joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400fd400
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
mov byte [rsp + 8], 0xe8
movzx eax, word [0x140177f38]
mov word [rsp + 0x40], ax
movsx eax, word [0x140177fc0]
mov dword [rsp + 0x6c], eax
mov qword [rsp + 0x18], 0x4a134e3c
movzx eax, byte [0x140177e8e]
movzx eax, al
mov word [rsp + 4], ax
mov rax, qword [0x140177f50]
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x38], 0x5f
mov dword [rsp + 0x30], 0xa6f6
movzx eax, byte [0x141720c44]
mov byte [rsp + 9], al
movzx eax, byte [0x140177f03]
mov dword [rsp + 0x34], eax
mov eax, dword [0x140177fac]
mov word [rsp + 0x20], ax
mov byte [rsp + 0xa], 0xf2
mov eax, 0xb5c9ce44
mov qword [rsp + 0x78], rax
movzx eax, byte [0x140177fd4]
mov byte [rsp + 0xb], al
mov dword [rsp + 0x58], 0xd9
mov rax, qword [0x140177fb8]
mov dword [rsp + 0x3c], eax
mov eax, 0x3360
mov word [rsp + 0x24], ax
mov rax, qword [0x140177f38]
mov qword [rsp + 0x48], rax
mov eax, 0xcb6ef332
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 0xf557
mov byte [rsp], 0xaf
movzx eax, byte [0x140177f1b]
mov dword [rsp + 0x5c], eax
mov qword [rsp + 0x50], 0xb002
movzx eax, byte [0x140177ede]
mov byte [rsp + 0xc], al
movabs rax, 0x2253dab606561
mov qword [rsp + 0x90], rax
mov eax, dword [0x140177fd8]
mov dword [rsp + 0x60], eax
mov eax, 0x3699
mov word [rsp + 0x28], ax
mov eax, dword [0x140177fc4]
mov dword [rsp + 0x64], eax
movzx eax, word [0x140177f78]
mov qword [rsp + 0x98], rax
movzx eax, byte [0x140177e8f]
mov byte [rsp + 0xd], al
mov byte [rsp + 0xe], 0x64
movzx eax, byte [0x140177fc4]
mov byte [rsp + 0xf], al
mov byte [rsp + 0x10], 0xda
movzx eax, word [0x140177f64]
mov word [rsp + 0x2c], ax
mov eax, dword [0x140177fd4]
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0x68], 0x9640ae2e
mov eax, dword [rsp + 0x30]
mov ecx, 1
imul rcx, rcx, 1
lea rdx, [0x141816540]
mov byte [rdx + rcx], al
mov rax, qword [rsp + 0x48]
add rax, 0x27a8ad18
mov byte [0x140177edf], al
movsx eax, word [rsp + 4]
mov dword [0x140177f68], eax
mov rax, qword [rsp + 0x50]
test rax, rax
je 0x1400fd5d4
movsx eax, word [rsp + 4]
mov dword [rsp + 0x14], eax
jmp 0x1400fd5dc
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x14], eax
movsxd rax, dword [rsp + 0x14]
mov qword [rsp + 0x48], rax
mov eax, dword [0x140177e64]
mov eax, eax
movabs rcx, 0xa79cdf18b12e4
sub rax, rcx
movzx ecx, byte [rsp]
movzx ecx, cl
movzx edx, byte [0x140177ede]
movsx edx, dl
and ecx, edx
movsxd rcx, ecx
sub rax, rcx
movzx ecx, byte [0x140177f1b]
xor rax, rcx
mov qword [0x140177f90], rax
mov eax, 8
imul rax, rax, 0x3d72
lea rcx, [0x14173aea0]
mov rdx, qword [rsp + 0x18]
sub rdx, qword [rcx + rax]
mov rax, rdx
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x18]
movabs rcx, 0x5c8d5609ebb38
and rax, rcx
mov ecx, dword [0x140177f5c]
sub rcx, rax
mov rax, rcx
mov dword [0x140177f5c], eax
mov rax, qword [rsp + 0x50]
