joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800f4fb0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
movzx eax, word [rdx]
mov word [rcx + 2], ax
mov r8d, eax
mov rcx, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call sym.ntdll.dll_RtlAllocateHeap
mov qword [rbx + 8], rax
xor r8d, r8d
test rax, rax
jne 0x1800f4ffb
mov eax, 0xc0000017
jmp 0x1800f5077
movzx r10d, word [rdi]
shr r10d, 1
mov dword [rsp + 0x20], r8d
mov rsi, qword [0x18015b238]
cmp r8d, r10d
jae 0x1800f506f
mov r11d, r8d
mov rax, qword [rdi + 8]
movzx r9d, word [rax + r11*2]
cmp r9w, 0x61
jb 0x1800f505c
cmp r9w, 0x7a
ja 0x1800f5034
sub r9w, 0x20
jmp 0x1800f505c
movzx edx, r9w
movzx eax, r9w
shr rax, 8
movzx ecx, word [rsi + rax*2]
mov eax, edx
shr eax, 4
and eax, 0xf
add ecx, eax
movzx ecx, word [rsi + rcx*2]
and edx, 0xf
add ecx, edx
add r9w, word [rsi + rcx*2]
mov rax, qword [rbx + 8]
mov word [rax + r11*2], r9w
inc r8d
mov dword [rsp + 0x20], r8d
jmp 0x1800f500e
movzx eax, word [rdi]
mov word [rbx], ax
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x1800f7470
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x1800f7487
call sym.ntdll.dll_RtlUnsubscribeWnfNotificationWaitForCompletion
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1800f749a
call sym.ntdll.dll_NtClose
and qword [rbx + 0x10], 0
mov rcx, qword [rbx]
test rcx, rcx
je 0x1800f74a7
call sym.ntdll.dll_TpReleaseWork
mov rcx, qword gs:[0x60]
mov r8, rbx
xor edx, edx
mov rcx, qword [rcx + 0x30]
add rsp, 0x20
pop rbx
jmp sym.ntdll.dll_RtlFreeHeap

Function at 0x1800f74c4
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
and qword [rcx], 0
mov rsi, rcx
mov rcx, qword gs:[0x60]
mov ebp, edx
xor edx, edx
mov rcx, qword [rcx + 0x30]
lea r8d, [rdx + 0x18]
call sym.ntdll.dll_RtlAllocateHeap
mov rbx, rax
test rax, rax
jne 0x1800f750b
mov edi, 0xc000009a
jmp 0x1800f759e
xor eax, eax
lea rcx, [rbx + 0x10]
mov qword [rbx], rax
xor r9d, r9d
mov qword [rbx + 8], rax
xor r8d, r8d
mov edx, 0x1f0003
mov qword [rbx + 0x10], rax
mov byte [rsp + 0x20], al
call sym.ntdll.dll_NtCreateEvent
mov edi, eax
test eax, eax
js 0x1800f7596
xor r9d, r9d
lea rdx, [0x1800f75e0]
mov r8, rbx
mov rcx, rbx
call sym.ntdll.dll_TpAllocWork
mov edi, eax
test eax, eax
js 0x1800f7596
mov rdx, qword [0x180120978]
lea rcx, [rbx + 8]
mov dword [rsp + 0x40], 0x11
lea r9, [0x1800f75c0]
mov dword [rsp + 0x38], 4
mov r8d, ebp
and dword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rbx
call fcn.1800496f4
mov edi, eax
test eax, eax
js 0x1800f7596
mov qword [rsi], rbx
jmp 0x1800f759e
mov rcx, rbx
call fcn.1800f7470
mov rbx, qword [rsp + 0x68]
mov eax, edi
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x1800ff17c
Capabilities:
Execute syscall

Disassembly:
push rbx
sub rsp, 0x50
xor eax, eax
mov qword [rsp + 0x30], rcx
mov rbx, rcx
mov dword [rsp + 0x38], 3
xor r9d, r9d
mov byte [rsp + 0x3c], al
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x40], rax
lea r8d, [rax + 0x18]
mov dword [rsp + 0x20], eax
lea ecx, [rax + 0x2c]
call sym.ntdll.dll_NtPowerInformation
mov rcx, rbx
add rsp, 0x50
pop rbx
jmp sym.ntdll.dll_NtClose
Function at 0x1800ffdf4
Capabilities:
Access peb ldr_data

