joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140047a10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
movss xmm2, dword [rcx + 0x4c]
mov rbx, rcx
movss xmm0, dword [rcx + 0x48]
ucomiss xmm0, xmm2
mov r9, qword [rdx]
mov qword [rcx + 0x1c], r9
jp 0x140047a93
jne 0x140047a93
mov edx, dword [rcx + 0x18]
mov rax, r9
mov r8d, dword [rcx + 0x14]
shr rax, 0x20
add eax, edx
movd xmm1, edx
cvtdq2ps xmm1, xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
mulss xmm1, xmm2
mulss xmm0, xmm2
cvttss2si eax, xmm1
cvttss2si ecx, xmm0
movd xmm1, r8d
sub ecx, eax
mov eax, ecx
lea ecx, [r8 + r9]
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
shl rax, 0x20
cvtdq2ps xmm1, xmm1
mulss xmm0, xmm2
mulss xmm1, xmm2
cvttss2si edx, xmm0
cvttss2si ecx, xmm1
sub edx, ecx
mov ecx, edx
or rax, rcx
jmp 0x140047aca
xorps xmm0, xmm0
mov ecx, r9d
mov rax, r9
shr rax, 0x20
cvtsi2ss xmm0, rax
mulss xmm0, xmm2
cvttss2si rax, xmm0
xorps xmm0, xmm0
mov eax, eax
cvtsi2ss xmm0, rcx
shl rax, 0x20
mulss xmm0, xmm2
cvttss2si rdx, xmm0
mov edx, edx
or rax, rdx
mov r9, qword [rbx + 0x40]
movsxd r8, dword [0x1400a05c4]
mov rcx, qword [r9 + 0x10]
movzx edx, word [rcx + r8*2]
mov qword [rdx + r9 + 0x20], rax
mov r9d, 0x80
mov rdx, qword [rbx + 0x40]
mov rcx, qword [rbx + 0x28]
call fcn.14004c550
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x1400480f0
push rbx
sub rsp, 0x70
mov rax, qword [0x140098020]
xor rax, rsp
mov qword [rsp + 0x68], rax
cmp qword [rcx + 8], 0
mov rbx, rcx
je 0x140048205
test dword [rcx + 0x10], 0xf0000
je 0x140048205
mov eax, dword [rcx + 0x1c]
lea r8, [rsp + 0x28]
mov dword [rsp + 0x28], eax
lea rdx, [rcx + 0x14]
mov eax, dword [rcx + 0x20]
mov dword [rsp + 0x2c], eax
call fcn.140048220
mov r9d, 1
lea rdx, [rbx + 0x14]
mov rcx, rbx
xorps xmm2, xmm2
call fcn.140047b10
movzx eax, byte [rsp + 0x20]
lea r9, [0x140048440]
mov rdx, qword [rbx + 0x40]
movsxd r10, dword [0x1400a05c4]
mov byte [rsp + 0x28], al
movups xmm0, xmmword [rsp + 0x28]
mov qword [rsp + 0x60], r9
movups xmmword [rsp + 0x38], xmm0
movups xmm1, xmmword [rsp + 0x38]
movups xmmword [rsp + 0x48], xmm1
movsd xmm0, qword [rsp + 0x48]
movsd qword [rsp + 0x58], xmm0
mov rax, qword [rdx + 0x10]
movzx ecx, word [rax + r10*2]
mov rax, qword [rcx + rdx + 0x80]
mov rax, qword [rax + 0x38]
test rax, rax
je 0x140048205
mov qword [rsp + 0x88], rdi
xor edi, edi
nop word [rax + rax]
lea rbx, [rax + 0x20]
movsxd rcx, r10d
test rbx, rbx
cmove rax, rdi
mov r8, qword [rax + 0x10]
mov rax, qword [r8 + 0x10]
movzx edx, word [rax + rcx*2]
lea rcx, [rsp + 0x38]
mov rdx, qword [rdx + r8 + 0x10]
call r9
mov rax, qword [rbx]
test rax, rax
je 0x1400481fd
mov r9, qword [rsp + 0x60]
mov r10d, dword [0x1400a05c4]
jmp 0x1400481c0
mov rdi, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140055f70
add rsp, 0x70
pop rbx
ret
Function at 0x140047ee0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rdx + 0x10]
mov rbx, rdx
movss xmm1, dword [0x140083c7c]
mov r11, rcx
movss xmm2, dword [rax]
mov rax, qword [rdx + 0x20]
mov qword [rcx + 8], rax
mov eax, dword [rdx + 0x2c]
mov dword [rcx + 0x10], eax
mov rax, qword [rdx + 0x30]
mov qword [rcx + 0x14], rax
mov rax, qword [rdx + 0x3c]
mov qword [rcx + 0x1c], rax
mov rax, qword [rdx]
mov qword [rcx + 0x28], rax
mov rax, qword [rdx + 8]
mov qword [rcx + 0x30], rax
mov rax, qword [rdx + 0x10]
mov qword [rcx + 0x38], rax
mov rdx, qword [rdx + 0x18]
mov qword [rcx + 0x40], rdx
test byte [rbx + 0x2c], 0x40
je 0x140047f4d
movaps xmm0, xmm1
jmp 0x140047f50
movaps xmm0, xmm2
movss dword [rcx + 0x48], xmm0
test byte [rbx + 0x2c], 0x80
jne 0x140047f5e
movaps xmm1, xmm2
movss dword [rcx + 0x4c], xmm1
mov rax, qword [rdx + 0x10]
movsxd rcx, dword [0x1400a05c4]
movzx edi, word [rax + rcx*2]
mov rax, qword [rbx + 0x20]
add rdi, rdx
test rax, rax
je 0x140047faf
mov rax, qword [rax + 0x40]
mov qword [rdi], rax
test dword [rbx + 0x2c], 0xf0000
je 0x140047faf
mov eax, dword [r11 + 0x1c]
lea r8, [rsp + 0x30]
mov dword [rsp + 0x30], eax
lea rdx, [r11 + 0x14]
mov eax, dword [r11 + 0x20]
mov rcx, r11
mov dword [rsp + 0x34], eax
call fcn.140048220
mov qword [rdi + 0x10], r11
mov eax, dword [rbx + 0x28]
mov dword [rdi + 8], eax
movd xmm0, dword [r11 + 0x14]
cvtdq2ps xmm0, xmm0
mulss xmm0, dword [r11 + 0x48]
cvttss2si eax, xmm0
movd xmm0, dword [r11 + 0x18]
mov dword [rsp + 0x30], eax
cvtdq2ps xmm0, xmm0
mulss xmm0, dword [r11 + 0x48]
cvttss2si eax, xmm0
mov dword [rsp + 0x34], eax
mov rax, qword [rsp + 0x30]
mov qword [rdi + 0x18], rax
mov eax, dword [rbx + 0x38]
mov dword [rdi + 0x28], eax
movss xmm2, dword [r11 + 0x4c]
movss xmm0, dword [r11 + 0x48]
ucomiss xmm0, xmm2
jp 0x14004806c
jne 0x14004806c
mov edx, dword [r11 + 0x18]
mov ecx, dword [r11 + 0x20]
mov r8d, dword [r11 + 0x14]
add ecx, edx
movd xmm1, edx
mov edx, dword [r11 + 0x1c]
movd xmm0, ecx
add edx, r8d
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
mulss xmm0, xmm2
mulss xmm1, xmm2
cvttss2si ecx, xmm0
cvttss2si eax, xmm1
movd xmm0, edx
sub ecx, eax
movd xmm1, r8d
mov eax, ecx
cvtdq2ps xmm0, xmm0
shl rax, 0x20
cvtdq2ps xmm1, xmm1
mulss xmm0, xmm2
mulss xmm1, xmm2
cvttss2si edx, xmm0
cvttss2si ecx, xmm1
sub edx, ecx
mov ecx, edx
or rax, rcx
jmp 0x1400480a1
mov eax, dword [r11 + 0x20]
xorps xmm0, xmm0
mov ecx, dword [r11 + 0x1c]
cvtsi2ss xmm0, rax
mulss xmm0, xmm2
cvttss2si rax, xmm0
xorps xmm0, xmm0
mov eax, eax
cvtsi2ss xmm0, rcx
shl rax, 0x20
mulss xmm0, xmm2
cvttss2si rdx, xmm0
mov edx, edx
or rax, rdx
mov qword [rdi + 0x20], rax
mov qword [rdi + 0x70], r11
mov eax, dword [rbx + 0x2c]
test al, 1
je 0x1400480b7
mov byte [rdi + 0x2d], 1
mov eax, dword [rbx + 0x2c]
test al, 4
je 0x1400480c2
mov byte [rdi + 0x2e], 1
mov eax, dword [rbx + 0x2c]
test al, 8
je 0x1400480ca
mov byte [rdi + 0x2f], 1
mov rdx, qword [r11 + 0x40]
mov rcx, qword [r11 + 0x28]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.14004c180
Function at 0x140049dd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rdx]
mov rbx, rcx
cmp byte [rax], 2
je 0x140049de9
xor al, al
add rsp, 0x20
pop rbx
ret
cmp byte [rax + 2], 0
mov qword [rsp + 0x30], rbp
jne 0x140049ebb
cmp byte [rax + 3], 0
je 0x140049e17
mov bpl, 1
mov byte [rcx + 0x91], 1
movzx eax, bpl
mov rbp, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
cmp byte [rcx + 0x91], 0
je 0x140049ebb
movzx edx, byte [rcx + 0x90]
mov r8b, 1
xor dl, 1
mov qword [rsp + 0x40], rsi
mov byte [rcx + 0x91], 0
call fcn.140049d30
movzx eax, byte [rbx + 0x90]
lea rsi, [rbx + 0x68]
inc dword [rsi]
xor bpl, bpl
mov rbx, qword [rsi + 8]
mov byte [rsp + 0x38], al
test rbx, rbx
je 0x140049e9d
mov qword [rsp + 0x48], rdi
mov rdi, qword [rsi + 0x10]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140049e8b
mov rax, qword [rcx]
lea rdx, [rsp + 0x38]
mov r8, qword [rbx + 0x18]
call qword [rax]
test al, al
jne 0x140049e95
cmp rbx, rdi
je 0x140049e98
mov rbx, qword [rbx]
jmp 0x140049e70
mov bpl, 1
mov rdi, qword [rsp + 0x48]
dec dword [rsi]
mov rcx, rsi
call fcn.140001b00
mov rsi, qword [rsp + 0x40]
movzx eax, bpl
mov rbp, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
xor bpl, bpl
movzx eax, bpl
mov rbp, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret

Function at 0x140049f40
Capabilities:
Get keyboard layout
Log keystrokes via polling
Register raw input devices

Disassembly:
push rdi
sub rsp, 0x20
cmp byte [rdx], 0
mov rdi, rcx
je 0x140049fc8
mov rax, qword [rcx + 0x28]
mov edx, 1
add rcx, 0x48
mov r8, qword [rax + 0x70]
mov eax, 6
mov word [rcx], dx
mov qword [rdi + 0x50], r8
mov qword [rdi + 0x60], r8
lea edx, [rax - 4]
mov word [rdi + 0x4a], ax
lea r8d, [rax + 0xa]
mov dword [rdi + 0x4c], 0x100
mov dword [rdi + 0x58], 0x20001
mov dword [rdi + 0x5c], 0x100
call qword [sym.imp.USER32.dll_RegisterRawInputDevices]
cmp eax, 1
je 0x140049fc4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x17f
lea rdx, str.engine::input::WindowDriver::_InitializeRawInput
mov r9d, eax
lea rcx, str.FAIL:__s:_u_CODE:_x
call fcn.140042f10
xor al, al
add rsp, 0x20
pop rdi
ret
mov byte [rdi + 0x41], 1
mov qword [rsp + 0x30], rbx
xor ecx, ecx
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], r14
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov ebx, 0x20
mov ebp, 0x600
mov rsi, rax
mov r14d, 0xff
nop word [rax + rax]
mov rdx, rsi
movzx ecx, bx
call qword [sym.imp.USER32.dll_VkKeyScanExW]
cmp ax, 0xffff
je 0x14004a01e
and ax, bp
cmp ax, bp
jne 0x14004a01e
mov byte [rdi + 0x68], 1
inc bx
cmp bx, r14w
jbe 0x14004a000
mov r14, qword [rsp + 0x48]
mov al, 1
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov byte [rdi + 0x30], 1
add rsp, 0x20
pop rdi
ret
Function at 0x14004a7f0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x140098020]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov eax, 0xe0
movzx r15d, r9b
movzx r14d, r8b
mov rsi, rcx
cmp dx, ax
jae 0x14004a986
movzx eax, dx
lea rcx, str.________34___1_____F_______0____2DECBGIHJ_____A_
movzx edi, byte [rax + rcx]
cmp dil, 0x5b
je 0x14004a986
xor ebp, ebp
lea ecx, [rbp + 0x12]
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 7
test al, 1
je 0x14004a86f
cmp byte [rsi + 0x68], bpl
je 0x14004a86a
mov ecx, 0xa5
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 7
test al, 1
jne 0x14004a986
mov ebp, 2
mov ecx, 0x11
mov qword [rsp + 0x48], rbx
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 7
mov ebx, ebp
or ebx, 1
mov ecx, 0x10
and al, 1
cmove ebx, ebp
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 7
mov ecx, ebx
or ecx, 4
and al, 1
cmove ecx, ebx
cmp ecx, 1
jne 0x14004a905
cmp dil, 0x15
je 0x14004a910
inc dword [rsi + 8]
xor bpl, bpl
mov rbx, qword [rsi + 0x10]
mov byte [rsp + 0x28], 0
mov byte [rsp + 0x29], r15b
mov dword [rsp + 0x2c], ecx
mov byte [rsp + 0x30], dil
mov byte [rsp + 0x31], r14b
test rbx, rbx
je 0x14004a958
mov rdi, qword [rsi + 0x18]
nop
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14004a8fb
mov rax, qword [rcx]
lea rdx, [rsp + 0x28]
mov r8, qword [rbx + 0x18]
call qword [rax]
test al, al
jne 0x14004a955
cmp rbx, rdi
je 0x14004a958
mov rbx, qword [rbx]
jmp 0x14004a8e0
cmp ecx, 4
jne 0x14004a8af
cmp dil, 0x40
jne 0x14004a8af
inc dword [rsi + 8]
xor bpl, bpl
mov rbx, qword [rsi + 0x10]
mov word [rsp + 0x20], 6
mov byte [rsp + 0x22], 0
test rbx, rbx
je 0x14004a958
mov rdi, qword [rsi + 0x18]
nop
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14004a94b
mov rax, qword [rcx]
lea rdx, [rsp + 0x20]
mov r8, qword [rbx + 0x18]
call qword [rax]
test al, al
jne 0x14004a955
cmp rbx, rdi
je 0x14004a958
mov rbx, qword [rbx]
jmp 0x14004a930
mov bpl, 1
dec dword [rsi + 8]
lea rcx, [rsi + 8]
call fcn.140001b00
mov rbx, qword [rsp + 0x48]
movzx eax, bpl
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140055f70
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
xor al, al
jmp 0x14004a96d
Function at 0x140051da0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x178
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x26
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x198]
lea rcx, [0x1400dd014]
call fcn.1400567b0
mov rax, qword [rbp + 0x178]
sub rax, 0x10000
mov rcx, rax
call fcn.140052040
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x170]
cmp qword [rbp + 8], rax
jbe 0x140051ec7
mov rax, qword [section..data]
cmp qword [rbp + 8], rax
jb 0x140051e31
mov rax, qword [0x140098008]
cmp qword [rbp + 8], rax
ja 0x140051e31
mov rax, qword [rbp + 8]
sub rax, 0x8000000
mov qword [rbp + 8], rax
jmp 0x140051df6
mov r8d, 0x30
xor edx, edx
lea rcx, [rbp + 0x28]
call fcn.140058320
mov r8d, 0x30
lea rdx, [rbp + 0x28]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x140051e5d
jmp 0x140051ec7
cmp dword [rbp + 0x48], 0x10000
jne 0x140051eac
cmp qword [rbp + 0x40], 0x10000
jb 0x140051eac
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0x78], rax
cmp qword [rbp + 0x78], 0
je 0x140051e9c
mov rax, qword [rbp + 0x78]
jmp 0x140051ec9
mov rax, qword [rbp + 8]
sub rax, 0x10000
mov qword [rbp + 8], rax
jmp 0x140051ec2
mov rax, qword [rbp + 0x30]
sub rax, 0x10000
mov rcx, rax
call fcn.140052040
mov qword [rbp + 8], rax
jmp 0x140051df6
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, reloc.d2d1.dll_Ordinal_1
call fcn.14005673c
mov rax, rdi
lea rsp, [rbp + 0x158]
pop rdi
pop rbp
ret
Function at 0x140051ef0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x178
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x26
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x198]
lea rcx, [0x1400dd014]
call fcn.1400567b0
mov rcx, qword [rbp + 0x170]
call fcn.1400520a0
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x178]
cmp qword [rbp + 8], rax
jae 0x140052012
mov rax, qword [section..data]
cmp qword [rbp + 8], rax
jb 0x140051f78
mov rax, qword [0x140098008]
cmp qword [rbp + 8], rax
ja 0x140051f78
mov rax, qword [rbp + 8]
add rax, 0x8000000
mov qword [rbp + 8], rax
jmp 0x140051f3d
mov r8d, 0x30
xor edx, edx
lea rcx, [rbp + 0x28]
call fcn.140058320
mov r8d, 0x30
lea rdx, [rbp + 0x28]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x140051fa4
jmp 0x140052012
cmp dword [rbp + 0x48], 0x10000
jne 0x140051ff3
cmp qword [rbp + 0x40], 0x10000
jb 0x140051ff3
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0x78], rax
cmp qword [rbp + 0x78], 0
je 0x140051fe3
mov rax, qword [rbp + 0x78]
jmp 0x140052014
mov rax, qword [rbp + 8]
add rax, 0x10000
mov qword [rbp + 8], rax
jmp 0x14005200d
mov rax, qword [rbp + 0x40]
mov rcx, qword [rbp + 0x28]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.1400520a0
mov qword [rbp + 8], rax
jmp 0x140051f3d
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, reloc.d2d1.dll_Ordinal_1
call fcn.14005673c
mov rax, rdi
lea rsp, [rbp + 0x158]
pop rdi
pop rbp
ret
Function at 0x1400532a0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x36
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1d8]
lea rcx, [0x1400dd014]
call fcn.1400567b0
mov r8d, 0x30
lea rdx, [rbp + 8]
mov rcx, qword [rbp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
nop
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x58], rax
mov rax, qword [rbp + 0x58]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140053312
xor al, al
jmp 0x1400533a9
mov rax, qword [rbp + 0x58]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rbp + 0x58]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x78], rax
