joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001fb00
Capabilities:
Access peb ldr_data

Disassembly:
cmp qword [rcx + 0x30], 0
jne 0x18001fb1e
mov rax, qword gs:[0x30]
mov rdx, qword [rax + 0x60]
mov rax, qword [rdx + 0x18]
mov rdx, qword [rax + 0x20]
jmp 0x18001fb22
mov rdx, qword [rcx + 0x10]
movups xmm0, xmmword [rdx - 0x10]
movaps xmmword [rcx], xmm0
movups xmm1, xmmword [rdx]
movaps xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x10]
movaps xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x20]
movaps xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x30]
movaps xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x40]
movaps xmmword [rcx + 0x50], xmm1
movsd xmm0, qword [rdx + 0x50]
movsd qword [rcx + 0x60], xmm0
mov rax, qword [rcx + 0x30]
ret

Function at 0x18001fb60
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, qword gs:[0x30]
mov rdx, qword [rax + 0x60]
mov rax, qword [rdx + 0x18]
mov rax, qword [rax + 0x10]
test rax, rax
je 0x18001fba4
nop word [rax + rax]
cmp qword [rax + 0x30], rcx
je 0x18001fb8f
mov rax, qword [rax]
test rax, rax
jne 0x18001fb80
ret
mov rdx, qword [rax + 8]
mov rcx, qword [rax]
mov qword [rdx], rcx
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov qword [rdx + 8], rcx
ret

Function at 0x18001fbb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 1
call fcn.18001fa10
mov rcx, rax
call fcn.18001fc30
mov rcx, rax
mov rdx, rbx
call fcn.18001fcc0
test rax, rax
jne 0x18001fc1b
lea ecx, [rax + 3]
call fcn.18001fa10
mov rcx, rax
call fcn.18001fc30
mov rcx, rax
mov rdx, rbx
call fcn.18001fcc0
test rax, rax
jne 0x18001fc1b
lea ecx, [rax + 2]
call fcn.18001fa10
mov rcx, rax
call fcn.18001fc30
mov rcx, rax
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp fcn.18001fcc0
add rsp, 0x20
pop rbx
ret

Function at 0x18001fcc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movsxd rax, dword [rcx + 0x3c]
mov r11, rcx
mov rbx, rdx
mov ecx, dword [rax + rcx + 0x88]
add rcx, r11
mov esi, dword [rcx + 0x1c]
mov ebp, dword [rcx + 0x24]
add rsi, r11
add rbp, r11
cmp rdx, 0xffff
ja 0x18001fd14
sub bx, word [rcx + 0x10]
movzx eax, bx
cmp eax, dword [rcx + 0x14]
jae 0x18001fd4e
movzx eax, bx
mov eax, dword [rsi + rax*4]
add rax, r11
jmp 0x18001fd50
mov r10d, dword [rcx + 0x20]
xor r9d, r9d
mov edi, dword [rcx + 0x18]
add r10, r11
test edi, edi
je 0x18001fd4e
nop word [rax + rax]
mov edx, dword [r10]
mov rcx, rbx
add rdx, r11
call 0x180020420
test eax, eax
je 0x18001fd65
inc r9d
add r10, 4
cmp r9d, edi
jb 0x18001fd30
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
movzx ecx, word [rbp + r9*2]
mov eax, dword [rsi + rcx*4]
add rax, r11
jmp 0x18001fd50
Function at 0x18001fff0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x180040008]
xor rax, rsp
mov qword [rbp - 8], rax
movdqa xmm0, xmmword [0x180031f60]
lea rcx, [rbp - 0x30]
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 0x74706563
mov dword [rbp - 0x1c], 0x486e6f69
mov dword [rbp - 0x18], 0x6c646e61
mov word [rbp - 0x14], 0x7265
mov byte [rbp - 0x12], 0
call fcn.18001fbb0
lea rdx, [0x18001ffe0]
mov ecx, 1
call rax
movdqa xmm0, xmmword [0x180031f50]
lea rcx, [rbp - 0x30]
movdqu xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x10], 0
mov dword [rbp - 0x20], 0x69666974
mov dword [rbp - 0x1c], 0x69746163
mov word [rbp - 0x18], 0x6e6f
mov byte [rbp - 0x16], 0
call fcn.18001fbb0
lea r9, [rbp - 0x10]
xor r8d, r8d
lea rdx, [0x18001f9f0]
xor ecx, ecx
call rax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180021350
add rsp, 0x50
pop rbp
ret
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.180020350
test eax, eax
jne 0x1800201ff
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x1800202e0
add rsp, 0x20
pop rbx
ret
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.180020210
mov qword [0x180040958], rax
mov r8d, 0x40
movsxd rax, dword [rdi + 0x3c]
mov edx, dword [rax + rdi + 0x50]
call fcn.18001fd80
mov r8d, 1
mov rdx, rdi
mov rcx, rax
mov rbx, rax
call fcn.180020140
lea r8, [0x180020530]
mov rdx, rdi
sub r8, rdi
mov rcx, rdi
add r8, rbx
call r8
mov rcx, rbx
call fcn.18001fe10
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x18001fff0

