joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140045cc0
Capabilities:
Create directory
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
mov eax, 0x2050
call fcn.140057580
sub rsp, rax
mov rax, qword [0x14009b020]
xor rax, rsp
mov qword [rsp + 0x2040], rax
mov rbx, rdx
lea rax, [rsp + 0x1040]
mov rdi, rcx
mov qword [rsp + 0x20], rax
mov edx, 0x801c
xor ecx, ecx
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x140045e1e
mov qword [rsp + 0x2060], rsi
lea rax, [rsp + 0x1040]
xor esi, esi
mov qword [rsp + 0x38], rdi
mov r9d, 0x5c
mov dword [rdi + 0x200], esi
mov word [rsp + 0x30], r9w
mov rcx, 0xffffffffffffffff
inc rcx
cmp word [rax + rcx*2], si
jne 0x140045d43
mov eax, ecx
lea r8, [rsp + 0x1040]
mov dword [rdi + 0x200], ecx
lea r8, [r8 + rax*2]
lea rax, [rsp + 0x1040]
cmp rax, r8
je 0x140045da6
lea rcx, [rsp + 0x1040]
mov rdx, rdi
sub rdx, rcx
lea rax, [rsp + 0x1040]
nop dword [rax]
nop word [rax + rax]
movzx ecx, word [rax]
mov word [rdx + rax], cx
add rax, 2
cmp rax, r8
jne 0x140045d90
mov ecx, dword [rdi + 0x200]
test ecx, ecx
je 0x140045dc3
mov r8d, ecx
cmp word [rdi + r8*2 - 2], r9w
je 0x140045dc3
lea eax, [rcx + 1]
mov dword [rdi + 0x200], eax
mov word [rdi + r8*2], r9w
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.14000a9a0
mov ebx, dword [rdi + 0x200]
lea rcx, [rsp + 0x40]
mov rdx, rdi
lea r8d, [rbx + rbx]
call fcn.140058970
lea eax, [rbx + 1]
mov word [rsp + rbx*2 + 0x40], si
xor edx, edx
lea rcx, [rsp + 0x40]
mov word [rsp + rax*2 + 0x40], si
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rsi, qword [rsp + 0x2060]
test eax, eax
jne 0x140045e1a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140045e1e
mov al, 1
jmp 0x140045e20
xor al, al
mov rcx, qword [rsp + 0x2040]
xor rcx, rsp
call fcn.140056c70
mov rbx, qword [rsp + 0x2070]
add rsp, 0x2050
pop rdi
ret
Function at 0x140048590
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
movss xmm2, dword [rcx + 0x4c]
mov rbx, rcx
movss xmm0, dword [rcx + 0x48]
ucomiss xmm0, xmm2
mov r9, qword [rdx]
mov qword [rcx + 0x1c], r9
jp 0x140048613
jne 0x140048613
mov edx, dword [rcx + 0x18]
mov rax, r9
mov r8d, dword [rcx + 0x14]
shr rax, 0x20
add eax, edx
movd xmm1, edx
cvtdq2ps xmm1, xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
mulss xmm1, xmm2
mulss xmm0, xmm2
cvttss2si eax, xmm1
cvttss2si ecx, xmm0
movd xmm1, r8d
sub ecx, eax
mov eax, ecx
lea ecx, [r8 + r9]
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
shl rax, 0x20
cvtdq2ps xmm1, xmm1
mulss xmm0, xmm2
mulss xmm1, xmm2
cvttss2si edx, xmm0
cvttss2si ecx, xmm1
sub edx, ecx
mov ecx, edx
or rax, rcx
jmp 0x14004864a
xorps xmm0, xmm0
mov ecx, r9d
mov rax, r9
shr rax, 0x20
cvtsi2ss xmm0, rax
mulss xmm0, xmm2
cvttss2si rax, xmm0
xorps xmm0, xmm0
mov eax, eax
cvtsi2ss xmm0, rcx
shl rax, 0x20
mulss xmm0, xmm2
cvttss2si rdx, xmm0
mov edx, edx
or rax, rdx
mov r9, qword [rbx + 0x40]
movsxd r8, dword [0x1400a5164]
mov rcx, qword [r9 + 0x10]
movzx edx, word [rcx + r8*2]
mov qword [rdx + r9 + 0x20], rax
mov r9d, 0x80
mov rdx, qword [rbx + 0x40]
mov rcx, qword [rbx + 0x28]
call fcn.14004d250
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x140048c70
