joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140009af0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
push r15
mov rsi, qword [rsp + 0x48]
xor r14d, r14d
mov rbx, qword [rsp + 0x60]
mov r12, r9
mov rcx, qword [rsp + 0x50]
mov r13, r8
mov rbp, qword [rsp + 0x58]
mov r15, rdx
mov qword [rsi], r8
mov qword [rbx], rcx
mov rax, qword [rsi]
cmp rax, r9
je 0x140009c85
cmp rcx, rbp
je 0x140009c85
mov r9d, 1
movzx edx, word [r15]
xor dil, dil
movzx ecx, word [rax]
mov r11d, 0x2800
mov r8d, 0x3ff
mov r10d, 0x2400
cmp r9w, dx
jae 0x140009b8c
lea eax, [r10 + rcx]
cmp ax, r8w
ja 0x140009cac
mov eax, edx
sub ecx, 0xdc00
shl eax, 0xa
or eax, ecx
jmp 0x140009ba3
mov eax, ecx
add cx, r11w
cmp cx, r8w
ja 0x140009ba3
shl eax, 0xa
mov dil, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x140009bb6
movzx r8d, al
mov r10d, r14d
mov r11d, r14d
jmp 0x140009c03
mov r8d, eax
cmp eax, 0x800
jae 0x140009bd0
shr r8d, 6
mov r10d, r9d
or r8b, 0xc0
mov r11d, r9d
jmp 0x140009c03
cmp eax, 0x10000
jae 0x140009bea
shr r8d, 0xc
mov r10d, 2
or r8b, 0xe0
mov r11d, r10d
jmp 0x140009c03
shr r8d, 0x12
mov r10d, 3
movzx r11d, dil
or r8b, 0xf0
xor r11d, 1
add r11d, r11d
lea r9d, [r11 + 1]
mov rdx, rbp
sub rdx, qword [rbx]
mov ecx, r9d
cmp rdx, rcx
jl 0x140009c85
add qword [rsi], 2
test dil, dil
jne 0x140009c24
cmp r10d, 3
jae 0x140009c30
mov rcx, qword [rbx]
mov r9d, r11d
mov byte [rcx], r8b
inc qword [rbx]
mov r8, qword [rbx]
test r9d, r9d
jle 0x140009c5e
lea ecx, [r10 + r10*2]
add ecx, ecx
nop
sub ecx, 6
mov edx, eax
shr edx, cl
dec r9d
and dl, 0x3f
or dl, 0x80
mov byte [r8], dl
inc qword [rbx]
mov r8, qword [rbx]
test r9d, r9d
jg 0x140009c40
shr eax, 0xa
mov r9d, 1
test dil, dil
mov ecx, r9d
cmovne ecx, eax
mov word [r15], cx
mov rax, qword [rsi]
cmp rax, r12
je 0x140009c85
cmp qword [rbx], rbp
jne 0x140009b4d
cmp r13, qword [rsi]
sete r14b
mov eax, r14d
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret
mov eax, 2
jmp 0x140009c8f

Function at 0x14000fd48
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000fd92
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000fd92
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000fd92
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000fd92
cmp dword [rcx + 0x84], 0xe
jbe 0x14000fd92
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000fd94
xor al, al
add rsp, 0x28
ret

Function at 0x140034560
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
call fcn.140044718
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x1400345b2
and dword [rsp + 0x30], 0
lea r8, [rsp + 0x30]
mov r9d, 2
lea edx, [r9 + 0x20]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx ecx, word [rsp + 0x30]
sub ecx, 0x30
je 0x1400345b2
sub ecx, 1
je 0x1400345ab
cmp ecx, 1
je 0x1400345a4
xor eax, eax
jmp 0x1400345b7
mov eax, 3
jmp 0x1400345b7
mov eax, 1
jmp 0x1400345b7
mov eax, 2
add rsp, 0x28
ret
Function at 0x140041520
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14004158f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14004158f
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14004158f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14004158f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14004158f
cmp dword [rcx + 0x84], 0xe
jbe 0x14004158f
cmp dword [rcx + 0xf8], 0
je 0x14004158f
mov ecx, ebx
call fcn.140041640
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14004141c
nop
cmp dword [rbp + 0x20], 0
je 0x1400415dd
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400415e8
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x140041520

Function at 0x140041724
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140041520

Function at 0x14004bdc0
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14004bdd6
mov al, 1
jmp 0x14004be36
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14004bde7
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14004be34
mov ecx, dword [rcx + 0x18]
nop
call fcn.140053b4c
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14004be34
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14004be34
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14004be34
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14004be36
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x14004e368
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14004e388
