joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402c7260
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rcx
mov eax, 0x22a8
call fcn.140317910
sub rsp, rax
mov dword [rsp + 0x24], 0
mov rcx, qword [rsp + 0x22b0]
call fcn.140015970
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x24]
or eax, 1
mov dword [rsp + 0x24], eax
lea r9, [rsp + 0x28]
mov r8d, 0x2000
lea rdx, [rsp + 0x2a0]
mov rcx, qword [0x1404a2800]
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x1402c7382
mov dword [rsp + 0x20], 0
jmp 0x1402c72d2
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x28]
xor edx, edx
mov eax, ecx
mov ecx, 8
div rcx
mov rcx, qword [rsp + 0x30]
cmp rcx, rax
jae 0x1402c7382
mov eax, dword [rsp + 0x20]
mov r9d, 0x104
lea r8, [rsp + 0x90]
mov rdx, qword [rsp + rax*8 + 0x2a0]
mov rcx, qword [0x1404a2800]
call sub.KERNEL32.dll_K32GetModuleFileNameExW
test eax, eax
je 0x1402c737d
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x40]
call fcn.140009a50
nop
mov eax, dword [rsp + 0x20]
lea rax, [rsp + rax*8 + 0x2a0]
mov r8, rax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.1402c6620
nop
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x22b0]
call fcn.1402c78a0
nop
lea rcx, [rsp + 0x60]
call fcn.140017be0
nop
lea rcx, [rsp + 0x40]
call fcn.140017380
jmp 0x1402c72c8
mov rax, qword [rsp + 0x22b0]
add rsp, 0x22a8
ret

Function at 0x1402c73f0
Capabilities:
Enumerate processes

Disassembly:
push rdi
sub rsp, 0x270
lea rax, [rsp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 0x238
rep stosb byte [rdi], al
mov dword [rsp + 0x30], 0x238
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Process32FirstW
cmp eax, 1
jne 0x1402c7468
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
jne 0x1402c7468
mov eax, dword [0x1404a2818]
cmp dword [rsp + 0x38], eax
jne 0x1402c7466
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x1402c7475
jmp 0x1402c7437
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
add rsp, 0x270
pop rdi
ret
Function at 0x1402ca7b0
Capabilities:
Hash data using murmur3

Disassembly:
mov dword [rsp + 8], ecx
mov eax, dword [rsp + 8]
shr eax, 0xf
mov ecx, dword [rsp + 8]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 8], eax
imul eax, dword [rsp + 8], 0x85ebca77
mov dword [rsp + 8], eax
mov eax, dword [rsp + 8]
shr eax, 0xd
mov ecx, dword [rsp + 8]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 8], eax
imul eax, dword [rsp + 8], 0xc2b2ae3d
mov dword [rsp + 8], eax
mov eax, dword [rsp + 8]
shr eax, 0x10
mov ecx, dword [rsp + 8]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 8], eax
mov eax, dword [rsp + 8]
ret
Function at 0x140316c00
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140316c84
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140454500]
cmp byte [rcx + rax], 0
je 0x140316c84
dec r8
sub rdx, 1
jne 0x140316c6a
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140318294
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1403182de
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1403182de
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1403182de
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1403182de
cmp dword [rcx + 0x84], 0xe
jbe 0x1403182de
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1403182e0
xor al, al
add rsp, 0x28
ret
Function at 0x140001160
Capabilities:
Parse pe header

Disassembly:
push rdi
push r14
sub rsp, 0x68
mov rax, qword [0x140012040]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r14, rdx
mov rdi, rcx
mov edx, recv
call fcn.140003190
test rax, rax
jne 0x140001193
mov al, 1
jmp 0x140001363
mov qword [rsp + 0x90], rbx
test rdi, rdi
je 0x14000137c
mov edx, 0x40
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x14000137c
mov eax, 0x5a4d
cmp word [rdi], ax
jne 0x14000137c
movsxd rax, dword [rdi + 0x3c]
cmp eax, 0x400
jg 0x14000137c
lea rbx, [rdi + rax]
mov edx, 0xf8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x14000137c
cmp dword [rbx], 0x4550
jne 0x14000137c
test rbx, rbx
je 0x14000137c
mov edx, 0xf8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x14000137c
mov eax, 0x20b
cmp word [rbx + 0x18], ax
jne 0x14000137c
mov rcx, rdi
mov qword [rsp + 0x60], rbp
call fcn.140003070
mov ebp, eax
mov edx, recv
lea rax, vtable.peconv::default_func_resolver.0
mov rcx, rdi
mov qword [rsp + 0x40], rax
call fcn.140003190
test rax, rax
je 0x140001378
mov ebx, dword [rax]
mov edx, dword [rax + 4]
lea rcx, [rbx + rdi]
cmp edx, 0x20
jb 0x140001378
test rcx, rcx
je 0x140001378
cmp rcx, rdi
jb 0x140001378
lea rax, [rbx + 0x20]
cmp rax, rbp
ja 0x140001378
cmp rax, 0x20
jb 0x140001378
cmp rax, rbx
jb 0x140001378
mov qword [rsp + 0x50], r15
mov r8b, 1
mov r15d, edx
shr r15, 5
test r15, r15
je 0x14000134d
add rbx, 0x20
mov qword [rsp + 0x58], rsi
xor esi, esi
lea rdx, [rdi - 0x20]
add rdx, rbx
je 0x140001348
cmp rdx, rdi
jb 0x140001348
cmp rbx, rbp
ja 0x140001348
cmp rbx, 0x20
jb 0x140001348
lea rax, [rbx - 0x20]
cmp rbx, rax
jb 0x140001348
mov eax, dword [rdi + rbx - 0x1c]
test eax, eax
je 0x140001348
cmp rax, r14
jbe 0x1400012f5
sub rax, r14
lea r9, [rdi + rax]
test r9, r9
je 0x140001338
cmp r9, rdi
jb 0x140001338
lea rcx, [rax + 1]
cmp rcx, rbp
ja 0x140001338
cmp rcx, 1
jb 0x140001338
cmp rcx, rax
jb 0x140001338
lea rax, [rsp + 0x40]
mov r8, r14
mov qword [rsp + 0x30], rax
mov rcx, rdi
mov qword [rsp + 0x28], rdx
mov rdx, rbp
call fcn.140001580
movzx r8d, al
inc rsi
add rbx, 0x20
cmp rsi, r15
jb 0x1400012c3
mov rsi, qword [rsp + 0x58]
mov r15, qword [rsp + 0x50]
movzx eax, r8b
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14000a140
add rsp, 0x68
pop r14
pop rdi
ret
xor al, al
jmp 0x140001356
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str._ERROR__Loader_Payload_bitness_mismatch._n
call fcn.1400013a0
xor al, al
jmp 0x14000135b
Function at 0x140001ed0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push rdi
push r12
push r14
sub rsp, 0x40
mov r14, rdx
lea rcx, str.C:UserskareeOneDriveDesktop_testopenvpn.exe
xor r12d, r12d
xor r9d, r9d
mov qword [rsp + 0x30], r12
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov r8d, 1
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140001f25
xor eax, eax
add rsp, 0x40
pop r14
pop r12
pop rdi
ret
mov qword [rsp + 0x28], r12
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], r12d
mov r8d, 2
mov qword [rsp + 0x68], rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rbp, rax
test rax, rax
jne 0x140001f6a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x68]
xor eax, eax
add rsp, 0x40
pop r14
pop r12
pop rdi
ret
xor r9d, r9d
mov qword [rsp + 0x78], r15
xor r8d, r8d
mov qword [rsp + 0x20], r12
mov edx, 4
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r15, rax
test rax, rax
jne 0x140001fa9
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140002075
xor edx, edx
mov qword [rsp + 0x60], rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
mov rax, qword [r14]
test rax, rax
je 0x140001fca
cmp rax, rbx
cmovbe rbx, rax
mov rdx, rbx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x14000203a
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
lea rdx, str.____Mapping_of
call fcn.1400020b0
mov rcx, rax
lea rdx, str.C:UserskareeOneDriveDesktop_testopenvpn.exe
call fcn.1400020b0
mov rcx, rax
lea rdx, str._is_invalid_
call fcn.1400020b0
lea rdx, [0x140002290]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140002070
mov qword [rsp + 0x70], rsi
test rbx, rbx
jne 0x140002089
mov rsi, r12
mov rbx, r12
mov rcx, r15
mov qword [r14], rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rsi
mov rsi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x60]
mov r15, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop r12
pop rdi
ret
mov edx, 1
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rsi, rax
test rax, rax
je 0x140002047
mov r8, rbx
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
jmp 0x14000204a
Function at 0x140002400
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
call fcn.140002c90
mov rsi, qword gs:[0x60]
mov rdi, rax
test rsi, rsi
jne 0x140002449
test rax, rax
jne 0x14000249a
xor al, al
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsi + 0x110]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
mov rax, qword [rsi + 0x18]
mov rdx, qword [rax + 0x10]
mov rax, rdx
test rdi, rdi
jne 0x140002474
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
jmp 0x140002432
test rax, rax
je 0x14000248f
mov rcx, qword [rax + 0x30]
test rcx, rcx
je 0x14000248f
cmp rdi, rcx
je 0x1400024ca
mov rax, qword [rax]
cmp rax, rdx
jne 0x140002474
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
xor esi, esi
test rbp, rbp
je 0x140002432
cmp rbp, rdi
jb 0x140002432
sub rbp, rdi
lea rax, [rbp + 1]
cmp rax, rsi
ja 0x140002432
cmp rax, 1
jb 0x140002432
cmp rax, rbp
jb 0x140002432
mov al, 1
jmp 0x140002434
mov esi, dword [rax + 0x40]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
jmp 0x14000249a
Function at 0x140002920
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
sub rsp, 0x68
mov rax, qword [0x140012040]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
call fcn.140003070
mov ebp, eax
test eax, eax
je 0x140002b18
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x98], r14
mov qword [rsp + 0x60], r15
test rbx, rbx
je 0x140002aee
mov edx, 0x40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x140002aee
mov r14d, 0x5a4d
cmp word [rbx], r14w
jne 0x140002aee
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140002aee
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x140002aee
cmp dword [rdi], 0x4550
jne 0x140002aee
test rdi, rdi
je 0x140002aee
mov edx, 0xf8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x140002aee
mov r15d, 0x20b
cmp word [rdi + 0x18], r15w
jne 0x140002aee
lea rax, vtable.peconv::default_func_resolver.0
mov qword [rsp + 0x88], rsi
xor esi, esi
mov qword [rsp + 0x20], rax
mov edx, 0x40
mov dword [rsp + 0x41], esi
mov rcx, rbx
mov word [rsp + 0x45], si
mov byte [rsp + 0x47], sil
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x140002a7b
cmp word [rbx], r14w
jne 0x140002a7b
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140002a7b
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x140002a7b
cmp dword [rdi], 0x4550
jne 0x140002a7b
test rdi, rdi
je 0x140002a7b
mov edx, 0xf8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x140002a7b
movzx esi, word [rdi + 0x18]
lea rax, vtable.FillImportThunks.0
cmp si, r15w
mov qword [rsp + 0x28], rax
mov edx, 1
lea rax, [rsp + 0x20]
mov rcx, rbx
mov qword [rsp + 0x48], rax
sete byte [rsp + 0x40]
call fcn.140003190
mov rsi, qword [rsp + 0x88]
test rax, rax
jne 0x140002ab8
mov al, 1
jmp 0x140002b03
mov ecx, dword [rax]
lea r8, [rcx + rbx]
test r8, r8
je 0x140002b01
cmp r8, rbx
jb 0x140002b01
lea rax, [rcx + 0x14]
cmp rax, rbp
ja 0x140002b01
cmp rax, 0x14
jb 0x140002b01
cmp rax, rcx
jb 0x140002b01
lea r9, [rsp + 0x28]
mov rdx, rbp
mov rcx, rbx
call fcn.140002550
jmp 0x140002b03
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str._ERROR__Loader_Payload_bitness_mismatch._n
call fcn.1400013a0
xor al, al
mov r14, qword [rsp + 0x98]
mov rdi, qword [rsp + 0x90]
mov r15, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14000a140
add rsp, 0x68
pop rbp
pop rbx
ret
Function at 0x140002db0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
test rcx, rcx
je 0x140002dd5
test rdx, rdx
je 0x140002de7
cmp rdx, 0x40
jae 0x140002df6
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov edx, 0x40
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x140002dd5
mov eax, 0x5a4d
cmp word [rdi], ax
jne 0x140002dd5
movsxd rax, dword [rdi + 0x3c]
cmp eax, 0x400
jg 0x140002dd5
lea rbx, [rax + rdi]
mov rcx, rax
test rsi, rsi
je 0x140002e3b
test rbx, rbx
je 0x140002dd5
cmp rbx, rdi
jb 0x140002dd5
add rax, 0xf8
cmp rax, rsi
ja 0x140002dd5
cmp rax, 0xf8
jb 0x140002dd5
cmp rax, rcx
jb 0x140002dd5
jmp 0x140002e4d
mov edx, 0xf8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x140002dd5
mov rsi, qword [rsp + 0x38]
xor eax, eax
cmp dword [rbx], 0x4550
cmovne rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140002e70
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x140002f57
mov edx, 0x40
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x140002f57
mov edi, 0x5a4d
cmp word [rbx], di
jne 0x140002f57
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140002f57
lea rsi, [rbx + rax]
mov edx, 0xf8
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x140002f57
cmp dword [rsi], 0x4550
jne 0x140002f57
test rsi, rsi
je 0x140002f57
mov edx, 0x40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x140002f44
cmp word [rbx], di
jne 0x140002f44
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140002f44
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x140002f44
cmp dword [rdi], 0x4550
jne 0x140002f44
test rdi, rdi
je 0x140002f44
mov edx, 0xf8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x140002f44
mov eax, 0x20b
cmp word [rdi + 0x18], ax
je 0x140002f57
mov rax, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140002f70
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x140003057
mov edx, 0x40
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x140003057
mov edi, 0x5a4d
cmp word [rbx], di
jne 0x140003057
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140003057
lea rsi, [rbx + rax]
mov edx, 0xf8
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x140003057
cmp dword [rsi], 0x4550
jne 0x140003057
test rsi, rsi
je 0x140003057
mov edx, 0x40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x140003057
cmp word [rbx], di
jne 0x140003057
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140003057
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x140003057
cmp dword [rdi], 0x4550
jne 0x140003057
test rdi, rdi
je 0x140003057
mov edx, 0xf8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x140003057
mov eax, 0x20b
cmp word [rdi + 0x18], ax
jne 0x140003057
mov rax, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140003070
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x140003179
mov edx, 0x40
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x140003179
mov esi, 0x5a4d
cmp word [rbx], si
jne 0x140003179
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140003179
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x140003179
cmp dword [rdi], 0x4550
jne 0x140003179
mov edx, 0x40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x14000315e
cmp word [rbx], si
jne 0x14000315e
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x14000315e
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x14000315e
cmp dword [rdi], 0x4550
jne 0x14000315e
test rdi, rdi
je 0x14000315e
mov edx, 0xf8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x14000315e
mov eax, 0x20b
cmp word [rdi + 0x18], ax
jne 0x14000315e
mov rcx, rbx
call fcn.140002f70
mov eax, dword [rax + 0x50]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, rbx
call fcn.140002e70
mov eax, dword [rax + 0x50]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140003190
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebp, edx
mov rbx, rcx
test rcx, rcx
je 0x140003281
mov edx, 0x40
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x140003281
mov edi, 0x5a4d
cmp word [rbx], di
jne 0x140003281
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140003281
lea rsi, [rbx + rax]
mov edx, 0xf8
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x140003281
cmp dword [rsi], 0x4550
jne 0x140003281
test rsi, rsi
je 0x140003281
mov edx, 0x40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x14000326f
cmp word [rbx], di
jne 0x14000326f
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x14000326f
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x14000326f
cmp dword [rdi], 0x4550
jne 0x14000326f
test rdi, rdi
je 0x14000326f
mov edx, 0xf8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x14000326f
mov eax, 0x20b
cmp word [rdi + 0x18], ax
lea rax, [rbp + 0x11]
je 0x140003273
lea rax, [rbp + 0xf]
lea rax, [rsi + rax*8]
xor ecx, ecx
cmp dword [rax], ecx
cmove rax, rcx
jmp 0x140003283
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400032a0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov edi, 0x5a4d
test rcx, rcx
je 0x14000331a
mov edx, 0x40
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x14000331a
cmp word [rbx], di
jne 0x14000331a
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x14000331a
lea rsi, [rbx + rax]
mov edx, 0xf8
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x14000331a
cmp dword [rsi], 0x4550
jne 0x14000331a
test rsi, rsi
je 0x14000331a
mov edx, 0xf8
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x140003314
xor esi, esi
jmp 0x140003321
movzx esi, word [rsi + 0x18]
jmp 0x140003321
xor esi, esi
test rbx, rbx
je 0x140003397
mov edx, 0x40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x140003397
cmp word [rbx], di
jne 0x140003397
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140003397
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x140003397
cmp dword [rdi], 0x4550
jne 0x140003397
test rdi, rdi
je 0x140003397
mov eax, 0x20b
cmp si, ax
jne 0x140003384
mov rax, qword [rdi + 0x30]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov eax, dword [rdi + 0x34]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret