joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180001380
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 8]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x70]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx]
movzx ecx, word [rcx + 0x14]
lea rax, [rax + rcx + 0x18]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
jmp 0x1800013e6
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x28]
add rax, 0x28
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x70]
mov rax, qword [rax]
movzx eax, word [rax + 6]
cmp dword [rsp + 0x20], eax
jge 0x18000155f
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x10], 0
jne 0x18000149c
mov rax, qword [rsp + 0x68]
mov eax, dword [rax + 0x38]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
jle 0x180001497
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x28]
mov ecx, dword [rcx + 0xc]
mov rdx, qword [rsp + 0x38]
add rdx, rcx
mov rcx, rdx
mov r9d, 4
mov r8d, 0x1000
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x18000145f
xor eax, eax
jmp 0x180001564
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x38]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x28]
mov ecx, dword [rsp + 0x30]
mov dword [rax + 8], ecx
movsxd rax, dword [rsp + 0x24]
mov r8, rax
xor edx, edx
mov rcx, qword [rsp + 0x30]
call fcn.1800010b0
jmp 0x1800013ce
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x14]
mov rcx, qword [rsp + 0x28]
add eax, dword [rcx + 0x10]
mov eax, eax
mov r8d, eax
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
call fcn.180001340
test eax, eax
jne 0x1800014cb
xor eax, eax
jmp 0x180001564
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x10]
mov rcx, qword [rsp + 0x28]
mov ecx, dword [rcx + 0xc]
mov rdx, qword [rsp + 0x38]
add rdx, rcx
mov rcx, rdx
mov r9d, 4
mov r8d, 0x1000
mov edx, eax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x18000150b
xor eax, eax
jmp 0x180001564
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x38]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x10]
mov rcx, qword [rsp + 0x28]
mov ecx, dword [rcx + 0x14]
mov rdx, qword [rsp + 0x58]
add rdx, rcx
mov rcx, rdx
mov r8d, eax
mov rdx, rcx
mov rcx, qword [rsp + 0x30]
call fcn.180001120
mov rax, qword [rsp + 0x28]
mov ecx, dword [rsp + 0x30]
mov dword [rax + 8], ecx
jmp 0x1800013ce
mov eax, 1
add rsp, 0x48
ret
Function at 0x1400010d0
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor eax, eax
nop
cpuid
nop
mov eax, 1
nop
cpuid
nop
movabs r9, 0xb2d05e00
nop
cpuid
nop
rdtsc
nop
shl rdx, 0x20
nop
or rax, rdx
nop
mov rcx, rax
nop
fldpi
nop
frndint
nop
rdtsc
nop
shl rdx, 0x20
nop
or rax, rdx
nop
sub rax, rcx
nop
cmp rax, r9
nop
jb 0x1400010fd
nop
nop
push rbp
nop
mov rbp, rsp
nop
sub rsp, 8
nop
mov r10, 0xa
nop
mov rcx, 0xffffffff9f345678
nop
dec rcx
nop
xor r9, r9
nop
mov rax, rcx
nop
jne 0x140001136
nop
xor rax, rax
nop
mov rax, rbx
nop
add rax, rdx
nop
dec r10
nop
xor r11, r11
nop
jne 0x14000112d
nop
xor rax, rax
mov rax, 0xa
nop
dec rax
nop
add rsp, 8
pop rbp
ret
Function at 0x1400033e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x20
xor ebp, ebp
mov rbx, rcx
lea r8d, [rbp + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x14000348a
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14000348a
mov rcx, rax
mov qword [rsp + 0x30], rsi
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rdi
mov rcx, rbx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov eax, 2
shr ebx, 1
lea ecx, [rbx + 1]
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140003928
add rbx, rbx
mov rdx, rsi
mov r8, rbx
mov rcx, rax
mov rdi, rax
call fcn.140004860
mov rsi, qword [rsp + 0x30]
mov rax, rdi
mov word [rbx + rdi], bp
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x38]
mov rax, rbp
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140004374
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400043be
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400043be
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400043be
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400043be
cmp dword [rcx + 0x84], 0xe
jbe 0x1400043be
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400043c0
xor al, al
add rsp, 0x28
ret

Function at 0x140007f74
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140007da0
Function at 0x408840
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
cmp byte [0x00447098], 0
je 0x4088de
cmp word [0x004473a8], 0xd7b2
jne 0x408873
cmp dword [0x004473b0], 0
jbe 0x408873
lea rcx, [0x004473a0]
call qword [0x004473c8]
mov ecx, 0xfffffff5
call sub.kernel32.dll_GetStdHandle
mov rcx, rax
lea rdx, [0x00440564]
mov r8d, 0x25
lea r9, [rsp + 0x3c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
mov ecx, 0xfffffff5
call sub.kernel32.dll_GetStdHandle
mov rbx, rax
lea rcx, [0x00408914]
call fcn.00409730
mov rcx, rbx
mov rdx, rax
mov r8d, 2
lea r9, [rsp + 0x3c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
jmp 0x408900
cmp byte [0x0043f03a], 0
jne 0x408900
xor rcx, rcx
lea rdx, [0x00440564]
lea r8, str.Error
xor r9, r9
call sub.user32.dll_MessageBoxA
add rsp, 0x40
pop rbx
ret

Function at 0x409103
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push rsi
sub rsp, 0x4f0
lea rax, str.ftadc
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x390], 0
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x28]
lea rcx, [rsp + 0x390]
mov qword [rsp + 0x4e0], rcx
mov dword [rsp + 0x1c8], eax
mov rax, qword gs:[0x30]
mov qword [rsp + 0x3a0], rax
mov rax, qword [rsp + 0x3a0]
mov rax, qword [rax + 0x60]
mov qword [rsp + 0x398], rax
mov rax, qword [rsp + 0x398]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x3a8], rax
mov rax, qword [rsp + 0x3a8]
add rax, 0x10
mov qword [rsp + 0x158], rax
mov qword [rsp + 0x2c0], rax
mov rax, qword [rsp + 0x2c0]
mov rax, qword [rax]
mov qword [rsp + 0x158], rax
mov rax, qword [rsp + 0x158]
cmp rax, qword [rsp + 0x2c0]
je 0x409213
mov rax, qword [rsp + 0x158]
mov qword [rsp + 0x2b8], rax
mov esi, dword [rsp + 0x1c8]
mov rax, qword [rsp + 0x2b8]
mov rcx, qword [rax + 0x60]
call fcn.00409063
cmp esi, eax
jne 0x4091fe
mov rax, qword [rsp + 0x2b8]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x2c8], rax
jmp 0x40921f
mov rax, qword [rsp + 0x158]
mov rax, qword [rax]
mov qword [rsp + 0x158], rax
jmp 0x4091aa
mov qword [rsp + 0x2c8], 0
mov rax, qword [rsp + 0x2c8]
mov qword [rsp + 0xe8], rax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x34]
mov rcx, qword [rsp + 0x38]
mov ecx, dword [rcx + 0xc]
mov rdx, qword [rsp + 0xe8]
