joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402af480
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.1400f84e1
sub rsp, rax
mov rax, qword [0x140a3b940]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x140a409f0]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x1402af695
lea rax, [rsp + 0x147e]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x38], rax
jae 0x1402af5d9
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x1402af5d9
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
mov word [rsp + 0x40], ax
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x30]
cmp eax, 0xa
jne 0x1402af5b9
mov eax, dword [rsp + 0x78]
add eax, 2
mov dword [rsp + 0x78], eax
mov eax, 0xd
mov rcx, qword [rsp + 0x38]
mov word [rcx], ax
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, word [rsp + 0x30]
mov word [rax], cx
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
jmp 0x1402af548
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov eax, eax
shl rax, 1
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x48]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1402af655
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1402af6b4
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x48]
cmp dword [rsp + 0x44], eax
jae 0x1402af690
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1402af6b4
jmp 0x1402af51e
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.1400fa791
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x1402b3dd0
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov edx, 8
lea rcx, [rsp + 0x60]
call fcn.1400f91ed
movzx eax, al
test eax, eax
je 0x1402b3df7
mov al, 1
jmp 0x1402b3eec
lea rcx, [rsp + 0x60]
call fcn.1400fe88c
movzx eax, al
test eax, eax
je 0x1402b3e36
lea rcx, [rsp + 0x60]
call fcn.1400fd086
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x60]
call fcn.1400fd086
mov rax, qword [rax + 8]
mov rcx, qword [rsp + 0x40]
cmp qword [rcx], rax
jne 0x1402b3e36
xor al, al
jmp 0x1402b3eec
lea rcx, [rsp + 0x60]
call fcn.1400fd315
mov ecx, eax
call fcn.1400fe7ba
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0xffffffffffffffff
jne 0x1402b3e5b
xor al, al
jmp 0x1402b3eec
lea rax, [rsp + 0x38]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
lea rax, [rsp + 0x48]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
mov r9d, 1
lea r8, [rsp + 0x38]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x1402b3ea0
xor al, al
jmp 0x1402b3eec
lea rax, [rsp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x1402b3ec9
xor al, al
jmp 0x1402b3eec
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
jne 0x1402b3edf
mov dword [rsp + 0x20], 1
jmp 0x1402b3ee7
mov dword [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
add rsp, 0x50
pop rdi
ret
Function at 0x1402d24a0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov dword [rsp + 0x20], 0
cmp qword [rsp + 0x40], 0
je 0x1402d24df
mov rax, qword [rsp + 0x40]
movzx eax, word [rax]
test eax, eax
je 0x1402d24df
lea rdx, [0x140339ab0]
mov rcx, qword [rsp + 0x40]
call fcn.1400fa84a
test eax, eax
jne 0x1402d2516
mov r9d, 2
lea r8, [rsp + 0x20]
mov edx, 0x20001004
mov rax, qword [rsp + 0x48]
mov ecx, dword [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x1402d2505
xor eax, eax
jmp 0x1402d2565
cmp dword [rsp + 0x20], 0
jne 0x1402d2514
call qword [sym.imp.KERNEL32.dll_GetACP]
jmp 0x1402d2565
jmp 0x1402d2561
lea rdx, [0x140339ad0]
mov rcx, qword [rsp + 0x40]
call fcn.1400fa84a
test eax, eax
jne 0x1402d2553
mov r9d, 2
lea r8, [rsp + 0x20]
mov edx, 0x2000000b
mov rax, qword [rsp + 0x48]
mov ecx, dword [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x1402d2551
xor eax, eax
jmp 0x1402d2565
jmp 0x1402d2561
mov rcx, qword [rsp + 0x40]
call fcn.1400f7136
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret

Function at 0x1402d2620
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x48
mov dword [rsp + 0x20], 0
movzx eax, word [rsp + 0x50]
and eax, 0x3ff
movzx eax, ax
bts eax, 0xa
movzx eax, ax
mov dword [rsp + 0x24], eax
call fcn.1400f88f1
add rax, 0x98
mov qword [rsp + 0x30], rax
mov r9d, 2
lea r8, [rsp + 0x20]
mov edx, 0x20000001
mov ecx, dword [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x1402d2683
xor eax, eax
jmp 0x1402d26c3
mov eax, dword [rsp + 0x20]
cmp dword [rsp + 0x50], eax
je 0x1402d26be
cmp dword [rsp + 0x58], 0
je 0x1402d26be
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call fcn.1402d1bf0
mov dword [rsp + 0x28], eax
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx]
call fcn.1400f7744
mov ecx, dword [rsp + 0x28]
cmp ecx, eax
jne 0x1402d26be
xor eax, eax
jmp 0x1402d26c3
mov eax, 1
add rsp, 0x48
ret
Function at 0x140001000
Capabilities:
Terminate process

Disassembly:
test ecx, ecx
jne 0x140001071
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
sub rsp, 0x848
mov rax, qword [0x1400143c8]
xor rax, rsp
mov qword [rsp + 0x830], rax
mov r9, rdx
mov edx, 0x400
lea rax, [r11 + 0x18]
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.140003b24
call fcn.140002598
lea r8, [rsp + 0x30]
lea rcx, [rax + 0x60]
lea rdx, [0x140011d40]
call fcn.140002174
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
ret

Function at 0x140001004
Capabilities:
Terminate process

Disassembly:
test ecx, ecx
jne 0x140001071
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
sub rsp, 0x848
mov rax, qword [0x1400143c8]
xor rax, rsp
mov qword [rsp + 0x830], rax
mov r9, rdx
mov edx, 0x400
lea rax, [r11 + 0x18]
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.140003b24
call fcn.140002598
lea r8, [rsp + 0x30]
lea rcx, [rax + 0x60]
lea rdx, [0x140011d40]
call fcn.140002174
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
ret

Function at 0x140001074
Capabilities:
Terminate process

Disassembly:
test ecx, ecx
jne 0x1400010e5
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
sub rsp, 0x448
mov rax, qword [0x1400143c8]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov r9, rdx
mov edx, 0x400
lea rax, [r11 + 0x18]
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.140007b7c
call fcn.140002598
lea r8, [rsp + 0x30]
lea rcx, [rax + 0x60]
lea rdx, str.Fatal_error_in_launcher:__s_n
call fcn.140002d2c
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
ret

Function at 0x140001078
Capabilities:
Terminate process

Disassembly:
test ecx, ecx
jne 0x1400010e5
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
sub rsp, 0x448
mov rax, qword [0x1400143c8]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov r9, rdx
mov edx, 0x400
lea rax, [r11 + 0x18]
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.140007b7c
call fcn.140002598
lea r8, [rsp + 0x30]
lea rcx, [rax + 0x60]
lea rdx, str.Fatal_error_in_launcher:__s_n
call fcn.140002d2c
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
ret
Function at 0x140001150
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov r13, rcx
lea r8, [0x140011da0]
lea rdx, [0x1400164b0]
lea rcx, [rbp + 0x38]
xor r12d, r12d
mov qword [rbp + 0x38], r12
call fcn.140002100
mov ecx, r12d
test eax, eax
lea rdx, str.Failed_to_open_executable
sete cl
call fcn.140001074
mov rcx, qword [rbp + 0x38]
lea r8d, [r12 + 2]
xor edx, edx
call fcn.140003bf8
mov rcx, qword [rbp + 0x38]
call fcn.1400033b8
mov rcx, qword [rbp + 0x38]
movsxd r14, eax
lea edi, [r14 - 0x104]
test edi, edi
cmovs edi, r12d
xor r8d, r8d
mov edx, edi
call fcn.140003bf8
mov r9, qword [rbp + 0x38]
lea r15d, [r12 + 1]
mov esi, 0x104
mov edx, r15d
mov rcx, r13
mov r8d, esi
call fcn.140002d0c
mov rcx, r13
mov rdx, rax
call fcn.1400010e8
mov rbx, rax
test rax, rax
je 0x140001229
lea rcx, [rbp - 0x20]
lea r8d, [r12 + 0x14]
mov rdx, rax
call fcn.14000c440
movsxd rdi, edi
sub rdi, r13
add rdi, rbx
jmp 0x1400012b0
mov ebx, 0x4100000
mov ecx, ebx
call fcn.1400024e0
mov rcx, qword [rbp + 0x38]
lea edi, [r14 - 0x4100000]
test edi, edi
mov rsi, rax
cmovs edi, r12d
xor r8d, r8d
mov edx, edi
call fcn.140003bf8
mov r9, qword [rbp + 0x38]
mov r8d, ebx
mov rdx, r15
mov rcx, rsi
call fcn.140002d0c
mov rcx, rsi
mov rdx, rax
call fcn.1400010e8
mov ecx, r12d
lea rdx, str.Unable_to_find_an_appended_archive.
test rax, rax
mov rbx, rax
setne cl
call fcn.140001074
lea rcx, [rbp - 0x20]
mov rdx, rbx
mov r8d, 0x14
call fcn.14000c440
movsxd rdi, edi
mov rcx, rsi
sub rdi, rsi
add rdi, rbx
call fcn.140002208
mov esi, 0x104
mov eax, dword [rbp - 0x10]
mov rcx, qword [rbp + 0x38]
xor r8d, r8d
add eax, dword [rbp - 0x14]
sub rdi, rax
mov edx, edi
call fcn.140003bf8
mov r9, qword [rbp + 0x38]
mov r8, rsi
mov rdx, r15
mov rcx, r13
call fcn.140002d0c
mov ecx, r12d
lea rdx, str.Unable_to_read_from_file
test rax, rax
setne cl
call fcn.140001074
movzx eax, word [r13]
cmp ax, word [0x140011e0c]
jne 0x140001301
mov r12, r13
jmp 0x140001367
mov rcx, qword [rbp + 0x38]
lea edx, [rdi - 0x104]
test edx, edx
cmovs edx, r12d
xor r8d, r8d
call fcn.140003bf8
mov r9, qword [rbp + 0x38]
mov r8, rsi
mov rdx, r15
mov rcx, r13
call fcn.140002d0c
mov ecx, r12d
lea rdx, str.Unable_to_read_from_file
test rax, rax
mov rbx, rax
setne cl
call fcn.140001074
lea r11, [rbx + r13 - 1]
cmp r11, r13
jb 0x140001367
movzx eax, word [0x140011e0c]
cmp word [r11], ax
je 0x140001364
sub r11, r15
cmp r11, r13
jae 0x140001354
jmp 0x140001367
mov r12, r11
mov rcx, qword [rbp + 0x38]
call fcn.140003f1c
lea r11, [rsp + 0x40]
mov rax, r12
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140004337
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1400143c8]
jne 0x14000201a
rol rcx, 0x10
test cx, 0xffff
jne 0x140002016
repz ret
ror rcx, 0x10
jmp 0x140004290
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140015490]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x140015588]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140004315
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140015490]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140004337
mov rax, qword [rsp + 0x88]
mov qword [0x140015588], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140015528], rax
mov rax, qword [0x140015588]
mov qword [0x140015400], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140015510], rax
mov dword [0x1400153f0], 0xc0000409
mov dword [0x1400153f4], 1
mov rax, qword [0x1400143c8]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1400143d0]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140015488], eax
mov ecx, 1
call fcn.140009588
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140010350]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140015488], 0
jne 0x1400043be
mov ecx, 1
call fcn.140009588
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x14000d3c8
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x1400143c8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.1400064b8
xor ebx, ebx
cmp qword [0x1400163d0], rbx
mov rdi, rax
jne 0x14000d4db
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x14000d5b2
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000d5b2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x1400163d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x1400163d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x1400163e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x1400163f0], rax
test rax, rax
je 0x14000d4d2
lea rdx, [0x140011c40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x1400163e8], rax
jmp 0x14000d4e2
mov rax, qword [0x1400163e8]
jmp 0x14000d4e9
mov rax, qword [0x1400163e8]
mov r11, qword [0x1400163f0]
cmp rax, rdi
je 0x14000d550
cmp r11, rdi
je 0x14000d550
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x1400163f0]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x14000d550
test rax, rax
je 0x14000d550
