joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400108b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x14028b814]
mov r12, rcx
mov rsi, rdx
mov rbx, r8
test edi, edi
jle 0x140010a60
mov rax, qword [0x14028b818]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp r12, rdx
jb 0x1400108fc
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x140010987
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x1400108e0
mov rcx, r12
call fcn.140011360
mov rbp, rax
test rax, rax
je 0x140010abd
mov rax, qword [0x14028b818]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call fcn.140011490
mov ecx, dword [rbp + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x14028b818]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140010aa2
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140010980
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140010a10
add dword [0x14028b814], 1
cmp ebx, 8
jae 0x1400109b8
test bl, 4
jne 0x140010a70
test ebx, ebx
je 0x1400109a9
movzx eax, byte [rsi]
mov byte [r12], al
test bl, 2
jne 0x140010a90
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi]
lea rcx, [r12 + 8]
and rcx, 0xfffffffffffffff8
mov qword [r12], rax
mov eax, ebx
mov rdx, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], rdx
sub r12, rcx
add ebx, r12d
sub rsi, r12
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x1400109a9
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x1400109ea
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rdi, qword [0x14028b818]
mov qword [rdi + 8], rcx
mov r9, rdi
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140010980
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140010840
xor edi, edi
jmp 0x140010907
mov eax, dword [rsi]
mov ebx, ebx
mov dword [r12], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r12 + rbx - 4], eax
jmp 0x1400109a9
mov ebx, ebx
movzx eax, word [rsi + rbx - 2]
mov word [r12 + rbx - 2], ax
jmp 0x1400109a9
mov rax, qword [0x14028b818]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call fcn.140010840
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.140010840
nop
nop dword [rax]
Function at 0x140010fd0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x14028b880]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14028b860]
test rbx, rbx
je 0x140011024
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x14001101b
test r12, r12
je 0x14001101b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140011000
lea rcx, [0x14028b880]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140011360
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x1402866a0]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x1400113d9
mov rcx, r10
call fcn.140011230
test eax, eax
je 0x1400113d9
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x1400113d6
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x1400113cd
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x1400113d9
add r8, 0x28
cmp r8, r9
jne 0x1400113b8
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret

Function at 0x140011740
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
xor ecx, ecx
xor r9d, r9d
mov r8d, 0xffff
mov dword [0x14028b900], 0xffffffff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov qword [0x14028b908], rax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ecx, eax
cmp eax, 0xffffffff
je 0x140011790
lea rdx, [0x140011650]
mov dword [0x14028b8f8], eax
call fcn.140016e30
test eax, eax
jne 0x140011798
add rsp, 0x28
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140011787
call sub.msvcrt.dll_abort
nop
nop
Function at 0x1400117a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
mov r13, qword [0x140286630]
mov r11d, dword [r13]
mov r12, rcx
test r11d, r11d
jne 0x1400117e0
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x140011848
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
ret
mov rsi, qword [rcx + 0x10]
test rsi, rsi
je 0x140011860
mov r13d, dword [0x14028b8f8]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rdi
mov r14d, eax
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, r14d
mov r13, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test r13, r13
je 0x1400118d8
mov rbx, qword [r13]
cmp rbx, rsi
jb 0x140011920
sub rsi, 1
