joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000dfd0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.14000e220
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x14000e0ea
mov rax, qword [0x140045050]
cmp qword [rsp + 0x20], rax
jb 0x14000e034
mov rax, qword [0x140045058]
cmp qword [rsp + 0x20], rax
ja 0x14000e034
mov rax, qword [rsp + 0x20]
sub rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x14000dff6
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140013e70
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
jne 0x14000e065
jmp 0x14000e0ea
cmp dword [rsp + 0x50], 0x10000
jne 0x14000e0cd
cmp qword [rsp + 0x48], 0x10000
jb 0x14000e0cd
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualAlloc
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x14000e0ab
mov rax, qword [rsp + 0x28]
jmp 0x14000e0ec
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x14000e0bb
xor eax, eax
jmp 0x14000e0ec
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x14000e0e5
mov rax, qword [rsp + 0x38]
sub rax, 0x10000
mov rcx, rax
call fcn.14000e220
mov qword [rsp + 0x20], rax
jmp 0x14000dff6
xor eax, eax
add rsp, 0x68
ret

Function at 0x14000e100
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.14000e260
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x14000e216
mov rax, qword [0x140045050]
cmp qword [rsp + 0x20], rax
jb 0x14000e15b
mov rax, qword [0x140045058]
cmp qword [rsp + 0x20], rax
ja 0x14000e15b
mov rax, qword [rsp + 0x20]
add rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x14000e11d
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140013e70
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
jne 0x14000e18c
jmp 0x14000e216
cmp dword [rsp + 0x50], 0x10000
jne 0x14000e1f4
cmp qword [rsp + 0x48], 0x10000
jb 0x14000e1f4
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualAlloc
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x14000e1d2
mov rax, qword [rsp + 0x28]
jmp 0x14000e218
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x14000e1e2
xor eax, eax
jmp 0x14000e218
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x14000e211
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.14000e260
mov qword [rsp + 0x20], rax
jmp 0x14000e11d
xor eax, eax
add rsp, 0x68
ret
Function at 0x14000e2b0
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.14000e840
mov qword [rsp + 0x28], 0
cmp qword [0x140046a38], 0
jne 0x14000e2f8
cmp qword [0x140046a30], 0
je 0x14000e2f8
mov rax, qword [0x140046a30]
mov qword [0x140046a38], rax
cmp qword [0x140046a38], 0
je 0x14000e39e
mov rax, qword [0x140046a38]
cmp qword [rax + 0x10], 0
je 0x14000e39e
mov rax, qword [0x140046a38]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x14000e39e
mov rax, qword [0x140046a38]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x14000e39e
mov rax, qword [0x140046a38]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
jb 0x14000e364
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x28], rax
jbe 0x14000e36b
xor eax, eax
jmp 0x14000e515
mov rax, qword [0x140046a38]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x48]
mov qword [rax + 0x10], rcx
mov r8d, 0x60
mov edx, 0xcc
mov rcx, qword [rsp + 0x28]
call fcn.140013e70
mov rax, qword [rsp + 0x28]
jmp 0x14000e515
mov rax, qword [0x140046a30]
mov qword [0x140046a38], rax
jmp 0x14000e3c0
mov rax, qword [0x140046a38]
mov rax, qword [rax + 8]
mov qword [0x140046a38], rax
cmp qword [0x140046a38], 0
je 0x14000e40d
cmp qword [0x140046a38], 0
je 0x14000e40b
mov rax, qword [0x140046a38]
cmp qword [rax + 0x10], 0
je 0x14000e40b
mov rax, qword [0x140046a38]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x14000e40b
mov rax, qword [0x140046a38]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x14000e40b
jmp 0x14000e33c
jmp 0x14000e3ae
mov rax, qword [rsp + 0x60]
and rax, 0xffff
mov eax, eax
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.14000e520
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x14000e513
mov rax, qword [rsp + 0x48]
mov qword [0x140046a38], rax
mov rax, qword [0x140046a38]
mov dword [rax], 0x52727464
mov rax, qword [0x140046a38]
mov qword [rax + 0x10], 0
mov rax, qword [0x140046a38]
mov rcx, qword [0x140046a30]
mov qword [rax + 8], rcx
mov rax, qword [0x140046a38]
mov qword [0x140046a30], rax
mov qword [rsp + 0x40], 0
mov rax, qword [0x140046a38]
add rax, 0x60
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2a8
jmp 0x14000e4c4
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
jle 0x14000e4fe
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov qword [rcx + rax + 0x48], rdx
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x14000e4ba
mov rax, qword [0x140046a38]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
jmp 0x14000e33c
xor eax, eax
add rsp, 0x58
ret
Function at 0x14000f230
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov r8d, 0x30
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x80]
call sub.KERNEL32.dll_VirtualQuery
nop
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14000f277
xor al, al
jmp 0x14000f319
mov rax, qword [rsp + 0x28]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x14000f2a1
xor al, al
jmp 0x14000f319
mov eax, 8
imul rax, rax, 0xc
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
cmp qword [rsp + 0x88], rax
jb 0x14000f311
mov eax, 8
imul rax, rax, 0xc
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov ecx, 8
imul rcx, rcx, 0xc
mov rdx, qword [rsp + 0x30]
mov ecx, dword [rdx + rcx + 0x8c]
add rax, rcx
cmp qword [rsp + 0x88], rax
jae 0x14000f311
mov al, 1
jmp 0x14000f319
jmp 0x14000f317
xor al, al
add rsp, 0x78
ret

