joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005610
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
and dword [rsp + 0x88], 0
mov rax, r8
mov r14d, edx
mov rbx, rcx
test r9d, r9d
je 0x14000564a
mov ecx, r9d
mov byte [rax], 0
lea rax, [rax + 0xc]
dec rcx
jne 0x14000563e
movsxd rax, dword [rbx + 0x3c]
mov edi, dword [rax + rbx + 0x88]
mov r8d, dword [rax + rbx + 0x8c]
lea r13d, [r8 + rdi]
cmp edi, r14d
jae 0x1400057e8
lea rcx, [rdi + 0x28]
cmp rcx, r14
jae 0x1400057e8
cmp r8d, r14d
jae 0x1400057e8
cmp r13d, r14d
jae 0x1400057e8
mov ecx, dword [rdi + rbx + 0x18]
mov r12d, dword [rdi + rbx + 0x14]
mov dword [rsp + 0x98], r12d
cmp r9d, ecx
jne 0x1400057e8
mov eax, dword [rdi + rbx + 0x20]
cmp eax, edi
jb 0x1400057e8
mov r9d, ecx
mov r15d, eax
mov r10d, r13d
shl r9, 2
mov ebp, ecx
mov qword [rsp + 0x80], rcx
add rax, r9
cmp rax, r10
jae 0x1400057e8
mov r11d, r8d
cmp r9, r8
jae 0x1400057e8
mov eax, dword [rdi + rbx + 0x24]
cmp eax, edi
jb 0x1400057e8
mov esi, eax
lea rax, [rax + rcx*2]
cmp rax, r10
jae 0x1400057e8
mov r8d, dword [rdi + rbx + 0x1c]
cmp r8d, edi
jb 0x1400057e8
mov edx, r12d
shl rdx, 2
lea rax, [r8 + rdx]
cmp rax, r10
jae 0x1400057e8
cmp rdx, r11
jae 0x1400057e8
add r8, rbx
add r15, rbx
lea r12, [rsi + rbx]
mov qword [rsp + 0x20], r8
test ecx, ecx
je 0x1400057e8
mov ecx, dword [r15]
cmp ecx, edi
jb 0x1400057cf
cmp ecx, r13d
jae 0x1400057cf
movzx edx, word [r12]
cmp edx, dword [rsp + 0x98]
jae 0x1400057cf
movzx eax, dx
mov esi, dword [r8 + rax*4]
cmp esi, r14d
jae 0x1400057cf
cmp esi, edi
jb 0x140005772
cmp esi, r13d
jb 0x1400057cf
cmp qword [rsp + 0xa0], 0
lea rbp, [rbx + rcx]
je 0x14000578f
mov rcx, rbp
call qword [rsp + 0xa0]
cmp al, 1
jne 0x1400057c2
mov rcx, rbp
call fcn.1400053d4
mov r8d, dword [rsp + 0x88]
mov rcx, qword [rsp + 0x90]
lea rdx, [r8 + r8*2]
inc r8d
mov byte [rcx + rdx*4], 1
mov dword [rcx + rdx*4 + 4], eax
mov dword [rcx + rdx*4 + 8], esi
mov dword [rsp + 0x88], r8d
mov r8, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x80]
add r15, 4
add r12, 2
dec rbp
mov qword [rsp + 0x80], rbp
jne 0x14000573b
mov eax, dword [rsp + 0x88]
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140005a58
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
movsxd r10, dword [rcx + 0x3c]
lea rdi, [rcx + 0x18]
xor r9d, r9d
movzx eax, word [r10 + rcx + 0x14]
add rdi, r10
mov ebx, r8d
add rdi, rax
cmp r8d, edx
jae 0x140005ab9
movzx r11d, word [r10 + rcx + 6]
mov edx, r9d
test r11d, r11d
je 0x140005ab9
lea r8, [rdi + 0xc]
mov ecx, dword [r8]
cmp ebx, ecx
jb 0x140005aa2
add ecx, dword [r8 - 4]
cmp ebx, ecx
jb 0x140005aaf
inc edx
add r8, 0x28
cmp edx, r11d
jae 0x140005ab9
jmp 0x140005a93
mov eax, edx
lea rcx, [rax + rax*4]
lea r9, [rdi + rcx*8]
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
mov rax, r9
ret
Function at 0x140005ac8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
push rsi
