joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140095240
Capabilities:
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x3f]
sub rsp, 0x88
mov rdi, rcx
mov esi, 1
mov rax, qword [rcx + 0x20]
neg rax
sbb rdx, rdx
mov qword [rbp + 7], rdx
cmp qword [rcx + 0x20], 0
je 0x14009542e
xor esi, esi
and qword [rbp + 0x17], rsi
and dword [rbp + 0x1f], esi
and qword [rbp + 0x27], rsi
mov rax, qword [rcx]
lea rdx, [rbp + 0xf]
mov rax, qword [rax + 0x40]
call qword [case.0x14006ccde.0]
mov rbx, rax
call fcn.140034118
mov rbx, qword [rbx]
xor edx, edx
mov rcx, qword [rax + 8]
call fcn.140039bd4
and qword [rbp + 0x77], rsi
lea rcx, [rbp + 0x67]
mov qword [rsp + 0x40], rcx
lea rcx, [rbp + 0x77]
mov qword [rsp + 0x38], rcx
and qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x2001f
and dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, eax
test eax, eax
jne 0x1400952f0
mov rax, qword [rbp + 0x77]
mov qword [rbp + 0x17], rax
and dword [rbp + 0x1f], ebx
mov rdx, qword [rbp + 0xf]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140095315
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14006ccde.0]
test ebx, ebx
jne 0x14009541f
call fcn.140030514
mov rcx, rax
test rax, rax
je 0x14009543c
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14006ccde.0]
add rax, 0x18
mov qword [rbp + 0x6f], rax
call fcn.140030514
mov rcx, rax
test rax, rax
je 0x140095447
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14006ccde.0]
add rax, 0x18
mov qword [rbp + 0x7f], rax
lea rcx, [rdi + 8]
lea r9, [rbp + 0x7f]
lea r8, [rbp + 0x6f]
lea rdx, [rbp + 7]
call fcn.1400934b8
mov rbx, qword [rbp + 0x7f]
test rbx, rbx
je 0x1400953b7
mov rcx, rbx
call fcn.1401cd46c
lea ecx, [rax*2 + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
mov rdx, qword [rbp + 0x6f]
mov rcx, qword [rbp + 0x17]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400953d9
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14006ccde.0]
nop
mov rdx, qword [rbp + 0x6f]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400953fe
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14006ccde.0]
cmp qword [rbp + 7], 0
jne 0x14009531d
mov rcx, qword [rbp + 0x17]
test rcx, rcx
je 0x140095418
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x140095430
mov rcx, qword [rbp + 0x17]
test rcx, rcx
je 0x14009542e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
add rsp, 0x88
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80004005
call fcn.140011860
nop
mov ecx, 0x80004005
call fcn.140011860
int3
Function at 0x140096218
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rdx, [rsp + 0x34]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x30], eax
cmp eax, 0xffffffff
jne 0x140096254
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140096254
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [rbx + 0x18]
mov ecx, eax
call fcn.140136b98
mov rax, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret

Function at 0x140096568
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
test r8d, r8d
jne 0x14009657a
xor eax, eax
jmp 0x1400965a8
mov rcx, qword [rcx + 8]
lea r9, [rsp + 0x50]
and qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400965a4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [rbx + 0x18]
mov ecx, eax
call fcn.140136b98
mov eax, dword [rsp + 0x50]
add rsp, 0x30
pop rbx
ret

Function at 0x140096684
Capabilities:
Write file on windows

Disassembly:
test r8d, r8d
je 0x1400966d3
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