mov rax, qword [r13 + rsi*8 + 8]
test rax, rax
jne 0x1400117c9
mov rcx, r12
call fcn.1400116a0
mov qword [r13 + rsi*8 + 8], rax
jmp 0x1400117c9
call fcn.1400116a0
mov qword [r12 + 0x10], rax
jmp 0x1400117c9
mov r10d, dword [r13]
test r10d, r10d
je 0x140011982
mov r9d, dword [0x140018540]
test r9d, r9d
je 0x1400119b0
lock add dword [0x14028b900], 1
jne 0x1400119e4
mov rsi, qword [r12 + 0x10]
test rsi, rsi
je 0x140011990
mov eax, dword [r13]
test eax, eax
je 0x1400117e9
mov eax, 0xffffffff
lock xadd dword [0x14028b900], eax
sub eax, 1
js 0x1400117e9
mov rcx, qword [0x14028b908]
xor r8d, r8d
mov edx, 1
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
jmp 0x1400117e9
lea rcx, [rsi + 0x21]
mov edx, 8
lea rbx, [rsi + 0x20]
call sub.msvcrt.dll_calloc
mov r13, rax
test rax, rax
je 0x140011a0b
mov qword [rax], rbx
mov ecx, dword [0x14028b8f8]
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x140011827
call rdi
jmp 0x140011827
lea r14, [rbx + rbx]
lea rax, [rsi + 0x20]
mov rcx, r13
cmp rsi, r14
cmova r14, rax
lea rdx, [r14*8 + 8]
call sub.msvcrt.dll_realloc
mov r13, rax
test rax, rax
je 0x140011a0b
mov qword [rax], r14
sub r14, rbx
lea rcx, [rax + rbx*8 + 8]
xor edx, edx
lea r8, [r14*8]
call sub.msvcrt.dll_memset
jmp 0x1400118f9
call fcn.140011740
mov dword [0x140018540], 1
mov edx, dword [r13]
test edx, edx
jne 0x14001187d
mov rsi, qword [r12 + 0x10]
test rsi, rsi
jne 0x1400117e9
mov rax, qword [0x14028b8f0]
lea rsi, [rax + 1]
mov qword [0x14028b8f0], rsi
mov qword [r12 + 0x10], rsi
jmp 0x140011899
lock add dword [0x140018544], 1
je 0x140011967
mov r8d, dword [0x140018540]
mov rsi, qword [sym.imp.KERNEL32.dll_Sleep]
lea rbx, [0x140018540]
test r8d, r8d
jne 0x140011976
nop dword [rax]
xor ecx, ecx
call rsi
mov ecx, dword [rbx]
test ecx, ecx
je 0x1400119d8
jmp 0x140011976
mov rcx, qword [0x14028b908]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14001188b
lock sub dword [0x14028b900], 1
jmp 0x14001188b
call sub.msvcrt.dll_abort
nop
nop word cs:[rax + rax]
nop dword [rax]
cmp qword [rcx], rdx
jae 0x140011a30
mov qword [rcx], rdx
mov qword [rcx + 0x18], 0
cmp qword [rcx + 8], r8
jae 0x140011a3a
mov qword [rcx + 8], r8
test r9, r9
je 0x140011a44
cmp qword [rcx], rdx
je 0x140011a48
ret
mov qword [rcx + 0x18], r9
ret
Function at 0x140001bc0
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x14004dd08], rbx
je 0x140001c27
cmp rax, rbx
jne 0x140001c1a
mov edi, 1
mov esi, edi
jmp 0x140001c2c
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x140001bff
mov edi, 1
mov eax, dword [0x14004dd10]
cmp eax, edi
jne 0x140001c44
mov ebx, 0x1f
mov ecx, ebx
call fcn.1400e1000
jmp 0x140001cba
mov eax, dword [0x14004dd10]
test eax, eax
jne 0x140001caf
mov dword [0x14004dd10], edi
lea r15, [0x140045358]
lea rbx, [0x140045340]
mov qword [rsp + 0x30], rbx
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rbx, r15
jae 0x140001ca1
test eax, eax
jne 0x140001ca5
cmp qword [rbx], r14
je 0x140001c96
movabs r10, 0xd30527475e523070
mov rax, qword [rbx]
mov rcx, qword [vtable.H_MA8HI.0]
call rcx
mov dword [rsp + 0x24], eax
add rbx, 8
mov qword [rsp + 0x30], rbx
jmp 0x140001c6e
test eax, eax
je 0x140001cb5
mov eax, 0xff
jmp 0x140001e1b
mov dword [0x14004d384], edi
mov ebx, 0x1f
mov eax, dword [0x14004dd10]
cmp eax, edi
jne 0x140001ce1
lea rdx, [0x140045338]
lea rcx, [0x140045308]
call sub.msvcrt.dll__initterm
mov dword [0x14004dd10], 2
test esi, esi
jne 0x140001cef
mov rax, r14
xchg qword [0x14004dd08], rax
cmp qword [0x14004dd28], r14
je 0x140001d2c
lea rcx, [0x14004dd28]
call fcn.140002280
test eax, eax
je 0x140001d2c
movabs r10, 0x99012e4578d92870
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x14004dd28]
mov r9, qword [vtable.H_MA8HI.0]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x140001d45
mov eax, 0xff
jmp 0x140001e1b
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x140001dcc
test ax, ax
je 0x140001d60
test edx, edx
jne 0x140001dcc
sub ax, di
cmp ax, bx
ja 0x140001d76
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x140001d60
test byte [rsp + 0x7c], dil
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140005044
mov dword [0x14004d380], eax
cmp dword [0x14004d3a0], r14d
jne 0x140001db5
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14004d384], r14d
