joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401d2ef8
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x140424e10]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x14041c504]
test eax, eax
je 0x1401d2f43
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14041c504]
test eax, eax
jne 0x1401d2f4c
call fcn.14000878c
test eax, eax
je 0x1401d2f68
lea rdx, [rsp + 0x48]
mov rcx, qword [0x140412028]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x1401d2f70
xor eax, eax
jmp 0x1401d2fd5
test rbx, rbx
jne 0x1401d2f90
lea rcx, str.ChooseColorW
call fcn.14005049c
mov rbx, rax
test rax, rax
je 0x1401d2fa3
mov qword [0x140424e10], rax
mov rcx, rbx
call fcn.1402821c0
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x1401d2fb8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1401d2fba
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x1401d2fd3
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x1401fc2e0
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x1404253f8]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x14041c504]
test eax, eax
je 0x1401fc32b
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14041c504]
test eax, eax
jne 0x1401fc334
call fcn.14000878c
test eax, eax
je 0x1401fc350
lea rdx, [rsp + 0x48]
mov rcx, qword [0x140412028]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x1401fc358
xor eax, eax
jmp 0x1401fc3bd
test rbx, rbx
jne 0x1401fc378
lea rcx, str.ImageList_DrawIndirect
call fcn.14001e2bc
mov rbx, rax
test rax, rax
je 0x1401fc38b
mov qword [0x1404253f8], rax
mov rcx, rbx
call fcn.1402821c0
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x1401fc3a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1401fc3a2
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x1401fc3bb
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x1401fc3d4
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov qword [rax - 0x18], rdi
mov rbx, qword [0x140425400]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x14041c504]
test eax, eax
je 0x1401fc420
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14041c504]
test eax, eax
jne 0x1401fc429
call fcn.14000878c
test eax, eax
je 0x1401fc445
lea rdx, [rsp + 0x48]
mov rcx, qword [0x140412028]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x1401fc44d
xor eax, eax
jmp 0x1401fc4b6
test rbx, rbx
jne 0x1401fc46d
lea rcx, str.ImageList_Duplicate
call fcn.14001e2bc
mov rbx, rax
test rax, rax
je 0x1401fc482
mov qword [0x140425400], rax
mov rcx, rbx
call fcn.1402821c0
mov rcx, r14
call rbx
mov rdi, rax
mov qword [rsp + 0x20], rax
xor ebx, ebx
test rdi, rdi
sete bl
test ebx, ebx
je 0x1401fc498
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1401fc49a
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x1401fc4b3
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x140240b30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
jne 0x140240b5e
xor eax, eax
jmp 0x140240beb
test rbx, rbx
je 0x140240b57
test r9, r9
jne 0x140240b76
call fcn.140030a08
mov r9, qword [rax + 0x18]
test r9, r9
je 0x140240b57
mov r8, rbx
mov qword [rsi + 0x10], r9
mov rdx, rdi
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x140240b57
mov rcx, qword [rsi + 0x10]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r14d, eax
test eax, eax
je 0x140240b57
mov rcx, qword [rsi + 0x10]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbp, rax
test rax, rax
je 0x140240b57
mov rbx, qword [rsi]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rcx, qword [rbx + 8]
mov rdi, rax
call fcn.1402821c0
mov r8d, r14d
mov rdx, rdi
mov rcx, rsi
call qword [rbx + reloc.OLEAUT32.dll_VariantClear]
mov rcx, rbp
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140264bdc
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x1404260a0]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x14041c504]
test eax, eax
je 0x140264c27
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14041c504]
test eax, eax
jne 0x140264c30
call fcn.14000878c
test eax, eax
je 0x140264c4c
lea rdx, [rsp + 0x48]
mov rcx, qword [0x140412028]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x140264c54