shl rax, 5
mov byte [rsp], al
mov eax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x18]
imul rcx, rax
mov rax, rcx
mov dword [0x140177f70], eax
mov eax, dword [rsp + 0x3c]
add rsp, 0xb8
ret
Function at 0x1400fd6b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [rsp + 8], cl
sub rsp, 0x98
movabs rax, 0xe214314b34b59
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 0x3ba2fec1
mov dword [rsp + 0x2c], 0xac75
movzx eax, byte [0x140177e8f]
movzx eax, al
mov word [rsp + 0xc], ax
mov eax, dword [0x140177f7c]
mov dword [rsp + 0x34], eax
mov rax, qword [0x140177f50]
mov byte [rsp + 2], al
mov rax, qword [0x140177fb8]
mov dword [rsp + 0x38], eax
mov byte [rsp + 3], 0x66
mov eax, 0x2f
mov word [rsp + 0x10], ax
movzx eax, byte [0x140177f38]
mov byte [rsp + 4], al
mov eax, dword [0x140177e64]
mov byte [rsp + 5], al
movzx eax, word [0x140177f98]
mov word [rsp + 0x14], ax
mov dword [rsp + 0x3c], 0xe3fb
mov eax, dword [0x140177e64]
mov byte [rsp + 6], al
mov byte [rsp + 7], 0xec
mov qword [rsp + 0x68], 0x55
movzx eax, word [0x140177f48]
mov word [rsp + 0x18], ax
mov qword [rsp + 0x70], 0xe0
mov byte [rsp + 8], 0xd3
mov eax, 0xa2
mov word [rsp + 0x1c], ax
mov eax, dword [0x140177e64]
mov byte [rsp], al
mov dword [rsp + 0x30], 0x2652
mov eax, dword [0x140177f6c]
mov eax, eax
mov qword [rsp + 0x78], rax
movzx eax, byte [0x140177ede]
movsx eax, al
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x80], 0x6cbc610c
mov dword [rsp + 0x44], 0x7a799d01
mov eax, dword [0x140177e64]
mov dword [rsp + 0x48], eax
mov rax, qword [0x140177fa0]
mov byte [rsp + 1], al
mov dword [rsp + 0x4c], 0xe6
mov dword [rsp + 0x50], 0x5689
movzx eax, word [0x140177f78]
mov dword [rsp + 0x54], eax
mov eax, 0xee
mov word [rsp + 0x20], ax
movzx eax, byte [0x140177f03]
mov qword [rsp + 0x88], rax
mov byte [rsp + 9], 0xa6
mov eax, 0x7777
mov word [rsp + 0x24], ax
mov eax, 0xffffea42
mov word [rsp + 0x28], ax
mov eax, dword [0x140177f1c]
sub eax, 0xa3
cdqe
mov qword [0x140177fc8], rax
mov eax, dword [0x141720c40]
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x30]
add eax, 0xd6a3
mov dword [0x140177fd4], eax
mov eax, dword [0x141720c40]
mov dword [0x140177f68], eax
movzx eax, byte [0x141720c40]
mov byte [rsp], al
movzx eax, byte [rsp + 1]
add rsp, 0x98
ret
Function at 0x1400fe400
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0xb8
mov rax, qword [0x140177fb0]
mov word [rsp + 4], ax
movsx rax, word [0x140177fc0]
mov qword [rsp + 0x60], rax
movabs rax, 0x3b502306993c1
mov qword [rsp + 0x68], rax
mov eax, 0x5f40
mov word [rsp + 8], ax
mov rax, qword [0x140177fb0]
mov word [rsp + 0xc], ax
mov rax, qword [0x140177f90]
mov qword [rsp + 0x70], rax
movzx eax, byte [0x140177f04]
mov byte [rsp], al
movabs rax, 0x507e568050d7c
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 0x44e
mov dword [rsp + 0x30], 0xdd1e5865
mov dword [rsp + 0x2c], 0xc29a84f6
movsxd rax, dword [0x140177f70]
