joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180010af2
Capabilities:
Check for software breakpoints
Check os version
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Get number of processors
Get system information on windows

Disassembly:
mov rdx, qword [rsp + 8]
jl 0x18000b8af
mov sp, sp
jge 0x18000b8af
pushfq
jb 0x18001051b
mov rsp, rsp
jae 0x18001051b
je 0x18000ceac
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [0x18001a843]
test bx, 0
jb 0x18000b1ae
call fcn.180012e98
leave
pop rdi
push rdx
sub eax, 0xd884e8e8
add byte [rax], al
fcompi st(3)
invalid
add qword [rsp + 0x10], rdi
jg 0x18000c807
nop
jle 0x18000c807
test ch, 0
call fcn.18001163a
mov r12, r11
add al, ch
mov qword [rax + 8], rbx
call fcn.18000d14f
std
and edi, 0xffffffe8
mov qword [rdx], rax
call fcn.180013ca1
xchg ebx, eax
mov dword [rbp + rsi - 0x18], 0x51e9c033
clc
invalid
mov ebx, dword [rsp + 0x30]
call fcn.1800082d9
mov bh, 9
not ch
call 0x1c0fa9a13
add byte [rax], al
xchg dword [rdx + rdi - 0x19], esi
call 0x10f8fc122
push rdi
jg 0x18001395d
mov bl, bl
jle 0x18001395d
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
call fcn.180014574
mov r12b, 0x4b
fsubr st(0)
test rbx, 0
js 0x18000b892
test edi, edi
je 0x18000b208
ror byte [rdi], 0x85
mov ebx, dword [rax]
add byte [rax], al
call fcn.18000a19f
jne 0x18000b842
movsxd rdx, dword [rdx]
jb 0x18000826a
xchg di, di
jae 0x18000826a
and rbx, rax
call fcn.180009839
sbb al, 0xbf
loope 0x18000b8f3
call 0x1f17f3ce1
add byte [rax], al
je 0x180010dd4
call fcn.180008f2e
adc al, 0x73
sahf
shr eax, cl
test ch, 0
call fcn.18000f3b4
out dx, eax
xchg esp, eax
insb byte [rdi], dx
sub ebp, eax
jmp fcn.180005d4f
movsb byte [rdi], byte [rsi]
invalid
popfq
jmp 0x1800143e9
test byte [rax], al
cdq
invalid
add rdi, 0x31fedb8a
jp 0x180007d3c
xchg dx, dx
jnp 0x180007d3c
jb 0x180014148
call fcn.18000b1c7
int3
push rdx
jl 0x1800069c1
xchg si, si
jge 0x1800069c1
lea rcx, [0x18001a619]
jmp fcn.180005d4f
invalid

Function at 0x180010b69
Capabilities:
Check for software breakpoints
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Get number of processors
Get system information on windows

Disassembly:
mov r11, qword [rsp + 8]
ja 0x180007687
nop
jbe 0x180007687
movsxd r11, dword [r11]
jp 0x180007abb
xchg bh, bh
jnp 0x180007abb
pushfq
jp 0x180010551
xchg bl, bl
jnp 0x180010551
add r11, 0x3d50a06d
jo 0x180013d98
mov r9, r9
jno 0x180013d98
push r11
jmp 0x180006236

Function at 0x1800110e3
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions
Get number of processors
Get system information on windows
Packed with generic packer

Disassembly:
push r15
jmp 0x180012857
mov r15, qword [rsp + 8]

Function at 0x18001163a
Capabilities:
Authenticate hmac
Check for software breakpoints
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Get number of processors
Get system information on windows

Disassembly:
push r8
jb 0x180013eff
mov bx, bx
jae 0x180013eff
Function at 0x18001166c
Capabilities:
Check for software breakpoints
Check os version
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Get number of processors
Get system information on windows

Disassembly:
push r10
js 0x18000d209
xchg bh, bh

Function at 0x180011724
Capabilities:
Check for software breakpoints
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Get number of processors
Get system information on windows

Disassembly:
mov r9, qword [rsp + 8]
jg 0x18000f845
mov rax, rax
jle 0x18000f845
sub ecx, eax
movsxd r9, dword [r9]
jb 0x180013eac
mov rbp, rbp
jae 0x180013eac
push r9
jo 0x180006702
xchg dx, dx
jno 0x180006702
call fcn.18000828e
test r11, 0
jnp 0x18000e7b7
call fcn.18000e67b
invalid
pushfq
je 0x180007649
mov rdx, rdx
jne 0x180007649

Function at 0x180011aa8
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions
Get system information on windows

Disassembly:
push rsi
je 0x180014329
xchg dh, dh
jne 0x180014329
popfq
jg 0x18000ab83
xchg bh, bh
jle 0x18000ab83

Function at 0x180011b14
Capabilities:
Authenticate hmac
Check for software breakpoints
Check os version
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Get number of processors
Get system information on windows

Disassembly:
push rbp
jb 0x18000da21
xchg r14, r14
jae 0x18000da21
jmp fcn.180005d4f
Function at 0x1800120d9
Capabilities:
Authenticate hmac
Check for software breakpoints
Check os version
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Get number of processors
Get system information on windows

Disassembly:
cmp edi, 0x3c1e8ff
add byte [rax], al
enter 0xffffffffffffa19a, 0xfffffffffffffffe
call 0x1a455abe2
call fcn.18000cd8e
invalid
push rbx
jl 0x180009313
nop
jge 0x180009313
call fcn.18000da7d
call fcn.18000c571
jns 0x180012089
and edi, dword [rdi]
call 0x1a44dae43
adc byte [rbp - 0x75], cl
fimul dword [rcx + 0x48102444]
test eax, 0
jb 0x1800109d7
sub r9, r10
mov r8, r10
call fcn.18000a181
or ah, byte [rcx]
jrcxz 0x180012143
call 0x1b18130bf
xchg edi, eax
invalid
test edx, 0
jb 0x1800081c9
xor eax, eax
call fcn.18001228f
jo 0x18001217c
test byte [rax + rbp*8], 0x4c
mov edx, dword [rsp + 8]
jmp fcn.180008fcc
jg 0x18001495c
xchg bx, bx
jle 0x18001495c
mov r9, qword [rsp + 8]
jp 0x1800124a5
xchg r13, r13
jnp 0x1800124a5
xor r10, 0x2b5514c9
jp 0x18000dfaa
mov bh, bh
jnp 0x18000dfaa
jo 0x1800135f7
test ebx, ebx
je 0x18000e48f
call fcn.18001046b
sbb eax, 0xe8f50855
call fcn.18001273e
mov rcx, qword [rax + 0x10]
call fcn.180009c39
xor al, 0x8c
sbb eax, 0x8b4ce834
jl 0x180012207
or byte [rdi], cl
test cl, ah
ret 0xffff
add byte [rax], al
add byte [rdi], cl
test dword [rcx + 0x67], edi
invalid
movsxd r9, dword [r9]
js 0x18000b666
mov ax, ax
jns 0x18000b666
test edx, 0
jb 0x18001388f
call fcn.180010746
invalid
call fcn.180014574
push rsi
mov word [rbx - 0x28], cs
call 0x1bb883dee
push rdx
invalid
xchg dword [rbx], edi
nop
invalid
or eax, edx
call fcn.18000c0ae
outsd dx, dword [rsi]
movabs eax, dword [0x850f00c7f6e8f8e3]
sal byte [rsi - 1], cl
inc dword [rbp + 0x31850fc0]
cmp eax, 0x48e8ffff
mov edi, edi
invalid
mov eax, esp
mov qword [rax + 8], rcx
call fcn.18000cfcf
xor edx, dword [rsi + 0x5de8325c]
adc eax, dword [rax]
add al, ch
imul di, di, 0x48ff
mov eax, dword [0x18001a7fa]
call fcn.180010af2
outsd dx, dword cs:[rsi]
popfq
cmp eax, 0x5c014ce8
and al, 0x10
js 0x18000647d
mov bh, bh
jns 0x18000647d
je 0x18000b19c
call fcn.18000c151
popfq
sbb esp, ecx
cmp ch, al
test cx, 0
call fcn.180009c39
rcl cl, 0x1c
xor al, 0xe8
jo 0x180012e8e
xor edi, edi
call fcn.18000caed
mov cl, 0x23
add esi, esi
call 0x1118c48c4
test edi, edi
invalid
add rdx, 0x115aa747
js 0x1800071d8
xchg cl, cl
jns 0x1800071d8
jb 0x18000d913
add rax, rcx
ret
Function at 0x180012269
Capabilities:
Authenticate hmac
Check for software breakpoints
Check os version
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Get number of processors
Get system information on windows