Function at 0x180020a30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rbx, rcx
mov dword [rbp - 0x10], 0x61657243
lea rcx, [rbp - 0x10]
mov dword [rbp - 0xc], 0x69466574
mov dword [rbp - 8], 0x57656c
call fcn.18001fbb0
mov rcx, rbx
mov r10, rax
call fcn.18001fa90
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov edx, 0x80000000
mov rcx, rax
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call r10
lea rcx, [rbp - 0x10]
mov dword [rbp - 0x10], 0x46746547
mov rsi, rax
mov dword [rbp - 0xc], 0x53656c69
mov dword [rbp - 8], 0x657a69
call fcn.18001fbb0
xor edx, edx
mov rcx, rsi
call rax
mov edx, eax
mov r8d, 4
mov ebx, eax
call fcn.18001fd80
lea rcx, [rbp - 0x10]
mov dword [rbp - 0x10], 0x64616552
mov rdi, rax
mov dword [rbp - 0xc], 0x656c6946
mov byte [rbp - 8], 0
call fcn.18001fbb0
xor r9d, r9d
mov qword [rsp + 0x20], 0
mov r8d, ebx
mov rdx, rdi
mov rcx, rsi
call rax
mov dword [rbp + 0x18], 0x6c43744e
lea rcx, [rbp + 0x18]
mov dword [rbp + 0x1c], 0x65736f
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x18], rax
call fcn.18001fbb0
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x60]
mov rax, rdi
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret
Function at 0x13fa33d5b
Capabilities:
Execute syscall

Disassembly:
mov rbp, qword [rsp + 0x18]
xchg qword [rsp + 0x78], rdi
mov r15, qword [rsp + 0x60]
sub rsi, qword [rsp + 0x20]
call fcn.13fa6ec3c
sub qword [rsp + 8], rdi
call 0x13fa8b89b
and dword [rsp + r10 - 0x56fc3853], r10d
add qword [rsp + r10 - 0x56fc3863], 0xffffffffbfb585f4
mov r10, qword [rsp + r10 - 0x56fc3843]
call 0x13fabe6e1
syscall
push r8
mov qword [rsp], 0x7e30c90
call 0x13fb826c0
movabs rbp, 0x64afc9118c8f160b
call 0x13fb2ff84
push qword [rsp]
popfq
lea rsp, [rsp + 0x10]
ret 8
push rbp
ja 0x13f9a3b49
push rbx
call fcn.13f99cff0
call 0x13fad264b

Function at 0x13fa39554
Capabilities:
Execute syscall

Disassembly:
mov r8, qword [rsp + 0x38]
call 0x13faf9091
mov r13d, dword [rsp + 0x34]
je 0x13f99d813
xchg qword [rsp + 0x40], rbx
mov rsi, qword [rsp + 0x28]
sub dword [rsp + 0x30], 0x19806983
not r13
not r13b
cmp qword [rsp + 0x30], 0x50ac2b83
setl r13b
add qword [rsp + 0x30], 0xffffffff8b32412b
mov r13, qword [rsp + 0x20]
shr dword [rsp + 0x30], 0xa
sets byte [rsp + 0x30]
shl dword [rsp + 0x30], 0xa3
xor word [rsp + 0x30], 0x316
add qword [rsp + 0x18], 0xffffffffbfbb74a0
call 0x13fae2623
cmp word [rsp + 0x90], 0x6ab2
call fcn.13fa143ce
mov rsi, qword [rsp + rsi - 0x7fe173e1]
mov rsi, qword [rsi]
mov qword [rsp + 0x10], 0x7e35ba12
push r12
jl 0x13fa59ef0
call fcn.13fa7ca06
movabs r10, 0xe4b4ee363704dd28
lea r10, [r10*8 + 0x1ab40727]
mov r10, qword [rsp + 8]
add qword [rsp], 0xffffffffbfa950cb
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x20]
call 0x13fb662da
shl byte [rax], cl
fisub dword [rdx - 0x552d066a]
invalid
Function at 0x140002150
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov eax, dword [rcx + 0x48]
lea rbx, [rcx + 0x28]
mov rsi, qword [rcx]
lea r11, [rcx + 0x28]
add rbx, rax
mov rdi, rcx
movabs rbp, 0x9e3779b185ebca87
movabs r15, 0x27d4eb2f165667c5
movabs r14, 0xc2b2ae3d27d4eb4f
movabs r12, 0x7a1435883d4d519d
cmp rsi, 0x20
jb 0x14000224b
mov rcx, qword [rcx + 8]
mov r8, qword [rdi + 0x18]
mov r9, qword [rdi + 0x20]
mov rax, r8
mov rdx, qword [rdi + 0x10]
mov r10, r9
rol r10, 0x12
rol rax, 0xc
add r10, rax
mov rax, rdx
rol rax, 7
add r10, rax
mov rax, rcx
rol rax, 1
add r10, rax
movabs rax, 0x85ebca77c2b2ae63
imul rcx, r14
imul rdx, r14
imul r8, r14
imul r9, r14
rol rcx, 0x1f
imul rcx, rbp
rol rdx, 0x1f
xor r10, rcx
rol r8, 0x1f
imul r10, rbp
imul rdx, rbp
imul r8, rbp
sub r10, r12
rol r9, 0x1f
xor r10, rdx
imul r10, rbp
imul r9, rbp
sub r10, r12
xor r10, r8
imul r10, rbp
sub r10, r12
xor r10, r9
imul r10, rbp
add rax, r10
add rax, rsi
jmp 0x140002253
lea rax, [rsi + r15]
add rax, qword [rcx + 0x18]
lea rdx, [rdi + 0x30]
cmp rdx, rbx
ja 0x14000228a
nop dword [rax]
mov rcx, qword [r11]
add rdx, 8
imul rcx, r14
add r11, 8
rol rcx, 0x1f
imul rcx, rbp
xor rax, rcx
rol rax, 0x1b
imul rax, rbp
sub rax, r12
cmp rdx, rbx
jbe 0x140002260
lea rdx, [r11 + 4]
movabs r8, 0x165667b19e3779f9
cmp rdx, rbx
ja 0x1400022b5
mov ecx, dword [r11]
mov r11, rdx
imul rcx, rbp
xor rax, rcx
rol rax, 0x17
imul rax, r14
add rax, r8
cmp r11, rbx
jae 0x1400022db
nop word [rax + rax]
movzx ecx, byte [r11]
inc r11
imul rcx, r15
xor rax, rcx
rol rax, 0xb
imul rax, rbp
cmp r11, rbx
jb 0x1400022c0
mov rbx, qword [rsp + 0x20]
mov rcx, rax
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
shr rcx, 0x21
xor rcx, rax
imul rcx, r14
mov rdx, rcx
shr rdx, 0x1d
xor rdx, rcx
imul rdx, r8
mov rax, rdx
shr rax, 0x20
xor rax, rdx
pop r15
pop r14
pop r12
ret

Function at 0x14000a490
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x250
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, r8
lea rax, [rsp + 0x30]
mov rbx, rcx
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor ecx, ecx
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x14000a4d5
xor al, al
jmp 0x14000a522
cmp word [rbx], 0
je 0x14000a4ed
nop dword [rax + rax]
add rbx, 2
dec rdi
cmp word [rbx], 0
jne 0x14000a4e0
cmp word [rsp + 0x30], 0
je 0x14000a51b
lea rcx, [rsp + 0x30]
sub rcx, rbx
nop dword [rax]
cmp rdi, 1
jb 0x14000a543
movzx eax, word [rcx + rbx]
dec rdi
mov word [rbx], ax
add rbx, 2
cmp word [rcx + rbx], 0
jne 0x14000a500
xor eax, eax
mov word [rbx], ax
mov al, 1
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14000b510
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
ret
call fcn.14000d7a0
int3
Function at 0x14000ab90
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x2030
call fcn.14001bfe0
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2020], rax
mov r11d, dword [0x14002cd10]
lea rsi, [0x14002ed40]
mov rdi, rcx
test r11d, r11d
jne 0x14000ac03
lea rdx, str._HOME_
lea rcx, [rsp + 0x20]
call fcn.14000a550
test al, al
je 0x14000acef
lea rcx, [rsp + 0x20]
call fcn.1400110a0
movsxd r11, dword [0x14002cd10]
mov qword [rsi + r11*8], rax
inc r11d
mov dword [0x14002cd10], r11d
xor r9d, r9d
test r11d, r11d
jle 0x14000ac44
mov r10, rsi
nop
mov r8, qword [r10]
mov rax, rdi
sub r8, rdi
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14000ac34
add rax, 2
test ecx, ecx
jne 0x14000ac20
test edx, edx
je 0x14000ac67
inc r9d
add r10, 8
cmp r9d, r11d
jl 0x14000ac10
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x14000ac50
cmp rax, 2
jne 0x14000ac6b
cmp word [rdi + 2], 0x3a
jne 0x14000ac6b
mov al, 1
jmp 0x14000acce
xor edx, edx
mov qword [rsp + 0x2048], rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne bl
test eax, eax
jne 0x14000ac98
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000ac98
mov bl, 1
jmp 0x14000ac9c
test bl, bl
je 0x14000acc3
cmp dword [0x14002cd10], 0x400
jge 0x14000acc3
mov rcx, rdi
call fcn.1400110a0
movsxd rdx, dword [0x14002cd10]
mov qword [rsi + rdx*8], rax
inc edx
mov dword [0x14002cd10], edx
movzx eax, bl
mov rbx, qword [rsp + 0x2048]
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.14000b510
mov rsi, qword [rsp + 0x2050]
add rsp, 0x2030
pop rdi
ret
lea rcx, str._HOME_
call fcn.14000a9e0
int3
Function at 0x14000ae10
Capabilities:
Check if file exists
Delete file
Get file attributes
Terminate process

Disassembly:
sub rsp, 0x68
mov rcx, qword [0x14002cd18]
test rcx, rcx
je 0x14000ae4b
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14000ae3e
mov rcx, qword [0x14002cd18]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [0x14002cd18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x140030d68], 0
je 0x14000af3e
mov qword [rsp + 0x70], rbx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x78], rbp
lea rbp, [0x140025900]
mov qword [rsp + 0x80], rsi
lea rsi, [0x14002cd40]
mov qword [rsp + 0x88], rdi
xor edi, edi
mov qword [rsp + 0x60], r14
mov r14d, 0x414
mov word [rsp + 0x40], r14w
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebx, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000af1f
test al, 0x10
je 0x14000af1f
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov word [rsp + 0x40], r14w
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
inc ebx
cmp ebx, 0x14
jl 0x14000aec5
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x60]
add rsp, 0x68
ret
Function at 0x14000be18
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000be62
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000be62
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000be62
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000be62
cmp dword [rcx + 0x84], 0xe
jbe 0x14000be62
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000be64
xor al, al
add rsp, 0x28
ret