mov qword [rsp + 0x88], rax
mov eax, 0x4a3e
mov word [rsp + 0x10], ax
mov eax, dword [0x140177f04]
mov dword [rsp + 0x34], eax
movzx eax, word [0x140177fd0]
mov word [rsp + 0x14], ax
movsxd rax, dword [0x140177fc4]
mov qword [rsp + 0x90], rax
movzx eax, byte [0x140177f5c]
mov byte [rsp + 1], al
mov byte [rsp + 2], 0xf5
mov dword [rsp + 0x38], 0x9713a20d
mov byte [rsp + 3], 0x65
mov dword [rsp + 0x3c], 0xaafd489
mov dword [rsp + 0x40], 0xb1
mov dword [rsp + 0x44], 0x7f7f0dcd
mov eax, 0x34
mov word [rsp + 0x18], ax
mov dword [rsp + 0x48], 0x315ca588
movzx eax, byte [0x140177eb7]
movzx eax, al
mov dword [rsp + 0x4c], eax
mov rax, qword [0x140177f80]
mov word [rsp + 0x1c], ax
mov dword [rsp + 0x50], 0x53ac649d
mov eax, 0x8d2d
mov word [rsp + 0x20], ax
movzx eax, word [0x140177f64]
mov word [rsp + 0x24], ax
mov rax, qword [0x140177f90]
mov dword [rsp + 0x54], eax
mov eax, 0x8463c335
mov qword [rsp + 0x98], rax
mov eax, 0xd76f4df9
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0x58], 0xfa
movzx eax, word [0x140177fd8]
mov word [rsp + 0x28], ax
movabs rax, 0xec46abc3e92a4
mov qword [rsp + 0xa8], rax
movzx eax, byte [0x140177f1b]
mov dword [0x140177fac], eax
mov eax, dword [0x140177f04]
mov dword [rsp + 0x2c], eax
mov rax, qword [0x140177fa0]
mov rcx, qword [0x140177f48]
add rcx, rax
mov rax, rcx
mov rcx, qword [0x140177f48]
sub rcx, rax
mov rax, rcx
mov qword [0x140177f48], rax
mov eax, dword [rsp + 0x30]
add rsp, 0xb8
ret
Function at 0x140109010
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [rsp + 0x20], r9b
mov byte [rsp + 0x18], r8b
mov byte [rsp + 0x10], dl
mov byte [rsp + 8], cl
sub rsp, 0x98
movzx eax, word [0x1401780c4]
cwde
mov dword [rsp + 0x38], eax
movzx eax, byte [0x140178006]
mov byte [rsp + 1], al
mov eax, dword [0x1401780e8]
mov dword [rsp + 0x2c], eax
mov qword [rsp + 0x50], 0x5dd4
mov byte [rsp + 2], 0xe6
mov byte [rsp + 3], 0x49
movzx eax, word [0x1401780a8]
mov word [rsp + 0xc], ax
mov rax, qword [0x140178098]
mov qword [rsp + 0x60], rax
mov eax, 0xfffffac9
mov word [rsp + 0x28], ax
mov dword [rsp + 0x10], 0x7bb91caf
mov qword [rsp + 0x68], 0xaf5a
mov qword [rsp + 0x58], 0xa0
mov dword [rsp + 0x3c], 0x88a60332
mov dword [rsp + 0x40], 0x207a56f3
mov byte [rsp + 4], 0x8d
movzx eax, byte [0x14017807e]
mov byte [rsp], al
mov dword [rsp + 0x44], 0x29875a98
mov eax, 0x4951
mov word [rsp + 0x14], ax
movzx eax, byte [0x140178053]
mov word [rsp + 0x18], ax
mov rax, qword [0x140178138]
mov byte [rsp + 5], al
mov dword [rsp + 0x30], 0x3a3e
mov dword [rsp + 0x34], 0x7fe5a681
movzx eax, byte [0x140178053]
mov word [rsp + 0x1c], ax
mov eax, 0xac07
mov word [rsp + 0x20], ax
mov rax, qword [0x140178108]
mov qword [rsp + 0x70], rax
mov eax, dword [0x140178094]
mov byte [rsp + 6], al
mov eax, 0x58
mov word [rsp + 0x24], ax
mov byte [rsp + 7], 0xe4
mov eax, dword [0x140178128]
cdqe
mov qword [rsp + 0x78], rax
movzx eax, byte [0x14017807e]
