joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008da70
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x11be0]
mov eax, 0x11ce0
call fcn.1400bdef0
sub rsp, rax
mov r10, qword [rbp + 0x11c10]
mov rdi, rcx
movzx ecx, word [rdx]
mov r11d, 0xffdf
lea eax, [rcx - 0x41]
test r11w, ax
jne 0x14008db24
cmp word [rdx + 2], 0
jne 0x14008db24
cmp word [r8], 0
jne 0x14008db24
cmp word [r9], 0
jne 0x14008db24
cmp word [r10], 0
jne 0x14008db24
mov qword [rsp + 0x11cf0], rbx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, rax
test rax, rax
je 0x14008daf3
cmp byte [rdi + 0x12a], 0
jne 0x14008daf3
mov rcx, rax
call qword [sym.imp.USER32.dll_IsWindowVisible]
xor ecx, ecx
test eax, eax
cmove rbx, rcx
cmp byte [rbp + 0x11c20], 0
je 0x14008db08
test rbx, rbx
je 0x14008db08
mov qword [rdi + 0xf8], rbx
mov rax, rbx
mov rbx, qword [rsp + 0x11cf0]
mov rdi, qword [rsp + 0x11cf8]
add rsp, 0x11ce0
pop rbp
ret
test cx, cx
jne 0x14008db54
cmp word [r8], cx
jne 0x14008db54
cmp word [r9], cx
jne 0x14008db54
cmp word [r10], cx
jne 0x14008db54
mov rcx, rdi
call fcn.14008dcd0
mov rdi, qword [rsp + 0x11cf8]
add rsp, 0x11ce0
pop rbp
ret
xor ecx, ecx
mov qword [rsp + 0x28], r10
mov qword [rsp + 0x20], r9
lea rax, [0x1400ccf5c]
mov r9, r8
mov dword [rsp + 0x30], ecx
mov r8, rdx
mov byte [rbp + 0x1781], cl
mov dword [rbp + 0x1784], ecx
xorps xmm0, xmm0
mov qword [rbp + 0x1788], rcx
mov rdx, rdi
mov dword [rbp + 0x17a0], ecx
mov qword [rbp + 0x17a8], rcx
mov qword [rbp + 0x17b8], rcx
mov qword [rbp + 0x17c0], rcx
lea rcx, [rsp + 0x30]
mov qword [rbp + 0xf48], rax
movdqa xmmword [rbp + 0x1790], xmm0
call fcn.14008eaa0
test eax, eax
je 0x14008dc76
test byte [rsp + 0x30], 2
movzx eax, byte [rbp + 0x11c18]
mov byte [rbp + 0x1781], al
mov rax, qword [rbp + 0x11c28]
mov qword [rbp + 0x1798], rax
mov eax, dword [rbp + 0x11c30]
mov dword [rbp + 0x17a0], eax
je 0x14008dc89
mov rax, qword [rbp + 0xf68]
cmp rax, 0xffff
je 0x14008dc4b
mov rcx, rax
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x14008dc76
cmp byte [rdi + 0x12a], 0
jne 0x14008dc44
mov rcx, qword [rbp + 0xf68]
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x14008dc44
mov rcx, qword [rbp + 0xf68]
lea edx, [rax - 0x10]
call qword [sym.imp.USER32.dll_GetWindowLongW]
bt eax, 0x1e
jae 0x14008dc76
mov rax, qword [rbp + 0xf68]
cmp qword [rbp + 0x17c0], rax
je 0x14008dc65
lea rcx, [rsp + 0x30]
mov qword [rbp + 0x17c0], rax
call fcn.14008ef40
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14008f030
test rax, rax
jne 0x14008dc9b
xor eax, eax
mov rdi, qword [rsp + 0x11cf8]
add rsp, 0x11ce0
pop rbp
ret
lea rdx, [rsp + 0x30]
lea rcx, [0x14008dd60]
call qword [sym.imp.USER32.dll_EnumWindows]
cmp byte [rbp + 0x11c20], 0
mov rax, qword [rbp + 0x1788]
je 0x14008dcb7
test rax, rax
je 0x14008dcb7
mov qword [rdi + 0xf8], rax
mov rdi, qword [rsp + 0x11cf8]
add rsp, 0x11ce0
pop rbp
ret
Function at 0x14008ef40
Capabilities:
Get graphical window text

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x1890]
test rcx, rcx
je 0x14008f023
mov eax, dword [rbx]
test eax, eax
je 0x14008f023
mov qword [rsp + 0x38], rsi
xor esi, esi
mov qword [rsp + 0x40], rdi
test al, 1
jne 0x14008ef7f
mov rax, qword [rbx + 0x1018]
cmp word [rax], si
je 0x14008ef9d
mov r8d, 0x7fff
lea rdx, [rbx + 0x189c]
call qword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x14008ef9d
mov word [rbx + 0x189c], si
test byte [rbx], 4
je 0x14008efb6
mov rcx, qword [rbx + 0x1890]
lea rdx, [rbx + 0x1898]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test byte [rbx], 0x20
je 0x14008eff4
mov rcx, qword [rbx + 0x1890]
lea rdx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x14008eff4
movzx r9d, byte [rbx + 0x1850]
lea rdx, [rbx + 0x11a9c]
mov ecx, dword [rsp + 0x30]
call fcn.14005d340
test eax, eax
jne 0x14008eff4
mov word [rbx + 0x11a9c], si
test byte [rbx], 8
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
je 0x14008f023
mov rcx, qword [rbx + 0x1890]
lea rdx, [rbx + 0x1189a]
mov r8d, 0x101
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_GetClassNameW]
add rsp, 0x20
pop rbx
ret

Function at 0x14008f890
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x11cd8
call fcn.1400bdef0
sub rsp, rax
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14008f94a
xor r9d, r9d
mov byte [rsp + 0x18a0], dl
lea rcx, [0x1400ccf5c]
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x1038], rcx
lea rdx, [rsp + 0x20]
xorps xmm0, xmm0
mov byte [rsp + 0x1871], r9b
lea rcx, [0x140090190]
mov dword [rsp + 0x1874], r9d
mov qword [rsp + 0x1878], r9
movdqa xmmword [rsp + 0x1880], xmm0
mov dword [rsp + 0x1890], r9d
mov qword [rsp + 0x18a8], r9
mov qword [rsp + 0x18b0], r9
mov qword [rsp + 0x1898], rax
mov dword [rsp + 0x18a4], r8d
call qword [sym.imp.USER32.dll_EnumWindows]
cmp qword [rsp + 0x1878], 0
je 0x14008f94a
mov rax, qword [0x1400fda58]
mov ecx, dword [rax + 0x74]
cmp ecx, 0xffffffff
jle 0x14008f94a
mov edx, 1
call fcn.140001710
mov eax, 1
add rsp, 0x11cd8
ret
Function at 0x14008f960
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x20], rbx
push r14
sub rsp, 0x20
cmp qword [rcx + 0x10], 0
movzx r14d, dl
mov rbx, rcx
jne 0x14008f98a
mov eax, 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x40], rdi
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r8, qword [0x1400fda58]
mov rcx, rbx
mov rdx, rax
mov rdi, rax
call fcn.14008ff30
cmp byte [rbx], 0
mov rbp, rax
je 0x14008f9c1
test rax, rax
jne 0x14008f9ca
jmp 0x14008fa62
test rbp, rbp
jne 0x14008fa5d
test rdi, rdi
je 0x14008fa5d
xor r9d, r9d
mov qword [rsp + 0x38], rsi
xor r8d, r8d
mov rcx, rdi
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_PostMessageW]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, 1
mov ecx, 0x8000012f
mov esi, eax
call fcn.140001710
mov rcx, rdi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x14008fa3f
nop
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [rsi + 0x1f4]
sub ecx, eax
cmp ecx, 5
jle 0x14008fa3f
mov edx, 1
mov ecx, 0x8000012f
call fcn.140001710
mov rcx, rdi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x14008fa10
mov rax, qword [0x1400fda58]
mov rsi, qword [rsp + 0x38]
mov ecx, dword [rax + 0x74]
cmp ecx, 0xffffffff
jle 0x14008fa5d
mov edx, 1
call fcn.140001710
cmp byte [rbx], 0
je 0x14008fa76
xor r9d, r9d
mov r8, rbp
movzx edx, r14b
mov rcx, rbx
call fcn.14008faa0
jmp 0x14008fa82
movzx edx, r14b
mov rcx, rbx
call fcn.14008fc90
mov rdi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14008fc90
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
mov eax, 0x11ce0
call fcn.1400bdef0
sub rsp, rax
cmp qword [rcx + 0x10], 0
movzx edi, dl
mov rbx, rcx
je 0x14008fe54
xor edx, edx
call fcn.14008fe70
test eax, eax
jne 0x14008fcd0
mov rbx, qword [rsp + 0x11d00]
add rsp, 0x11ce0
pop rdi
ret
mov qword [rsp + 0x11cf0], rbp
mov qword [rsp + 0x11cf8], rsi
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r8, qword [0x1400fda58]
mov rcx, rbx
mov rdx, rax
mov rsi, rax
call fcn.14008ff30
mov ecx, dword [0x140104458]
xor ebp, ebp
test rax, rax
mov dword [rsp + 0x30], ebp
lea rax, [0x1400ccf5c]
mov dword [rsp + 0x1884], ebp
cmovne ecx, ebp
mov qword [rsp + 0x1048], rax
mov dword [0x140104458], ecx
mov qword [rsp + 0x1888], rbp
mov qword [rsp + 0x1890], rbp
mov qword [rsp + 0x18b8], rbp
mov qword [rsp + 0x18c0], rbp
test dil, dil
je 0x14008fd5a