Function at 0x14000d794
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x14000d627
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000d627
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000d627
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000d627
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000d627
cmp dword [rcx + 0x84], 0xe
jbe 0x14000d627
cmp dword [rcx + 0xf8], 0
je 0x14000d627
mov ecx, ebx
call fcn.14000d6c8
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.14000d4b8
cmp dword [rbp + 0x20], 0
je 0x14000d674
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000d67c
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000d5c0
Function at 0x14001bf20
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14001bf48
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14001bf48
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140003e40
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
xor r8, r8
push r8
push rax
pushfq
push r8
push rdx
sub rsp, 0xa8
push r8
push r15
push r14
push r13
push r12
push rbx
push r8
push rsi
push rdi
push rbp
push rax
push rdx
sub rsp, 0x290
movdqa xmmword [rsp + 0x2f0], xmm6
movdqa xmmword [rsp + 0x300], xmm7
movdqa xmmword [rsp + 0x310], xmm8
movdqa xmmword [rsp + 0x320], xmm9
movdqa xmmword [rsp + 0x330], xmm10
movdqa xmmword [rsp + 0x340], xmm11
movdqa xmmword [rsp + 0x350], xmm12
movdqa xmmword [rsp + 0x360], xmm13
movdqa xmmword [rsp + 0x370], xmm14
movdqa xmmword [rsp + 0x380], xmm15
mov eax, dword [0x14045cfcc]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x30
add rax, rbx
lea rdx, [rsp + 0x20]
xor r8, r8
mov qword [rdx + 0x10], r8
mov byte [rdx + 0x19], 1
mov dword [rdx + 0x1c], 0xffffffff
mov byte [rdx + 0x18], 2
mov r8, qword [rax + 0x80]
mov qword [rdx], r8
mov qword [rax + 0x80], rdx
lea r8, [rsp + 0x290]
mov qword [rdx + 8], r8
call fcn.1400e9410
int3
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xd8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x120], rcx
mov qword [rsp + 0x128], rdx
mov qword [rsp + 0x130], r8
mov qword [rsp + 0x138], r9
mov eax, dword [0x14045cfcc]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x30
add rax, rbx
mov qword [rsp + 0xc0], rax
cmp rcx, qword [rax + 0x88]
sete byte [rsp + 0xd0]
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [r8 + 0x18]
mov rbx, qword [rax]
mov rax, qword [r8 + 0x20]
mov rbp, qword [rax]
mov rax, qword [r8 + 0x28]
mov rsi, qword [rax]
mov rax, qword [r8 + 0x30]
mov rdi, qword [rax]
mov rax, qword [r8 + 0x58]
mov r12, qword [rax]
mov rax, qword [r8 + 0x60]
mov r13, qword [rax]
mov rax, qword [r8 + 0x68]
mov r14, qword [rax]
mov rax, qword [r8 + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [r8 + 0x90]
movdqa xmm7, xmmword [r8 + 0xa0]
movdqa xmm8, xmmword [r8 + 0xb0]
movdqa xmm9, xmmword [r8 + 0xc0]
movdqa xmm10, xmmword [r8 + 0xd0]
movdqa xmm11, xmmword [r8 + 0xe0]
movdqa xmm12, xmmword [r8 + 0xf0]
movdqa xmm13, xmmword [r8 + 0x100]
movdqa xmm14, xmmword [r8 + 0x110]
movdqa xmm15, xmmword [r8 + 0x120]
mov rcx, qword [r8 + 0x78]
mov rdx, qword [rsp + 0x120]
call qword [rsp + 0x128]
mov r8, qword [rsp + 0x130]
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rdx + 0x70]
cmp rcx, 0
je 0x140003fd0
mov r9, qword [rdx + 0x68]
mov qword [r9], rcx
mov qword [rdx + 0x68], 0