mov byte [rsp + 8], al
mov rax, qword [0x1401780e0]
mov byte [rsp + 9], al
movsx rax, word [0x140178110]
mov qword [rsp + 0x80], rax
mov eax, dword [0x140178094]
mov byte [rsp + 0xa], al
mov qword [rsp + 0x88], 0xa5
mov eax, dword [0x1401780e8]
mov dword [rsp + 0x48], eax
movzx eax, byte [0x140178120]
mov byte [rsp + 0xb], al
mov eax, dword [rsp + 0x2c]
sub eax, 0x5a69e166
mov eax, eax
mov rcx, qword [0x1401780e0]
add rcx, rax
mov rax, rcx
mov qword [0x1401780e0], rax
mov eax, dword [rsp + 0x30]
mov rcx, qword [0x140178138]
xor rax, rcx
mov byte [rsp], al
mov eax, dword [rsp + 0x34]
sub eax, 0xeda0d8ac
mov eax, eax
mov qword [0x1401780d0], rax
movzx eax, word [0x1401780b8]
movzx eax, ax
movabs rcx, 0xbbd99116e614
add rax, rcx
mov byte [0x14017803f], al
mov eax, dword [0x1401780f0]
sub eax, 0xb33b
mov word [rsp + 0xc], ax
mov eax, dword [rsp + 0x10]
mov eax, eax
mov rcx, qword [rsp + 0x50]
sub rax, rcx
mov dword [rsp + 0x10], eax
mov rax, qword [0x1401780e0]
add rax, 0xf9ab
mov byte [rsp + 1], al
mov rax, qword [rsp + 0x58]
add rsp, 0x98
ret
Function at 0x14010a7a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0xa8
movzx eax, byte [0x140178065]
mov byte [rsp + 4], al
mov eax, 0xffffd47a
mov word [rsp + 0x14], ax
movabs rax, 0xe700ab7c46b3d
mov qword [rsp + 0x40], rax
mov byte [rsp + 5], 0x2c
mov qword [rsp + 0x48], 0x40a9
mov eax, dword [0x1401780f4]
mov byte [rsp + 6], al
mov eax, 0x4e82
mov word [rsp + 0xc], ax
mov byte [rsp + 3], 0xa0
movzx eax, word [0x1401780b8]
movzx eax, ax
mov qword [rsp + 0x50], rax
mov rax, qword [0x1401780f8]
mov qword [rsp + 0x58], rax
mov eax, 0x3e66
mov word [rsp + 0x18], ax
mov byte [rsp + 7], 0x8a
mov eax, 0xb237b556
mov qword [rsp + 0x60], rax
mov rax, qword [0x1401780a8]
mov qword [rsp + 0x68], rax
mov eax, 0xa
mov word [rsp + 0x1c], ax
mov dword [rsp + 0x2c], 0xcb
mov rax, qword [0x1401780e0]
mov byte [rsp + 8], al
mov byte [rsp + 2], 0x44
mov eax, 0x5e8
mov word [rsp + 0x10], ax
mov byte [rsp + 1], 0x45
mov rax, qword [0x140178138]
mov byte [rsp], al
mov qword [rsp + 0x70], 0x97
mov dword [rsp + 0x30], 0x669e77e0
mov qword [rsp + 0x78], 0x1b6c
mov eax, 0x732a
mov word [rsp + 0x20], ax
movabs rax, 0x7ea2f7211ca6b
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x34], 0xe7
movzx eax, byte [0x140178054]
mov byte [rsp + 9], al
mov rax, qword [0x1401780e0]
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x38], 0x27
mov eax, dword [0x140178094]
mov word [rsp + 0x24], ax
movzx eax, byte [0x140178066]
movsx ax, al
mov word [rsp + 0x28], ax
mov qword [rsp + 0x90], 0x4e
mov byte [rsp + 0xa], 0xe0
mov byte [rsp + 0xb], 0x84
mov eax, dword [0x1401780c0]
mov dword [rsp + 0x3c], eax
movzx eax, byte [0x140178093]
movsx ecx, byte [0x14017803f]
add eax, ecx
movzx ecx, word [rsp + 0xc]
mov edx, dword [rsp + 0x2c]
and ecx, edx
not ecx
imul eax, ecx
not eax
mov byte [rsp + 1], al
mov eax, 2
imul rax, rax, 0x14f5
lea rcx, [0x141adae50]
movzx eax, byte [rcx + rax]
mov byte [0x140178065], al
movsx rax, byte [rsp]
movabs rcx, 0x194413bc344ce
xor rax, rcx
mov qword [0x140178138], rax
movzx eax, word [0x1401780b8]
dec ax
mov word [0x1401780b8], ax
movzx eax, byte [rsp + 2]
movsx rax, al
movabs rcx, 0x581dc9eabe149
xor rax, rcx
movzx ecx, byte [0x140178093]
add rcx, rax
mov rax, rcx
mov byte [0x140178093], al
mov byte [rsp], 0x9d
movzx eax, byte [rsp + 3]
mov dword [0x1401780f4], eax
movzx eax, word [rsp + 0x10]
add rsp, 0xa8
ret
Function at 0x14010c5a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xe8
mov rax, qword [0x140178300]
mov word [rsp + 0x30], ax
mov byte [rsp + 0x20], 0x96
mov eax, dword [0x1401782d0]
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x70], 0xd4b2
mov byte [rsp + 0x21], 0xe3
movzx eax, word [0x140178280]
mov word [rsp + 0x34], ax
mov dword [rsp + 0x54], 0x527bf1e
mov qword [rsp + 0x78], 0x42
movzx eax, byte [0x1401782f8]
mov byte [rsp + 0x22], al
mov byte [rsp + 0x23], 0x52
mov rax, qword [0x1401782c8]
mov qword [rsp + 0x80], rax
movzx eax, byte [0x1401781b6]
mov dword [rsp + 0x44], eax
movzx eax, byte [0x1401781b7]
mov byte [rsp + 0x24], al
mov rax, qword [0x1401782b8]
mov qword [rsp + 0x68], rax
movzx eax, word [0x1401782c4]
mov word [rsp + 0x38], ax
movsxd rax, dword [0x140178248]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], 0x619533d
movzx eax, word [0x140178270]
cwde
mov dword [rsp + 0x48], eax
movzx eax, word [0x1401782dc]
mov word [rsp + 0x3c], ax
mov byte [rsp + 0x25], 0xf4
mov dword [rsp + 0x58], 0x6038
movabs rax, 0x33717c02af6f8
mov qword [rsp + 0x98], rax
mov eax, dword [0x1401782c4]
mov qword [rsp + 0xa0], rax
mov byte [rsp + 0x26], 0x41
mov dword [rsp + 0x5c], 0x76
movzx eax, byte [0x140178167]
mov dword [rsp + 0x60], eax
movzx eax, byte [0x140178250]
mov byte [rsp + 0x27], al
movzx eax, word [0x1401782e4]
mov word [rsp + 0x40], ax
mov eax, dword [0x14017825c]
mov eax, eax
mov qword [rsp + 0xa8], rax
mov eax, dword [0x1401782f8]
mov qword [rsp + 0xb0], rax
mov eax, dword [0x1401782d8]
mov eax, eax
mov qword [rsp + 0xb8], rax
mov rax, qword [0x140178290]
mov qword [rsp + 0xc0], rax
mov eax, dword [0x140178264]
mov eax, eax
mov qword [rsp + 0xc8], rax
mov eax, dword [0x14017829c]
mov dword [rsp + 0x64], eax
mov rax, qword [0x140178300]
mov byte [rsp + 0x28], al
mov rax, qword [0x140178278]
mov qword [rsp + 0xd0], rax
mov cl, 0x41
call qword [sym.imp.USER32.dll_IsCharAlphaNumericA]
mov dword [0x141ca19b0], eax
mov eax, dword [0x141ca19b0]
mov dword [0x141ca19b0], eax
mov eax, dword [0x140178248]
sub eax, 0xa451
mov dword [str.LBt], eax
mov dword [0x1401782dc], 0xdc763bd5
cmp qword [rsp + 0x68], 0
jne 0x14010c795
mov dword [rsp + 0x2c], 1
jmp 0x14010c79d
mov dword [rsp + 0x2c], 0
mov eax, dword [rsp + 0x44]
not eax
add eax, dword [rsp + 0x2c]
cdqe
mov qword [rsp + 0x70], rax
call fcn.14011e560
