joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001e990
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.14001a3fc
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14001ea1a
cmp byte [rbp - 0x21], r15b
je 0x14001ea15
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x14001ea50
call fcn.14001ca98
test eax, eax
jne 0x14001ea3c
cmp byte [rbp - 0x21], r15b
je 0x14001ea34
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x14001ea50
cmp byte [rbp - 0x21], r15b
je 0x14001ea4d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.1400199dc
test eax, eax
jne 0x14001eaf0
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.14001a3fc
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14001ea8f
cmp byte [rbp - 0x21], r15b
je 0x14001eac4
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x14001eac4
call fcn.14001ca98
test eax, eax
jne 0x14001eab0
cmp byte [rbp - 0x21], r15b
je 0x14001eaa9
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x14001eac4
cmp byte [rbp - 0x21], r15b
je 0x14001eac1
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.1400199dc
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x14001eaf0
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.kernel32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14001eaf3
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x14001eb01
mov rcx, rdi
call fcn.140018d5c
cmp byte [rbp + 0x3f], r15b
je 0x14001eb10
mov rcx, qword [rbp + 0x27]
call fcn.140018d5c
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x210041060
Capabilities:
Check for peb ntglobalflag flag
Contain obfuscated stackstrings
Get number of processors
Get process heap flags
Get process heap force flags
Parse pe header

Disassembly:
mov qword [rsp + 0x740], rax
mov dword [rsp + 0x448], 0xc65b962
mov dword [rsp + 0x44c], 0x7ddb2d19
mov dword [rsp + 0x450], 0xb7c24e93
mov dword [rsp + 0x454], 0x644af343
movabs rax, 0x8da850d5b7c46641
mov qword [rsp + 0x4a0], rax
mov qword [rsp + 0x2f0], 0
mov rax, qword gs:[0x30]
mov qword [rsp + 0x2f0], rax
mov dword [rsp + 0x498], 0xc42743d8
mov byte [rsp + 0x150], 0xda
movabs rax, 0x527a5195a954165c
mov qword [rsp + 0x4a8], rax
movabs rax, 0x169ca9e19eb85f8d
mov qword [rsp + 0x4b0], rax
movabs rax, 0xbadab64f2663cda2
mov qword [rsp + 0x4b8], rax
mov dword [rsp + 0x49c], 0xc7655cde
mov byte [rsp + 0x151], 0x47
movabs rax, 0x85e2d1cdd828a431
invalid
invalid
test byte [rax + rax*8], ah
add al, 0

Function at 0x210041290
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
add byte [rax + 0x6b], cl
rol byte [rdi], 0xc6
test byte [rax + riz*8], al
add dword [rax], eax
add byte [rdx], dh
mov dword [rsp + 0x310], 0x3c85bbff
mov dword [rsp + 0x314], 0x9de930f5
movabs rax, 0x5bdadbfed370d89c
mov qword [rsp + 0x4e8], rax
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x1e0], 0x2e
mov byte [rsp + 0x157], 0x7a
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x1e0], 0x44
movabs rax, 0x1bf443dcfe02a72d
invalid
invalid
test byte [rax + rsi*8], ah
add al, 0

Function at 0x2100413b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x54eddf8a
xor eax, 0x4819933d
mov dword [rsp + 0x508], eax
movabs rax, 0xb45dd03199c22f9a
mov qword [rsp + 0x510], rax
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x1e0], 0x43
movabs rax, 0x571e9423ee4a015c
mov qword [rsp + 0x518], rax
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x1e0], 0x6c
mov byte [rsp + 0x15b], 0x7f
movabs rax, 0x5f03abaa4737dbef
mov qword [rsp + 0x520], rax
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x1e0], 0x6f
movabs rax, 0xa93bb982e20db03a
mov qword [rsp + 0x528], rax
mov byte [rsp + 0x15c], 0x1b
movabs rax, 0x17c0caf040b15d6e
mov qword [rsp + 0x530], rax
invalid
invalid

