joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140039800
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov word [rsp + 8], cx
sub rsp, 0xb8
mov dword [rsp + 0x58], 0x1d
movzx eax, word [0x1401772d4]
mov byte [rsp], al
mov eax, 0x3683
mov word [rsp + 0x14], ax
mov byte [rsp + 2], 0xe0
mov eax, dword [0x1401772d8]
mov dword [rsp + 0x40], eax
movzx eax, word [0x140177258]
mov word [rsp + 4], ax
mov eax, 0x7f
mov word [rsp + 0x20], ax
mov qword [rsp + 0x78], 0x1f3d801d
mov eax, 0xef97539a
mov qword [rsp + 0x80], rax
movzx eax, word [0x140177288]
movsx rax, ax
mov qword [rsp + 0x88], rax
movzx eax, byte [0x14017722f]
mov byte [rsp + 8], al
mov rax, qword [0x140177280]
mov qword [rsp + 0x50], rax
mov eax, 0xffff9bc4
mov word [rsp + 0x34], ax
mov dword [rsp + 0x24], 0xe2
mov eax, 0x6e
mov word [rsp + 0x38], ax
movzx eax, byte [0x140177216]
mov dword [rsp + 0x5c], eax
mov byte [rsp + 9], 0x17
mov byte [rsp + 1], 0xf2
mov byte [rsp + 0xa], 0xe0
mov eax, dword [0x1401771d4]
mov word [rsp + 0x10], ax
movzx eax, word [0x140177288]
mov word [rsp + 0x18], ax
mov byte [rsp + 3], 0xa9
movzx eax, byte [0x140177264]
mov byte [rsp + 0xb], al
mov eax, 0xe733
mov word [rsp + 0x1c], ax
movsxd rax, dword [0x140177264]
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x60], 0x74
mov byte [rsp + 0xc], 0x60
mov qword [rsp + 0x98], 0x1848
movzx eax, word [0x140177298]
mov word [rsp + 0x3c], ax
mov eax, 0x61f0
mov word [rsp + 0x30], ax
movzx eax, byte [0x14017722f]
movsx eax, al
mov dword [rsp + 0x64], eax
mov dword [rsp + 0x68], 0x1bfee697
movzx eax, byte [0x14017729c]
mov byte [rsp + 0xd], al
movzx eax, byte [0x14017722b]
mov dword [rsp + 0x6c], eax
mov dword [rsp + 0x70], 0xc3b46971
mov eax, 0xb89e6572
mov qword [rsp + 0xa0], rax
movsx eax, byte [rsp]
cmp dword [rsp + 0x24], eax
jne 0x140039987
mov dword [rsp + 0x2c], 1
jmp 0x14003998f
mov dword [rsp + 0x2c], 0
cmp dword [rsp + 0x24], 0x26
jne 0x1400399a0
mov dword [rsp + 0x28], 1
jmp 0x1400399a8
mov dword [rsp + 0x28], 0
mov eax, dword [rsp + 0x28]
cmp dword [rsp + 0x2c], eax
jle 0x1400399ec
movzx eax, word [0x140177258]
movzx ecx, byte [rsp + 1]
movsx ecx, cl
and eax, ecx
movzx ecx, word [0x140177258]
sub ecx, eax
mov eax, ecx
mov word [0x140177258], ax
mov byte [rsp], 0xe1
movzx eax, byte [0x1401771ff]
sub eax, dword [0x14017726c]
mov byte [0x1401771ff], al
mov eax, 0xa2
mov word [0x1401772b8], ax
movzx eax, word [0x14017725c]
cwde
xor eax, 0x8b
mov word [rsp + 4], ax
movzx eax, byte [rsp + 2]
movsx eax, al
movsx ecx, byte [rsp]
imul eax, ecx
movzx ecx, word [rsp + 0x10]
movzx ecx, cx
xor eax, ecx
movzx ecx, word [rsp + 0x14]
movzx edx, word [rsp + 0x18]
movzx edx, dx
not edx
imul ecx, edx
sub ecx, 0xd8
sub eax, ecx
test eax, eax
jne 0x140039a4c
mov qword [rsp + 0x48], 1
jmp 0x140039a55
mov qword [rsp + 0x48], 0
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x78], rax
movzx eax, word [rsp + 0x1c]
movzx eax, ax
xor eax, 0x8a
cdqe
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
movzx eax, word [rsp + 4]
movzx eax, ax
