joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180172b3b
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
movzx eax, r14w
cdqe
movsx ax, r12b
push rsi
cdqe
cwde
push rdi
push r14
mov eax, 0x1450
call fcn.1801765fc
sub rsp, rax
setne al
bswap rsi
sal rsi, 0xe5
mov rax, qword [0x18009a010]
xor rax, rsp
cmp bp, ax
sub r14w, bx
mov qword [rsp + 0x1440], rax
sbb bpl, r12b
movsxd r10, edx
mov rdi, rcx
xchg r14w, cx
movsx r14w, r12b
adc esi, 0x23ff317c
mov rax, r10
mov ebp, r9d
test r12w, 0x970
stc
sar rax, 6
bt r14w, 0x3a
movsxd rdx, ebp
rol dx, 0x5b
lea rcx, [0x18009c930]
and r10d, 0x3f
btr dx, bp
sal r14w, cl
rcr sil, 0x75
lea rbp, [rbp + r8]
test dil, bl
movsx dx, bpl
mov rsi, r8
btc r14d, r15d
mov rax, qword [rcx + rax*8]
cmovb rdx, rdi
add dh, 0x6e
lea rdx, [r10 + r10*8]
shl r14d, cl
test r9d, r14d
shr r14w, cl
mov r14, qword [rax + rdx*8 + 0x28]
clc
jmp 0x180172c0e
xor eax, eax
stc
cmc
mov qword [rdi], rax
cmp r13b, 0x20
cmc
stc
mov dword [rdi + 8], eax
cmp dil, r12b
test r15b, 0x27
cmp r8, rbp
jmp 0x180172c2d
jae 0x180172d1a
lea rbx, [rsp + 0x40]
jmp 0x180172c3d
cmp rsi, rbp
jmp 0x180172c45
jae 0x180172ca3
mov al, byte [rsi]
inc rsi
cmp al, 0xa
jmp 0x180172c57
jne 0x180172c75
inc dword [rdi + 8]
jmp 0x180172c65
mov byte [rbx], 0xd
jmp 0x180172c6d
inc rbx
jmp 0x180172c75
mov byte [rbx], al
movzx ax, sil
movsx ax, r9b
inc rbx
ror ax, 0x85
lea rax, [rsp + 0x143f]
stc
cmp r11b, 0x78
cmp rbx, rax
jmp 0x180172c9d
jb 0x180172c3d
and qword [rsp + 0x20], 0
lea rax, [rsp + 0x40]
sub ebx, eax
lea r9, [rsp + 0x30]
mov rdx, r8
jmp 0x180172cc2
mov r8d, ebx
lea rdx, [rsp + 0x40]
setg ch
movsxd rcx, r12d
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x180172ce0
je 0x180172d12
mov eax, dword [rsp + 0x30]
jmp 0x180172cef
add dword [rdi + 4], eax
cmp eax, ebx
jmp 0x180172cf9
jb 0x180172d1a
cmp rsi, rbp
jmp 0x180172d07
jb 0x180172c33
jmp 0x180172d1a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
mov rax, rdi
xor cx, r11w
mov rcx, qword [rsp + 0x1440]
cmc
xor rcx, rsp
call fcn.180159e82
lea r11, [rsp + 0x1450]
not rbp
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
cmovs rdi, r12
bswap si
movsx rsi, bp
mov rsp, r11
movzx r14d, r12w
movsx esi, sp
pop r14
mov rsi, r8
movzx di, dl
xchg sil, sil
pop rdi
pop rsi
jmp 0x180172d6d
ret
Function at 0x180172d6e
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
movzx eax, r14w
mov qword [rsp + 0x18], rbp
cmovbe ax, r15w
push rsi
movsx rax, r10w
movzx ax, bpl
push rdi
movzx ax, r14b
cmovno ax, r8w
push r14
cwde
movsxd rax, edi
mov eax, 0x1450
jmp 0x180172da6
call fcn.1801765fc
sub rsp, rax
cwde
xchg dil, dil
rcr r14b, cl
mov rax, qword [0x18009a010]
bts r14d, r10d
rcl r10b, 0xc2
mov r10b, 0x64
xor rax, rsp
shl bp, 0x9e
adc sil, r11b
rol r14b, 0x38
mov qword [rsp + 0x1440], rax
or ax, 0x1eb1
btr esi, r8d
movsxd r10, edx
rol dx, 0x72
movsx rax, r14w
lahf
mov rdi, rcx
cmp r10d, 0x497777b6
stc
mov rax, r10
mov ebp, r9d
sbb sil, 0xab
sar rax, 6
xadd edx, edx
rcl dx, 0x97
lea rcx, [0x18009c930]
and dx, 0x45dd
rol dx, 0x16
and r10d, 0x3f
rol dx, cl
lea rbp, [rbp + r8]
mov rsi, r8
shl r14, cl
mov rax, qword [rcx + rax*8]
shr r14b, cl
shr dx, 0x64
adc r14w, 0x3e66
lea rdx, [r10 + r10*8]
xadd r14b, r14b
movzx r14, r9w
rol r14w, 0xe7
mov r14, qword [rax + rdx*8 + 0x28]
test sp, 0x7e3d
xor eax, eax
clc
cmc
mov qword [rdi], rax
mov dword [rdi + 8], eax
cmp ebx, 0x3db02dbd
test sil, r8b
cmp edi, r15d
cmp r8, rbp
jmp 0x180172e7d
jae 0x180172fb1
lea rbx, [rsp + 0x40]
cmp rsi, rbp
jmp 0x180172e90
jae 0x180172f11
movzx eax, word [rsi]
cmc
jmp 0x180172e9f
add rsi, 2
stc
test r10d, 0x18c11968
cmp ax, 0xa
jmp 0x180172eb4
jne 0x180172edb
add dword [rdi + 8], 2
rcr cx, cl
clc
mov ecx, 0xd
cmp rcx, 0x6496ce3
mov word [rbx], cx
cmp r14w, 0x3682
add rbx, 2
mov word [rbx], ax
sal ah, 5
shrd ax, r10w, 0x48
stc
add rbx, 2
or ah, 0x16
sub ah, 0x65
btc ax, 0x39
lea rax, [rsp + 0x143e]
test si, ax
stc
cmp rbx, rax
jmp 0x180172f0b
jb 0x180172e88
and qword [rsp + 0x20], 0
sal r9w, cl
bsr r8w, r14w
lea rax, [rsp + 0x40]
btr dx, r8w
sub rbx, rax
sub ch, 0x7c
cqo
bswap rcx
lea r9, [rsp + 0x30]
movzx rcx, cx
sar rbx, 1
dec rcx
rcr r8b, 0x22
lea rdx, [rsp + 0x40]
add r8w, si
add ebx, ebx
mov cl, dh
movsx r8, ax
mov rcx, r14
movsx r8, r10w
mov r8d, ebx
jmp 0x180172f68
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x180172f75
je 0x180172fa9
mov eax, dword [rsp + 0x30]
test bl, r12b
add dword [rdi + 4], eax
test r15b, 0x76
cmp eax, ebx
jmp 0x180172f90
jb 0x180172fb1
cmp rsi, rbp
jmp 0x180172f9e
jb 0x180172e83
jmp 0x180172fb1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
mov rax, rdi
btc cx, 0x4f
bsr cx, si
add cx, 0x22e6
mov rcx, qword [rsp + 0x1440]
jmp 0x180172fd0
xor rcx, rsp
jmp 0x180172fd8
call fcn.180159e82
lea r11, [rsp + 0x1450]
mov rbx, qword [r11 + 0x20]
mov rsi, r12
mov rbp, qword [r11 + 0x30]
mov rsp, r11
setne r14b
not dil
xchg esi, r14d
pop r14
pop rdi
movsx rsi, dx
pop rsi
jmp 0x18017300a
ret
Function at 0x4028a0
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x58
mov rax, qword gs:[0x60]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
add rax, 0x10
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp rax, qword [rsp + 0x38]
je 0x40292f
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 0x60]
invalid

Function at 0x402a00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x78
mov dword [rsp + 0x44], r9d
mov dword [rsp + 0x40], r8d
mov dword [rsp + 0x3c], edx
and al, 0x3c
mov qword [rsp + 0x28], rcx
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x28]
sub byte [rax + 0x63], cl
cmp al, 0x48
add eax, ecx
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x28]
and al, 0x28
mov rcx, qword [rsp + 0x70]
mov edx, dword [rsp + 0x44]
mov ecx, dword [rcx + rdx*8 + 0x88]
add byte [rax], al
add rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov ecx, dword [rsp + 0x30]
mov ecx, dword [rcx + 0x20]
add rax, rcx
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov ecx, dword [rcx + 0x1c]
add rax, rcx
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov ecx, dword [rcx + 0x24]
and al, 0x48
add eax, ecx
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x24], 0