Function at 0x14000f620
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x38
mov rax, qword [0x140046a30]
mov qword [rsp + 0x28], rax
jmp 0x14000f640
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 8]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x14000f66f
lea r9, [rsp + 0x20]
mov r8d, 0x40
mov edx, 0x10000
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x14000f66d
call sub.KERNEL32.dll_GetLastError
jmp 0x14000f671
jmp 0x14000f632
xor eax, eax
add rsp, 0x38
ret
Function at 0x14000ff10
Capabilities:
Resume thread

Disassembly:
sub rsp, 0x68
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x140046a48], eax
je 0x14000ff2b
mov eax, 0x10dd
jmp 0x140010050
mov rax, qword [0x140046a60]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x14000ffd5
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x20]
movzx eax, byte [rax + 0x3e]
lea r9, [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov r8d, dword [rcx + 0x28]
mov edx, eax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x18]
call sub.KERNEL32.dll_VirtualProtect
mov rax, qword [rsp + 0x28]
cmp dword [rax + 8], 0
jne 0x14000ffa0
mov rax, qword [rsp + 0x28]
cmp qword [rax + 0x20], 0
je 0x14000ffa0
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x20]
call fcn.14000e980
mov rax, qword [rsp + 0x28]
mov qword [rax + 0x20], 0
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov edx, 0x30
mov rcx, qword [rsp + 0x38]
call fcn.14000cf10
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
jmp 0x14000ff37
mov qword [0x140046a60], 0
call fcn.14000f3e0
mov rax, qword [0x140046a58]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x140010039
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call sub.KERNEL32.dll_ResumeThread
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov edx, 0x10
mov rcx, qword [rsp + 0x48]
call fcn.14000cf10
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
jmp 0x14000fff1
mov qword [0x140046a58], 0
mov dword [0x140046a48], 0
xor eax, eax
add rsp, 0x68
ret
Function at 0x140010580
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp dword [0x140046a4c], 0
je 0x14001059d
mov eax, dword [0x140046a4c]
jmp 0x140010663
call sub.KERNEL32.dll_GetCurrentThread
cmp qword [rsp + 0x50], rax
jne 0x1400105b0
xor eax, eax
jmp 0x140010663
mov ecx, 0x10
call fcn.14000cf18
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x14001061e
mov dword [rsp + 0x20], 8
cmp qword [rsp + 0x28], 0
je 0x140010603
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov edx, 0x10
mov rcx, qword [rsp + 0x38]
call fcn.14000cf10
mov qword [rsp + 0x28], 0
mov eax, dword [rsp + 0x20]
mov dword [0x140046a4c], eax
mov qword [0x140046a50], 0
mov eax, dword [rsp + 0x20]
jmp 0x140010663
mov rcx, qword [rsp + 0x50]
call sub.KERNEL32.dll_SuspendThread
cmp eax, 0xffffffff
jne 0x140010638
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
jmp 0x1400105d9
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x28]
mov rcx, qword [0x140046a58]
mov qword [rax], rcx
mov rax, qword [rsp + 0x28]
mov qword [0x140046a58], rax
xor eax, eax
add rsp, 0x48
ret
Function at 0x140010750
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x80], 0
jne 0x14001077d
xor ecx, ecx
call sub.KERNEL32.dll_GetModuleHandleW
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14001079d
mov ecx, 0xc1
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x140010916
mov rax, qword [rsp + 0x40]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp dword [rax], 0x4550
je 0x1400107d4
mov ecx, 0xbf
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x140010916
mov rax, qword [rsp + 0x38]
movzx eax, word [rax + 0x14]
