joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ffe04621e80
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
mov ecx, dword [0x7ffe0466e0ac]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
nop dword [rax + rax]
test rax, rax
jne 0x7ffe04621ea8
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x7ffe04621e9f
cmp dword [0x7ffe0466eeac], 0
mov byte [rcx + 0x28], 1
jne 0x7ffe046244b0
mov eax, 1
add rsp, 0x20
pop rbx
ret
cmp dword [0x7ffe0466eea8], 0
je 0x7ffe04621ec2
test qword [0x7ffe0466eea0], 0x200000
je 0x7ffe04621ec2
mov r8d, ebx
lea rdx, str.Marking_thread_data_entry_for_thread_0x_0lx_as_deleted_n
mov ecx, 0x200000
call fcn.7ffe04636b9c
nop
jmp 0x7ffe04621ec2
Function at 0x7ffe04622f6c
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x7ffe0466e6b0], eax
call fcn.7ffe04622d6c
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x7ffe0466e6b0], 0
jne 0x7ffe04622faf
mov ecx, 1
call fcn.7ffe04622d6c
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]

Function at 0x7ffe0462385c
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, 1
mov rbx, r8
cmp edx, edi
jne 0x7ffe04623892
mov eax, dword [0x7ffe0466e880]
test rbx, rbx
mov qword [sym.WLDAP32.dll_Ordinal_15], rcx
cmove eax, edi
mov dword [0x7ffe0466e880], eax
call fcn.7ffe04621040
jmp 0x7ffe0462390a
test edx, edx
jne 0x7ffe046238b8
cmp dword [0x7ffe0466ee98], edx
je 0x7ffe046238a3
call sub.api_ms_win_core_debug_l1_1_0.dll_DebugBreak
test rbx, rbx
jne 0x7ffe046238b1
xor ecx, ecx
call fcn.7ffe04621f90
jmp 0x7ffe0462390a
call fcn.7ffe04621008
jmp 0x7ffe04623908
cmp edx, 3
jne 0x7ffe04623908
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
nop dword [rax + rax]
mov ecx, eax
call fcn.7ffe04621e80
mov ecx, dword [0x7ffe0466e0ac]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
nop dword [rax + rax]
test rax, rax
je 0x7ffe046238f4
mov edx, 0x6c546864
mov rcx, rax
call fcn.7ffe04621ee0
mov ecx, dword [0x7ffe0466e0ac]
xor edx, edx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
nop dword [rax + rax]
mov eax, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x7ffe0462fdfc
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
test rcx, rcx
je 0x7ffe0462ff4e
test rdx, rdx
je 0x7ffe0462ff4e
mov qword [rcx], r15
lea rcx, [rsp + 0x68]
mov qword [rdx], r15
call qword [sym.imp.ntdll.dll_RtlGetNtProductType]
nop dword [rax + rax]
test al, al
je 0x7ffe0462ff4e
cmp dword [rsp + 0x68], 2
jne 0x7ffe0462ff25
cmp word [str.localhost], r15w
lea rax, str.localhost
mov ebx, r15d
lea ecx, [r15 + 1]
je 0x7ffe0462fe75
lea rax, [rax + 2]
inc ecx
cmp word [rax], r15w
jne 0x7ffe0462fe69
mov ebp, ecx
mov eax, 0xffffffff
add rbp, rbp
cmp rbp, rax
ja 0x7ffe0462feac
mov edx, 0x7473484c
mov ecx, ebp
call fcn.7ffe0465ad90
mov rdi, rax
test rax, rax
je 0x7ffe0462feac
mov r8, rbp
lea rdx, str.localhost
mov rcx, rax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
jmp 0x7ffe0462feaf
mov rdi, r15
mov qword [rsi], rdi
test rdi, rdi
jne 0x7ffe0462febe
mov ebx, 0x5a
jmp 0x7ffe0462ff2a
lea r8, [rsp + 0x60]
mov dword [rsp + 0x60], r15d
lea rdx, [rsp + 0x50]
mov word [rsp + 0x50], r15w
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetComputerNameExW]
nop dword [rax + rax]
mov ecx, dword [rsp + 0x60]
test ecx, ecx
jne 0x7ffe0462fef0
mov ebx, 0x52
jmp 0x7ffe0462ff2a
lea ecx, [rcx*2 + 2]
mov edx, 0x7473484c
call fcn.7ffe0465ad90
mov qword [r14], rax
test rax, rax
je 0x7ffe0462feb7
lea r8, [rsp + 0x60]
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetComputerNameExW]
nop dword [rax + rax]
test eax, eax
jne 0x7ffe0462ff4a
jmp 0x7ffe0462fee9
mov ebx, 0x34
mov rcx, qword [r14]
mov edx, 0x7473484c
call fcn.7ffe04621ee0
mov rcx, qword [rsi]
mov edx, 0x7473484c
call fcn.7ffe04621ee0
mov qword [r14], r15
mov qword [rsi], r15
mov eax, ebx
jmp 0x7ffe0462ff53
mov eax, 0x52
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x7ffe0463394c
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, ecx
mov ecx, dword [0x7ffe0466e0ac]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
nop dword [rax + rax]
mov rdi, rax
mov ebx, 0x6c546864
test rax, rax
jne 0x7ffe046339a7
mov edx, ebx
lea ecx, [rax + 0x10]
call fcn.7ffe0465ad90
mov rdi, rax
test rax, rax
je 0x7ffe04633acc
mov ecx, dword [0x7ffe0466e0ac]
mov rdx, rax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
nop dword [rax + rax]
mov edx, ebx
mov ecx, 0x30
call fcn.7ffe0465ad90
mov rbx, rax
test rax, rax
je 0x7ffe04633a9b
and qword [rax + 0x18], 0
lea rcx, [0x7ffe0466ed80]
and qword [rax + 0x20], 0
mov dword [rax + 0x10], esi
mov byte [rax + 0x28], 0
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
call fcn.7ffe04633864
test eax, eax
je 0x7ffe04633a29
call fcn.7ffe04634408
lea rcx, [rsp + 0x38]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemTimeAsFileTime]
nop dword [rax + rax]
mov eax, dword [rsp + 0x38]
mov edx, dword [rsp + 0x3c]
shl rdx, 0x20
or rdx, rax
movabs rax, 0x346dc5d63886594b
mul rdx
shr rdx, 0xb
mov qword [0x7ffe0466e8a0], rdx
mov rax, qword [0x7ffe0466e828]
lea rcx, [0x7ffe0466e828]
mov qword [rbx + 8], rcx
lea rcx, [0x7ffe0466ed80]
mov qword [rbx], rax
mov qword [rax + 8], rbx
mov qword [0x7ffe0466e828], rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
cmp dword [0x7ffe0466eeac], 0
mov qword [rdi + 8], rbx
je 0x7ffe04633a91
cmp dword [0x7ffe0466eea8], 0
je 0x7ffe04633a91
mov eax, 0x200000
test qword [0x7ffe0466eea0], rax
je 0x7ffe04633a91
mov r8d, esi
lea rdx, str.Added_thread_data_entry_for_thread_0x_0lx_n
mov ecx, eax
call fcn.7ffe04636b9c
mov eax, 1
jmp 0x7ffe04633b3a
cmp dword [0x7ffe0466eeac], 0
je 0x7ffe04633acc
cmp dword [0x7ffe0466eea8], 0
je 0x7ffe04633acc
mov eax, 0x4000
test qword [0x7ffe0466eea0], rax
je 0x7ffe04633acc
mov r8d, esi
lea rdx, str.Failed_to_allocate_thread_data_entry_for_thread_0x_0lx_n
mov ecx, eax
call fcn.7ffe04636b9c
lea rcx, [0x7ffe0466ed80]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
call fcn.7ffe04633864
test eax, eax
je 0x7ffe04633b25
call fcn.7ffe04634408
lea rcx, [rsp + 0x38]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemTimeAsFileTime]
nop dword [rax + rax]
mov eax, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x3c]
shl rcx, 0x20
or rcx, rax
movabs rax, 0x346dc5d63886594b
mul rcx
shr rdx, 0xb
mov qword [0x7ffe0466e8a0], rdx
lea rcx, [0x7ffe0466ed80]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x7ffe04633b54
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x7ffe0466e0ac]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
nop dword [rax + rax]
test rax, rax
je 0x7ffe04633b73
mov rax, qword [rax + 8]
add rsp, 0x28
ret
Function at 0x7ffe046373d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x40
and dword [rbp + 0x10], 0
lea rax, [rbp + 0x20]
and dword [rbp + 0x18], 0
lea rdx, str.SYSTEMCurrentControlSetServicesldapTracinglsass.exe
and qword [rbp + 0x20], 0
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x7ffe046374ac
and qword [rsp + 0x28], 0
lea r9, [rbp + 0x10]
mov rcx, qword [rbp + 0x20]
lea rdx, [0x7ffe046621f8]
and qword [rsp + 0x20], 0
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x7ffe046374a5
cmp dword [rbp + 0x10], 4
jne 0x7ffe046374ac
mov rcx, qword [rbp + 0x20]
lea rax, [rbp + 0x10]
mov qword [rsp + 0x30], rax
lea r8, [0x7ffe046621f8]
lea rax, [rbp + 0x18]
mov dword [rbp + 0x10], 4
mov qword [rsp + 0x28], rax
mov r9d, 0x10
and qword [rsp + 0x20], 0
xor edx, edx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
jne 0x7ffe046374ac
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcessId]
nop dword [rax + rax]
cmp dword [rbp + 0x18], eax
jne 0x7ffe046374ac
mov eax, 1
jmp 0x7ffe046374ae
xor eax, eax
mov rcx, qword [rbp + 0x20]
mov dword [0x7ffe0466eeac], eax
test rcx, rcx
je 0x7ffe046374c9
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
add rsp, 0x40
pop rbp
ret

Function at 0x7ffe04642dac
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
xor ebx, ebx
cmp qword [0x7ffe0466e8b0], rbx
je 0x7ffe04642dc4
mov al, 1
jmp 0x7ffe04642eae
lea rcx, str.ICMP.DLL
call fcn.7ffe0465a658
mov qword [0x7ffe0466e8b0], rax
test rax, rax
je 0x7ffe04642eac
lea rdx, str.IcmpCreateFile
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [0x7ffe0466e8b0]
lea rdx, str.IcmpCloseHandle
mov qword [0x7ffe0466f130], rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [0x7ffe0466e8b0]
lea rdx, str.IcmpSendEcho
mov qword [0x7ffe0466f138], rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [0x7ffe0466e8b0]
lea rdx, str.Icmp6CreateFile
mov qword [0x7ffe0466f128], rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [0x7ffe0466e8b0]
lea rdx, str.Icmp6SendEcho2
mov qword [0x7ffe0466f120], rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
cmp qword [0x7ffe0466f130], rbx
mov qword [0x7ffe0466f140], rax
je 0x7ffe04642e9c
cmp qword [0x7ffe0466f138], rbx
je 0x7ffe04642e9c
cmp qword [0x7ffe0466f128], rbx
jne 0x7ffe04642ea1
call fcn.7ffe0464304c
cmp qword [0x7ffe0466e8b0], rbx
je 0x7ffe04642eac
mov bl, 1
mov al, bl
add rsp, 0x20
pop rbx
ret
Function at 0x7ffe04659574
Capabilities:
Encrypt data using dpapi

Disassembly:
sub rsp, 0x28
xor eax, eax
cmp qword [rcx + 8], rax
je 0x7ffe0465959d
cmp word [rcx + 2], ax
je 0x7ffe0465959d
movzx edx, word [rcx + 2]
xor r8d, r8d
mov rcx, qword [rcx + 8]
call qword [sym.imp.CRYPT32.dll_CryptUnprotectMemory]
nop dword [rax + rax]
add rsp, 0x28
ret

Function at 0x7ffe046596a8
Capabilities:
Encrypt data using dpapi

Disassembly:
sub rsp, 0x28
xor eax, eax
cmp qword [rcx + 8], rax
je 0x7ffe046596d1
cmp word [rcx + 2], ax
je 0x7ffe046596d1
movzx edx, word [rcx + 2]
xor r8d, r8d
mov rcx, qword [rcx + 8]
call qword [sym.imp.CRYPT32.dll_CryptProtectMemory]
nop dword [rax + rax]
add rsp, 0x28
ret

Function at 0x7ffe0465a120
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x7ffe0466e0ac]
cmp ecx, 0xffffffff
je 0x7ffe0465a144
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
nop dword [rax + rax]
test rax, rax
je 0x7ffe0465a144
mov eax, dword [rax]
jmp 0x7ffe0465a149
mov eax, 0x52
add rsp, 0x28
ret

Function at 0x7ffe0465a658
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rbp, rcx
or rdi, 0xffffffffffffffff
inc rdi
cmp byte [rdi + rcx], bl
jne 0x7ffe0465a675
add edi, 0x107
mov edx, 0x736e414c
mov ecx, edi
call fcn.7ffe0465ad90
mov rsi, rax
test rax, rax
jne 0x7ffe0465a6d7
cmp dword [0x7ffe0466eeac], ebx
je 0x7ffe0465a775
cmp dword [0x7ffe0466eea8], ebx
je 0x7ffe0465a775
mov eax, 0x10000000
test qword [0x7ffe0466eea0], rax
je 0x7ffe0465a775
mov r8d, edi
lea rdx, str.LoadSystem32LibraryA_couldnt_allocate_0x_x_bytes._n
mov ecx, eax
call fcn.7ffe04636b9c
jmp 0x7ffe0465a775
mov edx, 0x105
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemDirectoryA]
nop dword [rax + rax]
mov r8d, eax
dec eax
cmp eax, 0x104
ja 0x7ffe0465a73c
lea eax, [r8 - 1]
mov ebx, edi
cmp byte [rax + rsi], 0x5c
je 0x7ffe0465a714
lea r8, [0x7ffe04669210]
mov edx, ebx
mov rcx, rsi
call fcn.7ffe0465aa4c
mov r8, rbp
mov rdx, rbx
mov rcx, rsi
call fcn.7ffe0465aa4c
xor edx, edx
mov rcx, rsi
lea r8d, [rdx + 8]
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadLibraryExA]
nop dword [rax + rax]
mov rbx, rax
jmp 0x7ffe0465a768
cmp dword [0x7ffe0466eeac], ebx
je 0x7ffe0465a768
cmp dword [0x7ffe0466eea8], ebx
je 0x7ffe0465a768
mov eax, 0x10000000
test qword [0x7ffe0466eea0], rax
je 0x7ffe0465a768
lea rdx, str.LoadSystem32LibraryA:_GetSystemDirectory_failed__error__0x_x._n
mov ecx, eax
call fcn.7ffe04636b9c
mov edx, 0x736e414c
mov rcx, rsi
call fcn.7ffe04621ee0
mov rbp, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x7ffe0465a92c
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ebx, edx
mov ecx, dword [0x7ffe0466e0ac]
cmp ecx, 0xffffffff
je 0x7ffe0465a98b
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x7ffe0465a989
mov edx, 0x6c546864
lea ecx, [rax + 0x10]
call fcn.7ffe0465ad90
mov rdi, rax
test rax, rax
je 0x7ffe0465a98b
mov ecx, dword [0x7ffe0466e0ac]
mov rdx, rax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
nop dword [rax + rax]
mov dword [rdi], ebx
test rsi, rsi
je 0x7ffe0465aa33
mov dword [rsi + 0x3f4], ebx
mov edi, 0x8000000
test ebx, ebx
js 0x7ffe0465a9ac
cmp ebx, 0x62
jae 0x7ffe0465a9ac
mov ecx, ebx
jmp 0x7ffe0465a9dd
cmp dword [0x7ffe0466eeac], 0
je 0x7ffe0465a9d8
cmp dword [0x7ffe0466eea8], 0
je 0x7ffe0465a9d8
test qword [0x7ffe0466eea0], rdi
je 0x7ffe0465a9d8
mov r8d, ebx
lea rdx, str.ldap_SetConnectionError_does_not_have_text_for_message_0x_x._n
mov ecx, edi
call fcn.7ffe04636b9c
mov ecx, 0x50
call sym.WLDAP32.dll_ldap_err2string
mov qword [rsi + 0x400], rax
and qword [rsi + 0x3f8], 0
cmp byte [rax], 0
jne 0x7ffe0465aa33
cmp dword [0x7ffe0466eeac], 0
je 0x7ffe0465aa22
cmp dword [0x7ffe0466eea8], 0
je 0x7ffe0465aa22
test qword [0x7ffe0466eea0], rdi
je 0x7ffe0465aa22
mov r8d, ebx
lea rdx, str.ldap_SetConnectionError_does_not_have_text_for_message_0x_x._n
mov ecx, edi
call fcn.7ffe04636b9c
mov ecx, 0x50
call sym.WLDAP32.dll_ldap_err2string
mov qword [rsi + 0x400], rax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1406a1058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1406a11df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1406a1089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406a106f
add dl, dl
jne 0x1406a1096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406a10f6
xor eax, eax
add dl, dl
jne 0x1406a10a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406a11ad
add dl, dl
jne 0x1406a10b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406a10c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406a10d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406a10dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1406a10ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1406a107e
mov eax, 1
add dl, dl
jne 0x1406a1106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406a1113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406a10fb
sub eax, ebx
mov ebx, 1
jne 0x1406a114c
mov ecx, 1
add dl, dl
jne 0x1406a112e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406a113b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406a1123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406a107e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1406a1168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406a1175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406a115d
cmp eax, 0x7d00
jae 0x1406a119b
cmp eax, 0x500
jb 0x1406a1196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406a107e
cmp eax, 0x7f
ja 0x1406a119e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406a107e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1406a11d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1406a107e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x414a20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x414bc6
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00430b40
xorps xmm15, xmm15
mov r14, qword [0x00598400]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x414a8b
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x414aa0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
nop
test rbx, rbx
jbe 0x414ac5
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x414ad9
cmp rbx, 0x1000
jae 0x414a95
nop dword [rax]
jmp 0x414b49
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x414aed
xor edx, edx
jmp 0x414b40
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00430b40
xorps xmm15, xmm15
mov r14, qword [0x00598400]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop dword [rax]
test dl, dl
jne 0x414acf
jmp 0x414ab4
call fcn.0045fb00
xorps xmm15, xmm15
mov r14, qword [0x00598400]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00435080
lea rax, [0x004ac73b]
mov ebx, 0x18
call fcn.00435980
mov rax, qword [rsp + 0x38]
call fcn.00435680
lea rax, [0x004ac7fb]
mov ebx, 0x19
call fcn.00435980
mov rax, qword [rsp + 0x30]
nop
call fcn.00435680
call fcn.004352e0
call fcn.00435100
lea rax, [0x004ae9b2]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.00433740
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045bf60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00414a20
Function at 0x414c00
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x414e2a
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00430bc0
xorps xmm15, xmm15
mov r14, qword [0x00598400]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x414c79
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x414c8c
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x414cb0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
nop
jmp 0x414cc4
cmp rbx, 0x1000
jae 0x414c83
jmp 0x414d45
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x414cd6
xor esi, esi
jmp 0x414d36
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.00430bc0
xorps xmm15, xmm15
mov r14, qword [0x00598400]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x414cba
nop
jmp 0x414ca2
call fcn.0045fb00
xorps xmm15, xmm15
mov r14, qword [0x00598400]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x414dc5
call fcn.00435080
lea rax, [0x004acbca]
mov ebx, 0x19
call fcn.00435980
mov rax, qword [rsp + 0x68]
call fcn.00435680
lea rax, [0x004ac7fb]
mov ebx, 0x19
call fcn.00435980
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.00435680
call fcn.004352e0
call fcn.00435100
lea rax, [0x004a9822]
mov ebx, 0xd
nop dword [rax + rax]
call fcn.00433740
cmp eax, 0x5af
je 0x414d68
call fcn.00435080
lea rax, [0x004acbca]
mov ebx, 0x19
nop dword [rax]
call fcn.00435980
mov rax, qword [rsp + 0x38]
call fcn.00435680
lea rax, [0x004ac7fb]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00435980
mov eax, dword [rsp + 0x34]
call fcn.00435680
call fcn.004352e0
call fcn.00435100
lea rax, [0x004ae2c6]
mov ebx, 0x1f
call fcn.00433740
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045bf60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00414c00