and qword [rsp + 0x20], 0
lea rdi, [rcx + 0x18]
mov rcx, qword [rcx + 8]
lea r9, [rsp + 0x50]
mov ebx, r8d
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400966c3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [rdi]
mov ecx, eax
call fcn.140136b98
cmp dword [rsp + 0x50], ebx
jne 0x1400966d4
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rcx, rdi
call fcn.140011a50
or edx, 0xffffffff
mov r8, rax
lea ecx, [rdx + 0xe]
call fcn.1401366f8
int3

Function at 0x1400b5cd4
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rax, qword [rcx + 0x28]
xor ebx, ebx
mov rdi, rcx
cmp dword [rax - 0x10], ebx
je 0x1400b5d43
call fcn.140039258
test rax, rax
je 0x1400b5d12
mov rdx, qword [rax]
mov rcx, rax
mov rax, qword [rdx + 0xe8]
call qword [case.0x14006ccde.0]
test rax, rax
je 0x1400b5d12
mov rbx, qword [rax + 0x40]
mov rdx, qword [rdi + 0x18]
mov rcx, rbx
mov r9, qword [rdi + 0x10]
mov r8, qword [rdi + 0x28]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rdx
xor edx, edx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x20
jb 0x1400b5d43
mov eax, 1
jmp 0x1400b5d45
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140104dac
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov eax, dword [rdx + 8]
mov rbx, rcx
mov ecx, 0x104
xor edi, edi
mov rsi, rdx
cmp eax, ecx
ja 0x140104f5b
je 0x140104f81
cmp eax, 0xa1
jb 0x140104fcc
cmp eax, 0xa2
jbe 0x140104f81
cmp eax, 0xa3
jbe 0x140104fcc
cmp eax, 0xa5
jbe 0x140104f81
cmp eax, 0xa6
jbe 0x140104fcc
cmp eax, 0xa8
jbe 0x140104f81
cmp eax, 0x100
jne 0x140104fcc
cmp dword [rbx + 0x154], 0xffffffff
je 0x140104f81
lea ecx, [rdi + 0x11]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x140104f81
mov rax, qword [rsi + 0x10]
sub rax, 0x21
je 0x140104eb5
cmp rax, 1
jne 0x140104f81
mov eax, dword [rbx + 0x154]
mov r8d, dword [rbx + 0x150]
lea esi, [rax + 1]
add eax, r8d
cmp esi, eax
jge 0x140104fea
mov eax, esi
mov rcx, rbx
cdq
idiv r8d
mov rax, qword [rbx]
mov ebp, edx
mov rax, qword [rax + 0x4f8]
call qword [case.0x14006ccde.0]
test eax, eax
jne 0x140104efd
mov ecx, dword [rbx + 0x154]
inc esi
mov r8d, dword [rbx + 0x150]
add ecx, r8d
cmp esi, ecx
jl 0x140104e7b
jmp 0x140104fea
mov ecx, dword [rbx + 0x154]
lea esi, [rcx - 1]
add esi, dword [rbx + 0x150]
cmp esi, ecx
jle 0x140104fea
mov eax, esi
mov rcx, rbx
cdq
idiv dword [rbx + 0x150]
mov rax, qword [rbx]
mov ebp, edx
mov rax, qword [rax + 0x4f8]
call qword [case.0x14006ccde.0]
test eax, eax
jne 0x140104efd
dec esi
cmp esi, dword [rbx + 0x154]
jg 0x140104ecc
jmp 0x140104fea
mov rax, qword [rbx]
mov edx, ebp
mov rcx, rbx
mov dword [rbx + 0x3b8], 1
mov rax, qword [rax + 0x428]
call qword [case.0x14006ccde.0]
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x420]
call qword [case.0x14006ccde.0]
mov rcx, rax
call fcn.140033250
mov rax, qword [rbx]
mov rcx, rbx
mov edx, dword [rbx + 0x154]
mov rax, qword [rax + 0x4e0]
call qword [case.0x14006ccde.0]
mov dword [rbx + 0x3b8], edi
jmp 0x140104fea
cmp eax, 0x200
jb 0x140104fcc
cmp eax, 0x202
jbe 0x140104f81
cmp eax, 0x203
jbe 0x140104fcc
cmp eax, 0x205
jbe 0x140104f81
add eax, 0xfffffdf9
cmp eax, 1
ja 0x140104fcc
mov rax, qword [rbx + 0x1c0]
mov ebp, 0x407
test rax, rax
je 0x140104fa9
mov rcx, qword [rax + 0x40]
test rcx, rcx
je 0x140104fa9
mov r9, rsi
xor r8d, r8d
mov edx, ebp
call qword [sym.imp.USER32.dll_SendMessageW]
mov rax, qword [rbx + 0x1b8]
test rax, rax
je 0x140104fcc
mov rcx, qword [rax + 0x40]
test rcx, rcx
je 0x140104fcc
mov r9, rsi
xor r8d, r8d
mov edx, ebp