test eax, eax
jne 0x1400107f2
mov ecx, 0xc0
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x140010916
mov rax, qword [rsp + 0x38]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x38]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x20], 0
jmp 0x14001081e
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x38]
movzx eax, word [rax + 6]
cmp dword [rsp + 0x20], eax
jae 0x1400108fa
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
lea rdx, str..detour
mov rcx, rax
call fcn.14001ff80
test eax, eax
jne 0x1400108f5
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x48]
cmp dword [rcx + rax + 0xc], 0
je 0x140010883
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x48]
cmp dword [rcx + rax + 0x10], 0
jne 0x140010885
jmp 0x1400108fa
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x48]
mov eax, dword [rcx + rax + 0xc]
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax]
cmp rax, 0x40
jb 0x1400108cb
mov rax, qword [rsp + 0x28]
cmp dword [rax + 4], 0x727444
je 0x1400108cd
jmp 0x1400108fa
mov rax, qword [rsp + 0x28]
cmp dword [rax + 8], 0
jne 0x1400108e7
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x28]
mov ecx, dword [rcx]
mov dword [rax + 8], ecx
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x28]
jmp 0x140010916
jmp 0x140010814
mov ecx, 0xc0
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x140010916
add rsp, 0x78
ret
Function at 0x140010920
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov rax, qword [rsp + 0x90]
add rax, 0x10000
mov qword [rsp + 0x30], rax
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x48]
call fcn.140013e70
jmp 0x140010968
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov r8d, 0x30
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
ja 0x140010987
jmp 0x140010a2b
cmp dword [rsp + 0x68], 0x1000
jne 0x1400109ac
mov eax, dword [rsp + 0x6c]
and eax, 0xff
cmp eax, 1
je 0x1400109ac
mov eax, dword [rsp + 0x6c]
and eax, 0x100
test eax, eax
je 0x1400109ae
jmp 0x140010953
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
jne 0x1400109e4
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x3c]
cmp rax, qword [rsp + 0x60]
ja 0x1400109e4
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x3c]
cmp rax, 0x40
jae 0x1400109e9
jmp 0x140010953
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp dword [rax], 0x4550
jne 0x140010953
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x20]
jmp 0x140010a2d
xor eax, eax
add rsp, 0x88
ret

Function at 0x140010c80
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.140013e70
nop
mov r8d, 0x30
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x80]
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
ja 0x140010cca
mov ecx, 0xc1
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x140010d92
cmp dword [rsp + 0x60], 0x1000
jne 0x140010cef
mov eax, dword [rsp + 0x64]
and eax, 0xff
cmp eax, 1
je 0x140010cef
mov eax, dword [rsp + 0x64]
and eax, 0x100
test eax, eax
je 0x140010d00
mov ecx, 0xc1
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x140010d92
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140010d27
mov ecx, 0xc1
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x140010d92
mov rax, qword [rsp + 0x28]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x140010d5b
mov ecx, 0xbf
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x140010d92
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x14]
test eax, eax
jne 0x140010d76
mov ecx, 0xc0
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x140010d92
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x28]
jmp 0x140010d92
add rsp, 0x78
ret

