joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000f040
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rbx, qword [0x14001a1c0]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x1a0012
mov dword [rbp - 0x1c], 0x50011
mov dword [rbp - 0x18], 0x5f000f
mov dword [rbp - 0x14], 0x5d0057
mov dword [rbp - 0x10], 0x1c006d
mov dword [rbp - 0xc], 0x740003
call fcn.1400029c0
mov rcx, rax
call rbx
mov rbx, qword [0x14001a1c0]
lea rcx, [rbp - 0x20]
mov qword [0x14001a1a0], rax
mov dword [rbp - 0x20], 0x1b0016
mov dword [rbp - 0x1c], 0x1a
mov dword [rbp - 0x18], 0x9000d
mov dword [rbp - 0x14], 0x5d0011
mov dword [rbp - 0x10], 0x1c006d
mov dword [rbp - 0xc], 0x740003
call fcn.1400029c0
mov rcx, rax
call rbx
movdqa xmm0, xmmword [0x140018a40]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x14001a130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x14001a1b0], rax
mov word [rbp - 0x10], 0x2205
mov byte [rbp - 0xe], 0x72
call fcn.140004620
mov rcx, qword [0x14001a1a0]
mov rdx, rax
call rbx
mov rbx, qword [0x14001a130]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x5111a12
mov dword [rbp - 0x1c], 0x161d290f
mov dword [rbp - 0x18], 0x111b056a
mov word [rbp - 0x14], 0x933
call fcn.140001180
mov rcx, qword [0x14001a1a0]
mov rdx, rax
call rbx
mov rbx, qword [0x14001a130]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0xc001c08
mov dword [rbp - 0x1c], 0x7000211
mov dword [rbp - 0x18], 0x1a0a0046
mov word [rbp - 0x14], 0x925
call fcn.140001180
mov rcx, qword [0x14001a1b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140018af0]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x14001a130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x14001a0e8], rax
mov byte [rbp - 0x10], 0x73
call fcn.140004330
mov rcx, qword [0x14001a1b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x1400189e0]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x14001a130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x14001a0f0], rax
mov dword [rbp - 0x10], 0x61171917
call fcn.140002660
mov rcx, qword [0x14001a1b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140018a60]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x14001a130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x14001a0e0], rax
mov byte [rbp - 0x10], 0x73
call fcn.140004330
mov rcx, qword [0x14001a1b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140018ad0]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x14001a130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x14001a0d8], rax
mov dword [rbp - 0x10], 0x201c1a1a
mov byte [rbp - 0xc], 0x6e
call fcn.140003130
mov rcx, qword [0x14001a1b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140018a10]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x14001a130]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x10], 0x341d
mov byte [rbp - 0xe], 0x72
call fcn.140004620
mov rcx, qword [0x14001a1b0]
mov rdx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rbp
jmp rax
Function at 0x140003530
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.Bbm_tjx_tqnotify_tben_tsupport_ttps_tprg_tulubionedodaj_tskype_totto_tstatewire_tprototypes_tgooglesitemap_tlinkspider_tonlinetraining_tadminstaff_tdonald_ttestumgebung_tstats_tscinfodir_tcsp_tadapters_torenburg_tcreate_tdiv_tpedidos_tamex_tmeinkonto_tgiftcard_tboogie_tusio_tpressa_tresumes_tnotes_tbetting_ttop_tarticoli_tformhandler_tkmartau_tama_tcatalog_tvignettes_tcab_tmitmachen_tesd_temail_tjax_tcategorysearch
mov r10, rax
sub rbx, rax
movabs rdi, 0x6058160581605817
lea r9, [rax + 1]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rax, r8
mov rcx, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x174
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 1]
mov byte [r9 - 1], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x174
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [rbx + r9]
mov byte [r9], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x174
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 + 1]
mov byte [r9 + 1], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x174
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 + 2]
mov byte [r9 + 2], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x174
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 + 3]
mov byte [r9 + 3], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x174