push rdi
push r12
push r13
push r14
push r15
movsxd rax, dword [rcx + 0x3c]
mov r10, rcx
xor ebx, ebx
mov r11d, dword [rax + rcx + 0x88]
mov ecx, dword [rax + rcx + 0x8c]
mov edi, edx
lea r15d, [rcx + r11]
cmp r11d, edx
jae 0x140005c10
lea rdx, [r11 + 0x28]
cmp rdx, rdi
jae 0x140005c10
cmp ecx, edi
jae 0x140005c10
cmp r15d, edi
jae 0x140005c10
mov eax, dword [r11 + r10 + 0x20]
mov r12d, dword [r11 + r10 + 0x18]
mov r13d, dword [r11 + r10 + 0x14]
cmp eax, r11d
jb 0x140005c10
mov edx, r12d
mov r14d, eax
mov r9d, r15d
shl rdx, 2
add rax, rdx
cmp rax, r9
jae 0x140005c10
cmp rdx, rcx
jae 0x140005c10
mov eax, dword [r11 + r10 + 0x24]
cmp eax, r11d
jb 0x140005c10
mov esi, eax
lea rax, [rax + r12*2]
cmp rax, r9
jae 0x140005c10
mov eax, dword [r11 + r10 + 0x1c]
cmp eax, r11d
jb 0x140005c10
lea rcx, [rax + r13*4]
cmp rcx, r9
jae 0x140005c10
add rsi, r10
lea r9, [r14 + r10]
mov ebp, ebx
lea r14, [rax + r10]
test r12d, r12d
je 0x140005c10
mov eax, dword [r9]
cmp eax, r11d
jb 0x140005bf6
cmp eax, r15d
jae 0x140005bf6
mov r8, qword [rsp + 0x48]
add rax, r10
sub r8, rax
movzx ecx, byte [rax]
movzx edx, byte [rax + r8]
sub ecx, edx
jne 0x140005bd5
inc rax
test edx, edx
jne 0x140005bc2
test ecx, ecx
jne 0x140005bf6
movzx ecx, word [rsi]
cmp ecx, r13d
jae 0x140005bf6
movzx eax, cx
mov ecx, dword [r14 + rax*4]
cmp ecx, edi
jae 0x140005bf6
cmp ecx, r11d
jb 0x140005c07
cmp ecx, r15d
jae 0x140005c07
inc ebp
add r9, 4
add rsi, 2
cmp ebp, r12d
jae 0x140005c10
jmp 0x140005baa
mov rax, qword [rsp + 0x50]
mov bl, 1
mov dword [rax], ecx
mov rbp, qword [rsp + 0x40]
mov al, bl
mov rbx, qword [rsp + 0x38]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret

Function at 0x140005c28
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
movsxd r9, dword [rcx + 0x3c]
xor ebx, ebx
lea r14, [rcx + 0x18]
movzx eax, word [r9 + rcx + 0x14]
movzx esi, word [r9 + rcx + 6]
add r14, r9
add r14, rax
mov r15, r8
mov ebp, edx
mov edi, ebx
test esi, esi
je 0x140005c96
mov eax, edi
lea rcx, [rax + rax*4]
lea rdx, [r14 + rcx*8]
mov rcx, r15
call fcn.14007d2dc
test eax, eax
je 0x140005c85
inc edi
cmp edi, esi
jb 0x140005c67
jmp 0x140005c96
mov ecx, edi
lea rdx, [rcx + rcx*4]
cmp dword [r14 + rdx*8 + 0xc], ebp
cmovb ebx, dword [r14 + rdx*8 + 0xc]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x140005cb4
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
movsxd r9, dword [rcx + 0x3c]
xor ebx, ebx
lea r14, [rcx + 0x18]
movzx eax, word [r9 + rcx + 0x14]
movzx ebp, word [r9 + rcx + 6]
add r14, r9
add r14, rax
mov r15, r8
mov esi, edx
mov edi, ebx
test ebp, ebp
je 0x140005d30
mov eax, edi
lea rcx, [rax + rax*4]
lea rdx, [r14 + rcx*8]
mov rcx, r15
call fcn.14007d2dc
test eax, eax
je 0x140005d11
inc edi
cmp edi, ebp
jb 0x140005cf3
jmp 0x140005d30
mov eax, edi
lea rcx, [rax + rax*4]
mov eax, dword [r14 + rcx*8 + 8]
cmp eax, esi
jae 0x140005d30
mov ecx, dword [r14 + rcx*8 + 0xc]
cmp ecx, esi
jae 0x140005d30
add ecx, eax
cmp ecx, esi
cmovb ebx, eax
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x1400061b8
Capabilities:
Attach user process memory

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0xf0
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov rdi, rdx
mov r14, rcx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rdx
mov ecx, 0x314
call fcn.140029ab4
mov rsi, rax
mov dword [rsp + 0x28], eax
test eax, eax
je 0x140006220
lea rcx, [rdi + 0x20]
mov edx, eax
mov rax, qword [rcx]
test rax, rax
je 0x140006217
cmp rax, qword [rcx + 8]
je 0x140006217
mov byte [rcx + 0x10], 1
add rcx, 0x48
dec rdx
jne 0x140006205
mov rcx, r14
call fcn.140077928
mov byte [rsp + 0x20], al
xor ebx, ebx
mov dword [rsp + 0x24], ebx
cmp ebx, esi
jae 0x1400063aa
mov eax, ebx
lea rcx, [rbx + rbx*8]
cmp qword [rdi + rcx*8 + 0x20], 0
je 0x1400063a3
movups xmm0, xmmword [rdi + rcx*8]
movaps xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rdi + rcx*8 + 0x10]
movaps xmmword [rsp + 0x60], xmm1
movups xmm0, xmmword [rdi + rcx*8 + 0x20]
movaps xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rdi + rcx*8 + 0x30]
movaps xmmword [rsp + 0x80], xmm1
movsd xmm0, qword [rdi + rcx*8 + 0x40]
movsd qword [rsp + 0x90], xmm0
lea rdx, [rsp + 0xa0]
mov rcx, r14
call sub.ntoskrnl.exe_KeStackAttachProcess
mov rax, qword [sym.imp.ntoskrnl.exe_MmUserProbeAddress]
mov rdx, qword [rax]
mov rcx, qword [rsp + 0x70]
cmp rcx, rdx
jae 0x140006342
lea rax, [rcx + 0xf]
cmp rax, rdx
jae 0x140006342
mov r8d, 0x10
lea rdx, [rsp + 0x82]
call fcn.14007d28c
test eax, eax
je 0x14000632e
mov byte [rsp + 0x81], 1
cmp byte [rsp + 0x80], 0
jne 0x14000632e
xor eax, eax
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xd8], rax
mov r8, qword [rsp + 0x70]
movups xmm0, xmmword [r8]
movdqu xmmword [rsp + 0xd0], xmm0
lea r9, [rsp + 0x40]
lea edx, [rax + 0x10]
lea rcx, [rsp + 0xd0]
call fcn.1400776fc
mov rcx, qword [rsp + 0x78]
cmp al, 1
cmove rcx, qword [rsp + 0x40]
mov qword [rsp + 0x78], rcx
jmp 0x140006342
lea rcx, [rsp + 0xa0]
call sub.ntoskrnl.exe_KeUnstackDetachProcess
nop
mov eax, ebx
lea rcx, [rax + rax*8]
movaps xmm0, xmmword [rsp + 0x50]
movups xmmword [rdi + rcx*8], xmm0
movaps xmm1, xmmword [rsp + 0x60]
movups xmmword [rdi + rcx*8 + 0x10], xmm1
movaps xmm0, xmmword [rsp + 0x70]
movups xmmword [rdi + rcx*8 + 0x20], xmm0
movaps xmm1, xmmword [rsp + 0x80]
movups xmmword [rdi + rcx*8 + 0x30], xmm1
movsd xmm0, qword [rsp + 0x90]
movsd qword [rdi + rcx*8 + 0x40], xmm0
jmp 0x1400063a3
inc ebx
jmp 0x14000622e
cmp byte [rsp + 0x20], 1
jne 0x1400063b9
mov rcx, r14
call fcn.140077a00
mov al, 1
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.14008c320
mov rbx, qword [rsp + 0x120]
add rsp, 0xf0
pop r14
pop rdi
pop rsi
ret
Function at 0x1400065f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rbp - 8], rax
mov dil, cl
mov r8b, cl
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x28]
call fcn.140006dd4
cmp al, 1
jne 0x1400066c5
mov edx, dword [rbp - 0x30]
mov rcx, qword [rbp - 0x28]
xor r9d, r9d
test dil, dil
lea r8, [rbp - 0x20]
mov dword [rbp - 0x20], 0x72657355
setne r9b
mov dword [rbp - 0x1c], 0x65696c43
mov dword [rbp - 0x18], 0x6c44746e
mov dword [rbp - 0x14], 0x696e496c
mov dword [rbp - 0x10], 0x6c616974
mov dword [rbp - 0xc], 0x657a69
call fcn.140005484
test eax, eax
je 0x1400066bc
mov edx, dword [rbp - 0x30]
mov rcx, qword [rbp - 0x28]
mov r8d, eax
test dil, dil
jne 0x140006689
call fcn.1400075a4
jmp 0x14000668e
call fcn.140007914
mov ebx, eax
test eax, eax
je 0x1400066bc
mov edx, eax
mov ecx, 0x312
test dil, dil
je 0x1400066a5
mov ecx, 0x313
call fcn.140029bac
mov edx, dword [rbp - 0x30]
mov rcx, qword [rbp - 0x28]
mov r9b, dil
mov r8d, ebx
call fcn.1400066e4
mov rcx, qword [rbp - 0x28]
call fcn.140077564
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14008c320
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret
Function at 0x140006dd4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rbp + 0x27], rax
xor ebx, ebx
mov r14, rdx
mov rsi, rcx
mov dword [rbp - 0x19], 0x53005c
mov dword [rbp - 0x15], 0x730079
mov dword [rbp - 0x11], 0x650074
lea r15d, [rbx + 1]
mov dword [rbp - 0xd], 0x52006d
mov dword [rbp - 9], 0x6f006f
mov dword [rbp - 5], 0x5c0074
mov dword [rbp - 1], 0x790073
test r8b, r8b
jne 0x140006e55
mov dword [rbp + 3], 0x740073
mov dword [rbp + 7], 0x6d0065
mov dword [rbp + 0xb], 0x320033
mov edi, ebx
jmp 0x140006e6d
mov dword [rbp + 3], 0x570073
mov dword [rbp + 7], 0x57004f
mov dword [rbp + 0xb], 0x340036
mov edi, r15d
lea r8, [rbp - 0x29]
lea rdx, [rbp - 0x21]
lea rcx, [rbp - 0x19]
mov r9b, r15b
mov dword [rbp + 0xf], 0x75005c
mov dword [rbp + 0x13], 0x650073
mov dword [rbp + 0x17], 0x330072
mov dword [rbp + 0x1b], 0x2e0032
mov dword [rbp + 0x1f], 0x6c0064
mov dword [rbp + 0x23], 0x6c
call fcn.14002f234
test eax, eax
jne 0x140006ed8
mov edx, dword [rbp - 0x29]
mov rcx, qword [rbp - 0x21]
mov r9, r14
mov r8, rsi
mov dword [rsp + 0x20], edi
call fcn.140005d4c
mov rcx, qword [rbp - 0x21]
movzx ebx, bl
cmp al, r15b
cmove ebx, r15d
call fcn.140077564
mov al, bl
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.14008c320
mov rbx, qword [rsp + 0xd0]
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x140006f00
Capabilities:
Attach user process memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x70
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor edi, edi
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x140006fe2
mov rax, qword [sym.imp.ntoskrnl.exe_MmUserProbeAddress]
mov rdx, qword [rax]
cmp rcx, rdx
jae 0x140006fe2
lea rax, [rcx + 8]
cmp rax, rdx
jae 0x140006fe2
mov ecx, 0x314
call fcn.140029ab4
cmp dword [rbx + 0x18], eax
jae 0x140006fe2
mov rcx, qword [rbx]
call fcn.140079dd8
mov r14b, al
mov rcx, qword [rbx]
call fcn.140077928
mov sil, al
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x30]
mov rcx, qword [rbx]
call sub.ntoskrnl.exe_KeStackAttachProcess
nop
mov rcx, qword [rbx + 0x10]
test r14b, r14b
jne 0x140006fa6
mov rdx, qword [rbx + 0x20]
call fcn.140082cb4
jmp 0x140006fae
mov edx, dword [rbx + 0x20]
call fcn.140082f04
mov dil, 1
mov byte [rsp + 0x21], dil
jmp 0x140006fca
lea rcx, [rsp + 0x30]
call sub.ntoskrnl.exe_KeUnstackDetachProcess
cmp sil, 1
jne 0x140006fe2
mov rcx, qword [rbx]
call fcn.140077a00
mov al, dil
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14008c320
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x140007188
Capabilities:
Attach user process memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, rcx
mov qword [rsp + 0x38], rcx
xor edi, edi
mov rcx, qword [rcx + 0x20]
test rcx, rcx
je 0x140007266
mov rax, qword [sym.imp.ntoskrnl.exe_MmUserProbeAddress]
mov rdx, qword [rax]
cmp rcx, rdx
jae 0x140007266
lea rax, [rcx + 0xf]
cmp rax, rdx
jae 0x140007266
mov ecx, 0x314
call fcn.140029ab4
cmp dword [rbx + 0x18], eax
jae 0x140007266
mov rcx, qword [rbx]
call fcn.140077928
mov sil, al
mov byte [rsp + 0x31], al
lea rdx, [rsp + 0x40]
mov rcx, qword [rbx]
call sub.ntoskrnl.exe_KeStackAttachProcess
nop
movups xmm0, xmmword [rbx + 0x32]
movdqu xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x20], rdi
mov r9b, 1
lea r8d, [rdi + 0x10]
lea rdx, [rsp + 0x70]
mov rcx, qword [rbx + 0x20]
call fcn.140082a70
mov dil, al
mov byte [rsp + 0x30], al
jmp 0x14000724e
lea rcx, [rsp + 0x40]
call sub.ntoskrnl.exe_KeUnstackDetachProcess
cmp sil, 1
jne 0x140007266
mov rcx, qword [rbx]
call fcn.140077a00
mov al, dil
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14008c320
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140007290
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov edi, edx
mov dword [rsp + 0x24], edx
mov r13, rcx
xor ebx, ebx
mov edx, 0x1000
lea ecx, [rbx + 1]
call fcn.140077530
mov r14, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400073f3
mov dword [rsp + 0x38], 0x730075
mov dword [rsp + 0x3c], 0x720065
mov dword [rsp + 0x40], 0x320033
mov dword [rsp + 0x44], 0x64002e
mov qword [rsp + 0x48], 0x6c006c
mov esi, ebx
mov dword [rsp + 0x20], ebx
mov r15, qword [r13]
mov edx, 0x1fe
cmp r15, r13
je 0x1400073dd
inc esi
mov dword [rsp + 0x20], esi
cmp esi, 0x1000
ja 0x1400073dd
mov eax, edi
mov rdi, r15
sub rdi, rax
mov rax, qword [sym.imp.ntoskrnl.exe_MmUserProbeAddress]
mov rcx, qword [rax]
cmp rdi, rcx
jae 0x1400073dd
lea rax, [rdi + 0x88]
cmp rax, rcx
jae 0x1400073dd
cmp qword [rdi + 0x30], rbx
je 0x1400073d1
movzx eax, word [rdi + 0x48]
cmp eax, edx
cmova eax, edx
cmp eax, 2
jbe 0x1400073d1
mov rdx, qword [rdi + 0x50]
cmp rdx, rcx
jae 0x1400073cc
test rdx, rdx
je 0x1400073cc
mov r12d, eax
add rax, rdx
cmp rax, rcx
jae 0x1400073cc
mov r8d, r12d
mov rcx, r14
call fcn.1400010a0
shr r12, 1
mov word [r14 + r12*2], bx
mov edx, 0x5c
mov rcx, r14
call fcn.14007d5ac
test rax, rax
je 0x1400073cc
lea rcx, [rax + 2]
lea rdx, [rsp + 0x38]
call fcn.14007d400
test eax, eax
jne 0x1400073cc
mov rbx, qword [rdi + 0x30]
mov qword [rsp + 0x28], rbx
jmp 0x1400073dd
mov edx, 0x1fe
mov r15, qword [r15]
mov edi, dword [rsp + 0x24]
jmp 0x140007317
jmp 0x1400073eb
mov rcx, r14
call fcn.140077564
mov rax, rbx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14008c320
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140007420
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov edi, edx
mov dword [rsp + 0x24], edx
mov r13, rcx
xor ebx, ebx
mov edx, 0x1000
lea ecx, [rbx + 1]
call fcn.140077530
mov r14, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140007578
mov dword [rsp + 0x38], 0x730075
mov dword [rsp + 0x3c], 0x720065
mov dword [rsp + 0x40], 0x320033
mov dword [rsp + 0x44], 0x64002e
mov qword [rsp + 0x48], 0x6c006c
mov esi, ebx
mov dword [rsp + 0x20], ebx
mov r15d, dword [r13]
mov edx, 0x1fe
cmp r15, r13
je 0x140007562
inc esi
mov dword [rsp + 0x20], esi
cmp esi, 0x1000
ja 0x140007562
mov eax, edi
mov rdi, r15
sub rdi, rax
mov rax, qword [sym.imp.ntoskrnl.exe_MmUserProbeAddress]
mov rcx, qword [rax]
cmp rdi, rcx
jae 0x140007562
lea rax, [rdi + 0x48]
cmp rax, rcx
jae 0x140007562
cmp dword [rdi + 0x18], ebx
je 0x140007556
movzx eax, word [rdi + 0x24]
cmp eax, edx
cmova eax, edx
cmp eax, 2
jbe 0x140007556
mov edx, dword [rdi + 0x28]
cmp rdx, rcx
jae 0x140007551
test edx, edx
je 0x140007551
mov r12d, eax
add rax, rdx
cmp rax, rcx
jae 0x140007551
mov r8d, r12d
mov rcx, r14
call fcn.1400010a0
shr r12, 1
mov word [r14 + r12*2], bx
mov edx, 0x5c
mov rcx, r14
call fcn.14007d5ac
test rax, rax
je 0x140007551
lea rcx, [rax + 2]
lea rdx, [rsp + 0x38]
call fcn.14007d400
test eax, eax
jne 0x140007551
mov ebx, dword [rdi + 0x18]
mov qword [rsp + 0x28], rbx
jmp 0x140007562
mov edx, 0x1fe
mov r15d, dword [r15]
mov edi, dword [rsp + 0x24]
jmp 0x1400074a7
jmp 0x140007570
mov rcx, r14
call fcn.140077564
mov rax, rbx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14008c320
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x140008728
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r8, rcx
mov r9d, edx
lea rcx, [rsp + 0x20]
mov edx, 2
mov dword [rsp + 0x20], 0x46005c
mov dword [rsp + 0x24], 0x6c0069
mov dword [rsp + 0x28], 0x530065
mov dword [rsp + 0x2c], 0x730079
mov dword [rsp + 0x30], 0x650074
mov dword [rsp + 0x34], 0x5c006d
mov dword [rsp + 0x38], 0x410052
mov dword [rsp + 0x3c], 0x57
call fcn.1400083c0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14008c320
add rsp, 0x58
ret

Function at 0x140008910
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rsp + 0x48], rax
and dword [rsp + 0x40], 0
mov r8, rcx
mov r9d, edx
lea rcx, [rsp + 0x20]
mov edx, 0xa
mov dword [rsp + 0x20], 0x44005c
mov dword [rsp + 0x24], 0x690072
mov dword [rsp + 0x28], 0x650076
mov dword [rsp + 0x2c], 0x5c0072
mov dword [rsp + 0x30], 0x380069
mov dword [rsp + 0x34], 0x340030
mov dword [rsp + 0x38], 0x700032
mov dword [rsp + 0x3c], 0x740072
call fcn.1400083c0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14008c320
add rsp, 0x58
ret
Function at 0x140008990
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rsp + 0x48], rax
and dword [rsp + 0x40], 0
mov r8, rcx
mov r9d, edx
lea rcx, [rsp + 0x20]
mov edx, 8
mov dword [rsp + 0x20], 0x44005c
mov dword [rsp + 0x24], 0x690072
mov dword [rsp + 0x28], 0x650076
mov dword [rsp + 0x2c], 0x5c0072
mov dword [rsp + 0x30], 0x62004b
mov dword [rsp + 0x34], 0x430064
mov dword [rsp + 0x38], 0x61006c
mov dword [rsp + 0x3c], 0x730073
call fcn.1400083c0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14008c320
add rsp, 0x58
ret

Function at 0x140008a10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rsp + 0x48], rax
and dword [rsp + 0x40], 0
mov r8, rcx
mov r9d, edx
lea rcx, [rsp + 0x20]
mov edx, 9
mov dword [rsp + 0x20], 0x44005c
mov dword [rsp + 0x24], 0x690072
mov dword [rsp + 0x28], 0x650076
mov dword [rsp + 0x2c], 0x5c0072
mov dword [rsp + 0x30], 0x6f004d
mov dword [rsp + 0x34], 0x630075
mov dword [rsp + 0x38], 0x61006c
mov dword [rsp + 0x3c], 0x730073
call fcn.1400083c0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14008c320
add rsp, 0x58
ret

Function at 0x140008a90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rsp + 0x40], rax
and dword [rsp + 0x38], 0
mov r8, rcx
mov r9d, edx
lea rcx, [rsp + 0x20]
mov edx, 0xb
mov dword [rsp + 0x20], 0x44005c
mov dword [rsp + 0x24], 0x690072
mov dword [rsp + 0x28], 0x650076
mov dword [rsp + 0x2c], 0x5c0072
mov dword [rsp + 0x30], 0x44004e
mov dword [rsp + 0x34], 0x530049
call fcn.1400083c0
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14008c320
add rsp, 0x58
ret

Function at 0x140008b00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r8, rcx
mov r9d, edx
lea rcx, [rsp + 0x20]
mov edx, 5
mov dword [rsp + 0x20], 0x44005c
mov dword [rsp + 0x24], 0x690072
mov dword [rsp + 0x28], 0x650076
mov dword [rsp + 0x2c], 0x5c0072
mov dword [rsp + 0x30], 0x630054
mov dword [rsp + 0x34], 0x690070
mov dword [rsp + 0x38], 0x70
call fcn.1400083c0
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14008c320
add rsp, 0x58
ret

Function at 0x140008b74
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rsp + 0x48], rax
and dword [rsp + 0x40], 0
mov r8, rcx
mov r9d, edx
lea rcx, [rsp + 0x20]
mov edx, 6
mov dword [rsp + 0x20], 0x44005c
mov dword [rsp + 0x24], 0x690072
mov dword [rsp + 0x28], 0x650076
mov dword [rsp + 0x2c], 0x5c0072
mov dword [rsp + 0x30], 0x73006e
mov dword [rsp + 0x34], 0x700069
mov dword [rsp + 0x38], 0x6f0072
mov dword [rsp + 0x3c], 0x790078
call fcn.1400083c0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14008c320
add rsp, 0x58
ret