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [rsi + 8], 0x203
jne 0x140104ff1
lea rax, [rbx + 0x3208]
test rax, rax
je 0x140104fe5
mov rdi, qword [rax + 0x40]
cmp qword [rsi], rdi
jne 0x140104ff1
mov eax, 1
jmp 0x140104ffc
mov rdx, rsi
mov rcx, rbx
call fcn.1400fdc94
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140173a0c
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x40
and dword [rax - 0x18], 0
mov rbp, r9
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
lea rcx, [rsp + 0x30]
call fcn.1401d416c
test eax, eax
jne 0x140173a70
mov eax, dword [rsp + 0x30]
lea r8, str._s_s_X.tmp
mov dword [rsp + 0x28], eax
mov r9, rsi
mov rdx, rbp
mov qword [rsp + 0x20], rdi
mov rcx, rbx
call fcn.14003a8a0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140173a82
jmp 0x140173a30
mov r9, rbx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1401b1d94
Capabilities:
Log keystrokes via polling
Open clipboard
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rsi, rdx
mov rbp, rcx
cmp dword [rdx + 8], 0x100
jne 0x1401b1ebf
mov ebx, dword [rdx + 0x10]
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x1401b1ebf
cmp ebx, 0x43
je 0x1401b1de2
cmp ebx, 0x2d
jne 0x1401b1ebf
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1401b1ebf
call qword [sym.imp.USER32.dll_EmptyClipboard]
call fcn.140030514
mov rcx, rax
test rax, rax
je 0x1401b1ede
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14006ccde.0]
add rax, 0x18
mov qword [rsp + 0x48], rax
movzx eax, byte [rbp + 0x196]
movzx r9d, byte [rbp + 0x195]
movzx r8d, byte [rbp + 0x194]
mov dword [rsp + 0x20], eax
lea rdx, str.RGB__d___d___d_
lea rcx, [rsp + 0x48]
call fcn.140011970
mov rbx, qword [rsp + 0x48]
mov eax, dword [rbx - 0x10]
inc eax
movsxd rdx, eax
add rdx, rdx
mov ecx, 0x2000
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rdi
mov ecx, SafeArrayGetDim
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1401b1ebf
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14006ccde.0]
mov rdx, rsi
mov rcx, rbp
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
jmp method.CDialogEx.virtual_536
mov ecx, 0x80004005
call fcn.140011860
int3

Function at 0x1401c827c
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x1401c810f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1401c810f
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401c810f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401c810f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401c810f
cmp dword [rcx + 0x84], 0xe
jbe 0x1401c810f
cmp dword [rcx + 0xf8], 0
je 0x1401c810f
mov ecx, ebx
call fcn.1401c81b0
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.1401c7fa0
cmp dword [rbp + 0x20], 0
je 0x1401c815c
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1401c8164
int3
xor r8d, r8d
xor edx, edx
jmp 0x1401c80a8
Function at 0x140001020
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
and qword [rsp + 0x58], 0
lea r9, [rsp + 0x58]
mov rbx, r8
mov rdi, rcx
xor r8d, r8d
lea rcx, [0x14000ba78]
xor edx, edx
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
nop dword [rax + rax]
test eax, eax
jns 0x14000105e
mov ebx, 3
jmp 0x140001086
mov r9, qword [rsp + 0x58]
lea r8, str._s_s
mov edx, 0x208
mov qword [rsp + 0x20], rbx
mov rcx, rdi
call fcn.14000124c
xor ebx, ebx
test eax, eax
lea ecx, [rbx + 0xd]
cmovs ebx, ecx
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14000109c
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1400010b0
Capabilities:
Create process on windows
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], r14
push rbp
lea rbp, [rax - 0x4d8]
sub rsp, 0x5d0
mov rax, qword [0x14000d948]
xor rax, rsp
mov qword [rbp + 0x4c0], rax
xor edx, edx
lea rcx, [rbp - 0x6c]
mov r8d, 0x118
xor esi, esi
call fcn.140008c80
lea rcx, [rbp - 0x70]
mov dword [rbp - 0x70], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
nop dword [rax + rax]
lea r14d, [rsi + 1]
mov word [rbp + 0xb0], si
cmp byte [rbp + 0xaa], r14b
mov eax, esi
cmove eax, r14d
test eax, eax
jne 0x14000116e
lea r8, str.Server_Manager.lnk
lea rcx, [rbp + 0xb0]
call fcn.140001020
lea rcx, [rbp + 0xb0]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
test ebx, ebx
jne 0x14000115a
cmp eax, 0xffffffff
je 0x14000115a
test al, 0x10
je 0x14000118b
xor edx, edx
lea rcx, [rbp + 0xb0]
mov r8d, 0x410
call fcn.140008c80
lea r8, str.Computer_Management.lnk
lea rcx, [rbp + 0xb0]
call fcn.140001020
mov ebx, eax
test eax, eax
jne 0x140001218
lea rdx, [rbp + 0xb0]
lea rcx, str.Snapin_path___ws_n
call fcn.140001008
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x70]
call fcn.140008c80
lea rax, [rbp + 0xb0]
mov dword [rsp + 0x20], 0x70
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x20]
lea rax, str.open
mov dword [rsp + 0x50], 5
mov qword [rsp + 0x30], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
nop dword [rax + rax]
test eax, eax
jne 0x1400011fb
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
jmp 0x140001210
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x140001210
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test ebx, ebx
jne 0x140001218
xor eax, eax
jmp 0x14000121b
mov eax, r14d
mov rcx, qword [rbp + 0x4c0]
xor rcx, rsp
call fcn.140001520
lea r11, [rsp + 0x5d0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov r14, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140001a90
Capabilities:
Enumerate pe sections

Disassembly:
mov rax, qword [rax]
mov rcx, qword [rsp + 0x88]
mov rcx, qword [rcx]
movzx ecx, word [rcx + 0x14]
lea rax, [rax + rcx + 0x18]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x88]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x24], 0
jmp 0x140004251
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x58
mov rax, qword [rsp + 0x88]
mov rax, qword [rax + 8]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x88]
jmp 0x14000166c
mov rax, qword [rsp + 0x88]
mov rax, qword [rax]
movzx eax, word [rax + 6]
cmp dword [rsp + 0x24], eax
jge 0x140006763
jmp 0x140002a3d
jmp 0x140003cc6
Function at 0x140001beb
Capabilities:
Inspect section memory permissions

Disassembly:
mov dword [rsp + 0x64], 0x80
mov dword [rsp + 0x68], 0x20
mov dword [rsp + 0x6c], 0x40
movsxd rax, dword [rsp + 0x40]
imul rax, rax, 0x10
lea rax, [rsp + rax + 0x50]
movsxd rcx, dword [rsp + 0x44]
lea rax, [rax + rcx*8]
movsxd rcx, dword [rsp + 0x48]
jmp 0x140006b5e
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x98]
cmp qword [rax + 0x10], 0
jne 0x140001c5c
jmp 0x140005ccc
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 0x18]
and eax, 0x2000000
test eax, eax
jne 0x140006d44
jmp 0x14000821b
cmp qword [rsp + 0x38], 0
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 0x18]
and eax, 0x40000000
test eax, eax
je 0x140002fc6
jmp 0x1400044c4
mov dword [rsp + 0x24], 0
jmp 0x140002644
mov eax, dword [rsp + 0x2c]
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x50], 1
mov dword [rsp + 0x54], 8
mov dword [rsp + 0x58], 2
mov dword [rsp + 0x5c], 4
mov dword [rsp + 0x60], 0x10
