joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b09bf
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
jmp 0x1401f5300
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x428
lea rbp, [rsp + 0x30]
mov dword [rbp + 0x3c4], 0
lea rcx, [0x14028336b]
call fcn.1400b2f21
nop
mov rax, qword [rbp + 0x410]
mov r9d, dword [rax + 0x14]
mov rax, qword [rbp + 0x410]
mov r8d, dword [rax + 0x10]
mov rax, qword [rbp + 0x410]
mov rdx, qword [rax]
mov rcx, qword [rbp + 0x410]
call fcn.1400b1446
mov dword [rbp + 0x3d4], eax
mov eax, dword [rbp + 0x3d4]
mov dword [rbp + 0x64], eax
mov dword [rbp + 0x84], 0x18
mov dword [rbp + 0xa4], 0x18
mov dword [rbp + 0xc4], 0x10
mov rax, qword gs:[0x60]
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov rax, qword [rax + 0x18]
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0x108]
mov rax, qword [rax + 0x18]
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x128]
mov rax, qword [rax + 0x10]
mov qword [rbp + 0x148], rax
mov rax, qword [rbp + 0x128]
mov qword [rbp + 0x168], rax
mov eax, 0x10
imul rax, rax, 0
mov rcx, qword [rbp + 0x168]
mov rax, qword [rcx + rax]
mov qword [rbp + 0x168], rax
mov rax, qword [rbp + 0x168]
cmp qword [rax + 0x30], 0
je 0x1401f5423
lea rdx, [0x14023ccc0]
mov rax, qword [rbp + 0x168]
mov rcx, qword [rax + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1401f5423
jmp 0x1401f5433
mov rax, qword [rbp + 0x168]
cmp qword [rbp + 0x128], rax
jne 0x1401f53dc
mov rax, qword [rbp + 0x168]
mov rax, qword [rax + 0x30]
mov qword [rbp + 8], rax
mov r9d, 0xa
mov r8d, 0xc
lea rdx, str.LoadLibraryA
mov rcx, qword [rbp + 0x410]
call fcn.1400b1446
mov dword [rbp + 0x3d4], eax
mov eax, dword [rbp + 0x3d4]
mov dword [rbp + 0x184], eax
mov dword [rsp + 0x20], 0xa
mov r9d, 0xc
mov r8d, dword [rbp + 0x184]
mov rdx, qword [rbp + 8]
mov rcx, qword [rbp + 0x410]
call fcn.1400b0dd4
mov qword [rbp + 0x3d8], rax
mov rax, qword [rbp + 0x3d8]
mov qword [rbp + 0x1a8], rax
mov rax, qword [rbp + 0x1a8]
mov qword [rbp + 0x3d8], rax
mov rax, qword [rbp + 0x410]
mov rcx, qword [rax + 8]
call qword [rbp + 0x3d8]
mov qword [rbp + 0x3e0], rax
mov rax, qword [rbp + 0x3e0]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x410]
mov eax, dword [rax + 0x14]
mov dword [rsp + 0x20], eax
mov rax, qword [rbp + 0x410]
mov r9d, dword [rax + 0x10]
mov r8d, dword [rbp + 0x64]
mov rdx, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x410]
call fcn.1400b0dd4
mov qword [rbp + 0x3d8], rax
mov rax, qword [rbp + 0x3d8]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x3a8], rax
lea rdx, [rbp + 0x3a8]
lea rcx, [rbp + 0x350]
call fcn.1400b2c47
mov qword [rbp + 0x3d8], rax
mov rdx, qword [rbp + 0x3d8]
mov rcx, qword [rbp + 0x418]
call fcn.1400b22ab
mov eax, dword [rbp + 0x3c4]
or eax, 1
mov dword [rbp + 0x3c4], eax
lea rcx, [rbp + 0x350]
call fcn.1400b1b62
nop
mov rax, qword [rbp + 0x418]
jmp 0x1401f5583
lea rsp, [rbp + 0x3f8]
pop rdi
pop rbp
ret
Function at 0x1400b0dd4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x1401fbf30
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x268
lea rbp, [rsp + 0x20]
lea rcx, [0x14028336b]
call fcn.1400b2f21
nop
mov rax, qword [rbp + 0x268]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x28], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x20]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x24]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
mov dword [rbp + 0xa4], 0xffffffff
mov dword [rbp + 0xe4], 0
jmp 0x1401fbff3
mov eax, dword [rbp + 0xe4]
inc eax
mov dword [rbp + 0xe4], eax
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x18]
dec eax
cmp dword [rbp + 0xe4], eax
jae 0x1401fc081
mov eax, dword [rbp + 0xe4]
mov rcx, qword [rbp + 0x68]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0xc8], rax
mov r9d, dword [rbp + 0x280]
mov r8d, dword [rbp + 0x278]
mov rdx, qword [rbp + 0xc8]
mov rcx, qword [rbp + 0x260]
call fcn.1400b1446
mov dword [rbp + 0x234], eax
mov eax, dword [rbp + 0x234]
mov dword [rbp + 0x104], eax
mov eax, dword [rbp + 0x104]
cmp dword [rbp + 0x270], eax
jne 0x1401fc07c
mov eax, dword [rbp + 0xe4]
mov rcx, qword [rbp + 0x88]
movzx eax, word [rcx + rax*2]
mov dword [rbp + 0xa4], eax
jmp 0x1401fc081
jmp 0x1401fbfe5
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov eax, dword [rbp + 0x128]
cmp dword [rbp + 0xa4], eax
jbe 0x1401fc0ab
xor eax, eax
jmp 0x1401fc0de
mov eax, dword [rbp + 0xa4]
mov rcx, qword [rbp + 0x128]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x148], rax
mov rax, qword [rbp + 0x148]
jmp 0x1401fc0de
lea rsp, [rbp + 0x248]
pop rdi
pop rbp
ret
Function at 0x1400b0f87
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x1401fb670
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x268
lea rbp, [rsp + 0x20]
lea rcx, [0x14028336b]
call fcn.1400b2f21
nop
mov rax, qword [rbp + 0x268]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x28], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x20]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x24]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
mov dword [rbp + 0xa4], 0xffffffff
mov dword [rbp + 0xe4], 0
jmp 0x1401fb733
mov eax, dword [rbp + 0xe4]
inc eax
mov dword [rbp + 0xe4], eax
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x18]
dec eax
cmp dword [rbp + 0xe4], eax
jae 0x1401fb7c1
mov eax, dword [rbp + 0xe4]
mov rcx, qword [rbp + 0x68]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0xc8], rax
mov r9d, dword [rbp + 0x280]
mov r8d, dword [rbp + 0x278]
mov rdx, qword [rbp + 0xc8]
mov rcx, qword [rbp + 0x260]
call fcn.1400b0ece
mov dword [rbp + 0x234], eax
mov eax, dword [rbp + 0x234]
mov dword [rbp + 0x104], eax
mov eax, dword [rbp + 0x104]
cmp dword [rbp + 0x270], eax
jne 0x1401fb7bc
mov eax, dword [rbp + 0xe4]
mov rcx, qword [rbp + 0x88]
movzx eax, word [rcx + rax*2]
mov dword [rbp + 0xa4], eax
jmp 0x1401fb7c1
jmp 0x1401fb725
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov eax, dword [rbp + 0x128]
cmp dword [rbp + 0xa4], eax
jbe 0x1401fb7eb
xor eax, eax
jmp 0x1401fb81e
mov eax, dword [rbp + 0xa4]
mov rcx, qword [rbp + 0x128]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x148], rax
mov rax, qword [rbp + 0x148]
jmp 0x1401fb81e
lea rsp, [rbp + 0x248]
pop rdi
pop rbp
ret
Function at 0x1400b0fdc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x1401fc160
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x268
lea rbp, [rsp + 0x20]
lea rcx, [0x14028336b]
call fcn.1400b2f21
nop
mov rax, qword [rbp + 0x268]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x28], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x20]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x24]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
mov dword [rbp + 0xa4], 0xffffffff
mov dword [rbp + 0xe4], 0
jmp 0x1401fc223
mov eax, dword [rbp + 0xe4]
inc eax
mov dword [rbp + 0xe4], eax
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x18]
dec eax
cmp dword [rbp + 0xe4], eax
jae 0x1401fc2b1
mov eax, dword [rbp + 0xe4]
mov rcx, qword [rbp + 0x68]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0xc8], rax
mov r9d, dword [rbp + 0x280]
mov r8d, dword [rbp + 0x278]
mov rdx, qword [rbp + 0xc8]
mov rcx, qword [rbp + 0x260]
call fcn.1400b26cf
mov dword [rbp + 0x234], eax
mov eax, dword [rbp + 0x234]
mov dword [rbp + 0x104], eax
mov eax, dword [rbp + 0x104]
cmp dword [rbp + 0x270], eax
jne 0x1401fc2ac
mov eax, dword [rbp + 0xe4]
mov rcx, qword [rbp + 0x88]
movzx eax, word [rcx + rax*2]
mov dword [rbp + 0xa4], eax
jmp 0x1401fc2b1
jmp 0x1401fc215
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov eax, dword [rbp + 0x128]
cmp dword [rbp + 0xa4], eax
jbe 0x1401fc2db
xor eax, eax
jmp 0x1401fc30e
mov eax, dword [rbp + 0xa4]
mov rcx, qword [rbp + 0x128]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x148], rax
mov rax, qword [rbp + 0x148]
jmp 0x1401fc30e
lea rsp, [rbp + 0x248]
pop rdi
pop rbp
ret
Function at 0x1400b11b7
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
jmp 0x1401f4c80
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x428
lea rbp, [rsp + 0x30]
mov dword [rbp + 0x3c4], 0
lea rcx, [0x14028336b]
call fcn.1400b2f21
nop
mov rax, qword [rbp + 0x410]
mov r9d, dword [rax + 0x14]
mov rax, qword [rbp + 0x410]
mov r8d, dword [rax + 0x10]
mov rax, qword [rbp + 0x410]
mov rdx, qword [rax]
mov rcx, qword [rbp + 0x410]
call fcn.1400b13c4
mov dword [rbp + 0x3d4], eax
mov eax, dword [rbp + 0x3d4]
mov dword [rbp + 0x64], eax
mov dword [rbp + 0x84], 0x18
mov dword [rbp + 0xa4], 0x18
mov dword [rbp + 0xc4], 0x10
mov rax, qword gs:[0x60]
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov rax, qword [rax + 0x18]
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0x108]
mov rax, qword [rax + 0x18]
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x128]
mov rax, qword [rax + 0x10]
mov qword [rbp + 0x148], rax
mov rax, qword [rbp + 0x128]
mov qword [rbp + 0x168], rax
mov eax, 0x10
imul rax, rax, 0
mov rcx, qword [rbp + 0x168]
mov rax, qword [rcx + rax]
mov qword [rbp + 0x168], rax
mov rax, qword [rbp + 0x168]
cmp qword [rax + 0x30], 0
je 0x1401f4da3
lea rdx, [0x14023ccc0]
mov rax, qword [rbp + 0x168]
mov rcx, qword [rax + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1401f4da3
jmp 0x1401f4db3
mov rax, qword [rbp + 0x168]
cmp qword [rbp + 0x128], rax
jne 0x1401f4d5c
mov rax, qword [rbp + 0x168]
mov rax, qword [rax + 0x30]
mov qword [rbp + 8], rax
mov r9d, 0xa
mov r8d, 0xc
lea rdx, str.LoadLibraryA
mov rcx, qword [rbp + 0x410]
call fcn.1400b13c4
mov dword [rbp + 0x3d4], eax
mov eax, dword [rbp + 0x3d4]
mov dword [rbp + 0x184], eax
mov dword [rsp + 0x20], 0xa
mov r9d, 0xc
mov r8d, dword [rbp + 0x184]
mov rdx, qword [rbp + 8]
mov rcx, qword [rbp + 0x410]
call fcn.1400b2670
mov qword [rbp + 0x3d8], rax
mov rax, qword [rbp + 0x3d8]
mov qword [rbp + 0x1a8], rax
mov rax, qword [rbp + 0x1a8]
mov qword [rbp + 0x3d8], rax
mov rax, qword [rbp + 0x410]
mov rcx, qword [rax + 8]
call qword [rbp + 0x3d8]
mov qword [rbp + 0x3e0], rax
mov rax, qword [rbp + 0x3e0]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x410]
mov eax, dword [rax + 0x14]
mov dword [rsp + 0x20], eax
mov rax, qword [rbp + 0x410]
mov r9d, dword [rax + 0x10]
mov r8d, dword [rbp + 0x64]
mov rdx, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x410]
call fcn.1400b2670
mov qword [rbp + 0x3d8], rax
mov rax, qword [rbp + 0x3d8]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x3a8], rax
lea rdx, [rbp + 0x3a8]
lea rcx, [rbp + 0x350]
call fcn.1400b2fa3
mov qword [rbp + 0x3d8], rax
mov rdx, qword [rbp + 0x3d8]
mov rcx, qword [rbp + 0x418]
call fcn.1400b2af8
mov eax, dword [rbp + 0x3c4]
or eax, 1
mov dword [rbp + 0x3c4], eax
lea rcx, [rbp + 0x350]
call fcn.1400b26e8
nop
mov rax, qword [rbp + 0x418]
jmp 0x1401f4f03
lea rsp, [rbp + 0x3f8]
pop rdi
pop rbp
ret
Function at 0x1400b1216
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x1401fb210
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x268
lea rbp, [rsp + 0x20]
lea rcx, [0x14028336b]
call fcn.1400b2f21
nop
mov rax, qword [rbp + 0x268]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x28], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x20]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x24]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
mov dword [rbp + 0xa4], 0xffffffff
mov dword [rbp + 0xe4], 0
jmp 0x1401fb2d3
mov eax, dword [rbp + 0xe4]
inc eax
mov dword [rbp + 0xe4], eax
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x18]
dec eax
cmp dword [rbp + 0xe4], eax
jae 0x1401fb361
mov eax, dword [rbp + 0xe4]
mov rcx, qword [rbp + 0x68]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0xc8], rax
mov r9d, dword [rbp + 0x280]
mov r8d, dword [rbp + 0x278]
mov rdx, qword [rbp + 0xc8]
mov rcx, qword [rbp + 0x260]
call fcn.1400b04c9
mov dword [rbp + 0x234], eax
mov eax, dword [rbp + 0x234]
mov dword [rbp + 0x104], eax
mov eax, dword [rbp + 0x104]
cmp dword [rbp + 0x270], eax
jne 0x1401fb35c
mov eax, dword [rbp + 0xe4]
mov rcx, qword [rbp + 0x88]
movzx eax, word [rcx + rax*2]
mov dword [rbp + 0xa4], eax
jmp 0x1401fb361
jmp 0x1401fb2c5
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov eax, dword [rbp + 0x128]
cmp dword [rbp + 0xa4], eax
jbe 0x1401fb38b
xor eax, eax
jmp 0x1401fb3be
mov eax, dword [rbp + 0xa4]
mov rcx, qword [rbp + 0x128]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x148], rax
mov rax, qword [rbp + 0x148]
jmp 0x1401fb3be
lea rsp, [rbp + 0x248]
pop rdi
pop rbp
ret
Function at 0x1400b17d9
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
jmp 0x1401f5640
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x428
lea rbp, [rsp + 0x30]
mov dword [rbp + 0x3c4], 0
lea rcx, [0x14028336b]
call fcn.1400b2f21
nop
mov rax, qword [rbp + 0x410]
mov r9d, dword [rax + 0x14]
mov rax, qword [rbp + 0x410]
mov r8d, dword [rax + 0x10]
mov rax, qword [rbp + 0x410]
mov rdx, qword [rax]
mov rcx, qword [rbp + 0x410]
call fcn.1400b26cf
mov dword [rbp + 0x3d4], eax
mov eax, dword [rbp + 0x3d4]
mov dword [rbp + 0x64], eax
mov dword [rbp + 0x84], 0x18
mov dword [rbp + 0xa4], 0x18
mov dword [rbp + 0xc4], 0x10
mov rax, qword gs:[0x60]
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov rax, qword [rax + 0x18]
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0x108]
mov rax, qword [rax + 0x18]
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x128]
mov rax, qword [rax + 0x10]
mov qword [rbp + 0x148], rax
mov rax, qword [rbp + 0x128]
mov qword [rbp + 0x168], rax
mov eax, 0x10
imul rax, rax, 0
mov rcx, qword [rbp + 0x168]
mov rax, qword [rcx + rax]
mov qword [rbp + 0x168], rax
mov rax, qword [rbp + 0x168]
cmp qword [rax + 0x30], 0
je 0x1401f5763
lea rdx, [0x14023ccc0]
mov rax, qword [rbp + 0x168]
mov rcx, qword [rax + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1401f5763
jmp 0x1401f5773
mov rax, qword [rbp + 0x168]
cmp qword [rbp + 0x128], rax
jne 0x1401f571c
mov rax, qword [rbp + 0x168]
mov rax, qword [rax + 0x30]
mov qword [rbp + 8], rax
mov r9d, 0xa
mov r8d, 0xc
lea rdx, str.LoadLibraryA
mov rcx, qword [rbp + 0x410]
call fcn.1400b26cf
mov dword [rbp + 0x3d4], eax
mov eax, dword [rbp + 0x3d4]
mov dword [rbp + 0x184], eax
mov dword [rsp + 0x20], 0xa
mov r9d, 0xc
mov r8d, dword [rbp + 0x184]
mov rdx, qword [rbp + 8]
mov rcx, qword [rbp + 0x410]
call fcn.1400b0fdc
mov qword [rbp + 0x3d8], rax
mov rax, qword [rbp + 0x3d8]
mov qword [rbp + 0x1a8], rax
mov rax, qword [rbp + 0x1a8]
mov qword [rbp + 0x3d8], rax
mov rax, qword [rbp + 0x410]
mov rcx, qword [rax + 8]
call qword [rbp + 0x3d8]
mov qword [rbp + 0x3e0], rax
mov rax, qword [rbp + 0x3e0]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x410]
mov eax, dword [rax + 0x14]
mov dword [rsp + 0x20], eax
mov rax, qword [rbp + 0x410]
mov r9d, dword [rax + 0x10]
mov r8d, dword [rbp + 0x64]
mov rdx, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x410]
call fcn.1400b0fdc
mov qword [rbp + 0x3d8], rax
mov rax, qword [rbp + 0x3d8]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x3a8], rax
lea rdx, [rbp + 0x3a8]
lea rcx, [rbp + 0x350]
call fcn.1400b09b0
mov qword [rbp + 0x3d8], rax
mov rdx, qword [rbp + 0x3d8]
mov rcx, qword [rbp + 0x418]
call fcn.1400b13dd
mov eax, dword [rbp + 0x3c4]
or eax, 1
mov dword [rbp + 0x3c4], eax
lea rcx, [rbp + 0x350]
call fcn.1400b2d32
nop
mov rax, qword [rbp + 0x418]
jmp 0x1401f58c3
lea rsp, [rbp + 0x3f8]
pop rdi
pop rbp
ret
Function at 0x1400b19be
Capabilities:
Terminate process

Disassembly:
jmp 0x14020a350
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret
Function at 0x1400b1cde
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x1401fb8a0
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x268
lea rbp, [rsp + 0x20]
lea rcx, [0x14028336b]
call fcn.1400b2f21
nop
mov rax, qword [rbp + 0x268]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x28], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x20]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x24]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
mov dword [rbp + 0xa4], 0xffffffff
mov dword [rbp + 0xe4], 0
jmp 0x1401fb963
mov eax, dword [rbp + 0xe4]
inc eax
mov dword [rbp + 0xe4], eax
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x18]
dec eax
cmp dword [rbp + 0xe4], eax
jae 0x1401fb9f1
mov eax, dword [rbp + 0xe4]
mov rcx, qword [rbp + 0x68]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0xc8], rax
mov r9d, dword [rbp + 0x280]
mov r8d, dword [rbp + 0x278]
mov rdx, qword [rbp + 0xc8]
mov rcx, qword [rbp + 0x260]
call fcn.1400b1b35
mov dword [rbp + 0x234], eax
mov eax, dword [rbp + 0x234]
mov dword [rbp + 0x104], eax
mov eax, dword [rbp + 0x104]
cmp dword [rbp + 0x270], eax
jne 0x1401fb9ec
mov eax, dword [rbp + 0xe4]
mov rcx, qword [rbp + 0x88]