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 6]
xor al, byte [rbx + r9 + 4]
mov byte [r9 + 4], al
mov rax, rdi
mul rcx
mov rax, rcx
lea r9, [r9 + 0xa]
sub rax, rdx
add r11d, 0xa
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x174
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 7]
xor al, byte [rbx + r9 - 5]
mov byte [r9 - 5], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x174
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 8]
xor al, byte [rbx + r9 - 4]
mov byte [r9 - 4], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x174
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 9]
xor al, byte [rbx + r9 - 3]
mov byte [r9 - 3], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x174
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 2]
mov byte [r9 - 2], al
cmp r11d, 0xa
jb 0x140003580
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140004cc0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx - 2]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.Bbm_tjx_tqnotify_tben_tsupport_ttps_tprg_tulubionedodaj_tskype_totto_tstatewire_tprototypes_tgooglesitemap_tlinkspider_tonlinetraining_tadminstaff_tdonald_ttestumgebung_tstats_tscinfodir_tcsp_tadapters_torenburg_tcreate_tdiv_tpedidos_tamex_tmeinkonto_tgiftcard_tboogie_tusio_tpressa_tresumes_tnotes_tbetting_ttop_tarticoli_tformhandler_tkmartau_tama_tcatalog_tvignettes_tcab_tmitmachen_tesd_temail_tjax_tcategorysearch
mov r10, rax
sub rbx, rax
movabs rdi, 0x6058160581605817
lea r9, [rax + 1]
nop dword [rax + rax]
movsxd r8, r11d
lea r9, [r9 + 6]
mov rax, rdi
mov rcx, r8
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x174
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 7]
mov byte [r9 - 7], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x174
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [r9 + rbx - 6]
mov byte [r9 - 6], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x174
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 - 5]
mov byte [r9 - 5], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x174
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 - 4]
mov byte [r9 - 4], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x174
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 - 3]
mov byte [r9 - 3], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x174
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 2]
mov byte [r9 - 2], al
add r11d, 6
cmp r11d, 6
jb 0x140004d10
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140005ca0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.Bbm_tjx_tqnotify_tben_tsupport_ttps_tprg_tulubionedodaj_tskype_totto_tstatewire_tprototypes_tgooglesitemap_tlinkspider_tonlinetraining_tadminstaff_tdonald_ttestumgebung_tstats_tscinfodir_tcsp_tadapters_torenburg_tcreate_tdiv_tpedidos_tamex_tmeinkonto_tgiftcard_tboogie_tusio_tpressa_tresumes_tnotes_tbetting_ttop_tarticoli_tformhandler_tkmartau_tama_tcatalog_tvignettes_tcab_tmitmachen_tesd_temail_tjax_tcategorysearch
mov r10, rax
sub rbx, rax
movabs rdi, 0x6058160581605817
lea r9, [rax + 2]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rax, r8
mov rcx, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x174
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 2]
movsx eax, al
mov word [r9 - 2], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x174
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [r9 + rbx]
movsx eax, al
mov word [r9], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x174
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 + 2]
movsx eax, al
mov word [r9 + 2], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x174
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 + 4]
movsx eax, al
mov word [r9 + 4], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x174
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 + 6]
movsx eax, al
mov word [r9 + 6], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x174
sub rcx, rax
movzx eax, byte [rcx + rsi]
add r11d, 6
xor al, byte [rbx + r9 + 8]
lea r9, [r9 + 0xc]
movsx eax, al
mov word [r9 - 4], ax
cmp r11d, 6
jb 0x140005cf0
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14000a3d0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x14000a432
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
mov r8, rax
call fcn.14000aec0
test al, al
jne 0x14000a444
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x14000a400