and eax, 0x95
mov word [rsp + 0x20], ax
mov dword [rsp + 0x40], 0xc1d9c91e
movsx ax, byte [rsp + 3]
add rsp, 0xb8
ret
Function at 0x14003abb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [rsp + 8], cl
sub rsp, 0xc8
mov eax, 0x1ef1
mov word [rsp + 0xc], ax
mov byte [rsp + 1], 0x25
mov eax, 0x62e5
mov word [rsp + 0x10], ax
movzx eax, byte [0x14017722f]
mov byte [rsp], al
movzx eax, word [0x140177288]
movsx rax, ax
mov qword [rsp + 0x60], rax
mov eax, 0xffffef47
mov word [rsp + 8], ax
movzx eax, byte [0x1401771ff]
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x58], 0xc953
movzx eax, byte [0x14017722b]
mov byte [rsp + 2], al
mov eax, dword [0x140177250]
mov dword [rsp + 0x38], eax
movzx eax, word [0x140177288]
movsx rax, ax
mov qword [rsp + 0x78], rax
movzx eax, word [0x1401772dc]
mov word [rsp + 0x14], ax
movzx eax, byte [0x1401771a6]
mov qword [rsp + 0x80], rax
movzx eax, byte [0x1401772a0]
mov byte [rsp + 3], al
mov eax, 0xd0807986
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x88], 0x7f56
movzx eax, word [0x140177258]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x3c], 0x4f48a3c6
movzx eax, word [0x140177258]
mov word [rsp + 0x18], ax
mov eax, 0xcf89
mov word [rsp + 0x1c], ax
mov dword [rsp + 0x40], 0xf8f3
mov byte [rsp + 4], 0x15
movzx eax, byte [0x14017722f]
movsx rax, al
mov qword [rsp + 0x90], rax
mov rax, qword [0x1401772b0]
mov qword [rsp + 0x98], rax
mov byte [rsp + 5], 0x46
mov dword [rsp + 0x44], 0xe4b3be84
movzx eax, word [0x1401772cc]
mov byte [rsp + 6], al
mov eax, 0x3dcc
mov word [rsp + 0x20], ax
movsx eax, word [0x140177260]
mov dword [rsp + 0x48], eax
movsx rax, byte [0x1401771a3]
mov qword [rsp + 0xa0], rax
movzx eax, byte [0x14017722f]
movsx ax, al
mov word [rsp + 0x24], ax
mov dword [rsp + 0x4c], 0x78131d9d
movzx eax, byte [0x1401771a6]
mov qword [rsp + 0xa8], rax
mov eax, dword [0x14017729c]
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x54], 0x55
movsxd rax, dword [0x1401772dc]
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0x60]
xor rax, 0x97
mov word [0x1401772d4], ax
movzx eax, word [0x1401772d0]
cwde
sub eax, 0x7b50024f
cdqe
mov qword [0x140177248], rax
mov rax, qword [rsp + 0x68]
test rax, rax
jne 0x14003ad87
mov qword [rsp + 0x30], 1
jmp 0x14003ad90
mov qword [rsp + 0x30], 0
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x70]
xor rcx, rax
mov rax, rcx
mov byte [rsp], al
movsx eax, word [0x14017722c]
sar eax, 1
mov dword [rsp + 0x28], eax
movzx eax, word [rsp + 8]
add rsp, 0xc8
ret
Function at 0x14005f580
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0xb8
movzx eax, byte [0x140177393]
mov qword [rsp + 0x78], rax
mov eax, 0x5176
mov word [rsp + 4], ax
mov byte [rsp + 0xc], 0xfc
movzx eax, word [0x140177448]
mov word [rsp + 0x18], ax
movzx eax, byte [0x140177316]
movzx eax, al
mov qword [rsp + 0x80], rax
mov eax, 0x2181
mov word [rsp + 0x1c], ax
mov rax, qword [0x1401773e0]
mov word [rsp + 0x20], ax
movzx eax, word [0x1401773fc]
mov byte [rsp + 0xd], al
movzx eax, word [0x14017740c]
mov word [rsp + 0x14], ax