push rbx
sub rsp, 0x70
mov rax, qword [0x14009b020]
xor rax, rsp
mov qword [rsp + 0x68], rax
cmp qword [rcx + 8], 0
mov rbx, rcx
je 0x140048d85
test dword [rcx + 0x10], 0xf0000
je 0x140048d85
mov eax, dword [rcx + 0x1c]
lea r8, [rsp + 0x28]
mov dword [rsp + 0x28], eax
lea rdx, [rcx + 0x14]
mov eax, dword [rcx + 0x20]
mov dword [rsp + 0x2c], eax
call fcn.140048da0
mov r9d, 1
lea rdx, [rbx + 0x14]
mov rcx, rbx
xorps xmm2, xmm2
call fcn.140048690
movzx eax, byte [rsp + 0x20]
lea r9, [0x140048fc0]
mov rdx, qword [rbx + 0x40]
movsxd r10, dword [0x1400a5164]
mov byte [rsp + 0x28], al
movups xmm0, xmmword [rsp + 0x28]
mov qword [rsp + 0x60], r9
movups xmmword [rsp + 0x38], xmm0
movups xmm1, xmmword [rsp + 0x38]
movups xmmword [rsp + 0x48], xmm1
movsd xmm0, qword [rsp + 0x48]
movsd qword [rsp + 0x58], xmm0
mov rax, qword [rdx + 0x10]
movzx ecx, word [rax + r10*2]
mov rax, qword [rcx + rdx + 0x80]
mov rax, qword [rax + 0x38]
test rax, rax
je 0x140048d85
mov qword [rsp + 0x88], rdi
xor edi, edi
nop word [rax + rax]
lea rbx, [rax + 0x20]
movsxd rcx, r10d
test rbx, rbx
cmove rax, rdi
mov r8, qword [rax + 0x10]
mov rax, qword [r8 + 0x10]
movzx edx, word [rax + rcx*2]
lea rcx, [rsp + 0x38]
mov rdx, qword [rdx + r8 + 0x10]
call r9
mov rax, qword [rbx]
test rax, rax
je 0x140048d7d
mov r9, qword [rsp + 0x60]
mov r10d, dword [0x1400a5164]
jmp 0x140048d40
mov rdi, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140056c70
add rsp, 0x70
pop rbx
ret
Function at 0x140048a60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rdx + 0x10]
mov rbx, rdx
movss xmm1, dword [0x140087b6c]
mov r11, rcx
movss xmm2, dword [rax]
mov rax, qword [rdx + 0x20]
mov qword [rcx + 8], rax
mov eax, dword [rdx + 0x2c]
mov dword [rcx + 0x10], eax
mov rax, qword [rdx + 0x30]
mov qword [rcx + 0x14], rax
mov rax, qword [rdx + 0x3c]
mov qword [rcx + 0x1c], rax
mov rax, qword [rdx]
mov qword [rcx + 0x28], rax
mov rax, qword [rdx + 8]
mov qword [rcx + 0x30], rax
mov rax, qword [rdx + 0x10]
mov qword [rcx + 0x38], rax
mov rdx, qword [rdx + 0x18]
mov qword [rcx + 0x40], rdx
test byte [rbx + 0x2c], 0x40
je 0x140048acd
movaps xmm0, xmm1
jmp 0x140048ad0
movaps xmm0, xmm2
movss dword [rcx + 0x48], xmm0
test byte [rbx + 0x2c], 0x80
jne 0x140048ade
movaps xmm1, xmm2
movss dword [rcx + 0x4c], xmm1
mov rax, qword [rdx + 0x10]
movsxd rcx, dword [0x1400a5164]
movzx edi, word [rax + rcx*2]
mov rax, qword [rbx + 0x20]
add rdi, rdx
test rax, rax
je 0x140048b2f
mov rax, qword [rax + 0x40]
mov qword [rdi], rax
test dword [rbx + 0x2c], 0xf0000
je 0x140048b2f
mov eax, dword [r11 + 0x1c]
lea r8, [rsp + 0x30]
mov dword [rsp + 0x30], eax
lea rdx, [r11 + 0x14]
mov eax, dword [r11 + 0x20]
mov rcx, r11
mov dword [rsp + 0x34], eax
call fcn.140048da0
mov qword [rdi + 0x10], r11
mov eax, dword [rbx + 0x28]
mov dword [rdi + 8], eax
movd xmm0, dword [r11 + 0x14]
cvtdq2ps xmm0, xmm0
mulss xmm0, dword [r11 + 0x48]
cvttss2si eax, xmm0
movd xmm0, dword [r11 + 0x18]
mov dword [rsp + 0x30], eax
cvtdq2ps xmm0, xmm0
mulss xmm0, dword [r11 + 0x48]
cvttss2si eax, xmm0
mov dword [rsp + 0x34], eax
mov rax, qword [rsp + 0x30]
mov qword [rdi + 0x18], rax
mov eax, dword [rbx + 0x38]
mov dword [rdi + 0x28], eax
movss xmm2, dword [r11 + 0x4c]
movss xmm0, dword [r11 + 0x48]
ucomiss xmm0, xmm2
jp 0x140048bec
jne 0x140048bec
mov edx, dword [r11 + 0x18]
mov ecx, dword [r11 + 0x20]
mov r8d, dword [r11 + 0x14]
add ecx, edx
movd xmm1, edx
mov edx, dword [r11 + 0x1c]
movd xmm0, ecx
add edx, r8d
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
mulss xmm0, xmm2
mulss xmm1, xmm2
cvttss2si ecx, xmm0
cvttss2si eax, xmm1
movd xmm0, edx
sub ecx, eax
movd xmm1, r8d
mov eax, ecx
cvtdq2ps xmm0, xmm0
shl rax, 0x20
cvtdq2ps xmm1, xmm1
mulss xmm0, xmm2
mulss xmm1, xmm2
cvttss2si edx, xmm0
cvttss2si ecx, xmm1
sub edx, ecx
mov ecx, edx
or rax, rcx
jmp 0x140048c21
mov eax, dword [r11 + 0x20]
xorps xmm0, xmm0
mov ecx, dword [r11 + 0x1c]
cvtsi2ss xmm0, rax
mulss xmm0, xmm2
cvttss2si rax, xmm0
xorps xmm0, xmm0
mov eax, eax
cvtsi2ss xmm0, rcx
shl rax, 0x20
mulss xmm0, xmm2
cvttss2si rdx, xmm0
mov edx, edx
or rax, rdx
mov qword [rdi + 0x20], rax
mov qword [rdi + 0x70], r11
mov eax, dword [rbx + 0x2c]
test al, 1
je 0x140048c37
mov byte [rdi + 0x2d], 1
mov eax, dword [rbx + 0x2c]
test al, 4
je 0x140048c42
mov byte [rdi + 0x2e], 1
mov eax, dword [rbx + 0x2c]
test al, 8
je 0x140048c4a
mov byte [rdi + 0x2f], 1
mov rdx, qword [r11 + 0x40]
mov rcx, qword [r11 + 0x28]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.14004ce80
Function at 0x14004a930
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rdx]
cmp byte [rcx], 1
je 0x14004a949
xor al, al
add rsp, 0x20
pop rbx
ret
cmp byte [rcx + 2], 0
mov qword [rsp + 0x30], rbp
jne 0x14004aa1b
cmp byte [rcx + 8], 0
je 0x14004a977
mov bpl, 1
mov byte [rbx + 0x91], 1
movzx eax, bpl
mov rbp, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
cmp byte [rbx + 0x91], 0
je 0x14004aa1b
movzx edx, byte [rbx + 0x90]
mov r8b, 1
xor dl, 1
mov qword [rsp + 0x40], rsi
mov rcx, rbx
mov byte [rbx + 0x91], 0
call fcn.14004a890
movzx eax, byte [rbx + 0x90]
lea rsi, [rbx + 0x68]
inc dword [rsi]
xor bpl, bpl
mov rbx, qword [rsi + 8]
mov byte [rsp + 0x38], al
test rbx, rbx
je 0x14004a9fd
mov qword [rsp + 0x48], rdi
mov rdi, qword [rsi + 0x10]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14004a9eb
mov rax, qword [rcx]
lea rdx, [rsp + 0x38]
mov r8, qword [rbx + 0x18]
call qword [rax]
test al, al
jne 0x14004a9f5
cmp rbx, rdi
je 0x14004a9f8
mov rbx, qword [rbx]
jmp 0x14004a9d0
mov bpl, 1
mov rdi, qword [rsp + 0x48]
dec dword [rsi]
mov rcx, rsi
call fcn.140001c10
mov rsi, qword [rsp + 0x40]
movzx eax, bpl
mov rbp, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
xor bpl, bpl
movzx eax, bpl
mov rbp, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret

Function at 0x14004aaa0
Capabilities:
Get keyboard layout
Log keystrokes via polling
Register raw input devices

Disassembly:
push rdi
sub rsp, 0x20
cmp byte [rdx], 0
mov rdi, rcx
je 0x14004ab44
mov rax, qword [rcx + 0x28]
mov edx, 1
add rcx, 0xa0
mov r8, qword [rax + 0x70]
mov eax, 6
mov word [rcx], dx
mov qword [rdi + 0xa8], r8
mov qword [rdi + 0xb8], r8
lea edx, [rax - 4]
mov word [rdi + 0xa2], ax
lea r8d, [rax + 0xa]
mov dword [rdi + 0xa4], 0x100
mov dword [rdi + 0xb0], 0x20001
mov dword [rdi + 0xb4], 0x100
call qword [sym.imp.USER32.dll_RegisterRawInputDevices]
cmp eax, 1
je 0x14004ab3d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x17f
lea rdx, str.engine::input::WindowDriver::_InitializeRawInput
mov r9d, eax
lea rcx, str.FAIL:__s:_u_CODE:_x
call fcn.140044d80
xor al, al
add rsp, 0x20
pop rdi
ret
mov byte [rdi + 0x9d], 1
mov qword [rsp + 0x30], rbx
xor ecx, ecx
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], r14
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov ebx, 0x20
mov ebp, 0x600
mov rsi, rax
mov r14d, 0xff
mov rdx, rsi
movzx ecx, bx
call qword [sym.imp.USER32.dll_VkKeyScanExW]
cmp ax, 0xffff
je 0x14004ab94
and ax, bp
cmp ax, bp
jne 0x14004ab94
mov byte [rdi + 0xc0], 1
inc bx
cmp bx, r14w
jbe 0x14004ab73
mov r14, qword [rsp + 0x48]
mov al, 1
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov byte [rdi + 0x30], 1
add rsp, 0x20
pop rdi
ret
Function at 0x14004b470
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x14009b020]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov eax, 0xe0
movzx r15d, r9b
movzx r14d, r8b
mov rsi, rcx
cmp dx, ax
jae 0x14004b607
movzx eax, dx
lea rcx, str.674I35GHFEJLKMCD
movzx edi, byte [rax + rcx]
cmp dil, 0x5e
je 0x14004b607
xor ebp, ebp
lea ecx, [rbp + 0x12]
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 7
test al, 1
je 0x14004b4f2
cmp byte [rsi + 0xc0], bpl
je 0x14004b4ed
mov ecx, 0xa5
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 7
test al, 1
jne 0x14004b607
mov ebp, 2
mov ecx, 0x11
mov qword [rsp + 0x48], rbx
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 7
mov ebx, ebp
or ebx, 1
mov ecx, 0x10
and al, 1
cmove ebx, ebp
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, ebx
mov byte [rdi + rsi + 0x3c], r14b
or ecx, 4
shr eax, 7
and al, 1
cmove ecx, ebx
cmp ecx, 1
jne 0x14004b587
cmp dil, 0x18
je 0x14004b592
inc dword [rsi + 8]
xor bpl, bpl
mov rbx, qword [rsi + 0x10]
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x29], r15b
mov byte [rsp + 0x2a], dil
mov dword [rsp + 0x2c], ecx
mov byte [rsp + 0x30], r14b
test rbx, rbx
je 0x14004b5d9
mov rdi, qword [rsi + 0x18]
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14004b57d
mov rax, qword [rcx]
lea rdx, [rsp + 0x28]
mov r8, qword [rbx + 0x18]
call qword [rax]
test al, al
jne 0x14004b5d6
cmp rbx, rdi
je 0x14004b5d9
mov rbx, qword [rbx]
jmp 0x14004b562
cmp ecx, 4
jne 0x14004b537
cmp dil, 0x43
jne 0x14004b537
inc dword [rsi + 8]
xor bpl, bpl
mov rbx, qword [rsi + 0x10]
mov word [rsp + 0x20], 0x305
mov byte [rsp + 0x22], 0
test rbx, rbx
je 0x14004b5d9
mov rdi, qword [rsi + 0x18]
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14004b5cc
mov rax, qword [rcx]
lea rdx, [rsp + 0x20]
mov r8, qword [rbx + 0x18]
call qword [rax]
test al, al
jne 0x14004b5d6
cmp rbx, rdi
je 0x14004b5d9
mov rbx, qword [rbx]
jmp 0x14004b5b1
mov bpl, 1
dec dword [rsi + 8]
lea rcx, [rsi + 8]
call fcn.140001c10
mov rbx, qword [rsp + 0x48]
movzx eax, bpl
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140056c70
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
xor al, al
jmp 0x14004b5ee
Function at 0x14004b610
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push rsi
push rdi
push r14
sub rsp, 0x48
mov rax, qword [0x14009b020]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rsi, rcx
movzx ebp, dl
xor edi, edi
movzx r14d, r8b
lea ecx, [rdi + 0x12]
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 7
test al, 1
je 0x14004b66c
cmp byte [rsi + 0xc0], dil
je 0x14004b667
mov ecx, 0xa5
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 7
test al, 1
je 0x14004b667
xor al, al
jmp 0x14004b70d
mov edi, 2
mov ecx, 0x11
mov qword [rsp + 0x40], rbx
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 7
mov ebx, edi
or ebx, 1
mov ecx, 0x10
and al, 1
cmove ebx, edi
call qword [sym.imp.USER32.dll_GetKeyState]
mov byte [rbp + rsi + 0x3c], r14b
mov ecx, ebx
or ecx, 4
shr eax, 7
and al, 1
mov byte [rsp + 0x22], bpl
mov word [rsp + 0x20], 0x101
cmove ecx, ebx
mov byte [rsp + 0x28], r14b
inc dword [rsi + 8]
xor bpl, bpl
mov rbx, qword [rsi + 0x10]
mov dword [rsp + 0x24], ecx
test rbx, rbx
je 0x14004b6f8
mov rdi, qword [rsi + 0x18]
nop
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14004b6eb
mov rax, qword [rcx]
lea rdx, [rsp + 0x20]
mov r8, qword [rbx + 0x18]
call qword [rax]
test al, al
jne 0x14004b6f5
cmp rbx, rdi
je 0x14004b6f8
mov rbx, qword [rbx]
jmp 0x14004b6d0
mov bpl, 1
dec dword [rsi + 8]
lea rcx, [rsi + 8]
call fcn.140001c10
mov rbx, qword [rsp + 0x40]
movzx eax, bpl
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140056c70
add rsp, 0x48
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x140052aa0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x178
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x26
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x198]
lea rcx, [0x1400d2014]
call fcn.1400574b0
mov rax, qword [rbp + 0x178]
sub rax, 0x10000
mov rcx, rax
call fcn.140052d40
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x170]
cmp qword [rbp + 8], rax
jbe 0x140052bc7
mov rax, qword [section..data]
cmp qword [rbp + 8], rax
jb 0x140052b31
mov rax, qword [0x14009b008]
cmp qword [rbp + 8], rax
ja 0x140052b31
mov rax, qword [rbp + 8]
sub rax, 0x8000000
mov qword [rbp + 8], rax
jmp 0x140052af6
mov r8d, 0x30
xor edx, edx
lea rcx, [rbp + 0x28]
call fcn.140059020
mov r8d, 0x30
lea rdx, [rbp + 0x28]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x140052b5d
jmp 0x140052bc7
cmp dword [rbp + 0x48], 0x10000
jne 0x140052bac
cmp qword [rbp + 0x40], 0x10000
jb 0x140052bac
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0x78], rax
cmp qword [rbp + 0x78], 0
je 0x140052b9c
mov rax, qword [rbp + 0x78]
jmp 0x140052bc9
mov rax, qword [rbp + 8]
sub rax, 0x10000
mov qword [rbp + 8], rax
jmp 0x140052bc2
mov rax, qword [rbp + 0x30]
sub rax, 0x10000
mov rcx, rax
call fcn.140052d40
mov qword [rbp + 8], rax
jmp 0x140052af6
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, reloc.d2d1.dll_Ordinal_1
call fcn.14005743c
mov rax, rdi
lea rsp, [rbp + 0x158]
pop rdi
pop rbp
ret
Function at 0x140052bf0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x178
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x26
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x198]
lea rcx, [0x1400d2014]
call fcn.1400574b0
mov rcx, qword [rbp + 0x170]
call fcn.140052da0
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x178]
cmp qword [rbp + 8], rax
jae 0x140052d12
mov rax, qword [section..data]
cmp qword [rbp + 8], rax
jb 0x140052c78
mov rax, qword [0x14009b008]
cmp qword [rbp + 8], rax
ja 0x140052c78
mov rax, qword [rbp + 8]
add rax, 0x8000000
mov qword [rbp + 8], rax
jmp 0x140052c3d
mov r8d, 0x30
xor edx, edx
lea rcx, [rbp + 0x28]
call fcn.140059020
mov r8d, 0x30
lea rdx, [rbp + 0x28]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x140052ca4
jmp 0x140052d12
cmp dword [rbp + 0x48], 0x10000
jne 0x140052cf3
cmp qword [rbp + 0x40], 0x10000
jb 0x140052cf3
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0x78], rax
cmp qword [rbp + 0x78], 0
je 0x140052ce3
mov rax, qword [rbp + 0x78]
jmp 0x140052d14
mov rax, qword [rbp + 8]
add rax, 0x10000
mov qword [rbp + 8], rax
jmp 0x140052d0d
mov rax, qword [rbp + 0x40]
mov rcx, qword [rbp + 0x28]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.140052da0
mov qword [rbp + 8], rax
jmp 0x140052c3d
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, reloc.d2d1.dll_Ordinal_1
call fcn.14005743c
mov rax, rdi
lea rsp, [rbp + 0x158]
pop rdi
pop rbp
ret
Function at 0x140053fa0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x36
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1d8]
lea rcx, [0x1400d2014]
call fcn.1400574b0
mov r8d, 0x30
lea rdx, [rbp + 8]
mov rcx, qword [rbp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
nop
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x58], rax
mov rax, qword [rbp + 0x58]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140054012
xor al, al
jmp 0x1400540a9
mov rax, qword [rbp + 0x58]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rbp + 0x58]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x78], rax
mov rax, qword [rbp + 0x78]
cmp dword [rax], 0x4550
je 0x140054038
xor al, al
jmp 0x1400540a9
mov eax, 8
imul rax, rax, 0xc
mov rcx, qword [rbp + 0x78]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rbp + 0x58]
add rcx, rax
mov rax, rcx
cmp qword [rbp + 0x1b8], rax
jb 0x1400540a1
mov eax, 8
imul rax, rax, 0xc
mov rcx, qword [rbp + 0x78]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rbp + 0x58]
add rcx, rax
mov rax, rcx
mov ecx, 8
imul rcx, rcx, 0xc
mov rdx, qword [rbp + 0x78]
mov ecx, dword [rdx + rcx + 0x8c]
add rax, rcx
cmp qword [rbp + 0x1b8], rax
jae 0x1400540a1
mov al, 1
jmp 0x1400540a9
jmp 0x1400540a7
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, reloc.d2d1.dll_Ordinal_1
call fcn.14005743c
mov rax, rdi
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret

Function at 0x1400540d0
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x20]
lea rcx, [0x1400d2014]
call fcn.1400574b0
mov rax, qword [rbp + 0x160]
cmp dword [rax], 0x52727464
je 0x140054105
xor eax, eax
jmp 0x140054194
mov rax, qword [rbp + 0x160]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
add rax, 0x10000
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x160]
add rax, 0x60
mov qword [rbp + 0x48], rax
mov dword [rbp + 0x64], 0
jmp 0x14005413e
mov eax, dword [rbp + 0x64]
inc eax
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0x2a9
jae 0x14005418f
movsxd rax, dword [rbp + 0x64]
imul rax, rax, 0x60
mov rcx, qword [rbp + 0x48]
cmp qword [rcx + rax + 0x48], 0
je 0x14005418d
movsxd rax, dword [rbp + 0x64]
imul rax, rax, 0x60
mov rcx, qword [rbp + 0x48]
mov rdx, qword [rbp + 8]
cmp qword [rcx + rax + 0x48], rdx
jb 0x140054189
movsxd rax, dword [rbp + 0x64]
imul rax, rax, 0x60
mov rcx, qword [rbp + 0x48]
mov rdx, qword [rbp + 0x28]
cmp qword [rcx + rax + 0x48], rdx
jb 0x14005418d
xor eax, eax
jmp 0x140054194
jmp 0x140054136
mov eax, 1
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret
Function at 0x140054450
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x12
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
lea rcx, [0x1400d2014]
call fcn.1400574b0
mov rax, qword [0x1400a3d20]
mov qword [rbp + 8], rax
jmp 0x140054495
mov rax, qword [rbp + 8]
mov rax, qword [rax + 8]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
je 0x1400544c3
lea r9, [rbp + 0x24]
mov r8d, 0x40
mov edx, 0x10000
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400544c1
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400544c5
jmp 0x140054489
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, reloc.d2d1.dll_Ordinal_1
call fcn.14005743c
mov rax, rdi
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x140054ea0
Capabilities:
Resume thread

Disassembly:
push rbp
push rdi
sub rsp, 0x1c8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x3a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
lea rcx, [0x1400d2014]
call fcn.1400574b0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x1400a3d38], eax
je 0x140054ee4
mov eax, 0x10dd
jmp 0x140055002
mov rax, qword [0x1400a3d50]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
je 0x140054f84
mov rax, qword [rbp + 8]
mov rax, qword [rax + 0x20]
movzx eax, byte [rax + 0x3e]
lea r9, [rbp + 0x24]
mov rcx, qword [rbp + 8]
mov r8d, dword [rcx + 0x28]
mov edx, eax
mov rax, qword [rbp + 8]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, qword [rbp + 8]
cmp dword [rax + 8], 0
jne 0x140054f50
mov rax, qword [rbp + 8]
cmp qword [rax + 0x20], 0
je 0x140054f50
mov rax, qword [rbp + 8]
mov rcx, qword [rax + 0x20]
call fcn.140053570
mov rax, qword [rbp + 8]
mov qword [rax + 0x20], 0
mov rax, qword [rbp + 8]
mov rax, qword [rax]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x168], rax
mov edx, 0x30
mov rcx, qword [rbp + 0x168]
call fcn.140056c90
mov rax, qword [rbp + 0x48]
mov qword [rbp + 8], rax
jmp 0x140054eef
mov qword [0x1400a3d50], 0
call fcn.1400541a0
mov rax, qword [0x1400a3d48]
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0
je 0x140054feb
mov rax, qword [rbp + 0x68]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rax, qword [rbp + 0x68]
mov rax, qword [rax]
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 0x68]
mov qword [rbp + 0x188], rax
mov edx, 0x10
mov rcx, qword [rbp + 0x188]
call fcn.140056c90
mov rax, qword [rbp + 0x88]
mov qword [rbp + 0x68], rax
jmp 0x140054f9f
mov qword [0x1400a3d48], 0
mov dword [0x1400a3d38], 0
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, reloc.d2d1.dll_Ordinal_1
call fcn.14005743c
mov rax, rdi
lea rsp, [rbp + 0x1a8]
pop rdi
pop rbp
ret