xor eax, eax
jmp 0x140264cb9
test rbx, rbx
jne 0x140264c74
lea rcx, str.ChooseFontW
call fcn.14005049c
mov rbx, rax
test rax, rax
je 0x140264c87
mov qword [0x1404260a0], rax
mov rcx, rbx
call fcn.1402821c0
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x140264c9c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140264c9e
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x140264cb7
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x14027bd30
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov qword [rax - 0x18], rdi
mov rbx, qword [0x140426328]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x14041c504]
test eax, eax
je 0x14027bd7c
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14041c504]
test eax, eax
jne 0x14027bd85
call fcn.14000878c
test eax, eax
je 0x14027bda1
lea rdx, [rsp + 0x48]
mov rcx, qword [0x140412028]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x14027bda9
xor eax, eax
jmp 0x14027be12
test rbx, rbx
jne 0x14027bdc9
lea rcx, str.FindTextW
call fcn.14005049c
mov rbx, rax
test rax, rax
je 0x14027bdde
mov qword [0x140426328], rax
mov rcx, rbx
call fcn.1402821c0
mov rcx, r14
call rbx
mov rdi, rax
mov qword [rsp + 0x20], rax
xor ebx, ebx
test rdi, rdi
sete bl
test ebx, ebx
je 0x14027bdf4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14027bdf6
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14027be0f
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x14027be28
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov qword [rax - 0x18], rdi
mov rbx, qword [0x140426330]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x14041c504]
test eax, eax
je 0x14027be74
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14041c504]
test eax, eax
jne 0x14027be7d
call fcn.14000878c
test eax, eax
je 0x14027be99
lea rdx, [rsp + 0x48]
mov rcx, qword [0x140412028]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x14027bea1
xor eax, eax
jmp 0x14027bf0a
test rbx, rbx
jne 0x14027bec1
lea rcx, str.ReplaceTextW
call fcn.14005049c
mov rbx, rax
test rax, rax
je 0x14027bed6
mov qword [0x140426330], rax
mov rcx, rbx
call fcn.1402821c0
mov rcx, r14
call rbx
mov rdi, rax
mov qword [rsp + 0x20], rax
xor ebx, ebx
test rdi, rdi
sete bl
test ebx, ebx
je 0x14027beec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14027beee
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14027bf07
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x14027cff8
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x140426348]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x14041c504]
test eax, eax
je 0x14027d043
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14041c504]
test eax, eax
jne 0x14027d04c
call fcn.14000878c
test eax, eax
je 0x14027d068
lea rdx, [rsp + 0x48]
mov rcx, qword [0x140412028]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x14027d070
xor eax, eax
jmp 0x14027d0d5
test rbx, rbx
jne 0x14027d090
lea rcx, str.PageSetupDlgW
call fcn.14005049c
mov rbx, rax
test rax, rax
je 0x14027d0a3
mov qword [0x140426348], rax
mov rcx, rbx
call fcn.1402821c0
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x14027d0b8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14027d0ba
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14027d0d3
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x14027d0ec
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x140426340]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x14041c504]
test eax, eax
je 0x14027d137
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14041c504]
test eax, eax
jne 0x14027d140
call fcn.14000878c
test eax, eax
je 0x14027d15c
lea rdx, [rsp + 0x48]
mov rcx, qword [0x140412028]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x14027d164
xor eax, eax
jmp 0x14027d1c9
test rbx, rbx
jne 0x14027d184
lea rcx, str.PrintDlgW
call fcn.14005049c
mov rbx, rax
test rax, rax
je 0x14027d197
mov qword [0x140426340], rax
mov rcx, rbx
call fcn.1402821c0
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x14027d1ac
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14027d1ae
