joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180006dd0
Capabilities:
Read file on windows

Disassembly:
mov r11, rsp
push rbx
push rsi
sub rsp, 0xa8
mov rax, qword [0x18003d1b0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov qword [r11 - 0x18], rdi
mov qword [r11 - 0x20], r12
mov qword [r11 - 0x28], r13
mov qword [r11 - 0x30], r14
or ebx, 0xffffffff
xor r13d, r13d
mov rdi, rcx
mov qword [r11 - 0x38], r15
mov r12d, r8d
mov r10d, r13d
mov r14, rdx
movsxd r15, r9d
lea rcx, [0x180030e68]
nop dword [rax + rax]
movzx eax, word [r10 + rcx]
lea r10, [r10 + 2]
mov word [rsp + r10 + 0x56], ax
test ax, ax
jne 0x180006c50
lea rcx, [rsp + 0x58]
mov qword [rsp + 0xd8], rbp
call fcn.1800069d0
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.180007df0
mov rsi, rax
test rax, rax
je 0x180006d5c
mov rcx, rax
call fcn.18000c78c
lea rdx, [rsp + 0x20]
mov ecx, eax
mov ebp, eax
call fcn.18000c7b4
test eax, eax
jne 0x180006d5c
lea eax, [r12*2 - 2]
mov r8d, 2
mov ecx, ebp
movsxd rdi, eax
cmp qword [rsp + 0x38], rdi
cmovl rdi, qword [rsp + 0x38]
mov rax, rdi
cqo
sub rax, rdx
mov rdx, rdi
sar rax, 1
neg rdx
mov rbx, rax
call fcn.18000cb80
lea rcx, [rdi + 2]
call fcn.18000bd40
mov r9, rsi
mov r8, rdi
mov rcx, rax
mov edx, 1
mov qword [r14], rax
call fcn.180008974
mov rax, qword [r14]
movsxd r8, ebx
mov word [rax + r8*2], r13w
cmp ebx, r15d
jle 0x180006d57
mov rcx, qword [r14]
mov rax, r15
mov rdx, rcx
test r15, r15
je 0x180006d57
cmp word [rdx], 0xa
je 0x180006d35
add rdx, 2
dec rax
jne 0x180006d21
mov ebx, r13d
jmp 0x180006d6c
test rdx, rdx
je 0x180006d57
mov rax, rdx
sub rax, rcx
sar rax, 1
sub r8, rax
cmp r8, r15
jle 0x180006d57
add r8, r8
add rdx, 2
call fcn.18000ade0
mov ebx, r13d
jmp 0x180006d6c
mov rcx, qword [r14]
test rcx, rcx
je 0x180006d6c
call fcn.1800099d8
mov qword [r14], r13
mov r15, qword [rsp + 0x80]
mov r14, qword [rsp + 0x88]
mov r13, qword [rsp + 0x90]
mov r12, qword [rsp + 0x98]
mov rdi, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0xd8]
test rsi, rsi
je 0x180006da9
mov rcx, rsi
call fcn.18000c724
mov eax, ebx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.180009cc0
add rsp, 0xa8
pop rsi
pop rbx
ret
mov r9d, 0x400
jmp 0x180006c00

