joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140012160
Capabilities:
Hash data with crc32
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rdi
push r12
push r14
sub rsp, 0x58
or ebx, 0xffffffff
xor r12d, r12d
mov r14, r8
mov edi, 0x80000
test rcx, rcx
je 0x1400123cb
mov qword [rsp + 0x30], r12
lea r8d, [r12 + 1]
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x28], pe_nt_image_headers64
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x1400123c6
mov rcx, qword [0x14001ca14]
xor edx, edx
mov r8d, edi
mov qword [rsp + 0x48], r13
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r13, rax
test rax, rax
je 0x1400123b8
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0x50], rsi
test rax, rax
jle 0x140012213
lea r8, [rsp + 0x8c]
xor r9d, r9d
mov edx, eax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea ebp, [r14 + 0x80000]
lea rsi, [0x140019d10]
add r12d, 0x80000
sub ebp, 0x80000
cmp r14, 0xffffffffffffffff
je 0x14001223d
movsxd rax, r12d
cmp rax, r14
cmovg edi, ebp
lea r9, [rsp + 0x80]
mov r8d, edi
mov rdx, r13
mov rcx, r15
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r10d, dword [rsp + 0x80]
mov r11, r13
mov r9d, r10d
cmp r10d, 8
jb 0x14001236b
mov esi, r10d
lea r10, [0x140019d10]
shr rsi, 3
nop word [rax + rax]
movzx ecx, byte [r11]
mov eax, ebx
shr ebx, 8
xor rcx, rax
add r11, 8
add r9d, 0xfffffff8
movzx eax, cl
movzx ecx, byte [r11 - 7]
mov edx, dword [r10 + rax*4]
xor edx, ebx
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 6]
mov r8d, dword [r10 + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 5]
mov edx, dword [r10 + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 4]
mov r8d, dword [r10 + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 3]
mov edx, dword [r10 + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 2]
mov r8d, dword [r10 + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 1]
mov edx, dword [r10 + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
mov ebx, dword [r10 + rax*4]
xor ebx, edx
dec rsi
jne 0x140012290
mov r10d, dword [rsp + 0x80]
lea rsi, [0x140019d10]
test r9d, r9d
je 0x14001238c
movzx ecx, byte [r11]
mov eax, ebx
inc r11
xor rcx, rax
shr eax, 8
movzx edx, cl
mov ebx, dword [rsi + rdx*4]
xor ebx, eax
dec r9d
jne 0x140012370
cmp r10d, 0x80000
je 0x140012221
mov rcx, qword [0x14001ca14]
mov r8, r13
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x90]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r13, qword [rsp + 0x48]
mov r15, qword [rsp + 0x40]
not ebx
movsxd rax, ebx
add rsp, 0x58
pop r14
pop r12
pop rdi
pop rbx
ret
or r8, 0xffffffffffffffff
xor edx, edx
jmp 0x140012160
Function at 0x1400123e0
Capabilities:
Encode data using xor
Hash data with crc32
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rdi
push r12
push r14
sub rsp, 0x58
or ebx, 0xffffffff
xor r12d, r12d
mov r14, r8
mov edi, 0x80000
test rcx, rcx
je 0x1400123cb
mov qword [rsp + 0x30], r12
lea r8d, [r12 + 1]
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x28], pe_nt_image_headers64
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x1400123c6
mov rcx, qword [0x14001ca14]
xor edx, edx
mov r8d, edi
mov qword [rsp + 0x48], r13
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r13, rax
test rax, rax
je 0x1400123b8
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0x50], rsi
test rax, rax
jle 0x140012213
lea r8, [rsp + 0x8c]
xor r9d, r9d
mov edx, eax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea ebp, [r14 + 0x80000]
lea rsi, [0x140019d10]
add r12d, 0x80000
