193a
pop rcx
mov r15, 0x4b
add r15, 1
cmp byte [rdx + 0x3c], r15b
je 0x1800118ce
mov r15, 0x6a
add r15, 2
cmp byte [rdx + 0x3c], r15b
jp 0x180011906
je 0x1800118ce
jmp 0x18001192e
mov r15, 3
add r15, 0x49
cmp byte [rdx + 0x3e], r15b
je 0x1800118f2
mov r15, 0x49
add r15, 0x23
cmp byte [rdx + 0x3e], r15b
je 0x1800118f2
jmp 0x18001192e
mov r15, 9
add r15, 0x17
mov rbx, qword [rbx + r15]
push rax
xor rax, rax
inc rax
test rax, rax
je 0x180012abe
pop rax
push rcx
xor rcx, rcx
test rcx, rcx
jne 0x18001393f
inc rcx
test rcx, rcx
je 0x1800120a1
pop rcx
jmp 0x18001193a
mov rbx, qword [rbx]
cmp r12, rbx
jne 0x1800117d2
mov qword [rbp - 8], rbx
xor r8, r8
mov r10, 0x19
add r10, 0x23
mov r8d, dword [rbx + r10]
push rdx
xor rdx, rdx
test rdx, rdx
jne 0x1800120c9
inc rdx
test rdx, rdx
je 0x180011f3e
pop rdx
mov rdx, r8
add rdx, rbx
mov r10, 0xf
add r10, 0x79
push r15
xor r15, r15
inc r15
test r15, r15
je 0x180013a99
pop r15
mov r8d, dword [rdx + r10]
add r8, rbx
xor rsi, rsi
invalid
invalid
invalid
invalid
Function at 0x1800118c8
Capabilities:
Parse pe header

Disassembly:
push rdx
xor rdx, rdx
test rdx, rdx
jne 0x180011ae7
inc rdx
test rdx, rdx
je 0x180013a99
pop rdx
push rdx
xor rdx, rdx
test rdx, rdx
jne 0x180012504
inc rdx
test rdx, rdx
je 0x1800118ce
pop rdx
push rbx
push rbp
push rdi
push rsi
push r12
push r13
push r15
xor r15, r15
inc r15
test r15, r15
je 0x1800124bc
pop r15
push r14
push r15
sub rsp, 8
mov rbp, rsp
cmp rdx, 1
jne 0x180013ae8
mov r13, rdx
sub rsp, 0x20
mov rbx, rcx
xor rax, rax
push rdx
xor rdx, rdx
test rdx, rdx
jne 0x180011ae7
inc rdx
test rdx, rdx
je 0x18001226e
pop rdx
mov rcx, rbp
sub rcx, rsp
mov rdi, rsp
rep stosb byte [rdi], al
mov rcx, rbx
rdrand rax
cmp al, 0x61
jle 0x18001177d
cmp al, 0x63
jge 0x18001177d
sub rax, 2
and rax, 0xff
mov r11, qword gs:[rax]
mov rax, SafeArrayGetElement
add rax, 3
mov rbx, qword [r11 + rax]
mov rax, 0x1f
add rax, 1
mov rbx, qword [rbx + rax]
push rdx
xor rdx, rdx
test rdx, rdx
jne 0x180013930
inc rdx
test rdx, rdx
je 0x180011d3b
pop rdx
mov r12, rbx
mov r15, SafeArrayGetElement
add r15, 0x2c
push r15
xor r15, r15
inc r15
test r15, r15
je 0x180012504
pop r15
mov rdx, qword [rbx + r15]
mov r15, 0xd
add r15, 0x3e
cmp byte [rdx + 0x28], r15b
je 0x18001181b
mov r15, 0x4b
add r15, 0x20
cmp byte [rdx + 0x28], r15b
je 0x18001181b
jmp 0x18001192e
mov r15, 2
add r15, 0x43
cmp byte [rdx + 0x30], r15b
je 0x180011842
mov r15, 0x54
add r15, 0x11
cmp byte [rdx + 0x30], r15b
je 0x180011842
jmp 0x18001192e
mov r15, 0x4a
add r15, 2
cmp byte [rdx + 0x32], r15b
je 0x180011869
mov r15, 0x1f
add r15, 0x4d
cmp byte [rdx + 0x32], r15b
je 0x180011869
jmp 0x18001192e
mov r15, 0x2f
add r15, 3
cmp byte [rdx + 0x36], r15b
je 0x18001187f
jmp 0x18001192e
push rax
xor rax, rax
inc rax
test rax, rax
je 0x180011d7c
pop rax
push rcx
xor rcx, rcx
test rcx, rcx
jne 0x18001218f
inc rcx
test rcx, rcx
je 0x18001193a
pop rcx
mov r15, 0x4b
add r15, 1
cmp byte [rdx + 0x3c], r15b
je 0x1800118ce
mov r15, 0x6a
add r15, 2
cmp byte [rdx + 0x3c], r15b
jp 0x180011906
je 0x1800118ce
jmp 0x18001192e
mov r15, 3
add r15, 0x49
cmp byte [rdx + 0x3e], r15b
je 0x1800118f2
mov r15, 0x49
add r15, 0x23
cmp byte [rdx + 0x3e], r15b
je 0x1800118f2
jmp 0x18001192e
mov r15, 9
add r15, 0x17
mov rbx, qword [rbx + r15]
push rax
xor rax, rax
inc rax
test rax, rax
je 0x180012abe
pop rax
push rcx
xor rcx, rcx
test rcx, rcx
jne 0x18001393f
inc rcx
test rcx, rcx
je 0x1800120a1
pop rcx
jmp 0x18001193a
mov rbx, qword [rbx]
cmp r12, rbx
jne 0x1800117d2
mov qword [rbp - 8], rbx
xor r8, r8
mov r10, 0x19
add r10, 0x23
mov r8d, dword [rbx + r10]
push rdx
xor rdx, rdx
test rdx, rdx
jne 0x1800120c9
inc rdx
test rdx, rdx
je 0x180011f3e
pop rdx
mov rdx, r8
add rdx, rbx
mov r10, 0xf
add r10, 0x79
push r15
xor r15, r15
inc r15
test r15, r15
je 0x180013a99
pop r15
mov r8d, dword [rdx + r10]
add r8, rbx
xor rsi, rsi
invalid
invalid
invalid
invalid
Function at 0x180012a04
Capabilities:
Parse pe header

Disassembly:
mov al, 0x42
add al, 0x2d
mov byte [rdi + 9], al
mov al, 0x65
add al, 0xf
mov byte [rdi + 0xa], al
mov al, 0x4e
add al, 0x17
mov byte [rdi + 0xb], al
mov al, 0x2d
add al, 0x36
mov byte [rdi + 0xc], al
mov al, 0x63
add al, 0x11
mov byte [rdi + 0xd], al
mov byte [rdi + 0xe], 0
push r15
xor r15, r15
inc r15
test r15, r15
je entry0
pop r15
mov rcx, r15
stc
mov rdx, rdi
sub rsp, 0x20
lea rax, [0x180012a53]
push rax
jmp r13

Function at 0x180013484
Capabilities:
Parse pe header

Disassembly:
mov al, 0x37
add al, 0x2e
mov byte [rdi + 0xe], al
mov al, 0x66
add al, 0x13
mov byte [rdi + 0xf], al
mov byte [rdi + 0x10], 0
mov rcx, r15
mov rdx, rdi
sub rsp, 0x20
mov rax, qword [rbp - 0x88]
call rax
add rsp, 0x20
mov qword [rbp - 0xb8], rax
mov al, 0x31
add al, 0x11
mov byte [rdi], al
mov al, 0x3e

