joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140052630
Capabilities:
Check if file exists
Delete file
Get common file path
Get program files directory
Write file on windows

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x70]
call fcn.14011d670
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x26]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
xor esi, esi
mov qword [rsp + 0x50], rsi
mov byte [rsp + 0x40], sil
cmp byte [rsp + 0x70], sil
jne 0x1400526a4
mov r8d, esi
jmp 0x1400526b9
lea rax, [rsp + 0x70]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], sil
jne 0x1400526b0
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call fcn.14000d058
nop
mov r8d, 9
lea rdx, str.SA_s.dat
lea rcx, [rsp + 0x40]
call fcn.14000bb3c
mov ebx, esi
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rcx, qword [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x1400527a6
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rcx, qword [rsp + 0x40]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140052779
mov dword [rbp + 0x90], esi
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rdx, qword [rsp + 0x40]
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0x90]
mov r8d, dword [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140052790
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0xf
jl 0x1400526e2
mov rax, qword [rsp + 0x58]
cmp rax, 0x10
jb 0x1400527fe
inc rax
mov rcx, qword [rsp + 0x40]
cmp rax, 0x1000
jb 0x1400527f9
test cl, 0x1f
je 0x1400527cc
call fcn.140128ff4
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1400527db
call fcn.140128ff4
int3
sub rcx, rax
cmp rcx, 8
jae 0x1400527ea
call fcn.140128ff4
int3
cmp rcx, 0x27
jbe 0x1400527f6
call fcn.140128ff4
int3
mov rcx, rax
call fcn.1400eb7f4
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140059ef0
Capabilities:
Access pe header

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
call fcn.140059fc0
mov rcx, rsi
mov rdi, rax
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rdi, rdi
jne 0x140059f20
xor al, al
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rdi + 0xc]
and al, 6
cmp al, 2
je 0x140059f13
cmp qword [rdi + 0x20], 0
je 0x140059f68
mov qword [rsp + 0x30], rbx
xor ebx, ebx
cmp dword [rdi + 0x28], ebx
jbe 0x140059f5a
nop dword [rax]
mov rax, qword [rdi + 0x20]
mov rcx, qword [rax + rbx*8]
test rcx, rcx
je 0x140059f53
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
inc ebx
cmp ebx, dword [rdi + 0x28]
jb 0x140059f40
mov rcx, qword [rdi + 0x20]
call fcn.1400ec138
mov rbx, qword [rsp + 0x30]
cmp qword [rdi + 0x10], 0
je 0x140059f80
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov al, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14005a110
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x30]
xor edi, edi
mov ebx, edi
mov dword [rsp + 0x30], edi
mov rsi, qword [rax + 0x40]
nop dword [rax]
nop dword [rax + rax]
mov rax, qword gs:[0x30]
mov r8, rbx
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r8d, dword [rsp + 0x30]
mov rbx, rdi
test r8d, r8d
je 0x14005a19c
lea eax, [r8 + r8]
xor edx, edx
mov dword [rsp + 0x30], eax
mov rax, qword gs:[0x30]
mov r8d, dword [rsp + 0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
test rax, rax
je 0x14005a1f2