Disassembly:
movsxd r14, dword [r14]
jb 0x18000f196
mov dx, dx
jae 0x18000f196
jne 0x180014171
lea eax, [rbp + 8]
call fcn.18000fd3b
and dword [rdx], 0x48e80295
inc ecx
mov r14, qword [rsp + 8]
jl 0x180009996
xchg r10, r10
jge 0x180009996
pushfq
jp 0x18000ac14
mov r11, r11
jnp 0x18000ac14
mov rcx, rdi
call qword [0x18001a47f]
mov rbx, rax
test r13, 0
jne 0x18000f69c
call fcn.18000e8db
jae 0x18000f20a
cmc
call 0x1f0ed7515
call fcn.18000e600
add cl, byte [rax]
cmp eax, 0x8b48e8f8
add al, ch
pop rsp
or eax, dword [rax]
add byte [0x1680387e8], al
and al, 0x10
test ebp, eax
add byte es:[rax], al
call fcn.180006069
enter 0x6658, 0xffffffffffffffe3
call 0x1a45d81f7
or byte [rdi], cl
invalid
push r14
jb 0x18000b598
mov ah, ah
jae 0x18000b598
call fcn.180009e67
test r11, 0
call fcn.180013b03
cmp al, 0xd
cmp eax, 0xf53e828
push rbx
invalid
mov byte [rcx], dh
out dx, eax
invalid
lea ecx, [0x18001a071]
jmp fcn.180005d4f

Function at 0x180012439
Capabilities:
Authenticate hmac
Check for software breakpoints
Check os version
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Get number of processors
Get system information on windows

Disassembly:
push r15
je 0x180013edc
xchg dx, dx
jne 0x180013edc
movsxd rax, dword [rax]
jmp 0x18000ca9a
mov r15, qword [rsp + 8]
jl 0x18000c967
mov rdi, rdi
Function at 0x180012452
Capabilities:
Authenticate hmac
Check for software breakpoints
Check os version
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Get number of processors
Get system information on windows

Disassembly:
movsxd rbp, dword [rbp]
js 0x180013037
xchg dl, dl
jns 0x180013037
jne 0x1800094dd
call fcn.1800110e3
mov es, word [rcx - 0x19]
sub eax, ebp
jne 0x1800121ff
cmp al, 0xf3
call fcn.18000a03c
invalid
mov ecx, esi
mov rbp, qword [rsp + 8]
jg 0x18000ae8a
nop
jle 0x18000ae8a
pushfq
js 0x180009327
xchg dl, dl
jns 0x180009327
jb 0x180013372
call fcn.18000a19f
xor dword [rdx*2 + 0x310fe82b], eax
call fcn.18000b4d9
mov ch, 0x41
mov dl, 0x3d
call 0x14a82d908
and byte [rax], al
add byte [rax - 0x70], cl
movsxd r15, dword [r15]
ja 0x18000c981
mov rsi, rsi
jbe 0x18000c981
jl 0x180012201
invalid
dec dword [rcx - 9]
rol byte [rax], 0
add byte [rax], al
jne 0x180008989
call fcn.18000a0f2
pop rbp
lodsb al, byte [rsi]
add esi, esi
call 0x18f0a856b
mov word [rax + 0x18], fs
add byte [rax], al
xchg bp, bp
jge 0x180013a83
push rdi
test dx, 0
jb 0x18000d744
sub rsp, 0x70
test dx, 0
js 0x18000e9ce
and qword [rcx + 0x58], 0
call fcn.1800132fb
test bl, al
invalid
push rbp
je 0x18000c8bc
nop
jne 0x18000c8bc
mov edx, dword [rbx]
mov rcx, qword [rbx + 0x10]
lea rax, [rsp + 0x48]
lea r8d, [rdx + 0x10]
lea r9, [rsp + 0x40]
call fcn.180009c39
invalid
add qword [rsp + 0x10], r10
jp 0x18000ea92
mov r12, r12
jnp 0x18000ea92
xor rsi, 0x2677cc0c
ja 0x180009d2d
xchg r10, r10
jbe 0x180009d2d
sub qword [rsp + 0x10], rbp
ja 0x18000859d
xchg ch, ch
jbe 0x18000859d
js 0x18000c17c
call fcn.18000ebd2
xchg esp, eax
jo 0x18001285c
adc eax, 0x7c8b4ce8
and al, 8
jb 0x18000ef1e
mov rdx, rdx
jae 0x18000ef1e
pop r11
js 0x1800115c8
xchg rsi, rsi
jns 0x1800115c8
js 0x18000f2b1
sub esi, ebx
call fcn.18000c0ae
mov bl, 0x8a
sbb al, 7
call 0x1b09037ed
sahf
invalid
pushfq
js 0x18000cd78
xchg dx, dx
jns 0x18000cd78
add rax, 0x199bfa55
ja 0x18000ef30
mov r13, r13
invalid