invalid

Function at 0x402a10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x78
mov dword [rsp + 0x44], r9d
mov dword [rsp + 0x40], r8d
mov dword [rsp + 0x3c], edx
and al, 0x3c
mov qword [rsp + 0x28], rcx
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x28]
sub byte [rax + 0x63], cl
cmp al, 0x48
add eax, ecx
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x28]
and al, 0x28
mov rcx, qword [rsp + 0x70]
mov edx, dword [rsp + 0x44]
mov ecx, dword [rcx + rdx*8 + 0x88]
add byte [rax], al
add rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov ecx, dword [rsp + 0x30]
mov ecx, dword [rcx + 0x20]
add rax, rcx
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov ecx, dword [rcx + 0x1c]
add rax, rcx
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov ecx, dword [rcx + 0x24]
and al, 0x48
add eax, ecx
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x24], 0
invalid
Function at 0x402a20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x78
mov dword [rsp + 0x44], r9d
mov dword [rsp + 0x40], r8d
mov dword [rsp + 0x3c], edx
and al, 0x3c
mov qword [rsp + 0x28], rcx
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x28]
sub byte [rax + 0x63], cl
cmp al, 0x48
add eax, ecx
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x28]
and al, 0x28
mov rcx, qword [rsp + 0x70]
mov edx, dword [rsp + 0x44]
mov ecx, dword [rcx + rdx*8 + 0x88]
add byte [rax], al
add rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov ecx, dword [rsp + 0x30]
mov ecx, dword [rcx + 0x20]
add rax, rcx
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov ecx, dword [rcx + 0x1c]
add rax, rcx
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov ecx, dword [rcx + 0x24]
and al, 0x48
add eax, ecx
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x24], 0
invalid

Function at 0x402a30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x78
mov dword [rsp + 0x44], r9d
mov dword [rsp + 0x40], r8d
mov dword [rsp + 0x3c], edx
and al, 0x3c
mov qword [rsp + 0x28], rcx
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x28]
sub byte [rax + 0x63], cl
cmp al, 0x48
add eax, ecx
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x28]
and al, 0x28
mov rcx, qword [rsp + 0x70]
mov edx, dword [rsp + 0x44]
mov ecx, dword [rcx + rdx*8 + 0x88]
add byte [rax], al
add rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov ecx, dword [rsp + 0x30]
mov ecx, dword [rcx + 0x20]
add rax, rcx
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov ecx, dword [rcx + 0x1c]
add rax, rcx
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov ecx, dword [rcx + 0x24]
and al, 0x48
add eax, ecx
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x24], 0
invalid

Function at 0x402b20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
push rdi
sub rsp, 0x158
lea rax, [0x0044484e]

Function at 0x402b30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x40], rax
call fcn.004028a0
mov qword [rsp + 0x80], rax
add byte [rax], al
mov rax, qword [rsp + 0x40]
mov r9d, dword [rax + 0xc]
mov rax, qword [rsp + 0x40]

Function at 0x402b50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r8d, dword [rax + 0x20]
mov rax, qword [rsp + 0x40]
mov edx, dword [rax + 8]
invalid
invalid
invalid
invalid

Function at 0x402b70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [rax - 0x39], cl
test byte [rax + rax*8], ah
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax - 0x75], cl
and al, 0x40
and al, 0x40

Function at 0x402b80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [rax - 0x39], cl
test byte [rax + rax*8], ah
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax - 0x75], cl
and al, 0x40
and al, 0x40
Function at 0x402c40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, qword [rsp + 0xc0]
mov ecx, dword [rsp + 0x5c]
movzx eax, word [rax + rcx*2]
cmp eax, 0
je 0x402c42
mov rax, qword [rsp + 0xc0]
mov ecx, dword [rsp + 0x5c]
mov ax, word [rax + rcx*2]
mov rcx, qword [rsp + 0x68]
mov edx, dword [rsp + 0x5c]
pop rsp
mov word [rcx + rdx*2], ax
mov eax, dword [rsp + 0x5c]
add eax, 1
mov dword [rsp + 0x5c], eax
jmp 0x402c03
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0xf8], rax
mov dword [rsp + 0x7c], 0
mov rax, qword [rsp + 0x68]
mov ecx, dword [rsp + 0x7c]
movzx eax, word [rax + rcx*2]
cmp eax, 0
je 0x402c7a
mov eax, dword [rsp + 0x7c]
add eax, 1
mov dword [rsp + 0x7c], eax
jmp 0x402c5b
mov eax, dword [rsp + 0x7c]
mov dword [rsp + 0x54], eax
and al, 0x54
mov rax, qword [rsp + 0x68]
mov ecx, dword [rsp + 0x54]
sub ecx, 1
mov ecx, ecx
Function at 0x402c90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movzx eax, word [rax + rcx*2]
mov rcx, qword [rsp + 0x40]
mov ecx, dword [rcx + 0x18]
movzx ecx, cx
cmp eax, ecx
invalid
je 0x402cbf
mov rax, qword [rsp + 0x68]
mov ecx, dword [rsp + 0x54]
mov word [rax + rcx*2], 0
mov eax, dword [rsp + 0x54]
add eax, 0xffffffff
mov dword [rsp + 0x54], eax
jmp 0x402c82
mov dword [rsp + 0x78], 0
mov rax, qword [rsp + 0xf8]
mov ecx, dword [rsp + 0x78]
movsx eax, byte [rax + rcx]
cmp eax, 0
je 0x402d11
mov rax, qword [rsp + 0xf8]
mov ecx, dword [rsp + 0x78]
movsx eax, byte [rax + rcx]
mov rcx, qword [rsp + 0x68]
mov edx, dword [rsp + 0x54]
mov word [rcx + rdx*2], ax
mov eax, dword [rsp + 0x54]
add eax, 1
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x78]
add eax, 1
mov dword [rsp + 0x78], eax
jmp 0x402cc7
mov rax, qword [rsp + 0x40]
mov r9d, dword [rax + 0xc]
mov rax, qword [rsp + 0x40]
mov r8d, dword [rax + 0x20]
mov rax, qword [rsp + 0x40]
mov edx, dword [rax + 0x28]
mov rcx, qword [rsp + 0x80]
call fcn.00402a00
mov qword [rsp + 0x130], rax
mov rax, qword [rsp + 0x130]
mov rcx, qword [rsp + 0x68]
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
mov dword [rsp + 0x20], 4
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
call rax
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0x40]
and al, 0x40
mov r9d, dword [rax + 0xc]
mov rax, qword [rsp + 0x40]
mov r8d, dword [rax + 0x20]
mov rax, qword [rsp + 0x40]
mov edx, dword [rax]
mov rcx, qword [rsp + 0x80]
call fcn.00402a00
mov qword [rsp + 0x128], rax
mov rax, qword [rsp + 0x128]
mov rcx, qword [rsp + 0xf0]
xor edx, edx
call rax
mov dword [rsp + 0x9c], eax
mov eax, dword [rsp + 0x9c]
mov rcx, qword [rsp + 0x40]
mov ecx, dword [rcx + 0xc]
cmp eax, ecx
jne 0x402de6
mov ecx, 1
call qword [rsp + 0x90]
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0x40]
mov edx, eax
xor ecx, ecx
mov r8d, 0x1000
mov r9d, 4
call qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x40]
mov r9d, dword [rax + 0xc]
or al, 0x48
mov eax, dword [rsp + 0x40]
mov r8d, dword [rax + 0x20]
mov rax, qword [rsp + 0x40]
mov edx, dword [rax + 0x24]
mov rcx, qword [rsp + 0x80]
call fcn.00402a00
mov qword [rsp + 0x120], rax
mov dword [rsp + 0x98], 0
add byte [rax], al
add byte [rax - 0x75], cl
test byte [rax + riz], ah
add dword [rax], eax
add byte [rbx + rcx*4 - 0x7c], al
and al, 0x9c
add byte [rax], al
add byte [rax - 0x75], cl
push rsp
and al, 0x48
mov rcx, qword [rsp + 0xf0]
lea r9, [rsp + 0x98]
mov qword [rsp + 0x20], 0
call rax
cmp eax, 0
jne 0x402e84
mov ecx, 1
call qword [rsp + 0x90]
mov rax, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x98]
add rax, rcx
mov qword [rsp + 0xb8], rax
mov rax, qword [rsp + 0x40]
Function at 0x402d80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movzx eax, word [rax + rcx*2]
mov rcx, qword [rsp + 0x40]
mov ecx, dword [rcx + 0x18]
movzx ecx, cx
cmp eax, ecx
invalid
je 0x402cbf
mov rax, qword [rsp + 0x68]
mov ecx, dword [rsp + 0x54]
mov word [rax + rcx*2], 0
mov eax, dword [rsp + 0x54]
add eax, 0xffffffff
mov dword [rsp + 0x54], eax
jmp 0x402c82
mov dword [rsp + 0x78], 0
mov rax, qword [rsp + 0xf8]
mov ecx, dword [rsp + 0x78]
movsx eax, byte [rax + rcx]
cmp eax, 0
je 0x402d11
mov rax, qword [rsp + 0xf8]
mov ecx, dword [rsp + 0x78]
movsx eax, byte [rax + rcx]
mov rcx, qword [rsp + 0x68]
mov edx, dword [rsp + 0x54]
mov word [rcx + rdx*2], ax
mov eax, dword [rsp + 0x54]
add eax, 1
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x78]
add eax, 1
mov dword [rsp + 0x78], eax
jmp 0x402cc7
mov rax, qword [rsp + 0x40]
mov r9d, dword [rax + 0xc]
mov rax, qword [rsp + 0x40]
mov r8d, dword [rax + 0x20]
mov rax, qword [rsp + 0x40]
mov edx, dword [rax + 0x28]
mov rcx, qword [rsp + 0x80]
call fcn.00402a00
mov qword [rsp + 0x130], rax
mov rax, qword [rsp + 0x130]
mov rcx, qword [rsp + 0x68]
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
mov dword [rsp + 0x20], 4
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
call rax
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0x40]
and al, 0x40
mov r9d, dword [rax + 0xc]
mov rax, qword [rsp + 0x40]
mov r8d, dword [rax + 0x20]
mov rax, qword [rsp + 0x40]
mov edx, dword [rax]
mov rcx, qword [rsp + 0x80]
call fcn.00402a00
mov qword [rsp + 0x128], rax
mov rax, qword [rsp + 0x128]
mov rcx, qword [rsp + 0xf0]
xor edx, edx
call rax
mov dword [rsp + 0x9c], eax
mov eax, dword [rsp + 0x9c]
mov rcx, qword [rsp + 0x40]
mov ecx, dword [rcx + 0xc]
cmp eax, ecx
jne 0x402de6
mov ecx, 1
call qword [rsp + 0x90]
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0x40]
mov edx, eax
xor ecx, ecx
mov r8d, 0x1000
mov r9d, 4
call qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x40]
mov r9d, dword [rax + 0xc]
or al, 0x48
mov eax, dword [rsp + 0x40]
mov r8d, dword [rax + 0x20]
mov rax, qword [rsp + 0x40]
mov edx, dword [rax + 0x24]
mov rcx, qword [rsp + 0x80]
call fcn.00402a00
mov qword [rsp + 0x120], rax
mov dword [rsp + 0x98], 0
add byte [rax], al
add byte [rax - 0x75], cl
test byte [rax + riz], ah
add dword [rax], eax
add byte [rbx + rcx*4 - 0x7c], al
and al, 0x9c
add byte [rax], al
add byte [rax - 0x75], cl
push rsp
and al, 0x48
mov rcx, qword [rsp + 0xf0]
lea r9, [rsp + 0x98]
mov qword [rsp + 0x20], 0
call rax
cmp eax, 0
jne 0x402e84
mov ecx, 1
call qword [rsp + 0x90]
mov rax, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x98]
add rax, rcx
mov qword [rsp + 0xb8], rax
mov rax, qword [rsp + 0x40]
Function at 0x402d90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movzx eax, word [rax + rcx*2]
mov rcx, qword [rsp + 0x40]
mov ecx, dword [rcx + 0x18]
movzx ecx, cx
cmp eax, ecx
invalid
je 0x402cbf
mov rax, qword [rsp + 0x68]
mov ecx, dword [rsp + 0x54]
mov word [rax + rcx*2], 0
mov eax, dword [rsp + 0x54]
add eax, 0xffffffff
mov dword [rsp + 0x54], eax
jmp 0x402c82
mov dword [rsp + 0x78], 0
mov rax, qword [rsp + 0xf8]
mov ecx, dword [rsp + 0x78]
movsx eax, byte [rax + rcx]
cmp eax, 0
je 0x402d11
mov rax, qword [rsp + 0xf8]
mov ecx, dword [rsp + 0x78]
movsx eax, byte [rax + rcx]
mov rcx, qword [rsp + 0x68]
mov edx, dword [rsp + 0x54]
mov word [rcx + rdx*2], ax
mov eax, dword [rsp + 0x54]
add eax, 1
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x78]
add eax, 1
mov dword [rsp + 0x78], eax
jmp 0x402cc7
mov rax, qword [rsp + 0x40]
mov r9d, dword [rax + 0xc]
mov rax, qword [rsp + 0x40]
mov r8d, dword [rax + 0x20]
mov rax, qword [rsp + 0x40]
mov edx, dword [rax + 0x28]
mov rcx, qword [rsp + 0x80]
call fcn.00402a00
mov qword [rsp + 0x130], rax
mov rax, qword [rsp + 0x130]
mov rcx, qword [rsp + 0x68]
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
mov dword [rsp + 0x20], 4
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
call rax
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0x40]
and al, 0x40
mov r9d, dword [rax + 0xc]
mov rax, qword [rsp + 0x40]
mov r8d, dword [rax + 0x20]
mov rax, qword [rsp + 0x40]
mov edx, dword [rax]
mov rcx, qword [rsp + 0x80]
call fcn.00402a00
mov qword [rsp + 0x128], rax
mov rax, qword [rsp + 0x128]
mov rcx, qword [rsp + 0xf0]
xor edx, edx
call rax
mov dword [rsp + 0x9c], eax
mov eax, dword [rsp + 0x9c]
mov rcx, qword [rsp + 0x40]
mov ecx, dword [rcx + 0xc]
cmp eax, ecx
jne 0x402de6
mov ecx, 1
call qword [rsp + 0x90]
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0x40]
mov edx, eax
xor ecx, ecx
mov r8d, 0x1000
mov r9d, 4
call qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x40]
mov r9d, dword [rax + 0xc]
or al, 0x48
mov eax, dword [rsp + 0x40]
mov r8d, dword [rax + 0x20]
mov rax, qword [rsp + 0x40]
mov edx, dword [rax + 0x24]
mov rcx, qword [rsp + 0x80]
call fcn.00402a00
mov qword [rsp + 0x120], rax
mov dword [rsp + 0x98], 0
add byte [rax], al
add byte [rax - 0x75], cl
test byte [rax + riz], ah
add dword [rax], eax
add byte [rbx + rcx*4 - 0x7c], al
and al, 0x9c
add byte [rax], al
add byte [rax - 0x75], cl
push rsp
and al, 0x48
mov rcx, qword [rsp + 0xf0]
lea r9, [rsp + 0x98]
mov qword [rsp + 0x20], 0
call rax
cmp eax, 0
jne 0x402e84
mov ecx, 1
call qword [rsp + 0x90]
mov rax, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x98]
add rax, rcx
mov qword [rsp + 0xb8], rax
mov rax, qword [rsp + 0x40]
Function at 0x402dc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movzx eax, word [rax + rcx*2]
mov rcx, qword [rsp + 0x40]
mov ecx, dword [rcx + 0x18]
movzx ecx, cx
cmp eax, ecx
invalid
je 0x402cbf
mov rax, qword [rsp + 0x68]
mov ecx, dword [rsp + 0x54]
mov word [rax + rcx*2], 0
mov eax, dword [rsp + 0x54]
add eax, 0xffffffff
mov dword [rsp + 0x54], eax
jmp 0x402c82
mov dword [rsp + 0x78], 0
mov rax, qword [rsp + 0xf8]
mov ecx, dword [rsp + 0x78]
movsx eax, byte [rax + rcx]
cmp eax, 0
je 0x402d11
mov rax, qword [rsp + 0xf8]
mov ecx, dword [rsp + 0x78]
movsx eax, byte [rax + rcx]
mov rcx, qword [rsp + 0x68]
mov edx, dword [rsp + 0x54]
mov word [rcx + rdx*2], ax
mov eax, dword [rsp + 0x54]
add eax, 1
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x78]
add eax, 1
mov dword [rsp + 0x78], eax
jmp 0x402cc7
mov rax, qword [rsp + 0x40]
mov r9d, dword [rax + 0xc]
mov rax, qword [rsp + 0x40]
mov r8d, dword [rax + 0x20]
mov rax, qword [rsp + 0x40]
mov edx, dword [rax + 0x28]
mov rcx, qword [rsp + 0x80]
call fcn.00402a00
mov qword [rsp + 0x130], rax
mov rax, qword [rsp + 0x130]
mov rcx, qword [rsp + 0x68]
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
mov dword [rsp + 0x20], 4
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
call rax
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0x40]
and al, 0x40
mov r9d, dword [rax + 0xc]
mov rax, qword [rsp + 0x40]
mov r8d, dword [rax + 0x20]
mov rax, qword [rsp + 0x40]
mov edx, dword [rax]
mov rcx, qword [rsp + 0x80]
call fcn.00402a00
mov qword [rsp + 0x128], rax
mov rax, qword [rsp + 0x128]
mov rcx, qword [rsp + 0xf0]
xor edx, edx
call rax
mov dword [rsp + 0x9c], eax
mov eax, dword [rsp + 0x9c]
mov rcx, qword [rsp + 0x40]
mov ecx, dword [rcx + 0xc]
cmp eax, ecx
jne 0x402de6
mov ecx, 1
call qword [rsp + 0x90]
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0x40]
mov edx, eax
xor ecx, ecx
mov r8d, 0x1000
mov r9d, 4
call qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x40]
mov r9d, dword [rax + 0xc]
or al, 0x48
mov eax, dword [rsp + 0x40]
mov r8d, dword [rax + 0x20]
mov rax, qword [rsp + 0x40]
mov edx, dword [rax + 0x24]
mov rcx, qword [rsp + 0x80]
call fcn.00402a00
mov qword [rsp + 0x120], rax
mov dword [rsp + 0x98], 0
add byte [rax], al
add byte [rax - 0x75], cl
test byte [rax + riz], ah
add dword [rax], eax
add byte [rbx + rcx*4 - 0x7c], al
and al, 0x9c
add byte [rax], al
add byte [rax - 0x75], cl
push rsp
and al, 0x48
mov rcx, qword [rsp + 0xf0]
lea r9, [rsp + 0x98]
mov qword [rsp + 0x20], 0
call rax
cmp eax, 0
jne 0x402e84
mov ecx, 1
call qword [rsp + 0x90]
mov rax, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x98]
add rax, rcx
mov qword [rsp + 0xb8], rax
mov rax, qword [rsp + 0x40]