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x48], 0x216ae416
movzx eax, byte [0x140178167]
imul eax, eax, 0x81b5bc27
mov byte [0x14017818e], al
mov eax, dword [rsp + 0x4c]
add rsp, 0xe8
ret
Function at 0x14010e920
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
push rsi
push rdi
sub rsp, 0xf8
movzx eax, byte [0x1401782e4]
mov byte [rsp + 0x22], al
mov eax, 0x4baa
mov word [rsp + 0x28], ax
mov qword [rsp + 0x78], 0xd1
mov eax, dword [0x140178298]
mov byte [rsp + 0x21], al
movsx rax, word [0x140178280]
mov qword [rsp + 0x80], rax
mov eax, 0x9e6cc740
mov qword [rsp + 0x88], rax
mov eax, dword [0x1401782dc]
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x54], 0xd6
mov dword [rsp + 0x44], 0x77de5e91
movzx eax, word [0x1401782ec]
movzx eax, ax
mov qword [rsp + 0x90], rax
movsx rax, word [0x140178280]
mov qword [rsp + 0x98], rax
movabs rax, 0x58d462fd4198a
mov qword [rsp + 0xa0], rax
mov rax, qword [0x140178300]
mov dword [rsp + 0x4c], eax
mov qword [rsp + 0xa8], 0xbe40
movzx eax, byte [0x140178167]
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x48], 0xbf
mov dword [rsp + 0x5c], 0x65dfdd68
mov eax, 0x2670
mov word [rsp + 0x30], ax
mov eax, 0xb6801250
mov qword [rsp + 0xb0], rax
movzx eax, byte [0x1401782e0]
mov byte [rsp + 0x20], al
mov qword [rsp + 0xb8], 0x2d45544e
mov eax, 0xdfdb6512
mov qword [rsp + 0xc0], rax
mov eax, 0x2497
mov word [rsp + 0x34], ax
mov eax, dword [0x1401782e8]
mov byte [rsp + 0x23], al
mov eax, 0xa446c428
mov qword [rsp + 0xc8], rax
mov eax, 0x3a57
mov word [rsp + 0x38], ax
mov dword [rsp + 0x60], 0xa8456c98
mov eax, dword [0x1401782c4]
mov qword [rsp + 0xd0], rax
mov eax, 0xb419
mov word [rsp + 0x3c], ax
mov dword [rsp + 0x64], 0xae
movzx eax, byte [0x1401782b0]
mov byte [rsp + 0x24], al
mov eax, dword [0x1401782f8]
mov dword [rsp + 0x68], eax
mov eax, dword [0x1401782f8]
mov dword [rsp + 0x6c], eax
mov rax, qword [0x140178290]
mov word [rsp + 0x40], ax
mov dword [rsp + 0x70], 0xa5
mov dword [rsp + 0x74], 0x6f00
lea rax, [rsp + 0xd8]
lea rcx, str.Additional_headers
mov rdi, rax
mov rsi, rcx
mov ecx, 0x13
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [0x140178248], eax
mov eax, 0xa7cbd79e
mov rcx, qword [0x1401782b0]
add rcx, rax
mov rax, rcx
mov dword [0x14017825c], eax
movzx eax, byte [rsp + 0x21]
movzx eax, al
mov ecx, dword [0x140178248]
sub ecx, eax
mov eax, ecx
mov ecx, dword [0x140178248]
or ecx, eax
mov eax, ecx
mov dword [0x140178248], eax
mov eax, dword [rsp + 0x44]
sub eax, 0xefc844bb
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
movsx eax, al
mov ecx, dword [0x14017825c]
imul eax, ecx
movzx ecx, byte [rsp + 0x20]
movsx ecx, cl
sub ecx, eax
mov eax, ecx
mov byte [rsp + 0x20], al
mov eax, dword [rsp + 0x48]
test eax, eax
jne 0x14010eb6e
mov dword [rsp + 0x2c], 1
jmp 0x14010eb76
mov dword [rsp + 0x2c], 0
mov eax, dword [rsp + 0x4c]
imul eax, dword [rsp + 0x2c]
mov dword [0x14017824c], eax
movzx eax, word [rsp + 0x28]