Function at 0x180012597
Capabilities:
Authenticate hmac
Check for software breakpoints
Check os version
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Get number of processors
Get system information on windows

Disassembly:
push rdx
jo 0x18000a8cf
xchg r12, r12
jno 0x18000a8cf

Function at 0x180012ba1
Capabilities:
Check for software breakpoints
Check os version
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Get number of processors
Get system information on windows

Disassembly:
mov r9, qword [rsp + 8]
jo 0x180013b89
xchg r8, r8
jno 0x180013b89
sub esp, 0x20
push r9
jo 0x1800085d5
nop
jno 0x1800085d5
je 0x18000bc10
mov rcx, rax
call fcn.18000956c
call fcn.1800109c6
mov bh, 0x6f
and byte [rsi], dl
call 0x10b49ec00
invalid
movsxd r9, dword [r9]
jb 0x18000a756
mov r12, r12
jae 0x18000a756
mov rax, qword [r13 + 0x10]
lea rdx, [0x18000626c]
call fcn.18000b3ab
pop rbx
invalid
Function at 0x180013325
Capabilities:
Check for software breakpoints
Check os version
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Get number of processors
Get system information on windows

Disassembly:
fisttp dword [rdi]
test ch, cl
ret 0xffff
push r11
jo 0x18000a3d2
xchg rdi, rdi
jno 0x18000a3d2
jnp 0x1800121bb
call fcn.18000cfcf
jnp 0x18001332d
pop rsp
xor ch, al
jmp 0x18000a2cc

Function at 0x1800135c2
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Get system information on windows
Packed with generic packer

Disassembly:
mov rbp, qword [rsp + 8]
push rbp
jl 0x18000a860
mov r8, r8
jge 0x18000a860
movabs r8, 0xffffffff80000001
call fcn.1800074f2
in eax, dx
retf 0x38c8

Function at 0x180013ae2
Capabilities:
Check for software breakpoints
Check os version
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Get number of processors
Get system information on windows

Disassembly:
push rbx
jl 0x18000a92a
xchg bp, bp
jge 0x18000a92a

Function at 0x180013ca1
Capabilities:
Check for software breakpoints
Check os version
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Get number of processors
Get system information on windows

Disassembly:
movsxd rbp, dword [rbp]
jl 0x180013488
mov ah, ah
jge 0x180013488
imul rdi, rdi, 0x38
test r14, 0
jo 0x18000824a
add rdi, rax
call fcn.1800120d9
insb byte [rdi], dx
loopne 0x18000fcc4
shr eax, 0xf
mov es, word [rsi - 0x17ffffe4]
cwde
add byte [r8], r8b
push 0x33e80bd6
ror byte [rax - 0x75], cl
enter 0xfffffffffffface8, 0x1d
add byte [rax], al
jbe 0x18000fd34
invalid
dec dword [rdi]
mov dword [rax + 0x24], eax
add byte [rax], al
pushfq
jmp fcn.180005d5e
mov r12, r12
jno 0x18000fcb2
xor edx, edx
call fcn.180014485
rcr byte [rdx + 0x50e80bd6], 1
push rax
push rax
jl 0x18000704f
mov r11, r11
jge 0x18000704f
xor edx, dword [rbp - 0x35]
call fcn.180014297
or esp, dword [rbx]
cmp bh, dh
call 0x1c0c5c00a
call fcn.18000b4d9
loope 0x180013c8c
mov dl, 0x3d
call 0x1f5c1c218
Function at 0x180014297
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions
Get number of processors
Get system information on windows

