joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003f030
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x58], rsi
mov rsi, rcx
mov ecx, 0x20
call fcn.140042afc
mov rdi, rax
mov qword [rsp + 0x68], rax
test rax, rax
je 0x14003f091
mov rcx, qword [rsi + 0x18]
test rcx, rcx
jne 0x14003f071
and qword [rax + 0x18], rcx
jmp 0x14003f093
cmp rcx, rsi
jne 0x14003f084
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax]
mov qword [rdi + 0x18], rax
jmp 0x14003f093
mov rax, qword [rcx]
xor edx, edx
call qword [rax]
mov qword [rdi + 0x18], rax
jmp 0x14003f093
xor edi, edi
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
mov r9, rdi
lea r8, [0x14003f104]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x14003f0d0
mov r8, qword [rcx]
cmp rcx, rsi
setne dl
call qword [r8 + 0x18]
and qword [rsi + 0x18], 0
mov rax, rdi
jmp 0x14003f0f6
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x14003f18c
Capabilities:
Delete registry value

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
sub rsp, 0xc0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov rax, qword [0x14007e090]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rsi, r9
mov bpl, r8b
mov rdi, rdx
xor r12d, r12d
cmp word [0x140083e50], r12w
je 0x14003f2f6
lea rcx, [r11 - 0x50]
call fcn.1400133b0
nop
cmp qword [rsp + 0xa0], r12
je 0x14003f2de
lea rcx, [rsp + 0x90]
cmp qword [rsp + 0xa8], 8
cmovae rcx, qword [rsp + 0x90]
lea rbx, [0x1400667d2]
cmp rsi, r12
cmovne rbx, rsi
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov r8, rax
mov qword [rsp + 0x20], rdi
mov r9, rbx
lea rdx, str._s__hs__p
lea rcx, [rsp + 0x60]
call fcn.140013c28
nop
cmp bpl, r12b
je 0x14003f29f
lea edx, [r12 + 1]
lea rcx, [rsp + 0x38]
call fcn.140012d78
cmp qword [rax + 0x20], 8
jb 0x14003f25b
mov r9, qword [rax + 8]
jmp 0x14003f25f
lea r9, [rax + 8]
lea r8, [rsp + 0x68]
cmp qword [rsp + 0x80], 8
cmovae r8, qword [rsp + 0x68]
mov dword [rsp + 0x20], r12d
lea rdx, [0x140083e50]
mov rcx, 0xffffffff80000002
call fcn.140013dc8
cmp qword [rsp + 0x58], 8
jb 0x14003f2c8
mov rcx, qword [rsp + 0x40]
call fcn.140042a98
jmp 0x14003f2c8
lea r8, [rsp + 0x68]
cmp qword [rsp + 0x80], 8
cmovae r8, qword [rsp + 0x68]
lea rdx, [0x140083e50]
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
nop
cmp qword [rsp + 0x80], 8
jb 0x14003f2de
mov rcx, qword [rsp + 0x68]
call fcn.140042a98
nop
cmp qword [rsp + 0xa8], 8
jb 0x14003f2f6
mov rcx, qword [rsp + 0x90]
call fcn.140042a98
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140042a40
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x14003f55c
Capabilities:
Delete registry key

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x2b0
movaps xmmword [rax - 0x18], xmm6
mov rax, qword [0x14007e090]
xor rax, rsp
mov qword [rsp + 0x290], rax
lea rcx, str.SoftwareWOW6432Nodeprojonepodlpdebug_async_
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor ebp, ebp
dec eax
cmp eax, 0xc6
ja 0x14003f63a
lea rdi, [0x140083e50]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlpdebug_async_
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rsp + 0x82]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x80], bp
call fcn.1400452b0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, 0x104
lea rdx, [rsp + 0x80]
mov rcx, rax
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [0x14006738c]
mov r8d, ebx
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_StrCatBuffW]
lea rcx, [rsp + 0x80]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov r8d, ebx
mov rcx, rdi
mov rdx, rax
call qword [sym.imp.SHLWAPI.dll_StrCatBuffW]
mov rdx, rdi
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea rax, [fcn.14002c52c]
mov qword [0x1400843b8], rax
cmp byte [0x140084310], bpl
jne 0x14003f753
lea rax, [0x14003f320]
mov edi, 1
mov qword [rsp + 0x20], rax
lea rax, [0x140084310]
lea esi, [rdi + 2]
mov qword [rsp + 0x28], rax
mov byte [0x140084310], dil
mov dword [0x140084348], esi
movdqu xmm6, xmmword [rsp + 0x20]
mov ecx, 0x20
call fcn.140042afc
cmp rax, rbp
je 0x14003f6a6
lea rcx, [0x140069648]
mov qword [rax], rcx
movdqu xmmword [rax + 8], xmm6
lea rcx, [rsp + 0x50]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x68], rax
call fcn.14003f030
mov rdx, qword [0x140084368]
mov r11, rax
mov qword [rsp + 0x20], rax
cmp rdx, rbp
jne 0x14003f6d3
mov rcx, rbp
jmp 0x14003f6e1
mov rcx, qword [0x140084378]
sub rcx, rdx
sar rcx, 3
mov rbx, qword [0x140084370]
mov rax, rbx
sub rax, rdx
sar rax, 3
cmp rax, rcx
jae 0x14003f707
lea rax, [rbx + 8]
mov qword [rbx], r11
mov qword [0x140084370], rax
jmp 0x14003f748
cmp rdx, rbx
jbe 0x14003f711
call fcn.140042ffc
mov rax, qword [0x140084350]
mov qword [rsp + 0x38], rbx
lea r9, [rsp + 0x20]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x70]
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [0x140084350]
call fcn.14003fa10
sub rsi, rdi
jne 0x14003f688
jmp 0x14003f756
mov dil, bpl
mov al, dil
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.140042a40
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop rdi
ret
Function at 0x14004360c
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.140047400
nop
cmp dword [0x1400814b8], 1
je 0x1400435b8
mov dword [0x1400814b4], 1
mov byte [0x1400814b0], r12b
test ebx, ebx
jne 0x1400435a4
mov rcx, qword [0x140086060]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140043591
mov rcx, qword [0x140086058]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x140043530
call fcn.140044670
cmp qword [rdi], rax
jne 0x140043530
jmp 0x140043516
cmp rdi, rsi
jb 0x140043591
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.140044670
mov qword [rdi], rax
call rbx
mov rcx, qword [0x140086060]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x140086058]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x14004356f
cmp r13, rax
je 0x14004358f
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x140043516
lea rdx, [0x1400638b8]
lea rcx, [0x1400638a0]
call fcn.140043360
lea rdx, [0x1400638c8]
lea rcx, [0x1400638c0]
call fcn.140043360
nop
test r12d, r12d
je 0x1400435c7
mov ecx, 8
call fcn.140047300
test r12d, r12d
jne 0x1400435f2
mov dword [0x1400814b8], 1
lea ecx, [r12 + 8]
call fcn.140047300
mov ecx, r15d
call fcn.1400432f4
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
jmp 0x140043480

Function at 0x140043618
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x140043480
Function at 0x140044297
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x14007e090]
jne 0x140042a5a
rol rcx, 0x10
test cx, 0xffff
jne 0x140042a56
repz ret
ror rcx, 0x10
jmp 0x1400441f0
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140081580]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x140081678]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140044275
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140081580]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140044297
mov rax, qword [rsp + 0x88]
mov qword [0x140081678], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140081618], rax
mov rax, qword [0x140081678]
mov qword [0x1400814f0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140081600], rax
mov dword [0x1400814e0], 0xc0000409
mov dword [0x1400814e4], 1
mov rax, qword [0x14007e090]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14007e098]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140081578], eax
mov ecx, 1
call fcn.140045298
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140063b58]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140081578], 0
jne 0x14004431e
mov ecx, 1
call fcn.140045298
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x14004a0e4
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.140044670
xor ebx, ebx
mov rdi, rax
cmp qword [0x140082278], rbx
jne 0x14004a1ea
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x14004a2bf
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14004a2bf
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x140082278], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x140082280], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x140082288], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x140082298], rax
test rax, rax
je 0x14004a1e1
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x140082290], rax
jmp 0x14004a1f1
mov rax, qword [0x140082290]
jmp 0x14004a1f8
mov rax, qword [0x140082290]
mov r11, qword [0x140082298]
cmp rax, rdi
je 0x14004a260
cmp r11, rdi
je 0x14004a260
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x140082298]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x14004a260
test rax, rax
je 0x14004a260
call rsi
test rax, rax
je 0x14004a25a
lea rcx, [rsp + 0x88]
mov r9d, recvfrom
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14004a25a
test byte [rsp + 0x38], 1
jne 0x14004a260
bts ebp, 0x15
jmp 0x14004a29e
mov rcx, qword [0x140082280]
cmp rcx, rdi
je 0x14004a29e
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14004a29e
call rax
mov rbx, rax
test rax, rax
je 0x14004a29e
mov rcx, qword [0x140082288]
cmp rcx, rdi
je 0x14004a29e
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14004a29e
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140082278]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14004a2bf
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x14004a2c1
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x14004df80
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov r8d, 0x30
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
nop
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14004dfc5
xor al, al
jmp 0x14004e043
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 0x3c]
mov rax, qword [rsp + 0x50]
add rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
cmp dword [rax], 0x4550
je 0x14004dfec
xor al, al
jmp 0x14004e043
mov rax, qword [rsp + 0x58]
mov ecx, dword [rax + 0xe8]
mov rax, qword [rsp + 0x50]
add rax, rcx
cmp qword [rsp + 0x88], rax
jb 0x14004e03b
mov rax, qword [rsp + 0x58]
mov eax, dword [rax + 0xe8]
mov rdx, qword [rsp + 0x50]
add rdx, rax
mov rax, qword [rsp + 0x58]
mov ecx, dword [rax + 0xec]
mov rax, rdx
add rax, rcx
cmp qword [rsp + 0x88], rax
jae 0x14004e03b
mov al, 1
jmp 0x14004e043
jmp 0x14004e041
xor al, al
add rsp, 0x78
ret

Function at 0x14004e0c0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1400823e0]
mov qword [rsp + 0x20], rax
jmp 0x14004e0e0
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14004e111
lea r9, [rsp + 0x28]
mov r8d, 0x40
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14004e10f
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14004e113
jmp 0x14004e0d2
xor eax, eax
add rsp, 0x38
ret
Function at 0x14004e120
Capabilities:
Resume thread

Disassembly:
sub rsp, 0x68
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x1400823f8], eax
je 0x14004e13c
mov eax, 0x10dd
jmp 0x14004e257
mov rax, qword [0x140082410]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14004e1e0
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x20]
movzx edx, byte [rax + 0x3e]
lea r9, [rsp + 0x30]
mov rax, qword [rsp + 0x20]
mov r8d, dword [rax + 0x28]
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, qword [rsp + 0x20]
cmp dword [rax + 8], 0
jne 0x14004e1b0
mov rax, qword [rsp + 0x20]
cmp qword [rax + 0x20], 0
je 0x14004e1b0
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx + 0x20]
call fcn.14004e2d0
mov r11, qword [rsp + 0x20]
mov qword [r11 + 0x20], 0
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x48]
call fcn.140042a98
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x20], rax
jmp 0x14004e148
mov qword [0x140082410], 0
call fcn.14004e260
mov rax, qword [0x140082408]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x14004e240
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
call fcn.140042a98
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x38], rax
jmp 0x14004e1fc
mov qword [0x140082408], 0
mov dword [0x1400823f8], 0
xor eax, eax
add rsp, 0x68
ret
Function at 0x14004e960
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x52727464
je 0x14004e97d
xor eax, eax
jmp 0x14004ea16
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
mov rax, qword [rsp]
add rax, 0x10000
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x30]
add rax, 0x60
mov qword [rsp + 0x10], rax
mov dword [rsp + 0x18], 0
jmp 0x14004e9b8
mov eax, dword [rsp + 0x18]
add eax, 1
mov dword [rsp + 0x18], eax
cmp dword [rsp + 0x18], 0x2a9
jae 0x14004ea11
movsxd rcx, dword [rsp + 0x18]
imul rcx, rcx, 0x60
mov rax, qword [rsp + 0x10]
cmp qword [rax + rcx + 0x48], 0
je 0x14004ea0f
movsxd rdx, dword [rsp + 0x18]
imul rdx, rdx, 0x60
mov rcx, qword [rsp + 0x10]
mov rax, qword [rsp]
cmp qword [rcx + rdx + 0x48], rax
jb 0x14004ea0b
movsxd rdx, dword [rsp + 0x18]
imul rdx, rdx, 0x60
mov rcx, qword [rsp + 0x10]
mov rax, qword [rsp + 8]
cmp qword [rcx + rdx + 0x48], rax
jb 0x14004ea0f
xor eax, eax
jmp 0x14004ea16
jmp 0x14004e9ad
mov eax, 1
add rsp, 0x28
ret

Function at 0x14004eb00
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp dword [0x1400823fc], 0
je 0x14004eb1d
mov eax, dword [0x1400823fc]
jmp 0x14004ebe1
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp qword [rsp + 0x50], rax
jne 0x14004eb31
xor eax, eax
jmp 0x14004ebe1
mov ecx, recvfrom
call fcn.140042afc
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x14004eb9a
mov dword [rsp + 0x20], 8
cmp qword [rsp + 0x28], 0
je 0x14004eb7f
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
call fcn.140042a98
mov qword [rsp + 0x28], 0
mov eax, dword [rsp + 0x20]
mov dword [0x1400823fc], eax
mov qword [0x140082400], 0
mov eax, dword [rsp + 0x20]
jmp 0x14004ebe1
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x14004ebb6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
jmp 0x14004eb5a
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x50]
mov qword [rcx + 8], rax
mov rcx, qword [rsp + 0x28]
mov rax, qword [0x140082408]
mov qword [rcx], rax
mov rax, qword [rsp + 0x28]
mov qword [0x140082408], rax
xor eax, eax
add rsp, 0x48
ret
Function at 0x14004fc80
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.14004fd90
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x14004fd7d
mov rax, qword [0x14007f0d0]
cmp qword [rsp + 0x20], rax
jb 0x14004fcdb
mov rax, qword [0x14007f0d8]
cmp qword [rsp + 0x20], rax
ja 0x14004fcdb
mov rax, qword [rsp + 0x20]
add rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x14004fc9d
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.1400452b0
mov r8d, 0x30
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x14004fd0a
jmp 0x14004fd7d
cmp dword [rsp + 0x48], 0x10000
jne 0x14004fd61
cmp qword [rsp + 0x40], 0x10000
jb 0x14004fd61
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
je 0x14004fd4f
mov rax, qword [rsp + 0x58]
jmp 0x14004fd7f
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x14004fd78
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
add rcx, rax
call fcn.14004fd90
mov qword [rsp + 0x20], rax
jmp 0x14004fc9d
xor eax, eax
add rsp, 0x68
ret