Function at 0x14001e00c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14001de38
Function at 0x7fffe43c7096
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x138
mov rsi, rdx
mov rdi, rcx
xor ebp, ebp
lea rbx, [rsp + 0x30]
mov r8d, 0x100
mov rcx, rbx
xor edx, edx
call fcn.7fffe43c6fee
lea rcx, [rsp + 0x2f]
mov byte [rcx], bpl
lea rdx, [rsp + 0x2e]
mov byte [rdx], bpl
mov r8, rbx
call fcn.7fffe43cd847
test rsi, rsi
je 0x7fffe43c7124
neg rsi
mov eax, 1
xor ecx, ecx

Function at 0x7fffe43c717d
Capabilities:
Access peb ldr_data

Disassembly:
push rsi
push rdi
push rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rdx, qword [rax + 0x20]
add rax, 0x20
cmp rdx, rax
je 0x7fffe43c71e8
mov r8, qword [rdx + 0x50]
xor r9d, r9d
movzx r11d, word [rcx + r9]
movzx r10d, word [r8 + r9]
test r11w, r11w
je 0x7fffe43c71dd
lea esi, [r11 - 0x41]
lea edi, [r11 + 0x20]
cmp si, 0x1a
cmovae edi, r11d
lea r11d, [r10 - 0x41]
lea esi, [r10 + 0x20]
cmp r11w, 0x1a
cmovae esi, r10d
add r9, 2
cmp di, si
je 0x7fffe43c71a1
jmp 0x7fffe43c71e3
test r10w, r10w
je 0x7fffe43c71f1
mov rdx, qword [rdx]
jmp 0x7fffe43c7195
xor eax, eax
add rsp, 8
pop rdi
pop rsi
ret
mov qword [rsp], 0
lea rax, [0x7fffe43c7200]
mov qword [rsp], rax
mov r8, qword [rdx + 0x20]
mov rcx, qword [rsp]
xor eax, eax
cmp r8, rcx
jae 0x7fffe43c71ea
mov edx, dword [rdx + 0x30]
add rdx, r8
xor eax, eax
cmp rcx, rdx
setb al
jmp 0x7fffe43c71ea

Function at 0x7fffe43c7260
Capabilities:
Access peb ldr_data

Disassembly:
push rsi
push rdi
push rbx
mov rax, qword gs:[0x60]
mov r8, qword [rax + 0x18]
mov rdx, qword [r8 + 0x20]
add r8, 0x20
xor eax, eax
cmp rdx, r8
je 0x7fffe43c72cc
mov r9, qword [rdx + 0x50]
xor r10d, r10d
movzx esi, word [rcx + r10]
movzx r11d, word [r9 + r10]
test si, si
je 0x7fffe43c72bd
lea edi, [rsi - 0x41]
lea ebx, [rsi + 0x20]
cmp di, 0x1a
cmovae ebx, esi
lea esi, [r11 - 0x41]
lea edi, [r11 + 0x20]
cmp si, 0x1a
cmovae edi, r11d
add r10, 2
cmp bx, di
je 0x7fffe43c7286
jmp 0x7fffe43c72c3
test r11w, r11w
je 0x7fffe43c72c8
mov rdx, qword [rdx]
jmp 0x7fffe43c727a
mov rax, qword [rdx + 0x20]
pop rbx
pop rdi
pop rsi
ret
Function at 0x7fffe43c72d1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x4b8
mov rbx, rcx
movsxd r10, dword [rcx + 0x3c]
mov eax, dword [rcx + r10 + 0x88]
mov ecx, dword [rcx + rax + 0x18]
test rcx, rcx
je 0x7fffe43c7380
mov r8d, dword [rbx + rax + 0x1c]
add r8, rbx
mov r9d, dword [rbx + rax + 0x24]
add r9, rbx
mov r11d, dword [rbx + rax + 0x20]
add r11, rbx
mov r10d, dword [rbx + r10 + 0x8c]
add r10d, eax
xor r15d, r15d
mov r12d, dword [r11 + r15*4]
add r12, rbx
xor r13d, r13d
mov sil, byte [rdx + r13]
mov bpl, byte [r12 + r13]
test sil, sil
je 0x7fffe43c7373
lea edi, [rsi - 0x41]
lea r14d, [rsi + 0x20]
cmp dil, 0x1a
movzx esi, sil
movzx edi, r14b
cmovae edi, esi
lea esi, [rbp - 0x41]
lea r14d, [rbp + 0x20]
cmp sil, 0x1a
movzx esi, bpl
movzx ebp, r14b
cmovae ebp, esi
inc r13
cmp dil, bpl
je 0x7fffe43c7330
jmp 0x7fffe43c7378
test bpl, bpl
je 0x7fffe43c7399
inc r15
cmp r15, rcx
jb 0x7fffe43c7326
xor esi, esi
mov rax, rsi
add rsp, 0x4b8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movzx ecx, word [r9 + r15*2]
mov r15d, dword [r8 + rcx*4]
lea rsi, [rbx + r15]
cmp r15d, eax
jb 0x7fffe43c7382
cmp r15d, r10d
ja 0x7fffe43c7382
xor r12d, r12d
lea rcx, [rsp + 0x90]
add byte [rax], al
add byte [rcx - 0x48], al
add al, 1
add byte [rax], al
xor edx, edx
call fcn.7fffe43c6fee
lea rcx, [rsp + 0x1a0]
mov r8d, 0x104
xor edx, edx
call fcn.7fffe43c6fee
lea rcx, [rsp + 0x2b0]
invalid
invalid
invalid
Function at 0x7fffe43d0260
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x7fffe43d0288
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x7fffe43d0288
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x4157e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41596b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00433040
xorps xmm15, xmm15
mov r14, qword [0x005fc978]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x415845
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x415854
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x415873
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x415883
cmp rbx, 0x1000
jae 0x41584b
jmp 0x4158ed
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x415895
xor edx, edx
jmp 0x4158e4
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00433040
xorps xmm15, xmm15
mov r14, qword [0x005fc978]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x415879
jmp 0x415868
call fcn.00465640
xorps xmm15, xmm15
mov r14, qword [0x005fc978]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.004376a0
lea rax, [0x004ea5eb]
mov ebx, 0x18
nop dword [rax]
call fcn.00437f20
mov rax, qword [rsp + 0x38]
call fcn.00437c60
lea rax, [0x004eaaea]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00437f20
mov rax, qword [rsp + 0x30]
call fcn.00437c60
call fcn.004378e0
call fcn.00437700
lea rax, [0x004ecc24]
mov ebx, 0x21
call fcn.00435d00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00461f40
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004157e0
Function at 0x4159a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x415bc6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.004330c0
xorps xmm15, xmm15
mov r14, qword [0x005fc978]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x415a13
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x415a22
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x415a45
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x415a55
cmp rbx, 0x1000
jae 0x415a19
nop
jmp 0x415ad8
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x415a6d
xor esi, esi
jmp 0x415aca
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.004330c0
xorps xmm15, xmm15
mov r14, qword [0x005fc978]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x415a4b
jmp 0x415a36
call fcn.00465640
xorps xmm15, xmm15
mov r14, qword [0x005fc978]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x415b60
nop dword [rax + rax]
call fcn.004376a0
lea rax, [0x004eab03]
mov ebx, 0x19
call fcn.00437f20
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.00437c60
lea rax, [0x004eaaea]
mov ebx, 0x19
call fcn.00437f20
mov eax, dword [rsp + 0x34]
call fcn.00437c60
nop
call fcn.004378e0
call fcn.00437700
lea rax, [0x004e73de]
mov ebx, 0xd
call fcn.00435d00
nop dword [rax + rax]
cmp eax, 0x5af
je 0x415b00
call fcn.004376a0
lea rax, [0x004eab03]
mov ebx, 0x19
call fcn.00437f20
mov rax, qword [rsp + 0x38]
call fcn.00437c60
lea rax, [0x004eaaea]
mov ebx, 0x19
call fcn.00437f20
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.00437c60
call fcn.004378e0
call fcn.00437700
lea rax, [0x004ec4a2]
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.00435d00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00461f40
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.004159a0