Function at 0x180006ea0
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rax, rdx
mov r14, rcx
test rdx, rdx
jne 0x180006ec6
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
movsxd rdi, dword [rsp + 0x30]
lea edx, [rdi + 1]
mov rsi, rax
movsxd rcx, edx
mov edx, 1
shl rcx, 3
call fcn.180009994
mov r8, rdi
mov rdx, rsi
mov rcx, rax
shl r8, 3
mov rbx, rax
call fcn.18000ade0
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov qword [r14], rbx
mov rbx, qword [rsp + 0x38]
mov rax, r14
add rsp, 0x20
pop r14
ret
Function at 0x180006f60
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov eax, dword [0x18003d014]
xor ebx, ebx
mov r12, r9
mov r13, r8
mov esi, ebx
mov ebp, ebx
mov edi, ebx
mov r15d, ebx
mov r14d, ebx
cmp eax, 0xffffffff
je 0x180006fc4
mov ebx, dword [0x18003d010]
mov edi, dword [0x18003d018]
mov r15d, dword [0x18003d01c]
mov r14d, dword [0x18003d020]
mov ebp, dword [0x18003d024]
mov esi, eax
jmp 0x1800070a5
cmp dword [0x18003f010], ebx
jne 0x180006feb
lea rcx, [0x18003f010]
mov dword [0x18003f010], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x180007075
mov esi, dword [0x18003f014]
mov edi, dword [0x18003f018]
mov r15d, dword [0x18003f01c]
mov r14d, dword [0x18003f020]
movzx ebp, word [0x18003f124]
cmp esi, 0xa
jg 0x180007070
jne 0x18000701e
test edi, edi
jns 0x180007070
mov ebx, 6
jmp 0x180007075
cmp esi, 6
jg 0x180007017
jne 0x18000704d
cmp edi, 3
jge 0x180007017
cmp edi, 2
jge 0x180007046
cmp edi, 1
jge 0x18000703f
test edi, edi
js 0x180007069
mov ebx, 3
jmp 0x180007075
mov ebx, 4
jmp 0x180007075
mov ebx, 5
jmp 0x180007075
cmp esi, 5
jg 0x180007069
jne 0x180007075
cmp edi, 2
jge 0x180007069
cmp edi, 1
jge 0x180007069
test edi, edi
js 0x180007075
mov ebx, 1
jmp 0x180007075
mov ebx, 2
jmp 0x180007075
mov ebx, 7
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov dword [0x18003d010], ebx
mov dword [0x18003d014], esi
mov dword [0x18003d018], edi
mov dword [0x18003d01c], r15d
mov dword [0x18003d020], r14d
mov dword [0x18003d024], ebp
test rcx, rcx
je 0x1800070ac
mov dword [rcx], ebx
test rdx, rdx
je 0x1800070b3
mov dword [rdx], esi
test r13, r13
je 0x1800070bc
mov dword [r13], edi
test r12, r12
je 0x1800070c5
mov dword [r12], r15d
mov rax, qword [rsp + 0x80]
test rax, rax
je 0x1800070d5
mov dword [rax], r14d
mov rax, qword [rsp + 0x88]
test rax, rax
je 0x1800070e4
mov dword [rax], ebp
mov rbx, qword [rsp + 0x70]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180007100
Capabilities:
Check os version

Disassembly:
sub rsp, 0x38
mov eax, dword [0x18003d010]
cmp eax, 0xffffffff
jne 0x180007242
mov qword [rsp + 0x40], rbx
xor ebx, ebx
cmp dword [0x18003d014], eax
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
mov esi, ebx
mov r15d, ebx
mov ebp, ebx
mov edi, ebx
mov r14d, ebx
jne 0x180007224
cmp dword [0x18003f010], ebx
jne 0x180007172
lea rcx, [0x18003f010]
mov dword [0x18003f010], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1800071fc
mov esi, dword [0x18003f014]
mov edi, dword [0x18003f018]
mov r14d, dword [0x18003f01c]
mov r15d, dword [0x18003f020]
movzx ebp, word [0x18003f124]
cmp esi, 0xa
jg 0x1800071f7
jne 0x1800071a5
test edi, edi
jns 0x1800071f7
mov ebx, 6
jmp 0x1800071fc
cmp esi, 6
jg 0x18000719e
jne 0x1800071d4
cmp edi, 3
jge 0x18000719e
cmp edi, 2
jge 0x1800071cd
cmp edi, 1
jge 0x1800071c6
test edi, edi
js 0x1800071f0
mov ebx, 3
jmp 0x1800071fc
mov ebx, 4
jmp 0x1800071fc
mov ebx, 5
jmp 0x1800071fc
cmp esi, 5
jg 0x1800071f0
jne 0x1800071fc
cmp edi, 2
jge 0x1800071f0
cmp edi, 1
jge 0x1800071f0
test edi, edi
js 0x1800071fc
mov ebx, 1
jmp 0x1800071fc
mov ebx, 2
jmp 0x1800071fc
mov ebx, 7
mov eax, ebx
mov dword [0x18003d010], ebx
mov dword [0x18003d014], esi
mov dword [0x18003d018], edi
mov dword [0x18003d01c], r14d
mov dword [0x18003d020], r15d
mov dword [0x18003d024], ebp
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x38
ret
Function at 0x1800075c0
Capabilities:
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov eax, 0x1070
call fcn.18000d0d0
sub rsp, rax
mov rax, qword [0x18003d1b0]
xor rax, rsp
mov qword [rsp + 0x1060], rax
xor ebp, ebp
mov rbx, rcx
mov rcx, qword [rdx]
or esi, 0xffffffff
mov rdi, rdx
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x38], rbp
test rcx, rcx
je 0x18000760c
call fcn.1800099d8
mov qword [rdi], rbp
mov rdx, rbp
lea rcx, [0x180030f38]
nop word [rax + rax]
movzx eax, word [rdx + rcx]
lea rdx, [rdx + 2]
mov word [rsp + rdx + 0x46], ax
test ax, ax
jne 0x180007620
lea rcx, [rsp + 0x48]
call fcn.1800069d0
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.180007df0
mov rbx, rax
test rax, rax
je 0x18000775e
lea rcx, [rsp + 0x40]
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x180007756
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8004
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x180007756
lea rcx, [rsp + 0x60]
mov r9, rbx
mov edx, 1
mov r8d, 0x1000
call fcn.180008974
mov dword [rsp + 0x30], eax
test eax, eax
jle 0x18000770a
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x60]
xor r9d, r9d
mov r8d, eax
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x180007756
lea rcx, [rsp + 0x60]
mov r9, rbx
mov edx, 1
mov r8d, 0x1000
call fcn.180008974
mov dword [rsp + 0x30], eax
test eax, eax
jg 0x1800076d0
mov edx, 1
mov dword [rsp + 0x30], 0x14
lea ecx, [rdx + 0x13]
call fcn.180009994
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x30]
mov r8, rax
mov edx, 2
mov qword [rdi], rax
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
jne 0x180007754
mov rcx, qword [rdi]
test rcx, rcx
je 0x180007756
call fcn.1800099d8
mov qword [rdi], rbp
jmp 0x180007756
mov esi, ebp
mov rcx, rbx
call fcn.18000c724
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x180007770
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x180007780
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, esi
mov rcx, qword [rsp + 0x1060]
xor rcx, rsp
call fcn.180009cc0
mov rbx, qword [rsp + 0x10a0]
add rsp, 0x1070
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800077b0
Capabilities:
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rbp
push rsi
push rdi
sub rsp, 0x30
xor ebp, ebp
mov rsi, rcx
mov rcx, qword [r8]
or edi, 0xffffffff
mov rbx, r8
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x60], rbp
test rcx, rcx
je 0x1800077e5
call fcn.1800099d8
mov qword [rbx], rbp
lea rcx, [rsp + 0x68]
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x180007895
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8004
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x180007895
mov r8d, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
xor r9d, r9d
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x180007895
mov edx, 1
mov dword [rsp + 0x58], 0x14
lea ecx, [rdx + 0x13]
call fcn.180009994
mov rcx, qword [rsp + 0x60]
lea r9, [rsp + 0x58]
mov r8, rax
mov edx, 2
mov qword [rbx], rax
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
jne 0x180007893
mov rcx, qword [rbx]
test rcx, rcx
je 0x180007895
call fcn.1800099d8
mov qword [rbx], rbp
jmp 0x180007895
mov edi, ebp
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1800078a7
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1800078b7
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, edi
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret

Function at 0x180007920
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x30
mov rdi, rdx
mov edx, 1
mov rbx, rcx
lea ecx, [rdx + 0x1f]
mov rsi, r8
call fcn.180009994
lea r8, [0x1800080f0]
xor edx, edx
mov qword [rbx], rax
mov r14, rax
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rsi
mov dword [rax + 0x1c], 2
xor eax, eax
mov qword [rsp + 0x28], rax
mov r9, r14
xor ecx, ecx
mov dword [rsp + 0x20], eax
call fcn.18000ccfc
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov qword [r14], rax
neg rax
sbb eax, eax
neg eax
dec eax
add rsp, 0x30
pop r14
ret

Function at 0x1800079b0
Capabilities:
Terminate thread

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateThread]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x180009a18
Capabilities:
Create directory

Disassembly:
sub rsp, 0x28
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x180009a30
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x180009a32
xor eax, eax
test eax, eax
je 0x180009a42
mov ecx, eax
call fcn.1800097e4
or eax, 0xffffffff
jmp 0x180009a44
xor eax, eax
add rsp, 0x28
ret
Function at 0x180009ae8
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x180009afe
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x180009b00
xor eax, eax
test eax, eax
je 0x180009b10
mov ecx, eax
call fcn.1800097e4
or eax, 0xffffffff
jmp 0x180009b12
xor eax, eax
add rsp, 0x28
ret
jmp 0x180009ae8

Function at 0x180009b18
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x180009afe
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x180009b00
xor eax, eax
test eax, eax
je 0x180009b10
mov ecx, eax
call fcn.1800097e4
or eax, 0xffffffff
jmp 0x180009b12
xor eax, eax
add rsp, 0x28
ret
jmp 0x180009ae8
Function at 0x14002bb60
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14002bb6d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14002bb7d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14002bb65
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x14002bb95
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14002bb82
sub eax, 3
jb 0x14002bbaf
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14002bbe6
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x14002bbd6
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14002bbd4
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14002bbc3
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.14002bb22
jmp 0x14002bb6d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x1b400
mov dl, 9
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14002bc32
cmp rsi, rcx
jae 0x14002bc3a
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14002bc19
cmp al, 0x8f
ja 0x14002bc19
cmp byte [rsi - 2], 0xf
je 0x14002bc1f
sub al, 0xe8
cmp al, 1
ja 0x14002bc03
cmp rsi, rcx
jae 0x14002bc3a
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14002bc09
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14002bc3a
lodsb al, byte [rsi]
jmp 0x14002bc19
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x29000]
mov eax, dword [rdi]
or eax, eax
je 0x14002bca3
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x2cb50]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14002bc47
jns 0x14002bc7c
movzx rdx, word [rdi]
add rdi, 2
jmp 0x14002bc86
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14002bc9d
mov qword [rbx], rax
add rbx, 8
jmp 0x14002bc67
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x18f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14002bcfb
sub rsp, 0xffffffffffffff80
jmp 0x14001bce0
Function at 0x140013ec0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140013cec

Function at 0x141bb08e0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x141bb08ea
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x141bb0913
pop rbp
sub rbp, 0x33
sub rbp, 0x1bb08e0
sub rsp, 0x20
jmp 0x141bb0932
mov rax, 0x1bb08e0
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xfffffffff86b3ba3
xor byte [rax], dl
inc rax
dec rcx
jne 0x141bb0951
jmp 0x141bb0968
jmp 0x141bb0994
movabs dword [0xbf1bebf3f34ba2eb], eax
mov gs, esi
movabs dword [0x78671aeba3a3a3a3], eax
invalid
Function at 0x415b80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x415d26
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00435160
xorps xmm15, xmm15
mov r14, qword [0x0054db60]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x415beb
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x415c07
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
call fcn.0044f280
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
sub rbx, rcx
test rbx, rbx
jbe 0x415c2b
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x415c3f
cmp rbx, 0x1000
jae 0x415bf5
jmp 0x415ca9
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x415c51
xor edx, edx
jmp 0x415ca0
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00435160
xorps xmm15, xmm15
mov r14, qword [0x0054db60]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x415c35
jmp 0x415c20
call fcn.00463fc0
xorps xmm15, xmm15
mov r14, qword [0x0054db60]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00439740
lea rax, [0x004956c9]
mov ebx, 0x18
call fcn.0043a040
mov rax, qword [rsp + 0x38]
call fcn.00439d40
lea rax, [0x00495789]
mov ebx, 0x19
call fcn.0043a040
mov rax, qword [rsp + 0x30]
nop
call fcn.00439d40
call fcn.004399a0
call fcn.004397c0
lea rax, [0x0049762c]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.00437f00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460460
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00415b80
Function at 0x415d60
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x415f8a
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00435200
xorps xmm15, xmm15
mov r14, qword [0x0054db60]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x415dd9
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x415e00
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rax, rcx
call fcn.0044f280
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
sub rbx, rcx
mov rcx, rax
mov rax, qword [rsp + 0x68]
test rbx, rbx
jbe 0x415e25
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x415e39
cmp rbx, 0x1000
jae 0x415de3
nop dword [rax]
jmp 0x415eb4
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x415e4d
xor esi, esi
jmp 0x415eaa
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00435200
xorps xmm15, xmm15
mov r14, qword [0x0054db60]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x415e2f
jmp 0x415e14
call fcn.00463fc0
xorps xmm15, xmm15
mov r14, qword [0x0054db60]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x415f2c
call fcn.00439740
lea rax, [0x00495b58]
mov ebx, 0x19
call fcn.0043a040
mov rax, qword [rsp + 0x68]
call fcn.00439d40
lea rax, [0x00495789]
mov ebx, 0x19
call fcn.0043a040
mov eax, dword [rsp + 0x34]
call fcn.00439d40
call fcn.004399a0
call fcn.004397c0
lea rax, [0x00492d94]
mov ebx, 0xd
call fcn.00437f00
cmp eax, 0x5af
je 0x415ed7
call fcn.00439740
lea rax, [0x00495b58]
mov ebx, 0x19
call fcn.0043a040
mov rax, qword [rsp + 0x38]
call fcn.00439d40
lea rax, [0x00495789]
mov ebx, 0x19
nop
call fcn.0043a040
mov eax, dword [rsp + 0x34]
call fcn.00439d40
call fcn.004399a0
call fcn.004397c0
lea rax, [0x00497087]
mov ebx, 0x1f
call fcn.00437f00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460460
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00415d60
Function at 0x4211e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4212de
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 8], 0
jmp 0x421220
mov rax, qword [rsp + 0x50]
mov rcx, rdx
mov rbx, qword [rsp + 0x58]
nop
cmp qword [rsp + 8], rbx
jae 0x4212cf
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov rax, rcx
call fcn.00421d40
nop dword [rax]
test rax, rax
je 0x4212cf
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
lea rcx, [0x00421320]
mov qword [rsp + 0x10], rcx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rbx, [rsp + 0x10]
mov qword [rsp], rbx
call fcn.00460320
xorps xmm15, xmm15
mov r14, qword [0x0054db60]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x60]
test rdx, rdx
jne 0x4212bd
xor eax, eax
jmp 0x4212c7
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x60]
test al, al
je 0x421212
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00460460
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004211e0

Function at 0x458f40
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x458ff9
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rdx, [0x00459040]
mov qword [rsp + 0x10], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x28], rdx
mov rdx, r14
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00460320
xorps xmm15, xmm15
mov r14, qword [0x0054db60]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00460460
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00458f40