sub ebp, 0x80000
cmp r14, 0xffffffffffffffff
je 0x14001223d
movsxd rax, r12d
cmp rax, r14
cmovg edi, ebp
lea r9, [rsp + 0x80]
mov r8d, edi
mov rdx, r13
mov rcx, r15
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r10d, dword [rsp + 0x80]
mov r11, r13
mov r9d, r10d
cmp r10d, 8
jb 0x14001236b
mov esi, r10d
lea r10, [0x140019d10]
shr rsi, 3
nop word [rax + rax]
movzx ecx, byte [r11]
mov eax, ebx
shr ebx, 8
xor rcx, rax
add r11, 8
add r9d, 0xfffffff8
movzx eax, cl
movzx ecx, byte [r11 - 7]
mov edx, dword [r10 + rax*4]
xor edx, ebx
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 6]
mov r8d, dword [r10 + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 5]
mov edx, dword [r10 + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 4]
mov r8d, dword [r10 + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 3]
mov edx, dword [r10 + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 2]
mov r8d, dword [r10 + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 1]
mov edx, dword [r10 + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
mov ebx, dword [r10 + rax*4]
xor ebx, edx
dec rsi
jne 0x140012290
mov r10d, dword [rsp + 0x80]
lea rsi, [0x140019d10]
test r9d, r9d
je 0x14001238c
movzx ecx, byte [r11]
mov eax, ebx
inc r11
xor rcx, rax
shr eax, 8
movzx edx, cl
mov ebx, dword [rsi + rdx*4]
xor ebx, eax
dec r9d
jne 0x140012370
cmp r10d, 0x80000
je 0x140012221
mov rcx, qword [0x14001ca14]
mov r8, r13
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x90]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r13, qword [rsp + 0x48]
mov r15, qword [rsp + 0x40]
not ebx
movsxd rax, ebx
add rsp, 0x58
pop r14
pop r12
pop rdi
pop rbx
ret
or r8, 0xffffffffffffffff
xor edx, edx
jmp 0x140012160
Function at 0x140003bb0
Capabilities:
Accept command line arguments

Disassembly:
jmp 0x140003bb0
push rbx
sub rsp, 0x190
mov rax, qword [0x140042258]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov rbx, rcx
lea rcx, str.Entering_WinMain___n
call fcn.140004ea0
test rbx, rbx
je 0x140003d6a
mov qword [rsp + 0x1a0], rdi
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea rcx, str.CommandLine:__s_n
mov rdx, rax
call fcn.140004ea0
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.140001082
mov rdi, rax
test rax, rax
jne 0x140003c2f
lea rcx, str.ERROR:_Failed_to_parse_command_line._n
call fcn.140004ea0
lea ebx, [rdi + 2]
jmp 0x140003d44
mov ecx, dword [rsp + 0x30]
mov rdx, rax
call fcn.1400017b0
test eax, eax
je 0x140003d1c
cmp dword [0x140043d60], 0
je 0x140003d1c
mov rcx, qword [0x140042010]
lea r8, [rsp + 0x70]
xor r9d, r9d
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
cmp eax, 0x104
jb 0x140003c8e
mov rdx, qword [0x140042010]
lea rcx, str.ERROR:_INF_file_name___s__is_too_long._n
call fcn.140004ea0
mov ebx, 3
jmp 0x140003d3c
xor ebx, ebx
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x38]
lea r9d, [rbx + 0x20]
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.SETUPAPI.dll_SetupDiGetINFClassA]
test eax, eax
jne 0x140003ccd
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_0x_X_:_Failed_to_get_class_from_INF_file._n
mov edx, eax
call fcn.140004ea0
mov ebx, 2
jmp 0x140003d3c
lea rax, [rsp + 0x38]
lea rcx, [0x1400387c0]
mov rdx, qword [rax]
cmp rdx, qword [rcx]
jne 0x140003ceb
mov rdx, qword [rax + 8]
cmp rdx, qword [rcx + 8]
je 0x140003cf2
sbb eax, eax
sbb eax, 0xffffffff
mov ebx, eax
test ebx, ebx
je 0x140003d09
lea rcx, str.ERROR:_INF_file_does_not_contain_Imaging_Class_GUID._n
call fcn.140004ea0
mov ebx, 2
jmp 0x140003d3c