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rbx
mov ecx, 5
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x14005a140
test rbx, rbx
je 0x14005a1f2
mov rax, rbx
cmp qword [rbx + 0x50], rsi
je 0x14005a1d3
mov ecx, dword [rax]
test ecx, ecx
je 0x14005a1d6
add rax, rcx
cmp qword [rax + 0x50], rsi
jne 0x14005a1c4
mov edi, dword [rax + 4]
mov rax, qword gs:[0x30]
mov r8, rbx
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rbx, qword [rsp + 0x38]
mov eax, edi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14005ad30
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x50
mov rsi, r9
mov r14, r8
mov r15, rdx
movups xmm0, xmmword [rcx]
movups xmmword [rax - 0x38], xmm0
movups xmm2, xmmword [rcx + 0x10]
movups xmmword [rax - 0x28], xmm2
movsd xmm0, qword [rcx + 0x20]
movsd qword [rax - 0x18], xmm0
xor ecx, ecx
movq rax, xmm2
mov dword [rax], ecx
mov dword [r8], ecx
mov qword [r9], rcx
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov edx, 8
lea r8d, [rdx + 0x38]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
test rax, rax
jne 0x14005adac
mov eax, 0xc0000017
jmp 0x14005ae57
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [0x1406f4b68]
call qword [sym.imp.ntdll.dll_RtlFindClearBitsAndSet]
mov edi, eax
cmp eax, 0xffffffff
jne 0x14005adea
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r8, rbx
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, 0xc000009a
jmp 0x14005ae57
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rbx + 0x10], xmm0
movups xmm1, xmmword [rsp + 0x30]
movups xmmword [rbx + 0x20], xmm1
movsd xmm0, qword [rsp + 0x40]
movsd qword [rbx + 0x30], xmm0
mov qword [rbx + 0x38], r15
mov rax, qword [rbx + 0x20]
mov dword [rax], edi
mov dword [rbx + 0x34], edi
lea rcx, [0x1406f4b78]
call qword [sym.imp.ntdll.dll_RtlAcquireSRWLockExclusive]
mov rax, qword [0x1406f4b60]
lea rdx, [0x1406f4b58]
mov qword [rbx], rdx
mov qword [rbx + 8], rax
mov qword [rax], rbx
mov qword [0x1406f4b60], rbx
lea rcx, [0x1406f4b78]
call qword [sym.imp.ntdll.dll_RtlReleaseSRWLockExclusive]
mov qword [rsi], rbx
mov dword [r14], edi
xor eax, eax
jmp 0x14005ae57
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
add rsp, 0x50
pop r15
ret
Function at 0x14005b9d0
Capabilities:
Access pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, rcx
mov edx, 8
lea r8d, [rdx + 0x5e]
call fcn.14005b2c0
nop
xor r14d, r14d
mov r15d, r14d
mov rcx, rsi
call fcn.140059fc0
mov rdi, rax
test rax, rax
je 0x14005bb9e
movzx eax, byte [rax + 0xc]
test al, 2
je 0x14005bb9e
test byte [rdi + 0xe], 1
jne 0x14005ba49
or al, 4
mov byte [rdi + 0xc], al
mov rcx, rsi
call fcn.140059ef0
mov ecx, 0xc0000001
test al, al
cmovne ecx, r14d
mov eax, ecx
jmp 0x14005bba5
test rbx, rbx
je 0x14005ba53
mov rbx, qword [rbx]
jmp 0x14005ba5e
mov rcx, rsi
call fcn.14005d860
mov rbx, rax
test rbx, rbx
je 0x14005bb9e
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov r12, rax
mov ecx, dword [rbx + 0x40]
cmp dword [rax + 0x50], ecx
jne 0x14005bb9e
test byte [rdi + 0xe], 8
je 0x14005bac1
call fcn.14005e010
test eax, eax
jle 0x14005bab7
cmp eax, 3
jle 0x14005bab0
cmp eax, 8
jg 0x14005bab7
movzx ecx, word [rbx + 0x6c]
mov rax, qword [rbx + 0x98]
mov r15d, dword [rax + 0x18]
cmp r15d, ecx
cmove r15d, ecx
jmp 0x14005bac1
movzx r15d, word [rbx + 0x6c]