jne 0x140001dca
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14004d380]
jmp 0x140001e1b
cmp ax, 0x22
jne 0x140001de0
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x140001d4e
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.140002314
add rsp, 0x28
jmp 0x140001bc0
Function at 0x180001fd0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov r14, rcx
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov edi, dword [rdx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x180002077
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x180002077
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x91f7da5d
lea rcx, [rbx + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x180002072
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x180002050
cmp r8d, 0x4ed5f3cf
je 0x18000207c
test r9d, r9d
jne 0x180002030
mov rax, qword [rax]
jmp 0x180002000
mov eax, dword [rdi + 0x24]
mov ecx, dword [rdi + 0x1c]
add rax, r10
add rcx, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
mov rcx, r14
add rdx, r10
call rdx
mov rcx, 0xffffffffffffffff
lea rbp, [rax + 1]
mov eax, 2
mul rbp
cmovo rax, rcx
mov rcx, rax
call fcn.18000ffe0
mov rcx, qword gs:[0x60]
mov rsi, rax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax + rax]
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov r11d, dword [rdx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x180002147
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x180002147
mov edi, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
mov r8d, 0xee9949a
lea rax, [rdi + r9*4]
mov edx, dword [rax + r10]
add rdx, r10
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x180002142
nop
movsx eax, al
lea rdx, [rdx + 1]
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx - 1]
test al, al
jne 0x180002120
cmp r8d, 0xaacb420e
je 0x18000214c
test r9d, r9d
jne 0x180002100
mov rcx, qword [rcx]
jmp 0x1800020d0
mov ecx, dword [r11 + 0x24]
mov r8, rbp
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov rdx, r14
add rax, r10
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x180002190
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov ebx, dword [rdx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x180002237
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x180002237
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xed458e87
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180002232
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x180002210
cmp r8d, 0x6616d40b
je 0x18000223c
test r9d, r9d
jne 0x1800021f0
mov rax, qword [rax]
jmp 0x1800021c0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rcx, [rsp + 0x30]
add rax, r10
call rax
movd xmm0, dword [rsp + 0x30]
mov rax, rsi
movd xmm2, dword [rsp + 0x34]
mov rbx, qword [rsp + 0x38]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm2, xmm2
cvtps2pd xmm1, xmm0
cvtps2pd xmm0, xmm2
movsd qword [rsi], xmm1
movsd qword [rsi + 8], xmm0
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1800024f0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x110
movaps xmmword [rax - 0x18], xmm6
mov r14, r8
movaps xmmword [rax - 0x28], xmm7
mov rsi, rdx
movaps xmmword [rax - 0x38], xmm8
mov rbp, rcx
movaps xmmword [rax - 0x48], xmm9
movaps xmmword [rax - 0x58], xmm10
movaps xmmword [rax - 0x68], xmm11
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd r9, dword [r10 + 0x3c]
mov edi, dword [r9 + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1800025c7
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1800025c7
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x5d9c90cd
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1800025c2
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x1800025a0
cmp r8d, 0xccd03d1f
je 0x1800025cc
test r9d, r9d
jne 0x180002580
mov rax, qword [rax]
jmp 0x180002550
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov rcx, rbp
add rax, r10
call rax
movsd xmm7, qword [rsi]
mov rcx, rbp
movsd xmm8, qword [rsi + 8]
addsd xmm7, qword [0x180012b20]
addsd xmm8, qword [0x180012b20]
movups xmm9, xmmword [0x180012a50]
movups xmm10, xmmword [0x1800192a8]
movaps xmm11, xmmword [r14]
movaps xmm6, xmmword [rsi]
call fcn.180001fd0
cmp word [rax], 0
je 0x180002646