mov byte [rsp + 0x1881], bpl
test ecx, ecx
je 0x14008fd62
mov byte [rsp + 0x1881], 1
mov rax, qword [0x140104450]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x1898], rax
mov rax, qword [rbx + 0x10]
mov dword [rsp + 0x18a0], ecx
lea rcx, [0x140090050]
mov qword [rsp + 0x18a8], rax
call qword [sym.imp.USER32.dll_EnumWindows]
mov rax, qword [rsp + 0x1888]
test rax, rax
je 0x14008fe18
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
lea rcx, [0x14008e7c0]
mov qword [rsp + 0x28], rbp
call qword [sym.imp.USER32.dll_EnumWindows]
mov r10, qword [rsp + 0x28]
test r10, r10
je 0x14008fde0
mov rcx, qword [rsp + 0x1888]
call fcn.14008f5a0
mov qword [rsp + 0x1888], r10
jmp 0x14008fde8
mov r10, qword [rsp + 0x1888]
mov rcx, r10
call fcn.14008d4a0
mov rcx, qword [rsp + 0x1888]
call fcn.14008f5a0
mov rcx, qword [0x1400fda58]
mov ecx, dword [rcx + 0x74]
cmp ecx, 0xffffffff
jle 0x14008fe44
mov edx, 1
call fcn.140001710
jmp 0x14008fe44
mov eax, dword [0x140104458]
test eax, eax
je 0x14008fe44
cmp eax, 1
mov dword [0x140104458], ebp
setg al
test al, al
je 0x14008fe44
mov rcx, rsi
call fcn.14008f5a0
xor edx, edx
mov rcx, rbx
call fcn.14008fc90
mov rsi, qword [rsp + 0x11cf8]
mov rbp, qword [rsp + 0x11cf0]
mov eax, 1
mov rbx, qword [rsp + 0x11d00]
add rsp, 0x11ce0
pop rdi
ret
Function at 0x1400acb38
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x1400ac90c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400ac90c
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400ac90c
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400ac90c
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400ac90c
cmp dword [rcx + 0x84], 0xe
jbe 0x1400ac90c
cmp dword [rcx + 0xf8], esi
je 0x1400ac90c
mov ecx, r14d
call fcn.1400aca54
mov ecx, 2
call fcn.1400b5d70
nop
cmp byte [0x140100b00], 0
jne 0x1400ac9d6
mov r15d, 1
mov eax, r15d
xchg dword [0x140100af4], eax
test ebx, ebx
jne 0x1400ac97f
mov rdi, qword [0x1400fd018]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x140100af8]
cmp rcx, rax
je 0x1400ac976
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.140016cf0]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x140100d40]
jmp 0x1400ac98b
cmp ebx, r15d
jne 0x1400ac991
lea rcx, [0x140100d58]
call fcn.1400b2990
nop
test ebx, ebx
jne 0x1400ac9a8
lea rdx, [0x1400c4f68]
lea rcx, [0x1400c4f48]
call fcn.1400b2d24
lea rdx, [0x1400c4f78]
lea rcx, [0x1400c4f70]
call fcn.1400b2d24
movzx eax, byte [0x140100b00]
test esi, esi
cmove eax, r15d
mov byte [0x140100b00], al
jmp 0x1400ac9d6
mov ecx, 2
call fcn.1400b5dc4
test esi, esi
jne 0x1400ac9ed
mov ecx, r14d
call fcn.1400aca08
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x1400ac89c
Function at 0x140007e10
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x140025040]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rsi, rdx
mov r14, rcx
lea r15, [rdx + 0x10]
xor r12d, r12d
mov qword [r15], r12
mov rax, rdx
cmp qword [rdx + 0x18], 7
jbe 0x140007e52
mov rax, qword [rdx]
mov word [rax], r12w
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x38], 7
mov qword [rsp + 0x30], r12
mov word [rsp + 0x20], r12w
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
test eax, eax
jne 0x140007eb7
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
je 0x140007fd5
test eax, eax
jle 0x140007ea0
movzx eax, ax
or eax, 0x80070000
mov r8d, eax
mov rdx, r14
lea rcx, str.Failed_to_read_environment_variable___s___HRESULT:_0x_X
call fcn.140007430
jmp 0x140007fd5
mov eax, 2
mul rdi
mov rbx, 0xffffffffffffffff
cmovo rax, rbx
mov rcx, rax
call fcn.140013e5c
mov rbp, rax
mov r8d, edi
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x140007e83
nop dword [rax + rax]
inc rbx
