joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401310cc
Capabilities:
Access peb ldr_data
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
xchg r15, r14
lea r8, [rbp + 0x118]
mov rcx, 0xffffffffffffffff
lea rdx, [rbp + 0x120]
jne 0x140130fe3
je 0x140130fe3
lea esi, [rbx + 0x7a01]
pop r8
pushf
call rcx
push r10
rcl edi, 0xf4
rcl ebx, 0x27
neg rcx
and ebx, 0xcd89a72e
cpuid
jmp rax
jmp 0x140131053
mov r9d, 0x8000
xchg r14, r15
mov qword [rbp + 0x118], r14
jmp 0x140130f9a
call r12
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
xchg rdi, rcx
mov rdi, rcx
xchg rcx, rdi
add rax, r9
je 0x140131101
jne 0x140131101
ret
jmp 0x1401311ab
call rax
xchg rcx, r11
mov r11, qword [rsp + 0x30]
xchg r11, rcx
call r14
test eax, eax
jne 0x140131580
jmp 0x14013103e

Function at 0x140133cc0
Capabilities:
Contain obfuscated stackstrings
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
xchg rdx, r9
mov qword [rsp + 0x20], rdx
xchg rdx, r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
jmp 0x140133cd9
mov qword [rsp + 8], rcx
sub rsp, 0x28
lea rax, [0x140133e90]
mov qword [rsp + 0x18], rax
mov dword [rsp + 8], 0
jmp 0x140133cfb
xchg r10, rax
mov r10, qword [rsp + 0x30]
xchg r10, rax
mov qword [rsp + 0x10], rax
Function at 0x401ce0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
xor r8d, r8d
test rdx, rdx
mov rsi, rcx
mov rbx, rdx
je 0x401cff
mov rcx, rdx
call sub.msvcrt.dll_strlen
mov r8, rax
mov rcx, rbx
mov r9, rsi
mov edx, 1
call sub.msvcrt.dll_fwrite
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp sub.msvcrt.dll_fflush

Function at 0x401d20
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, 2
call qword [fcn.00413a50]
mov r8d, 0x3f
mov edx, 1
lea rcx, str._GC__cannot_register_global_variable__too_many_global_variables
mov rbx, rax
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rcx, rbx
call sub.msvcrt.dll_fflush
mov ecx, 1
call sub.msvcrt.dll_exit
nop

Function at 0x402470
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, 2
call qword [fcn.00413a50]
mov r8d, 0x4b
mov edx, 1
lea rcx, str._GC__cannot_register_thread_local_variable__too_many_thread_local_variables
mov rbx, rax
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rcx, rbx
call sub.msvcrt.dll_fflush
mov ecx, 1
call sub.msvcrt.dll_exit
nop

Function at 0x404080
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
test rcx, rcx
mov rbx, rdx
je 0x4040f1
cmp qword [rcx + 8], 0
js 0x404100
call fcn.00403e90
test rax, rax
je 0x4040f1
mov r10, qword [rax]
test r10, r10
jle 0x4040eb
mov r9, rax
add r10, rbx
sub r9, rbx
nop
mov r8, rbx
mov rdx, rbx
sar r8, 8
sar rdx, 0x10
xor r8d, ebx
and edx, 0xffffffee
and r8d, 0xffffffee
xor r8b, byte [r9 + rbx + 0x10]
xor r8d, edx
mov rdx, rbx
sar rdx, 0x18
and edx, 0xffffffee
xor r8d, edx
mov byte [r9 + rbx + 0x10], r8b
add rbx, 1
cmp rbx, r10
jne 0x4040b0
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rax, rcx
jmp 0x40409e
Function at 0x404b70
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov r14, rcx
mov rcx, qword [0x00d6c4d0]
mov ebp, edx
mov edx, 0x5c757ce6
lea rbx, [r14 + 2]
call fcn.00404080
mov edx, 0x2bcb5e82
mov rcx, rax
call fcn.004042d0
mov rdi, qword [0x00d6c4e0]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov r13, qword [rax + 0x20]
lea rsi, [rax + 0x20]
nop dword [rax]
nop word cs:[rax + rax]
movzx eax, word [r14]
mov rdx, r14
test ax, ax
je 0x404c00
nop dword [rax]
lea ecx, [rax - 0x41]
cmp cx, 0x19
ja 0x404d80
add eax, 0x20
add rdx, 2
mov word [rdx - 2], ax
movzx eax, word [rdx]
test ax, ax
jne 0x404be0
mov rcx, qword [r13 + 0x50]
movzx r12d, word [rcx]
test r12w, r12w
je 0x404da2
mov rax, rcx
nop
nop word cs:[rax + rax]
lea edx, [r12 - 0x41]
cmp dx, 0x19
ja 0x404db0
add r12d, 0x20
add rax, 2
mov word [rax - 2], r12w
movzx r12d, word [rax]
test r12w, r12w
jne 0x404c20
movzx r15d, word [r14]
movzx r12d, word [rcx]
test r15w, r15w
je 0x404cb5
test r12w, r12w
je 0x404dd0
mov r10, rbx
mov eax, r15d
sub r10, rcx
jmp 0x404c76
cmp word [rcx], 0
je 0x404cb5
movzx edx, word [rcx]
lea r9d, [rax - 0x41]
lea r8d, [rax + 0x20]
cmp r9w, 0x1a
cmovb eax, r8d
lea r9d, [rdx - 0x41]
lea r8d, [rdx + 0x20]
cmp r9w, 0x1a
cmovb edx, r8d
cmp ax, dx
jne 0x404dd0
mov rax, rcx
add rcx, 2
movzx eax, word [r10 + rax]
test ax, ax
jne 0x404c70
mov edx, 0x376ed9e6
mov rcx, rdi
call fcn.00404080
mov edx, 0x7e405582
mov rcx, rax
call fcn.004042d0
cmp r15w, r12w
je 0x404df3
mov r13, qword [r13]
cmp rsi, r13
jne 0x404bd0
test ebp, ebp
je 0x404e08
mov rcx, qword [0x00d6c500]
lea rbx, [rsp + 0x30]
mov edx, 0x581ae226
call fcn.00404080
mov edx, 0x68270642
mov rcx, rax
call fcn.004042d0
mov rax, qword [0x00d6c370]
mov rcx, rbx
mov rdx, r14
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x28], 0
call qword [rax]
mov rax, qword [0x00d6c360]
mov r8, rbx
xor edx, edx
lea r9, [rsp + 0x28]
xor ecx, ecx
call qword [rax]
mov rcx, qword [0x00d6c510]
mov edx, 0x585201c2
mov ebx, eax
call fcn.00404080
mov edx, 0x376ed9e6
mov rcx, rax
call fcn.004042d0
test ebx, ebx
jne 0x404e26
mov rax, qword [rsp + 0x28]
jmp 0x404df7
add rdx, 2
movzx eax, word [rdx]
test ax, ax
jne 0x404be0
mov rcx, qword [r13 + 0x50]
movzx r12d, word [rcx]
test r12w, r12w
jne 0x404c12
movzx r15d, word [r14]
jmp 0x404cb5
add rax, 2
movzx r12d, word [rax]
test r12w, r12w
jne 0x404c20
jmp 0x404c46
mov rcx, qword [0x00d6c4e0]
mov edx, 0x376ed9e6
call fcn.00404080
mov edx, 0x7e405582
mov rcx, rax
call fcn.004042d0
jmp 0x404cd9
mov rax, qword [r13 + 0x20]
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [0x00d6c4f0]
mov edx, 0x29810502
call fcn.00404080
mov edx, 0x41469ba6
mov rcx, rax
call fcn.004042d0
xor eax, eax
jmp 0x404df7
Function at 0x40aac0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x148
mov byte [rsp + 0x2f], 1
movzx eax, byte [rsp + 0x2f]
mov rbx, rcx
mov qword [rsp + 0x168], rdx
test al, al
jne 0x40aaf0
add rsp, 0x148
pop rbx
pop rsi
ret
mov ecx, 2
call qword [fcn.00413a50]
mov rdx, qword [rsp + 0x168]
mov rcx, rbx
mov rsi, rax
mov r9, rax
mov r8, rdx
mov edx, 1
call sub.msvcrt.dll_fwrite
mov rcx, rsi
call sub.msvcrt.dll_fflush
jmp 0x40aae2

Function at 0x40f740
Capabilities:
Write file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbp, qword [fcn.00413a50]
mov rsi, qword [rcx]
mov ecx, 1
call rbp
mov rdi, rax
test rsi, rsi
je 0x40f820
cmp qword [rsi], 0
lea r8, [rsi + 0x10]
mov rcx, rdi
lea rax, [0x00d69c78]
lea rdx, [0x00d69c79]
cmove r8, rax
call sub.msvcrt.dll_fprintf
lea r12, [0x00d69c79]
mov ebx, eax
movsxd rax, ebx
cmp rax, qword [rsi]
jge 0x40f7ba
cmp byte [rsi + rax + 0x10], 0
jne 0x40f800
xor ecx, ecx
mov rdx, rdi
call sub.msvcrt.dll_fputc
test eax, eax
jne 0x40f7ba
add ebx, 1
movsxd rax, ebx
cmp rax, qword [rsi]
jl 0x40f79a
mov ecx, 1
call rbp
mov r8d, 1
mov edx, 1
lea rcx, [0x00d69c7c]
mov r9, rax
call sub.msvcrt.dll_fwrite
mov ecx, 1
call rbp
mov rcx, rax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sub.msvcrt.dll_fflush
lea r8, [rsi + rax + 0x10]
mov rdx, r12
mov rcx, rdi
call sub.msvcrt.dll_fprintf
test eax, eax
jle 0x40f7ba
add ebx, eax
jmp 0x40f792
lea r8, [0x00d69c78]
mov rcx, rax
lea rdx, [0x00d69c79]
call sub.msvcrt.dll_fprintf
lea rsi, [0x00d69c79]
mov ebx, eax
nop
test ebx, ebx
jns 0x40f7ba
movsxd r8, ebx
cmp byte [r8 + 0x10], 0
jne 0x40f879
xor ecx, ecx
mov rdx, rdi
call sub.msvcrt.dll_fputc
test eax, eax
jne 0x40f7ba
add ebx, 1
test ebx, ebx
jns 0x40f7ba
movsxd r8, ebx
cmp byte [r8 + 0x10], 0
je 0x40f852
add r8, 0x10
mov rdx, rsi
mov rcx, rdi
call sub.msvcrt.dll_fprintf
test eax, eax
jle 0x40f7ba
add ebx, eax
jmp 0x40f840
Function at 0x411560
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
lea rsi, [0x00d6b4e0]
mov edx, 0x5c757ce6
mov r13, rcx
lea rcx, [0x00d6b340]
call fcn.00404080
lea rdi, [r13 + 2]
mov edx, 0x2bcb5e82
mov rcx, rax
call fcn.004042d0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov r12, qword [rax + 0x20]
lea rbp, [rax + 0x20]
nop
movzx eax, word [r13]
mov rdx, r13
test ax, ax
je 0x4115e0
nop dword [rax]
lea ecx, [rax - 0x41]
cmp cx, 0x19
ja 0x411760
add eax, 0x20
add rdx, 2
mov word [rdx - 2], ax
movzx eax, word [rdx]
test ax, ax
jne 0x4115c0
mov rcx, qword [r12 + 0x50]
movzx ebx, word [rcx]
test bx, bx
je 0x411781
mov rax, rcx
nop
nop word cs:[rax + rax]
lea edx, [rbx - 0x41]
cmp dx, 0x19
ja 0x411790
add ebx, 0x20
add rax, 2
mov word [rax - 2], bx
movzx ebx, word [rax]
test bx, bx
jne 0x411600
movzx r14d, word [r13]
movzx ebx, word [rcx]
test r14w, r14w
je 0x411695
test bx, bx
je 0x4117b0
mov r10, rdi
mov eax, r14d
sub r10, rcx
jmp 0x411656
cmp word [rcx], 0
je 0x411695
movzx edx, word [rcx]
lea r9d, [rax - 0x41]
lea r8d, [rax + 0x20]
cmp r9w, 0x1a
cmovb eax, r8d
lea r9d, [rdx - 0x41]
lea r8d, [rdx + 0x20]
cmp r9w, 0x1a
cmovb edx, r8d
cmp ax, dx
jne 0x4117b0
mov rax, rcx
add rcx, 2
movzx eax, word [r10 + rax]
test ax, ax
jne 0x411650
mov edx, 0x376ed9e6
mov rcx, rsi
call fcn.00404080
mov edx, 0x7e405582
mov rcx, rax
call fcn.004042d0
cmp r14w, bx
je 0x4117cf
mov r12, qword [r12]
cmp rbp, r12
jne 0x4115b0
lea rcx, [0x00d6b460]
mov edx, 0x581ae226
call fcn.00404080
lea rbx, [rsp + 0x30]
mov edx, 0x68270642
mov rcx, rax
call fcn.004042d0
mov rcx, rbx
mov rdx, r13
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x28], 0
call qword [0x00d6f5f0]
mov r8, rbx
xor edx, edx
xor ecx, ecx
lea r9, [rsp + 0x28]
call qword [0x00d6f5e8]
mov edx, 0x585201c2
lea rcx, [0x00d6b420]
mov ebx, eax
call fcn.00404080
mov edx, 0x376ed9e6
mov rcx, rax
call fcn.004042d0
xor eax, eax
test ebx, ebx
jne 0x4117d4
mov rax, qword [rsp + 0x28]
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
add rdx, 2
movzx eax, word [rdx]
test ax, ax
jne 0x4115c0
mov rcx, qword [r12 + 0x50]
movzx ebx, word [rcx]
test bx, bx
jne 0x4115f1
movzx r14d, word [r13]
jmp 0x411695
add rax, 2
movzx ebx, word [rax]
test bx, bx
jne 0x411600
jmp 0x411620
mov rcx, rsi
mov edx, 0x376ed9e6
call fcn.00404080
mov edx, 0x7e405582
mov rcx, rax
call fcn.004042d0
jmp 0x4116b9
mov rax, qword [r12 + 0x20]
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x4129d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x00d845c4]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x412b58
mov rax, qword [0x00d845c8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x412a1c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x412aa5
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x412a00
mov rcx, rbx
call fcn.00413670
test rax, rax
mov r12, rax
je 0x412b8d
mov rax, qword [0x00d845c8]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call fcn.004137a0
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x00d845c8]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x412b70
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x412a9e
sub eax, 0x40
and eax, 0xffffffbf
jne 0x412b00
add dword [0x00d845c4], 1
cmp edi, 8
jae 0x412ad3
test dil, 4
jne 0x412b44
test edi, edi
je 0x412ac8
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x412b5f
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x412ac8
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x412aec
jmp 0x412ac8
add rsi, qword [0x00d845c8]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x412a9e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.00417ab0
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x412ac8
xor esi, esi
jmp 0x412a27
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x412ac8
mov rax, qword [0x00d845c8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call fcn.00417ab0
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.00417ab0
nop
nop dword [rax]

Function at 0x4132e0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00d848a0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x00d84880]
test rbx, rbx
je 0x413334
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x41332b
test rsi, rsi
je 0x41332b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x413310
lea rcx, [0x00d848a0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x413670
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x00d6c600]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x4136dd
mov rcx, r8
call fcn.00413550
test eax, eax
je 0x4136dd
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x4136dd
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x4136d4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x4136df
add rax, 0x28
cmp rax, r9
jne 0x4136c0
xor eax, eax
add rsp, 0x28
ret

Function at 0x417ab0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
call sub.msvcrt.dll__onexit
test rax, rax
sete al
movzx eax, al
neg eax
add rsp, 0x28
ret
lea rcx, [0x00401540]
jmp 0x401510
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.00413a50
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.00413a50
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
jmp 0x401530
Function at 0x143574268
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1435743ef
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x143574299
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14357427f
add dl, dl
jne 0x1435742a6
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x143574306
xor eax, eax
add dl, dl
jne 0x1435742b5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1435743bd
add dl, dl
jne 0x1435742c6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1435742d3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1435742e0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1435742ed
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1435742fa
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14357428e
mov eax, 1
add dl, dl
jne 0x143574316
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x143574323
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14357430b
sub eax, ebx
mov ebx, 1
jne 0x14357435c
mov ecx, 1
add dl, dl
jne 0x14357433e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14357434b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x143574333
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14357428e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x143574378
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x143574385
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14357436d
cmp eax, 0x7d00
jae 0x1435743ab
cmp eax, 0x500
jb 0x1435743a6
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14357428e
cmp eax, 0x7f
ja 0x1435743ae
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14357428e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1435743e2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14357428e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140002460
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
xor r8, r8
push r8
push rax
pushfq
push r8
push rdx
sub rsp, 0xa8
push r8
push r15
push r14
push r13
push r12
push rbx
push r8
push rsi
push rdi
push rbp
push rax
push rdx
sub rsp, 0x290
movdqa xmmword [rsp + 0x2f0], xmm6
movdqa xmmword [rsp + 0x300], xmm7
movdqa xmmword [rsp + 0x310], xmm8
movdqa xmmword [rsp + 0x320], xmm9
movdqa xmmword [rsp + 0x330], xmm10
movdqa xmmword [rsp + 0x340], xmm11
movdqa xmmword [rsp + 0x350], xmm12
movdqa xmmword [rsp + 0x360], xmm13
movdqa xmmword [rsp + 0x370], xmm14
movdqa xmmword [rsp + 0x380], xmm15
mov eax, dword [0x1402094f4]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x30
add rax, rbx
lea rdx, [rsp + 0x20]
xor r8, r8
mov qword [rdx + 0x10], r8
mov byte [rdx + 0x19], 1
mov dword [rdx + 0x1c], 0xffffffff
mov byte [rdx + 0x18], 2
mov r8, qword [rax + 0x80]
mov qword [rdx], r8
mov qword [rax + 0x80], rdx
lea r8, [rsp + 0x290]
mov qword [rdx + 8], r8
call fcn.14006a188
int3
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xd8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x120], rcx
mov qword [rsp + 0x128], rdx
mov qword [rsp + 0x130], r8
mov qword [rsp + 0x138], r9
mov eax, dword [0x1402094f4]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x30
add rax, rbx
mov qword [rsp + 0xc0], rax
cmp rcx, qword [rax + 0x88]
sete byte [rsp + 0xd0]
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [r8 + 0x18]
mov rbx, qword [rax]
mov rax, qword [r8 + 0x20]
mov rbp, qword [rax]
mov rax, qword [r8 + 0x28]
mov rsi, qword [rax]
mov rax, qword [r8 + 0x30]
mov rdi, qword [rax]
mov rax, qword [r8 + 0x58]
mov r12, qword [rax]
mov rax, qword [r8 + 0x60]
mov r13, qword [rax]
mov rax, qword [r8 + 0x68]
mov r14, qword [rax]
mov rax, qword [r8 + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [r8 + 0x90]
movdqa xmm7, xmmword [r8 + 0xa0]
movdqa xmm8, xmmword [r8 + 0xb0]
movdqa xmm9, xmmword [r8 + 0xc0]
movdqa xmm10, xmmword [r8 + 0xd0]
movdqa xmm11, xmmword [r8 + 0xe0]
movdqa xmm12, xmmword [r8 + 0xf0]
movdqa xmm13, xmmword [r8 + 0x100]
movdqa xmm14, xmmword [r8 + 0x110]
movdqa xmm15, xmmword [r8 + 0x120]
mov rcx, qword [r8 + 0x78]
mov rdx, qword [rsp + 0x120]
call qword [rsp + 0x128]
mov r8, qword [rsp + 0x130]
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rdx + 0x70]
cmp rcx, 0
je 0x1400025f0
mov r9, qword [rdx + 0x68]
mov qword [r9], rcx
mov qword [rdx + 0x68], 0
mov qword [rdx + 0x70], 0
mov rcx, qword [rsp + 0x138]
mov r8, qword [r8 + 0x78]
xor r9d, r9d
mov rcx, qword [rcx]
cmp rcx, r9
je 0x14000260c
cmp rcx, r8
jl 0x1400025ff
mov qword [rdx + 0x80], rcx
test dword [0x1402030a8], 1
je 0x14000263b
cmp byte [rsp + 0xd0], 0
je 0x14000263b
mov rcx, 0x43
mov rdx, rax
mov rsp, r8
jmp 0x140002160
mov rsp, r8
jmp rax
Function at 0x140002640
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xc8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x110], rcx
mov qword [rsp + 0x118], rdx
mov eax, dword [0x1402094f4]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x30
add rax, rbx
mov qword [rsp + 0xc0], rax
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [rdx + 0x18]
mov rbx, qword [rax]
mov rax, qword [rdx + 0x20]
mov rbp, qword [rax]
mov rax, qword [rdx + 0x28]
mov rsi, qword [rax]
mov rax, qword [rdx + 0x30]
mov rdi, qword [rax]
mov rax, qword [rdx + 0x58]
mov r12, qword [rax]
mov rax, qword [rdx + 0x60]
mov r13, qword [rax]
mov rax, qword [rdx + 0x68]
mov r14, qword [rax]
mov rax, qword [rdx + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [rdx + 0x90]
movdqa xmm7, xmmword [rdx + 0xa0]
movdqa xmm8, xmmword [rdx + 0xb0]
movdqa xmm9, xmmword [rdx + 0xc0]
movdqa xmm10, xmmword [rdx + 0xd0]
movdqa xmm11, xmmword [rdx + 0xe0]
movdqa xmm12, xmmword [rdx + 0xf0]
movdqa xmm13, xmmword [rdx + 0x100]
movdqa xmm14, xmmword [rdx + 0x110]
movdqa xmm15, xmmword [rdx + 0x120]
mov rcx, qword [rdx + 0x78]
call qword [rsp + pe_nt_image_headers64]
mov rdx, qword [rsp + 0x118]
mov rax, qword [rdx + 0x18]
mov qword [rax], rbx
mov rax, qword [rdx + 0x20]
mov qword [rax], rbp
mov rax, qword [rdx + 0x28]
mov qword [rax], rsi
mov rax, qword [rdx + 0x30]
mov qword [rax], rdi
mov rax, qword [rdx + 0x58]
mov qword [rax], r12
mov rax, qword [rdx + 0x60]
mov qword [rax], r13
mov rax, qword [rdx + 0x68]
mov qword [rax], r14
mov rax, qword [rdx + 0x70]
mov qword [rax], r15
movdqa xmmword [rdx + 0x90], xmm6
movdqa xmmword [rdx + 0xa0], xmm7
movdqa xmmword [rdx + 0xb0], xmm8
movdqa xmmword [rdx + 0xc0], xmm9
movdqa xmmword [rdx + 0xd0], xmm10
movdqa xmmword [rdx + 0xe0], xmm11
movdqa xmmword [rdx + 0xf0], xmm12
movdqa xmmword [rdx + 0x100], xmm13
movdqa xmmword [rdx + 0x110], xmm14
movdqa xmmword [rdx + 0x120], xmm15
mov rax, qword [rsp + 0xc0]
lock or dword [rax + 0x38], 0x10
movdqa xmm6, xmmword [rsp + 0x20]
movdqa xmm7, xmmword [rsp + 0x30]
movdqa xmm8, xmmword [rsp + 0x40]
movdqa xmm9, xmmword [rsp + 0x50]
movdqa xmm10, xmmword [rsp + 0x60]
movdqa xmm11, xmmword [rsp + 0x70]
movdqa xmm12, xmmword [rsp + 0x80]
movdqa xmm13, xmmword [rsp + 0x90]
movdqa xmm14, xmmword [rsp + 0xa0]
movdqa xmm15, xmmword [rsp + 0xb0]
add rsp, 0xc8
pop rbp
pop rdi
pop rsi
pop rbx
pop r12
pop r13
pop r14
pop r15
ret