call rsi
test rax, rax
je 0x14000d54a
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14000d54a
test byte [rsp + 0x40], 1
jne 0x14000d550
bts ebp, 0x15
jmp 0x14000d590
mov rcx, qword [0x1400163d8]
cmp rcx, rdi
je 0x14000d590
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14000d590
call rax
mov rbx, rax
test rax, rax
je 0x14000d590
mov rcx, qword [0x1400163e0]
cmp rcx, rdi
je 0x14000d590
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14000d590
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1400163d0]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14000d5b2
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x14000d5b4
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140002000
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x414a00
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x414b8b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.004303c0
xorps xmm15, xmm15
mov r14, qword [0x005db3f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x414a65
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x414a74
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x414a93
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x414aa3
cmp rbx, 0x1000
jae 0x414a6b
jmp 0x414b0d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x414ab5
xor edx, edx
jmp 0x414b04
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.004303c0
xorps xmm15, xmm15
mov r14, qword [0x005db3f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x414a99
jmp 0x414a88
call fcn.00460120
xorps xmm15, xmm15
mov r14, qword [0x005db3f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00433d60
lea rax, [0x004a69a8]
mov ebx, 0x18
nop dword [rax]
call fcn.004345a0
mov rax, qword [rsp + 0x38]
call fcn.00434300
lea rax, [0x004a6cb0]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.004345a0
mov rax, qword [rsp + 0x30]
call fcn.00434300
call fcn.00433f80
call fcn.00433dc0
lea rax, [0x004a87f1]
mov ebx, 0x21
call fcn.00432320
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045cb40
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00414a00
Function at 0x414bc0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x414de6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00430440
xorps xmm15, xmm15
mov r14, qword [0x005db3f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x414c33
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x414c42
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x414c65
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x414c75
cmp rbx, 0x1000
jae 0x414c39
nop
jmp 0x414cf8
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x414c8d
xor esi, esi
jmp 0x414cea
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00430440
xorps xmm15, xmm15
mov r14, qword [0x005db3f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x414c6b
jmp 0x414c56
call fcn.00460120
xorps xmm15, xmm15
mov r14, qword [0x005db3f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x414d80
nop dword [rax + rax]
call fcn.00433d60
lea rax, [0x004a6cc9]
mov ebx, 0x19
call fcn.004345a0
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.00434300
lea rax, [0x004a6cb0]
mov ebx, 0x19
call fcn.004345a0
mov eax, dword [rsp + 0x34]
call fcn.00434300
nop
call fcn.00433f80
call fcn.00433dc0
lea rax, [0x004a42b8]
mov ebx, 0xd
call fcn.00432320
nop dword [rax + rax]
cmp eax, 0x5af
je 0x414d20
call fcn.00433d60
lea rax, [0x004a6cc9]
mov ebx, 0x19
call fcn.004345a0
mov rax, qword [rsp + 0x38]
call fcn.00434300
lea rax, [0x004a6cb0]
mov ebx, 0x19
call fcn.004345a0
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.00434300
call fcn.00433f80
call fcn.00433dc0
lea rax, [0x004a8151]
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.00432320
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045cb40
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00414bc0
Function at 0x41f620
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41f726
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov byte [rsp + 0x70], dil
mov qword [rsp + 0x10], 0
jmp 0x41f663
mov rax, qword [rsp + 0x58]
mov rcx, rdx
mov rbx, qword [rsp + 0x60]
movzx edi, byte [rsp + 0x70]
cmp qword [rsp + 0x10], rbx
jae 0x41f71b
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call fcn.00420380
test rax, rax
je 0x41f71b
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x0041f760]
mov qword [rsp + 0x18], rcx
lea rdx, [rsp + 0x10]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x18]
mov qword [rsp], rbx
nop dword [rax]
call fcn.0045ca20
xorps xmm15, xmm15
mov r14, qword [0x005db3f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x68]
nop dword [rax]
test rdx, rdx
jne 0x41f709
xor eax, eax
jmp 0x41f713
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x68]
test al, al
je 0x41f651
mov rax, qword [rsp + 0x10]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.0045cb40
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.0041f620
Function at 0x430640
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 8
mov qword [rsp + 0x60], 0
mov rcx, qword [0x005db3f0]
mov rcx, qword gs:[rcx]
mov rcx, qword [rcx]
mov rcx, qword [rcx + 0x30]
mov qword [rcx + 0x3c0], 8
lea rdx, [rsp + 0x20]
mov qword [rcx + 0x3c8], rdx
mov rax, qword [rsp + 0x18]
xorps xmm15, xmm15
mov r14, qword [0x005db3f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
call fcn.004301e0
mov qword [rsp + 0x60], rax
add rsp, 8
pop rbp
ret