cwde
add rsp, 0xf8
pop rdi
pop rsi
ret
Function at 0x14010f2d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [rsp + 0x20], r9b
mov byte [rsp + 0x18], r8b
mov byte [rsp + 0x10], dl
mov byte [rsp + 8], cl
sub rsp, 0xa8
mov byte [rsp + 8], 0x10
movabs rax, 0x3c647e8bc5185
mov qword [rsp + 0x60], rax
movzx eax, byte [0x140178248]
mov byte [rsp], al
mov eax, 0x8d
mov word [rsp + 0x40], ax
mov dword [rsp + 0x1c], 0x11373ff0
mov eax, dword [0x140178278]
mov dword [rsp + 0x4c], eax
mov eax, 0xffff9537
mov word [rsp + 0x14], ax
mov eax, 0x94ee5a9e
mov qword [rsp + 0x68], rax
mov eax, dword [0x140178264]
mov eax, eax
mov qword [rsp + 0x70], rax
movzx eax, byte [0x140178166]
mov word [rsp + 0x44], ax
mov eax, 0xa08c
mov word [rsp + 0x20], ax
mov rax, qword [0x140178268]
mov word [rsp + 0x24], ax
mov eax, dword [0x140178264]
mov word [rsp + 0x28], ax
movzx eax, word [0x1401782d0]
mov word [rsp + 0x2c], ax
mov byte [rsp + 9], 0xea
mov byte [rsp + 0xa], 0x17
movsx eax, word [0x140178280]
mov dword [rsp + 0x50], eax
mov eax, 0xb9
mov word [rsp + 0x10], ax
mov byte [rsp + 0xb], 0x45
mov eax, dword [0x140178298]
mov dword [rsp + 0x54], eax
mov eax, dword [0x140178298]
mov word [rsp + 4], ax
movzx eax, word [0x140178270]
cwde
mov dword [rsp + 0x48], eax
movzx eax, word [0x1401782f0]
mov word [rsp + 0x30], ax
mov qword [rsp + 0x78], 0xbc3d
mov eax, 0x6c4f
mov word [rsp + 0x34], ax
mov rax, qword [0x1401782a8]
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x58], 0xc0
mov eax, dword [0x140178264]
mov byte [rsp + 0xc], al
mov dword [rsp + 0x5c], 0x783bfd93
movabs rax, 0x21b6c26f82d06
mov qword [rsp + 0x88], rax
mov eax, 0x33b4
mov word [rsp + 0x38], ax
mov eax, 0x7aa0
mov word [rsp + 0x3c], ax
movzx eax, byte [0x1401782b8]
mov byte [rsp + 0xd], al
mov eax, dword [0x14017824c]
mov byte [rsp + 0xe], al
movsxd rax, dword [str.LBt]
mov qword [rsp + 0x90], rax
mov eax, 0xc5948672
mov qword [rsp + 0x98], rax
movsx rax, byte [rsp]
movabs rcx, 0xa9c1eb94ba8e3
add rax, rcx
mov dword [0x140178284], eax
movzx eax, word [rsp + 4]
dec ax
mov word [rsp + 4], ax
mov eax, dword [rsp + 0x48]
cdqe
movabs rcx, 0xbd4b15d86672f
sub rax, rcx
mov qword [0x1401782f0], rax
movsxd rax, dword [rsp + 0x1c]
mov rcx, qword [0x140178268]
add rcx, rax
mov rax, rcx
mov rcx, qword [0x140178268]
add rcx, rax
mov rax, rcx
mov qword [0x140178268], rax
movsx eax, word [rsp + 0x10]
test eax, eax
jne 0x14010f4d9
mov dword [rsp + 0x18], 1
jmp 0x14010f4e1
mov dword [rsp + 0x18], 0
mov eax, dword [rsp + 0x18]
mov dword [0x1401782dc], eax
movsx eax, word [rsp + 0x14]
sub eax, 0xc9e4
mov dword [0x1401782f8], eax
mov eax, dword [rsp + 0x1c]
sub eax, 0x926f
mov dword [0x140178284], eax
movzx eax, byte [rsp + 0x60]
add rsp, 0xa8
ret
Function at 0x14011d020
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov qword [rsp + 0x28], 0x1f
mov byte [rsp + 0x30], 0xf3
mov byte [rsp + 0x31], 0xe8
