joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001400
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x13d0
call fcn.1400042f0
sub rsp, rax
mov rax, qword [0x140008010]
xor rax, rsp
mov qword [rsp + 0x13c0], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor edi, edi
mov dword [rsp + 0x20], edi
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov edx, eax
mov dword [rsp + 0x13b4], 0xffffffff
mov dword [rsp + 0x34], eax
lea ecx, [rdi + 1]
nop dword [rax]
nop word [rax + rax]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [rsp + rcx*4 + 0x34], edx
inc rcx
cmp rcx, 0x270
jb 0x140001460
mov dword [rsp + 0x30], 0x270
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], dil
mov dword [rsp + 0x20], 1
mov edi, 0x19
lea rsi, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
lea rcx, [rsp + 0x30]
call fcn.140003270
mov ecx, eax
imul rax, rcx, 0x3e
cmp eax, 3
ja 0x1400014da
lea rcx, [rsp + 0x30]
call fcn.140003270
mov ecx, eax
imul rax, rcx, 0x3e
cmp eax, 4
jb 0x1400014c5
shr rax, 0x20
movsxd rcx, eax
movzx r9d, byte [rcx + rsi]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x140001512
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x140001507
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14000151a
mov rcx, rbx
call fcn.140002e60
sub rdi, 1
jne 0x1400014b0
mov rax, rbx
mov rcx, qword [rsp + 0x13c0]
xor rcx, rsp
call fcn.140003480
lea r11, [rsp + 0x13d0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140003270
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x1400032d1
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140003290
mov ecx, dword [r9]
jmp 0x1400033b8
cmp ecx, 0x4e0
jb 0x1400033b8
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x1400032f0
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x140003340
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret

Function at 0x140003eb4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140003efe
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140003efe
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003efe
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140003efe
cmp dword [rcx + 0x84], 0xe
jbe 0x140003efe
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140003f00
xor al, al
add rsp, 0x28
ret
Function at 0x14003d16c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push rdi
push rbx
movabs r15, 0x60
mov rdi, qword gs:[r15]
push rcx
mov rcx, qword [rdi + 0x10]
mov ecx, dword [rdi + 0x10]
add rdi, 0x18
mov rbx, qword [rdi]
mov ebx, dword [rdi]

Function at 0x14003d7fc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003d846
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003d846
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003d846
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003d846
cmp dword [rcx + 0x84], 0xe
jbe 0x14003d846
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14003d848
xor al, al
add rsp, 0x28
ret

Function at 0x14004c480
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14004c270
Function at 0x140052438
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140052468
xor eax, eax
jmp 0x14005252b
mov rbp, rbx
cmp word [rax], si
je 0x14005248d
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140052474
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140052470
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140050d6c
movsxd r14, eax
test eax, eax
jne 0x1400524cb
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140052461
mov rcx, r14
call fcn.14004e3cc
mov rdi, rax
test rax, rax
jne 0x1400524e4
xor ecx, ecx
call fcn.14004dd7c
jmp 0x1400524c0
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140050d6c
test eax, eax
jne 0x140052515
mov rcx, rdi
call fcn.14004dd7c
jmp 0x14005251f
xor ecx, ecx
call fcn.14004dd7c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x411230
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x41123d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x41124d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x411235
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x411265
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x411252
sub eax, 3
jb 0x41127f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x4112b6
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x4112a6
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x4112a4
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x411293
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.004111f2
jmp 0x41123d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x6600
mov dl, 2
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x411302
cmp rsi, rcx
jae 0x41130a
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x4112e9
cmp al, 0x8f
ja 0x4112e9
cmp byte [rsi - 2], 0xf
je 0x4112ef
sub al, 0xe8
cmp al, 1
ja 0x4112d3
cmp rsi, rcx
jae 0x41130a
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x4112d9
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x41130a
lodsb al, byte [rsi]
jmp 0x4112e9
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0xf000]
mov eax, dword [rdi]
or eax, eax
je 0x411367
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x11000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x411317
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x411361
mov qword [rbx], rax
add rbx, 8
jmp 0x411337
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x4113bf
sub rsp, 0xffffffffffffff80
jmp 0x401710
Function at 0x1401cd33c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov rax, qword [rsp]
mov r12w, word [rsp]
mov al, 0xa4
mov ax, r12w
push rbx
jmp 0x1401cd2df
mov eax, r14d
mov al, byte [rsp]
push r12
mov r12, qword [rsp]
mov rax, qword [rsp]
bswap eax
jmp 0x1401cd27d
mov word [rsp + 4], sp
mov qword [rsp + 1], rax
dec eax
not rax
cld
mov ax, word [rsp]
jmp 0x1401cd293
shl r12w, cl
sub rsp, 0x1b
add rsp, 0xb
mov word [rsp + 2], bx
mov byte [rsp + 0x15], bpl
mov byte [rsp + 0xb], r10b
mov byte [rsp + 3], r13b
jmp 0x1401cd2ae
jmp 0x1401cd30b

Function at 0x1401cd632
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [rsp + 3]
mov dl, dil
dec bl
mov dword [rsp + 0xc], r11d
add rsp, 0xb
lea rsp, [rsp + 4]
jmp 0x1401cd6e2
jmp 0x1401cd60e
xchg qword [rsp + 9], r12
mov r9, r14
mov cx, 0xde02
xchg rcx, r11
jmp 0x1401cd678
mov ebp, eax
xchg r9w, ax
sub rsp, 0x15
xchg r10b, r13b
mov r13w, bp
xchg byte [rsp + 4], r12b
jmp 0x1401cd634
xchg word [rsp + 8], r9w
mov r10w, dx
rdtsc
mov bl, r9b
jmp 0x1401cd6b0
pop word [rsp + 2]
mov dl, byte [rsp + 3]
xchg dword [rsp + 9], r8d
mov ebx, 0x15336f6e
mov rcx, 0x64dd1125
or r11w, 0x66d5
jmp 0x1401cd662
lea r11, [0xffffffff91fc6653]
mov dword [rsp], r9d
sbb r13b, 0x34
jmp 0x1401cd6c7
inc si
setbe r15b
not rcx
mov byte [rsp + 3], r13b
add rsp, 0xd
rdtsc
jmp 0x1401cd69a
xchg word [rsp + 3], bp
sete r13b
mov r8d, r14d
lea r8, [rdx + rdi]
clc
shr rbx, 4
jmp 0x1401cd73f
xchg r12b, al
mov esi, dword [rsp]
pop cx
mov ebx, r15d
cpuid
mov r10d, 0x9f9a2073
jmp 0x1401cd64a
bsf r13d, r13d
rdtsc
neg cl
xchg r12w, ax
mov edx, dword [rsp]
call fcn.1401cd711
lea r10, [r9 + riz + 0xbec4]
mov rbx, rdx
mov r11d, eax
mov r10d, esp
rcr dl, 2
sub rsp, 0x1b
jmp 0x1401cd886
add rsp, 8
clc
not bpl
mov si, 0xb338
mov rcx, qword [rsp]
rdtsc
jmp 0x1401cd7eb
push sp
lea r11, [rsi + r10]
neg r8
xchg r8d, ecx
mov r13d, dword [rsp + 0xb]
bsr dx, bx
jmp 0x1401cd79d
setb cl
not ebp
mov bp, r10w
sub rsp, 0x11
inc eax
jmp 0x1401cd801
mov r11b, 0x45
cmp ax, 0x5c93
cmc
bswap rbx
mov r13w, 0xb2c
bsr r11d, r8d
jmp 0x1401cd7d2
lea r10, [r11 + riz + 0x69d0cbef]
mov rax, qword [rsp]
call fcn.1401cd84e
xchg esi, eax
add al, 0x9a
std
or al, 0xee
and byte [rcx + 0x58b34021], dh
xor byte [rbx], dh
sub al, byte [rbp - 0xc]
neg r11b
lea rsp, [rsp + 0x18]
mov rcx, r8
mov r12, r9
mov rsi, rsp
xchg edx, esi
jmp 0x1401cd7ba
sub rsp, 0xa
pop r13w
lea rsp, [rsp + 0x12]
dec ebx
xchg r10w, ax
lea r10, [rax + r14]
jmp 0x1401cd823

Function at 0x1401cdd1a
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea rsp, [rsp + 2]
jmp 0x1401cdd6d
push word [rsp + 0xa]
mov r12b, 0x25
not edx
mov r11, rcx
mov r13w, 0xbf55
jmp 0x1401cdd55
add rsp, 1
mov dword [rsp], ebp
mov edx, esp
push rsi
dec dl
not rdx
jmp 0x1401cdd21
Function at 0x1401cdedf
Capabilities:
Execute anti-debugging instructions

Disassembly:
not dl
mov r13d, 0xb93a935f
mov r15, r11
cmc
mov byte [rsp + 4], dl
jmp 0x1401cdef4
bsf rax, rdi
mov qword [rsp], rbx
mov ecx, 0xedd9a843
mov qword [rsp], rcx
cpuid
jmp 0x1401cdec9
xchg dl, al
mov dword [rsp + 7], r11d
mov rcx, 0x785aec2f
cld
xchg r10w, bx
xchg dword [rsp + 7], r15d
jmp 0x1401cdfa1
lea rsp, [rsp + 9]
lea rdx, [r15 + riz + 0x8e8]
pushfq
jmp 0x1401cdf89
xchg byte [rsp + 0xb], r10b
lea rdx, [rax + rax]
mov r8b, byte [rsp + 0xe]
xchg rdx, r8
jmp 0x1401cdf3d
xchg r8, r10
bswap ecx
xchg r10w, bp
mov r9, qword [rsp + 5]
lea r11, [rdx + riz - 0xa0ed]
or r10, 0xffffffffdcc8dbc9
jmp 0x1401cdf53
mov r8b, 0x92
xchg word [rsp], r15w
mov r8d, 0x4bfc654
jmp 0x1401cdfd4
clc
mov dword [rsp + 3], r10d
xchg dword [rsp + 1], ebp
mov r10d, dword [rsp + 2]
xchg word [rsp + 6], r13w
xchg word [rsp + 6], r15w
jmp 0x1401cdf6a
lea rcx, [rax + r10]
mov r11, 0xffffffffb9a2170c
not r9d
jmp 0x1401cebe3
mov dx, word [rsp + 5]
inc dx
xchg word [rsp + 5], bp
add rsp, 2
push r8
mov r9, rsi
jmp 0x1401cdfbe
bswap edx
xchg r8, r12
bswap r11d
cpuid
xchg rsi, rdx
mov ebx, dword [rsp]
jmp 0x1401ce034
pop word [rsp]
mov si, r12w
xchg r13w, r10w
mov bl, byte [rsp]
lea r10, [r10 + r13]
mov r13w, 0x731b
jmp 0x1401cdfec
mov r13d, dword [rsp + 8]
mov dword [rsp + 2], ebx
mov ecx, dword [rsp + 0xf]
bswap r11
jmp 0x1401ce073
mov byte [rsp], bl
mov r8w, word [rsp]
sub rsp, 0xe
push word [rsp + 0xb]
cld
lea r12, [r14 + riz + 0x74e9508c]
jmp 0x1401ce01c
pushfq
xchg dx, bx
bsr r13w, r9w
std
shl rbp, 0x39
bswap rbx
jmp 0x1401ce091
mov r9, 0x56299351
mov cx, word [rsp + 0xd]
pushfq
rcl r8w, cl
mov r8d, 0x8ccc505d
mov dword [rsp + 0xd], r14d
jmp 0x1401ce050
pop rbp
lea rbx, [r13 + r13]
xchg r13b, sil
mov qword [rsp + 0xc], rsp
sub rsp, 0x14
jmp 0x1401ce192
dec dx
mov dword [rsp], r15d
xchg dword [rsp], r10d
pop word [rsp + 1]
mov rsi, 0xfffffffffeb2937c
lea rbp, [rbp + riz - 0x28]
jmp 0x1401ce002
cld
bsf r10, r13
push word [rsp + 5]
mov word [rsp + 3], r11w
lea rsp, [rsp + 2]
setge cl
jmp 0x1401ce0aa
mov si, bp
xchg word [rsp + 0x10], si
mov byte [rsp + 0x21], dl
mov cx, 0xfed7
mov r9d, r12d
xchg r8b, r12b
jmp 0x1401ce136
mov word [rsp + 0x14], r14w
sub rsp, 9
bsf r10w, cx
neg r8d
mov rax, 0xffffffff986eedfd
mov r10w, 0x5e5e
jmp 0x1401ce0f7
pop word [rsp + 6]
lea r9, [rdx + rsi]
setg sil
call fcn.1401ce16e
std
hlt
mov cl, 0x48
push rax
mov byte [rsp + 5], al
lea r12, [rbx*8]
lea rsp, [rsp + 0x11]
xchg byte [rsp + 0x12], r12b
jmp 0x1401ce116
bswap r10
mov r10, 0x2e2d1fff
lea r15, [rbp + riz - 0x25]
mov dword [rsp + 3], r9d
rcr r10, cl
mov r10, qword [rsp + 0x28]
jmp 0x1401ce153
push word [rsp]
mov r8b, 0xdd
pushfq
mov word [rsp + 0xb], bp
mov qword [rsp], rbx
pop r11
jmp 0x1401ce0dd
bsf bp, r11w
rdtsc
xchg r15w, r9w
push word [rsp + 1]
neg r15
btr r11, rdx
jmp 0x1401ce21f
rdtsc
shl sil, cl
pop dx
mov r11w, 0x8e89
mov byte [rsp], r14b
lea r9, [rbx*8]
jmp 0x1401ce502
mov dword [rsp + 1], ebp
mov bpl, r9b
mov rcx, qword [rsp + 7]
lea rsp, [rsp + 0x10]
xchg byte [rsp + 2], cl
mov rbx, 0xffffffffa2095663
jmp 0x1401ce8dc
Function at 0x1401ce16e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov r9w, 0x8fe0
push qword [rsp + 1]
setne cl
jmp 0x1401ce1f2
xchg sil, r10b
and bpl, dl
cld
xchg byte [rsp + 4], sil
jmp 0x1401ce4b9
not r13d
pop word [rsp + 0x37]
mov byte [rsp + 3], r12b
shr r10b, 0
xchg r9d, r10d
mov bp, 0xd12a
jmp 0x1401ce1b0
rdtsc
mov r11d, dword [rsp + 0x33]
push r9w
xchg r12w, r8w
pop r13w
bswap r15
jmp 0x1401ce1c6
pop r15
cmc
xchg byte [rsp + 8], sil
pushfq
mov edx, 0x989be6f0
jmp 0x1401ce28f
lea rcx, [0xffffffffa0733f7c]
rdtsc
mov r8d, dword [rsp + 0x34]
add rsp, 0x12
pop rsi
rdtsc
jmp 0x1401ce237
cld
mov r12b, r14b
mov qword [rsp + 0x12], r10
xchg qword [rsp + 0x1f], rsi
push word [rsp + 0x26]
btr r15, rsp
jmp 0x1401ce335
mov rsi, qword [rsp + 0x1d]
xchg rbx, rbp
push qword [rsp + 0x1c]
lea rsp, [rsp + 6]
cld
sub rsp, 9
jmp 0x1401ce265
btr edx, r14d
lea r9, [rsp + rbx]
sub r10b, r14b
lea r12, [r12 + 0x2c02]
std
push r11
jmp 0x1401ce24d
mov rax, qword [rsp + 0x31]
mov rbx, r10
setg r15b
mov r10w, ax
jmp 0x1401ce309
cpuid
not r9w
mov r13, 0xfffffffff4262f97
mov bp, dx
lea rdx, [rcx*4]
cmc
jmp 0x1401ce2d8
xchg word [rsp], bx
xchg word [rsp + 0x25], ax
pop qword [rsp + 0x19]
mov r11b, byte [rsp + 0x24]
pop rsi
push qword [rsp + 0xc]
jmp 0x1401ce353
xchg qword [rsp + 0x25], r12
mov bx, 0xeb0
xchg r13, rdx
dec r12w
lea r9, [rax + riz - 0xaa]
bsf r13d, r15d
jmp 0x1401ce2ee
lea r15, [rbp*8]
rcl r8w, cl
xor r8, 0x1430a071
bswap r13
mov ecx, r15d
lea rbx, [r15 + riz]
jmp 0x1401ce3ff
xchg word [rsp + 3], r13w
mov r12d, dword [rsp + 0x29]
xchg qword [rsp + 9], r10
push word [rsp + 0x37]
lea r10, [r15 + riz + 0x15]
mov ebx, r8d
jmp 0x1401ce2bd
pop qword [rsp + 0x14]
lea rbp, [r11 + riz + 0x37c2e336]
xchg r8w, ax
mov qword [rsp + 0x16], rdi
mov byte [rsp + 0x12], r10b
call fcn.1401ce3c1
bsf rax, rax
neg r8b
push word [rsp + 2]
bswap rbx
jmp 0x1401ce449
bsf r13w, r10w
lea rdx, [rsi + rbp]
lea r8, [rbp + riz - 0x3cef]
lea rsi, [r12 - 0xa4]
jmp 0x1401ce496
mov byte [rsp + 7], r13b
call fcn.1401ce4eb
mov ch, 0x2b
mov ebx, 0xce8c2dde
pop rcx
mov eax, 0x48edf29b
lea esp, [rsp]
lea rsp, [rsp]
pop word [rsp]
xchg r12d, edx
push r10
mov r10b, 0x8e
bts si, r15w
jmp 0x1401ce480
xchg qword [rsp + 0x30], r8
mov ax, 0xf9fb
bswap r11d
mov r12w, di
mov bpl, spl
pop r9w
jmp 0x1401ce37e
Function at 0x1401d50a1
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov dword [rsp + 6], r9d
mov byte [rsp + 9], spl
mov dword [rsp + 1], r13d
jmp 0x1401d50b5
pop qword [rsp + 5]
pop word [rsp + 9]
pop qword [rsp]
mov qword [rsp], r8
jmp 0x1401d508b
mov dword [rsp + 6], esi
mov word [rsp + 2], di
lea rsp, [rsp + 4]
lea rsp, [rsp + 8]
jmp 0x1401d50ea
Function at 0x418140
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4182e6
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00437aa0
xorps xmm15, xmm15
mov r14, qword [0x005d17a8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x4181ab
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x4181c7
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
call fcn.00452180
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
sub rbx, rcx
test rbx, rbx
jbe 0x4181eb
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x4181ff
cmp rbx, 0x1000
jae 0x4181b5
jmp 0x418269
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x418211
xor edx, edx
jmp 0x418260
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00437aa0
xorps xmm15, xmm15
mov r14, qword [0x005d17a8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x4181f5
jmp 0x4181e0
call fcn.004685a0
xorps xmm15, xmm15
mov r14, qword [0x005d17a8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.0043c260
lea rax, [0x004ec910]
mov ebx, 0x18
call fcn.0043cb60
mov rax, qword [rsp + 0x38]
call fcn.0043c860
lea rax, [0x004ec9d0]
mov ebx, 0x19
call fcn.0043cb60
mov rax, qword [rsp + 0x30]
nop
call fcn.0043c860
call fcn.0043c4c0
call fcn.0043c2e0
lea rax, [0x004eec82]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.0043aa20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004649e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00418140
Function at 0x418320
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41854a
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00437b40
xorps xmm15, xmm15
mov r14, qword [0x005d17a8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x418399
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x4183c0
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rax, rcx
call fcn.00452180
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
sub rbx, rcx
mov rcx, rax
mov rax, qword [rsp + 0x68]
test rbx, rbx
jbe 0x4183e5
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x4183f9
cmp rbx, 0x1000
jae 0x4183a3
nop dword [rax]
jmp 0x418474
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x41840d
xor esi, esi
jmp 0x41846a
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00437b40
xorps xmm15, xmm15
mov r14, qword [0x005d17a8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x4183ef
jmp 0x4183d4
call fcn.004685a0
xorps xmm15, xmm15
mov r14, qword [0x005d17a8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x4184ec
call fcn.0043c260
lea rax, [0x004ecdb8]
mov ebx, 0x19
call fcn.0043cb60
mov rax, qword [rsp + 0x68]
call fcn.0043c860
lea rax, [0x004ec9d0]
mov ebx, 0x19
call fcn.0043cb60
mov eax, dword [rsp + 0x34]
call fcn.0043c860
call fcn.0043c4c0
call fcn.0043c2e0
lea rax, [0x004e9960]
mov ebx, 0xd
call fcn.0043aa20
cmp eax, 0x5af
je 0x418497
call fcn.0043c260
lea rax, [0x004ecdb8]
mov ebx, 0x19
call fcn.0043cb60
mov rax, qword [rsp + 0x38]
call fcn.0043c860
lea rax, [0x004ec9d0]
mov ebx, 0x19
nop
call fcn.0043cb60
mov eax, dword [rsp + 0x34]
call fcn.0043c860
call fcn.0043c4c0
call fcn.0043c2e0
lea rax, [0x004ee596]
mov ebx, 0x1f
call fcn.0043aa20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004649e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00418320