joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001828
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x270
jne 0x14000184a
mov rcx, qword [rsp + 0x40]
call fcn.140001a48
jmp 0x140001861
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x4e0
jb 0x140001861
mov rcx, qword [rsp + 0x40]
call fcn.140001af4
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax*4 + 4]
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
inc eax
mov rcx, qword [rsp + 0x40]
mov dword [rcx], eax
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0xb
mov rcx, qword [rsp + 0x40]
and eax, dword [rcx + 0x1384]
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 7
and eax, 0x9d2c5680
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 0xf
and eax, 0xefc60000
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0x12
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret

Function at 0x140001a48
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov qword [rsp + 8], 0x270
jmp 0x140001a69
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 0x4e0
jae 0x140001aed
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 8]
mov eax, dword [rax + rcx*4 - 0x9bc]
and eax, 0x80000000
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov ecx, dword [rcx + rdx*4 - 0x9b8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp], eax
mov eax, dword [rsp]
and eax, 1
test eax, eax
je 0x140001ab8
mov dword [rsp + 4], 0x9908b0df
jmp 0x140001ac0
mov dword [rsp + 4], 0
mov eax, dword [rsp]
shr eax, 1
xor eax, dword [rsp + 4]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x140001a5c
add rsp, 0x18
ret
Function at 0x140001af4
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x28], 0x26f
mov qword [rsp + 0x30], 0xe3
mov qword [rsp], 0
jmp 0x140001b24
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
cmp qword [rsp], 0xe3
jae 0x140001ba6
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x10], eax
mov eax, dword [rsp + 0x10]
and eax, 1
test eax, eax
je 0x140001b72
mov dword [rsp + 0x14], 0x9908b0df
jmp 0x140001b7a
mov dword [rsp + 0x14], 0
mov eax, dword [rsp + 0x10]
shr eax, 1
xor eax, dword [rsp + 0x14]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
xor eax, dword [rcx + rdx*4 + 0xff8]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x140001b19
mov qword [rsp + 8], 0xe3
jmp 0x140001bbe
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 0x26f
jae 0x140001c45
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 8]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x18], eax
mov eax, dword [rsp + 0x18]
and eax, 1
test eax, eax
je 0x140001c0f
mov dword [rsp + 0x1c], 0x9908b0df
jmp 0x140001c17
mov dword [rsp + 0x1c], 0
mov eax, dword [rsp + 0x18]
shr eax, 1
xor eax, dword [rsp + 0x1c]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x140001bb1
mov qword [rsp + 0x38], 0x26f
mov eax, 4
imul rax, rax, 0x4df
mov rcx, qword [rsp + 0x50]
mov eax, dword [rcx + rax + 4]
and eax, 0x80000000
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x50]
mov ecx, dword [rdx + rcx + 4]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
and eax, 1
test eax, eax
je 0x140001c99
mov dword [rsp + 0x24], 0x9908b0df
jmp 0x140001ca1
mov dword [rsp + 0x24], 0
mov eax, dword [rsp + 0x20]
shr eax, 1
xor eax, dword [rsp + 0x24]
mov ecx, 4
imul rcx, rcx, 0x18c
mov rdx, qword [rsp + 0x50]
xor eax, dword [rdx + rcx + 4]
mov ecx, 4
imul rcx, rcx, 0x26f
mov rdx, qword [rsp + 0x50]
mov dword [rdx + rcx + 4], eax
mov rax, qword [rsp + 0x50]
mov dword [rax], 0
add rsp, 0x48
ret

Function at 0x140003050
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000309a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000309a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000309a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000309a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000309a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000309c
xor al, al
add rsp, 0x28
ret
Function at 0x1400022c8
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400022c8
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002312
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002312
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002312
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002312
cmp dword [rcx + 0x84], 0xe
jbe 0x140002312
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002314
xor al, al
add rsp, 0x28
ret
Function at 0x1410d2058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1410d21df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1410d2089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1410d206f
add dl, dl
jne 0x1410d2096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1410d20f6
xor eax, eax
add dl, dl
jne 0x1410d20a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1410d21ad
add dl, dl
jne 0x1410d20b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410d20c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410d20d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410d20dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1410d20ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1410d207e
mov eax, 1
add dl, dl
jne 0x1410d2106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410d2113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1410d20fb
sub eax, ebx
mov ebx, 1
jne 0x1410d214c
mov ecx, 1
add dl, dl
jne 0x1410d212e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1410d213b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1410d2123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1410d207e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1410d2168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1410d2175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1410d215d
cmp eax, 0x7d00
jae 0x1410d219b
cmp eax, 0x500
jb 0x1410d2196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1410d207e
cmp eax, 0x7f
ja 0x1410d219e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1410d207e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1410d21d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1410d207e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140492058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1404921df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140492089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14049206f
add dl, dl
jne 0x140492096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1404920f6
xor eax, eax
add dl, dl
jne 0x1404920a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1404921ad
add dl, dl
jne 0x1404920b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1404920c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1404920d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1404920dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1404920ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14049207e
mov eax, 1
add dl, dl
jne 0x140492106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140492113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1404920fb
sub eax, ebx
mov ebx, 1
jne 0x14049214c
mov ecx, 1
add dl, dl
jne 0x14049212e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14049213b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140492123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14049207e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140492168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140492175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14049215d
cmp eax, 0x7d00
jae 0x14049219b
cmp eax, 0x500
jb 0x140492196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14049207e
cmp eax, 0x7f
ja 0x14049219e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14049207e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1404921d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14049207e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x401c40
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
mov eax, 1
xchg byte [0x0107a260], al
test al, al
je 0x401c5f
lea rcx, [0x0107a260]
call fcn.00438d60
movzx eax, byte [0x0107a261]
test al, al
je 0x401c80
mov byte [0x0107a260], 0
add rsp, 0x58
ret
lea rdx, [0x010fb2a8]
lea rcx, [0x010fb2d0]
mov rax, rdx
mov byte [rax], 0
add rax, 1
cmp rax, rcx
jne 0x401c91
lea rax, [0x010fb2a8]
xor ecx, ecx
pxor xmm0, xmm0
mov qword [0x010fb2a8], rax
mov qword [0x010fb2b0], rax
lea rax, [0x0107a2a0]
mov r8, rax
add rcx, 1
movaps xmmword [r8], xmm0
add r8, 0x10
cmp rcx, 0x4000
jne 0x401cc2
mov byte [0x010ba2a0], 0
xor ecx, ecx
pxor xmm0, xmm0
add rcx, 1
movaps xmmword [rax + 0x40040], xmm0
add rax, 0x10
cmp rcx, 0xd8
jne 0x401ce4
lea rax, [0x010bb060]
mov byte [rax], 0
add rax, 1
cmp rax, rdx
jne 0x401d03
mov rax, qword [0x00842258]
test rax, rax
jne 0x401d31
lea rcx, [rsp + 0x20]
call qword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x24]
mov qword [0x00842258], rax
mov qword [0x010bb060], rax
lea rax, [0x010bb070]
mov qword [0x010bb068], rax
mov byte [0x0107a261], 1
mov byte [0x0107a260], 0
add rsp, 0x58
ret
Function at 0x4086b0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x58
mov rsi, qword [rsp + 0x90]
cmp rcx, 0xffffffffffffffff
mov rbx, r9
je 0x408765
lea rax, [rsp + 0x40]
test rsi, rsi
cmove rsi, rax
test r9, r9
lea rax, [rsp + 0x48]
mov dword [rsi], 0
cmove rbx, rax
lea rax, [rcx - 1]
mov qword [rbx], 0
cmp rax, 1
ja 0x408729
cmp rcx, 1
mov qword [rsp + 0x38], r8
sete cl
mov qword [rsp + 0x30], rdx
movzx ecx, cl
sub ecx, 0xc
call qword [sym.imp.kernel32.dll_GetStdHandle]
mov rdx, qword [rsp + 0x30]
test rax, rax
mov rcx, rax
mov r8, qword [rsp + 0x38]
je 0x408790
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
call qword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
je 0x408754
mov eax, dword [rsp + 0x44]
mov qword [rbx], rax
mov eax, 1
add rsp, 0x58
pop rbx
pop rsi
ret
call qword [sym.imp.kernel32.dll_GetLastError]
mov dword [rsi], eax
xor eax, eax
add rsp, 0x58
pop rbx
pop rsi
ret
lea r8, str.__fd_____fd_t__1_______0_
xor r9d, r9d
mov edx, 0x2586
mov qword [rsp + 0x20], 0
lea rcx, str.gotsan.cpp
call fcn.00406990
nop dword [rax]
mov dword [rsi], 6
xor eax, eax
jmp 0x40874d

Function at 0x40b400
Capabilities:
Print debug messages

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x40
mov eax, 1
mov rsi, qword [rcx]
mov rbx, rcx
mov rdi, rdx
xchg byte [rsi], al
test al, al
je 0x40b42d
mov rcx, rsi
mov qword [rsp + 0x38], r8
call fcn.00438d60
mov r8, qword [rsp + 0x38]
mov rax, qword [rbx]
movzx r9d, byte [rax]
cmp r9, 1
jne 0x40b490
mov rcx, qword [rbx + 8]
lea rax, [rcx - 1]
cmp rax, 1
jbe 0x40b45e
mov rcx, rbx
mov qword [rsp + 0x38], r8
call fcn.0040bf30
mov rcx, qword [rbx + 8]
mov r8, qword [rsp + 0x38]
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov rdx, rdi
call fcn.004086b0
test al, al
jne 0x40b47f
mov rcx, rdi
call qword [sym.imp.kernel32.dll_OutputDebugStringA]
mov byte [rsi], 0
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
mov qword [rsp + 0x20], 1
lea r8, str.__atomic_load_state___memory_order_relaxed_______1__
mov edx, 0x2b
lea rcx, str....._sanitizer_common_sanitizer_mutex.h
call fcn.00406990
nop
nop word cs:[rax + rax]
Function at 0x40d6b0
Capabilities:
Get system information on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x60
mov rax, qword [0x007dcee0]
mov rsi, rcx
lea rcx, [rax - 1]
test rax, rcx
jne 0x40d784
lea rbx, [rdx + rcx]
neg rax
mov rdx, qword [rsi]
and rbx, rax
mov rax, qword [rsi + 8]
sub rdx, rax
cmp rdx, rbx
jge 0x40d74b
mov rax, qword [0x00842258]
test rax, rax
je 0x40d790
lea rdi, [rax - 1]
test rdi, rax
jne 0x40d784
lea rdx, str.Allocate
neg rax
add rdi, rbx
and rdi, rax
mov rcx, rdi
call fcn.0040d590
mov r8, qword [0x0106ca30]
lea rdx, [rax + rdi]
mov qword [rsi + 8], rax
mov qword [rsi], rdx
test r8, r8
je 0x40d743
mov rdx, rdi
mov rcx, rax
call r8
mov rdx, qword [rsi]
mov rax, qword [rsi + 8]
sub rdx, rax
cmp rbx, rdx
jg 0x40d760
add rbx, rax
mov qword [rsi + 8], rbx
add rsp, 0x60
pop rbx
pop rsi
pop rdi
ret
lea r8, str.__allocated_end____allocated_current_____sptr_size______0_
xor r9d, r9d
mov edx, 0x1b33
mov qword [rsp + 0x20], 0
lea rcx, str.gotsan.cpp
call fcn.00406990
call fcn.0040b4c0
nop dword [rax]
lea rcx, [rsp + 0x30]
call qword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x34]
mov qword [0x00842258], rax
jmp 0x40d6f7
Function at 0x40e930
Capabilities:
Get system information on windows
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
mov rbx, qword [0x00842258]
mov r12, qword [rsp + 0xf0]
test rbx, rbx
mov qword [rsp + 0xd0], rcx
mov rbp, rdx
mov rsi, r9
mov qword [rsp + 0xe0], r8
je 0x40eb30
mov r13, qword [sym.imp.kernel32.dll_ReadFile]
lea r14, [rsp + 0x50]
cmp r12, rbx
cmovbe rbx, r12
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rbp]
mov rdx, qword [rax]
call fcn.0040e7f0
xor ecx, ecx
mov r9d, 4
mov rdx, rbx
mov r8d, 0x3000
call qword [sym.imp.kernel32.dll_VirtualAlloc]
test rax, rax
je 0x40ebb7
mov qword [rbp], rax
mov rax, qword [rsp + 0xe0]
xor r9d, r9d
mov r8d, 7
mov edx, 0x80000000
mov rcx, qword [rsp + 0xd0]
mov qword [rax], rbx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [sym.imp.kernel32.dll_CreateFileA]
cmp rax, 1
mov rdi, rax
je 0x40eb50
cmp rax, 2
je 0x40eb74
cmp qword [rsp + 0xf8], 0
setne r15b
cmp rax, 0xffffffffffffffff
sete al
test al, r15b
jne 0x40eae1
cmp rdi, 0xffffffffffffffff
je 0x40eaf1
mov qword [rsi], 0
xor ecx, ecx
jmp 0x40ea6b
test eax, eax
mov r8d, dword [rsp + 0x50]
je 0x40eaac
mov rcx, r8
add rcx, qword [rsi]
cmp r12, rcx
mov qword [rsi], rcx
sete dl
test r8, r8
sete al
or al, dl
jne 0x40eba0
cmp rbx, rcx
jbe 0x40eb10
mov r8d, ebx
mov rdx, rcx
mov r9, r14
add rdx, qword [rbp]
mov qword [rsp + 0x20], 0
sub r8d, ecx
mov rcx, rdi
call r13
test eax, eax
jne 0x40ea45
test r15b, r15b
je 0x40ea45
call qword [sym.imp.kernel32.dll_GetLastError]
mov rsi, qword [rsp + 0xf8]
mov dword [rsi], eax
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rbp]
mov rdx, qword [rax]