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x70]
call fcn.140003720
mov ebx, eax
jmp 0x140003d3c
lea rcx, str.ERROR:_One_or_more_required_parameters_is_missing:__inf_file____hwid____MAC_addr____port_number___and__ip_addr__or__hostname_._n
call fcn.140004ea0
mov rdx, qword [rdi]
lea rcx, str.USAGE:__s__f__inf_file___m__hwid___h__hostname___a__ip_addr___e__MAC_addr___n__port_number__n
call fcn.140004ea0
mov ebx, 3
mov rcx, rdi
call fcn.140006420
lea rcx, str.hpbniscan_returning_with_exit_code_0x_X._n
mov edx, ebx
call fcn.140004ea0
lea rcx, str.Leaving_WinMain___n
call fcn.140004ea0
mov rdi, qword [rsp + 0x1a0]
mov eax, ebx
jmp 0x140003d87
lea rcx, str.hpbniscan_instance_was_NULL__n
call fcn.140004ea0
lea rcx, str.Leaving_WinMain___n
call fcn.140004ea0
mov eax, 2
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.140006700
add rsp, 0x190
pop rbx
ret
Function at 0x1400044b0
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x60
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x140042258]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rsi, rdx
mov rdi, rcx
lea rbx, [rcx + 8]
cmp qword [rbx + 0x20], 0x10
jb 0x1400044ef
mov rcx, qword [rbx + 8]
jmp 0x1400044f3
lea rcx, [rbx + 8]
lea rdx, [0x140036de2]
test rsi, rsi
cmovne rdx, rsi
call fcn.1400059b8
test eax, eax
je 0x14000461c
mov rcx, qword [rdi + 0x30]
test rcx, rcx
je 0x140004524
call fcn.140007464
mov qword [rdi + 0x30], 0
test rsi, rsi
je 0x14000460a
mov qword [rsp + 0x48], 0xf
mov qword [rsp + 0x40], 0
mov byte [rsp + 0x30], 0
mov r8d, 0xf
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov edx, eax
mov rax, qword [rsp + 0x48]
cmp rdx, rax
jbe 0x1400045cc
mov rdi, qword [rsp + 0x40]
cmp rdi, rdx
ja 0x1400045aa
cmp rax, rdx
je 0x1400045aa
mov r8b, 1
lea rcx, [rsp + 0x28]
call fcn.1400010e1
test al, al
je 0x1400045a5
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae rax, qword [rsp + 0x30]
mov byte [rax + rdi], 0
mov rax, qword [rsp + 0x48]
jmp 0x1400045aa
mov rax, qword [rsp + 0x48]
lea rdx, [rsp + 0x30]
cmp rax, 0x10
cmovae rdx, qword [rsp + 0x30]
mov r8d, dword [rsp + 0x48]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov rax, qword [rsp + 0x48]
lea rdx, [rsp + 0x30]
cmp rax, 0x10
cmovae rdx, qword [rsp + 0x30]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call fcn.14000107d
nop
cmp qword [rsp + 0x48], 0x10
jb 0x14000461c
mov rcx, qword [rsp + 0x30]
call fcn.140006070
jmp 0x14000461c
xor r8d, r8d
lea rdx, [0x140036de2]
mov rcx, rbx
call fcn.14000107d
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140006700
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14000712c
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xa0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
nop
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x1400071b5
movsxd rax, dword [0x14000003c]
lea rdi, [0x140000000]
add rax, rdi
cmp dword [rax], 0x4550
je 0x140007177
xor ebx, ebx
mov dword [rsp + 0xb0], ebx
jmp 0x1400071c5
mov ecx, 0x20b
cmp word [rax + 0x18], cx
je 0x14000718d
xor ebx, ebx
mov dword [rsp + 0xb0], ebx
jmp 0x1400071c5
cmp dword [rax + 0x84], 0xe
ja 0x1400071a1
xor ebx, ebx
mov dword [rsp + 0xb0], ebx
jmp 0x1400071c5
xor ebx, ebx
cmp dword [rax + 0xf8], ebx
setne bl
mov dword [rsp + 0xb0], ebx
jmp 0x1400071c5
xor ebx, ebx
mov dword [rsp + 0xb0], ebx
lea rdi, [0x140000000]
mov ecx, 1
call fcn.1400da000
test eax, eax
jne 0x1400071f5
cmp dword [0x140043de0], 1
jne 0x1400071e1
call fcn.14000f06c
mov ecx, 0x1c
call fcn.14000ee18
mov ecx, 0xff