Function at 0x14004fde0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x78]
sub rcx, 0x10000
call fcn.14004fef0
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x14004fee3
mov rax, qword [0x14007f0d0]
cmp qword [rsp + 0x20], rax
jb 0x14004fe42
mov rax, qword [0x14007f0d8]
cmp qword [rsp + 0x20], rax
ja 0x14004fe42
mov rax, qword [rsp + 0x20]
sub rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x14004fe04
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.1400452b0
mov r8d, 0x30
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x14004fe71
jmp 0x14004fee3
cmp dword [rsp + 0x48], 0x10000
jne 0x14004fec8
cmp qword [rsp + 0x40], 0x10000
jb 0x14004fec8
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
je 0x14004feb6
mov rax, qword [rsp + 0x58]
jmp 0x14004fee5
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x14004fede
mov rcx, qword [rsp + 0x30]
sub rcx, 0x10000
call fcn.14004fef0
mov qword [rsp + 0x20], rax
jmp 0x14004fe04
xor eax, eax
add rsp, 0x68
ret
Function at 0x14004ff30
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x38
cmp dword [0x140082470], 0
je 0x14004ff44
xor eax, eax
jmp 0x1400501af
cmp qword [0x140082468], 0
je 0x14004ff5a
mov rax, qword [0x140082468]
jmp 0x1400501af
mov r8d, 0x48
xor edx, edx
lea rcx, [0x140082420]
call fcn.1400452b0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [0x140082420], rax
xor r8d, r8d
xor edx, edx
lea rcx, str.dbghelp.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [0x140082428], rax
cmp qword [0x140082428], 0
jne 0x140050013
mov dword [0x140082470], 1
cmp qword [0x140082428], 0
je 0x14004ffbf
mov rcx, qword [0x140082428]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x140082430], 0
mov qword [0x140082438], 0
mov qword [0x140082440], 0
mov qword [0x140082448], 0
mov qword [0x140082450], 0
mov qword [0x140082458], 0
mov qword [0x140082460], 0
xor eax, eax
jmp 0x1400501af
lea rdx, str.ImagehlpApiVersionEx
mov rcx, qword [0x140082428]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140082430], rax
lea rdx, str.SymInitialize
mov rcx, qword [0x140082428]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140082438], rax
lea rdx, str.SymSetOptions
mov rcx, qword [0x140082428]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140082440], rax
lea rdx, str.SymGetOptions
mov rcx, qword [0x140082428]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140082448], rax
lea rdx, str.SymLoadModule64
mov rcx, qword [0x140082428]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140082450], rax
lea rdx, str.SymGetModuleInfo64
mov rcx, qword [0x140082428]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140082458], rax
lea rdx, str.SymFromName
mov rcx, qword [0x140082428]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140082460], rax
mov r8d, 8
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.1400452b0
mov r11d, 0xb
mov word [rsp + 0x20], r11w
cmp qword [0x140082430], 0
je 0x140050120
cmp qword [0x140082438], 0
je 0x140050120
cmp qword [0x140082450], 0
je 0x140050120
cmp qword [0x140082458], 0
je 0x140050120
cmp qword [0x140082460], 0
jne 0x140050125
jmp 0x14004ff9e
lea rcx, [rsp + 0x20]
call qword [0x140082430]
movzx eax, word [rsp + 0x20]
cmp eax, 0xb
jge 0x14005013f
jmp 0x14004ff9e
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x140082420]
call qword [0x140082438]
test eax, eax
jne 0x14005015a
jmp 0x14004ff9e
cmp qword [0x140082448], 0
je 0x14005019a
cmp qword [0x140082440], 0
je 0x14005019a
call qword [0x140082448]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x28]
and eax, 0xfffffff8
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x28]
or eax, 0x2704
mov dword [rsp + 0x28], eax
mov ecx, dword [rsp + 0x28]
call qword [0x140082440]
lea rax, [0x140082420]
mov qword [0x140082468], rax
mov rax, qword [0x140082468]
add rsp, 0x38
ret