joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140333b90
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
mov rdx, rcx
cmp rbx, 0x20
jb 0x140333cd6
mov qword [rsp + 0x30], rsi
lea r11, [rcx - 0x1f]
mov qword [rsp + 0x38], rdi
add r11, rbx
movabs rdi, 0xc2b2ae3d27d4eb4f
xor r9d, r9d
mov r8, rdi
movabs rcx, 0x60ea27eeadc0b5d6
movabs rsi, 0x9e3779b185ebca87
movabs r10, 0x61c8864e7a143579
nop word [rax + rax]
mov rax, qword [rdx]
imul rax, rdi
add rcx, rax
mov rax, qword [rdx + 8]
imul rax, rdi
rol rcx, 0x1f
add r8, rax
mov rax, qword [rdx + 0x10]
imul rax, rdi
imul rcx, rsi
add r9, rax
rol r8, 0x1f
mov rax, qword [rdx + 0x18]
add rdx, 0x20
imul rax, rdi
imul r8, rsi
add r10, rax
rol r9, 0x1f
rol r10, 0x1f
imul r10, rsi
imul r9, rsi
cmp rdx, r11
jb 0x140333bf0
mov r11, r10
mov rax, r9
rol r11, 0x12
rol rax, 0xc
add r11, rax
mov rax, r8
rol rax, 7
add r11, rax
mov rax, rcx
imul rcx, rdi
imul r8, rdi
imul r9, rdi
imul r10, rdi
mov rdi, qword [rsp + 0x38]
rol rax, 1
add r11, rax
rol rcx, 0x1f
movabs rax, 0x7a1435883d4d519d
rol r8, 0x1f
imul rcx, rsi
imul r8, rsi
xor r11, rcx
rol r9, 0x1f
imul r11, rsi
imul r9, rsi
sub r11, rax
rol r10, 0x1f
xor r11, r8
imul r11, rsi
imul r10, rsi
sub r11, rax
xor r11, r9
imul r11, rsi
sub r11, rax
xor r11, r10
imul r11, rsi
mov rsi, qword [rsp + 0x30]
sub r11, rax
jmp 0x140333ce0
movabs r11, 0x27d4eb2f165667c5
lea rcx, [r11 + rbx]
mov r9d, 1
mov r8, rbx
add rsp, 0x20
pop rbx
jmp fcn.140333a90
Function at 0x140333ed0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
push r15
mov rbx, qword [rcx]
mov rdi, rcx
movabs rbp, 0xc2b2ae3d27d4eb4f
movabs rsi, 0x9e3779b185ebca87
movabs r14, 0x27d4eb2f165667c5
movabs r15, 0x7a1435883d4d519d
cmp rbx, 0x20
jb 0x140333fb8
mov r8, qword [rcx + 8]
mov r10, qword [rcx + 0x20]
mov rdx, r8
mov r9, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
mov rax, r9
rol rax, 0xc
mov r11, rcx
rol r11, 7
add r11, rax
rol r8, 1
mov rax, r10
imul rdx, rbp
imul rcx, rbp
imul r9, rbp
imul r10, rbp
rol rax, 0x12
add r11, rax
rol rdx, 0x1f
add r11, r8
rol rcx, 0x1f
imul rdx, rsi
imul rcx, rsi
rol r9, 0x1f
movabs rax, 0x85ebca77c2b2ae63
xor r11, rdx
rol r10, 0x1f
imul r11, rsi
imul r9, rsi
imul r10, rsi
sub r11, r15
xor r11, rcx
imul r11, rsi
sub r11, r15
xor r11, r9
imul r11, rsi
sub r11, r15
xor r11, r10
imul r11, rsi
add rax, r11
jmp 0x140333fbf
mov rax, qword [rcx + 0x18]
add rax, r14
add rax, rbx
lea r8, [rdi + 0x28]
and ebx, 0x1f
cmp rbx, 8
jb 0x140334007
mov edx, ebx
shr rdx, 3
imul rcx, rdx, 0xfffffffffffffff8
add rbx, rcx
nop dword [rax]
mov rcx, qword [r8]
add r8, 8
imul rcx, rbp
rol rcx, 0x1f
imul rcx, rsi
xor rax, rcx
rol rax, 0x1b
imul rax, rsi
sub rax, r15
sub rdx, 1
jne 0x140333fe0
movabs r9, 0x165667b19e3779f9
cmp rbx, 4
jb 0x140334034
mov edx, dword [r8]
add r8, 4
imul rdx, rsi
xor rax, rdx
rol rax, 0x17
imul rax, rbp
add rax, r9
sub rbx, 4
test rbx, rbx
je 0x14033405d
nop dword [rax]
movzx ecx, byte [r8]
lea r8, [r8 + 1]
imul rcx, r14
xor rax, rcx
rol rax, 0xb
imul rax, rsi
sub rbx, 1
jne 0x140334040
mov rbx, qword [rsp + 0x18]