mov byte [rsp + 0x32], 0xc5
mov byte [rsp + 0x33], 0x4d
mov byte [rsp + 0x34], 0x40
mov byte [rsp + 0x35], 0x6e
mov byte [rsp + 0x36], 0xe4
mov byte [rsp + 0x37], 0x7b
mov byte [rsp + 0x38], 0x42
mov byte [rsp + 0x39], 0xf4
mov byte [rsp + 0x3a], 0xec
mov byte [rsp + 0x3b], 0x77
mov byte [rsp + 0x3c], 0xe5
mov byte [rsp + 0x3d], 0xde
mov byte [rsp + 0x3e], 0xe4
mov byte [rsp + 0x3f], 0x59
mov byte [rsp + 0x40], 0x62
mov byte [rsp + 0x41], 0x71
mov byte [rsp + 0x42], 0xe4
mov byte [rsp + 0x43], 0x49
mov byte [rsp + 0x44], 0x57
mov byte [rsp + 0x45], 0xe7
mov byte [rsp + 0x46], 0xc0
mov byte [rsp + 0x47], 0x46
mov byte [rsp + 0x48], 0xd8
mov byte [rsp + 0x49], 0xfe
mov byte [rsp + 0x4a], 0xc8
mov byte [rsp + 0x4b], 0x64
mov byte [rsp + 0x4c], 0x42
mov byte [rsp + 0x4d], 0x66
mov byte [rsp + 0x4e], 0x81
mov eax, 0xda0
mov eax, eax
mov ecx, dword [0x141f20340]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
and eax, 1
test eax, eax
jne 0x14011d16a
mov eax, 0xda0
mov eax, eax
mov ecx, dword [0x141f20340]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
or eax, 1
mov dword [rsp + 0x20], eax
mov eax, dword [0x141f20340]
mov rcx, qword gs:[0x58]
mov edx, 0xda0
mov edx, edx
mov rax, qword [rcx + rax*8]
mov ecx, dword [rsp + 0x20]
mov dword [rdx + rax], ecx
mov eax, 0xd80
mov eax, eax
mov ecx, dword [0x141f20340]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.140124420
lea rcx, [0x14013b5b0]
call fcn.1401258bc
nop
mov eax, 0xd80
mov eax, eax
mov ecx, dword [0x141f20340]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
add rsp, 0x58
ret
Function at 0x140124990
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov qword [rsp + 0x28], 0x11
mov byte [rsp + 0x30], 0x5f
mov byte [rsp + 0x31], 0xc4
mov byte [rsp + 0x32], 0x59
mov byte [rsp + 0x33], 0x4e
mov byte [rsp + 0x34], 0x6a
mov byte [rsp + 0x35], 0x6e
mov byte [rsp + 0x36], 0x40
mov byte [rsp + 0x37], 0x57
mov byte [rsp + 0x38], 0xe6
mov byte [rsp + 0x39], 0xf9
mov byte [rsp + 0x3a], 0x79
mov byte [rsp + 0x3b], 0x4f
mov byte [rsp + 0x3c], 0x68
mov byte [rsp + 0x3d], 0xc4
mov byte [rsp + 0x3e], 0x58
mov byte [rsp + 0x3f], 0x50
mov byte [rsp + 0x40], 3
mov eax, 0xc0c
mov eax, eax
mov ecx, dword [0x141f20340]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
and eax, 1
test eax, eax
jne 0x140124a94
mov eax, 0xc0c
mov eax, eax
mov ecx, dword [0x141f20340]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
or eax, 1
mov dword [rsp + 0x20], eax
mov eax, dword [0x141f20340]
mov rcx, qword gs:[0x58]
mov edx, 0xc0c
mov edx, edx
mov rax, qword [rcx + rax*8]
mov ecx, dword [rsp + 0x20]
mov dword [rdx + rax], ecx
mov eax, 0xbf8
mov eax, eax
mov ecx, dword [0x141f20340]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.140031060
lea rcx, [0x14013b580]
call fcn.1401258bc
nop
mov eax, 0xbf8
mov eax, eax
mov ecx, dword [0x141f20340]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
add rsp, 0x58
ret