cmp word [rbp + rbx*2], 0
jne 0x140007ef0
mov rax, qword [rsp + 0x38]
cmp rbx, rax
ja 0x140007f31
lea rdi, [rsp + 0x20]
cmp rax, 7
cmova rdi, qword [rsp + 0x20]
mov qword [rsp + 0x30], rbx
add rbx, rbx
mov r8, rbx
mov rdx, rbp
mov rcx, rdi
call fcn.140018f50
mov word [rbx + rdi], r12w
jmp 0x140007f41
mov r9, rbp
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140005e50
mov rcx, rbp
call fcn.140013ba0
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.14000f870
test al, al
je 0x140007fb5
lea rax, [rsp + 0x20]
cmp rsi, rax
je 0x140007fb1
lea r9, [rsp + 0x20]
cmp qword [rsp + 0x38], 7
cmova r9, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
mov rax, qword [rsi + 0x18]
cmp rbx, rax
ja 0x140007fa6
cmp rax, 7
jbe 0x140007f8b
mov rsi, qword [rsi]
mov qword [r15], rbx
lea r8, [rbx + rbx]
mov rdx, r9
mov rcx, rsi
call fcn.140018f50
mov word [rsi + rbx*2], r12w
mov bl, 1
jmp 0x140007fd7
mov rdx, rbx
mov rcx, rsi
call fcn.140005e50
mov bl, 1
jmp 0x140007fd7
lea r8, [rsp + 0x20]
cmp qword [rsp + 0x38], 7
cmova r8, qword [rsp + 0x20]
mov rdx, r14
lea rcx, str.Did_not_find___s__directory___s_
call fcn.1400070a0
xor bl, bl
mov rdx, qword [rsp + 0x38]
cmp rdx, 7
jbe 0x14000801c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008017
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008017
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140013ba0
movzx eax, bl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140013b80
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14000f0a0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x140025040]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r14, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xor ebp, ebp
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], 7
mov word [rsp + 0x20], bp
movzx eax, byte [str.d38cc827_e34f_4453_9df4_1e796e9f1d07]
cmp al, 0x65
jne 0x14000f141
mov qword [rsp + 0x30], rbp
mov word [rsp + 0x20], bp
xor r8d, r8d
xor edx, edx
lea rcx, str._DOTNET_TEST_GLOBALLY_REGISTERED_PATH
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
test eax, eax
jne 0x14000f19d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
je 0x14000f141
test eax, eax
jle 0x14000f12b
movzx eax, ax
or eax, 0x80070000
mov r8d, eax
lea rdx, str._DOTNET_TEST_GLOBALLY_REGISTERED_PATH
lea rcx, str.Failed_to_read_environment_variable___s___HRESULT:_0x_X
call fcn.140007430
mov rdx, r14
mov ecx, 7
call fcn.14000f2c0
movzx ebx, al
mov rdx, qword [rsp + 0x38]
cmp rdx, 7
jbe 0x14000f297
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f292
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000f292
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov eax, 2
mul rdi
mov rbx, 0xffffffffffffffff
cmovo rax, rbx
mov rcx, rax
call fcn.140013e5c
mov rsi, rax
mov r8d, edi
mov rdx, rax
lea rcx, str._DOTNET_TEST_GLOBALLY_REGISTERED_PATH
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x14000f112
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x14000f1d6
mov rax, qword [rsp + 0x38]
cmp rbx, rax
ja 0x14000f215
lea rdi, [rsp + 0x20]
cmp rax, 7
cmova rdi, qword [rsp + 0x20]
mov qword [rsp + 0x30], rbx
add rbx, rbx
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call fcn.140018f50
mov word [rbx + rdi], bp
jmp 0x14000f225
mov r9, rsi
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140005e50
mov rcx, rsi
call fcn.140013ba0
lea rax, [rsp + 0x20]
cmp r14, rax
je 0x14000f28b
lea r9, [rsp + 0x20]
cmp qword [rsp + 0x38], 7
cmova r9, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
mov rax, qword [r14 + 0x18]
cmp rbx, rax
ja 0x14000f280
mov rdi, r14
cmp rax, 7
jbe 0x14000f262
mov rdi, qword [r14]
mov qword [r14 + 0x10], rbx
lea r8, [rbx + rbx]
mov rdx, r9
mov rcx, rdi
call fcn.140018f50
mov word [rdi + rbx*2], bp
mov bl, 1
jmp 0x14000f151
mov rdx, rbx
mov rcx, r14
call fcn.140005e50
mov bl, 1
jmp 0x14000f151
call fcn.140013ba0
movzx eax, bl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140013b80
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x1400146ec
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140014736
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140014736
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140014736
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140014736
cmp dword [rcx + 0x84], 0xe
jbe 0x140014736
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140014738
xor al, al
add rsp, 0x28
ret

Function at 0x140018e20
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140018e48
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140018e48
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x4176c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41784b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x0073e770]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x417725
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x417734
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x417753
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x417763
cmp rbx, 0x1000
jae 0x41772b
jmp 0x4177cd
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x417775
xor edx, edx
jmp 0x4177c4
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x0073e770]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x417759
jmp 0x417748
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x0073e770]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call sym.runtime.printlock
lea rax, [0x0056d68f]
mov ebx, 0x18
nop dword [rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x0056ddbd]
mov ebx, 0x19
nop dword [rax + rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x30]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x00570bc6]
mov ebx, 0x21
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.runtime.sysUnusedOS
Function at 0x417880
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x417aa6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x0073e770]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x4178f3
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x417902
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x417925
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x417935
cmp rbx, 0x1000
jae 0x4178f9
nop
jmp 0x4179b8
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x41794d
xor esi, esi
jmp 0x4179aa
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x0073e770]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x41792b
jmp 0x417916
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x0073e770]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x417a40
nop dword [rax + rax]
call sym.runtime.printlock
lea rax, [0x0056ddd6]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call sym.runtime.printuint
lea rax, [0x0056ddbd]
mov ebx, 0x19
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
call sym.runtime.printuint
nop
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x00569314]
mov ebx, 0xd
call sym.runtime.throw
nop dword [rax + rax]
cmp eax, 0x5af
je 0x4179e0
call sym.runtime.printlock
lea rax, [0x0056ddd6]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x0056ddbd]
mov ebx, 0x19
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
nop dword [rax]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x005702b4]
mov ebx, 0x1f
nop dword [rax + rax]
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp sym.runtime.sysUsedOS