joyce8/EMBER2024-capa huggingface dataset:
Function at 0x639180
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x63931c
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rdi
movq qword [rsp + 0x38], xmm15
mov byte [rsp + 0x17], 0
mov byte [rsp + 0x16], 0
lea rsi, [rax + 0x80]
mov rdx, rax
xor eax, eax
mov r8d, 1
lock cmpxchg dword [rdx + 0x80], r8d
sete r8b
test r8b, r8b
jne 0x63920b
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rdi
mov rax, rsi
call fcn.0046b320
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x68]
movups xmmword [rsp + 0x20], xmm15
lea r8, [0x00639360]
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x28], rsi
lea rsi, [rsp + 0x20]
mov qword [rsp + 0x38], rsi
mov byte [rsp + 0x17], 1
cmp qword [rdx + 0x98], 0
jne 0x639245
cmp qword [rdx + 0xa0], 0
je 0x639264
mov byte [rsp + 0x16], 0
mov byte [rsp + 0x17], 0
mov rdx, qword [rsp + 0x38]
mov rax, qword [rdx]
call rax
movzx eax, byte [rsp + 0x16]
add rsp, 0x40
pop rbp
ret
mov qword [rdx + 0x88], 0
cmp dword [0x0092d940], 0
je 0x6392a6
mov rsi, qword [rdx + 0x90]
nop
call fcn.0045fea0
mov qword [r11], rsi
mov qword [r11 + 8], rbx
mov rsi, qword [rdx + 0x98]
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
mov rsi, qword [rdx + 0xa8]
mov qword [r11 + 0x20], rsi
mov qword [rdx + 0x90], 0
mov qword [rdx + 0x98], rbx
mov qword [rdx + 0xa0], rcx
mov qword [rdx + 0xa8], rdi
test rbx, rbx
jne 0x6392d0
test rcx, rcx
je 0x6392f8
mov rax, qword [rdx + 0x68]
call fcn.00406a80
mov byte [rsp + 0x16], 1
mov byte [rsp + 0x17], 0
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rdx]
call rcx
movzx eax, byte [rsp + 0x16]
add rsp, 0x40
pop rbp
ret
lea rax, [0x0066d140]
lea rbx, [0x007402e0]
call fcn.004337c0
nop
call fcn.00433720
movzx eax, byte [rsp + 0x16]
add rsp, 0x40
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00639180
Function at 0x6396a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x639752
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x78], r8
mov rdx, qword [rax + 0x90]
test rdx, rdx
je 0x6396ec
mov r10, qword [rdx]
mov rax, rbx
mov rbx, rcx
mov rcx, rdi
mov rdi, rsi
mov rsi, r8
mov r8, r9
call r10
jmp 0x639705
mov rdx, qword [rax + 0x98]
mov r10, qword [rdx]
mov rax, rdi
mov rbx, rsi
mov rcx, r8
mov rdi, r9
call r10
test rax, rax
jne 0x63974c
test rcx, rcx
jne 0x63974c
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
nop
lea rax, [0x006870a0]
call fcn.0040d480
mov qword [rax + 8], 0x41
lea rcx, [0x006d7622]
mov qword [rax], rcx
mov rbx, qword [rsp + 0x38]
lea rcx, [0x00741740]
mov rdi, rax
mov rax, qword [rsp + 0x30]
add rsp, 0x40
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
nop dword [rax]
jmp fcn.006396a0
Function at 0x63ed40
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x63efba
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x90], rsi
test rdi, rdi
je 0x63efb0
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x88], rdi
mov rcx, qword [rax + 0xb0]
xor ebx, ebx
mov rax, rcx
call fcn.00406f00
mov rax, qword [rsp + 0x70]
call fcn.0063e600
test rax, rax
jne 0x63efaa
mov rdx, qword [rsp + 0x78]
lea rsi, [rdx + 0x20]
xor eax, eax
mov edi, 1
lock cmpxchg dword [rdx + 0x20], edi
sete dil
test dil, dil
jne 0x63ede6
mov qword [rsp + 0x38], rsi
mov rax, rsi
call fcn.0046b320
mov rdx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x38]
mov rax, qword [rdx + 0x28]
mov rbx, qword [rdx + 0x30]
nop
mov edi, 0xffffffff
lock xadd dword [rdx + 0x20], edi
lea edx, [rdi - 1]
nop dword [rax]
test edx, edx
je 0x63ee22
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
mov rax, rsi
mov ebx, edx
call fcn.0046b600
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
test rax, rax
jne 0x63efa4
mov rax, qword [rsp + 0x88]
cmp qword [0x00899b50], rax
jne 0x63ee60
mov rcx, qword [0x00899b58]
mov rbx, qword [rsp + 0x90]
call fcn.00405280
test al, al
jne 0x63ef8e
mov rax, qword [rsp + 0x88]
lea rcx, [0x00741d80]
cmp rax, rcx
jne 0x63eec6
mov rcx, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x70]
cmp qword [rdx + 0x78], rcx
jne 0x63eeb8
movups xmmword [rsp + 0x50], xmm15
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0x58], rcx
lea rax, [0x006946c0]
lea rbx, [rsp + 0x50]
call fcn.0040a6e0
mov rbx, rax
lea rax, [0x00741d60]
add rsp, 0x60
pop rbp
ret
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop rbp
ret
mov rax, qword [rsp + 0x70]
call fcn.0063e540
test al, al
je 0x63ef78
mov rdx, qword [rsp + 0x80]
mov r8, qword [rsp + 0x70]
cmp qword [r8 + 0x78], rdx
je 0x63ef3d
movups xmmword [rsp + 0x40], xmm15
mov rdx, qword [rsp + 0x88]
test rdx, rdx
je 0x63ef04
mov rdi, qword [rdx + 8]
jmp 0x63ef07
mov rdi, rdx
mov qword [rsp + 0x40], rdi
mov rdx, qword [rsp + 0x90]
mov qword [rsp + 0x48], rdx
lea rax, [0x006d5268]
mov ebx, 0x32
lea rcx, [rsp + 0x40]
mov edi, 1
mov rsi, rdi
call fcn.004bfac0
add rsp, 0x60
pop rbp
ret
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0x58], rcx
lea rax, [0x006946c0]
lea rbx, [rsp + 0x50]
call fcn.0040a6e0
mov rbx, rax
lea rax, [0x00741d60]
add rsp, 0x60
pop rbp
ret
mov rax, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop rbp
ret
mov rax, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop rbp
ret
add rsp, 0x60
pop rbp
ret
add rsp, 0x60
pop rbp
ret
xor eax, eax
xor ebx, ebx
add rsp, 0x60
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.0063ed40
Function at 0x642580
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x642713
push rbp
mov rbp, rsp
sub rsp, 0x78
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x98], rcx
test rbx, rbx
je 0x6426ff
mov byte [rax + 0x108], 1
cmp qword [rax + 0xe8], 0
je 0x6425c5
mov rdx, rax
nop
jmp 0x6426d6
mov qword [rsp + 0x90], rbx
mov qword [rax + 0xe8], rbx
cmp dword [0x0092d940], 0
je 0x6425f3
nop dword [rax]
call fcn.0045fe40
mov qword [r11], rcx
mov rdx, qword [rax + 0xf0]
mov qword [r11 + 8], rdx
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x98], rcx
mov qword [rax + 0xf0], rcx
mov rdx, qword [rax + 0x10]
mov r11, qword [rax + 0x18]
mov qword [rsp + 0x40], r11
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rsp + 0x48], xmm0
movups xmm0, xmmword [rax + 0x30]
movups xmmword [rsp + 0x58], xmm0
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rsp + 0x68], xmm0
mov rbx, qword [rsp + 0x40]
mov r11, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov r8, qword [rsp + 0x60]
mov r9, qword [rsp + 0x68]
movzx r10d, byte [rsp + 0x70]
mov rax, rdx
mov rcx, r11
nop dword [rax]
call fcn.0063ab40
mov rdx, qword [rsp + 0x88]
cmp qword [rdx], 0
jne 0x6426d6
mov rax, qword [rsp + 0x90]
nop dword [rax + rax]
cmp qword [0x00899b60], rax
jne 0x6426ac
mov rcx, qword [0x00899b68]
mov rbx, qword [rsp + 0x98]
call fcn.00405280
nop dword [rax]
test al, al
jne 0x6426ba
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rdx + 0x50]
mov rax, qword [rdx + 0x58]
mov rcx, qword [rcx + 0x18]
call rcx
mov rcx, qword [rsp + 0x88]
mov rax, qword [rcx + 0x90]
call fcn.00406a80
mov rdx, qword [rsp + 0x88]
cmp dword [0x0092d940], 0
je 0x6426ee
mov rax, qword [rdx + 0x110]
call fcn.0045fe20
mov qword [r11], rax
mov qword [rdx + 0x110], 0
add rsp, 0x78
pop rbp
ret
lea rax, [0x0066d140]
lea rbx, [0x00740300]
call fcn.004337c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00642580
Function at 0x6427a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x6428a2
push rbp
mov rbp, rsp
sub rsp, 0x68
mov qword [rsp + 0x78], rax
mov rcx, qword [rax + 0x28]
mov rbx, qword [rax + 0x30]
nop
mov rax, rcx
call fcn.00596560
test rdi, rdi
jne 0x6427f3
mov rbx, qword [0x008a64a0]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rdx]
mov rdi, qword [rdx + 8]
lea rax, [0x0067ba40]
call fcn.004121a0
mov rdi, qword [rax + 8]
mov rcx, qword [rax]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x48], rdi
mov rax, qword [rsp + 0x78]
call fcn.00642740
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
nop
call fcn.00403ae0
xorps xmm15, xmm15
mov r14, qword [0x0092d718]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x642875
xor eax, eax
lea rbx, [0x0073fbc8]
mov ecx, 1
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x50]
lea r8, [0x006c4a23]
mov r9d, 2
mov r10, qword [rsp + 0x58]
mov r11, qword [rsp + 0x48]
call fcn.0044ad40
jmp 0x64289c
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
lea rdi, [0x0073e628]
mov esi, 1
mov r8, qword [rsp + 0x58]
mov r9, qword [rsp + 0x48]
call fcn.0044ac80
add rsp, 0x68
pop rbp
ret
mov qword [rsp + 8], rax
call fcn.0045df00
mov rax, qword [rsp + 8]
jmp fcn.006427a0
Function at 0x140f49058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140f491df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140f49089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f4906f
add dl, dl
jne 0x140f49096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f490f6
xor eax, eax
add dl, dl
jne 0x140f490a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f491ad
add dl, dl
jne 0x140f490b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f490c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f490d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f490dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140f490ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140f4907e
mov eax, 1
add dl, dl
jne 0x140f49106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f49113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f490fb
sub eax, ebx
mov ebx, 1
jne 0x140f4914c
mov ecx, 1
add dl, dl
jne 0x140f4912e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140f4913b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f49123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f4907e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140f49168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140f49175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f4915d
cmp eax, 0x7d00
jae 0x140f4919b
cmp eax, 0x500
jb 0x140f49196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f4907e
cmp eax, 0x7f
ja 0x140f4919e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f4907e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140f491d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140f4907e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14298b058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.14298b1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14298b089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14298b06f
add dl, dl
jne 0x14298b096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14298b0f6
xor eax, eax
add dl, dl
jne 0x14298b0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14298b1ad
add dl, dl
jne 0x14298b0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14298b0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14298b0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14298b0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14298b0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14298b07e
mov eax, 1
add dl, dl
jne 0x14298b106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14298b113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14298b0fb
sub eax, ebx
mov ebx, 1
jne 0x14298b14c
mov ecx, 1
add dl, dl
jne 0x14298b12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14298b13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14298b123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14298b07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14298b168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14298b175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14298b15d
cmp eax, 0x7d00
jae 0x14298b19b
cmp eax, 0x500
jb 0x14298b196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14298b07e
cmp eax, 0x7f
ja 0x14298b19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14298b07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14298b1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14298b07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001490
Capabilities:
Execute command
Reference cloudflare dns server
Set console window title

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x47], rax
lea rcx, str.LOV3YP_BTK_1.SULH
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
lea rdx, str.Ethernet
lea rcx, [rbp + 0x27]
call fcn.1400016c0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
movdqa xmm1, xmmword [0x1400034b0]
movdqu xmmword [rbp + 0x17], xmm1
mov rax, qword [str.1.1.1.1]
mov dword [rbp + 7], eax
movzx edx, word [0x14000348c]
mov word [rbp + 0xb], dx
movzx ecx, byte [0x14000348e]
mov byte [rbp + 0xd], cl
mov byte [rbp + 0xe], 0
movups xmmword [rbp - 0x19], xmm0
movdqu xmmword [rbp - 9], xmm1
mov dword [rbp - 0x19], eax
mov word [rbp - 0x15], dx
mov byte [rbp - 0x13], cl
mov byte [rbp - 0x12], 0
lea r8, [rbp - 0x19]
lea rdx, [rbp + 7]
lea rcx, [rbp + 0x27]
call fcn.1400011c0
lea rdx, [0x140003490]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001860
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov rdx, qword [rbp - 1]
cmp rdx, 0xf
jbe 0x140001588
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001583
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001583
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140001d1c
movdqa xmm0, xmmword [0x1400034a0]
movdqu xmmword [rbp - 9], xmm0
mov byte [rbp - 0x19], 0
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0xf
jbe 0x1400015df
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400015d2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400015d2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140001d1c
movdqa xmm0, xmmword [0x1400034a0]
movdqu xmmword [rbp + 0x17], xmm0
mov byte [rbp + 7], 0
mov rdx, qword [rbp + 0x3f]
cmp rdx, 7
jbe 0x14000162b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001626
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001626
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140001d1c
xor eax, eax
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140001cc0
add rsp, 0x90
pop rbp
ret

Function at 0x140002640
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000268a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000268a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000268a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000268a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000268a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000268c
xor al, al
add rsp, 0x28
ret
Function at 0x14001b4c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14001b64b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [0x140a6d1c8]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.140039fc0
xorps xmm15, xmm15
mov r14, qword [0x141485a70]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x14001b525
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x14001b534
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x14001b553
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x14001b563
cmp rbx, 0x1000
jae 0x14001b52b
jmp 0x14001b5cd
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x14001b575
xor edx, edx
jmp 0x14001b5c4
mov rcx, qword [0x140a6d1c8]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.140039fc0
xorps xmm15, xmm15
mov r14, qword [0x141485a70]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x14001b559
jmp 0x14001b548
call fcn.14006e820
xorps xmm15, xmm15
mov r14, qword [0x141485a70]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.14003e980
lea rax, [0x140caf46c]
mov ebx, 0x18
nop dword [rax]
call fcn.14003f200
mov rax, qword [rsp + 0x38]
call fcn.14003ef40
lea rax, [0x140cb0838]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.14003f200
mov rax, qword [rsp + 0x30]
call fcn.14003ef40
call fcn.14003ebc0
call fcn.14003e9e0
lea rax, [0x140cb9b7a]
mov ebx, 0x21
call fcn.14003cf40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.14006b0e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.14001b4c0
Function at 0x14001b680
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14001b8a6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [0x140a6d1c0]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.14003a040
xorps xmm15, xmm15
mov r14, qword [0x141485a70]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x14001b6f3
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x14001b702
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x14001b725
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x14001b735
cmp rbx, 0x1000
jae 0x14001b6f9
nop
jmp 0x14001b7b8
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x14001b74d
xor esi, esi
jmp 0x14001b7aa
mov rax, qword [0x140a6d1c0]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.14003a040
xorps xmm15, xmm15
mov r14, qword [0x141485a70]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x14001b72b
jmp 0x14001b716
call fcn.14006e820
xorps xmm15, xmm15
mov r14, qword [0x141485a70]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x14001b840
nop dword [rax + rax]
call fcn.14003e980
lea rax, [0x140cb0851]
mov ebx, 0x19
call fcn.14003f200
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.14003ef40
lea rax, [0x140cb0838]
mov ebx, 0x19
call fcn.14003f200
mov eax, dword [rsp + 0x34]
call fcn.14003ef40
nop
call fcn.14003ebc0
call fcn.14003e9e0
lea rax, [0x140ca2f7a]
mov ebx, 0xd
call fcn.14003cf40
nop dword [rax + rax]
cmp eax, 0x5af
je 0x14001b7e0
call fcn.14003e980
lea rax, [0x140cb0851]
mov ebx, 0x19
call fcn.14003f200
mov rax, qword [rsp + 0x38]
call fcn.14003ef40
lea rax, [0x140cb0838]
mov ebx, 0x19
call fcn.14003f200
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.14003ef40
call fcn.14003ebc0
call fcn.14003e9e0
lea rax, [0x140cb7944]
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.14003cf40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.14006b0e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.14001b680