joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e5b60
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov r12, r9
mov rbx, rdx
mov r15, rcx
mov rdx, qword [rcx]
mov rsi, rbx
sub rsi, rdx
mov rax, qword [rcx + 8]
sub rax, rdx
sar rax, 4
movabs r9, 0xfffffffffffffff
cmp rax, r9
je 0x1400e5d93
lea r8, [rax + 1]
mov qword [rsp + 0x40], r8
mov rcx, qword [rcx + 0x10]
sub rcx, rdx
sar rcx, 4
mov rdx, rcx
shr rdx, 1
mov rax, r9
sub rax, rdx
cmp rcx, rax
ja 0x1400e5d8d
lea rax, [rdx + rcx]
mov r14, r8
cmp rax, r8
cmovae r14, rax
cmp r14, r9
ja 0x1400e5d8d
mov rcx, r14
shl rcx, 4
mov qword [rsp + 0x30], r14
cmp rcx, 0x1000
jb 0x1400e5c2d
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400e5d8d
mov rcx, rax
call fcn.140108140
test rax, rax
je 0x1400e5c26
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400e5c4d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x1400e5c46
call fcn.140108140
mov rdi, rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
jmp 0x1400e5c52
xor edi, edi
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], rdi
and rsi, 0xfffffffffffffff0
lea r13, [rsi + rdi]
lea rax, [r13 + 0x10]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0xa8], rax
mov ecx, 0x20
call fcn.140108140
mov r9, rax
test r9, r9
je 0x1400e5cb0
mov rax, qword [rsp + 0xc8]
mov rcx, qword [rax]
mov qword [r9], rcx
mov rax, qword [rsp + 0xc0]
mov ecx, dword [rax]
mov dword [r9 + 8], ecx
mov eax, dword [r12]
mov dword [r9 + 0x10], eax
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov qword [r9 + 0x18], rax
mov qword [rsp + 0x50], r9
lea r12, [r13 + 8]
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], 0
lea r8, [0x1400e65c0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [r13], rax
test rax, rax
je 0x1400e5d99
mov qword [rsp + 0xa8], r13
mov rdx, qword [r15 + 8]
mov rax, qword [r15]
mov rcx, rdi
cmp rbx, rdx
jne 0x1400e5d1b
cmp rax, rdx
je 0x1400e5d67
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rcx], xmm1
lea rcx, [rcx + 0x10]
add rax, 0x10
cmp rax, rdx
jne 0x1400e5d00
jmp 0x1400e5d67
cmp rax, rbx
je 0x1400e5d39
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rcx], xmm1
lea rcx, [rcx + 0x10]
add rax, 0x10
cmp rax, rbx
jne 0x1400e5d20
mov qword [rsp + 0xa8], rdi
mov rax, qword [r15 + 8]
cmp rbx, rax
je 0x1400e5d67
sub rsi, rbx
add rsi, rdi
xorps xmm0, xmm0
movups xmm1, xmmword [rbx]
movups xmmword [rbx], xmm0
movups xmmword [rsi + rbx + 0x10], xmm1
add rbx, 0x10
cmp rbx, rax
jne 0x1400e5d50
mov r9, r14
mov r8, qword [rsp + 0x40]
mov rdx, rdi
mov rcx, r15
call fcn.1400c4ea0
mov rax, r13
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
call fcn.14000df60
int3
call fcn.14000e090
nop
mov dword [r12], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x1400e5db0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov r12, r9
mov rbx, rdx
mov r15, rcx
mov rdx, qword [rcx]
mov rsi, rbx
sub rsi, rdx
mov rax, qword [rcx + 8]
sub rax, rdx
sar rax, 4
movabs r9, 0xfffffffffffffff
cmp rax, r9
je 0x1400e5fe3
lea r8, [rax + 1]
mov qword [rsp + 0x40], r8
mov rcx, qword [rcx + 0x10]
sub rcx, rdx
sar rcx, 4
mov rdx, rcx
shr rdx, 1
mov rax, r9
sub rax, rdx
cmp rcx, rax
ja 0x1400e5fdd
lea rax, [rdx + rcx]
mov r14, r8
cmp rax, r8
cmovae r14, rax
cmp r14, r9
ja 0x1400e5fdd
mov rcx, r14
shl rcx, 4
mov qword [rsp + 0x30], r14
cmp rcx, 0x1000
jb 0x1400e5e7d
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400e5fdd
mov rcx, rax
call fcn.140108140
test rax, rax
je 0x1400e5e76
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400e5e9d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x1400e5e96
call fcn.140108140
mov rdi, rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
jmp 0x1400e5ea2
xor edi, edi
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], rdi
and rsi, 0xfffffffffffffff0
lea r13, [rsi + rdi]
lea rax, [r13 + 0x10]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0xa8], rax
mov ecx, 0x20
call fcn.140108140
mov r9, rax
test r9, r9
je 0x1400e5f00
mov rax, qword [rsp + 0xc8]
mov rcx, qword [rax]
mov qword [r9], rcx
mov rax, qword [rsp + 0xc0]
mov ecx, dword [rax]
mov dword [r9 + 8], ecx
mov eax, dword [r12]
mov dword [r9 + 0x10], eax
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov qword [r9 + 0x18], rax
mov qword [rsp + 0x50], r9
lea r12, [r13 + 8]
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], 0
lea r8, [0x1400e6630]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [r13], rax
test rax, rax
je 0x1400e5fe9
mov qword [rsp + 0xa8], r13
mov rdx, qword [r15 + 8]
mov rax, qword [r15]
mov rcx, rdi
cmp rbx, rdx
jne 0x1400e5f6b
cmp rax, rdx
je 0x1400e5fb7
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rcx], xmm1
lea rcx, [rcx + 0x10]
add rax, 0x10
cmp rax, rdx
jne 0x1400e5f50
jmp 0x1400e5fb7
cmp rax, rbx
je 0x1400e5f89
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rcx], xmm1
lea rcx, [rcx + 0x10]
add rax, 0x10
cmp rax, rbx
jne 0x1400e5f70
mov qword [rsp + 0xa8], rdi
mov rax, qword [r15 + 8]
cmp rbx, rax
je 0x1400e5fb7
sub rsi, rbx
add rsi, rdi
xorps xmm0, xmm0
movups xmm1, xmmword [rbx]
movups xmmword [rbx], xmm0
movups xmmword [rsi + rbx + 0x10], xmm1
add rbx, 0x10
cmp rbx, rax
jne 0x1400e5fa0
mov r9, r14
mov r8, qword [rsp + 0x40]
mov rdx, rdi
mov rcx, r15
call fcn.1400c4ea0
mov rax, r13
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
call fcn.14000df60
int3
call fcn.14000e090
nop
mov dword [r12], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x1400eb050
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov r12, r9
mov rbx, rdx
mov r15, rcx
mov rdx, qword [rcx]
mov rsi, rbx
sub rsi, rdx
mov rax, qword [rcx + 8]
sub rax, rdx
sar rax, 4
movabs r9, 0xfffffffffffffff
cmp rax, r9
je 0x1400eb293
lea r8, [rax + 1]
mov qword [rsp + 0x40], r8
mov rcx, qword [rcx + 0x10]
sub rcx, rdx
sar rcx, 4
mov rdx, rcx
shr rdx, 1
mov rax, r9
sub rax, rdx
cmp rcx, rax
ja 0x1400eb28d
lea rax, [rdx + rcx]
mov r14, r8
cmp rax, r8
cmovae r14, rax
cmp r14, r9
ja 0x1400eb28d
mov rcx, r14
shl rcx, 4
mov qword [rsp + 0x30], r14
cmp rcx, 0x1000
jb 0x1400eb11d
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400eb28d
mov rcx, rax
call fcn.140108140
test rax, rax
je 0x1400eb116
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400eb13d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x1400eb136
call fcn.140108140
mov rdi, rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
jmp 0x1400eb142
xor edi, edi
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], rdi
and rsi, 0xfffffffffffffff0
lea r13, [rsi + rdi]
lea rax, [r13 + 0x10]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0xa8], rax
mov ecx, 0x20
call fcn.140108140
mov r9, rax
test r9, r9
je 0x1400eb1a1
mov rax, qword [rsp + 0xc8]
mov rcx, qword [rax]
mov qword [r9], rcx
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rax]
mov qword [r9 + 8], rcx
mov rax, qword [r12]
mov qword [r9 + 0x10], rax
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov qword [r9 + 0x18], rax
mov qword [rsp + 0x50], r9
lea r12, [r13 + 8]
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], 0
lea r8, [0x1400eb510]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [r13], rax
test rax, rax
je 0x1400eb299
mov qword [rsp + 0xa8], r13
mov rdx, qword [r15 + 8]
mov rax, qword [r15]
mov rcx, rdi
cmp rbx, rdx
jne 0x1400eb21b
cmp rax, rdx
je 0x1400eb267
nop dword [rax]
nop word [rax + rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rcx], xmm1
lea rcx, [rcx + 0x10]
add rax, 0x10
cmp rax, rdx
jne 0x1400eb200
jmp 0x1400eb267
cmp rax, rbx
je 0x1400eb239
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rcx], xmm1
lea rcx, [rcx + 0x10]
add rax, 0x10
cmp rax, rbx
jne 0x1400eb220
mov qword [rsp + 0xa8], rdi
mov rax, qword [r15 + 8]
cmp rbx, rax
je 0x1400eb267
sub rsi, rbx
add rsi, rdi
xorps xmm0, xmm0
movups xmm1, xmmword [rbx]
movups xmmword [rbx], xmm0
movups xmmword [rsi + rbx + 0x10], xmm1
add rbx, 0x10
cmp rbx, rax
jne 0x1400eb250
mov r9, r14
mov r8, qword [rsp + 0x40]
mov rdx, rdi
mov rcx, r15
call fcn.1400c4ea0
mov rax, r13
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
call fcn.14000df60
int3
call fcn.14000e090
nop
mov dword [r12], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x1400eb2b0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov r12, r9
mov rbx, rdx
mov r15, rcx
mov rdx, qword [rcx]
mov rsi, rbx
sub rsi, rdx
mov rax, qword [rcx + 8]
sub rax, rdx
sar rax, 4
movabs r9, 0xfffffffffffffff
cmp rax, r9
je 0x1400eb4f3
lea r8, [rax + 1]
mov qword [rsp + 0x40], r8
mov rcx, qword [rcx + 0x10]
sub rcx, rdx
sar rcx, 4
mov rdx, rcx
shr rdx, 1
mov rax, r9
sub rax, rdx
cmp rcx, rax
ja 0x1400eb4ed
lea rax, [rdx + rcx]
mov r14, r8
cmp rax, r8
cmovae r14, rax
cmp r14, r9
ja 0x1400eb4ed
mov rcx, r14
shl rcx, 4
mov qword [rsp + 0x30], r14
cmp rcx, 0x1000
jb 0x1400eb37d
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400eb4ed
mov rcx, rax
call fcn.140108140
test rax, rax
je 0x1400eb376
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400eb39d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x1400eb396
call fcn.140108140
mov rdi, rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
jmp 0x1400eb3a2
xor edi, edi
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], rdi
and rsi, 0xfffffffffffffff0
lea r13, [rsi + rdi]
lea rax, [r13 + 0x10]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0xa8], rax
mov ecx, 0x20
call fcn.140108140
mov r9, rax
test r9, r9
je 0x1400eb401
mov rax, qword [rsp + 0xc8]
mov rcx, qword [rax]
mov qword [r9], rcx
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rax]
mov qword [r9 + 8], rcx
mov rax, qword [r12]
mov qword [r9 + 0x10], rax
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov qword [r9 + 0x18], rax
mov qword [rsp + 0x50], r9
lea r12, [r13 + 8]
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], 0
lea r8, [0x1400eb5e0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [r13], rax
test rax, rax
je 0x1400eb4f9
mov qword [rsp + 0xa8], r13
mov rdx, qword [r15 + 8]
mov rax, qword [r15]
mov rcx, rdi
cmp rbx, rdx
jne 0x1400eb47b
cmp rax, rdx
je 0x1400eb4c7
nop dword [rax]
nop word [rax + rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rcx], xmm1
lea rcx, [rcx + 0x10]
add rax, 0x10
cmp rax, rdx
jne 0x1400eb460
jmp 0x1400eb4c7
cmp rax, rbx
je 0x1400eb499
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rcx], xmm1
lea rcx, [rcx + 0x10]
add rax, 0x10
cmp rax, rbx
jne 0x1400eb480
mov qword [rsp + 0xa8], rdi
mov rax, qword [r15 + 8]
cmp rbx, rax
je 0x1400eb4c7
sub rsi, rbx
add rsi, rdi
xorps xmm0, xmm0
movups xmm1, xmmword [rbx]
movups xmmword [rbx], xmm0
movups xmmword [rsi + rbx + 0x10], xmm1
add rbx, 0x10
cmp rbx, rax
jne 0x1400eb4b0
mov r9, r14
mov r8, qword [rsp + 0x40]
mov rdx, rdi
mov rcx, r15
call fcn.1400c4ea0
mov rax, r13
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
call fcn.14000df60
int3
call fcn.14000e090
nop
mov dword [r12], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x1400fa900
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rax, qword [rcx + 0x14340]
lea r14, [0x140000000]
mov rbp, rdx
mov rdi, rcx
mov r8, qword [rax]
mov eax, r8d
and eax, 3
mov ebx, eax
mov r13d, eax
xor rbx, r8
mov r9d, eax
mov r12, rbx
nop word [rax + rax]
movsxd rsi, r9d
movsxd rax, dword [r14 + rsi*4 + 0x168f60]
mov r15, qword [rbx + rax*8 + 0x18]
movsxd rax, dword [r14 + rsi*4 + 0x168f70]
mov r14, qword [rbx + rax*8 + 0x18]
movsxd rax, dword [rdi + 0x142e8]
cmp dword [r15 + rax*4], 0
jne 0x1400fa983
mov dword [r15 + rax*4], 1
movsxd rax, dword [rdi + 0x142e8]
cmp dword [r14 + rax*4], 0
jne 0x1400fa999
mov dword [r14 + rax*4], 1
mov rcx, qword [rbx + rsi*8 + 0x30]
mov eax, ecx
and rcx, 0xfffffffffffffffc
and eax, 1
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x28], eax
cmp rcx, qword [rdi + 0x14350]
jne 0x1400faa85
lea rcx, [rdi + 0x50]
call fcn.1400ff470
mov rcx, qword [rdi + 0x14350]
mov r10, rax
mov qword [rsp + 0x20], rax
lea r9, [r10 + 0x38]
xor r11d, r11d
mov dword [rsp + 0x28], 1
mov qword [rax], rcx
lea r8, [r10 + 0x40]
mov rcx, qword [rdi + 0x14350]
mov qword [rax + 8], rcx
mov qword [rax + 0x10], r11
mov qword [rax + 0x18], r11
mov qword [rax + 0x20], r11
mov qword [rax + 0x28], r11
mov rax, qword [rdi + 0x14340]
mov qword [r10 + 0x30], rax
mov rax, qword [rdi + 0x14340]
mov qword [r9], rax
mov rax, rsi
mov dword [r8], r11d
or rax, rbx
mov qword [r10 + 0x10], r14
mov qword [r10 + 0x18], r15
mov qword [r10 + 0x20], r14
mov qword [r10 + 0x28], r15
mov qword [rbx + rsi*8 + 0x30], r10
mov qword [r10 + 0x30], rax
or r10, 1
mov rcx, qword [rbx + rsi*8]
mov eax, ecx
and eax, 3
mov edx, eax
xor rax, rcx
mov qword [rax + rdx*8 + 0x30], r10
or rdx, rax
mov qword [r9], rdx
mov dword [r8], 1
cmp dword [rbp + 0x74], 2
jle 0x1400faa92
lea rcx, str.__Inserting_new
call fcn.1400771e0
lea r8, [rsp + 0x20]
mov rdx, rbp
mov rcx, rdi
call fcn.1400ff840
jmp 0x1400faa92
cmp dword [rcx + 0x40], 0
jne 0x1400faa92
mov dword [rcx + 0x40], 1
mov r8, qword [rdi + 0x14340]
lea r14, [0x140000000]
movsxd rax, dword [r14 + rsi*4 + 0x168f60]
mov r9d, eax
mov rcx, qword [rbx + rax*8]
mov eax, ecx
and eax, 3
mov edx, eax
xor rax, rcx
mov ecx, dword [r14 + rdx*4 + 0x168f60]
cmp rax, r8
je 0x1400faaf4
nop word [rax + rax]
mov r9d, ecx
mov rbx, rax
movsxd rcx, ecx
mov rdx, qword [rax + rcx*8]
mov eax, edx
and eax, 3
mov ecx, eax
xor rax, rdx
mov ecx, dword [r14 + rcx*4 + 0x168f60]
cmp rax, r8
jne 0x1400faad0
cmp rbx, r12
jne 0x1400fa950
cmp r9d, r13d
jne 0x1400fa950
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1401079a8
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1401079e2
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1401079e7
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140107a30
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140138960]
cmp byte [rcx + rax], 0
je 0x140107a30
dec r8
sub rdx, 1
jne 0x140107a16
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140108ff8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140109042
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140109042
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140109042
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140109042
cmp dword [rcx + 0x84], 0xe
jbe 0x140109042
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140109044
xor al, al
add rsp, 0x28
ret
Function at 0x14002c1d0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x14004c2c8], rbx
je 0x14002c21c
cmp rax, rbx
jne 0x14002c20f
mov ebx, 1
mov esi, ebx
jmp 0x14002c221
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14002c1f4
mov ebx, 1
mov eax, dword [0x14004c2d0]
cmp eax, ebx
jne 0x14002c237
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x14002c29c
mov eax, dword [0x14004c2d0]
test eax, eax
jne 0x14002c296
mov dword [0x14004c2d0], ebx
lea r15, [0x14002f640]
lea rdi, [0x14002f628]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x14002c288
test eax, eax
jne 0x14002c28c
cmp qword [rdi], 0
je 0x14002c27d
mov rax, qword [rdi]
mov rcx, qword [0x14002f5e0]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x14002c25e
test eax, eax
je 0x14002c29c
mov eax, 0xff
jmp 0x14002c378
mov dword [0x14004b368], ebx
mov eax, dword [0x14004c2d0]
cmp eax, ebx
jne 0x14002c2c3
lea rdx, [0x14002f620]
lea rcx, [0x14002f5e8]
call sub.msvcrt.dll__initterm
mov dword [0x14004c2d0], 2
test esi, esi
jne 0x14002c2d0
xor eax, eax
xchg qword [0x14004c2c8], rax
cmp qword [0x14004c2e8], 0
je 0x14002c304
lea rcx, [0x14004c2e8]
call fcn.14002cdb0
test eax, eax
je 0x14002c304
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x14004c2e8]
mov r9, qword [0x14002f5e0]
call r9
mov r8, qword [0x14004b380]
mov rdx, qword [0x14004b378]
mov ecx, dword [0x14004b370]
call fcn.140009c48
mov dword [0x14004b364], eax
cmp dword [0x14004b388], 0
jne 0x14002c334
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14004b368], 0
jne 0x14002c349
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14004b364]
jmp 0x14002c378
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.1400dd000
add rsp, 0x28
jmp 0x14002c1d0

Function at 0x14002c7b8
Capabilities:
Print debug messages

Disassembly:
jmp 0x14002c7c4
push rbx
sub rsp, 0x540
mov rax, qword [0x14004a300]
xor rax, rsp
mov qword [rsp + 0x530], rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x14002c841
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlVirtualUnwind]
jmp 0x14002c861
mov rax, qword [rsp + 0x548]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x548]
mov qword [rsp + 0xf8], rax
lea rcx, str.Invalid_parameter_passed_to_C_runtime_function._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.14002c700
add rsp, 0x540
pop rbx
ret
Function at 0x140015760
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1400158f0
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [0x140071368]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.1400328e0
xorps xmm15, xmm15
mov r14, qword [0x140168e50]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x1400157c5
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x1400157e0
add rsp, 0x48
pop rbp
ret
call fcn.14004ccc0
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
sub rbx, rcx
nop dword [rax]
test rbx, rbx
jbe 0x1400157ff
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x14001580f
cmp rbx, 0x1000
jae 0x1400157cb
jmp 0x14001587a
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x140015822
xor edx, edx
nop
jmp 0x140015871
mov rcx, qword [0x140071368]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.1400328e0
xorps xmm15, xmm15
mov r14, qword [0x140168e50]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x140015805
jmp 0x1400157f4
call fcn.140060fe0
xorps xmm15, xmm15
mov r14, qword [0x140168e50]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.140036660
lea rax, [0x14008727a]
mov ebx, 0x18
call fcn.140036ea0
mov rax, qword [rsp + 0x38]
call fcn.140036c00
lea rax, [0x140087460]
mov ebx, 0x19
call fcn.140036ea0
mov rax, qword [rsp + 0x30]
call fcn.140036c00
call fcn.140036880
call fcn.1400366c0
lea rax, [0x1400886c8]
mov ebx, 0x21
call fcn.140034cc0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.14005da80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.140015760
Function at 0x140015920
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140015b4a
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [0x140071360]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.140032980
xorps xmm15, xmm15
mov r14, qword [0x140168e50]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x140015993
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x1400159ba
add rsp, 0x50
pop rbp
ret
mov rax, rcx
nop dword [rax]
call fcn.14004ccc0
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
sub rbx, rcx
mov rcx, rax
mov rax, qword [rsp + 0x68]
test rbx, rbx
jbe 0x1400159dc
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x1400159ec
cmp rbx, 0x1000
jae 0x140015999
jmp 0x140015a6e
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x1400159fe
xor esi, esi
jmp 0x140015a60
mov rax, qword [0x140071360]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.140032980
xorps xmm15, xmm15
mov r14, qword [0x140168e50]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
test sil, sil
jne 0x1400159e2
jmp 0x1400159ce
call fcn.140060fe0
xorps xmm15, xmm15
mov r14, qword [0x140168e50]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x140015ae9
call fcn.140036660
lea rax, [0x140087479]
mov ebx, 0x19
call fcn.140036ea0
mov rax, qword [rsp + 0x68]
call fcn.140036c00
lea rax, [0x140087460]
mov ebx, 0x19
nop dword [rax]
call fcn.140036ea0
mov eax, dword [rsp + 0x34]
call fcn.140036c00
call fcn.140036880
call fcn.1400366c0
lea rax, [0x140085c1f]
mov ebx, 0xd
call fcn.140034cc0
cmp eax, 0x5af
je 0x140015a91
call fcn.140036660
lea rax, [0x140087479]
mov ebx, 0x19
call fcn.140036ea0
mov rax, qword [rsp + 0x38]
call fcn.140036c00
lea rax, [0x140087460]
mov ebx, 0x19
nop dword [rax]
call fcn.140036ea0
mov eax, dword [rsp + 0x34]
call fcn.140036c00
call fcn.140036880
call fcn.1400366c0
lea rax, [0x14008826d]
mov ebx, 0x1f
call fcn.140034cc0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.14005da80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.140015920