jmp 0x14005bac1
mov eax, 0xc0000001
jmp 0x14005bba5
test r15d, 0xfffffffe
jne 0x14005bb49
or byte [rdi + 0xc], 4
test byte [rdi + 0xc], 1
je 0x14005bae7
mov rcx, qword [rdi + 0x10]
mov eax, dword [r12 + 0x28]
add rax, rcx
xor r8d, r8d
xor edx, edx
call rax
movzx eax, word [rdi + 0xe]
test al, 1
je 0x14005bb32
test al, 2
je 0x14005bb06
mov rcx, rsi
call fcn.14005cfc0
test eax, eax
jns 0x14005bb06
mov ecx, 3
int 0x29
test byte [rdi + 0xe], 4
je 0x14005bb1f
mov rcx, rbx
call fcn.14005deb0
test eax, eax
jns 0x14005bb1f
mov ecx, 7
int 0x29
mov rcx, rbx
call fcn.14005c3c0
test al, al
jne 0x14005bb32
mov ecx, 7
int 0x29
mov rcx, rsi
call fcn.140059ef0
test al, al
jne 0x14005bb45
mov ecx, 7
int 0x29
xor eax, eax
jmp 0x14005bba5
call fcn.14005e010
test eax, eax
jle 0x14005bb93
cmp eax, 3
jle 0x14005bb81
cmp eax, 8
jg 0x14005bb93
movzx eax, word [rbx + 0x6c]
test ax, ax
je 0x14005bb6c
dec ax
mov word [rbx + 0x6c], ax
mov rcx, qword [rbx + 0x98]
mov eax, dword [rcx + 0x18]
test eax, eax
je 0x14005bb99
dec eax
mov dword [rcx + 0x18], eax
jmp 0x14005bb99
movzx eax, word [rbx + 0x6c]
test ax, ax
je 0x14005bb99
dec ax
mov word [rbx + 0x6c], ax
jmp 0x14005bb99
mov r14d, 0xc0000001
mov eax, r14d
jmp 0x14005bba5
mov eax, 0xc0000008
jmp 0x14005bba5
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x14005bbd0
Capabilities:
Access pe header
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov r12, rdx
mov r14, rcx
mov byte [rsp + 0x20], 0
xor edi, edi
test rdx, rdx
je 0x14005bbf6
mov qword [rdx], rdi
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov rbx, rax
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
test rax, rax
je 0x14005bded
movzx eax, word [rax + 0x18]
cmp eax, 0x10b
je 0x14005bc8e
cmp eax, 0x20b
je 0x14005bc2b
xor al, al
jmp 0x14005bded
movzx r15d, word [rbx + 0x14]
add r15, 0x18
add r15, rbx
mov qword [rsp + 0x40], r15
mov esi, dword [rbx + 0x54]
mov qword [rsp + 0x38], rsi
movzx eax, word [rbx + 6]
lea rdx, [rax + rax*4]
shl rdx, 3
mov r8d, 0x66
mov rcx, r15
call fcn.14005b2c0
movzx ecx, di
mov word [rsp + 0x24], cx
cmp cx, word [rbx + 6]
jae 0x14005bc86
mov eax, dword [r15 + 0x10]
add rsi, rax
mov qword [rsp + 0x38], rsi
inc cx
add r15, 0x28
mov qword [rsp + 0x40], r15
jmp 0x14005bc61
mov eax, dword [rbx + 0xac]
jmp 0x14005bcef
movzx r15d, word [rbx + 0x14]
add r15, 0x18
add r15, rbx
mov qword [rsp + 0x40], r15
mov esi, dword [rbx + 0x54]
mov qword [rsp + 0x38], rsi
movzx eax, word [rbx + 6]
lea rdx, [rax + rax*4]
shl rdx, 3
mov r8d, 0x66
mov rcx, r15
call fcn.14005b2c0
movzx ecx, di
mov word [rsp + 0x28], cx
cmp cx, word [rbx + 6]
jae 0x14005bce9
mov eax, dword [r15 + 0x10]
add rsi, rax
mov qword [rsp + 0x38], rsi
inc cx
add r15, 0x28
mov qword [rsp + 0x40], r15
jmp 0x14005bcc4
mov eax, dword [rbx + 0x9c]
add rsi, rax
mov qword [rsp + 0x38], rsi
mov r8d, 0x66
mov rdx, rsi
mov rcx, r14
call fcn.14005b2c0
test r12, r12
je 0x14005bd11
mov qword [r12], rsi
mov rcx, r14
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov r8, rax
mov qword [rsp + 0x48], r14
mov dword [rsp + 0x98], edi
mov edx, edi
mov dword [rsp + 0x2c], edx
lea ecx, [rsi + 1]
shr ecx, 1
cmp edx, ecx
jae 0x14005bd6c
movzx ecx, word [r14]
add edi, ecx
mov dword [rsp + 0x98], edi
mov eax, edi
shr eax, 0x10
test ax, ax
je 0x14005bd5f
mov ecx, eax
movzx eax, di
add ecx, eax
mov edi, ecx
mov dword [rsp + 0x98], ecx
add r14, 2
mov qword [rsp + 0x48], r14
inc edx
jmp 0x14005bd2b
mov eax, edi
shr eax, 0x10
add ax, di
movzx ecx, ax
mov dword [rsp + 0x90], ecx
mov edx, dword [r8 + 0x58]
mov dword [rsp + 0x30], edx
test edx, edx
jne 0x14005bd8e
mov al, 1
jmp 0x14005bdd2
cmp cx, dx
jb 0x14005bd9a
movzx eax, dx
sub ecx, eax
jmp 0x14005bda1
sub ecx, edx
movzx ecx, cx
dec ecx
mov dword [rsp + 0x90], ecx
mov eax, edx
shr eax, 0x10
cmp cx, ax
jb 0x14005bdb6
sub ecx, eax
jmp 0x14005bdbd
sub ecx, eax
movzx ecx, cx
dec ecx
mov dword [rsp + 0x90], ecx
add ecx, esi
mov dword [rsp + 0x90], ecx
cmp edx, ecx
sete al
mov byte [rsp + 0x20], al
jmp 0x14005bded
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14005be10
Capabilities:
Access pe header

Disassembly:
push rdi
sub rsp, 0x20
mov rdi, qword [rcx + 0x10]
mov rcx, rdi
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov ecx, dword [rax + 0xd0]
test ecx, ecx
je 0x14005be62
mov qword [rsp + 0x30], rbx
mov rbx, qword [rcx + rdi + 0x18]
test rbx, rbx
je 0x14005be5d
mov rax, qword [rbx]
test rax, rax
je 0x14005be5d
xor r8d, r8d
mov rcx, rdi
lea edx, [r8 + 1]
call rax
mov rax, qword [rbx + 8]
lea rbx, [rbx + 8]
test rax, rax
jne 0x14005be44
mov rbx, qword [rsp + 0x30]
mov eax, 1
add rsp, 0x20
pop rdi
ret

Function at 0x14005be80
Capabilities:
Access pe header

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, edx
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov r8d, dword [rax + 0x28]
test r8d, r8d
je 0x14005bee2
mov rcx, qword [rbx + 0x10]
lea rax, [rcx + r8]
xor r8d, r8d
mov edx, edi
call rax
test eax, eax
je 0x14005bec0
or byte [rbx + 0xc], 1
mov eax, 1
jmp 0x14005bee7
mov ecx, 0x45a
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14005bede
xor eax, eax
jmp 0x14005bee7
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14005bf20
Capabilities:
Access pe header

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x50
mov rsi, r9
mov rbp, r8
mov r14d, edx
mov rdi, rcx
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rax, rax
jne 0x14005bf53
mov eax, 0xc000007b
jmp 0x14005bfa6
mov rcx, rdi
mov qword [rsp + 0x60], rbx
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rax, rax
je 0x14005bf9c
call fcn.14005dbe0
mov rcx, rax
call fcn.14005db80
mov rbx, rax
test rax, rax
je 0x14005bf9c
lea r9, [rsp + 0x40]
mov rdx, rsi
lea r8, [rsp + 0x30]
mov rcx, rbp
call fcn.14005ca70
mov rcx, rbx
test al, al
jne 0x14005bfbc
call fcn.14005dbb0
mov eax, 0xc0000017
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
lea rax, [rsp + 0x40]
mov r8, rdi
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov edx, r14d
call fcn.14005c4e0
mov rcx, rbx
test al, al
jne 0x14005bffd
call fcn.14005dbb0
mov rcx, qword [rsp + 0x38]
call fcn.14005dbb0
mov rcx, qword [rsp + 0x48]
call fcn.14005dbb0
mov eax, 0xc0000001
jmp 0x14005bfa1
call fcn.14005c810
mov rax, qword [rsp + 0x80]
test rax, rax
je 0x14005c012
mov qword [rax], rbx
xor eax, eax
jmp 0x14005bfa1
Function at 0x14005c810
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov r14, rcx
call fcn.14005e010
mov rax, qword gs:[0x30]
mov rdx, qword [rax + 0x60]
mov rsi, qword [rdx + 0x18]
call fcn.14005dac0
lea rcx, [r14 + 0x58]
mov dl, 1