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140044eac
or eax, 0xffffffff
jmp 0x14004e38a
xor eax, eax
add rsp, 0x28
ret

Function at 0x14004fc2c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.14005d140
sub rsp, rax
mov rax, qword [0x140077040]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.14004bba4
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x14004fc7b
mov rax, rbp
jmp 0x14004fd83
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x7a4b0]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.140050b78
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0x7a4b0]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x14004fd7f
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14004fd7f
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.140050b78
test rax, rax
js 0x14004fd7f
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x14004fd7f
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x14004fd71
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x14004fd71
cmp byte [rcx], 0xd
jne 0x14004fd57
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x14004fd66
cmp byte [rcx + 1], 0xa
jne 0x14004fd66
inc rcx
jmp 0x14004fd66
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x774e0]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x14004fd39
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x14004fd83
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.14000f0b0
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14004ff18
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x14007a4b0]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x14004ff6f
cmp word [rdx], r13w
jne 0x14004ff6f
or byte [rax + rdi*8 + 0x38], cl
jmp 0x14004ff74
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x140050099
mov r11d, recv
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x1400500ba
lea r9, [rdx + 2]
cmp cx, r11w
je 0x14004ffad
mov rdx, r9
mov word [rbx], cx
jmp 0x14004ffd4
cmp r9, r8
jae 0x14004ffe4
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x14004ff8e
jmp 0x140050099
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14005008e
cmp dword [rsp + 0x80], esi
je 0x14005008e
lea r8, [0x14007a4b0]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x140050066
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x140050036
mov word [rbx], r13w
jmp 0x140050096
mov ecx, recv
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x140050043
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x140050096
cmp word [rsp + 0x70], r13w
jne 0x140050073
cmp rbx, r14
je 0x140050030
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.140050b80
cmp word [rsp + 0x70], r13w
je 0x140050099
mov ecx, recv
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x14007a4b0]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x140050093
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x140050099
Function at 0x140052b84
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140052c0b
mov rsi, rbx
cmp word [rax], bp
je 0x140052bca
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140052bb4
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140052bb0
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14004e1a0
mov rdi, rax
test rax, rax
je 0x140052bf8
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14005d9c0
mov rbp, rdi
xor ecx, ecx
call fcn.14004c2c0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140056230
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.14004b844
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x1400562d1
cmp ebx, dword [rsp + 0x30]
je 0x1400562ca
test esi, esi
je 0x1400562ca
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x1400562a5
sub r8w, 0x61
cmp r8w, 0x19
ja 0x1400562b2
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x14005628f
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x1400562b6
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x1400562d3
mov eax, 1
jmp 0x1400562d3
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14005c764
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.140050b80
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.140050b80
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14005c8b4
cmp rax, 0xffffffffffffffff
je 0x14005c8b4
xor edi, edi
test rbp, rbp
jle 0x14005c85f