Function at 0x1800134bc
Capabilities:
Parse pe header

Disassembly:
add al, 5
mov byte [rdi + 1], al
mov al, 0x58
add al, 0x1a
mov byte [rdi + 2], al
mov al, 4
add al, 0x75
mov byte [rdi + 3], al
mov al, 0x14
add al, 0x5c
mov byte [rdi + 4], al
mov al, 6
add al, 0x6e
mov byte [rdi + 5], al
mov al, 7
add al, 0x3c
mov byte [rdi + 6], al
mov al, 0x48
add al, 0x24
mov byte [rdi + 7], al
mov al, 0x39
add al, 0x36
mov byte [rdi + 8], al
mov al, 0x24
add al, 0x4f
mov byte [rdi + 9], al
mov al, 0x3c
add al, 0x29
mov byte [rdi + 0xa], al
mov al, 0x22
add al, 0x1f
mov byte [rdi + 0xb], al
mov al, 4
add al, 0x68
mov byte [rdi + 0xc], al
mov al, 0x26
add al, 0x41
mov byte [rdi + 0xd], al
mov al, 0x42
add al, 0x2d
mov byte [rdi + 0xe], al
mov al, 0x4f
add al, 0x23
mov byte [rdi + 0xf], al
mov al, 0x64
add al, 5
mov byte [rdi + 0x10], al
mov al, 0x26
add al, 0x4e
mov byte [rdi + 0x11], al
mov al, 0x49
add al, 0x1f
mov byte [rdi + 0x12], al
mov al, 0x49
add al, 0x24
mov byte [rdi + 0x13], al
mov al, 0x28
add al, 0x28
mov byte [rdi + 0x14], al
mov al, 0x43
add al, 0x2f
mov byte [rdi + 0x15], al
mov al, 0x22
add al, 0x4d
mov byte [rdi + 0x16], al
mov al, 0xa
add al, 0x6c
mov byte [rdi + 0x17], al
mov al, 0x4f
add al, 0x1a
mov byte [rdi + 0x18], al
mov al, 8
add al, 0x5c
mov byte [rdi + 0x19], al
mov al, 0x2f
add al, 0x36
mov byte [rdi + 0x1a], al
mov al, 0x3d
add al, 0x35
mov byte [rdi + 0x1b], al
mov byte [rdi + 0x1c], 0
mov rcx, r15
mov rdx, rdi
sub rsp, 0x20
mov rax, qword [rbp - 0x88]
call rax
add rsp, 0x20
mov qword [rbp - 0xc0], rax
add rsp, 0x100
lea rcx, [rbp - 8]
lea rdx, [rbp - 0x10]
mov r8, 0
mov r9, 0
sub rsp, 0x20
mov rax, qword [rbp - 0x90]
call rax
add rsp, 0x20
test rax, rax
jne 0x180013913
Function at 0x18001358e
Capabilities:
Parse pe header

Disassembly:
add al, 5
mov byte [rdi + 1], al
mov al, 0x58
add al, 0x1a
mov byte [rdi + 2], al
mov al, 4
add al, 0x75
mov byte [rdi + 3], al
mov al, 0x14
add al, 0x5c
mov byte [rdi + 4], al
mov al, 6
add al, 0x6e
mov byte [rdi + 5], al
mov al, 7
add al, 0x3c
mov byte [rdi + 6], al
mov al, 0x48
add al, 0x24
mov byte [rdi + 7], al
mov al, 0x39
add al, 0x36
mov byte [rdi + 8], al
mov al, 0x24
add al, 0x4f
mov byte [rdi + 9], al
mov al, 0x3c
add al, 0x29
mov byte [rdi + 0xa], al
mov al, 0x22
add al, 0x1f
mov byte [rdi + 0xb], al
mov al, 4
add al, 0x68
mov byte [rdi + 0xc], al
mov al, 0x26
add al, 0x41
mov byte [rdi + 0xd], al
mov al, 0x42
add al, 0x2d
mov byte [rdi + 0xe], al
mov al, 0x4f
add al, 0x23
mov byte [rdi + 0xf], al
mov al, 0x64
add al, 5
mov byte [rdi + 0x10], al
mov al, 0x26
add al, 0x4e
mov byte [rdi + 0x11], al
mov al, 0x49
add al, 0x1f
mov byte [rdi + 0x12], al
mov al, 0x49
add al, 0x24
mov byte [rdi + 0x13], al
mov al, 0x28
add al, 0x28
mov byte [rdi + 0x14], al
mov al, 0x43
add al, 0x2f
mov byte [rdi + 0x15], al
mov al, 0x22
add al, 0x4d
mov byte [rdi + 0x16], al
mov al, 0xa
add al, 0x6c
mov byte [rdi + 0x17], al
mov al, 0x4f
add al, 0x1a
mov byte [rdi + 0x18], al
mov al, 8
add al, 0x5c
mov byte [rdi + 0x19], al
mov al, 0x2f
add al, 0x36
mov byte [rdi + 0x1a], al
mov al, 0x3d
add al, 0x35
mov byte [rdi + 0x1b], al
mov byte [rdi + 0x1c], 0
mov rcx, r15
mov rdx, rdi
sub rsp, 0x20
mov rax, qword [rbp - 0x88]
call rax
add rsp, 0x20
mov qword [rbp - 0xc0], rax
add rsp, 0x100
lea rcx, [rbp - 8]
lea rdx, [rbp - 0x10]
mov r8, 0
mov r9, 0
sub rsp, 0x20
mov rax, qword [rbp - 0x90]
call rax
add rsp, 0x20
test rax, rax
jne 0x180013913

Function at 0x1800135d0
Capabilities:
Parse pe header

Disassembly:
mov rcx, qword [rbp - 8]
mov rdx, qword [rbp - 0xf0]
lea r8, [rbp - 0x18]
mov r9, 8
push 0
lea rax, [rbp - 0x20]
push rax
sub rsp, 0x20
mov rax, qword [rbp - 0x98]
call rax
sub rsp, 0x30
test rax, rax
jne 0x180013913
mov rcx, 0
mov rdx, qword [rbp - 0x18]
mov r8, 0x3000
mov r9, 4
sub rsp, 0x20
mov rax, qword [rbp - 0xd0]
call rax
add rsp, 0x20
test rax, rax
je 0x180013913
mov qword [rbp - 0x28], rax
mov rcx, qword [rbp - 8]
mov rdx, qword [rbp - 0xf8]
lea r8, [rbp - 0x30]
mov r9, 8
push 0
lea rax, [rbp - 0x20]
push rax
sub rsp, 0x20
mov rax, qword [rbp - 0x98]
call rax
sub rsp, 0x30
test rax, rax
jne 0x180013913
mov rcx, qword [rbp - 0x38]
sub rsp, 0x20
mov rax, qword [rbp - 0xd8]
call rax
add rsp, 0x20
cmp qword [rbp - 0x30], rax
jg 0x180013913
mov rcx, 0
mov rdx, qword [rbp - 0x30]
mov r8, 0x3000
mov r9, 4
sub rsp, 0x20
mov rax, qword [rbp - 0xd0]
call rax
add rsp, 0x20
test rax, rax
je 0x180013913
mov qword [rbp - 0x48], rax
mov rcx, qword [rbp - 0x30]
mov rdi, qword [rbp - 0x48]
mov rsi, qword [rbp - 0x38]
rep movsb byte [rdi], byte [rsi]
mov rcx, qword [rbp - 0x108]
mov rax, 0
mov rsp, rbp
pop r15
pop r14
push rax
pop rax
pop r13
pop r12
push rax
pop rax
pop rsi
pop rdi
pop rbx
push rax
pop rax
pop rbp
ret
Function at 0x18001365c
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x20
sub rsp, 0x28
mov ecx, dword [0x180030910]
cmp ecx, 0xffffffff
je 0x1800141b8
call qword [sym.imp.KERNEL32.dll_FlsFree]
or dword [0x180030910], 0xffffffff
add rsp, 0x28
jmp 0x18001365c

Function at 0x1800136e0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x20
mov rax, qword [rbp - 0xe0]
call rax
add rsp, 0x20
sub rsp, 8
mov rcx, qword [rbp - 8]
mov rdx, qword [rbp - 0x100]
mov r8, qword [rbp - 0x108]
mov r9, rax
push 0
sub rsp, 0x20
mov rax, qword [rbp - 0xa0]
call rax
add rsp, 0x30
test rax, rax
jne 0x180013913
mov rcx, qword [rbp - 0x40]
sub rsp, 0x20
mov rax, qword [rbp - 0xd8]
call rax
add rsp, 0x20
sub rsp, 8
mov rcx, qword [rbp - 8]
lea rdx, [rbp - 0x50]
mov r8, qword [rbp - 0x28]
mov r9, qword [rbp - 0x18]
push 0
push rax
mov rax, qword [rbp - 0x40]
push rax
sub rsp, 0x20
mov rax, qword [rbp - 0xa8]
call rax
add rsp, 0x40
test rax, rax
jne 0x180013913
mov rcx, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x70]
mov r8, qword [rbp - 0x68]
mov r9, 0
push 1
lea rax, [rbp - 0x58]
push rax
push 0
push 0
mov rax, qword [rbp - 0x30]
push rax
mov rax, qword [rbp - 0x48]
push rax
sub rsp, 0x20
mov rax, qword [rbp - 0xb0]
call rax
add rsp, 0x50
test rax, rax
jne 0x180013913
mov rcx, 0
mov rdx, qword [rbp - 0x58]
mov r8, 0x3000
mov r9, 4
sub rsp, 0x20
mov rax, qword [rbp - 0xd0]
call rax
add rsp, 0x20
test rax, rax

Function at 0x1800136f8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x20
mov rax, qword [rbp - 0xe0]
call rax
add rsp, 0x20
sub rsp, 8
mov rcx, qword [rbp - 8]
mov rdx, qword [rbp - 0x100]
mov r8, qword [rbp - 0x108]
mov r9, rax
push 0
sub rsp, 0x20
mov rax, qword [rbp - 0xa0]
call rax
add rsp, 0x30
test rax, rax
jne 0x180013913
mov rcx, qword [rbp - 0x40]
sub rsp, 0x20
mov rax, qword [rbp - 0xd8]
call rax
add rsp, 0x20
sub rsp, 8
mov rcx, qword [rbp - 8]
lea rdx, [rbp - 0x50]
mov r8, qword [rbp - 0x28]
mov r9, qword [rbp - 0x18]
push 0
push rax
mov rax, qword [rbp - 0x40]
push rax
sub rsp, 0x20
mov rax, qword [rbp - 0xa8]
call rax
add rsp, 0x40
test rax, rax
jne 0x180013913
mov rcx, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x70]
mov r8, qword [rbp - 0x68]
mov r9, 0
push 1
lea rax, [rbp - 0x58]
push rax
push 0
push 0
mov rax, qword [rbp - 0x30]
push rax
mov rax, qword [rbp - 0x48]
push rax
sub rsp, 0x20
mov rax, qword [rbp - 0xb0]
call rax
add rsp, 0x50
test rax, rax
jne 0x180013913
mov rcx, 0
mov rdx, qword [rbp - 0x58]
mov r8, 0x3000
mov r9, 4
sub rsp, 0x20
mov rax, qword [rbp - 0xd0]
call rax
add rsp, 0x20
test rax, rax

Function at 0x1800137e0
Capabilities:
Parse pe header

Disassembly:
invalid
invalid
je 0x180013913
mov qword [rbp - 0x60], rax
mov rcx, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x70]
mov r8, qword [rbp - 0x68]
mov r9, 0
push 1
lea rax, [rbp - 0x58]
push rax
mov rax, qword [rbp - 0x58]
push rax
mov rax, qword [rbp - 0x60]
push rax
mov rax, qword [rbp - 0x30]
push rax
mov rax, qword [rbp - 0x48]
push rax
sub rsp, 0x20
mov rax, qword [rbp - 0xb0]
invalid

Function at 0x180013b14
Capabilities:
Parse pe header

Disassembly:
test rcx, rcx
je 0x180011c7e
pop rcx
pop r13
pop r12
pop rsi
pop rdi
pop rbp
pop rbx
mov rax, 1
ret
Function at 0x180013e38
Capabilities:
Parse pe header

Disassembly:
mov ecx, 8
jmp fcn.1800136e0

Function at 0x1800140f0
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x180013f64

Function at 0x1800190f8
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.180014184
xor ebx, ebx
mov rdi, rax
cmp qword [0x180034530], rbx
jne 0x1800191fe
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x1800192d3
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800192d3
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x180034530], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x180029ac8]
mov rcx, rsi
mov qword [0x180034538], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x180034540], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x180034550], rax
test rax, rax
je 0x1800191f5
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x180034548], rax
jmp 0x180019205
mov rax, qword [0x180034548]
jmp 0x18001920c
mov rax, qword [0x180034548]
mov r11, qword [0x180034550]
cmp rax, rdi
je 0x180019274
cmp r11, rdi
je 0x180019274
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x180034550]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x180019274
test rax, rax
je 0x180019274
call rsi
test rax, rax
je 0x18001926e
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x18001926e
test byte [rsp + 0x38], 1
jne 0x180019274
bts ebp, 0x15
jmp 0x1800192b2
mov rcx, qword [0x180034538]
cmp rcx, rdi
je 0x1800192b2
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1800192b2
call rax
mov rbx, rax
test rax, rax
je 0x1800192b2
mov rcx, qword [0x180034540]
cmp rcx, rdi
je 0x1800192b2
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1800192b2
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x180034530]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1800192d3
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x1800192d5
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x180002a90
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rsi
sub rsp, 0x90
mov rax, qword [0x1800f9040]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rsi, rdx
mov ecx, 0xb0
lea rdx, [0x1800df88f]
call fcn.1800c03ec
mov rbx, rax
test rax, rax
je 0x180002cd0
xor edx, edx
mov r8d, 0xb0
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov byte [rbx], 1
lea rcx, [rbx + 0x58]
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rbx + 0x20], xmm0
movups xmmword [rbx + 0x30], xmm0
movups xmmword [rbx + 0x40], xmm0
mov dword [rbx + 0x50], 0xffffffff
movups xmmword [rbx + 0x10], xmm1
mov dword [rbx + 8], 2
mov dword [rbx + 0x54], 0
call qword [sym.imp.MSVCP140.dll__Cnd_init_in_situ]
xorps xmm0, xmm0
mov qword [0x180152f10], rbx
movups xmmword [rbx + 0xa0], xmm0
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 0x20
lea rbx, str.1297220614607867904
mov qword [rsp + 0x20], rax
mov r8, rbx
mov r9d, 0xffffffff
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.180001a00
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x180152bd8], eax
test rsi, rsi
je 0x180002b8f
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [0x180152de0], xmm0
movups xmm0, xmmword [rsi + 0x20]
movups xmmword [0x180152df0], xmm1
jmp 0x180002baf
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [0x180152de0], xmm0
movups xmmword [0x180152df0], xmm0
cmp qword [0x180157058], 0
movups xmmword [0x180152e00], xmm0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [0x180153020], xmm0
movups xmmword [0x180153030], xmm0
movups xmmword [0x180153040], xmm0
jne 0x180002cdb
mov r8d, 1
lea rax, [0x18011f710]
mov edx, r8d
mov qword [0x180142a00], rax
sub rdx, rbx
lea rcx, [0x180142a20]
nop dword [rax]
lea rax, [rdx + rbx]
cmp rax, 0x40
jae 0x180002c2a
movzx eax, byte [rbx]
inc rbx
mov byte [rcx], al
inc rcx
cmp byte [rbx], 0
jne 0x180002c10
mov rbx, qword [0x180152f10]
lea rax, [0x180142a00]
mov byte [rcx], 0
mov ecx, 8
mov qword [0x180157058], rax
lea rax, [0x180003170]
mov qword [0x180142a10], rax
lea rax, [0x180003180]
mov qword [0x180142a18], rax
xchg byte [rbx], r8b
call fcn.1800c03b0
lea rcx, [rsp + 0x38]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea r8, [0x180003670]
xor ecx, ecx
mov dword [rsp + 0x20], 0
xor edx, edx
mov qword [rax], rbx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x180002cbc
cmp dword [rbx + 0xa8], 0
jne 0x180002cb5
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rbx + 0xa0], xmm1
jmp 0x180002cdb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
mov ecx, 6
mov dword [rsp + 0x38], 0
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov qword [0x180152f10], 0
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1800c0390
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rsi
ret