mov rbx, rax
lea rdi, [r14 + 0x70]
call fcn.14005d9f0
mov edx, eax
lea rcx, [rsi + 0x10]
shl rdx, 4
add rdx, rbx
mov rbx, qword [rsp + 0x30]
mov rax, qword [rdx + 8]
mov qword [rdi], rdx
mov qword [rdi + 8], rax
mov qword [rax], rdi
mov qword [rdx + 8], rdi
lea rdx, [r14 + 0x10]
mov rax, qword [rcx + 8]
mov rdi, qword [rsp + 0x40]
mov qword [r14], rcx
mov qword [r14 + 8], rax
mov qword [rax], r14
mov qword [rcx + 8], r14
lea rcx, [rsi + 0x20]
mov rax, qword [rcx + 8]
mov qword [rdx], rcx
mov qword [rdx + 8], rax
mov qword [rax], rdx
mov qword [rcx + 8], rdx
lea rcx, [rsi + 0x30]
mov rax, qword [rcx + 8]
lea rdx, [r14 + 0x20]
mov rsi, qword [rsp + 0x38]
mov qword [rdx], rcx
mov qword [rdx + 8], rax
mov qword [rax], rdx
mov qword [rcx + 8], rdx
add rsp, 0x20
pop r14
ret

Function at 0x14005d080
Capabilities:
Access pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov ecx, 0x400
test word [rax + 0x5e], cx
je 0x14005d0c7
mov dword [rbx], 0xffffffff
xor eax, eax
mov dword [rdi], 0xffffffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov r8d, 0xa
lea r9, [rsp + 0x48]
mov dl, 1
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlImageDirectoryEntryToData]
mov rcx, rax
test rax, rax
je 0x14005d119
cmp dword [rsp + 0x48], 0x40
jne 0x14005d119
cmp dword [rax], 0x48
jb 0x14005d119
cmp qword [rax + 0x60], 0
je 0x14005d119
cmp qword [rax + 0x68], 0
je 0x14005d119
mov eax, dword [rax + 0x60]
mov dword [rdi], eax
mov eax, dword [rcx + 0x68]
mov dword [rbx], eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov r8d, reloc.WS2_32.dll_ntohl
lea r9, [rsp + 0x48]
mov dl, 1
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlImageDirectoryEntryToData]
test rax, rax
je 0x14005d13f
test byte [rax + 0x10], 1
je 0x14005d13f
or eax, 0xffffffff
jmp 0x14005d141
xor eax, eax
mov rsi, qword [rsp + 0x38]
mov dword [rbx], eax
mov rbx, qword [rsp + 0x30]
mov dword [rdi], eax
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x14005d380
Capabilities:
Access pe header
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push r12
push r15
sub rsp, 0x70
lea rcx, [0x1403f39a0]
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov rbp, rax
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov r9b, 1
mov qword [rsp + 0x58], Ordinal_30
mov r12, rax
lea edx, [rbx + 2]
xor eax, eax
lea ecx, [rbx + 6]
mov qword [rsp + 0x38], rax
lea r15, str..data
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x50], rax
xor eax, eax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
call fcn.14005dec0
test al, al
je 0x14005d403
mov rbx, rbp
mov rcx, r12
jmp 0x14005d4b3
xor r8d, r8d
lea edx, [r8 + 3]
lea ecx, [rdx + 3]
call fcn.14005df40
test al, al
je 0x14005d428
mov rbx, rbp
lea r15, str..mrdata
mov rcx, r12
jmp 0x14005d4b3
mov rax, qword gs:[0x30]
mov qword [rsp + 0x98], rdi
mov qword [rsp + 0xa0], r14
mov rcx, qword [rax + 0x60]
mov r14, qword [rcx + 0x18]
add r14, 0x10
mov rdi, qword [r14]
cmp rdi, r14
je 0x14005d497
mov qword [rsp + 0x90], rsi
nop dword [rax]
mov rcx, qword [rdi + 0x30]
lea rsi, [rdi]
mov rdi, qword [rdi]
call fcn.140059fa0
test al, al
jne 0x14005d48a
test rbx, rbx
je 0x14005d486
mov rax, qword [rsi + 0x30]
cmp rbx, rax
jb 0x14005d48a
mov rbx, rax
jmp 0x14005d48a
mov rbx, qword [rsi + 0x30]
cmp rdi, r14
jne 0x14005d460
mov rsi, qword [rsp + 0x90]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov r14, qword [rsp + 0xa0]
mov rcx, rax
mov rdi, qword [rsp + 0x98]
test rbx, rbx
je 0x14005d58a
test rcx, rcx
je 0x14005d58a
test rbp, rbp
je 0x14005d58a
test r12, r12
je 0x14005d58a
mov edx, dword [rcx + 0xa4]
test edx, edx
je 0x14005d4f1
mov eax, dword [rcx + 0xa0]
add rax, rbx
mov qword [rsp + 0x20], rax
jmp 0x14005d4fa
mov qword [rsp + 0x20], 0
mov eax, dword [rcx + 0x50]
lea r8, [rsp + 0x50]
mov dword [rsp + 0x34], edx
mov rcx, rbp
mov dword [rsp + 0x30], eax
mov rdx, r15
movsd xmm1, qword [rsp + 0x30]
mov qword [rsp + 0x28], rbx
movups xmm0, xmmword [rsp + 0x20]
movsd qword [rsp + 0x48], xmm1
movups xmmword [rsp + 0x38], xmm0
call fcn.14005dcc0
test eax, eax
js 0x14005d58a
nop dword [rax]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x60]
xor r8d, r8d
lea edx, [r8 + 2]
lea ecx, [rdx + 4]
call fcn.14005df40
test al, al
je 0x14005d567
cmp dword [rbx - 0xc], 0x200
jne 0x14005d576
cmp dword [rbx - 4], 0
je 0x14005d59e
cmp dword [rbx - 0xc], 0x200
jne 0x14005d576
cmp dword [rbx - 8], 0
je 0x14005d59e
lea r8, [rsp + 0x50]
mov rdx, r15
mov rcx, rbp
call fcn.14005dcc0
test eax, eax
jns 0x14005d540
xor eax, eax
mov rbx, qword [rsp + 0xa8]
add rsp, 0x70
pop r15
pop r12
pop rbp
ret
lea rax, [rbx - 0x10]
mov rbx, qword [rsp + 0xa8]
add rsp, 0x70
pop r15
pop r12
pop rbp
ret

Function at 0x14005d860
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, qword gs:[0x30]
mov rdx, qword [rax + 0x60]
mov r8, qword [rdx + 0x18]
add r8, 0x10
mov rax, qword [r8]
cmp rax, r8
je 0x14005d891
nop dword [rax]
mov rdx, rax
mov rax, qword [rax]
cmp qword [rdx + 0x30], rcx
je 0x14005d894
cmp rax, r8
jne 0x14005d880
xor eax, eax
ret
mov rax, rdx
ret
Function at 0x14005d8a0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x30]
mov rbp, rcx
mov rdx, qword [rax + 0x60]
mov rsi, qword [rdx + 0x18]
add rsi, 0x10
mov rbx, qword [rsi]
cmp rbx, rsi
je 0x14005d91f
nop dword [rax]
nop dword [rax + rax]
mov rdi, rbx
mov rcx, rbp
mov rbx, qword [rbx]
movzx r8d, word [rdi + 0x58]
mov rdx, qword [rdi + 0x60]
shr r8, 1
sub r8, 4
call fcn.14016ef5c
test eax, eax
je 0x14005d936
movzx r8d, word [rdi + 0x58]
mov rcx, rbp
mov rdx, qword [rdi + 0x60]
shr r8, 1
call fcn.14016ef5c
test eax, eax
je 0x14005d936
cmp rbx, rsi
jne 0x14005d8e0
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rax, rdi
jmp 0x14005d921

Function at 0x14005dac0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1406f4c80]
test rax, rax
jne 0x14005db68
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r8, qword [rcx + 0x18]
add r8, 0x30
mov rax, qword [r8]
cmp r8, rax
je 0x14005db61
mov qword [rsp + 0x20], rbx
xor r9d, r9d
nop dword [rax]
lea rbx, [rax - 0x20]
mov rax, qword [rax]
mov rdx, qword [rbx + 0x70]
lea rcx, [rbx + 0x70]
cmp rdx, rcx
je 0x14005db27
mov qword [0x1406f4c80], rdx
cmp qword [rdx], rcx
je 0x14005db3d
mov qword [0x1406f4c80], r9
cmp r8, rax
jne 0x14005db00
mov rbx, qword [rsp + 0x20]
mov rax, qword [0x1406f4c80]
add rsp, 0x28
ret
lea rcx, [rbx + 0x58]
mov dl, 1
call fcn.14005d9f0
mov ecx, eax
mov rax, qword [rbx + 0x70]
mov rbx, qword [rsp + 0x20]
shl rcx, 4
sub rax, rcx
mov qword [0x1406f4c80], rax
mov rax, qword [0x1406f4c80]
add rsp, 0x28
ret