mov rax, qword [rbp + 0x78]
cmp dword [rax], 0x4550
je 0x140053338
xor al, al
jmp 0x1400533a9
mov eax, 8
imul rax, rax, 0xc
mov rcx, qword [rbp + 0x78]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rbp + 0x58]
add rcx, rax
mov rax, rcx
cmp qword [rbp + 0x1b8], rax
jb 0x1400533a1
mov eax, 8
imul rax, rax, 0xc
mov rcx, qword [rbp + 0x78]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rbp + 0x58]
add rcx, rax
mov rax, rcx
mov ecx, 8
imul rcx, rcx, 0xc
mov rdx, qword [rbp + 0x78]
mov ecx, dword [rdx + rcx + 0x8c]
add rax, rcx
cmp qword [rbp + 0x1b8], rax
jae 0x1400533a1
mov al, 1
jmp 0x1400533a9
jmp 0x1400533a7
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, reloc.d2d1.dll_Ordinal_1
call fcn.14005673c
mov rax, rdi
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret

Function at 0x1400533d0
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x20]
lea rcx, [0x1400dd014]
call fcn.1400567b0
mov rax, qword [rbp + 0x160]
cmp dword [rax], 0x52727464
je 0x140053405
xor eax, eax
jmp 0x140053494
mov rax, qword [rbp + 0x160]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
add rax, 0x10000
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x160]
add rax, 0x60
mov qword [rbp + 0x48], rax
mov dword [rbp + 0x64], 0
jmp 0x14005343e
mov eax, dword [rbp + 0x64]
inc eax
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0x2a9
jae 0x14005348f
movsxd rax, dword [rbp + 0x64]
imul rax, rax, 0x60
mov rcx, qword [rbp + 0x48]
cmp qword [rcx + rax + 0x48], 0
je 0x14005348d
movsxd rax, dword [rbp + 0x64]
imul rax, rax, 0x60
mov rcx, qword [rbp + 0x48]
mov rdx, qword [rbp + 8]
cmp qword [rcx + rax + 0x48], rdx
jb 0x140053489
movsxd rax, dword [rbp + 0x64]
imul rax, rax, 0x60
mov rcx, qword [rbp + 0x48]
mov rdx, qword [rbp + 0x28]
cmp qword [rcx + rax + 0x48], rdx
jb 0x14005348d
xor eax, eax
jmp 0x140053494
jmp 0x140053436
mov eax, 1
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret
Function at 0x140053750
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x12
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
lea rcx, [0x1400dd014]
call fcn.1400567b0
mov rax, qword [0x14009f180]
mov qword [rbp + 8], rax
jmp 0x140053795
mov rax, qword [rbp + 8]
mov rax, qword [rax + 8]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
je 0x1400537c3
lea r9, [rbp + 0x24]
mov r8d, 0x40
mov edx, 0x10000
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400537c1
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400537c5
jmp 0x140053789
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, reloc.d2d1.dll_Ordinal_1
call fcn.14005673c
mov rax, rdi
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x1400541a0
Capabilities:
Resume thread

Disassembly:
push rbp
push rdi
sub rsp, 0x1c8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x3a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
lea rcx, [0x1400dd014]
call fcn.1400567b0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x14009f198], eax
je 0x1400541e4
mov eax, 0x10dd
jmp 0x140054302
mov rax, qword [0x14009f1b0]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
je 0x140054284
mov rax, qword [rbp + 8]
mov rax, qword [rax + 0x20]
movzx eax, byte [rax + 0x3e]
lea r9, [rbp + 0x24]
mov rcx, qword [rbp + 8]
mov r8d, dword [rcx + 0x28]
mov edx, eax
mov rax, qword [rbp + 8]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, qword [rbp + 8]
cmp dword [rax + 8], 0
jne 0x140054250
mov rax, qword [rbp + 8]
cmp qword [rax + 0x20], 0
je 0x140054250
mov rax, qword [rbp + 8]
mov rcx, qword [rax + 0x20]
call fcn.140052870
mov rax, qword [rbp + 8]
mov qword [rax + 0x20], 0
mov rax, qword [rbp + 8]
mov rax, qword [rax]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x168], rax
mov edx, 0x30
mov rcx, qword [rbp + 0x168]
call fcn.140055f90
mov rax, qword [rbp + 0x48]
mov qword [rbp + 8], rax
jmp 0x1400541ef
mov qword [0x14009f1b0], 0
call fcn.1400534a0
mov rax, qword [0x14009f1a8]
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0
je 0x1400542eb
mov rax, qword [rbp + 0x68]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rax, qword [rbp + 0x68]
mov rax, qword [rax]
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 0x68]
mov qword [rbp + 0x188], rax
mov edx, 0x10
mov rcx, qword [rbp + 0x188]
call fcn.140055f90
mov rax, qword [rbp + 0x88]
mov qword [rbp + 0x68], rax
jmp 0x14005429f
mov qword [0x14009f1a8], 0
mov dword [0x14009f198], 0
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, reloc.d2d1.dll_Ordinal_1
call fcn.14005673c
mov rax, rdi
lea rsp, [rbp + 0x1a8]
pop rdi
pop rbp
ret
Function at 0x1400548b0
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x20]
lea rcx, [0x1400dd014]
call fcn.1400567b0
cmp dword [0x14009f19c], 0
je 0x1400548e3
mov eax, dword [0x14009f19c]
jmp 0x1400549ae
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp qword [rbp + 0x160], rax
jne 0x1400548f9
xor eax, eax
jmp 0x1400549ae
mov ecx, 0x10
call fcn.140055f98
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x140054967
mov dword [rbp + 4], 8
cmp qword [rbp + 0x28], 0
je 0x14005494e
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x128], rax
mov edx, 0x10
mov rcx, qword [rbp + 0x128]
call fcn.140055f90
mov qword [rbp + 0x28], 0
mov eax, dword [rbp + 4]
mov dword [0x14009f19c], eax
mov qword [0x14009f1a0], 0
mov eax, dword [rbp + 4]
jmp 0x1400549ae
mov rcx, qword [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x140054984
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 4], eax
jmp 0x140054923
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x160]
mov qword [rax + 8], rcx
mov rax, qword [rbp + 0x28]
mov rcx, qword [0x14009f1a8]
mov qword [rax], rcx
mov rax, qword [rbp + 0x28]
mov qword [0x14009f1a8], rax
xor eax, eax
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret
Function at 0x14005de1c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x14009fd60]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x14005de73
cmp word [rdx], r13w
jne 0x14005de73
or byte [rax + rdi*8 + 0x38], cl
jmp 0x14005de78
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x14005df9d
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x14005dfbe
lea r9, [rdx + 2]
cmp cx, r11w
je 0x14005deb1
mov rdx, r9
mov word [rbx], cx
jmp 0x14005ded8
cmp r9, r8
jae 0x14005dee8
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x14005de92
jmp 0x14005df9d
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14005df92
cmp dword [rsp + 0x80], esi
je 0x14005df92
lea r8, [0x14009fd60]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x14005df6a
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x14005df3a
mov word [rbx], r13w
jmp 0x14005df9a
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x14005df47
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x14005df9a
cmp word [rsp + 0x70], r13w
jne 0x14005df77
cmp rbx, r14
je 0x14005df34
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.14005da98
cmp word [rsp + 0x70], r13w
je 0x14005df9d
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x14009fd60]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x14005df97
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x14005df9d