Function at 0x210041560
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test byte [rax + riz*8], al
add dword [rax], eax
add byte [rax + rcx*2 - 0x48], ch
out dx, eax
jmp 0x286a3d7ce
Function at 0x2100416e0
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
mov byte [rsp + rax + 0x1e0], 0x61
mov byte [rsp + 0x166], 0x41
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x1e0], 0x74
movabs rax, 0xdd68401301f38821
mov qword [rsp + 0x590], rax
movabs rax, 0x8494766122fc17ea
mov qword [rsp + 0x598], rax
mov dword [rsp + 0x350], 0x4230a4a6
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x1e0], 0x65
movabs rax, 0x19438bd8da25bf9
mov qword [rsp + 0x5a0], rax
movabs rax, 0x16c84f68b2e0adcc
mov qword [rsp + 0x5a8], rax
movabs rax, 0xc1ef2acd20e90f3e
mov qword [rsp + 0x5b0], rax
mov dword [rsp + 0x354], 0xf3369b5e
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x1e0], 0x46
mov dword [rsp + 0x358], 0x9eb8074d
mov dword [rsp + 0x35c], 0x1555091f
movabs rax, 0x8edea61ce296b355
mov qword [rsp + 0x5b8], rax
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x1e0], 0x69
mov dword [rsp + 0x360], 0x8dd9bc57
mov dword [rsp + 0x364], 0x3650fc9e
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x1e0], 0x6c
movabs rax, 0x3b29976064beced9
mov qword [rsp + 0x5c0], rax
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x1e0], 0x65
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x1e0], 0x41
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x1e0], 0
mov byte [rsp + 0x167], 0x78
movabs rax, 0xda4ea7bdb8cade58
mov qword [rsp + 0x5c8], rax
lea rdx, [rsp + 0x1e0]
mov rcx, qword [rsp + 0x1b0]
mov rax, qword [rsp + 0x1a0]
call qword [rax + 0xb300]
mov qword [rsp + 0x468], rax
movabs rax, 0xaf1fb9233c272a2e
mov qword [rsp + 0x5d0], rax
mov byte [rsp + 0x168], 0x7b
mov dword [rsp + 0x368], 0xebb7dd7
movabs rax, 0x1578e99ed03852
mov qword [rsp + 0x5d8], rax
invalid
Function at 0x210041950
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add dword [rax], eax
add byte [rax], al
imul rax, rax, 5
mov byte [rsp + rax + 0x1e0], 0x64
mov byte [rsp + 0x16c], 0xa1
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x1e0], 0x75
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x1e0], 0x6c
movabs rax, 0xef53b2a189a9e3f0
mov qword [rsp + 0x5e8], rax
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x1e0], 0x65
mov byte [rsp + 0x16d], 0xc5
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x1e0], 0x46
mov dword [rsp + 0x378], 0x77bcc46e
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x1e0], 0x69
mov byte [rsp + 0x16e], 0xb
mov dword [rsp + 0x37c], 0x7c2cc9ea
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x1e0], 0x6c
mov eax, 1
imul rax, rax, 0xc
mov byte [rsp + rax + 0x1e0], 0x65
mov dword [rsp + 0x380], 0x1df74742
mov dword [rsp + 0x384], 0xb79da20c
mov eax, 1
imul rax, rax, 0xd
mov byte [rsp + rax + 0x1e0], 0x4e
mov dword [rsp + 0x388], 0xb4260155
mov byte [rsp + 0x16f], 0xe2
mov eax, 1
imul rax, rax, 0xe
mov byte [rsp + rax + 0x1e0], 0x61
mov dword [rsp + 0x38c], 0xbc4a32b8
mov byte [rsp + 0x170], 0x65
mov eax, 1
imul rax, rax, 0xf
mov byte [rsp + rax + 0x1e0], 0x6d
mov byte [rsp + 0x171], 5
mov eax, 1
imul rax, rax, 0x10
mov byte [rsp + rax + 0x1e0], 0x65
movabs rax, 0xa70d0dad4bd7490c
mov qword [rsp + 0x5f0], rax
mov dword [rsp + 0x390], 0x527cc0c
mov dword [rsp + 0x394], 0x4e094bcc
mov eax, 1
imul rax, rax, 0x11
mov byte [rsp + rax + 0x1e0], 0x41
mov byte [rsp + 0x172], 0x4a
mov dword [rsp + 0x398], 0xf8d6235b
mov dword [rsp + 0x39c], 0x8f06b82a
movabs rax, 0xa678b67ebd793983
mov qword [rsp + 0x5f8], rax
mov eax, 1
imul rax, rax, 0x12
mov byte [rsp + rax + 0x1e0], 0
mov dword [rsp + 0x3a0], 0xaebef6b
movabs rax, 0x3376cf2d421900ca
mov qword [rsp + 0x600], rax
movabs rax, 0x75eee282b574b3ee
mov qword [rsp + 0x608], rax
mov dword [rsp + 0x3a4], 0x78cba32f
mov dword [rsp + 0x3a8], 0x8a8ed553
lea rdx, [rsp + 0x1e0]
mov rcx, qword [rsp + 0x1b0]
mov rax, qword [rsp + 0x1a0]
call qword [rax + 0xb300]
mov qword [rsp + 0x460], rax
mov dword [rsp + 0x3ac], 0xb3cb376b
movabs rax, 0x2050dcd62c39f2a
mov qword [rsp + 0x610], rax
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x1e0], 0x52
mov dword [rsp + 0x3b0], 0x3624c341
mov dword [rsp + 0x3b4], 0x67bc73f6
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x1e0], 0x65
mov byte [rsp + 0x173], 0xf0
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x1e0], 0x61
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x1e0], 0x64
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x1e0], 0x46
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x1e0], 0x69
mov byte [rsp + 0x174], 0x24
invalid
invalid
invalid
Function at 0x2100db6f0
Capabilities:
Get thread local storage value

Disassembly:
push r12
sub rsp, 0x20
mov r12, rcx
mov ecx, dword [0x210318444]
call sym.TlsGetValue
mov rdx, r12
mov rcx, rax
add rsp, 0x20
pop r12
jmp method._cygtls.call_unsigned_int____void__void___void_

Function at 0x2100db720
Capabilities:
Check for peb ntglobalflag flag
Get number of processors
Parse pe header

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x758
cmp dword [rsp + 0x768], 1
je 0x210041056
movabs rax, 0xc9efee942df9b44b
mov qword [rsp + 0x538], rax
mov dword [rsp + 0x444], 0xffffbf6c
mov byte [rsp + 0x18f], 0x4f
mov byte [rsp + 0x19a], 0xfa
mov eax, 1
jmp 0x210042ce6
movabs rax, 0x805f1b6d6b0bfbc7
add rsp, 0x758
ret
jmp 0x210041005

Function at 0x2100e07a0
Capabilities:
Read file on windows

Disassembly:
push r14
push r13
push r12
push rsi
push rbx
sub rsp, 0x50
mov r12, rcx
mov r13, rdx
xor ecx, ecx
mov ebx, r8d
mov edx, 1
xor r8d, r8d
lea r14, [rsp + 0x30]
mov rsi, r9
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
call sym.CreateEventA
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov r8d, ebx
mov rdx, r13
mov rcx, r12
mov qword [rsp + 0x48], rax
call sym.ReadFile
test eax, eax
je 0x2100e0840
xor r9d, r9d
mov r8, rsi
mov rdx, r14
mov rcx, r12
call sym.GetOverlappedResult
mov rcx, qword [rsp + 0x48]
mov r12d, eax
call sym.CloseHandle
mov eax, r12d
add rsp, 0x50
pop rbx
pop rsi
pop r12
pop r13
pop r14
ret
call sym.GetLastError
cmp eax, 0x3e5
je 0x2100e0870
mov rcx, qword [rsp + 0x48]
xor r12d, r12d
call sym.CloseHandle
mov eax, r12d
add rsp, 0x50
pop rbx
pop rsi
pop r12
pop r13
pop r14
ret
mov edx, dword [rsp + 0xa0]
mov rcx, qword [rsp + 0x48]
call sym.WaitForSingleObject
test eax, eax
je 0x2100e0812
mov rcx, r12
call sym.CancelIo
jmp 0x2100e0812

Function at 0x2100e0890
Capabilities:
Write file on windows

Disassembly:
push r14
push r13
push r12
push rsi
push rbx
sub rsp, 0x50
mov r12, rcx
mov r13, rdx
xor ecx, ecx
mov ebx, r8d
mov edx, 1
xor r8d, r8d
lea r14, [rsp + 0x30]
mov rsi, r9
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
call sym.CreateEventA
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov r8d, ebx
mov rdx, r13
mov rcx, r12
mov qword [rsp + 0x48], rax
call sym.WriteFile
test eax, eax
je 0x2100e0930
xor r9d, r9d
mov r8, rsi
mov rdx, r14
mov rcx, r12
call sym.GetOverlappedResult
mov rcx, qword [rsp + 0x48]
mov r12d, eax
call sym.CloseHandle
mov eax, r12d
add rsp, 0x50
pop rbx
pop rsi
pop r12
pop r13
pop r14
ret
call sym.GetLastError
cmp eax, 0x3e5
je 0x2100e0960
mov rcx, qword [rsp + 0x48]
xor r12d, r12d
call sym.CloseHandle
mov eax, r12d
add rsp, 0x50
pop rbx
pop rsi
pop r12
pop r13
pop r14
ret
mov edx, dword [rsp + 0xa0]
mov rcx, qword [rsp + 0x48]
call sym.WaitForSingleObject
test eax, eax
je 0x2100e0902
mov rcx, r12
call sym.CancelIo
jmp 0x2100e0902
Function at 0x141160058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1411601df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141160089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14116006f
add dl, dl
jne 0x141160096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1411600f6
xor eax, eax
add dl, dl
jne 0x1411600a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1411601ad
add dl, dl
jne 0x1411600b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1411600c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1411600d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1411600dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1411600ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14116007e
mov eax, 1
add dl, dl
jne 0x141160106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141160113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1411600fb
sub eax, ebx
mov ebx, 1
jne 0x14116014c
mov ecx, 1
add dl, dl
jne 0x14116012e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14116013b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141160123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14116007e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141160168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141160175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14116015d
cmp eax, 0x7d00
jae 0x14116019b
cmp eax, 0x500
jb 0x141160196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14116007e
cmp eax, 0x7f
ja 0x14116019e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14116007e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1411601d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14116007e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x418140
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4182e6
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00437aa0
xorps xmm15, xmm15
mov r14, qword [0x005d07e8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x4181ab
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x4181c7
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
call fcn.00452180
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
sub rbx, rcx
test rbx, rbx
jbe 0x4181eb
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x4181ff
cmp rbx, 0x1000
jae 0x4181b5
jmp 0x418269
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x418211
xor edx, edx
jmp 0x418260
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00437aa0
xorps xmm15, xmm15
mov r14, qword [0x005d07e8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x4181f5
jmp 0x4181e0
call fcn.004685a0
xorps xmm15, xmm15
mov r14, qword [0x005d07e8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.0043c260
lea rax, [0x004eb9b5]
mov ebx, 0x18
call fcn.0043cb60
mov rax, qword [rsp + 0x38]
call fcn.0043c860
lea rax, [0x004eba75]
mov ebx, 0x19
call fcn.0043cb60
mov rax, qword [rsp + 0x30]
nop
call fcn.0043c860
call fcn.0043c4c0
call fcn.0043c2e0
lea rax, [0x004edd25]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.0043aa20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004649e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00418140
Function at 0x418320
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41854a
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00437b40
xorps xmm15, xmm15
mov r14, qword [0x005d07e8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x418399
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x4183c0
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rax, rcx
call fcn.00452180
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
sub rbx, rcx
mov rcx, rax
mov rax, qword [rsp + 0x68]
test rbx, rbx
jbe 0x4183e5
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x4183f9
cmp rbx, 0x1000
jae 0x4183a3
nop dword [rax]
jmp 0x418474
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x41840d
xor esi, esi
jmp 0x41846a
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00437b40
xorps xmm15, xmm15
mov r14, qword [0x005d07e8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x4183ef
jmp 0x4183d4
call fcn.004685a0
xorps xmm15, xmm15
mov r14, qword [0x005d07e8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x4184ec
call fcn.0043c260
lea rax, [0x004ebe5d]
mov ebx, 0x19
call fcn.0043cb60
mov rax, qword [rsp + 0x68]
call fcn.0043c860
lea rax, [0x004eba75]
mov ebx, 0x19
call fcn.0043cb60
mov eax, dword [rsp + 0x34]
call fcn.0043c860
call fcn.0043c4c0
call fcn.0043c2e0
lea rax, [0x004e89e6]
mov ebx, 0xd
call fcn.0043aa20
cmp eax, 0x5af
je 0x418497
call fcn.0043c260
lea rax, [0x004ebe5d]
mov ebx, 0x19
call fcn.0043cb60
mov rax, qword [rsp + 0x38]
call fcn.0043c860
lea rax, [0x004eba75]
mov ebx, 0x19
nop
call fcn.0043cb60
mov eax, dword [rsp + 0x34]
call fcn.0043c860
call fcn.0043c4c0
call fcn.0043c2e0
lea rax, [0x004ed639]
mov ebx, 0x1f
call fcn.0043aa20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004649e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00418320
Function at 0x4237a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42389e
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 8], 0
jmp 0x4237e0
mov rax, qword [rsp + 0x50]
mov rcx, rdx
mov rbx, qword [rsp + 0x58]
nop
cmp qword [rsp + 8], rbx
jae 0x42388f
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov rax, rcx
call fcn.00424300
nop dword [rax]
test rax, rax
je 0x42388f
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
lea rcx, [0x004238e0]
mov qword [rsp + 0x10], rcx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rbx, [rsp + 0x10]
mov qword [rsp], rbx
call fcn.004648a0
xorps xmm15, xmm15
mov r14, qword [0x005d07e8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x60]
test rdx, rdx
jne 0x42387d
xor eax, eax
jmp 0x423887
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x60]
test al, al
je 0x4237d2
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004649e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004237a0

Function at 0x45cbc0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45cc79
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rdx, [0x0045ccc0]
mov qword [rsp + 0x10], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x28], rdx
mov rdx, r14
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.004648a0
xorps xmm15, xmm15
mov r14, qword [0x005d07e8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004649e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0045cbc0