Disassembly:
push r14
jb 0x18000f7c0
mov r15, r15
jae 0x18000f7c0
mov rsi, rax
call fcn.1800148c9
push rsp
sub eax, 0x1002e8f3
test si, 0
jb 0x180008fe9
call fcn.18000ad89
lodsd eax, dword [rsi]
and dl, dh
xor al, 0xe8
ret

Function at 0x180014485
Capabilities:
Check for software breakpoints
Check os version
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Get number of processors
Get system information on windows

Disassembly:
lodsb al, byte [rsi]
xor byte [rax], al
add byte [rax - 9], cl
invalid
invalid
invalid
ret
push rdx
jl 0x1800133e8
xchg bp, bp
jge 0x1800133e8
test r14, 0
jne 0x180007459
test rcx, rcx
je 0x18000ec36
je 0x180011f25
call fcn.18000828e
test bl, 0
jb 0x18000d54c
call fcn.18000cd8e
xor dl, byte [rbx + 0x48e8d976]
mov edx, esi
call fcn.180008c8e
call fcn.18000e600
push rdi
jle 0x180014515
clc
call 0x1fc88543c
mov edi, 0xdb86ffff
jbe 0x18001045e
call qword [0x18001a046]
mov edi, edi
dec esi
shrd dword [rcx], esp, 0xe8
call qword [0x18001a2a9]
mov ebx, 2
call fcn.1800120d9
movabs al, byte [0xf1b6348e8c1e532]
test byte [rax], dl
sar edi, 1
jmp qword [rsi - 0x79]
Function at 0x1800145dc
Capabilities:
Authenticate hmac
Check for software breakpoints
Check os version
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Get number of processors
Get system information on windows

Disassembly:
movsxd r12, dword [r12]
jb 0x18000aebe
mov dl, dl
jae 0x18000aebe
mov rbx, r9
mov r11, rcx
test r12, 0
call fcn.1800117dd
int1
invalid
call qword [rcx + 0x48]
lea ecx, [0x18001a8f0]
jmp fcn.180005d4f
sub ecx, eax
test ax, 0
jb 0x180009872
cmp rcx, 0x989680
call fcn.1800109c6
jbe 0x180009177
fucompi st(1)
call sub.KERNEL32.dll_CreateEventA
neg r11
mov r12, qword [rsp + 8]
ja 0x180008939
xchg rsp, rsp
jbe 0x180008939
adc eax, 0x11000
add al, ch
outsb dx, byte [rsi]
stc
invalid
pushfq
jmp 0x180013fb7
invalid
mov byte [rdx], ch
fdivp st(7)
inc dword [rbp + 0x33]
rol bh, 0x45
cmp ch, bl
ret
pop r12
js 0x18000db8c
mov bp, bp
jns 0x18000db8c
popfq
ja 0x180014273
mov di, di
jbe 0x180014273
lea rcx, [0x18001a3c9]
jmp fcn.180005d4f
ret
sub qword [rsp + 0x10], r12
ja 0x18001480a
xchg rbp, rbp
jbe 0x18001480a
pop rcx
jb 0x180010cb2
mov r10, r10
jae 0x180010cb2
mov ecx, edi
call fcn.180007f38
inc byte [rdx]
movabs al, byte [0xff3796840f9ce828]
dec dword [rax - 0x75]
ror byte [rdi], cl
test dword [rbp + 0x48ffff37], ecx
add edx, 0x11279be
sub r12, 0x28f50774
je 0x180013e7c
mov ah, ah
jne 0x180013e7c
mov qword [rbp - 0x40], rbx
call fcn.18000d793
add ebx, edx
popfq
add al, 0xe8
xor rdi, 0xd05e4bd
jmp fcn.18000abea
pop rax
ja 0x180014313
xchg r11, r11
jbe 0x180014313
sub qword [rsp + 0x10], r15
jb 0x18000a7d9
xchg dx, dx
jae 0x18000a7d9
ret
push r12
js 0x180009608
nop
jns 0x180009608
jne 0x18000ba9e
jne 0x18000fa4f
test bh, 0
jo 0x18000b915
call fcn.18000c0ae
fnstenv [rbx + 0x41e8f8e3]
push rsp
push r13
test rcx, 0
jne 0x18000d99e
call fcn.18000e7a1
invalid
popfq
jb 0x18000eae2
xchg ch, ch
jae 0x18000eae2
jne 0x18000a2cb
mov rcx, r12
call fcn.180008ea8
lea rcx, [rsi + 0xfff]
mov r9, rbp
mov ecx, ebp
mov r8d, 0x20
mov rdx, rdi
call rax
test di, 0
js 0x1800091aa
test eax, eax
call fcn.180009f09
jp 0x180014880
sub al, 0x13
call 0x1a445499f
adc byte [rdi], cl
mov byte [rax - 8], ah
invalid
xor byte [rcx - 0x48], al
loop 0x18001482f
xchg al, ch
pop ax
invalid