movzx eax, word [rcx + rax*2]
mov dword [rbp + 0xa4], eax
jmp 0x1401fb9f1
jmp 0x1401fb955
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov eax, dword [rbp + 0x128]
cmp dword [rbp + 0xa4], eax
jbe 0x1401fba1b
xor eax, eax
jmp 0x1401fba4e
mov eax, dword [rbp + 0xa4]
mov rcx, qword [rbp + 0x128]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x148], rax
mov rax, qword [rbp + 0x148]
jmp 0x1401fba4e
lea rsp, [rbp + 0x248]
pop rdi
pop rbp
ret
Function at 0x1400b1db0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
jmp 0x1401f42c0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x428
lea rbp, [rsp + 0x30]
mov dword [rbp + 0x3c4], 0
lea rcx, [0x14028336b]
call fcn.1400b2f21
nop
mov rax, qword [rbp + 0x410]
mov r9d, dword [rax + 0x14]
mov rax, qword [rbp + 0x410]
mov r8d, dword [rax + 0x10]
mov rax, qword [rbp + 0x410]
mov rdx, qword [rax]
mov rcx, qword [rbp + 0x410]
call fcn.1400b068b
mov dword [rbp + 0x3d4], eax
mov eax, dword [rbp + 0x3d4]
mov dword [rbp + 0x64], eax
mov dword [rbp + 0x84], 0x18
mov dword [rbp + 0xa4], 0x18
mov dword [rbp + 0xc4], 0x10
mov rax, qword gs:[0x60]
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov rax, qword [rax + 0x18]
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0x108]
mov rax, qword [rax + 0x18]
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x128]
mov rax, qword [rax + 0x10]
mov qword [rbp + 0x148], rax
mov rax, qword [rbp + 0x128]
mov qword [rbp + 0x168], rax
mov eax, 0x10
imul rax, rax, 0
mov rcx, qword [rbp + 0x168]
mov rax, qword [rcx + rax]
mov qword [rbp + 0x168], rax
mov rax, qword [rbp + 0x168]
cmp qword [rax + 0x30], 0
je 0x1401f43e3
lea rdx, [0x14023ccc0]
mov rax, qword [rbp + 0x168]
mov rcx, qword [rax + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1401f43e3
jmp 0x1401f43f3
mov rax, qword [rbp + 0x168]
cmp qword [rbp + 0x128], rax
jne 0x1401f439c
mov rax, qword [rbp + 0x168]
mov rax, qword [rax + 0x30]
mov qword [rbp + 8], rax
mov r9d, 0xa
mov r8d, 0xc
lea rdx, str.LoadLibraryA
mov rcx, qword [rbp + 0x410]
call fcn.1400b068b
mov dword [rbp + 0x3d4], eax
mov eax, dword [rbp + 0x3d4]
mov dword [rbp + 0x184], eax
mov dword [rsp + 0x20], 0xa
mov r9d, 0xc
mov r8d, dword [rbp + 0x184]
mov rdx, qword [rbp + 8]
mov rcx, qword [rbp + 0x410]
call fcn.1400b02bc
mov qword [rbp + 0x3d8], rax
mov rax, qword [rbp + 0x3d8]
mov qword [rbp + 0x1a8], rax
mov rax, qword [rbp + 0x1a8]
mov qword [rbp + 0x3d8], rax
mov rax, qword [rbp + 0x410]
mov rcx, qword [rax + 8]
call qword [rbp + 0x3d8]
mov qword [rbp + 0x3e0], rax
mov rax, qword [rbp + 0x3e0]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x410]
mov eax, dword [rax + 0x14]
mov dword [rsp + 0x20], eax
mov rax, qword [rbp + 0x410]
mov r9d, dword [rax + 0x10]
mov r8d, dword [rbp + 0x64]
mov rdx, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x410]
call fcn.1400b02bc
mov qword [rbp + 0x3d8], rax
mov rax, qword [rbp + 0x3d8]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x3a8], rax
lea rdx, [rbp + 0x3a8]
lea rcx, [rbp + 0x350]
call fcn.1400b0c76
mov qword [rbp + 0x3d8], rax
mov rdx, qword [rbp + 0x3d8]
mov rcx, qword [rbp + 0x418]
call fcn.1400b1338
mov eax, dword [rbp + 0x3c4]
or eax, 1
mov dword [rbp + 0x3c4], eax
lea rcx, [rbp + 0x350]
call fcn.1400b0a0f
nop
mov rax, qword [rbp + 0x418]
jmp 0x1401f4543
lea rsp, [rbp + 0x3f8]
pop rdi
pop rbp
ret