mov rcx, 0xffffffffffffffff
nop
inc rcx
cmp word [rax + rcx*2], 0
jne 0x180002630
xor edx, edx
add ecx, 1
je 0x18000264a
mov rdx, rax
jmp 0x18000264a
xor edx, edx
mov ecx, edx
mov rax, qword [0x180015790]
movaps xmm0, xmmword [0x180012d60]
mov rbx, qword [0x180015800]
mov qword [rsp + 0x20], rax
mov rax, qword [0x180019750]
movsd qword [rsp + 0x38], xmm6
unpckhpd xmm6, xmm6
movsd qword [rsp + 0x40], xmm6
movsd qword [rsp + 0x80], xmm7
movsd qword [rsp + 0x88], xmm8
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x34], ecx
mov dword [rsp + 0x68], 0
mov word [rsp + 0x90], 0x101
mov byte [rsp + 0x92], 1
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm11
movups xmmword [rsp + 0x6c], xmm10
movups xmmword [rsp + 0x94], xmm9
test rax, rax
jne 0x1800026f8
mov rax, qword [0x180015920]
lea r8, str.Canvas.K2_DrawText
add rax, 0x3edbf1c
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call rax
mov qword [0x180019750], rax
mov r9, qword [rbx]
lea r8, [rsp + 0x20]
mov rdx, rax
mov rcx, rbx
call qword [r9 + 0x268]
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
mov rsp, r11
pop r14
ret
Function at 0x414700
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4148a6
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00430620
xorps xmm15, xmm15
mov r14, qword [0x0059faa8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x41476b
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x414780
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
nop
test rbx, rbx
jbe 0x4147a5
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x4147b9
cmp rbx, 0x1000
jae 0x414775
nop dword [rax]
jmp 0x414829
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x4147cd
xor edx, edx
jmp 0x414820
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00430620
xorps xmm15, xmm15
mov r14, qword [0x0059faa8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop dword [rax]
test dl, dl
jne 0x4147af
jmp 0x414794
call fcn.0045e560
xorps xmm15, xmm15
mov r14, qword [0x0059faa8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00434a20
lea rax, [0x004afcbe]
mov ebx, 0x18
call fcn.00435320
mov rax, qword [rsp + 0x38]
call fcn.00435020
lea rax, [0x004afd7e]
mov ebx, 0x19
call fcn.00435320
mov rax, qword [rsp + 0x30]
nop
call fcn.00435020
call fcn.00434c80
call fcn.00434aa0
lea rax, [0x004b265f]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.004330e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045aa00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00414700
Function at 0x4148e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x414b0a
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.004306a0
xorps xmm15, xmm15
mov r14, qword [0x0059faa8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x414959
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x41496c
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x414990
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
nop
jmp 0x4149a4
cmp rbx, 0x1000
jae 0x414963
jmp 0x414a25
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x4149b6
xor esi, esi
jmp 0x414a16
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.004306a0
xorps xmm15, xmm15
mov r14, qword [0x0059faa8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x41499a
nop
jmp 0x414982
call fcn.0045e560
xorps xmm15, xmm15
mov r14, qword [0x0059faa8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x414aa5
call fcn.00434a20
lea rax, [0x004b0328]
mov ebx, 0x19
call fcn.00435320
mov rax, qword [rsp + 0x68]
call fcn.00435020
lea rax, [0x004afd7e]
mov ebx, 0x19
call fcn.00435320
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.00435020
call fcn.00434c80
call fcn.00434aa0
lea rax, [0x004aba3f]
mov ebx, 0xd
nop dword [rax + rax]
call fcn.004330e0
cmp eax, 0x5af
je 0x414a48
call fcn.00434a20
lea rax, [0x004b0328]
mov ebx, 0x19
nop dword [rax]
call fcn.00435320
mov rax, qword [rsp + 0x38]
call fcn.00435020
lea rax, [0x004afd7e]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00435320
mov eax, dword [rsp + 0x34]
call fcn.00435020
call fcn.00434c80
call fcn.00434aa0
lea rax, [0x004b1fb5]
mov ebx, 0x1f
call fcn.004330e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045aa00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004148e0