movzx eax, byte [0x1401773d0]
mov byte [rsp + 1], al
mov eax, 0xe9
mov word [rsp + 0x24], ax
movsx eax, byte [0x140177353]
mov dword [rsp + 0x50], eax
mov eax, pe_nt_image_headers64
mov word [rsp + 0x28], ax
mov byte [rsp + 0xe], 0x2d
movzx eax, word [0x140177430]
mov word [rsp + 8], ax
mov eax, 0x1294
mov word [rsp + 0x2c], ax
mov dword [rsp + 0x3c], 0xc5d7de49
movsx eax, byte [0x140177353]
mov dword [rsp + 0x40], eax
mov byte [rsp], 0xa3
mov byte [rsp + 0xf], 0xb2
mov byte [rsp + 0x10], 0x2b
mov qword [rsp + 0x60], 0x17
movabs rax, 0x7a1152a39d8ec
mov qword [rsp + 0x70], rax
mov eax, 0x9b4a1497
mov qword [rsp + 0x68], rax
mov eax, 0x21
mov word [rsp + 0x30], ax
mov byte [rsp + 2], 0xef
mov eax, 0xffff947e
mov word [rsp + 0x34], ax
mov eax, dword [0x1401773b0]
mov dword [rsp + 0x54], eax
mov eax, 0x66e6
mov word [rsp + 0x38], ax
movabs rax, 0x82ec82632640e
mov qword [rsp + 0x88], rax
movabs rax, 0x3fbe6a983d4eb
mov qword [rsp + 0x90], rax
movsxd rax, dword [0x140177440]
mov qword [rsp + 0x98], rax
movzx eax, byte [0x140177317]
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x5c], 0xcd
movabs rax, 0xf940f7f6cd716
mov qword [rsp + 0xa0], rax
movzx eax, byte [0x1401772ed]
movsx rax, al
mov qword [rsp + 0xa8], rax
mov eax, dword [rsp + 0x3c]
test eax, eax
je 0x14005f733
movzx eax, word [rsp + 4]
mov qword [rsp + 0x48], rax
jmp 0x14005f73f
mov rax, qword [0x140177438]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x1401773e0], rax
movzx eax, byte [0x14017733e]
movabs rcx, 0x35e6655442349
xor rax, rcx
mov qword [rsp + 0x60], rax
movsx eax, word [rsp + 0x14]
add eax, 0xd1
cdqe
mov qword [rsp + 0x68], rax
movzx eax, byte [rsp + 1]
movzx eax, al
add rax, qword [rsp + 0x70]
mov byte [rsp], al
mov eax, dword [0x1401773d8]
sar eax, 4
mov word [rsp + 8], ax
movzx eax, word [rsp + 4]
xor eax, 0xf7
mov dword [0x1401773dc], eax
movzx eax, word [0x1401773b8]
inc ax
mov word [0x1401773b8], ax
mov eax, dword [rsp + 0x40]
movabs rcx, 0x26056e42ebef8
add rax, rcx
mov qword [0x1401773f0], rax
movzx eax, word [rsp + 8]
movzx eax, ax
movsx ecx, byte [rsp]
lea eax, [rcx + rax + 0xd066]
mov byte [rsp], al
movsx eax, byte [rsp + 2]
add rsp, 0xb8
ret
Function at 0x140060310
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
mov dword [rsp + 0x50], 0x7ff1
mov byte [rsp + 0xc], 0xa9
movabs rax, 0x8f5992ded0b11
mov qword [rsp + 0x60], rax
mov eax, dword [0x1401773c0]
mov dword [rsp + 0x24], eax
mov byte [rsp + 0xd], 0x14
mov eax, 0xd969
mov word [rsp + 0x14], ax
movzx eax, word [0x140177408]
mov word [rsp + 0x1c], ax
movzx eax, byte [0x140177393]
mov dword [rsp + 0x38], eax
mov byte [rsp + 1], 0xca
mov dword [rsp + 0x3c], 0x38
mov rax, qword [0x1401773e8]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x58], 0x1fcebf20
mov byte [rsp + 0xe], 0xdc
mov qword [rsp + 0x70], 0xcd
mov eax, 0x3be6
mov word [rsp + 0x18], ax
movzx eax, byte [0x1401773b0]
mov byte [rsp + 0xf], al
movzx eax, word [0x1401773f0]
mov word [rsp + 0x20], ax
movzx eax, byte [0x140177410]
mov byte [rsp + 0x10], al