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14004c248
mov rbx, rax
test rax, rax
jne 0x14005c7ec
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14005c855
mov edx, 0x8000
mov ecx, r14d
call fcn.140042574
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14004da94
cmp eax, 0xffffffff
je 0x14005c835
cdqe
sub rbp, rax
test rbp, rbp
jg 0x14005c7fc
mov edx, r15d
mov ecx, r14d
call fcn.140042574
jmp 0x14005c855
cmp byte [rsi + 0x38], dil
je 0x14005c84c
cmp dword [rsi + 0x34], 5
jne 0x14005c84c
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], recv
cmp byte [rsi + 0x30], dil
je 0x14005c855
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14004c2c0
jmp 0x14005c8c8
jns 0x14005c8c8
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.140050b80
cmp rax, 0xffffffffffffffff
jne 0x14005c880
cmp byte [rsi + 0x30], dil
je 0x14005c8c8
mov edi, dword [rsi + 0x2c]
jmp 0x14005c8c8
mov ecx, r14d
call fcn.140053b4c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x14005c8c8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, recv
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], recv
jmp 0x14005c8c8
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x14005c8c1
mov eax, dword [rsi + 0x2c]
jmp 0x14005c8c6
mov eax, socket
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.140050b80
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x14005d230
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14005d258
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14005d258
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140a5da8c
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc r10d
btr bp, dx
movzx r8w, r14b
rol r10d, 1
dec r10d
movzx eax, si
xchg r11w, r9w
cmovnp bx, dx
ror r10d, 2
add r10, rdx
or r9b, dil
movabs r8, 0x100000000
cdqe
add r10, r8
neg rax
mov rbx, rsp
dec ah
jmp 0x140a18085
dec r9d
test r11d, eax
xor r9d, 0x639c3850
rol r9d, 1
clc
push rbp
add bp, 0x57bf
movsxd rbp, r13d
xor dword [rsp], r9d
pop rbp
movsxd r9, r9d
add r11, r9
jmp 0x14096dedc
push r11
ret
sub rsp, 0x180
and bp, 0x6bfd
shl bpl, 0x57
rcl r11w, cl
and rsp, 0xfffffffffffffff0
stc
movzx ebp, si
cmovnp r9w, r11w
mov rbp, r10
not ax
lahf
or r11b, cl
movabs rax, 0
bsr r9w, dx
shrd r9, rsi, 0x88
cmp dil, 0xa
sub rbp, rax
add r9b, 0xdf
movsxd r11, ecx
cmp ch, 0x6f
lea r11, [0x140a180d8]
mov r9w, 0x4717
ror r9b, cl
mov r9d, dword [r10]
test ecx, 0x29ca6134
clc
test rbp, rsi
add r10, 4
xor r9d, ebp
dec r9d
xor r9d, 0x376b7e59
jmp 0x140966617
push r10
push rax
lahf
push rcx
pushfq
sete r10b
movsxd rax, edi
push rdi
movsx ax, r12b
cdqe
push r9
lahf
dec r10b
cbw
push rdx
rdtsc
push r15
push rbx
cdqe
bswap rbx
push rsi
push r11
push r14
rdtsc
cdq
lahf
push rbp
mov r11b, 0xe5
push r8
inc edx
push r12
movzx rbx, bx
bswap rdx
push r13
cwd
movzx r9d, r12w
xchg dx, r10w
movabs rdx, 0
bswap r11
cwde
push rdx
mov r10, qword [rsp + 0x90]
jmp 0x140944dd8
Function at 0x14000d6a0
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
xor r8, r8
push r8
push rax
pushfq
push r8
push rdx
sub rsp, 0xa8
push r8
push r15
push r14
push r13
push r12
push rbx
push r8
push rsi
push rdi
push rbp
push rax
push rdx
sub rsp, 0x290
movdqa xmmword [rsp + 0x2f0], xmm6
movdqa xmmword [rsp + 0x300], xmm7
movdqa xmmword [rsp + 0x310], xmm8
movdqa xmmword [rsp + 0x320], xmm9
movdqa xmmword [rsp + 0x330], xmm10
movdqa xmmword [rsp + 0x340], xmm11
movdqa xmmword [rsp + 0x350], xmm12
movdqa xmmword [rsp + 0x360], xmm13
movdqa xmmword [rsp + 0x370], xmm14
movdqa xmmword [rsp + 0x380], xmm15
mov eax, dword [0x140dffb44]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x30
add rax, rbx
lea rdx, [rsp + 0x20]
xor r8, r8
mov qword [rdx + 0x10], r8
mov byte [rdx + 0x19], 1
mov dword [rdx + 0x1c], 0xffffffff
mov byte [rdx + 0x18], 2
mov r8, qword [rax + 0x80]
mov qword [rdx], r8
mov qword [rax + 0x80], rdx
lea r8, [rsp + 0x290]
mov qword [rdx + 8], r8
call fcn.1402eee70
int3
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xd8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x120], rcx
mov qword [rsp + 0x128], rdx
mov qword [rsp + 0x130], r8
mov qword [rsp + 0x138], r9
mov eax, dword [0x140dffb44]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x30
add rax, rbx
mov qword [rsp + 0xc0], rax
cmp rcx, qword [rax + 0x88]
sete byte [rsp + 0xd0]
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [r8 + 0x18]
mov rbx, qword [rax]
mov rax, qword [r8 + 0x20]
mov rbp, qword [rax]
mov rax, qword [r8 + 0x28]
mov rsi, qword [rax]
mov rax, qword [r8 + 0x30]
mov rdi, qword [rax]
mov rax, qword [r8 + 0x58]
mov r12, qword [rax]
mov rax, qword [r8 + 0x60]
mov r13, qword [rax]
mov rax, qword [r8 + 0x68]
mov r14, qword [rax]
mov rax, qword [r8 + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [r8 + 0x90]
movdqa xmm7, xmmword [r8 + 0xa0]
movdqa xmm8, xmmword [r8 + 0xb0]
movdqa xmm9, xmmword [r8 + 0xc0]
movdqa xmm10, xmmword [r8 + 0xd0]
movdqa xmm11, xmmword [r8 + 0xe0]
movdqa xmm12, xmmword [r8 + 0xf0]
movdqa xmm13, xmmword [r8 + 0x100]
movdqa xmm14, xmmword [r8 + 0x110]
movdqa xmm15, xmmword [r8 + 0x120]
mov rcx, qword [r8 + 0x78]
mov rdx, qword [rsp + 0x120]
call qword [rsp + 0x128]
mov r8, qword [rsp + 0x130]
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rdx + 0x70]
cmp rcx, 0
je 0x14000d830
mov r9, qword [rdx + 0x68]
mov qword [r9], rcx
mov qword [rdx + 0x68], 0
mov qword [rdx + 0x70], 0
mov rcx, qword [rsp + 0x138]
mov r8, qword [r8 + 0x78]
xor r9d, r9d
mov rcx, qword [rcx]
cmp rcx, r9
je 0x14000d84c
cmp rcx, r8
jl 0x14000d83f
mov qword [rdx + 0x80], rcx
test dword [0x140df2e38], 1
je 0x14000d87b
cmp byte [rsp + 0xd0], 0
je 0x14000d87b
mov rcx, 0x43
mov rdx, rax
mov rsp, r8
jmp 0x14000d3a0
mov rsp, r8
jmp rax
Function at 0x14000d880
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xc8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x110], rcx
mov qword [rsp + 0x118], rdx
mov eax, dword [0x140dffb44]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x30
add rax, rbx
mov qword [rsp + 0xc0], rax
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [rdx + 0x18]
mov rbx, qword [rax]
mov rax, qword [rdx + 0x20]
mov rbp, qword [rax]
mov rax, qword [rdx + 0x28]
mov rsi, qword [rax]
mov rax, qword [rdx + 0x30]
mov rdi, qword [rax]
mov rax, qword [rdx + 0x58]
mov r12, qword [rax]
mov rax, qword [rdx + 0x60]
mov r13, qword [rax]
mov rax, qword [rdx + 0x68]
mov r14, qword [rax]
mov rax, qword [rdx + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [rdx + 0x90]
movdqa xmm7, xmmword [rdx + 0xa0]
movdqa xmm8, xmmword [rdx + 0xb0]
movdqa xmm9, xmmword [rdx + 0xc0]
movdqa xmm10, xmmword [rdx + 0xd0]
movdqa xmm11, xmmword [rdx + 0xe0]
movdqa xmm12, xmmword [rdx + 0xf0]
movdqa xmm13, xmmword [rdx + 0x100]
movdqa xmm14, xmmword [rdx + 0x110]
movdqa xmm15, xmmword [rdx + 0x120]
mov rcx, qword [rdx + 0x78]
call qword [rsp + 0x110]
mov rdx, qword [rsp + 0x118]
mov rax, qword [rdx + 0x18]
mov qword [rax], rbx
mov rax, qword [rdx + 0x20]
mov qword [rax], rbp
mov rax, qword [rdx + 0x28]
mov qword [rax], rsi
mov rax, qword [rdx + 0x30]
mov qword [rax], rdi
mov rax, qword [rdx + 0x58]
mov qword [rax], r12
mov rax, qword [rdx + 0x60]
mov qword [rax], r13
mov rax, qword [rdx + 0x68]
mov qword [rax], r14
mov rax, qword [rdx + 0x70]
mov qword [rax], r15
movdqa xmmword [rdx + 0x90], xmm6
movdqa xmmword [rdx + 0xa0], xmm7
movdqa xmmword [rdx + 0xb0], xmm8
movdqa xmmword [rdx + 0xc0], xmm9
movdqa xmmword [rdx + 0xd0], xmm10
movdqa xmmword [rdx + 0xe0], xmm11
movdqa xmmword [rdx + 0xf0], xmm12
movdqa xmmword [rdx + 0x100], xmm13
movdqa xmmword [rdx + 0x110], xmm14
movdqa xmmword [rdx + 0x120], xmm15
mov rax, qword [rsp + 0xc0]
lock or dword [rax + 0x38], 0x10
movdqa xmm6, xmmword [rsp + 0x20]
movdqa xmm7, xmmword [rsp + 0x30]
movdqa xmm8, xmmword [rsp + 0x40]
movdqa xmm9, xmmword [rsp + 0x50]
movdqa xmm10, xmmword [rsp + 0x60]
movdqa xmm11, xmmword [rsp + 0x70]
movdqa xmm12, xmmword [rsp + 0x80]
movdqa xmm13, xmmword [rsp + 0x90]
movdqa xmm14, xmmword [rsp + 0xa0]
movdqa xmm15, xmmword [rsp + 0xb0]
add rsp, 0xc8
pop rbp
pop rdi
pop rsi
pop rbx
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14000e5d0
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rdx
mov rdx, rcx
mov rcx, rax
jmp 0x140017ca0
mov rax, qword gs:[0x30]
mov r10, rcx
mov r8, qword [rax + 0x60]
mov r9, qword [r8 + 0x18]
add r9, 0x20
mov rax, qword [r9]
nop dword [rax + rax]
cmp qword [rax + 0x20], rdx
je 0x140017cdd
test rdx, rdx
je 0x140017cdd
mov rax, qword [rax]
cmp rax, r9
jne 0x140017cc0
mov qword [rcx], 0
xor eax, eax
ret
mov rcx, qword [rax + 0x40]
mov qword [r10], rcx
movzx eax, word [rax + 0x38]
shr eax, 1
ret