jmp 0x1400016ae
mov dword [rsp + 0x28], 0
jmp 0x140004c14
mov dword [rsp + 0x2c], 0
jmp 0x140002f3b
mov rax, qword [rsp + 0x98]
cmp dword [rax + 0x1c], 0
jne 0x140007cde
jmp 0x1400046fa
mov rax, qword [rsp + 0x90]
mov eax, dword [rax + 0x40]
mov qword [rsp + 0x70], rax
xor edx, edx
mov rcx, qword [rsp + 0x98]
mov rax, qword [rcx + 0x10]
mov rcx, qword [rsp + 0x70]
div rcx
mov rax, rdx
test rax, rax
jne 0x140007681
jmp 0x140007cde
mov dword [rsp + 0x28], 1
jmp 0x140004c14
mov rax, qword [rsp + 0x90]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x90]
mov ecx, dword [rcx + 0x40]
cmp dword [rax + 0x38], ecx
je 0x140007cde
jmp 0x140003fc4
mov eax, dword [rsp + 0x28]
mov dword [rsp + 0x44], eax
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 0x18]
and eax, 0x80000000
test eax, eax
jne 0x140006ffb
jmp 0x1400033d3
mov dword [rsp + 0x24], 1
jmp 0x140002644
mov eax, 1
jmp 0x1400016a6
mov eax, dword [rax + rcx*4]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 0x18]
and eax, 0x4000000
test eax, eax
jne 0x140007c1b
jmp 0x140001ed2
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x98]
mov rcx, qword [rcx + 8]
cmp qword [rax], rcx
je 0x140003a00
jmp 0x14000799d
mov dword [rsp + 0x2c], 1
jmp 0x140002f3b
mov r8d, 0x4000
mov rax, qword [rsp + 0x98]
mov rdx, qword [rax + 0x10]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rax]
call qword [0x140083415]
jmp 0x140007681
mov eax, 1
jmp 0x1400016a6
mov eax, 1
jmp 0x1400016a6
mov eax, dword [rsp + 0x20]
bts eax, 9
mov dword [rsp + 0x20], eax
cmp qword [rsp + 0x38], 0
jne 0x1400062f7
jmp 0x140003603
mov r8d, 0x4000
mov rax, qword [rsp + 0x98]
mov rdx, qword [rax + 0x10]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rax]
mov rax, qword [rsp + 0x38]
call qword [rax + 8]
jmp 0x140007681
cmp qword [rsp + 0x38], 0
je 0x14000709b
jmp 0x140007c39
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 0x18]
and eax, 0x20000000
test eax, eax
je 0x140002b87
jmp 0x140005232
Function at 0x140001c08
Capabilities:
Inspect section memory permissions

Disassembly:
mov dword [rsp + 0x64], 0x80
mov dword [rsp + 0x68], 0x20
mov dword [rsp + 0x6c], 0x40
movsxd rax, dword [rsp + 0x40]
imul rax, rax, 0x10
lea rax, [rsp + rax + 0x50]
movsxd rcx, dword [rsp + 0x44]
lea rax, [rax + rcx*8]
movsxd rcx, dword [rsp + 0x48]
jmp 0x140006b5e
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x98]
cmp qword [rax + 0x10], 0
jne 0x140001c5c
jmp 0x140005ccc
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 0x18]
and eax, 0x2000000
test eax, eax
jne 0x140006d44
jmp 0x14000821b
cmp qword [rsp + 0x38], 0
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 0x18]
and eax, 0x40000000
test eax, eax
je 0x140002fc6
jmp 0x1400044c4
mov dword [rsp + 0x24], 0
jmp 0x140002644
mov eax, dword [rsp + 0x2c]
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x50], 1
mov dword [rsp + 0x54], 8
mov dword [rsp + 0x58], 2
mov dword [rsp + 0x5c], 4
mov dword [rsp + 0x60], 0x10
jmp 0x1400016ae
mov dword [rsp + 0x28], 0
jmp 0x140004c14
mov dword [rsp + 0x2c], 0
jmp 0x140002f3b
mov rax, qword [rsp + 0x98]
cmp dword [rax + 0x1c], 0
jne 0x140007cde
jmp 0x1400046fa
mov rax, qword [rsp + 0x90]
mov eax, dword [rax + 0x40]
mov qword [rsp + 0x70], rax
xor edx, edx
mov rcx, qword [rsp + 0x98]
mov rax, qword [rcx + 0x10]
mov rcx, qword [rsp + 0x70]
div rcx
mov rax, rdx
test rax, rax
jne 0x140007681
jmp 0x140007cde
mov dword [rsp + 0x28], 1
jmp 0x140004c14
mov rax, qword [rsp + 0x90]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x90]
mov ecx, dword [rcx + 0x40]
cmp dword [rax + 0x38], ecx
je 0x140007cde
jmp 0x140003fc4
mov eax, dword [rsp + 0x28]
mov dword [rsp + 0x44], eax
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 0x18]
and eax, 0x80000000
test eax, eax
jne 0x140006ffb
jmp 0x1400033d3
mov dword [rsp + 0x24], 1
jmp 0x140002644
mov eax, 1
jmp 0x1400016a6
mov eax, dword [rax + rcx*4]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 0x18]
and eax, 0x4000000
test eax, eax
jne 0x140007c1b
jmp 0x140001ed2
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x98]
mov rcx, qword [rcx + 8]
cmp qword [rax], rcx
je 0x140003a00
jmp 0x14000799d
mov dword [rsp + 0x2c], 1
jmp 0x140002f3b
mov r8d, 0x4000
mov rax, qword [rsp + 0x98]
mov rdx, qword [rax + 0x10]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rax]
call qword [0x140083415]
jmp 0x140007681
mov eax, 1
jmp 0x1400016a6
mov eax, 1
jmp 0x1400016a6
mov eax, dword [rsp + 0x20]
bts eax, 9
mov dword [rsp + 0x20], eax
cmp qword [rsp + 0x38], 0
jne 0x1400062f7
jmp 0x140003603
mov r8d, 0x4000
mov rax, qword [rsp + 0x98]
mov rdx, qword [rax + 0x10]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rax]
mov rax, qword [rsp + 0x38]
call qword [rax + 8]
jmp 0x140007681
cmp qword [rsp + 0x38], 0
je 0x14000709b
jmp 0x140007c39
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 0x18]
and eax, 0x20000000
test eax, eax
je 0x140002b87
jmp 0x140005232
Function at 0x140005530
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movzx eax, word [rsp + 0x28]
mov rcx, qword [rsp + 0x70]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x1a0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x1a8]
sub rcx, rax
jmp 0x140008238
jmp 0x1400038c7
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x18]
cmp dword [rsp + 0x24], eax
jb 0x14000687c
jmp 0x140004cc4
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
lea rax, [rcx + rax + 1]
mov qword [rsp + 0x88], rax
movsxd rax, dword [rsp + 0x20]
mov ecx, 0x2e
mov word [rsp + rax*2 + 0x90], cx
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
jmp 0x1400075b5
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x18]
cmp dword [rsp + 0x24], eax
jae 0x140004cc4
jmp 0x14000687c
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
add rsp, 0x198
ret
mov rax, qword [rsp + 0x38]
add rsp, 0x198
ret
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
movsx eax, byte [rcx + rax]
cmp eax, 0x2e
je 0x140003633
jmp 0x140004f21
jmp 0x1400033fc
test eax, eax
jne 0x140002993
jmp 0x140005209
mov rax, qword [rsp + 0x48]
mov eax, dword [rax + 4]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
cmp qword [rsp + 0x38], rax
jbe 0x140006329
jmp 0x1400039e6
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
jae 0x14000471f
jmp 0x1400039e6
movsxd rax, dword [rsp + 0x20]
movsxd rcx, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x40]
movsx ax, byte [rdx + rax]
mov word [rsp + rcx*2 + 0x90], ax
jmp 0x140003a81
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x38], rax
jmp 0x140004cc4
inc rax
test dl, dl
jne 0x140008238
jmp 0x1400081af
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x198
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x1a0]
add rcx, rax
jmp 0x140006a67
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x1a0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x1a0]
jmp 0x1400065dc
sbb eax, eax
or eax, 1
jmp 0x1400046ed
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x20], 0
jmp 0x1400072ef
invalid
invalid
xchg esp, eax