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rbx, rcx
cmp rcx, qword [rax + 0x30]
jne 0x1800ffe5e
mov rax, qword gs:[0x60]
cmp qword [rax + 0x18], 0
je 0x1800ffe3f
mov rax, qword gs:[0x60]
lea rcx, str.HEAP__wZ_:
mov rdx, qword [rax + 0x18]
mov rdx, qword [rdx + 0x10]
add rdx, 0x58
call sym.ntdll.dll_DbgPrint
jmp 0x1800ffe4b
lea rcx, str.HEAP:
call sym.ntdll.dll_DbgPrint
mov rdx, rbx
lea rcx, str.May_not_destroy_the_process_heap_at__p_n
call sym.ntdll.dll_DbgPrint
xor al, al
jmp 0x1800ffea8
lea rdx, [0x180130ce8]
call fcn.18001fc58
test al, al
je 0x1800ffe5a
xor edx, edx
mov rcx, rbx
call fcn.1801010bc
test al, al
je 0x1800ffe5a
and dword [rbx + 0x98], 0
lea rdx, [rbx + 0xd8]
cmp qword [rdx], 0
je 0x1800ffea6
and qword [rsp + 0x30], 0
lea r8, [rsp + 0x30]
mov r9d, 0x8000
call fcn.18005cd8c
mov al, 1
add rsp, 0x20
pop rbx
ret
Function at 0x18010109c
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov rax, qword gs:[0x60]
cmp byte [rax + 2], 0
je 0x1801010ba
mov byte [0x18015a7f0], 1
int3
ret
Function at 0x1801016bc
Capabilities:
Access peb ldr_data

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x30
cmp byte [0x18015d824], 0
mov rbx, rcx
je 0x18010185f
lea rsi, [rcx + 0xd8]
mov rcx, qword [rsi]
test rcx, rcx
jne 0x180101726
movzx eax, word [rbx + 0xd2]
lea r9, [r11 + 0x18]
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov rdx, rsi
mov qword [r11 + 0x18], rax
or rcx, 0xffffffffffffffff
mov dword [rsp + 0x20], 0x1000
call sym.ntdll.dll_NtAllocateVirtualMemory
test eax, eax
js 0x18010185f
mov rcx, qword [rsi]
mov dl, 1
movzx r8d, word [rbx + 0xd2]
mov qword [rsp + 0x50], r8
test dl, dl
jne 0x18010174c
mov rdx, rcx
mov rcx, rbx
call sym.ntdll.dll_RtlCompareMemory
mov rdi, rax
mov rax, qword [rsp + 0x50]
jmp 0x18010175c
mov rdx, rbx
call sym.ntdll.dll_RtlCopyMemory
mov rax, qword [rsp + 0x50]
mov rdi, rax
cmp rax, rdi
je 0x18010185f
mov rax, qword gs:[0x60]
cmp qword [rax + 0x18], 0
je 0x180101798
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x10]
lea rcx, str.HEAP__wZ_:
add rdx, 0x58
call sym.ntdll.dll_DbgPrint
jmp 0x1801017a4
lea rcx, str.HEAP:
call sym.ntdll.dll_DbgPrint
mov rax, qword [rsi]
lea r8, [rdi + rbx]
mov r9d, dword [r8]
mov rdx, rbx
mov ecx, dword [rax + rdi]
mov dword [rsp + 0x20], ecx
lea rcx, str.Heap__p___headers_modified___p_is__lx_instead_of__lx__n
call sym.ntdll.dll_DbgPrint
xor edx, edx
cmp qword [0x1801114b8], rdx
je 0x18010185b
xor ebx, ebx
lea rsi, [0x1801114b0]
xor eax, eax
mov eax, dword [rax + rsi]
cmp rdi, rax
jb 0x1801017f4
lea ecx, [rdx + 1]
add rcx, rcx
mov eax, dword [rsi + rcx*8]
cmp rdi, rax
jb 0x180101808
inc edx
mov eax, edx
shl rax, 4
mov ebx, edx
cmp qword [rax + rsi + 8], 0
jne 0x1801017de
jmp 0x18010185b
mov rax, qword gs:[0x60]
cmp qword [rax + 0x18], 0
je 0x18010183b
mov rax, qword gs:[0x60]
lea rcx, str.HEAP__wZ_:
mov rdx, qword [rax + 0x18]
mov rdx, qword [rdx + 0x10]
add rdx, 0x58
call sym.ntdll.dll_DbgPrint
jmp 0x180101847
lea rcx, str.HEAP:
call sym.ntdll.dll_DbgPrint
add rbx, rbx
lea rcx, str.____This_is_located_in_the__s_field_of_the_heap_header._n
mov rdx, qword [rsi + rbx*8 + 8]
call sym.ntdll.dll_DbgPrint
xor al, al
jmp 0x180101861
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1801080c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov edi, dword [0x7ffe03c0]
mov rbx, rcx
add rcx, 0x48
call sym.ntdll.dll_RtlAcquireSRWLockExclusive
mov eax, dword [rbx + 0x1a8]
cmp edi, eax
je 0x180108157
mov r8d, edi
mov dword [rbx + 0x1a8], edi
sub r8d, eax
je 0x180108157
prefetchw byte [rbx + 8]
mov rax, qword [rbx + 8]
mov qword [rsp + 0x38], rax
lea ecx, [rax + r8]
xor ecx, eax
movzx edx, cx
xor edx, eax
mov dword [rsp + 0x38], edx
mov rcx, qword [rsp + 0x38]
lock cmpxchg qword [rbx + 8], rcx
mov qword [rsp + 0x38], rax
jne 0x180108107
mov r9d, 4
cmp edi, r9d
inc edi
jae 0x180108138
mov edi, r9d
mov rcx, qword [rbx + 0x38]
lea r8, [rsp + 0x30]
mov edx, 8
mov dword [rsp + 0x30], edi
call sym.ntdll.dll_NtSetInformationWorkerFactory
mov rcx, rbx
call fcn.1800593d8
lea rcx, [rbx + 0x48]
call sym.ntdll.dll_RtlReleaseSRWLockExclusive
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x1801089e0
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, rdx
mov rdi, rcx
and qword [rax + 0x20], 0
and qword [rax - 0x10], 0
mov rax, qword gs:[0x60]
mov r9, qword [rax + 0x18]
cmp byte [r9 + 0x48], 0
je 0x180108a1e
mov eax, 0xc0000001
jmp 0x180108b1d
test rdi, rdi
je 0x180108b18
test r8d, r8d
jne 0x180108b18
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.180058f2c
mov ebx, eax
mov dword [rsp + 0x20], eax
test eax, eax
js 0x180108b0a
cmp byte [0x180160908], 0
jne 0x180108ab6
lea rcx, [0x180160910]
call sym.ntdll.dll_RtlAcquireSRWLockExclusive
nop
cmp byte [0x180160908], 0
je 0x180108a71
xor ebx, ebx
mov dword [rsp + 0x20], ebx
jmp 0x180108aa6
lea r9, [0x180160928]
xor r8d, r8d
lea rdx, [0x180108f80]
xor ecx, ecx
call sym.ntdll.dll_LdrRegisterDllNotification
mov ebx, eax
mov dword [rsp + 0x20], eax
movzx eax, byte [0x180160908]
mov edx, 1
test ebx, ebx
cmovns eax, edx
mov byte [0x180160908], al
lea rcx, [0x180160910]
call sym.ntdll.dll_RtlReleaseSRWLockExclusive
test ebx, ebx
js 0x180108b0a
mov r8, rdi
mov rdx, rsi
lea rcx, [rsp + 0x28]
call fcn.180109100
mov ebx, eax
mov dword [rsp + 0x20], eax
test eax, eax
js 0x180108b0a
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x1720]
mov rdx, qword [rsp + 0x28]
mov qword [rdx + 0xa0], rcx
mov rax, qword gs:[0x30]
movups xmm0, xmmword [rax + 0x1710]
movdqu xmmword [rdx + 0xa8], xmm0
xor ebx, ebx
mov dword [rsp + 0x20], ebx
mov rcx, qword [rsp + 0x58]
call fcn.1800588b4
mov eax, ebx
jmp 0x180108b1d
mov eax, 0xc000000d
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x180108b64
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r12, r8
mov rsi, rdx
mov r15, rcx
and qword [rax + 0x20], 0
mov dword [rax - 0x28], 0xc0000001
and qword [rax - 0x20], 0
mov rcx, qword gs:[0x60]
mov edx, 8
mov r8d, 0xb8
mov rcx, qword [rcx + 0x30]
call sym.ntdll.dll_RtlAllocateHeap
mov rdi, rax
mov qword [rsp + 0x28], rax
test rax, rax
jne 0x180108bcb
mov ebx, 0xc0000017
jmp 0x180108c86
lea r8, [rsp + 0x68]
lea rdx, [0x18015d3b8]
lea rcx, [0x18015d3b0]
call fcn.180059230
mov ebx, eax
mov dword [rsp + 0x20], eax
test eax, eax
js 0x180108c8a
mov qword [rdi], rsi
lea rax, [0x180108d30]
mov qword [rdi + 0x40], rax
lea rsi, [rdi + 0x48]
lea r14, [rdi + 0x4c]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x180108c1e
mov r8, r14
mov rdx, rsi
call fcn.180024854
jmp 0x180108c25
and dword [rsi], 0
mov byte [r14], 0
and qword [rdi + 0x28], 0
lea rax, [rdi + 0x30]
mov qword [rax + 8], rax
mov qword [rax], rax
lea rax, [0x1801106c0]
mov qword [rdi + 8], rax
mov eax, dword [rsi]
mov dword [rdi + 0x10], eax
mov al, byte [r14]
mov byte [rdi + 0x14], al
mov rcx, qword [rsp + 0x68]
mov qword [rdi + 0x50], rcx
mov r8, rcx
lea rdx, [rdi + 8]
mov rcx, r12
call fcn.18005756c
mov ebx, eax
mov dword [rsp + 0x20], eax
test eax, eax
js 0x180108c8a
inc dword [rdi + 0x58]
lea rax, [rdi + 0x60]
mov qword [rax], rax
and qword [rax + 8], 0
and qword [rax + 0x10], 0
mov qword [r15], rdi
xor ebx, ebx
mov dword [rsp + 0x20], ebx
test ebx, ebx
jns 0x180108cbf
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x180108c9d
call fcn.1800484b8
test rdi, rdi
je 0x180108cbf
mov rcx, qword gs:[0x60]
mov r8, qword [rsp + 0x28]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call sym.ntdll.dll_RtlFreeHeap
mov ebx, dword [rsp + 0x20]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
Function at 0x180109384
Capabilities:
Enumerate pe sections

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov r8d, dword [rcx + 0x3c]
lea rbx, [rcx + 0x18]
add rbx, r8
xor edi, edi
mov r14, rdx
mov rsi, rcx
movzx eax, word [r8 + rcx + 0x14]
movzx ebp, word [r8 + rcx + 6]
add rbx, rax
test ebp, ebp
je 0x1801093e6
mov r8d, 8
lea rcx, str..sb_data
mov rdx, rbx
call sym.ntdll.dll__strnicmp
test eax, eax
je 0x180109403
inc edi
add rbx, 0x28
cmp edi, ebp
jb 0x1801093c3
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov eax, dword [rbx + 0x10]
mov edx, dword [rbx + 0xc]
add rdx, rsi
cmp dword [rbx + 8], eax
cmovbe eax, dword [rbx + 8]
mov ebx, eax
add rbx, rdx
jmp 0x180109468
cmp dword [rdx], 0x45734c6b
jne 0x180109464
mov r8, qword [rdx + 0x10]
test r8, r8
je 0x180109464
xor ecx, ecx
cmp dword [r8], ecx
jbe 0x180109464
mov eax, ecx
mov r9, r14
add rax, rax
mov rdi, qword [r8 + rax*8 + 8]
sub rdi, r14
movzx eax, word [r9]
movzx r10d, word [r9 + rdi]
sub eax, r10d
jne 0x180109459
add r9, 2
test r10d, r10d
jne 0x180109442
test eax, eax
je 0x180109472
inc ecx
cmp ecx, dword [r8]
jb 0x180109432
add rdx, 0x28
cmp rdx, rbx
jb 0x18010941a
jmp 0x1801093e6
inc rcx
add rcx, rcx
mov rax, qword [r8 + rcx*8]
jmp 0x1801093e8

Function at 0x18010a5c0
Capabilities:
Parse pe header

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x180
mov rax, qword [0x1801724e0]
xor rax, rsp
mov qword [rsp + 0x170], rax
xor eax, eax
mov rsi, r8
and qword [rsp + 0x20], rax
lea r8, [rsp + 0x30]
mov qword [rcx], rax
mov rdi, rdx
mov qword [rcx + 8], rax
mov rbx, rcx
mov qword [rcx + 0x10], rax
lea r9d, [rax + 0x40]
mov rcx, rdi
mov rdx, rsi
call sym.ntdll.dll_NtReadVirtualMemory
test eax, eax
js 0x18010a6a4
mov eax, 0x5a4d
cmp word [rsp + 0x30], ax
je 0x18010a627
mov eax, 0xc000012f
jmp 0x18010a6a4
movsxd rdx, dword [rsp + 0x6c]
lea r8, [rsp + 0x70]
and qword [rsp + 0x20], 0
add rdx, rsi
mov r9d, 0xf8
mov rcx, rdi
call sym.ntdll.dll_NtReadVirtualMemory
test eax, eax
js 0x18010a6a4
cmp dword [rsp + 0x70], 0x4550
je 0x18010a65d
mov eax, 0xc000007b
jmp 0x18010a6a4
movzx eax, word [rsp + 0x88]
cmp eax, 0x10b
je 0x18010a67d
cmp eax, 0x20b
jne 0x18010a656
mov rax, qword [rsp + 0xa0]
jmp 0x18010a684
mov eax, dword [rsp + 0xa4]
mov qword [rbx + 8], rax
mov eax, dword [rsp + 0x78]
mov dword [rbx], eax
mov eax, dword [rsp + 0xc0]
mov dword [rbx + 4], eax
mov eax, dword [rsp + 0xc8]
mov dword [rbx + 0x10], eax
xor eax, eax
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.18008b0e0
add rsp, 0x180
pop rdi
pop rsi
pop rbx
ret
Function at 0x14014e675
Capabilities:
Encode data using xor

Disassembly:
cmp dword [riz*8 - 0x7f10db77], esp
and al, 0xe5
and dword [rsp - 0x1b], edi
cmp dword [rax + riz - 0x1b], esi
sub dword [rax + rbp - 0x1b], ecx
and dword [rax + riz - 0x1f], eax
sub dword [rsp - 0x19], eax
and dword [rsp - 0x19], ecx
cmp dword [rsp - 0x19], esi
sub dword [rcx + riz - 0x1b], edi
lodsd eax, dword [rsi]
and eax, 0xe524a4e5
lodsd eax, dword [rsi]
test byte [rsi + rdx*4], cl
xchg edx, eax
xchg ebx, eax
and al, 0xef
test al, 0x4c
xor dword [rdi + 0x63420a0a], ebp
jae 0x14014e69f
insb byte [rdi], dx
insb byte [rdi], dx
insb byte [rdi], dx
insb byte [rdi], dx
insb byte [rdi], dx
invalid
Function at 0x140017434
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
cmp dword [0x1400211a8], 0
mov r14, rdx
mov r15, rcx
lea rbx, [0x1400211b8]
jne 0x140017481
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rcx, rbx
mov dword [0x1400211e0], eax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x1400211a8], 1
mov ecx, dword [0x1400211e0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbp, rax
test rax, rax
jne 0x140017556
mov rcx, qword [0x1400204bc]
lea edx, [rax + 8]
lea r8d, [rax + 0x28]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
je 0x140017581
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x1400211b0]
test rax, rax
je 0x1400174d1
mov qword [rax], rbp
mov rcx, rbx
mov qword [rbp + 8], rax
mov qword [0x1400211b0], rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
and dword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
lea r9, [rbp + 0x20]
mov r8, rdi
mov rcx, rax
mov rdx, rbx
mov dword [rsp + 0x20], 0x100000
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rdx, qword [rbp + 0x20]
lea rcx, [rbp + 0x18]
lea r8, [0x14001759c]
mov r9, rbp
mov dword [rsp + 0x28], 8
or dword [rsp + 0x20], 0xffffffff
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
mov ecx, dword [0x1400211e0]
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, qword [0x1400204bc]
xor edx, edx
lea r8d, [rdx + 0x18]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x140017581
mov qword [rax + 8], r15
mov qword [rax + 0x10], r14
mov rcx, qword [rbp + 0x10]
mov qword [rax], rcx
mov qword [rbp + 0x10], rax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret

Function at 0x14015e00a
Capabilities:
Encode data using xor

Disassembly:
lea rcx, [0x140138e40]
lea rsp, [rsp + 8]
push 0xffffffffc499c037
movzx esi, byte [rdx]
sal word [rsp + 6], 0x84
xor esi, eax
not word [rsp]
and esi, 0xff
shr qword [rsp], 0x30
mov esi, dword [rcx + rsi*4]
shr eax, 8
xor eax, esi
inc rdx
xor eax, 0x70881537
sar dword [rsp + 2], 0x2b
not word [rsp + 4]
dec rbx
lea rsp, [rsp + 8]
jne 0x14015e016
call fcn.14016c71d
Function at 0x1413a85f4
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [rsp + 2], r9w
push qword [rsp + 7]
jb 0x1413a8843
pop qword [rsp]
jmp 0x1413a86cc
mov word [rsp + 1], dx
push word [rsp + 6]
jmp 0x1413a8747
mov word [rsp + 1], dx
push word [rsp + 6]
call fcn.1413a86a0
lea rsp, [rsp + 3]
xchg qword [rsp + 8], rbx
pushfq
mov byte [rsp + 5], r11b
jmp 0x1413a8813
mov qword [rsp], rdi
lea rsp, [rsp + 7]
pushfq
lea rsp, [rsp + 1]
lea rbx, [rbx + riz + 0x1d]
call fcn.1413a878c
pop qword [rsp]
jmp 0x1413a873d

Function at 0x1413a86a0
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfq
mov byte [rsp + 9], r11b
push word [rsp + 6]
mov word [rsp + 0x11], bp
jmp 0x1413a8643
push rdi
push si
jp 0x1413a8624
pushfq
jmp 0x1413a8669
mov dword [rsp + 5], r9d
lea rsp, [rsp + 4]
mov qword [rsp + 0x28], r13
call fcn.1413a867f
push rbp
rol byte [rsi + 0x21], 1
rcl byte [rsi]
vpaddusw ymm12, ymm6, ymmword [rdi + rdx*2 - 0x4950a31f]
movabs eax, dword [reloc.steam_api64.dll_SteamAPI_RunCallbacks]
push qword [rsp + 6]
mov byte [rsp + 9], r11b
push word [rsp + 6]
mov word [rsp + 0x11], bp
mov dword [rsp + 5], r9d
jmp 0x1413a8648
push r12
call fcn.1413a86ee
push rbx
fmul dword [rsi + 0x29]
fcomp dword [rbx]
mov edi, 0x3fcca535
mov esp, dword [rdi + rdx*8 + reloc.steam_api64.dll_SteamAPI_RunCallbacks]
pop qword [rsp]
lea rsp, [rsp + 2]
mov qword [rsp + 0x20], r12
jmp 0x1413a863a

Function at 0x1413a8762
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfq
mov qword [rsp], r15
lea rsp, [rsp + 3]
pop word [rsp]
pushfq
jmp 0x1413a874c

Function at 0x1413a878c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [rsp + 0xa], r11b
lea rsp, [rsp + 8]
pop word [rsp + 2]
jmp 0x1413a87a9
push qword [rsp + 1]
jmp 0x1413a8773
lea rsp, [rsp + 6]
xchg qword [rsp + 0x10], rbx
push sp
mov byte [rsp], al
pushfq
call fcn.1413a8793

Function at 0x1413a8862
Capabilities:
Execute anti-debugging instructions

Disassembly:
bts rsi, rdi
jmp 0x1413a8887
dec bx
jp 0x1413a884c
bts rsi, rdi
jmp 0x1413a8887
lea rsp, [rsp + 5]
jmp 0x1413a88ba
lea r14, [rsp + 8]
mov cl, byte [rsp]
mov r13d, dword [rsp]
xchg esi, r9d
sub rsp, 5
jmp 0x1413a88d0
jne 0x1413a886d
lea rsp, [rsp + 5]
call fcn.1413a8977
sub ecx, dword [rdi + reloc.steam_api64.dll_SteamAPI_RunCallbacks]
movabs byte [0x482cdde320d1b620], al
lea esp, [rsp + 2]

Function at 0x1413a89b1
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov r9w, word [rsp + 2]
mov word [rsp], r14w
xchg r9, rdi
mov rdi, 0x15948505
jmp 0x1413a89e5
Function at 0x1413aa63a
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg r13b, bl
cmc
jmp 0x1413aa792
bswap ebx
mov ebx, r12d
sub rsp, 0x11
lea rsp, [rsp + 1]
jmp 0x1413aa66b
lea rsp, [rsp + 0x20]
dec r8b
lea r13, [r9*8]
jmp 0x1413aa6da
sub rsp, 0x11
lea rsp, [rsp + 1]
jmp 0x1413aa66b
bt r12w, sp
neg r15d
jmp 0x1413aa6ba
jmp 0x1413aa68c
bswap r9d
jmp 0x1413aa732
sub r8b, 0x54
clc
jg 0x1413aa6a4
bswap r9d
lea r14, [r13 + riz + 0x7c4e289a]
xchg edx, eax
rdtsc
not r9
jmp 0x1413aa713
bswap r14
mov esi, 0x2e3b4999
lea r13, [rbx*4]
mov edx, r12d
stc
je 0x1413aa6a2
bt r12w, sp
neg r15d
jmp 0x1413aa6ba
jmp 0x1413aa75a
not r9
add dil, r8b
bsr r8d, r14d
jae 0x1413aa6fa
mov r9, r8
lea r15, [rax + riz - 0x8e4f]
mov rdx, r14
jmp 0x1413aa73f
lea r14, [r13 + riz + 0x7c4e289a]
xchg edx, eax
rdtsc
jmp 0x1413aa710
inc rcx
call fcn.1413aa76a
and byte [rdx + rbp + 0x360bbc4d], dh
movabs eax, dword [reloc.steam_api64.dll_SteamAPI_RunCallbacks]
loop 0x1413aa77d
movabs dword [reloc.steam_api64.dll_SteamAPI_RunCallbacks], eax
jno 0x1413aa763
mov r9, r8
lea r15, [rax + riz - 0x8e4f]
mov rdx, r14
jmp 0x1413aa73f
invalid
dec dword [rcx - 0x75]
invalid
lea esp, [rsp + 2]
mov r13, qword [rsp]
btc rdx, r15
not si
jmp 0x1413aa7fa
jne 0x1413aa644
bswap ebx
mov ebx, r12d
jmp 0x1413aa681
mov r14d, 0x54a864a9
not r9b
call fcn.1413aa89f
jmp 0x1b2bd8f6e
mov rax, rsi
push rsi
xchg r12w, ax
rol r11b, 0
bt r9w, cx
jmp 0x1413aa810
ja 0x1413aa7e4
mov r14d, 0x54a864a9
not r9b
call fcn.1413aa859
movabs dword [reloc.steam_api64.dll_SteamAPI_RunCallbacks], eax
cld