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14027d1c7
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x1402cbb18
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x1402cb907
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1402cb907
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1402cb907
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1402cb907
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1402cb907
cmp dword [rcx + 0x84], 0xe
jbe 0x1402cb907
cmp dword [rcx + 0xf8], 0
je 0x1402cb907
mov ecx, ebx
call fcn.1402cba38
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.1402cb694
cmp dword [rbp + 0x20], 0
je 0x1402cb954
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1402cb95c
int3
xor r8d, r8d
xor edx, edx
jmp 0x1402cb8a0
Function at 0x1402d96e4
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x1402d938a
call fcn.14029116c
mov dword [rax], reloc.OLEAUT32.dll_SafeArrayAccessData
call fcn.140290ae4
jmp 0x1402d94d5
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1402d94d5
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x1402d94d5
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x1402d93b9
lock or dword [rcx + 0x14], 0x10
jmp 0x1402d94d5
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x1402d93cd
call fcn.1402e65a8
mov esi, dword [rbx + 0x10]
cmp esi, 1
jne 0x1402d93dd
mov rax, qword [rbx]
mov bpl, byte [rax]
jmp 0x1402d93e0
xor bpl, bpl
mov rdi, qword [rbx + 8]
mov rcx, rbx
mov qword [rbx], rdi
call fcn.1402c8228
mov r8d, dword [rbx + 0x20]
mov ecx, eax
mov rdx, rdi
call fcn.1402d8c84
mov dword [rbx + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x1402d94c3
mov eax, dword [rbx + 0x14]
test al, 6
jne 0x1402d9471
mov rcx, rbx
call fcn.1402c8228
cmp eax, 0xffffffff
je 0x1402d945c
mov rcx, rbx
call fcn.1402c8228
cmp eax, 0xfffffffe
je 0x1402d945c
mov rcx, rbx
call fcn.1402c8228
movsxd rdi, eax
lea r14, [0x140427830]
mov rcx, rbx
sar rdi, 6
call fcn.1402c8228
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rdi*8]
lea rdx, [rax + rcx*8]
jmp 0x1402d9463
lea rdx, [0x140413c10]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1402d9471
lock or dword [rbx + 0x14], 0x20
cmp dword [rbx + 0x20], 0x200
jne 0x1402d9495
mov eax, dword [rbx + 0x14]
shr eax, 6
test al, 1
je 0x1402d9495
mov eax, dword [rbx + 0x14]
shr eax, 8
test al, 1
jne 0x1402d9495
mov dword [rbx + 0x20], 0x1000
mov rax, qword [rbx]
cmp esi, 1
jne 0x1402d94b3
movzx ecx, byte [rax]
dec dword [rbx + 0x10]
shl cx, 8
movzx eax, bpl
or cx, ax
inc qword [rbx]
jmp 0x1402d94be
movzx ecx, word [rax]
add dword [rbx + 0x10], 0xfffffffe
add qword [rbx], 2
movzx eax, cx
jmp 0x1402d94da
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rbx + 0x14], eax
and dword [rbx + 0x10], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
jmp 0x1402d9354
Function at 0x14000b9ac
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140016950], eax
call fcn.14000b730
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x140016950], 0
jne case.default.0x14000ba02
mov ecx, 1
call fcn.14000b730
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
add byte [rbp + 0x47f4ae50], dh
dec byte [rbx + 0x755b6332]
push rsi
loope 0x1400232da
xor eax, 0x1d4e7af0
invalid
xor ebx, edx
mov dl, 0x7e
push qword [rcx + 0xa136bb4]
clc
movsx ebx, di
mov al, 0x4c
invalid
Function at 0x18001ad64
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rax, qword [rdx]
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx], rax
je 0x18001ae36
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x18001ae16
mov r10d, dword [r9 + 0x18]
test r10d, r10d
je 0x18001ae16
mov r15d, dword [r9 + 0x20]
dec r10d
mov ebp, 0x1604f3f2
lea rcx, [r15 + r10*4]
mov r11d, dword [rcx + r8]
add r11, r8
mov sil, byte [r11]
inc r11
test sil, sil
je 0x18001ae11
movsx ecx, sil
sub sil, 0x41
mov edx, ecx
or edx, 0x20
cmp sil, 0x19
mov sil, byte [r11]
cmova edx, ecx
inc r11
xor edx, ebp
imul ebp, edx, 0x1000193
test sil, sil
jne 0x18001ade2
cmp ebp, 0xc99b42a4
je 0x18001ae1b
test r10d, r10d
jne 0x18001adc4
mov rax, qword [rax]
jmp 0x18001ad9f