Function at 0x1800148c9
Capabilities:
Check for software breakpoints
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Get number of processors
Get system information on windows

Disassembly:
mov r15, qword [rsp + 8]
movsxd r15, dword [r15]
jp 0x180007984
mov r15, r15
jnp 0x180007984
push rsi
call fcn.18000ec40
add dword [rdi - 0x63], ecx
invalid
push r15
jp 0x18000caba
mov sp, sp
jnp 0x18000caba
Function at 0x1800148da
Capabilities:
Check for software breakpoints
Encode data using base64
Encode data using xor
Encrypt data using speck
Execute anti-debugging instructions
Get number of processors
Get system information on windows

Disassembly:
or r8b, bpl
test dword [rsi], ecx
add al, ch
mov ebp, 0x58000001
invalid
mov rdx, qword [rsp + 8]
je 0x18000dcac
mov r14, r14
jne 0x18000dcac
int1
mov r12d, 0xedd
call fcn.1800098c6
jno 0x18000c28f
mov gs, word [rdi]
call 0x190444dc7
test ch, 0
call fcn.180011bb7
test al, 0x4b
insd dword [rdi], dx
adc eax, ebp
mov byte [rax + rbp*8], 0xa6
pop rax
add byte [rax], al
and al, 0xd7
insd dword [rdi], dx
adc eax, ebp
je 0x18000757b
je 0x180011815
test dl, 0
jb 0x180007822
test r15, r15
je 0x18000757b
je 0x180012cdb
call fcn.18000f3b4
sbb al, 0xee
insb byte [rdi], dx
sub ebp, eax
movsxd rdx, dword [rdx]
je 0x180009693
mov rdi, rdi
jne 0x180009693
mov rax, qword [rcx]
mov esp, ebx
test eax, 0
invalid
push rdx
je 0x180007dc2
mov ch, ch
jne 0x180007dc2
jo 0x180005ea0
and qword [rcx], 0
test ecx, 0
js 0x180013771
and dword [rcx + 8], 0
test ecx, 0
jb 0x18000c30a
and qword [rcx + 0x10], 0
test dl, 0
jb 0x18000c266
and dword [rcx + 0x18], 0
mov rsi, rcx
call fcn.180008a5d
xor edi, dword [rcx + 0x3be8c968]
call 0x133b3d543
invalid
Function at 0x140001160
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
mov rsi, qword [0x140081048]
xor eax, eax
lock cmpxchg qword [rsi], rdi
sete bl
je 0x1400011b9
cmp rdi, rax
je 0x1400011b9
mov r14, qword [sym.imp.KERNEL32.dll_Sleep]
nop word [rax + rax]
mov ecx, 0x3e8
call r14
xor eax, eax
lock cmpxchg qword [rsi], rdi
sete bl
je 0x1400011b9
cmp rdi, rax
jne 0x1400011a0
mov rdi, qword [0x140081050]
mov eax, dword [rdi]
cmp eax, 1
jne 0x1400011d3
mov ecx, 0x1f
call fcn.14004ba20
jmp 0x1400011fa
cmp dword [rdi], 0
je 0x1400011e1
mov byte [0x1401315d8], 1
jmp 0x1400011fa
mov dword [rdi], 1
mov rcx, qword [0x140081068]
mov rdx, qword [0x140081070]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
mov eax, dword [rdi]
cmp eax, 1
jne 0x14000121a
mov rcx, qword [0x140081058]
mov rdx, qword [0x140081060]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
mov dword [rdi], 2
test bl, 1
je 0x140001224
xor eax, eax
xchg qword [rsi], rax
mov rax, qword [0x140081008]
mov rax, qword [rax]
test rax, rax
je 0x140001243
xor ecx, ecx
mov edx, 2
xor r8d, r8d
call qword [0x140139008]
call fcn.14004b090
lea rcx, [0x14004b640]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [0x140081040]
mov qword [rcx], rax
lea rcx, [0x140001390]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__set_invalid_parameter_handler
call fcn.14004b080
movsxd rdi, dword [0x1401315c4]
lea rcx, [rdi*8 + 8]
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov rsi, rax
test rdi, rdi
jle 0x1400012d2
mov ebx, edi
mov r14, qword [0x1401315c8]
xor r15d, r15d
nop dword [rax + rax]
mov rcx, qword [r14 + r15*8]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
lea rdi, [rax + 1]
mov rcx, rdi
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov qword [rsi + r15*8], rax
mov rdx, qword [r14 + r15*8]
mov rcx, rax
mov r8, rdi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
inc r15
cmp rbx, r15
jne 0x1400012a0
jmp 0x1400012d4
xor ebx, ebx
mov qword [rsi + rbx*8], 0
mov qword [0x1401315c8], rsi
call fcn.14004aed0
mov rax, qword [0x1401315d0]
mov rcx, qword [0x140081018]
mov rcx, qword [rcx]
mov qword [rcx], rax
mov ecx, dword [0x1401315c4]
mov rdx, qword [0x1401315c8]
mov r8, qword [0x1401315d0]
call fcn.140001394
mov dword [0x1401315dc], eax
cmp dword [0x1401315bc], 0
je 0x140001344
cmp byte [0x1401315d8], 0
jne 0x140001338
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
mov eax, dword [0x1401315dc]
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3
Function at 0x1400013ec
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r14, rcx
mov rdi, qword [rcx + 8]
sub rdi, qword [rcx]
lea rcx, str.KERNEL32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, 0xffffffff
test rax, rax
je 0x14000156d
mov rbx, rax
movzx eax, word [rax]
cmp eax, 0x5a4d
jne 0x14000156d
movsxd rax, dword [rbx + 0x3c]
cmp dword [rbx + rax], 0x4550
jne 0x14000156d
mov r8d, dword [rbx + rax + 0x88]
mov eax, dword [rbx + r8 + 0x14]
test rax, rax
je 0x14000156d
mov edx, dword [rbx + r8 + 0x20]
add rdx, rbx
mov ecx, dword [rbx + r8 + 0x1c]
add rcx, rbx
mov r8d, dword [rbx + r8 + 0x24]
add r8, rbx
lea r9, [rbx + 1]
xor r10d, r10d
mov r11d, dword [rdx + r10*4]
mov r15b, byte [rbx + r11]
test r15b, r15b
je 0x1400014b1
add r11, r9
mov ebp, 0x1d
movsx r15d, r15b
mov r12d, ebp
shl r12d, 5
add ebp, r12d
add ebp, r15d
mov r15b, byte [r11]
inc r11
test r15b, r15b
jne 0x14000148d
cmp ebp, 0xdd4d5eaf
je 0x1400014be
inc r10
cmp r10, rax
jne 0x140001478
jmp 0x14000156d
mov r10d, r10d
movzx r10d, word [r8 + r10*2]
mov r10d, dword [rcx + r10*4]
add r10, rbx
xor r11d, r11d
mov r15d, dword [rdx + r11*4]
mov r12b, byte [rbx + r15]
test r12b, r12b
je 0x140001509
add r15, r9
mov ebp, 0x1d
movsx r12d, r12b
mov r13d, ebp
shl r13d, 5
add ebp, r13d
add ebp, r12d
mov r12b, byte [r15]
inc r15
test r12b, r12b
jne 0x1400014e5
cmp ebp, 0xf70166a5
je 0x140001513
inc r11
cmp r11, rax
jne 0x1400014d0
jmp 0x14000156d
mov eax, r11d
movzx eax, word [r8 + rax*2]
mov r12d, dword [rcx + rax*4]
xor ecx, ecx
mov rdx, rdi
mov r8d, 0x3000
mov r9d, 4
call r10
mov esi, 1
test rax, rax
je 0x14000156d
mov r15, rax
add rbx, r12
mov rdx, qword [r14]
mov rcx, rax
mov r8, rdi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
lea r9, [rsp + 0x24]
mov rcx, r15
mov rdx, rdi
mov r8d, 0x20
call rbx
test eax, eax
je 0x14000156d
call r15
xor esi, esi
mov eax, esi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret