joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5090c0
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x509321
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
test rax, rax
je 0x509305
mov qword [rsp + 0xb8], rax
mov rbx, qword [rax + 8]
mov rdx, qword [rax]
mov rcx, qword [rax + 0x10]
test rbx, rbx
jne 0x50910d
xor ebx, ebx
xor ecx, ecx
jmp 0x509120
mov rax, rdx
call fcn.004f9b60
mov rcx, rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x48], rbx
cmp qword [rax + 0x28], 0
je 0x509238
mov rcx, qword [rax + 0x18]
mov rax, rcx
nop
call fcn.0048fde0
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0xb8]
mov r8, qword [rcx + 0x20]
mov r9, qword [rcx + 0x28]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x00752cd8]
mov esi, 1
lea rax, [rsp + 0x68]
mov rbx, qword [rsp + 0x88]
call fcn.0044e800
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.00403280
xorps xmm15, xmm15
mov r14, qword [0x00947068]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x5091fb
xor eax, eax
lea rbx, [0x00752f00]
mov ecx, 1
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x60]
lea r8, [0x006da235]
mov r9d, 2
mov r10, qword [rsp + 0x98]
mov r11, qword [rsp + 0x58]
call fcn.0044e8e0
jmp 0x509228
xor eax, eax
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x60]
lea rdi, [0x00752d98]
mov esi, 1
mov r8, qword [rsp + 0x98]
mov r9, qword [rsp + 0x58]
call fcn.0044e800
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov rax, qword [rax + 0x18]
nop dword [rax]
call fcn.0048fde0
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsp + 0x88]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 0x3a
call fcn.00403280
xorps xmm15, xmm15
mov r14, qword [0x00947068]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x5092c8
xor eax, eax
lea rbx, [0x00752f00]
mov ecx, 1
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x48]
lea r8, [0x006da235]
mov r9d, 2
mov r10, qword [rsp + 0x90]
mov r11, qword [rsp + 0x50]
call fcn.0044e8e0
jmp 0x5092f5
xor eax, eax
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x00752d98]
mov esi, 1
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x50]
call fcn.0044e800
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
lea rax, [0x006da74e]
mov ebx, 5
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov qword [rsp + 8], rax
call fcn.00463760
mov rax, qword [rsp + 8]
jmp fcn.005090c0
Function at 0x531820
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53194f
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x60], rbx
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
mov rcx, rax
lea rax, [rsp + 0x38]
mov rbx, rcx
call fcn.00531660
mov qword [rsp + 0x58], rax
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
lea rcx, [rsp + 0x18]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 1
call fcn.0053d380
xorps xmm15, xmm15
mov r14, qword [0x00947068]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x58]
xor eax, eax
xor edx, edx
jmp 0x5318c0
test byte [rcx], al
lea rsi, [rax + 1]
mov rdi, qword [rsp + rax*8 + 0x18]
xor rdi, qword [rcx + rax*8]
or rdx, rdi
mov rax, rsi
nop dword [rax]
cmp rax, 4
jl 0x5318a8
nop
not rdx
mov rcx, rdx
shr rdx, 0x20
and rcx, rdx
mov rdx, rcx
shr rcx, 0x10
and rcx, rdx
mov rdx, rcx
shr rcx, 8
and rcx, rdx
mov rdx, rcx
shr rcx, 4
and rcx, rdx
mov rdx, rcx
shr rcx, 2
and rcx, rdx
mov rdx, rcx
shr rcx, 1
and rcx, rdx
and ecx, 1
cmp rcx, 1
je 0x531941
lea rax, [0x0069f6e0]
call fcn.0040d960
mov qword [rax + 8], 0x17
lea rcx, [0x006e11b2]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x00755980]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
nop
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463760
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00531820
Function at 0x549220
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5493fc
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0xb0], r10
test rsi, rsi
je 0x549357
test r9, r9
je 0x549357
mov qword [rsp + 0x98], rsi
lea rbx, [rsi + 1]
mov qword [rsp + 0x58], rbx
cmp rcx, rbx
jl 0x54927c
jae 0x5492db
jmp 0x5493f0
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0xa8], r9
mov qword [rsp + 0xa0], r8
lea rcx, [rsi + 5]
mov qword [rsp + 0x50], rcx
lea rax, [0x006863e0]
call fcn.0044a840
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x98]
mov rdi, qword [rsp + 0x90]
mov r8, qword [rsp + 0xa0]
mov r9, qword [rsp + 0xa8]
mov r10, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x50]
nop dword [rax + rax]
cmp rsi, rcx
ja 0x5493e5
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], r10
call fcn.005550a0
xorps xmm15, xmm15
mov r14, qword [0x00947068]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x98]
mov rdx, qword [rsp + 0x58]
cmp rcx, rdx
jae 0x5493d9
mov rsi, qword [rsp + 0x60]
mov qword [rsi + rcx*8], rax
jmp 0x5493a2
test r10, r10
jne 0x549362
xor edx, edx
nop
jmp 0x549392
nop
cmp rcx, 1
jge 0x54938a
lea rax, [0x006863e0]
mov ebx, 1
mov rcx, rbx
call fcn.0044a840
mov r10, qword [rsp + 0xb0]
mov ecx, 1
mov qword [rax], r10
mov edx, 1
mov rbx, rdx
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
dec rdx
test rdx, rdx
jle 0x5493b1
mov rdi, qword [rsi + rdx*8 - 8]
test rdi, rdi
je 0x54939f
mov rcx, qword [rsp + 0x48]
cmp rdx, rcx
ja 0x5493cb
mov rax, rsi
mov rbx, rdx
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rax, rcx
mov rcx, rdx
mov rdx, rax
call fcn.00465e40
mov rax, rcx
mov rcx, rdx
nop
call fcn.00465dc0
mov rdx, rcx
mov rcx, rsi
call fcn.00465e40
mov rdx, rcx
mov rcx, rbx
call fcn.00465e40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r10
call fcn.00463760
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
jmp fcn.00549220
Function at 0x549c80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x549dd1
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x78], rdi
cmp rcx, r9
jb 0x549dc5
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x90], r9
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rcx
mov qword [rsp], rax
mov qword [rsp + 8], r9
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], r8
call fcn.00554d40
xorps xmm15, xmm15
mov r14, qword [0x00947068]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x549da1
mov rbx, qword [rsp + 0x90]
mov rsi, rbx
sar rbx, 1
lea rcx, [rsi + rbx]
mov rdx, qword [rsp + 0x70]
cmp rdx, rcx
jb 0x549dc0
cmp rsi, rcx
ja 0x549db3
sub rdx, rsi
mov rdi, rdx
neg rdx
mov r8, rsi
shl rsi, 3
sar rdx, 0x3f
and rsi, rdx
mov rdx, qword [rsp + 0x60]
add rdx, rsi
mov rcx, qword [rsp + 0x68]
nop dword [rax]
cmp rcx, r8
jb 0x549dab
mov qword [rsp], rdx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], rdx
sub rcx, r8
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rax
call fcn.00554e80
xorps xmm15, xmm15
mov r14, qword [0x00947068]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rax, r8
call fcn.00465e80
mov rax, rsi
call fcn.00465e80
nop dword [rax + rax]
call fcn.00465e40
mov rdx, rcx
mov rcx, r9
call fcn.00465e40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.00463760
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
nop dword [rax]
jmp fcn.00549c80
Function at 0x549e40
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x549f91
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x78], rdi
cmp rcx, r9
jb 0x549f85
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x90], r9
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rcx
mov qword [rsp], rax
mov qword [rsp + 8], r9
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], r8
call fcn.00554de0
xorps xmm15, xmm15
mov r14, qword [0x00947068]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x549f61
mov rbx, qword [rsp + 0x90]
mov rsi, rbx
sar rbx, 1
lea rcx, [rsi + rbx]
mov rdx, qword [rsp + 0x70]
cmp rdx, rcx
jb 0x549f80
cmp rsi, rcx
ja 0x549f73
sub rdx, rsi
mov rdi, rdx
neg rdx
mov r8, rsi
shl rsi, 3
sar rdx, 0x3f
and rsi, rdx
mov rdx, qword [rsp + 0x60]
add rdx, rsi
mov rcx, qword [rsp + 0x68]
nop dword [rax]
cmp rcx, r8
jb 0x549f6b
mov qword [rsp], rdx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], rdx
sub rcx, r8
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rax
call fcn.00554f20
xorps xmm15, xmm15
mov r14, qword [0x00947068]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rax, r8
call fcn.00465e80
mov rax, rsi
call fcn.00465e80
nop dword [rax + rax]
call fcn.00465e40
mov rdx, rcx
mov rcx, r9
call fcn.00465e40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.00463760
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
nop dword [rax]
jmp fcn.00549e40
Function at 0x55bea0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x55c0e6
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0xa0], rdi
mov qword [rsp + 0x88], rax
mov rsi, qword [rdi]
nop
mov rsi, qword [rsi + 8]
mov qword [rsp + 0x70], rsi
mov r8, qword [rax + 8]
mov r9, qword [rax]
cmp qword [rax + 0x10], rsi
jl 0x55bf3e
test r8, r8
je 0x55bf2b
shl r8, 3
mov rax, r9
mov rbx, r8
call fcn.00466460
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x90]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0xa0]
mov rdx, qword [rax + 0x10]
cmp rdx, rsi
jb 0x55c0da
mov qword [rax + 8], rsi
jmp 0x55bf93
lea rax, [0x00686a20]
mov rbx, rsi
mov rcx, rbx
call fcn.0044a840
mov rdx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x88]
mov qword [rdi + 8], rdx
mov qword [rdi + 0x10], rdx
cmp dword [0x009472e0], 0
jne 0x55bf73
mov qword [rdi], rax
jmp 0x55bf78
call fcn.00465920
mov rax, rdi
mov rcx, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x90]
mov rdi, qword [rsp + 0xa0]
mov rdx, qword [rdi]
mov rsi, qword [rbx + 8]
mov r8, qword [rbx]
mov r9, qword [rbx + 0x10]
mov r10, qword [rdx + 8]
mov r11, qword [rdx]
mov rdx, qword [rdx + 0x10]
cmp r10, rsi
jne 0x55c0c7
mov r12, qword [rcx + 8]
mov r13, qword [rcx]
mov rcx, qword [rcx + 0x10]
cmp r10, r12
jne 0x55c0c7
mov rbx, qword [rax]
mov r15, qword [rax + 8]
mov rax, qword [rax + 0x10]
mov rdi, qword [rdi + 0x10]
mov qword [rsp], rbx
mov qword [rsp + 8], r15
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x50], r10
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], rdi
call fcn.0055d1e0
xorps xmm15, xmm15
mov r14, qword [0x00947068]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rax]
mov rax, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x88]
mov rbx, qword [rdx + 8]
mov rsi, qword [rdx]
mov rdi, qword [rcx + 0x10]
mov r8, qword [rcx]
cmp rdi, rbx
jb 0x55c0bc
xor edi, edi
xor r9d, r9d
nop
jmp 0x55c080
lea r10, [rdi + 1]
mov r11, qword [rsi + rdi*8]
sub r11, qword [r8 + rdi*8]
sub r11, r9
shr r11, 0x3f
mov rdi, r10
mov r9, r11
nop dword [rax + rax]
cmp rdi, rbx
jl 0x55c062
mov rsi, rax
sub rax, r9
sbb rbx, rbx
sub r9, rsi
sbb rsi, rsi
nop
neg rbx
neg rsi
or rbx, rsi
xor rbx, 1
mov rax, rdx
call fcn.0055b2e0
mov rax, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov rcx, rbx
mov rdx, rdi
call fcn.00465e40
lea rax, [0x00686960]
lea rbx, [0x00754930]
call fcn.00436420
mov rcx, rsi
nop dword [rax]
call fcn.00465e40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463760
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0055bea0
Function at 0x57b920
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x57bb5c
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
call fcn.00510500
xorps xmm15, xmm15
mov r14, qword [0x00947068]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
add qword [rcx + 0x68], rax
mov rdx, qword [rcx + 0x60]
test rdx, rdx
jle 0x57ba6a
nop
cmp rdx, 0x40
ja 0x57bb4e
lea rsi, [rdx - 0x40]
mov rdi, rsi
neg rsi
cmp rax, rsi
cmovl rsi, rax
mov qword [rsp + 0x28], rsi
sar rdi, 0x3f
and rdi, rdx
lea rdx, [rcx + rdi]
lea rdx, [rdx + 0x20]
mov rbx, qword [rsp + 0x60]
cmp rbx, rdx
je 0x57b9d9
mov rax, rdx
mov rcx, rsi
nop
call fcn.00466760
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x60]
add rdx, rsi
mov qword [rcx + 0x60], rdx
cmp rdx, 0x40
jne 0x57ba41
mov qword [rsp], rcx
lea rax, [rcx + 0x20]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.0057c0a0
xorps xmm15, xmm15
mov r14, qword [0x00947068]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x60], 0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
cmp rax, rsi
jb 0x57bb43
mov rdi, qword [rsp + 0x70]
sub rdi, rsi
mov rdx, rax
sub rax, rsi
mov r8, rdi
neg rdi
sar rdi, 0x3f
and rsi, rdi
add rbx, rsi
jmp 0x57ba77
mov rdx, rax
mov rbx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
cmp rax, 0x40
jl 0x57baf7
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp], rcx
mov qword [rsp + 8], rbx
and rax, 0xffffffffffffffc0
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], r8
call fcn.0057c0a0
xorps xmm15, xmm15
mov r14, qword [0x00947068]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov rcx, qword [rsp + 0x30]
and rax, rcx
and rax, 0xffffffffffffffc0
mov rbx, qword [rsp + 0x40]
add rbx, rax
sub rcx, rdx
mov rdx, qword [rsp + 0x68]
mov rax, rcx
mov rcx, qword [rsp + 0x58]
test rax, rax
je 0x57bb32
cmp rax, 0x40
mov esi, 0x40
cmovl rsi, rax
lea rax, [rcx + 0x20]
cmp rbx, rax
je 0x57bb2e
mov qword [rsp + 0x38], rsi
mov rcx, rsi
call fcn.00466760
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rcx + 0x60], rsi
mov rax, rdx
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rcx, rax
mov rax, rsi
call fcn.00465e80
mov rax, rdx
mov ecx, 0x40
call fcn.00465e80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463760
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0057b920
Function at 0x5899e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x589bf7
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
add qword [rax + 0x58], rcx
mov rdx, qword [rax + 0x50]
test rdx, rdx
jle 0x589b0e
nop dword [rax + rax]
cmp rdx, 0x40
ja 0x589be9
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea rsi, [rdx - 0x40]
mov r8, rsi
neg rsi
cmp rcx, rsi
cmovl rsi, rcx
mov qword [rsp + 0x28], rsi
sar r8, 0x3f
and r8, rdx
lea rdx, [rax + r8]
lea rdx, [rdx + 0x10]
cmp rbx, rdx
je 0x589a82
mov rax, rdx
mov rcx, rsi
call fcn.00466760
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rax + 0x50]
add rdx, rsi
mov qword [rax + 0x50], rdx
cmp rdx, 0x40
jne 0x589aea
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.00589e80
xorps xmm15, xmm15
mov r14, qword [0x00947068]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
cmp rcx, rsi
jb 0x589be1
sub rdi, rsi
mov rdx, rcx
sub rcx, rsi
mov r8, rdi
neg rdi
sar rdi, 0x3f
and rsi, rdi
add rbx, rsi
jmp 0x589b14
mov rdx, rcx
mov r8, rdi
cmp rcx, 0x40
jl 0x589b91
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
and rcx, 0xffffffffffffffc0
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], r8
call fcn.00589e80
xorps xmm15, xmm15
mov r14, qword [0x00947068]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov rcx, qword [rsp + 0x30]
and rax, rcx
and rax, 0xffffffffffffffc0
mov rbx, qword [rsp + 0x40]
add rbx, rax
sub rcx, rdx
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
test rcx, rcx
je 0x589bcf
cmp rcx, 0x40
mov esi, 0x40
cmovl rsi, rcx
lea rdi, [rax + 0x10]
cmp rbx, rdi
je 0x589bcb
mov qword [rsp + 0x38], rsi
mov rax, rdi
mov rcx, rsi
call fcn.00466760
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rax + 0x50], rsi
mov rax, rdx
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
nop
ret
mov rax, rsi
call fcn.00465e80
mov rax, rdx
mov ecx, 0x40
call fcn.00465e80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463760
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.005899e0
Function at 0x5fc140
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5fc2eb
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov qword [rsp + 0x80], rax
xor ecx, ecx
jmp 0x5fc167
inc rcx
cmp rbx, rcx
jle 0x5fc2dd
movzx edx, byte [rax + rcx]
cmp dl, 0x80
jb 0x5fc164
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x80], rax
call fcn.004fd160
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x58], rsi
test rsi, rsi
mov rdx, qword [rsp + 0x88]
cmovne rbx, rdx
mov rdx, qword [rsp + 0x80]
cmovne rax, rdx
mov rdx, qword [0x008e6808]
mov r8, rax
mov rax, rdx
mov r9, rbx
mov rbx, r8
mov rcx, r9
mov edi, 1
call fcn.005f8200
mov rdx, qword [rsp + 0x58]
test rdx, rdx
mov rdx, qword [rsp + 0x48]
mov esi, 0
cmovne rdx, rsi
mov r8, qword [rsp + 0x60]
mov r9d, 0
cmovne r8, r9
nop dword [rax]
test rcx, rcx
jne 0x5fc2cd
test rdx, rdx
je 0x5fc2be
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x68], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.00403280
xorps xmm15, xmm15
mov r14, qword [0x00947068]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x5fc289
xor eax, eax
lea rbx, [0x00752f00]
mov ecx, 1
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x50]
lea r8, [0x006da235]
mov r9d, 2
mov r10, qword [rsp + 0x60]
mov r11, qword [rsp + 0x48]
call fcn.0044e8e0
jmp 0x5fc2b0
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
lea rdi, [0x00752d98]
mov esi, 1
mov r8, qword [rsp + 0x60]
mov r9, qword [rsp + 0x48]
call fcn.0044e800
xor ecx, ecx
xor edi, edi
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
xor ecx, ecx
mov rdi, r9
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rax, r9
mov rbx, rsi
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
xor ecx, ecx
xor edi, edi
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463760
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.005fc140
Function at 0x100001000
Capabilities:
Allocate or change rwx memory
Create thread
Enumerate process modules
Inject thread
Spawn thread to rwx shellcode
Terminate process

Disassembly:
sub rsp, 0x11f8
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rsi
lea rcx, [rsp + 0x48]
mov edx, 0xfa0
lea r8, [rsp + 0xfe8]
call qword [sym.imp.kernel32.dll_K32EnumProcesses]
test al, al
je 0x100001195
mov esi, dword [rsp + 0xfe8]
mov ecx, 0x43a
xor rdx, rdx
mov r8d, dword [rsp + rsi + 0x44]
call qword [sym.imp.kernel32.dll_OpenProcess]
test rax, rax
je 0x100001093
mov rbp, rax
mov rcx, rbp
xor rdx, rdx
lea r8, [rsp + 0xfe8]
mov r9d, 0x100
call qword [sym.imp.kernel32.dll_K32GetModuleBaseNameW]
test eax, eax
je 0x10000108a
lea rcx, [0x100004084]
lea rdx, [rsp + 0xfe8]
call qword [sym.imp.kernel32.dll_lstrcmpiW]
test eax, eax
je 0x1000010ba
mov rcx, rbp
call qword [sym.imp.kernel32.dll_CloseHandle]
sub esi, 4
jne 0x100001038
xor rcx, rcx
lea rdx, [0x1000040a4]
lea r8, [0x1000040a0]
mov r9d, 0x10040
call qword [sym.imp.user32.dll_MessageBoxW]
jmp 0x1000011b2
mov rcx, rbp
xor rdx, rdx
mov r8d, dword [0x100000090]
mov r9d, 0x1000
mov dword [rsp + 0x20], pe_nt_image_headers64
call qword [sym.imp.kernel32.dll_VirtualAllocEx]
test rax, rax
je 0x10000118c
mov rsi, rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rax, qword [rax]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
sub qword [sym.imp.kernel32.dll_LoadLibraryA], rax
sub qword [sym.imp.kernel32.dll_GetProcAddress], rax
mov rcx, rbp
mov rdx, rsi
lea r8, [0x100000000]
mov r9d, dword [0x100000090]
mov qword [rsp + 0x20], 0
call qword [sym.imp.kernel32.dll_WriteProcessMemory]
test al, al
je 0x100001177
mov rcx, rbp
xor rdx, rdx
mov r8d, 0x1000
lea r9, [rsi + 0x11cd]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rdx
call qword [sym.imp.kernel32.dll_CreateRemoteThread]
test rax, rax
je 0x100001177
mov rcx, rax
call qword [sym.imp.kernel32.dll_CloseHandle]
mov rcx, rbp
call qword [sym.imp.kernel32.dll_CloseHandle]
jmp 0x1000011b2
mov rcx, rbp
mov rdx, rsi
xor r8, r8
mov r9d, 0x4000
call qword [sym.imp.kernel32.dll_VirtualFreeEx]
mov rcx, rbp
call qword [sym.imp.kernel32.dll_CloseHandle]
xor rcx, rcx
lea rdx, [0x1000040d4]
lea r8, [0x1000040a0]
mov r9d, 0x10010
call qword [sym.imp.user32.dll_MessageBoxW]
xor rcx, rcx
call qword [sym.imp.kernel32.dll_ExitProcess]