joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401f77b0
Capabilities:
Set environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
mov rbx, qword [0x1402976b8]
mov rsi, rcx
test rbx, rbx
je 0x1401f7830
mov rax, qword [0x140272930]
mov rcx, qword [rax + 0x48]
cmp rbx, rcx
je 0x1401f7820
mov rdx, qword [0x1402978e8]
test rdx, rdx
je 0x1401f7928
mov rcx, rbx
mov rbx, qword [sym.imp.python310.dll_PyNumber_InPlaceAdd]
call rbx
mov rcx, rax
mov rdx, rsi
mov rax, rbx
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp rax
mov rbx, qword [sym.imp.python310.dll_PyNumber_InPlaceAdd]
jmp 0x1401f7801
lea r15, str.NUITKA_ONEFILE_BINARY
mov rcx, r15
call fcn.1401e0300
test rax, rax
je 0x1401f7948
mov rcx, rax
mov rdx, 0xffffffffffffffff
lea r14, [rsp + 0x40]
call qword [sym.imp.python310.dll_PyUnicode_FromWideChar]
xor ecx, ecx
mov r13, r14
lea r12, [r15 + 0x28]
mov word [rsp + 0x40], cx
lea rbp, [rsp + 0x3a]
lea rdi, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
mov eax, 0x4e
nop
mov rbx, r12
mov r8d, 2
mov rdx, rbp
mov rcx, rdi
sub rbx, r15
mov byte [rsp + 0x3a], al
mov byte [rsp + 0x3b], 0
call sub.msvcrt.dll_mbstowcs
cmp rax, 1
jne 0x14025ba42
cmp word [r13], 0
movzx edx, word [rsp + 0x3c]
mov rax, r13
je 0x1401f78ce
nop word [rax + rax]
add rax, 2
sub rbx, 1
cmp word [rax], 0
jne 0x1401f78c0
test rbx, rbx
je 0x14025ba42
mov word [rax], dx
add r15, 1
xor edx, edx
add r13, 2
mov word [rax + 2], dx
movzx eax, byte [r15]
test al, al
jne 0x1401f7880
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rax, qword [sym.imp.python310.dll__PyRuntime]
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rax + 0x1f0]
call fcn.1401f76d0
mov rbx, rax
mov qword [0x1402976b8], rbx
jmp 0x1401f77d2
lea rcx, [0x14026ebd0]
call qword [sym.imp.python310.dll_PyUnicode_FromString]
mov qword [0x1402978e8], rax
mov rdx, rax
jmp 0x1401f77f2
mov rbx, qword [0x1402976c8]
test rbx, rbx
jne 0x1401f7916
cmp byte [0x1402978e2], 0
je 0x1401f7986
mov rdx, 0xffffffffffffffff
lea rcx, [0x1402976e0]
call qword [sym.imp.python310.dll_PyUnicode_FromWideChar]
mov qword [0x1402976c8], rax
mov rbx, rax
test rax, rax
je 0x1401f7992
add qword [rax], 1
jmp 0x1401f7916
mov ecx, 1
call fcn.1401e0c70
jmp 0x1401f795d
call qword [sym.imp.python310.dll_PyErr_Print]
call sub.msvcrt.dll_abort
nop
nop
call sub.msvcrt.dll_abort
nop
Function at 0x1401f8400
Capabilities:
Set environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
lea rsi, str.NUITKA_ONEFILE_BINARY
mov ebx, ecx
mov rcx, rsi
call fcn.1401e0300
test rax, rax
je 0x1401f8560
mov rcx, rax
mov rdx, 0xffffffffffffffff
lea r14, [rsp + 0x40]
call qword [sym.imp.python310.dll_PyUnicode_FromWideChar]
xor ecx, ecx
mov r15, r14
lea r12, [rsi + 0x28]
mov word [rsp + 0x40], cx
mov r13, rax
lea rbp, [rsp + 0x3a]
mov eax, 0x4e
lea rdi, [rsp + 0x3c]
nop word cs:[rax + rax]
nop dword [rax]
mov rbx, r12
mov r8d, 2
mov rdx, rbp
mov rcx, rdi
sub rbx, rsi
mov byte [rsp + 0x3a], al
mov byte [rsp + 0x3b], 0
call sub.msvcrt.dll_mbstowcs
cmp rax, 1
jne 0x14025ba48
cmp word [r15], 0
movzx edx, word [rsp + 0x3c]
mov rax, r15
je 0x1401f84be
nop dword [rax]
add rax, 2
sub rbx, 1
cmp word [rax], 0
jne 0x1401f84b0
test rbx, rbx
je 0x14025ba48
mov word [rax], dx
add rsi, 1
xor edx, edx
add r15, 2
mov word [rax + 2], dx
movzx eax, byte [rsi]
test al, al
jne 0x1401f8470
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rax, qword [sym.imp.python310.dll__PyRuntime]
mov rdx, qword [0x140298020]
mov rsi, qword [rax + 0x1f0]
mov rax, qword [0x140272930]
mov rbx, qword [rax + 0x1d0]
test rdx, rdx
je 0x1401f85b0
mov r8, rbx
mov rcx, rsi
call fcn.1401e3990
mov r8, r13
mov rcx, rsi
mov rbx, rax
mov rdx, rax
call fcn.1401f5800
sub qword [rbx], 1
jne 0x1401f854c
mov rdx, qword [rbx + 8]
mov qword [rsp + 0x28], rax
mov rcx, rbx
call qword [rdx + 0x30]
mov rax, qword [rsp + 0x28]
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [0x1402976c0]
lea rsi, [0x1402976c0]
test bl, bl
je 0x1401f8580
mov rax, qword [0x1402976c8]
lea rsi, [0x1402976c8]
test rax, rax
jne 0x1401f854c
cmp byte [0x1402978e2], 0
je 0x1401f85dd
mov rdx, 0xffffffffffffffff
lea rcx, [0x1402976e0]
call qword [sym.imp.python310.dll_PyUnicode_FromWideChar]
mov qword [rsi], rax
test rax, rax
je 0x1401f85e7
add qword [rax], 1
jmp 0x1401f854c
mov rdx, qword [0x140297f98]
mov rdi, qword [rax + 0x1c0]
test rdx, rdx
je 0x1401f85f2
mov r8, rdi
mov rcx, rsi
call fcn.1401e3990
mov qword [0x140298020], rax
mov rdx, rax
jmp 0x1401f8516
movzx ecx, bl
call fcn.1401e0c70
jmp 0x1401f858e
call qword [sym.imp.python310.dll_PyErr_Print]
call sub.msvcrt.dll_abort
lea rcx, [0x14026ac50]
call qword [sym.imp.python310.dll_PyImport_ImportModule]
mov qword [0x140297f98], rax
mov rdx, rax
test rax, rax
jne 0x1401f85c3
lea r8, str._Unexpected_failure_of_hard_import_of_os_
lea rdx, str.IMPORT_HARD_OS
lea rcx, str._s_:__s_n
call fcn.1401e1ce0
call sub.msvcrt.dll_abort
nop
nop
call sub.msvcrt.dll_abort
nop
Function at 0x140240ef0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
cmp byte [0x1402976b1], 0
mov rbp, rcx
mov rdi, rdx
mov r12, r8
je 0x140240f98
lea rdx, [0x14026e36a]
mov rcx, r12
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x140241000
mov rbx, qword [0x140297548]
jmp 0x140240f35
lea rbx, [rdx + rax + 4]
mov rdx, rbx
mov rcx, r12
call sub.msvcrt.dll_strcmp
mov rcx, rbx
mov esi, eax
call sub.msvcrt.dll_strlen
lea rdx, [rbx + rax + 1]
mov eax, dword [rdx]
test esi, esi
jne 0x140240f30
movzx eax, word [rdx + 4]
lea r8, [rdx + 6]
test ax, ax
je 0x140240f87
lea rbx, [rdi + rax*8]
nop word cs:[rax + rax]
mov rdx, rdi
mov rcx, rbp
add rdi, 8
call fcn.140236900
mov r8, rax
cmp rdi, rbx
jne 0x140240f70
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r8d, 0xa
xor ecx, ecx
mov edx, 3
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
xor ecx, ecx
lea rdx, [rax + 4]
mov qword [0x140297548], rax
mov ebx, dword [rax]
mov qword [0x140297548], rdx
mov r8d, dword [rax + 4]
lea rdx, [rax + 8]
mov qword [0x140297548], rdx
call fcn.14023ffb0
cmp eax, ebx
jne 0x140241087
mov byte [0x1402976b1], 1
jmp 0x140240f10
cmp byte [0x1402976b0], 0
jne 0x140240f27
mov rbx, qword [sym.imp.python310.dll_PyDict_New]
call rbx
mov qword [0x140298228], rax
call rbx
mov qword [0x140298220], rax
call rbx
mov qword [0x140298218], rax
call rbx
mov qword [0x140298210], rax
call rbx
mov qword [0x140298208], rax
call rbx
mov qword [0x140298200], rax
call rbx
mov qword [0x1402981f8], rax
call rbx
mov byte [0x1402976b0], 1
mov qword [0x1402981f0], rax
mov rax, qword [sym.imp.python310.dll__PyRuntime]
mov rax, qword [rax + 0x1f0]
mov rax, qword [rax + 0x10]
add rax, 0xda0
mov qword [0x140297540], rax
jmp 0x140240f27
lea rcx, str.Error__corrupted_constants_object
call sub.msvcrt.dll_puts
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x140249400
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call fcn.14025a9c0
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call fcn.14025a9c0
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
Function at 0x14024a0d2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x1402986e8]
test eax, eax
je 0x14024a16a
lea rax, [0x1402986c0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x1402986f0]
mov qword [rbp - 8], rax
jmp 0x14024a14e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x14024a142
cmp qword [rbp - 0x10], 0
je 0x14024a142
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x14024a108
lea rax, [0x1402986c0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x14024a16b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x14024a270
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x14024a298
mov eax, 0
jmp 0x14024a2e6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x14024a2c1
mov eax, 0
jmp 0x14024a2e6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x14024a2e1
mov eax, 0
jmp 0x14024a2e6
mov eax, 1
add rsp, 0x20
pop rbp
ret

Function at 0x14024a2ec
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x14024a36a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x14024a361
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x14024a361
mov rax, qword [rbp - 8]
jmp 0x14024a37f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x14024a334
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x180006e20
Capabilities:
Print debug messages

Disassembly:
push rsi
sub rsp, 0x20
lea rcx, section..data
mov rsi, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rsi
lea rcx, [0x18002d0e0]
call rsi
lea rcx, [0x18002d030]
call rsi
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
add rsp, 0x20
pop rsi
ret

Function at 0x180006e60
Capabilities:
Print debug messages

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov eax, dword [0x18002e168]
mov ecx, dword [0x18002e16c]
lea edx, [rax - 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete byte [rsp + 0x26]
cmp ecx, 0xa
setl byte [rsp + 0x27]
mov eax, 0x3773ed2f
mov r15d, 0x3a5e4949
lea r12, section..data
mov rbp, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea r13, [0x18002d100]
lea r14, [0x18002d030]
mov rsi, qword [sym.imp.KERNEL32.dll_DebugBreak]
mov edi, 0xe5603451
nop word [rax + rax]
cmp eax, 0x3a5e4948
jg 0x180006f20
cmp eax, 0xe5603451
je 0x180006f97
cmp eax, 0x3773ed2f
jne 0x180006ed0
movzx ecx, byte [rsp + 0x26]
movzx eax, byte [rsp + 0x27]
mov edx, eax
xor dl, cl
test al, al
mov eax, 0x5ee48bd4
cmovne eax, r15d
test cl, cl
mov ecx, 0x5ee48bd4
cmove eax, ecx
test dl, dl
cmovne eax, r15d
jmp 0x180006ed0
cmp eax, 0x3a5e4949
je 0x180006f46
cmp eax, 0x5ee48bd4
jne 0x180006ed0
mov rcx, r12
call rbp
mov rcx, r13
call rbp
mov rcx, r14
call rbp
call rsi
mov eax, 0x3a5e4949
jmp 0x180006ed0
mov rcx, r12
call rbp
mov rcx, r13
call rbp
mov rcx, r14
call rbp
call rsi
mov eax, dword [0x18002e168]
mov ecx, dword [0x18002e16c]
lea edx, [rax - 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete al
cmp ecx, 0xa
setl bl
xor bl, al
mov ebx, 0x5ee48bd4
cmovne ebx, edi
cmp edx, 0xffffffff
mov eax, ebx
cmove eax, edi
cmp ecx, 0xa
cmovge eax, ebx
jmp 0x180006ed0
xor eax, eax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x180006fb0
Capabilities:
Print debug messages

Disassembly:
push rsi
sub rsp, 0x20
lea rcx, section..data
mov rsi, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rsi
lea rcx, str.fGyFZ_h_ALG__JH_LLXLZ__
call rsi
lea rcx, [0x18002d030]
call rsi
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
add rsp, 0x20
pop rsi
ret
Function at 0x180006ff0
Capabilities:
Print debug messages

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov eax, dword [0x18002e178]
mov ecx, dword [0x18002e17c]
lea edx, [rax - 1]
imul edx, eax
mov eax, edx
xor eax, 0xfffffffe
test eax, edx
sete byte [rsp + 0x26]
cmp ecx, 0xa
setl byte [rsp + 0x27]
mov eax, 0x845ac753
mov r15d, 0xe79587f7
lea r12, section..data
mov rbp, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea r13, [0x18002d140]
lea r14, [0x18002d030]
mov rsi, qword [sym.imp.KERNEL32.dll_DebugBreak]
mov edi, 0xb24cb9ce
nop dword [rax]
cmp eax, 0xb24cb9cd
jg 0x1800070a0
cmp eax, 0x845ac753
je 0x180007103
cmp eax, 0xabac7846
jne 0x180007060
mov rcx, r12
call rbp
mov rcx, r13
call rbp
mov rcx, r14
call rbp
call rsi
mov eax, 0xe79587f7
jmp 0x180007060
cmp eax, 0xb24cb9ce
je 0x180007131
cmp eax, 0xe79587f7
jne 0x180007060
mov rcx, r12
call rbp
mov rcx, r13
call rbp
mov rcx, r14
call rbp
call rsi
mov eax, dword [0x18002e178]
mov ecx, dword [0x18002e17c]
lea edx, [rax - 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete al
cmp ecx, 0xa
setl bl
xor bl, al
mov ebx, 0xabac7846
cmovne ebx, edi
cmp edx, 0xffffffff
mov eax, ebx
cmove eax, edi
cmp ecx, 0xa
cmovge eax, ebx
jmp 0x180007060
movzx ecx, byte [rsp + 0x26]
movzx eax, byte [rsp + 0x27]
mov edx, eax
xor dl, cl
test al, al
mov eax, 0xabac7846
cmovne eax, r15d
test cl, cl
mov ecx, 0xabac7846
cmove eax, ecx
test dl, dl
cmovne eax, r15d
jmp 0x180007060
xor eax, eax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x180007150
Capabilities:
Print debug messages

Disassembly:
push rsi
sub rsp, 0x20
lea rcx, section..data
mov rsi, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rsi
lea rcx, [0x18002d160]
call rsi
lea rcx, [0x18002d030]
call rsi
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
add rsp, 0x20
pop rsi
ret

Function at 0x180007190
Capabilities:
Print debug messages

Disassembly:
push rsi
sub rsp, 0x20
lea rcx, section..data
mov rsi, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rsi
lea rcx, str.A_kabxkk
call rsi
lea rcx, [0x18002d030]
call rsi
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
add rsp, 0x20
pop rsi
ret
Function at 0x1800071d0
Capabilities:
Print debug messages

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov eax, dword [0x18002e190]
mov ecx, dword [0x18002e194]
lea edx, [rax - 1]
imul edx, eax
mov eax, edx
xor eax, 0xfffffffe
test eax, edx
sete byte [rsp + 0x26]
cmp ecx, 0xa
setl byte [rsp + 0x27]
mov eax, 0x7542143b
lea r14, section..data
mov rsi, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea r15, [0x18002d1a0]
lea r13, [0x18002d030]
mov r12, qword [sym.imp.KERNEL32.dll_DebugBreak]
mov ebp, 0x5e49d227
mov edi, 0x486c9119
mov ebx, 0x89d2d1e0
nop dword [rax]
cmp eax, 0x5e49d226
jg 0x180007270
cmp eax, 0x89d2d1e0
je 0x1800072a2
cmp eax, 0x486c9119
jne 0x180007240
mov rcx, r14
call rsi
mov rcx, r15
call rsi
mov rcx, r13
call rsi
call r12
mov eax, 0x89d2d1e0
jmp 0x180007240
cmp eax, 0x5e49d227
je 0x1800072e9
cmp eax, 0x7542143b
jne 0x180007240
movzx ecx, byte [rsp + 0x26]
movzx eax, byte [rsp + 0x27]
mov edx, eax
xor dl, cl
test al, al
mov eax, 0x486c9119
cmovne eax, ebx
test cl, cl
cmove eax, edi
test dl, dl
cmovne eax, ebx
jmp 0x180007240
mov rcx, r14
call rsi
mov rcx, r15
call rsi
mov rcx, r13
call rsi
call r12
mov eax, dword [0x18002e190]
lea ecx, [rax - 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
sete cl
mov eax, 0x486c9119
cmove eax, ebp
cmp dword [0x18002e194], 0xa
cmovge eax, edi
setl dl
xor dl, cl
cmovne eax, ebp
jmp 0x180007240
xor eax, eax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x180007300
Capabilities:
Print debug messages

Disassembly:
push rsi
sub rsp, 0x20
lea rcx, section..data
mov rsi, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rsi
lea rcx, [0x18002d1c0]
call rsi
lea rcx, [0x18002d030]
call rsi
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
add rsp, 0x20
pop rsi
ret

Function at 0x180007340
Capabilities:
Print debug messages

Disassembly:
push rsi
sub rsp, 0x20
lea rcx, section..data
mov rsi, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rsi
lea rcx, [0x18002d1e0]
call rsi
lea rcx, [0x18002d030]
call rsi
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
add rsp, 0x20
pop rsi
ret
Function at 0x180007380
Capabilities:
Print debug messages

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov eax, dword [0x18002e1a0]
mov ecx, dword [0x18002e1a4]
lea edx, [rax - 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete byte [rsp + 0x26]
cmp ecx, 0xa
setl byte [rsp + 0x27]
mov eax, 0x5d1948c0
lea r14, section..data
mov rsi, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea r15, [0x18002d200]
lea rbx, [0x18002d030]
mov r13, qword [sym.imp.KERNEL32.dll_DebugBreak]
mov ebp, 0x89de5337
mov r12d, 0x5ad98bfe
mov edi, 0x3c476f8b
nop
cmp eax, 0x5ad98bfd
jg 0x180007450
cmp eax, 0x89de5337
je 0x1800074a1
cmp eax, 0x3c476f8b
jne 0x1800073f0
mov rcx, r14
call rsi
mov rcx, r15
call rsi
mov rcx, rbx
call rsi
call r13
mov eax, dword [0x18002e1a0]
lea ecx, [rax - 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
sete cl
mov eax, 0x5ad98bfe
cmove eax, ebp
cmp dword [0x18002e1a4], 0xa
cmovge eax, r12d
setl dl
xor dl, cl
cmovne eax, ebp
jmp 0x1800073f0
cmp eax, 0x5ad98bfe
je 0x180007485
cmp eax, 0x5d1948c0
jne 0x1800073f0
movzx ecx, byte [rsp + 0x26]
movzx eax, byte [rsp + 0x27]
mov edx, ecx
xor dl, al
mov edx, 0x5ad98bfe
cmovne edx, edi
test al, al
mov eax, edx
cmovne eax, edi
test cl, cl
cmove eax, edx
jmp 0x1800073f0
mov rcx, r14
call rsi
mov rcx, r15
call rsi
mov rcx, rbx
call rsi
call r13
mov eax, 0x3c476f8b
jmp 0x1800073f0
xor eax, eax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x1800074c0
Capabilities:
Print debug messages

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov eax, dword [0x18002e1a8]
mov ecx, dword [0x18002e1ac]
lea edx, [rax - 1]
imul edx, eax
mov eax, edx
xor eax, 0xfffffffe
test eax, edx
sete byte [rsp + 0x26]
cmp ecx, 0xa
setl byte [rsp + 0x27]
mov eax, 0xb1e0a8c2
mov r15d, 0x136c09eb
mov r14d, 0x649b2c64
lea r12, section..data
mov rbp, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea r13, [0x18002d220]
lea rbx, [0x18002d030]
mov rsi, qword [sym.imp.KERNEL32.dll_DebugBreak]
mov edi, 0x944f6c6e
nop
cmp eax, 0x136c09ea
jg 0x180007570
cmp eax, 0x944f6c6e
je 0x1800075dd
cmp eax, 0xb1e0a8c2
jne 0x180007530
movzx ecx, byte [rsp + 0x26]
movzx eax, byte [rsp + 0x27]
mov edx, ecx
xor dl, al
mov edx, 0x649b2c64
cmovne edx, r15d
test al, al
mov eax, edx
cmovne eax, r15d
test cl, cl
cmove eax, edx
jmp 0x180007530
cmp eax, 0x136c09eb
je 0x180007596
cmp eax, 0x649b2c64
jne 0x180007530
mov rcx, r12
call rbp
mov rcx, r13
call rbp
mov rcx, rbx
call rbp
call rsi
mov eax, 0x136c09eb
jmp 0x180007530
mov rcx, r12
call rbp
mov rcx, r13
call rbp
mov rcx, rbx
call rbp
call rsi
mov eax, dword [0x18002e1a8]
lea ecx, [rax - 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
sete cl
mov eax, 0x649b2c64
cmove eax, edi
cmp dword [0x18002e1ac], 0xa
cmovge eax, r14d
setl dl
xor dl, cl
cmovne eax, edi
jmp 0x180007530
xor eax, eax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1800075f0
Capabilities:
Print debug messages

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov eax, dword [0x18002e1b0]
mov ecx, dword [0x18002e1b4]
lea edx, [rax - 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete byte [rsp + 0x26]
cmp ecx, 0xa
setl byte [rsp + 0x27]
mov eax, 0x6823144f
lea r14, section..data
mov rsi, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea r15, [0x18002d240]
lea r13, [0x18002d030]
mov r12, qword [sym.imp.KERNEL32.dll_DebugBreak]
mov ebp, 0x2e44a5c4
mov edi, 0x642c2681
nop dword [rax]
cmp eax, 0x642c2680
jg 0x180007680
cmp eax, 0xd6a866ab
je 0x1800076b2
cmp eax, 0x2e44a5c4
jne 0x180007660
jmp 0x18000771d
cmp eax, 0x642c2681
je 0x1800076cb
cmp eax, 0x6823144f
jne 0x180007660
movzx ecx, byte [rsp + 0x26]
movzx eax, byte [rsp + 0x27]
mov edx, ecx
xor dl, al
mov edx, 0xd6a866ab
cmovne edx, edi
test al, al
mov eax, edx
cmovne eax, edi
test cl, cl
cmove eax, edx
jmp 0x180007660
mov rcx, r14
call rsi
mov rcx, r15
call rsi
mov rcx, r13
call rsi
call r12
mov eax, 0x642c2681
jmp 0x180007660
mov rcx, r14
call rsi
mov rcx, r15
call rsi
mov rcx, r13
call rsi
call r12
mov eax, dword [0x18002e1b0]
mov ecx, dword [0x18002e1b4]
lea edx, [rax - 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete al
cmp ecx, 0xa
setl bl
xor bl, al
mov ebx, 0xd6a866ab
cmovne ebx, ebp
cmp edx, 0xffffffff
mov eax, ebx
cmove eax, ebp
cmp ecx, 0xa
cmovge eax, ebx
jmp 0x180007660
xor eax, eax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x180007730
Capabilities:
Print debug messages

Disassembly:
push rsi
sub rsp, 0x20
lea rcx, section..data
mov rsi, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rsi
lea rcx, [0x18002d260]
call rsi
lea rcx, [0x18002d030]
call rsi
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
add rsp, 0x20
pop rsi
ret

Function at 0x180007770
Capabilities:
Print debug messages

Disassembly:
push rsi
sub rsp, 0x20
lea rcx, section..data
mov rsi, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rsi
lea rcx, [0x18002d280]
call rsi
lea rcx, [0x18002d030]
call rsi
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
add rsp, 0x20
pop rsi
ret

Function at 0x1800077b0
Capabilities:
Print debug messages

Disassembly:
push rsi
sub rsp, 0x20
lea rcx, section..data
mov rsi, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rsi
lea rcx, [0x18002d2a0]
call rsi
lea rcx, [0x18002d030]
call rsi
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
add rsp, 0x20
pop rsi
ret

Function at 0x1800077f0
Capabilities:
Print debug messages

Disassembly:
push rsi
sub rsp, 0x20
lea rcx, section..data
mov rsi, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rsi
lea rcx, [0x18002d2c0]
call rsi
lea rcx, [0x18002d030]
call rsi
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
add rsp, 0x20
pop rsi
ret