call fcn.0040e7f0
mov rcx, rdi
call qword [sym.imp.kernel32.dll_CloseHandle]
xor edx, edx
mov eax, edx
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call qword [sym.imp.kernel32.dll_GetLastError]
mov rdi, qword [rsp + 0xf8]
mov dword [rdi], eax
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rbp]
mov rdx, qword [rax]
call fcn.0040e7f0
xor edx, edx
jmp 0x40eacb
add rbx, rbx
mov rcx, rdi
call qword [sym.imp.kernel32.dll_CloseHandle]
cmp r12, rbx
cmovbe rbx, r12
jmp 0x40e984
lea rcx, [rsp + 0x50]
call qword [sym.imp.kernel32.dll_GetSystemInfo]
mov ebx, dword [rsp + 0x54]
mov qword [0x00842258], rbx
jmp 0x40e971
lea r8, str.__res_____fd_t_1_____fd_t_1_____fd_t__1_______0_
xor r9d, r9d
mov edx, 0x2564
mov qword [rsp + 0x20], 0
lea rcx, str.gotsan.cpp
call fcn.00406990
lea r8, str.__res_____fd_t_2_____fd_t_2_____fd_t__1_______0_
xor r9d, r9d
mov edx, 0x2565
mov qword [rsp + 0x20], 0
lea rcx, str.gotsan.cpp
call fcn.00406990
nop dword [rax + rax]
mov byte [rsp + 0x4f], al
mov rcx, rdi
call qword [sym.imp.kernel32.dll_CloseHandle]
movzx edx, byte [rsp + 0x4f]
jmp 0x40eacb
call qword [sym.imp.kernel32.dll_GetLastError]
mov dword [rsp + 0x20], 0
lea r8, str.allocate
mov rcx, rbx
lea rdx, str.ReadFileToBuffer
mov r9d, eax
call fcn.0040d4f0
nop
nop
Function at 0x45c560
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45c706
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree_1]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.0047a840
xorps xmm15, xmm15
mov r14, qword [0x0083ba78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x45c5cb
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x45c5e0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
nop
test rbx, rbx
jbe 0x45c605
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x45c619
cmp rbx, 0x1000
jae 0x45c5d5
nop dword [rax]
jmp 0x45c689
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x45c62d
xor edx, edx
jmp 0x45c680
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree_1]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.0047a840
xorps xmm15, xmm15
mov r14, qword [0x0083ba78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop dword [rax]
test dl, dl
jne 0x45c60f
jmp 0x45c5f4
call fcn.004b2fe0
xorps xmm15, xmm15
mov r14, qword [0x0083ba78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.0047f700
lea rax, [0x0067e5dc]
mov ebx, 0x18
call fcn.00480000
mov rax, qword [rsp + 0x38]
call fcn.0047fd00
lea rax, [0x0067e6e4]
mov ebx, 0x19
call fcn.00480000
mov rax, qword [rsp + 0x30]
nop
call fcn.0047fd00
call fcn.0047f960
call fcn.0047f780
lea rax, [0x006817c1]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.0047ddc0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004aec80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.0045c560
Function at 0x45c740
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45c96a
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc_1]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.0047a8c0
xorps xmm15, xmm15
mov r14, qword [0x0083ba78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x45c7b9
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x45c7cc
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x45c7f0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
nop
jmp 0x45c804
cmp rbx, 0x1000
jae 0x45c7c3
jmp 0x45c885
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x45c816
xor esi, esi
jmp 0x45c876
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc_1]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.0047a8c0
xorps xmm15, xmm15
mov r14, qword [0x0083ba78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x45c7fa
nop
jmp 0x45c7e2
call fcn.004b2fe0
xorps xmm15, xmm15
mov r14, qword [0x0083ba78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x45c905
call fcn.0047f700
lea rax, [0x0067eb94]
mov ebx, 0x19
call fcn.00480000
mov rax, qword [rsp + 0x68]
call fcn.0047fd00
lea rax, [0x0067e6e4]
mov ebx, 0x19
call fcn.00480000
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.0047fd00
call fcn.0047f960
call fcn.0047f780
lea rax, [0x0067a769]
mov ebx, 0xd
nop dword [rax + rax]
call fcn.0047ddc0
cmp eax, 0x5af
je 0x45c8a8
call fcn.0047f700
lea rax, [0x0067eb94]
mov ebx, 0x19
nop dword [rax]
call fcn.00480000
mov rax, qword [rsp + 0x38]
call fcn.0047fd00
lea rax, [0x0067e6e4]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00480000
mov eax, dword [rsp + 0x34]
call fcn.0047fd00
call fcn.0047f960
call fcn.0047f780
lea rax, [0x00680c4f]
mov ebx, 0x1f
call fcn.0047ddc0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004aec80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0045c740