mov qword [rdx + 0x70], 0
mov rcx, qword [rsp + 0x138]
mov r8, qword [r8 + 0x78]
xor r9d, r9d
mov rcx, qword [rcx]
cmp rcx, r9
je 0x140003fec
cmp rcx, r8
jl 0x140003fdf
mov qword [rdx + 0x80], rcx
test dword [0x140454b80], 1
je 0x14000401b
cmp byte [rsp + 0xd0], 0
je 0x14000401b
mov rcx, 0x43
mov rdx, rax
mov rsp, r8
jmp 0x140003b40
mov rsp, r8
jmp rax
Function at 0x140004020
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xc8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x110], rcx
mov qword [rsp + 0x118], rdx
mov eax, dword [0x14045cfcc]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x30
add rax, rbx
mov qword [rsp + 0xc0], rax
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [rdx + 0x18]
mov rbx, qword [rax]
mov rax, qword [rdx + 0x20]
mov rbp, qword [rax]
mov rax, qword [rdx + 0x28]
mov rsi, qword [rax]
mov rax, qword [rdx + 0x30]
mov rdi, qword [rax]
mov rax, qword [rdx + 0x58]
mov r12, qword [rax]
mov rax, qword [rdx + 0x60]
mov r13, qword [rax]
mov rax, qword [rdx + 0x68]
mov r14, qword [rax]
mov rax, qword [rdx + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [rdx + 0x90]
movdqa xmm7, xmmword [rdx + 0xa0]
movdqa xmm8, xmmword [rdx + 0xb0]
movdqa xmm9, xmmword [rdx + 0xc0]
movdqa xmm10, xmmword [rdx + 0xd0]
movdqa xmm11, xmmword [rdx + 0xe0]
movdqa xmm12, xmmword [rdx + 0xf0]
movdqa xmm13, xmmword [rdx + 0x100]
movdqa xmm14, xmmword [rdx + 0x110]
movdqa xmm15, xmmword [rdx + 0x120]
mov rcx, qword [rdx + 0x78]
call qword [rsp + pe_nt_image_headers64]
mov rdx, qword [rsp + 0x118]
mov rax, qword [rdx + 0x18]
mov qword [rax], rbx
mov rax, qword [rdx + 0x20]
mov qword [rax], rbp
mov rax, qword [rdx + 0x28]
mov qword [rax], rsi
mov rax, qword [rdx + 0x30]
mov qword [rax], rdi
mov rax, qword [rdx + 0x58]
mov qword [rax], r12
mov rax, qword [rdx + 0x60]
mov qword [rax], r13
mov rax, qword [rdx + 0x68]
mov qword [rax], r14
mov rax, qword [rdx + 0x70]
mov qword [rax], r15
movdqa xmmword [rdx + 0x90], xmm6
movdqa xmmword [rdx + 0xa0], xmm7
movdqa xmmword [rdx + 0xb0], xmm8
movdqa xmmword [rdx + 0xc0], xmm9
movdqa xmmword [rdx + 0xd0], xmm10
movdqa xmmword [rdx + 0xe0], xmm11
movdqa xmmword [rdx + 0xf0], xmm12
movdqa xmmword [rdx + 0x100], xmm13
movdqa xmmword [rdx + 0x110], xmm14
movdqa xmmword [rdx + 0x120], xmm15
mov rax, qword [rsp + 0xc0]
lock or dword [rax + 0x38], 0x10
movdqa xmm6, xmmword [rsp + 0x20]
movdqa xmm7, xmmword [rsp + 0x30]
movdqa xmm8, xmmword [rsp + 0x40]
movdqa xmm9, xmmword [rsp + 0x50]
movdqa xmm10, xmmword [rsp + 0x60]
movdqa xmm11, xmmword [rsp + 0x70]
movdqa xmm12, xmmword [rsp + 0x80]
movdqa xmm13, xmmword [rsp + 0x90]
movdqa xmm14, xmmword [rsp + 0xa0]
movdqa xmm15, xmmword [rsp + 0xb0]
add rsp, 0xc8
pop rbp
pop rdi
pop rsi
pop rbx
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140004540
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rdx
mov rdx, rcx
mov rcx, rax
jmp 0x14000e490
mov rax, qword gs:[0x30]
mov r10, rcx
mov r8, qword [rax + 0x60]
mov r9, qword [r8 + 0x18]
add r9, 0x20
mov rax, qword [r9]
nop dword [rax + rax]
cmp qword [rax + 0x20], rdx
je 0x14000e4cd
test rdx, rdx
je 0x14000e4cd
mov rax, qword [rax]
cmp rax, r9
jne 0x14000e4b0
mov qword [rcx], 0
xor eax, eax
ret
mov rcx, qword [rax + 0x40]
mov qword [r10], rcx
movzx eax, word [rax + 0x38]
shr eax, 1
ret