mov rsi, qword [rsp + 0x38]
mov esi, dword [rsi + 0x54]
mov dword [rsp + 0x21c], eax
mov dword [rsp + 0x218], ecx
mov qword [rsp + 0xe0], rdx
mov dword [rsp + 0x214], esi
mov rax, qword [rsp + 0xe0]
loopne 0x409272
add byte [rax], al
mov rcx, qword [rsp + 0xe0]
movsxd rcx, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp + 0x4c0], rax
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x4c0]
mov edx, dword [rsp + 0x214]
mov ecx, dword [rcx + rdx*8 + 0x88]
add rax, rcx
mov qword [rsp + 0x1a0], rax
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x1a0]
mov ecx, dword [rcx + 0x24]
add rax, rcx
mov qword [rsp + 0x4b8], rax
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x1a0]
mov ecx, dword [rcx + 0x20]
add rax, rcx
mov qword [rsp + 0x4b0], rax
Function at 0x4091c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
sub rsp, 0x4f0
lea rax, str.ftadc
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x390], 0
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x28]
lea rcx, [rsp + 0x390]
mov qword [rsp + 0x4e0], rcx
mov dword [rsp + 0x1c8], eax
mov rax, qword gs:[0x30]
mov qword [rsp + 0x3a0], rax
mov rax, qword [rsp + 0x3a0]
mov rax, qword [rax + 0x60]
mov qword [rsp + 0x398], rax
mov rax, qword [rsp + 0x398]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x3a8], rax
mov rax, qword [rsp + 0x3a8]
add rax, 0x10
mov qword [rsp + 0x158], rax
mov qword [rsp + 0x2c0], rax
mov rax, qword [rsp + 0x2c0]
mov rax, qword [rax]
mov qword [rsp + 0x158], rax
mov rax, qword [rsp + 0x158]
cmp rax, qword [rsp + 0x2c0]
je 0x409213
mov rax, qword [rsp + 0x158]
mov qword [rsp + 0x2b8], rax
mov esi, dword [rsp + 0x1c8]
mov rax, qword [rsp + 0x2b8]
mov rcx, qword [rax + 0x60]
call fcn.00409063
cmp esi, eax
jne 0x4091fe
mov rax, qword [rsp + 0x2b8]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x2c8], rax
jmp 0x40921f
mov rax, qword [rsp + 0x158]
mov rax, qword [rax]
mov qword [rsp + 0x158], rax
jmp 0x4091aa
mov qword [rsp + 0x2c8], 0
mov rax, qword [rsp + 0x2c8]
mov qword [rsp + 0xe8], rax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x34]
mov rcx, qword [rsp + 0x38]
mov ecx, dword [rcx + 0xc]
mov rdx, qword [rsp + 0xe8]
mov rsi, qword [rsp + 0x38]
mov esi, dword [rsi + 0x54]
mov dword [rsp + 0x21c], eax
mov dword [rsp + 0x218], ecx
mov qword [rsp + 0xe0], rdx
mov dword [rsp + 0x214], esi
mov rax, qword [rsp + 0xe0]
loopne 0x409272
add byte [rax], al
mov rcx, qword [rsp + 0xe0]
movsxd rcx, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp + 0x4c0], rax
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x4c0]
mov edx, dword [rsp + 0x214]
mov ecx, dword [rcx + rdx*8 + 0x88]
add rax, rcx
mov qword [rsp + 0x1a0], rax
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x1a0]
mov ecx, dword [rcx + 0x24]
add rax, rcx
mov qword [rsp + 0x4b8], rax
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x1a0]
mov ecx, dword [rcx + 0x20]
add rax, rcx
mov qword [rsp + 0x4b0], rax
Function at 0x409270
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
sub rsp, 0x4f0
lea rax, str.ftadc
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x390], 0
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x28]
lea rcx, [rsp + 0x390]
mov qword [rsp + 0x4e0], rcx
mov dword [rsp + 0x1c8], eax
mov rax, qword gs:[0x30]
mov qword [rsp + 0x3a0], rax
mov rax, qword [rsp + 0x3a0]
mov rax, qword [rax + 0x60]
mov qword [rsp + 0x398], rax
mov rax, qword [rsp + 0x398]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x3a8], rax
mov rax, qword [rsp + 0x3a8]
add rax, 0x10
mov qword [rsp + 0x158], rax
mov qword [rsp + 0x2c0], rax
mov rax, qword [rsp + 0x2c0]
mov rax, qword [rax]
mov qword [rsp + 0x158], rax
mov rax, qword [rsp + 0x158]
cmp rax, qword [rsp + 0x2c0]
je 0x409213
mov rax, qword [rsp + 0x158]
mov qword [rsp + 0x2b8], rax
mov esi, dword [rsp + 0x1c8]
mov rax, qword [rsp + 0x2b8]
mov rcx, qword [rax + 0x60]
call fcn.00409063
cmp esi, eax
jne 0x4091fe
mov rax, qword [rsp + 0x2b8]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x2c8], rax
jmp 0x40921f
mov rax, qword [rsp + 0x158]
mov rax, qword [rax]
mov qword [rsp + 0x158], rax
jmp 0x4091aa
mov qword [rsp + 0x2c8], 0
mov rax, qword [rsp + 0x2c8]
mov qword [rsp + 0xe8], rax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x34]
mov rcx, qword [rsp + 0x38]
mov ecx, dword [rcx + 0xc]
mov rdx, qword [rsp + 0xe8]
mov rsi, qword [rsp + 0x38]
mov esi, dword [rsi + 0x54]
mov dword [rsp + 0x21c], eax
mov dword [rsp + 0x218], ecx
mov qword [rsp + 0xe0], rdx
mov dword [rsp + 0x214], esi
mov rax, qword [rsp + 0xe0]
loopne 0x409272
add byte [rax], al
mov rcx, qword [rsp + 0xe0]
movsxd rcx, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp + 0x4c0], rax
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x4c0]
mov edx, dword [rsp + 0x214]
mov ecx, dword [rcx + rdx*8 + 0x88]
add rax, rcx
mov qword [rsp + 0x1a0], rax
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x1a0]
mov ecx, dword [rcx + 0x24]
add rax, rcx
mov qword [rsp + 0x4b8], rax
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x1a0]
mov ecx, dword [rcx + 0x20]
add rax, rcx
mov qword [rsp + 0x4b0], rax
Function at 0x4092f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x1a0]
mov ecx, dword [rcx + 0x1c]
add rax, rcx
mov qword [rsp + 0x4a8], rax
mov dword [rsp + 0x7c], 0
mov eax, dword [rsp + 0x7c]
mov rcx, qword [rsp + 0x1a0]
cmp eax, dword [rcx + 0x18]
jae 0x4094a5
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x4b0]
mov edx, dword [rsp + 0x7c]
mov ecx, dword [rcx + rdx*4]
add rax, rcx
mov qword [rsp + 0x4a0], rax
mov rax, qword [rsp + 0x4a0]
mov ecx, dword [rsp + 0x21c]
mov qword [rsp + 0x308], rax
mov dword [rsp + 0x224], ecx
mov dword [rsp + 0xfc], 0
mov rcx, qword [rsp + 0x308]
call fcn.004090c3
std
invalid
dec dword [rcx + 0x2202484]
add byte [rax], al
mov dword [rsp + 0x94], 0
mov eax, dword [rsp + 0x94]
cmp eax, dword [rsp + 0x220]
jae 0x409455
mov rax, qword [rsp + 0x308]
movsxd rcx, dword [rsp + 0x94]
mov al, byte [rax + rcx]
mov byte [rsp + 0x59], al
mov eax, dword [rsp + 0x224]
mov ecx, dword [rsp + 0xfc]
mov dword [rsp + 0x28c], eax
mov dword [rsp + 0x288], ecx
mov dword [rsp + 0x14c], 0
mov dword [rsp + 0x148], 0
mov eax, dword [rsp + 0x148]
cmp eax, dword [rsp + 0x28c]
mov eax, dword [rsp + 0xfc]
cmp eax, dword [rsp + 0x218]
jne 0x409495
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x4a8]
mov rdx, qword [rsp + 0x4b8]
mov esi, dword [rsp + 0x7c]
movzx edx, word [rdx + rsi*2]
mov ecx, dword [rcx + rdx*4]
add rax, rcx
mov qword [rsp + 0x300], rax
jmp 0x4094b1
mov eax, dword [rsp + 0x7c]
add eax, 1
mov dword [rsp + 0x7c], eax
jmp 0x409316
mov qword [rsp + 0x300], 0
mov rax, qword [rsp + 0x300]
mov qword [rsp + 0x388], rax
mov rax, qword [rsp + 0x388]
mov rcx, qword [rsp + 0x38]
mov ecx, dword [rcx + 0x10]
mov edx, ecx
xor ecx, ecx
call rax
mov qword [rsp + 0x150], rax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x34]
mov rcx, qword [rsp + 0x38]
mov ecx, dword [rcx + 0x68]
mov rdx, qword [rsp + 0xe8]
mov rsi, qword [rsp + 0x38]
mov esi, dword [rsi + 0x54]
mov dword [rsp + 0x210], eax
mov dword [rsp + 0x20c], ecx
mov qword [rsp + 0xd8], rdx
mov dword [rsp + 0x208], esi
mov rax, qword [rsp + 0xd8]
fadd dword [rax]
add byte [rax], al
mov rcx, qword [rsp + 0xd8]
movsxd rcx, dword [rcx + 0x3c]

Function at 0x409400
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jae 0x40942a
mov eax, dword [rsp + 0x288]
add eax, dword [rsp + 0x14c]
mov eax, dword [rsp + 0x14c]
movzx ecx, byte [rsp + 0x59]
add eax, ecx
mov dword [rsp + 0xfc], eax
mov eax, dword [rsp + 0x94]
add eax, 1
mov dword [rsp + 0x94], eax
jmp 0x409395

Function at 0x409410
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x14c], eax
mov eax, dword [rsp + 0x148]
add eax, 1
mov dword [rsp + 0x148], eax
jmp 0x4093f2

Function at 0x409450
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jae 0x40942a
mov eax, dword [rsp + 0x288]
add eax, dword [rsp + 0x14c]
mov eax, dword [rsp + 0x14c]
movzx ecx, byte [rsp + 0x59]
add eax, ecx
mov dword [rsp + 0xfc], eax
mov eax, dword [rsp + 0x94]
add eax, 1
mov dword [rsp + 0x94], eax
jmp 0x409395
Function at 0x4094b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x1a0]
mov ecx, dword [rcx + 0x1c]
add rax, rcx
mov qword [rsp + 0x4a8], rax
mov dword [rsp + 0x7c], 0
mov eax, dword [rsp + 0x7c]
mov rcx, qword [rsp + 0x1a0]
cmp eax, dword [rcx + 0x18]
jae 0x4094a5
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x4b0]
mov edx, dword [rsp + 0x7c]
mov ecx, dword [rcx + rdx*4]
add rax, rcx
mov qword [rsp + 0x4a0], rax
mov rax, qword [rsp + 0x4a0]
mov ecx, dword [rsp + 0x21c]
mov qword [rsp + 0x308], rax
mov dword [rsp + 0x224], ecx
mov dword [rsp + 0xfc], 0
mov rcx, qword [rsp + 0x308]
call fcn.004090c3
std
invalid
dec dword [rcx + 0x2202484]
add byte [rax], al
mov dword [rsp + 0x94], 0
mov eax, dword [rsp + 0x94]
cmp eax, dword [rsp + 0x220]
jae 0x409455
mov rax, qword [rsp + 0x308]
movsxd rcx, dword [rsp + 0x94]
mov al, byte [rax + rcx]
mov byte [rsp + 0x59], al
mov eax, dword [rsp + 0x224]
mov ecx, dword [rsp + 0xfc]
mov dword [rsp + 0x28c], eax
mov dword [rsp + 0x288], ecx
mov dword [rsp + 0x14c], 0
mov dword [rsp + 0x148], 0
mov eax, dword [rsp + 0x148]
cmp eax, dword [rsp + 0x28c]
mov eax, dword [rsp + 0xfc]
cmp eax, dword [rsp + 0x218]
jne 0x409495
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x4a8]
mov rdx, qword [rsp + 0x4b8]
mov esi, dword [rsp + 0x7c]
movzx edx, word [rdx + rsi*2]
mov ecx, dword [rcx + rdx*4]
add rax, rcx
mov qword [rsp + 0x300], rax
jmp 0x4094b1
mov eax, dword [rsp + 0x7c]
add eax, 1
mov dword [rsp + 0x7c], eax
jmp 0x409316
mov qword [rsp + 0x300], 0
mov rax, qword [rsp + 0x300]
mov qword [rsp + 0x388], rax
mov rax, qword [rsp + 0x388]
mov rcx, qword [rsp + 0x38]
mov ecx, dword [rcx + 0x10]
mov edx, ecx
xor ecx, ecx
call rax
mov qword [rsp + 0x150], rax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x34]
mov rcx, qword [rsp + 0x38]
mov ecx, dword [rcx + 0x68]
mov rdx, qword [rsp + 0xe8]
mov rsi, qword [rsp + 0x38]
mov esi, dword [rsi + 0x54]
mov dword [rsp + 0x210], eax
mov dword [rsp + 0x20c], ecx
mov qword [rsp + 0xd8], rdx
mov dword [rsp + 0x208], esi
mov rax, qword [rsp + 0xd8]
fadd dword [rax]
add byte [rax], al
mov rcx, qword [rsp + 0xd8]
movsxd rcx, dword [rcx + 0x3c]
Function at 0x409510
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x1a0]
mov ecx, dword [rcx + 0x1c]
add rax, rcx
mov qword [rsp + 0x4a8], rax
mov dword [rsp + 0x7c], 0
mov eax, dword [rsp + 0x7c]
mov rcx, qword [rsp + 0x1a0]
cmp eax, dword [rcx + 0x18]
jae 0x4094a5
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x4b0]
mov edx, dword [rsp + 0x7c]
mov ecx, dword [rcx + rdx*4]
add rax, rcx
mov qword [rsp + 0x4a0], rax
mov rax, qword [rsp + 0x4a0]
mov ecx, dword [rsp + 0x21c]
mov qword [rsp + 0x308], rax
mov dword [rsp + 0x224], ecx
mov dword [rsp + 0xfc], 0
mov rcx, qword [rsp + 0x308]
call fcn.004090c3
std
invalid
dec dword [rcx + 0x2202484]
add byte [rax], al
mov dword [rsp + 0x94], 0
mov eax, dword [rsp + 0x94]
cmp eax, dword [rsp + 0x220]
jae 0x409455
mov rax, qword [rsp + 0x308]
movsxd rcx, dword [rsp + 0x94]
mov al, byte [rax + rcx]
mov byte [rsp + 0x59], al
mov eax, dword [rsp + 0x224]
mov ecx, dword [rsp + 0xfc]
mov dword [rsp + 0x28c], eax
mov dword [rsp + 0x288], ecx
mov dword [rsp + 0x14c], 0
mov dword [rsp + 0x148], 0
mov eax, dword [rsp + 0x148]
cmp eax, dword [rsp + 0x28c]
mov eax, dword [rsp + 0xfc]
cmp eax, dword [rsp + 0x218]
jne 0x409495
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x4a8]
mov rdx, qword [rsp + 0x4b8]
mov esi, dword [rsp + 0x7c]
movzx edx, word [rdx + rsi*2]
mov ecx, dword [rcx + rdx*4]
add rax, rcx
mov qword [rsp + 0x300], rax
jmp 0x4094b1
mov eax, dword [rsp + 0x7c]
add eax, 1
mov dword [rsp + 0x7c], eax
jmp 0x409316
mov qword [rsp + 0x300], 0
mov rax, qword [rsp + 0x300]
mov qword [rsp + 0x388], rax
mov rax, qword [rsp + 0x388]
mov rcx, qword [rsp + 0x38]
mov ecx, dword [rcx + 0x10]
mov edx, ecx
xor ecx, ecx
call rax
mov qword [rsp + 0x150], rax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x34]
mov rcx, qword [rsp + 0x38]
mov ecx, dword [rcx + 0x68]
mov rdx, qword [rsp + 0xe8]
mov rsi, qword [rsp + 0x38]
mov esi, dword [rsi + 0x54]
mov dword [rsp + 0x210], eax
mov dword [rsp + 0x20c], ecx
mov qword [rsp + 0xd8], rdx
mov dword [rsp + 0x208], esi
mov rax, qword [rsp + 0xd8]
fadd dword [rax]
add byte [rax], al
mov rcx, qword [rsp + 0xd8]
movsxd rcx, dword [rcx + 0x3c]
Function at 0x409520
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x1a0]
mov ecx, dword [rcx + 0x1c]
add rax, rcx
mov qword [rsp + 0x4a8], rax
mov dword [rsp + 0x7c], 0
mov eax, dword [rsp + 0x7c]
mov rcx, qword [rsp + 0x1a0]
cmp eax, dword [rcx + 0x18]
jae 0x4094a5
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x4b0]
mov edx, dword [rsp + 0x7c]
mov ecx, dword [rcx + rdx*4]
add rax, rcx
mov qword [rsp + 0x4a0], rax
mov rax, qword [rsp + 0x4a0]
mov ecx, dword [rsp + 0x21c]
mov qword [rsp + 0x308], rax
mov dword [rsp + 0x224], ecx
mov dword [rsp + 0xfc], 0
mov rcx, qword [rsp + 0x308]
call fcn.004090c3
std
invalid
dec dword [rcx + 0x2202484]
add byte [rax], al
mov dword [rsp + 0x94], 0
mov eax, dword [rsp + 0x94]
cmp eax, dword [rsp + 0x220]
jae 0x409455
mov rax, qword [rsp + 0x308]
movsxd rcx, dword [rsp + 0x94]
mov al, byte [rax + rcx]
mov byte [rsp + 0x59], al
mov eax, dword [rsp + 0x224]
mov ecx, dword [rsp + 0xfc]
mov dword [rsp + 0x28c], eax
mov dword [rsp + 0x288], ecx
mov dword [rsp + 0x14c], 0
mov dword [rsp + 0x148], 0
mov eax, dword [rsp + 0x148]
cmp eax, dword [rsp + 0x28c]
mov eax, dword [rsp + 0xfc]
cmp eax, dword [rsp + 0x218]
jne 0x409495
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x4a8]
mov rdx, qword [rsp + 0x4b8]
mov esi, dword [rsp + 0x7c]
movzx edx, word [rdx + rsi*2]
mov ecx, dword [rcx + rdx*4]
add rax, rcx
mov qword [rsp + 0x300], rax
jmp 0x4094b1
mov eax, dword [rsp + 0x7c]
add eax, 1
mov dword [rsp + 0x7c], eax
jmp 0x409316
mov qword [rsp + 0x300], 0
mov rax, qword [rsp + 0x300]
mov qword [rsp + 0x388], rax
mov rax, qword [rsp + 0x388]
mov rcx, qword [rsp + 0x38]
mov ecx, dword [rcx + 0x10]
mov edx, ecx
xor ecx, ecx
call rax
mov qword [rsp + 0x150], rax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x34]
mov rcx, qword [rsp + 0x38]
mov ecx, dword [rcx + 0x68]
mov rdx, qword [rsp + 0xe8]
mov rsi, qword [rsp + 0x38]
mov esi, dword [rsi + 0x54]
mov dword [rsp + 0x210], eax
mov dword [rsp + 0x20c], ecx
mov qword [rsp + 0xd8], rdx
mov dword [rsp + 0x208], esi
mov rax, qword [rsp + 0xd8]
fadd dword [rax]
add byte [rax], al
mov rcx, qword [rsp + 0xd8]
movsxd rcx, dword [rcx + 0x3c]

Function at 0x409530
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add rax, rcx
mov qword [rsp + 0x498], rax
mov rax, qword [rsp + 0xd8]
add byte [rax], al
add byte [rax - 0x75], cl
mov word [rax + rbx*4], fs
add al, 0
add byte [rbx + 0x2082494], cl
add byte [rax], al
mov ecx, dword [rcx + rdx*8 + 0x88]
add rax, rcx
mov qword [rsp + 0x198], rax
mov rax, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0x198]
mov ecx, dword [rcx + 0x24]
add rax, rcx
mov qword [rsp + 0x490], rax
mov rax, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0x198]
mov ecx, dword [rcx + 0x20]
add rax, rcx
mov qword [rsp + 0x488], rax
mov rax, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0x198]
mov ecx, dword [rcx + 0x1c]
add rax, rcx
mov qword [rsp + 0x480], rax
mov dword [rsp + 0x78], 0
Function at 0x409540
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [rax], al
add byte [rax - 0x75], cl
mov word [rax + rbx*4], fs
add al, 0
add byte [rbx + 0x2082494], cl
add byte [rax], al

Function at 0x409660
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [rax + 0x63], cl
mov word [rax + rbx*4], fs
add byte [rax], al
add byte [rdx + 0x44880804], cl
and al, 0x5a
Function at 0x409730
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test byte [rsp + rax*2], ah
add dword [rax], eax
add byte [rbx + 0x1402484], cl
add byte [rax], al
js 0x409741
mov bh, 0x14
jb 0x4096c1
or al, 0x91
add byte [rax], al

Function at 0x409890
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [rax - 0x75], cl
test byte [rax + rdx*8], ah
add byte [rax], al
add byte [rax - 0x75], cl
mov word [rax + rdx*8], fs
add byte [rax], al
add byte [rax + 0x63], cl
cmp al, 0x48
add eax, ecx