mov rcx, rax
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
shr rcx, 0x21
xor rcx, rax
imul rcx, rbp
mov rbp, qword [rsp + 0x20]
mov rdx, rcx
shr rdx, 0x1d
xor rdx, rcx
imul rdx, r9
mov rax, rdx
shr rax, 0x20
xor rax, rdx
pop r15
pop r14
ret
Function at 0x14037b540
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
cmp dword [0x141443c80], 0
mov rsi, rcx
jne 0x14037b566
xor edx, edx
mov ecx, 0x10001
call fcn.14037c450
xor eax, eax
add rsp, 0x20
pop rsi
ret
mov ecx, dword [0x141445628]
mov qword [rsp + 0x40], rdi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rax, rax
jne 0x14037b59d
lea rdx, [0x1413f2fc0]
mov ecx, 0x10002
call fcn.14037c450
mov rdi, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x20
pop rsi
ret
cmp byte [rsi], 0
jne 0x14037b5c0
lea rdx, [0x1413f3008]
mov ecx, 0x10004
call fcn.14037c450
mov rdi, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x20
pop rsi
ret
cmp dword [rax + 0x218], 3
mov qword [rsp + 0x30], rbx
jl 0x14037b64b
lea rdx, [rsp + 0x38]
mov ecx, 0x821d
call qword [rax + 0x248]
xor ebx, ebx
cmp dword [rsp + 0x38], ebx
jle 0x14037b62f
nop word [rax + rax]
mov edx, ebx
mov ecx, 0x1f03
call qword [rdi + 0x240]
test rax, rax
je 0x14037b65b
mov r8, rsi
sub r8, rax
nop dword [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x14037b623
inc rax
test ecx, ecx
jne 0x14037b610
test edx, edx
je 0x14037b68d
inc ebx
cmp ebx, dword [rsp + 0x38]
jl 0x14037b5f0
mov rcx, rsi
mov rax, qword [rdi + 0x270]
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
jmp rax
mov ecx, 0x1f03
call qword [rax + 0x250]
test rax, rax
jne 0x14037b67e
lea rdx, [0x1413f2f90]
mov ecx, 0x10008
call fcn.14037c450
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
mov rdx, rax
mov rcx, rsi
call fcn.14037b4b0
test eax, eax
je 0x14037b62f
mov rbx, qword [rsp + 0x30]
mov eax, 1
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
Function at 0x14037bbd0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x141443c80], 0
jne 0x14037bbe5
xor edx, edx
mov ecx, 0x10001
jmp fcn.14037c450
cmp ecx, 0x21001
jg 0x14037bcbe
lea eax, [rcx - 0x20001]
cmp eax, 0xe
ja case.0x14037bdaf.139268
cdqe
lea r8, [0x140000000]
mov eax, dword [r8 + rax*4 + 0x37be7c]
add rax, r8
jmp rax
xor eax, eax
test edx, edx
setne al
mov dword [0x141443f4c], eax
ret
xor eax, eax
test edx, edx
setne al
mov dword [0x141443f70], eax
ret
xor eax, eax
test edx, edx
setne al
mov dword [0x141443f78], eax
ret
xor eax, eax
test edx, edx
setne al
mov dword [0x141443f7c], eax
ret
xor eax, eax
test edx, edx
setne al
mov dword [0x141443f80], eax
ret
xor eax, eax
test edx, edx
setne al
mov dword [0x141443f84], eax
ret
xor eax, eax
test edx, edx
setne al
mov dword [0x141443f88], eax
ret
xor eax, eax
test edx, edx
setne al
mov dword [0x141443f74], eax
ret
mov dword [0x141443f58], edx
ret
mov dword [0x141443f5c], edx
ret
xor eax, eax
test edx, edx
setne al
mov dword [0x141443f8c], eax
ret
xor eax, eax
test edx, edx
setne al
mov dword [0x141443f90], eax
ret
xor eax, eax
test edx, edx
setne al
mov dword [0x141443f94], eax
ret
cmp ecx, 0x22001
jg 0x14037bd7a
je 0x14037bd73
lea eax, [rcx - 0x21002]
cmp eax, 0xe
ja case.0x14037bdaf.139268
cdqe
lea r8, [0x140000000]
mov eax, dword [r8 + rax*4 + 0x37beb8]
add rax, r8
jmp rax
mov dword [0x141443f14], edx
ret
mov dword [0x141443f18], edx
ret
mov dword [0x141443f1c], edx
ret
mov dword [0x141443f20], edx
ret
mov dword [0x141443f24], edx
ret
mov dword [0x141443f28], edx
ret
mov dword [0x141443f2c], edx
ret
mov dword [0x141443f30], edx
ret
mov dword [0x141443f34], edx
ret
mov dword [0x141443f38], edx
ret
xor eax, eax
test edx, edx
setne al
mov dword [0x141443f3c], eax
ret
xor eax, eax
test edx, edx
setne al
mov dword [0x141443f48], eax
ret
mov dword [0x141443f40], edx
ret
xor eax, eax
test edx, edx
setne al
mov dword [0x141443f44], eax
ret
mov dword [0x1414443e0], edx
ret
mov dword [0x1414443a8], edx
ret
cmp ecx, 0x23001
jg 0x14037be21
je case.0x14037bdaf.139277
lea eax, [rcx - 0x22002]
cmp eax, 0xb
ja case.0x14037bdaf.139268
cdqe
lea r8, [0x140000000]
mov eax, dword [r8 + rax*4 + 0x37bef4]
add rax, r8
jmp rax
xor eax, eax
test edx, edx
setne al
mov dword [0x141443f98], eax
ret
mov dword [0x1414443ac], edx
ret
mov dword [0x1414443b0], edx
ret
mov dword [0x1414443b4], edx
ret
mov dword [0x1414443c8], edx
ret
xor eax, eax
test edx, edx
setne al
mov dword [0x1414443b8], eax
ret
xor eax, eax
test edx, edx
setne al
mov dword [0x1414443bc], eax
ret
xor eax, eax
test edx, edx
setne al
mov dword [0x1414443c0], eax
ret
mov dword [0x1414443c4], edx
ret
mov dword [0x1414443cc], edx
ret
xor eax, eax
test edx, edx
setne al
mov dword [0x141443f9c], eax
ret
mov r8d, ecx
sub r8d, 0x23003
je 0x14037be6c
sub r8d, 0x1ffe
je 0x14037be5e
cmp r8d, 1
je 0x14037be50
mov r8d, ecx
lea rdx, [0x1413f3088]
mov ecx, 0x10003
jmp fcn.14037c450
xor eax, eax
test edx, edx
setne al
mov dword [0x1414442a4], eax
ret
xor eax, eax
test edx, edx
setne al
mov dword [0x1414442a0], eax
ret
xor eax, eax
test edx, edx
setne al
mov dword [0x1414443d8], eax
ret
Function at 0x14037bf30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x141443c80], 0
mov rbx, rcx
jne 0x14037bf53
xor edx, edx
mov ecx, 0x10001
add rsp, 0x20
pop rbx
jmp fcn.14037c450
test rbx, rbx
je 0x14037c030
vpxor xmm0, xmm0, xmm0
vmovups ymmword [rcx + 0x2d8], ymm0
vmovups ymmword [rcx + 0x2f8], ymm0
vmovups ymmword [rcx + 0x318], ymm0
vmovups ymmword [rcx + 0x338], ymm0
xor eax, eax
mov qword [rcx + 0x358], rax
mov ecx, dword [0x141445628]
vzeroupper
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp rbx, rax
jne 0x14037bfcd
cmp dword [0x141443c80], 0
jne 0x14037bfb4
xor edx, edx
mov ecx, 0x10001
call fcn.14037c450
jmp 0x14037bfcd
mov ecx, dword [0x141445628]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14037bfcd
xor ecx, ecx
call qword [rax + 0x258]
mov rcx, rbx
call qword [0x141443d98]
mov rcx, qword [0x1414443f8]
lea rdx, [0x1414443f8]
cmp rcx, rbx
je 0x14037bffe
nop dword [rax]
mov rax, qword [rcx]
mov rdx, rcx
mov rcx, rax
cmp rax, rbx
jne 0x14037bff0
mov rax, qword [rbx]
mov qword [rdx], rax
mov rcx, qword [rbx + 0x60]
test rcx, rcx
je 0x14037c01a
mov rdx, qword [0x141443ca0]
call qword [0x141443c98]
mov rdx, qword [0x141443ca0]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [0x141443c98]
add rsp, 0x20
pop rbx
ret

Function at 0x14037c040
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
cmp dword [0x141443c80], 0
mov rsi, rdx
mov rbx, rcx
jne 0x14037c06f
xor edx, edx
mov ecx, 0x10001
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
jmp fcn.14037c450
mov qword [rsp + 0x30], rdi
mov rdi, qword [rcx + 0x60]
mov rcx, rsi
call fcn.14037c3d0
mov rdx, rsi
mov qword [rbx + 0x60], rax
mov rcx, rbx
call qword [0x141443da0]
test rdi, rdi
je 0x14037c0a5
mov rdx, qword [0x141443ca0]
mov rcx, rdi
call qword [0x141443c98]
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
Function at 0x14037f5a0
Capabilities:
Register raw input devices

Disassembly:
push rbx
sub rsp, 0x30
cmp dword [rcx + 0x208], 0
mov rbx, rcx
je 0x14037f5f2
mov edx, 1
mov dword [rsp + 0x20], 0x20001
mov r8d, reloc.WS2_32.dll_recv
mov dword [rsp + 0x24], edx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x28], 0
call qword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x14037f5f2
lea rdx, [0x14140c8b0]
mov ecx, 0x10008
call fcn.140386200
xor ecx, ecx
mov qword [0x1414465c8], 0
call qword [sym.imp.USER32.dll_ClipCursor]
vcvttsd2si ecx, qword [0x1414465b8]
vcvttsd2si eax, qword [0x1414465c0]
mov qword [0x1414465d0], 0
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], ecx
mov dword [rbx + 0x3a0], ecx
mov rcx, qword [rbx + 0x360]
mov dword [rsp + 0x44], eax
mov dword [rbx + 0x3a4], eax
call qword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.USER32.dll_SetCursorPos]
mov rcx, rbx
add rsp, 0x30
pop rbx
jmp fcn.14037f3c0

Function at 0x14037f980
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetKeyState]
movzx ebx, ax
mov ecx, reloc.WS2_32.dll_recvfrom
shr ebx, 0xf
call qword [sym.imp.USER32.dll_GetKeyState]
mov edi, ebx
mov ecx, send
or edi, 2
test ax, ax
cmovns edi, ebx
call qword [sym.imp.USER32.dll_GetKeyState]
mov esi, edi
mov ecx, 0x5c
or esi, 4
test ax, ax
cmovns esi, edi
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x5b
movzx ebx, ax
call qword [sym.imp.USER32.dll_GetKeyState]
mov edi, esi
mov ecx, socket
or edi, 8
or bx, ax
cmovns edi, esi
call qword [sym.imp.USER32.dll_GetKeyState]
mov ebx, edi
mov ecx, 0x90
or ebx, 0x10
test al, 1
cmove ebx, edi
call qword [sym.imp.USER32.dll_GetKeyState]
mov rsi, qword [rsp + 0x38]
mov ecx, ebx
or ecx, 0x20
test al, 1
cmove ecx, ebx
mov rbx, qword [rsp + 0x30]
mov eax, ecx
add rsp, 0x20
pop rdi
ret
Function at 0x140386310
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r12
push r14
push r15
sub rsp, 0x1b0
mov rax, qword [0x14143b040]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
xor edx, edx
lea rcx, [rsp + 0xa0]
mov r8d, 0x100
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [0x141445ee2]
mov r8d, 0x6d1
call sub.VCRUNTIME140.dll_memset
lea r14, [rsp + 0x40]
mov qword [rsp + 0x1d0], rdi
sub r14, 0x480
lea rbp, [0x141445c68]
xor r12d, r12d
lea r15, [0x141445f82]
mov ebx, 0x20
movsx esi, word [rbp]
cmp esi, 0xffffffff
je 0x1403864c8
cmp ebx, 0x140
jb 0x14038642f
cmp ebx, 0x14e
ja 0x14038642f
mov dword [rsp + 0x40], 0x60
mov dword [rsp + 0x44], 0x61
mov dword [rsp + 0x48], 0x62
mov dword [rsp + 0x4c], 0x63
mov dword [rsp + 0x50], 0x64
mov dword [rsp + 0x54], 0x65
mov dword [rsp + 0x58], 0x66
mov dword [rsp + 0x5c], 0x67
mov dword [rsp + 0x60], WSAGetLastError
mov dword [rsp + 0x64], WSAGetLastError
mov dword [rsp + 0x68], WSAStartup
mov dword [rsp + 0x6c], reloc.WS2_32.dll_WSAGetLastError
mov dword [rsp + 0x70], WSAGetLastError
mov dword [rsp + 0x74], WSAStartup
mov dword [rsp + 0x78], WSAGetLastError
mov edi, dword [r14]
jmp 0x14038643e
mov edx, 1
mov ecx, esi
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov edi, eax
mov dword [rsp + 0x28], r12d
lea r9, [rsp + 0x80]
lea r8, [rsp + 0xa0]
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
mov edx, esi
mov ecx, edi
call qword [sym.imp.USER32.dll_ToUnicode]
cmp eax, 0xffffffff
jne 0x140386491
mov dword [rsp + 0x28], r12d
lea r9, [rsp + 0x80]
lea r8, [rsp + 0xa0]
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
mov edx, esi
mov ecx, edi
call qword [sym.imp.USER32.dll_ToUnicode]
cmp eax, 1
jl 0x1403864c8
mov qword [rsp + 0x38], r12
lea r8, [rsp + 0x80]
mov qword [rsp + 0x30], r12
mov r9d, 1
mov dword [rsp + 0x28], 5
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
inc ebx
add r15, 5
add r14, 4
add rbp, 2
cmp ebx, 0x15c
jle 0x140386391
mov rdi, qword [rsp + 0x1d0]
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1403f4b10
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x140389a10
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x48
cmp qword [0x141445760], 0
lea rax, [0x14140e2e0]
lea rcx, [0x14140e288]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], 0
je 0x140389a49
mov eax, 1
add rsp, 0x48
ret
mov qword [rsp + 0x40], rbx
xor ebx, ebx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x141445760], rax
mov rcx, rax
test rax, rax
jne 0x140389a75
mov rax, qword [rsp + rbx*8 + 0x28]
inc rbx
test rax, rax
jne 0x140389a50
mov rbx, qword [rsp + 0x40]
test rcx, rcx
jne 0x140389a97
lea rdx, [0x14140e298]
mov ecx, 0x10006
call fcn.14037c450
xor eax, eax
add rsp, 0x48
ret
lea rdx, [0x14140e250]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x141445760]
lea rdx, [0x14140e268]
mov qword [0x141445768], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x141445760]
lea rdx, [0x14140e3d0]
mov qword [0x141445770], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x141445760]
lea rdx, [0x14140e3e8]
mov qword [0x141445778], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x141445760]
lea rdx, [0x14140e3a0]
mov qword [0x141445780], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x141445760]
lea rdx, [0x14140e3b8]
mov qword [0x141445788], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x141445760]
lea rdx, [0x14140e358]
mov qword [0x141445790], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x141445768], 0
mov qword [0x141445798], rax
je 0x140389b88
cmp qword [0x141445778], 0
je 0x140389b88
cmp qword [0x141445780], 0
je 0x140389b88
cmp qword [0x141445788], 0
je 0x140389b88
cmp qword [0x141445790], 0
je 0x140389b88
test rax, rax
jne 0x140389a3f
lea rdx, [0x14140e370]
mov ecx, 0x10008
call fcn.14037c450
mov rcx, qword [0x141445760]
test rcx, rcx
je 0x140389bb6
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x141445760], 0
xor eax, eax
add rsp, 0x48
ret
Function at 0x14039cdc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rdi
push r12
sub rsp, 0x50
mov rax, qword [rcx + 8]
mov r12d, r8d
mov ecx, 0x3e80000
mov rbx, qword [rax + 0x2f0]
mov rax, qword [rdx + 0x80]
movzx edx, word [rdx + 0x68]
movzx edi, word [rax + 0x18]
mov eax, 0x40000
shl edi, 0x10
cmp edi, eax
cmovl edi, eax
shl edx, 0x10
call fcn.14038baf0
mov dword [rsp + 0x24], eax
mov ecx, eax
cmp eax, 0x28f
jge 0x14039ce18
xor eax, eax
add rsp, 0x50
pop r12
pop rdi
pop rbx
ret
mov eax, dword [rbx + 0x24]
mov qword [rsp + 0x80], rbp
mov ebp, dword [rbx + 0x40]
mov qword [rsp + 0x48], rsi
mov esi, dword [rbx + 0x28]
mov qword [rsp + 0x40], r13
mov r13d, dword [rbx + 0x3c]
mov dword [rsp + 0x88], eax
mov eax, dword [rbx + 0x2c]
mov qword [rsp + 0x38], r14
mov r14d, dword [rbx + 0x34]
mov dword [rsp + 0x70], eax
mov eax, dword [rbx + 0x38]
mov qword [rsp + 0x30], r15
mov r15d, dword [rbx + 0x30]
mov dword [rsp + 0x78], eax
mov dword [rsp + 0x20], r13d
test r12d, r12d
jg 0x14039ce6f
mov ebx, 0x4b0000
jmp 0x14039ce7f
shl r12d, 0x10
mov edx, ecx
mov ecx, r12d
call fcn.14038df10
mov ebx, eax
bsr ecx, ebx
bsr eax, edi
shl r13d, 0x10
add eax, ecx
cmp eax, 0x2e
jl 0x14039ce95
mov ecx, r13d
jmp 0x14039cea0
mov edx, edi
mov ecx, ebx
call fcn.14038df10
mov ecx, eax
mov r8d, dword [rsp + 0x88]
mov eax, r8d
shl eax, 0x10
cmp ecx, eax
jge 0x14039cebc
shl esi, 0x10
mov ecx, esi
jmp 0x14039cf82
mov edx, dword [rsp + 0x70]
mov r12d, edx
shl r12d, 0x10
cmp ecx, r12d
jge 0x14039ceef
mov r13d, edx
mov ecx, eax
mov edx, edi
sub r13d, r8d
call fcn.14038baf0
mov ecx, ebx
sub ecx, eax
test r13d, r13d
je 0x14039cf3f
sub r15d, esi
mov r8d, r13d
mov edx, r15d
jmp 0x14039cf28
mov eax, r14d
shl eax, 0x10
cmp ecx, eax
jl 0x14039cf43
cmp ecx, r13d
jge 0x14039cf7d
mov r15d, dword [rsp + 0x20]
mov edx, edi
sub r15d, r14d
shl r14d, 0x10
mov ecx, r14d
call fcn.14038baf0
sub ebx, eax
test r15d, r15d
je 0x14039cf7d
mov esi, dword [rsp + 0x78]
mov r8d, r15d
sub ebp, esi
mov ecx, ebx
mov edx, ebp
call fcn.14038dde0
shl esi, 0x10
mov edx, edi
mov ecx, esi
mov ebx, eax
call fcn.14038baf0
add ebx, eax
jmp 0x14039cf8b
mov edx, dword [rsp + 0x70]
mov esi, r14d
mov ecx, r12d
sub esi, edx
mov edx, edi
call fcn.14038baf0
mov ecx, ebx
sub ecx, eax
test esi, esi
je 0x14039cefe
mov edx, dword [rsp + 0x78]
mov r8d, esi
sub edx, r15d
call fcn.14038dde0
shl r15d, 0x10
mov edx, edi
mov ecx, r15d
mov ebx, eax
call fcn.14038baf0
add ebx, eax
jmp 0x14039cf8b
shl ebp, 0x10
mov ecx, ebp
mov edx, edi
call fcn.14038baf0
mov ebx, eax
mov edx, dword [rsp + 0x24]
mov ecx, ebx
mov r15, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
mov r13, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x80]
add rsp, 0x50
pop r12
pop rdi
pop rbx
jmp fcn.14038baf0
Function at 0x1403e8d80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r14
sub rsp, 0x250
mov rax, qword [0x14143b040]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov eax, dword [rcx + 0x58]
lea rbx, [rsp + 0x30]
mov dword [rsp + 0x40], eax
mov ebp, r9d
mov eax, dword [rcx + 0x5c]
mov rsi, rcx
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x290]
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x3c], r8d
mov dword [rsp + 0x30], r9d
mov qword [rsp + 0x278], rdi
nop dword [rax]
mov r10d, dword [rbx + 0x14]
mov eax, r10d
mov r14d, dword [rbx + 4]
cmp r10d, r14d
mov r11d, dword [rbx + 0xc]
cmovg eax, r14d
cmp r11d, eax
jl 0x1403e8f1c
cmp r10d, r14d
mov eax, r14d
cmovg eax, r10d
cmp r11d, eax
jg 0x1403e8f1c
cmp r10d, r14d
jne 0x1403e8e20
sub rbx, 0x10
jmp 0x1403e8f69
mov edx, dword [rsi + 0x88]
xor r9d, r9d
cmp r10d, r14d
setge r9b
inc r9d
cmp edx, r9d
je 0x1403e8e92
mov eax, dword [rsi + 4]
mov ecx, eax
mov r8d, dword [rsi + 8]
neg ecx
cmp r10d, r14d
jge 0x1403e8e54
dec eax
add eax, r10d
and eax, ecx
sub eax, r10d
jmp 0x1403e8e5c
and ecx, r10d
mov eax, r10d
sub eax, ecx
cmp eax, r8d
setge r11b
test edx, edx
je 0x1403e8e7b
movzx edx, r11b
mov rcx, rsi
call fcn.1403e9e50
test al, al
jne 0x1403e8f7a
movzx r8d, r11b
mov edx, r9d
mov rcx, rsi
call fcn.1403ea590
test al, al
jne 0x1403e8f7a
mov edx, dword [rsi + 0x64]
lea r9, [0x1403ea8e0]
mov ecx, dword [rsi + 0x60]
mov r8, rbx
cmp r10d, r14d
jge 0x1403e8ebe
mov dword [rsp + 0x28], edx
mov edx, 2
mov dword [rsp + 0x20], ecx
mov rcx, rsi
call fcn.1403e8c00
jmp 0x1403e8f12
mov eax, dword [rbx + 4]
neg ecx
movzx edi, byte [rsi + 0x6a]
neg eax
mov dword [rbx + 4], eax
neg edx
mov eax, dword [rbx + 0xc]
neg eax
mov dword [rsp + 0x28], ecx
mov dword [rbx + 0xc], eax
mov rcx, rsi
mov eax, dword [rbx + 0x14]
neg eax
mov dword [rsp + 0x20], edx
mov edx, 2
mov dword [rbx + 0x14], eax
call fcn.1403e8c00
test dil, dil
je 0x1403e8f0a
cmp byte [rsi + 0x6a], 0
jne 0x1403e8f0a
mov rdx, qword [rsi + 0x70]
mov ecx, dword [rdx + 0x20]
neg ecx
mov dword [rdx + 0x20], ecx
mov ecx, dword [rbx + 4]
neg ecx
mov dword [rbx + 4], ecx
test al, al
jne 0x1403e8f7a
sub rbx, 0x10
jmp 0x1403e8f69
mov edx, dword [rbx + 0x10]
lea ecx, [r10 + r11]
mov r8d, dword [rbx]
add r8d, dword [rbx + 8]
mov dword [rbx + 0x20], edx
add edx, dword [rbx + 8]
mov eax, edx
mov dword [rbx + 0x24], r10d
sar eax, 1
mov dword [rbx + 0x18], eax
lea eax, [rdx + r8]
sar r8d, 1
sar eax, 2
lea edx, [r14 + r11]
mov dword [rbx + 0x10], eax
mov eax, ecx
sar eax, 1
mov dword [rbx + 0x1c], eax
lea eax, [rcx + rdx]
sar eax, 2
sar edx, 1
mov dword [rbx + 0x14], eax
mov dword [rbx + 8], r8d
mov dword [rbx + 0xc], edx
add rbx, 0x10
lea rax, [rsp + 0x30]
cmp rbx, rax
jb 0x1403e8f7e
mov ebp, dword [rbx]
jmp 0x1403e8de0
mov al, 1
jmp 0x1403e8f87
mov dword [rsi + 0x58], ebp
xor al, al
mov dword [rsi + 0x5c], r14d
mov rdi, qword [rsp + 0x278]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1403f4b10
mov rbx, qword [rsp + 0x280]
add rsp, 0x250
pop r14
pop rsi
pop rbp
ret