movzx eax, word [0x140177394]
movsx rax, ax
mov qword [rsp + 0x78], rax
mov rax, qword [0x1401773e0]
mov byte [rsp + 2], al
movzx eax, word [0x140177440]
mov word [rsp + 8], ax
movzx eax, byte [0x14017733f]
movzx eax, al
mov dword [rsp + 0x28], eax
mov eax, 0xbf8
mov word [rsp + 4], ax
mov rax, qword [0x1401773c8]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x40], 0xf808fc87
mov dword [rsp + 0x44], 0x95c143df
mov rax, qword [0x140177428]
mov byte [rsp + 0x11], al
movzx eax, word [0x14017740c]
mov qword [rsp + 0x80], rax
mov byte [rsp + 0x12], 0xc
mov eax, dword [0x140177430]
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x88], 0x91
mov qword [rsp + 0x90], 0xb366f46
mov dword [rsp + 0x4c], 0xccf800d9
mov qword [rsp + 0x98], 0xc6584ff
movzx eax, byte [0x1401772ee]
mov byte [rsp + 0x13], al
movabs rax, 0x9071aaccc555
mov qword [rsp + 0xa0], rax
movzx eax, word [rsp + 4]
add rax, qword [rsp + 0x30]
mov word [rsp + 4], ax
mov eax, dword [rsp + 0x24]
mov eax, eax
mov rcx, qword [0x140177428]
not rcx
movzx edx, byte [0x14017733e]
add rcx, rdx
not rcx
mov rdx, qword [0x140177438]
not rdx
sub rcx, rdx
not rcx
imul rax, rcx
test rax, rax
jne 0x1400604eb
mov byte [rsp], 1
jmp 0x1400604ef
mov byte [rsp], 0
movzx eax, byte [rsp]
mov byte [0x14017733e], al
mov rax, qword [rsp + 0x30]
shl rax, 8
mov word [rsp + 4], ax
movzx eax, byte [rsp + 1]
movsx rax, al
mov rcx, qword [rsp + 0x58]
xor rax, rcx
not rax
mov dword [rsp + 0x28], eax
movzx eax, word [0x1401773fc]
movzx eax, ax
movzx ecx, word [rsp + 0x14]
movzx ecx, cx
add eax, ecx
cdqe
mov qword [rsp + 0x30], rax
movzx eax, word [rsp + 0x18]
movzx eax, ax
mov dword [0x1401773dc], eax
movzx eax, byte [str._api_ms_win_securit]
movsx rax, al
movabs rcx, 0xe1e27dd052f8a
imul rax, rcx
movzx ecx, word [0x1401773fc]
movzx ecx, cx
add rcx, rax
mov rax, rcx
mov word [0x1401773fc], ax
movzx eax, byte [0x140177396]
movabs rcx, 0xbc4fe229e5e6f
imul rax, rcx
movzx ecx, word [rsp + 8]
movsx rcx, cx
sub rcx, rax
mov rax, rcx
mov word [rsp + 8], ax
movzx eax, byte [rsp + 2]
movsx rax, al
add rsp, 0xb8
ret
Function at 0x14006f000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0xa8
mov byte [rsp + 4], 0x25
mov eax, 0xffff9c1d
mov word [rsp + 0x18], ax
mov rax, qword [0x140177580]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x34], 0xd2
mov rax, qword [0x140177570]
mov dword [rsp + 0x38], eax
movzx eax, byte [0x14017746c]
mov byte [rsp + 1], al
mov eax, dword [0x14017756c]
mov dword [rsp + 0x3c], eax
mov byte [rsp + 2], 9
movzx eax, word [0x1401775d4]
mov word [rsp + 0x1c], ax
mov rax, qword [0x140177540]
mov dword [rsp + 0x14], eax
mov eax, 0xffffb5e8
mov word [rsp + 8], ax
mov dword [rsp + 0x40], 0x1f04
mov eax, 0x82e3
mov word [rsp + 0x20], ax
mov dword [rsp + 0x44], 0x4ea51e4e
movzx eax, word [0x140177588]
mov word [rsp + 0x24], ax
mov rax, qword [0x140177540]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x48], 0xbf723b34
mov byte [rsp + 5], 0x57
mov qword [rsp + 0x68], 0x3dc7
movzx eax, word [0x1401775e0]
movsx rax, ax
mov qword [rsp + 0x70], rax
movzx eax, word [0x1401775d4]
mov word [rsp + 0x28], ax
mov byte [rsp], 0xee
movzx eax, word [0x1401775c0]
mov word [rsp + 0xc], ax
movzx eax, word [0x1401774ec]
cwde
mov dword [rsp + 0x10], eax
mov eax, 0xffffe458
mov word [rsp + 0x2c], ax
mov byte [rsp + 3], 0xe4
movabs rax, 0xc049512057ab8
mov qword [rsp + 0x78], rax
movzx eax, word [0x1401774ac]
cwde
mov dword [rsp + 0x4c], eax
movzx eax, word [0x1401775a0]
mov word [rsp + 0x30], ax
mov byte [rsp + 6], 0x2e
movzx eax, byte [0x14017746b]
mov byte [rsp + 7], al
mov eax, dword [0x14017746c]
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x54], 0x2f
movabs rax, 0x5ca512d22b254
mov qword [rsp + 0x80], rax
mov rax, qword [0x1401775c8]
mov qword [rsp + 0x88], rax
movabs rax, 0x12e0f651a0f8
mov qword [rsp + 0x90], rax
movzx eax, word [0x1401775d4]
cwde
movzx ecx, word [rsp + 8]
movsx ecx, cx
cmp eax, ecx
jle 0x14006f1d8
mov eax, 2
imul rax, rax, 0x88
lea rcx, [0x14097d760]
movzx eax, byte [rcx + rax]
mov byte [rsp + 1], al
movsx eax, byte [rsp]
mov ecx, dword [0x14017756c]
lea eax, [rax + rcx - 0xf7ad]
mov byte [rsp], al
movzx eax, word [0x140177568]
mov byte [rsp + 2], al
jmp 0x14006f208
cmp qword [rsp + 0x58], 0
je 0x14006f208
mov rax, qword [0x140177530]
imul rax, rax, 0x27
mov word [0x14017757c], ax
imul eax, dword [0x14017756c], 0xb1
mov ecx, dword [rsp + 0x14]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x14], eax
movzx eax, byte [0x1401774ab]
sub eax, 0x4c07
mov word [0x14017755c], ax
mov byte [rsp], 0xae
movsx eax, word [0x140177560]
add eax, 0x10
cdqe
mov qword [0x140177548], rax
movzx eax, word [0x14017755c]
movsx rax, ax
cmp qword [0x1401775d8], rax
ja 0x14006f26b
movzx eax, word [0x140766118]
mov word [rsp + 0xc], ax
mov eax, dword [rsp + 0x10]
add rax, qword [0x1401775c8]
mov ecx, dword [rsp + 0x10]
add rcx, rax
mov rax, rcx
mov dword [rsp + 0x10], eax
movsx eax, byte [rsp + 3]
add rsp, 0xa8
ret
Function at 0x1400717d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0xc8
movzx eax, byte [0x14017771c]
mov byte [rsp + 1], al
mov dword [rsp + 0x48], 0x73
mov dword [rsp + 8], 0x9cec00d5
mov eax, 0x8df98fe5
mov qword [rsp + 0x88], rax
movzx eax, byte [0x140177667]
movsx ax, al
mov word [rsp + 0x10], ax
mov dword [rsp + 0x58], 0x723eca3
movzx eax, byte [0x140177667]
movsx ax, al
mov word [rsp + 0x14], ax
movabs rax, 0x772c5e2d9b8b9
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x80], 0x40
mov eax, 0x8d
mov word [rsp + 0x18], ax
movzx eax, word [0x1401776f0]
mov word [rsp + 0x1c], ax
mov eax, 0xffffe4e1
mov word [rsp + 0x20], ax
mov qword [rsp + 0x70], 0x6e
movzx eax, byte [0x14017761f]
movzx eax, al
mov word [rsp + 0x24], ax
movzx eax, byte [0x1401776a4]
mov byte [rsp + 2], al
mov eax, 0x4e
mov word [rsp + 0x28], ax
mov dword [rsp + 0x44], 0x6029
movzx eax, byte [0x14017771c]
mov byte [rsp + 3], al
mov eax, 0x7e
mov word [rsp + 0x2c], ax
mov byte [rsp], 0xa0
mov qword [rsp + 0x98], 0xdf48
mov qword [rsp + 0x78], 0x65da
mov dword [rsp + 0x5c], 0xa107
movzx eax, word [0x1401776b8]
mov word [rsp + 0x30], ax
mov dword [rsp + 0x60], 0xe55d93e2
movzx eax, word [0x140177664]
mov qword [rsp + 0xa0], rax
mov rax, qword [0x1401776f8]
mov qword [rsp + 0xa8], rax
movzx eax, byte [0x140177663]
movsx rax, al
mov qword [rsp + 0xb0], rax
movzx eax, word [0x140177730]
mov word [rsp + 0x34], ax
mov eax, 0x3417
mov word [rsp + 0x38], ax
movzx eax, word [0x1401776f4]
mov word [rsp + 0x3c], ax
mov rax, qword [0x1401776f8]
mov byte [rsp + 4], al
mov eax, 0xf2
mov word [rsp + 0x40], ax
mov dword [rsp + 0x64], 0xb7e7
mov dword [rsp + 0x68], 0x1d490b70
mov byte [rsp + 5], 0xfa
movsx eax, word [0x140177718]
test eax, eax
je 0x1400719be
mov rax, qword [rsp + 0x70]
test rax, rax
jne 0x140071984
mov dword [rsp + 0xc], 1
jmp 0x14007198c
mov dword [rsp + 0xc], 0
mov eax, dword [rsp + 0xc]
mov ecx, dword [0x1401776b8]
add ecx, eax
mov eax, ecx
mov eax, eax
mov qword [0x1401776f8], rax
mov eax, dword [rsp + 8]
sub eax, 0x1d
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 8]
add eax, 0x2b3fe6c5
mov eax, eax
mov qword [rsp + 0x78], rax
cmp dword [rsp + 0x48], 0
je 0x1400719d3
mov rax, qword [0x140177708]
mov qword [rsp + 0x50], rax
jmp 0x1400719df
mov rax, qword [0x140177708]
mov qword [rsp + 0x50], rax
movzx eax, byte [rsp + 0x50]
mov byte [0x140177663], al
mov eax, dword [0x140a7d480]
mov qword [0x140177710], rax
movzx eax, word [0x140177664]
sub eax, 0xaa
mov ecx, dword [0x1401776e0]
and ecx, eax
mov eax, ecx
mov dword [0x1401776e0], eax
movzx eax, byte [rsp]
movzx eax, al
mov rcx, qword [0x140177710]
sub rax, rcx
mov byte [rsp], al
mov eax, dword [rsp + 0x80]
add rsp, 0xc8
ret
Function at 0x140073000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [rsp + 8], cl
sub rsp, 0xa8
mov eax, 0x2765
mov word [rsp + 0x38], ax
mov dword [rsp + 0x34], 0xdabf
mov byte [rsp + 8], 0xc8
mov eax, dword [0x140177738]
mov dword [rsp + 0x58], eax
mov byte [rsp + 9], 0x7a
movzx eax, word [0x1401776bc]
mov word [rsp + 0x20], ax
movzx eax, byte [0x1401776c8]
mov byte [rsp + 0xa], al
mov qword [rsp + 0x18], 0xa8ec
movzx eax, byte [0x140177704]
mov byte [rsp], al
mov eax, dword [0x140177704]
mov dword [rsp + 0x3c], eax
movsx rax, byte [0x14017761e]
mov qword [rsp + 0x78], rax
movzx eax, byte [0x1401776c4]
mov byte [rsp + 0xb], al
movabs rax, 0x4caacf214884b
mov qword [rsp + 0x70], rax
mov eax, 0xdd
mov word [rsp + 0x10], ax
mov eax, dword [0x140177704]
mov dword [rsp + 0x40], eax
movabs rax, 0xd17a923ceacb3
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x60], 0x8c
mov dword [rsp + 0x44], 0x72fc1ca
movzx eax, word [0x1401776bc]
mov byte [rsp + 0xc], al
mov byte [rsp + 0xd], 0x26
mov eax, 0x8cf9
mov word [rsp + 4], ax
mov rax, qword [0x140177710]
mov word [rsp + 0x24], ax
movabs rax, 0x9ed90a0ac2877
mov qword [rsp + 0x68], rax
mov eax, dword [0x1401776b8]
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x48], 0x469c9110
movzx eax, byte [0x140177667]
movsx ax, al
mov word [rsp + 0x28], ax
mov dword [rsp + 0x4c], 0x55
mov dword [rsp + 0x50], 0xe4b48c92
movabs rax, 0x7f8cb14ceb91b
mov qword [rsp + 0x90], rax
mov byte [rsp + 1], 0x39
mov eax, 0x47bc
mov word [rsp + 0x2c], ax
mov eax, 0x3c70
mov word [rsp + 0x30], ax
mov byte [rsp + 0xe], 0x16
mov dword [rsp + 0x54], 0x5e88
mov byte [rsp + 0xf], 0xb5
movzx eax, byte [0x140177666]
movzx eax, al
mov qword [rsp + 0x98], rax
movzx eax, word [rsp + 4]
movzx ecx, word [rsp + 0x10]
add eax, ecx
mov word [rsp + 4], ax
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x60]
add rax, rcx
mov rcx, qword [rsp + 0x18]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x18], rax
movzx eax, word [0x140177664]
mov word [0x1401776f4], ax
movzx eax, byte [rsp]
dec al
mov byte [rsp], al
movzx eax, word [0x1401776d4]
movzx eax, ax
movzx ecx, byte [0x14017764b]
movsx ecx, cl
not ecx
xor eax, ecx
mov dword [0x140177700], eax
mov dword [rsp + 0x34], 0xbb0e
mov eax, dword [0x1401776d0]
sub eax, 0x68
movzx ecx, byte [str.UThe_application_is]
or ecx, eax
mov eax, ecx
mov byte [str.UThe_application_is], al
mov rax, qword [rsp + 0x18]
imul rax, qword [rsp + 0x68]
mov qword [rsp + 0x18], rax
mov eax, dword [0x1401776a4]
add eax, 0x9a58cbb6
mov byte [0x140177666], al
mov rax, qword [rsp + 0x70]
add rax, 0xff
mov byte [0x1401775f7], al
movzx eax, byte [0x1401776be]
movzx eax, al
mov ecx, dword [0x1401776e0]
imul ecx, eax
mov eax, ecx
mov ecx, dword [0x1401776e0]
sub ecx, eax
mov eax, ecx
mov dword [0x1401776e0], eax
movzx eax, byte [rsp + 1]
add rsp, 0xa8
ret
Function at 0x1400966f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov qword [rsp + 0x28], 0x1b
mov byte [rsp + 0x30], 0x54
mov byte [rsp + 0x31], 0x68
mov byte [rsp + 0x32], 0xcf
mov byte [rsp + 0x33], 0xef
mov byte [rsp + 0x34], 0xe6
mov byte [rsp + 0x35], 0xde
mov byte [rsp + 0x36], 0xf8
mov byte [rsp + 0x37], 0x28
mov byte [rsp + 0x38], 0x63
mov byte [rsp + 0x39], 0xca
mov byte [rsp + 0x3a], 0x44
mov byte [rsp + 0x3b], 0x4e
mov byte [rsp + 0x3c], 0x66
mov byte [rsp + 0x3d], 0x75
mov byte [rsp + 0x3e], 0xd3
mov byte [rsp + 0x3f], 0xe2
mov byte [rsp + 0x40], 0xea
mov byte [rsp + 0x41], 0xda
mov byte [rsp + 0x42], 0xab
mov byte [rsp + 0x43], 0x5b
mov byte [rsp + 0x44], 0x44
mov byte [rsp + 0x45], 0xd1
mov byte [rsp + 0x46], 0x5d
mov byte [rsp + 0x47], 0x4a
mov byte [rsp + 0x48], 0x60
mov byte [rsp + 0x49], 0x64
mov byte [rsp + 0x4a], 0xa1
mov eax, 0x8bc
mov eax, eax
mov ecx, dword [0x141f20340]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
and eax, 1
test eax, eax
jne 0x140096826
mov eax, 0x8bc
mov eax, eax
mov ecx, dword [0x141f20340]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
or eax, 1
mov dword [rsp + 0x20], eax
mov eax, dword [0x141f20340]
mov rcx, qword gs:[0x58]
mov edx, 0x8bc
mov edx, edx
mov rax, qword [rcx + rax*8]
mov ecx, dword [rsp + 0x20]
mov dword [rdx + rax], ecx
mov eax, 0x8a0
mov eax, eax
mov ecx, dword [0x141f20340]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.140096a90
lea rcx, [0x14013ab90]
call fcn.1401258bc
nop
mov eax, 0x8a0
mov eax, eax
mov ecx, dword [0x141f20340]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
add rsp, 0x58
ret