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov eax, 0x74
mov dword [rbp - 0x20], 0x270009
lea rcx, [rbp - 0x20]
mov word [rbp - 0xc], ax
mov dword [rbp - 0x1c], 0x47003f
mov dword [rbp - 0x18], 0x34002f
mov dword [rbp - 0x14], 0x30004b
mov dword [rbp - 0x10], 0x2a003d
call fcn.140005e60
mov rcx, rax
call 0x14000a3d0
mov qword [0x1400161b8], rax
lea rcx, [rbp - 0x20]
mov eax, 0x6e
mov dword [rbp - 0x20], 0x270009
mov word [rbp - 0x10], ax
mov dword [rbp - 0x1c], 0x47003f
mov dword [rbp - 0x18], 0x34002f
mov dword [rbp - 0x14], 0x43003a
call fcn.140002590
mov rcx, rax
call 0x14000a3d0
lea rcx, [rbp - 0x20]
mov qword [0x1400161a8], rax
mov dword [rbp - 0x20], 0x16002c
mov dword [rbp - 0x1c], 0x650009
mov dword [rbp - 0x18], 0x780006
call fcn.140005ca0
mov rcx, rax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
jmp 0x14000a3d0
Function at 0x14000eea0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x14000a432
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
mov r8, rax
call fcn.14000aec0
test al, al
jne 0x14000a444
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x14000a400
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov eax, 0x74
mov dword [rbp - 0x20], 0x270009
lea rcx, [rbp - 0x20]
mov word [rbp - 0xc], ax
mov dword [rbp - 0x1c], 0x47003f
mov dword [rbp - 0x18], 0x34002f
mov dword [rbp - 0x14], 0x30004b
mov dword [rbp - 0x10], 0x2a003d
call fcn.140005e60
mov rcx, rax
call 0x14000a3d0
mov qword [0x1400161b8], rax
lea rcx, [rbp - 0x20]
mov eax, 0x6e
mov dword [rbp - 0x20], 0x270009
mov word [rbp - 0x10], ax
mov dword [rbp - 0x1c], 0x47003f
mov dword [rbp - 0x18], 0x34002f
mov dword [rbp - 0x14], 0x43003a
call fcn.140002590
mov rcx, rax
call 0x14000a3d0
lea rcx, [rbp - 0x20]
mov qword [0x1400161a8], rax
mov dword [rbp - 0x20], 0x16002c
mov dword [rbp - 0x1c], 0x650009
mov dword [rbp - 0x18], 0x780006
call fcn.140005ca0
mov rcx, rax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
jmp 0x14000a3d0
Function at 0x14000efe0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rbx, qword [0x1400161c0]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0xa0011
mov dword [rbp - 0x1c], 0x650008
mov dword [rbp - 0x18], 0x4b0006
mov dword [rbp - 0x14], 0x5f003b
mov dword [rbp - 0x10], 0x3000a
mov dword [rbp - 0xc], 0x690018
call fcn.140002e40
mov rcx, rax
call rbx
mov rbx, qword [0x1400161c0]
lea rcx, [rbp - 0x20]
mov qword [0x1400161a0], rax
mov dword [rbp - 0x20], 0xb0015
mov dword [rbp - 0x1c], 0x600003
mov dword [rbp - 0x18], 0x1d0004
mov dword [rbp - 0x14], 0x5f007d
mov dword [rbp - 0x10], 0x3000a
mov dword [rbp - 0xc], 0x690018
call fcn.140002e40
mov rcx, rax
call rbx
movdqa xmm0, xmmword [0x140015430]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140016130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400161b0], rax
mov word [rbp - 0x10], 0x3913
mov byte [rbp - 0xe], 9
call fcn.140005220
mov rcx, qword [0x1400161a0]
mov rdx, rax
call rbx
mov rbx, qword [0x140016130]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x65080a11
mov dword [rbp - 0x1c], 0x14713d06
mov dword [rbp - 0x18], 0xc001a0d
mov word [rbp - 0x14], 0x7931
call fcn.140001180
mov rcx, qword [0x1400161a0]
mov rdx, rax
call rbx
mov rbx, qword [0x140016130]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x6c190c0b
mov dword [rbp - 0x1c], 0x56c1618
mov dword [rbp - 0x18], 0x7111f21
mov word [rbp - 0x14], 0x7927
call fcn.140001180
mov rcx, qword [0x1400161b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140015540]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140016130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400160e8], rax
mov byte [rbp - 0x10], 0x65
call fcn.140004e60
mov rcx, qword [0x1400161b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140015490]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140016130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400160f0], rax
mov dword [rbp - 0x10], 0x736c0201
call fcn.1400029f0
mov rcx, qword [0x1400161b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140015450]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140016130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400160e0], rax
mov byte [rbp - 0x10], 0x65
call fcn.140004e60
mov rcx, qword [0x1400161b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140015500]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140016130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400160d8], rax
mov dword [rbp - 0x10], 0x3267010c
mov byte [rbp - 0xc], 0x75
call fcn.140003790
mov rcx, qword [0x1400161b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x1400154a0]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140016130]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x10], 0x2f0b
mov byte [rbp - 0xe], 9
call fcn.140005220
mov rcx, qword [0x1400161b0]
mov rdx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
jmp rax
Function at 0x14000f260
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
movsxd rax, dword [rcx + 0x3c]
mov r12, rdx
mov rdx, rcx
mov ecx, dword [rax + rcx + 0x88]
xor eax, eax
add rcx, rdx
mov dword [rbp - 0x2c], eax
mov qword [rbp - 0x28], rcx
mov r8d, dword [rcx + 0x1c]
mov r9d, dword [rcx + 0x20]
add r8, rdx
mov r10d, dword [rcx + 0x24]
add r9, rdx
add r10, rdx
mov qword [rbp - 0x20], r8
mov qword [rbp - 0x18], r9
mov qword [rbp - 0x10], r10
cmp dword [rcx + 0x18], eax
jbe 0x14000f48e
mov word [rbp + 0x50], 0x6242
mov word [rbp + 0x58], 0x6242
nop
mov esi, dword [r9 + rax*4]
lea rcx, [rbp + 0x50]
movzx eax, word [r10 + rax*2]
add rsi, rdx
xor edi, edi
mov r15d, dword [r8 + rax*4]
add r15, rdx
mov qword [rbp - 8], r15
call fcn.1400018c0
movzx ecx, byte [rax]
cmp byte [rsi], cl
je 0x14000f314
nop dword [rax]
lea rcx, [rbp + 0x50]
inc rdi
call fcn.1400018c0
movzx ecx, byte [rax]
cmp byte [rdi + rsi], cl
jne 0x14000f300
lea rcx, [rbp + 0x58]
xor ebx, ebx
call fcn.1400018c0
movzx ecx, byte [rax]
cmp byte [r12], cl
je 0x14000f345
nop dword [rax + rax]
lea rcx, [rbp + 0x58]
inc rbx
call fcn.1400018c0
movzx ecx, byte [rax]
cmp byte [rbx + r12], cl
jne 0x14000f330
cmp rdi, rbx
jne 0x14000f462
mov r13, rsi
mov word [rbp - 0x50], 0x6242
sub r13, r12
mov r14, r12
nop dword [rax]
lea rcx, [rbp - 0x50]
xor ebx, ebx
call fcn.1400018c0
movzx ecx, byte [rax]
cmp byte [rsi], cl
je 0x14000f386
lea rcx, [rbp - 0x50]
inc rbx
call fcn.1400018c0
movzx ecx, byte [rax]
cmp byte [rbx + rsi], cl
jne 0x14000f372
mov rax, r14
sub rax, r12
dec rbx
cmp rax, rbx
jae 0x14000f488
movsx r15d, byte [r14 + r13]
lea rcx, [rbp - 0x4e]
mov dword [rbp - 0x4e], 0x620023
call fcn.1400027f0
movzx eax, word [rax]
cmp r15d, eax
jl 0x14000f3f8
lea rcx, [rbp - 0x4a]
mov dword [rbp - 0x4a], 0x620038
call fcn.1400027f0
movzx ecx, word [rax]
cmp r15d, ecx
jg 0x14000f3f8
lea rcx, [rbp - 0x46]
mov dword [rbp - 0x46], 0x620023
mov dword [rbp - 0x42], 0x620003
call fcn.1400027f0
lea rcx, [rbp - 0x42]
movzx ebx, byte [rax]
call fcn.1400027f0
movzx ecx, byte [rax]
sub cl, bl
add r15b, cl
movsx edi, byte [r14]
lea rcx, [rbp - 0x3e]
mov dword [rbp - 0x3e], 0x620023
call fcn.1400027f0
movzx eax, word [rax]
cmp edi, eax
jl 0x14000f455
lea rcx, [rbp - 0x3a]
mov dword [rbp - 0x3a], 0x620038
call fcn.1400027f0
movzx ecx, word [rax]
cmp edi, ecx
jg 0x14000f455
lea rcx, [rbp - 0x36]
mov dword [rbp - 0x36], 0x620023
mov dword [rbp - 0x32], 0x620003
call fcn.1400027f0
lea rcx, [rbp - 0x32]
movzx ebx, byte [rax]
call fcn.1400027f0
movzx ecx, byte [rax]
sub cl, bl
add dil, cl
cmp r15b, dil
jne 0x14000f462
inc r14
jmp 0x14000f360
mov eax, dword [rbp - 0x2c]
mov rcx, qword [rbp - 0x28]
inc eax
mov dword [rbp - 0x2c], eax
cmp eax, dword [rcx + 0x18]
jae 0x14000f48e
mov rdx, qword [rbp + 0x40]
mov r8, qword [rbp - 0x20]
mov r9, qword [rbp - 0x18]
mov r10, qword [rbp - 0x10]
jmp 0x14000f2d0
mov rax, qword [rbp - 8]
jmp 0x14000f490
xor eax, eax
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000192c
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
cmp qword [rcx], rdx
je 0x140001970
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rdi
call fcn.140003f40
lea rax, [rsi + 1]
cmp rax, 2
jb case.default.0x140001969
mov qword [rdi], rsi
call fcn.14000c0a0
mov ecx, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
xchg edi, eax
sub dword [rbx], 0xffffffd3
invalid
invalid
xlatb
mov cl, 0x5a
fcompi st(0)
jnp 0x1401058a8
pop rsp
cld
mov edi, dword [rbx]
sahf
movabs eax, dword [0x383a8caf1ffe9d97]
popfq
invalid
invalid
scasd eax, dword [rdi]
invalid
cmp bh, byte [rax]
push 0x20
in al, dx
or eax, 0xcc505d48
adc dword [rax], 0xffffffeb
insd dword [rdi], dx
mov edi, 0x27d0c19b
adc ebp, ebp
cmc
scasb al, byte [rdi]
jl 0x140105974
popfq
invalid
invalid
mov ch, 0xd3
mov eax, 0x96dd2462
sbb dword [rbx + 0x3efefcde], esp
invalid