call fcn.14000ea0c
call fcn.14000a640
test eax, eax
jne 0x140007220
cmp dword [0x140043de0], 1
jne 0x14000720c
call fcn.14000f06c
mov ecx, 0x10
call fcn.14000ee18
mov ecx, 0xff
call fcn.14000ea0c
call fcn.14000fc6c
nop
call fcn.14000f910
test eax, eax
jns 0x140007239
mov ecx, 0x1b
call fcn.14000e9a0
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov qword [0x1400462f8], rax
call fcn.14000f75c
mov qword [0x140043dd0], rax
call fcn.14000f664
test eax, eax
jns 0x140007265
mov ecx, 8
call fcn.14000e9a0
call fcn.14000f35c
test eax, eax
jns 0x140007278
mov ecx, 9
call fcn.14000e9a0
mov ecx, 1
call fcn.14000eb3c
test eax, eax
je 0x14000728d
mov ecx, eax
call fcn.14000e9a0
call fcn.14000f2e0
test byte [rsp + 0x6c], 1
movzx edx, word [rsp + 0x70]
mov r9d, 0xa
cmovne r9d, edx
mov r8, rax
xor edx, edx
mov rcx, rdi
call fcn.1400010a5
mov edi, eax
mov dword [rsp + 0x20], eax
test ebx, ebx
jne 0x1400072c4
mov ecx, eax
call fcn.14000ed78
call fcn.14000ed90
jmp 0x1400072e5
mov eax, edi
jmp 0x1400072ee
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa0
pop rdi
ret
sub rsp, 0x28
call fcn.14000fd50
add rsp, 0x28
jmp 0x14000712c
Function at 0x14000c967
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140042258]
jne 0x14000671a
rol rcx, 0x10
test cx, 0xffff
jne 0x140006716
repz ret
ror rcx, 0x10
jmp 0x14000c8c0
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140043f00]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x140043ff8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14000c945
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140043f00]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14000c967
mov rax, qword [rsp + 0x88]
mov qword [0x140043ff8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140043f98], rax
mov rax, qword [0x140043ff8]
mov qword [0x140043e70], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140043f80], rax
mov dword [0x140043e60], 0xc0000409
mov dword [0x140043e64], 1
mov rax, qword [0x140042258]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140042260]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140043ef8], eax
mov ecx, 1
call fcn.1400184bc
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140039180]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140043ef8], 0
jne 0x14000c9ee
mov ecx, 1
call fcn.1400184bc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x14000ed84
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x14000ebec
Function at 0x140020398
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.14000a2fc
xor ebx, ebx
mov rdi, rax
cmp qword [0x140044bc0], rbx
jne 0x14002049e
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x140020573
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140020573
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x140044bc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x140044bc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x140044bd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x140044be0], rax
test rax, rax
je 0x140020495
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x140044bd8], rax
jmp 0x1400204a5
mov rax, qword [0x140044bd8]
jmp 0x1400204ac
mov rax, qword [0x140044bd8]
mov r11, qword [0x140044be0]
cmp rax, rdi
je 0x140020514
cmp r11, rdi
je 0x140020514
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x140044be0]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x140020514
test rax, rax
je 0x140020514
call rsi
test rax, rax
je 0x14002050e
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14002050e
test byte [rsp + 0x38], 1
jne 0x140020514
bts ebp, 0x15
jmp 0x140020552
mov rcx, qword [0x140044bc8]
cmp rcx, rdi
je 0x140020552
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140020552
call rax
mov rbx, rax
test rax, rax
je 0x140020552
mov rcx, qword [0x140044bd0]
cmp rcx, rdi
je 0x140020552
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140020552
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140044bc0]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140020573
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x140020575
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x1800018d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test rdx, rdx
je 0x1800018e2
test rcx, rcx
je 0x1800018e2
mov rcx, qword [rcx]
jmp 0x180005050
mov eax, 0x80510005
ret
je 0x1800050a0
nop word [rax + rax]
mov edx, dword [rbx]
mov ecx, r12d
add rdx, rdi
mov r8d, r12d
cmp byte [rdx], cl
je 0x18000508c
nop
inc r8d
cmp byte [r8 + rdx], cl
jne 0x180005068
test r8d, r8d
je 0x18000508c
mov r9d, r8d
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
imul ecx, r11d
add ecx, eax
sub r9, 1
jne 0x180005079
cmp ecx, ebp
je 0x18000529a
inc r10d
add rbx, 4
cmp r10d, esi
jb 0x180005058
mov rax, r12
mov r8d, 0x104
mov rdx, r13
xor ecx, ecx
call rax
mov r10, qword [0x18008eca9]
mov r8d, eax
mov ecx, dword [0x18008ece1]
lea r9d, [rax - 1]
movzx edx, word [r13 + r9*2]
cmp dx, cx
je 0x1800050f8
nop word [rax + rax]
mov eax, r8d
mov r8d, r9d
dec r9d
mov word [r13 + rax*2], r12w
movzx ecx, word [r13 + r9*2]
mov eax, dword [0x18008ece1]
cmp cx, ax
jne 0x1800050d8
mov edx, r12d
cmp byte [r10], dl
je 0x180005124
movzx eax, byte [r10]
nop dword [rax]
movsx ecx, al
inc edx
mov eax, r8d
inc r8d
mov word [r13 + rax*2], cx
mov eax, edx
movzx eax, byte [rdx + r10]
test al, al
jne 0x180005108
mov ebx, dword [0x18008ecc1]
mov r11d, r12d
mov ebp, dword [0x18008eccd]
mov eax, dword [0x18008ecb9]
movsxd rcx, dword [rdi + 0x3c]
add rcx, rdi
mov edx, dword [rcx + rax*8 + 0x88]
add rdx, rdi
mov r10d, dword [rdx + 0x20]
mov r14d, dword [rdx + 0x1c]
add r10, rdi
mov r15d, dword [rdx + 0x24]
add r14, rdi
mov esi, dword [rdx + 0x18]
add r15, rdi
test esi, esi
je 0x1800051be
nop
mov edx, dword [r10]
mov ecx, r12d
add rdx, rdi
mov r8d, r12d
cmp byte [rdx], cl
je 0x1800051aa
inc r8d
cmp byte [r8 + rdx], cl
jne 0x180005178
test r8d, r8d
je 0x1800051aa
mov r9d, r8d
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
imul ecx, ebx
add ecx, eax
sub r9, 1
jne 0x180005198
cmp ecx, ebp
je 0x1800052ae
inc r11d
add r10, 4
cmp r11d, esi
jb 0x180005168
mov r10, r12
mov eax, dword [0x18008ecd9]
xor r9d, r9d
mov qword [rsp + 0x30], r12
mov rcx, r13
mov dword [rsp + 0x28], eax
mov eax, dword [0x18008ec91]
mov edx, dword [0x18008ecb1]
lea r8d, [r9 + 1]
mov dword [rsp + 0x20], eax
call r10
mov r11d, dword [0x18008ecc1]
mov r12, rax
mov ebp, dword [0x18008ec89]
mov ecx, dword [0x18008ecb9]
invalid
or byte [rax], al
movsxd rdx, dword [rdi + 0x3c]
add rdx, rdi
mov qword [rsp + 0xb0], rax
xor eax, eax
mov r10d, eax
mov r8d, dword [rdx + rcx*8 + 0x88]
add r8, rdi
mov ebx, dword [r8 + 0x20]
mov r14d, dword [r8 + 0x1c]
add rbx, rdi
mov r15d, dword [r8 + 0x24]
add r14, rdi
mov esi, dword [r8 + 0x18]
add r15, rdi
test esi, esi
invalid
invalid
invalid
Function at 0x180004f68
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov ebx, dword [0x18008ec8d]
xor r12d, r12d
mov rax, qword gs:[0x60]
mov r11, qword [rax + 0x18]
add r11, 0x10
mov r10, qword [r11]
cmp r10, r11
je 0x180004fed
nop word [rax + rax]
mov r9, qword [r10 + 0x60]
mov rdx, r12
mov r8d, r12d
cmp word [r9], dx
je 0x180004fdc
movzx eax, word [r9]
lea ecx, [rax - 0x41]
cmp cx, 0x19
ja 0x180004fc9
add ax, 0x20
inc rdx
movzx ecx, ax
add r8d, ecx
movzx eax, word [r9 + rdx*2]
test ax, ax
jne 0x180004fbc
cmp ebx, r8d
je 0x180005291
mov r10, qword [r10]
cmp r10, r11
jne 0x180004fa8
mov rdi, r12
mov ebx, dword [0x18008ec9d]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r11d, dword [0x18008ecc1]
mov r10d, r12d
mov ebp, dword [0x18008ec95]
mov r13, rax
mov ecx, dword [0x18008ecb9]
movsxd rdx, dword [rdi + 0x3c]
add rdx, rdi
mov r8d, dword [rdx + rcx*8 + 0x88]
add r8, rdi
mov ebx, dword [r8 + 0x20]
mov r14d, dword [r8 + 0x1c]
add rbx, rdi
mov r15d, dword [r8 + 0x24]
add r14, rdi
mov esi, dword [r8 + 0x18]
add r15, rdi
test esi, esi
mov rdi, qword [r10 + 0x30]
jmp 0x180004ff0
Function at 0x180005050
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test rdx, rdx
je 0x1800018e2
test rcx, rcx
je 0x1800018e2
mov rcx, qword [rcx]
jmp 0x180005050
mov eax, 0x80510005
ret
je 0x1800050a0
nop word [rax + rax]
mov edx, dword [rbx]
mov ecx, r12d
add rdx, rdi
mov r8d, r12d
cmp byte [rdx], cl
je 0x18000508c
nop
inc r8d
cmp byte [r8 + rdx], cl
jne 0x180005068
test r8d, r8d
je 0x18000508c
mov r9d, r8d
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
imul ecx, r11d
add ecx, eax
sub r9, 1
jne 0x180005079
cmp ecx, ebp
je 0x18000529a
inc r10d
add rbx, 4
cmp r10d, esi
jb 0x180005058
mov rax, r12
mov r8d, 0x104
mov rdx, r13
xor ecx, ecx
call rax
mov r10, qword [0x18008eca9]
mov r8d, eax
mov ecx, dword [0x18008ece1]
lea r9d, [rax - 1]
movzx edx, word [r13 + r9*2]
cmp dx, cx
je 0x1800050f8
nop word [rax + rax]
mov eax, r8d
mov r8d, r9d
dec r9d
mov word [r13 + rax*2], r12w
movzx ecx, word [r13 + r9*2]
mov eax, dword [0x18008ece1]
cmp cx, ax
jne 0x1800050d8
mov edx, r12d
cmp byte [r10], dl
je 0x180005124
movzx eax, byte [r10]
nop dword [rax]
movsx ecx, al
inc edx
mov eax, r8d
inc r8d
mov word [r13 + rax*2], cx
mov eax, edx
movzx eax, byte [rdx + r10]
test al, al
jne 0x180005108
mov ebx, dword [0x18008ecc1]
mov r11d, r12d
mov ebp, dword [0x18008eccd]
mov eax, dword [0x18008ecb9]
movsxd rcx, dword [rdi + 0x3c]
add rcx, rdi
mov edx, dword [rcx + rax*8 + 0x88]
add rdx, rdi
mov r10d, dword [rdx + 0x20]
mov r14d, dword [rdx + 0x1c]
add r10, rdi
mov r15d, dword [rdx + 0x24]
add r14, rdi
mov esi, dword [rdx + 0x18]
add r15, rdi
test esi, esi
je 0x1800051be
nop
mov edx, dword [r10]
mov ecx, r12d
add rdx, rdi
mov r8d, r12d
cmp byte [rdx], cl
je 0x1800051aa
inc r8d
cmp byte [r8 + rdx], cl
jne 0x180005178
test r8d, r8d
je 0x1800051aa
mov r9d, r8d
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
imul ecx, ebx
add ecx, eax
sub r9, 1
jne 0x180005198
cmp ecx, ebp
je 0x1800052ae
inc r11d
add r10, 4
cmp r11d, esi
jb 0x180005168
mov r10, r12
mov eax, dword [0x18008ecd9]
xor r9d, r9d
mov qword [rsp + 0x30], r12
mov rcx, r13
mov dword [rsp + 0x28], eax
mov eax, dword [0x18008ec91]
mov edx, dword [0x18008ecb1]
lea r8d, [r9 + 1]
mov dword [rsp + 0x20], eax
call r10
mov r11d, dword [0x18008ecc1]
mov r12, rax
mov ebp, dword [0x18008ec89]
mov ecx, dword [0x18008ecb9]
invalid
or byte [rax], al
movsxd rdx, dword [rdi + 0x3c]
add rdx, rdi
mov qword [rsp + 0xb0], rax
xor eax, eax
mov r10d, eax
mov r8d, dword [rdx + rcx*8 + 0x88]
add r8, rdi
mov ebx, dword [r8 + 0x20]
mov r14d, dword [r8 + 0x1c]
add rbx, rdi
mov r15d, dword [r8 + 0x24]
add r14, rdi
mov esi, dword [r8 + 0x18]
add r15, rdi
test esi, esi
invalid
invalid
invalid