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + r10*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
call rax
mov rax, qword [rbx]
movzx ecx, byte [rax]
cmp ecx, 5
ja 0x18001ae65
je 0x18001ae65
test ecx, ecx
je 0x18001ae65
sub ecx, 1
je 0x18001ae5b
sub ecx, 1
jne 0x18001ae65
mov rax, qword [rdi + 0x10]
cmp qword [rbx + 0x10], rax
jmp 0x18001ae6d
mov rax, qword [rdi + 8]
cmp qword [rbx + 8], rax
jmp 0x18001ae6d
mov rax, qword [rdi + 0x18]
cmp qword [rbx + 0x18], rax
mov rbx, qword [rsp + 0x40]
sete al
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x18001af2c
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
xor r10d, r10d
mov rbx, rdx
mov r11, rcx
test r9b, r9b
je 0x18001af7e
test r8, r8
je 0x18001afa1
movabs r9, 0x100000001b3
mov al, byte [r10 + rbx]
mov dl, byte [r10 + rbx]
add al, 0x20
movzx ecx, al
sub dl, 0x41
movzx eax, byte [r10 + rbx]
cmp dl, 0x19
cmova ecx, eax
inc r10
imul r11, r9
movsx rax, cl
xor r11, rax
cmp r10, r8
jb 0x18001af4e
jmp 0x18001afa1
test r8, r8
je 0x18001afa1
movabs r9, 0x100000001b3
movsx rcx, byte [r10 + rdx]
inc r10
imul r11, r9
xor r11, rcx
cmp r10, r8
jb 0x18001af8d
mov rbx, qword [rsp + 8]
mov rax, r11
ret
xor r8d, r8d
cmp byte [rcx], r8b
je 0x180026792
inc r8
cmp byte [r8 + rcx], 0
jne 0x180026788
mov r9b, dl
mov rdx, rcx
movabs rcx, 0xcbf29ce484222325
jmp 0x18001af2c
Function at 0x18001f814
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
xor ebx, ebx
mov r15, rdx
cmp byte [rcx], 4
mov rdi, rcx
je 0x18001f8ea
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x18001f8ca
mov r10d, dword [r9 + 0x18]
test r10d, r10d
je 0x18001f8ca
mov r12d, dword [r9 + 0x20]
dec r10d
mov ebp, 0xa409b1be
lea rcx, [r12 + r10*4]
mov r11d, dword [rcx + r8]
add r11, r8
mov sil, byte [r11]
inc r11
test sil, sil
je 0x18001f8c5
movsx ecx, sil
sub sil, 0x41
mov edx, ecx
or edx, 0x20
cmp sil, 0x19
mov sil, byte [r11]
cmova edx, ecx
inc r11
xor edx, ebp
imul ebp, edx, 0x1000193
test sil, sil
jne 0x18001f896
cmp ebp, 0xc0cdf748
je 0x18001f8cf
test r10d, r10d
jne 0x18001f878
mov rax, qword [rax]
jmp 0x18001f853
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + r10*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
call rax
cmp byte [rdi], 4
lea rax, [rdi + 8]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
cmove rbx, rax
mov rdi, qword [rsp + 0x58]
mov al, byte [rbx]
mov rbx, qword [rsp + 0x40]
mov byte [r15], al
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x18001f91c
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
movzx r9d, byte [rcx]
xor r8d, r8d
mov r11, rdx
mov r10, rcx
cmp r9d, 5
ja 0x18001f99c
je 0x18001f97e
mov edx, r9d
test r9d, r9d
je 0x18001f9b1
sub edx, 1
je 0x18001f9b1
sub edx, 1
je 0x18001f9b1
sub edx, 1
je 0x18001f9b1
cmp edx, 1
jne 0x18001f9b1
lea rax, [rcx + 8]
cmp r9b, 4
cmove r8, rax
movzx eax, byte [r8]
mov dword [r11], eax
jmp 0x18001fa7f
sub r9b, 5
cmp r9b, 1
setbe al
add rcx, 8
neg al
sbb rax, rax
and rax, rcx
mov eax, dword [rax]
jmp 0x18001fa7d
mov ecx, r9d
sub ecx, 6
je 0x18001fa6e
sub ecx, 1
je 0x18001fa5b
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov r10d, dword [rcx + r9 + 0x88]
add r10, r9
cmp r10, r9
je 0x18001fa39
mov r11d, dword [r10 + 0x18]
test r11d, r11d
je 0x18001fa39
mov r14d, dword [r10 + 0x20]
dec r11d
mov esi, 0xc944d0c4
lea rcx, [r14 + r11*4]
mov ebx, dword [rcx + r9]
add rbx, r9
mov dil, byte [rbx]
inc rbx
test dil, dil
je 0x18001fa34
movsx ecx, dil
sub dil, 0x41
mov edx, ecx
or edx, 0x20
cmp dil, 0x19
mov dil, byte [rbx]
cmova edx, ecx
inc rbx
xor edx, esi
imul esi, edx, 0x1000193
test dil, dil
jne 0x18001fa05
cmp esi, 0xa5496f9e
je 0x18001fa3e
test r11d, r11d
jne 0x18001f9e7
mov rax, qword [rax]
jmp 0x18001f9c2
mov ecx, dword [r10 + 0x24]
add rcx, r9
movzx edx, word [rcx + r11*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
call rax
jmp 0x18001fa7f
lea rax, [r10 + 8]
cmp r9b, 7
cmove r8, rax
cvttsd2si eax, qword [r8]
jmp 0x18001fa7d
lea rax, [r10 + 8]
cmp r9b, 6
cmove r8, rax
mov eax, dword [r8]
mov dword [rdx], eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret