joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140096250
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbx
push rbp
push r12
push r13
push r15
sub rsp, 0x180
mov rax, qword [0x1405eeab8]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x50], rcx
mov r15, r8
mov rcx, rdx
mov r12, rdx
xor ebp, ebp
xor ebx, ebx
call fcn.14006c990
mov r13, rax
test rax, rax
jne 0x1400962ce
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0x60]
mov ecx, eax
call fcn.14006d530
mov r9, rax
lea rdx, [0x1401f5828]
mov r8, r12
mov rcx, r15
call fcn.140059160
xor ecx, ecx
lea ebx, [rbp + 0x4d]
call qword [fcn.1401e168a]
jmp 0x140096489
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov rcx, r13
mov qword [rsp + 0x170], r14
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x140096341
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0x60]
mov ecx, eax
call fcn.14006d530
mov r9, rax
lea rdx, [0x1401f5860]
mov r8, r12
mov rcx, r15
call fcn.140059160
xor ecx, ecx
lea ebx, [r14 + 0x4e]
jmp 0x140096472
lea rdx, [rsp + 0x48]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x14009638a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0x60]
mov ecx, eax
call fcn.14006d530
mov r9, rax
lea rdx, [0x1401f5890]
mov r8, r12
mov rcx, r15
call fcn.140059160
mov ebx, 0x4d
jmp 0x140096466
mov qword [rsp + 0x178], rdi
mov rdi, qword [rsp + 0x48]
cmp rdi, 0x100000
jle 0x1400963bf
mov r8d, 0x100000
lea rdx, [0x1401f58c8]
mov rcx, r15
call fcn.140059160
mov ebx, 0x4d
jmp 0x14009645e
lea rcx, [rdi + 1]
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbp, rax
test rax, rax
jne 0x1400963d9
lea ebx, [rax + 0x1b]
jmp 0x14009645e
mov qword [rsp + 0x1c8], rsi
test rdi, rdi
je 0x140096438
nop word [rax + rax]
mov r8d, edi
mov dword [rsp + 0x40], 0
sub r8d, ebx
mov esi, ebx
lea rdx, [rbx + rbp]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400964ab
mov eax, dword [rsp + 0x40]
test eax, eax
jne 0x14009642f
mov edi, esi
jmp 0x140096431
add ebx, eax
mov eax, ebx
cmp rax, rdi
jb 0x1400963f0
mov rcx, qword [rsp + 0x50]
mov r9, r12
mov r8, rdi
mov byte [rdi + rbp], 0
mov rdx, rbp
mov qword [rsp + 0x20], r15
call fcn.140095fd0
mov ebx, eax
mov rsi, qword [rsp + 0x1c8]
mov rdi, qword [rsp + 0x178]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbp
call qword [fcn.1401e168a]
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r14, qword [rsp + 0x170]
mov eax, ebx
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1401e0580
add rsp, 0x180
pop r15
pop r13
pop r12
pop rbp
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0x60]
mov ecx, eax
call fcn.14006d530
mov r9, rax
lea rdx, [0x1401f58f8]
mov r8, r12
mov rcx, r15
call fcn.140059160
mov ebx, 0x4d
jmp 0x140096456
Function at 0x14009db10
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r15
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbp, rcx
mov ecx, dword [rcx + 0x20]
mov rsi, rdx
add rcx, 0x18
mov r15d, r8d
lea r9d, [rax + rax]
add rcx, r9
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
jne 0x14009db53
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop rsi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbp
mov qword [rax + 8], rcx
mov eax, dword [rbp + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rdi
mov qword [rbx + 0x10], rax
lea rdi, [rbp + 8]
mov qword [rsp + 0x50], r14
cmp r15d, dword [rbp + 0x1c]
jbe 0x14009dba0
call qword [rbp]
mov rcx, qword [rbx + 8]
mov r8d, r15d
mov rdx, rsi
call qword [rdi]
mov esi, dword [rbp + 0x18]
add rsi, qword [rbx + 0x10]
mov rdx, qword [rbx + 8]
mov rcx, rsi
call qword [rbp + reloc.WS2_32.dll_recv]
mov r15d, dword [rbp + 0x20]
mov rcx, qword [rbx + 8]
call qword [rbp]
mov rcx, qword [rbx + 0x10]
call qword [rbp]
xor r14d, r14d
test r15, r15
je 0x14009dc02
mov r14, r15
nop dword [rax]
movzx eax, byte [rsi]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rbx + 8]
call qword [rdi]
movzx eax, byte [rsi]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea rsi, [rsi + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rbx + 0x10]
call qword [rdi]
sub r15, 1
jne 0x14009dbc0
lea rdi, [rbp + 8]
mov eax, dword [rbp + 0x1c]
cmp r14, rax
jae 0x14009dc41
nop word [rax + rax]
mov rcx, qword [rbx + 8]
lea rdx, [0x1401f7221]
mov r8d, 1
call qword [rdi]
mov rcx, qword [rbx + 0x10]
lea rdx, [0x1401f7222]
mov r8d, 1
call qword [rdi]
mov eax, dword [rbp + 0x1c]
inc r14
cmp r14, rax
jb 0x14009dc10
mov r14, qword [rsp + 0x50]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rsi
pop rbp
ret
Function at 0x14009de30
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1405eeab8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbp, r8
mov dword [rsp + 0x20], 0xf0000040
mov rsi, rdx
mov rdi, rcx
xor r8d, r8d
lea rcx, [rsp + 0x38]
xor edx, edx
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x14009de7c
mov eax, 0x1b
jmp 0x14009df4e
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x14009dec0
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 2
mov qword [rsp + 0x38], 0
jmp 0x14009df4e
mov rcx, rbp
call fcn.140013f20
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov r8d, eax
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x20], 0
lea edx, [r8 + 2]
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [rsp + 0x30], 0x20
jne 0x14009df2a
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
mov r8, rdi
mov dword [rsp + 0x20], 0
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14009df3a
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14009df4c
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401e0580
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret

Function at 0x14009ed10
Capabilities:
Encode data using xor

Disassembly:
mov r10, rcx
test rdx, rdx
je 0x14009ed75
nop dword [rax + rax]
movzx r8d, byte [r10]
lea r10, [r10 + 1]
movzx eax, r8b
movzx r9d, r8b
shr r9b, 1
and al, 0xfe
not r9b
movzx eax, al
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
or r8b, 1
test r9b, 2
movzx ecx, r8b
cmove ecx, eax
mov byte [r10 - 1], cl
sub rdx, 1
jne 0x14009ed20
ret
Function at 0x1400ef530
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov byte [rsp + 0x18], r8b
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
sub rsp, 0x48
movsx eax, byte [rsp + 0x58]
and eax, 1
mov dword [rsp + 0x34], eax
movsx eax, byte [rsp + 0x60]
mov ecx, eax
call fcn.1400eef80
mov dword [rsp + 0x30], eax
movzx eax, byte [rsp + 0x58]
and eax, 0xf
mov byte [rsp + 0x20], al
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x24], eax
jmp 0x1400ef580
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 3
ja 0x1400ef603
movsx eax, byte [rsp + 0x60]
mov ecx, dword [rsp + 0x24]
sar eax, cl
and eax, 1
cmp eax, dword [rsp + 0x34]
jne 0x1400ef5a5
mov dword [rsp + 0x28], 1
jmp 0x1400ef5ad
mov dword [rsp + 0x28], 0
cmp dword [rsp + 0x28], 0
jne 0x1400ef5be
mov dword [rsp + 0x2c], 0
jmp 0x1400ef5c6
mov dword [rsp + 0x2c], 1
movzx eax, byte [rsp + 0x2c]
mov byte [rsp + 0x21], al
movzx eax, byte [rsp + 0x21]
test eax, eax
je 0x1400ef5e9
movzx edx, byte [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
call fcn.1400ef3c0
jmp 0x1400ef5fe
movzx eax, byte [rsp + 0x20]
xor eax, 1
movzx edx, al
mov rcx, qword [rsp + 0x50]
call fcn.1400ef3c0
jmp 0x1400ef576
movzx edx, byte [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
call fcn.1400ef3c0
add rsp, 0x48
ret
Function at 0x1401e13d0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1401e141a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401e141a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401e141a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401e141a
cmp dword [rcx + 0x84], 0xe
jbe 0x1401e141a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1401e141c
xor al, al
add rsp, 0x28
ret
Function at 0x140005bdc
Capabilities:
Write file on windows

Disassembly:
test rcx, rcx
je 0x140005ceb
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rdi
mov rax, qword [0x140027080]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rdx
xor edi, edi
cmp word [rcx], di
je 0x140005cca
mov dword [rbp - 0x38], edi
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], di
jne 0x140005c26
test r8b, r8b
je 0x140005c50
lea r8d, [rax + rax]
mov qword [rsp + 0x20], rdi
lea r9, [rbp - 0x38]
mov rdx, rcx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
jmp 0x140005cca
mov qword [rbp - 0x50], rcx
mov qword [rbp - 0x48], rax
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.1400067e8
nop
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
mov qword [rsp + 0x20], rdi
lea r9, [rbp - 0x38]
mov r8d, dword [rbp - 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x140005cca
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005cc4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005cc4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.14000fd8c
nop
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14000fd30
nop
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x140005be5
Capabilities:
Write file on windows

Disassembly:
test rcx, rcx
je 0x140005ceb
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rdi
mov rax, qword [0x140027080]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rdx
xor edi, edi
cmp word [rcx], di
je 0x140005cca
mov dword [rbp - 0x38], edi
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], di
jne 0x140005c26
test r8b, r8b
je 0x140005c50
lea r8d, [rax + rax]
mov qword [rsp + 0x20], rdi
lea r9, [rbp - 0x38]
mov rdx, rcx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
jmp 0x140005cca
mov qword [rbp - 0x50], rcx
mov qword [rbp - 0x48], rax
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.1400067e8
nop
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
mov qword [rsp + 0x20], rdi
lea r9, [rbp - 0x38]
mov r8d, dword [rbp - 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x140005cca
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005cc4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005cc4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.14000fd8c
nop
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14000fd30
nop
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140005cec
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x140027080]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor edx, edx
mov rdi, rcx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp eax, 0xffffffff
je 0x140005da8
mov dl, 1
lea rcx, [0x14001e3c8]
call fcn.1400062b8
test al, al
je 0x140005da8
test esi, esi
jne 0x140005d4e
mov bl, 1
lea rcx, [0x14001e41c]
mov r8b, bl
mov rdx, rdi
call fcn.140005bdc
jmp 0x140005da8
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov esi, 2
mov qword [rsp + 0x20], rbx
mov r8d, esi
mov dword [rsp + 0x34], esi
lea r9, [rsp + 0x34]
mov rcx, rdi
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140005d95
cmp byte [rsp + 0x30], 0xff
jne 0x140005d97
cmp byte [rsp + 0x31], 0xfe
jne 0x140005d97
mov bl, 1
mov r9d, esi
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov al, bl
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14000fd30
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x1400060c0
Capabilities:
Print debug messages

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov rax, qword [0x140027080]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
call fcn.140006054
nop
mov rdi, rax
xor esi, esi
cmp byte [rax + 0x10], sil
jne 0x140006156
test rbx, rbx
je 0x14000612f
cmp word [rbx], si
je 0x14000612f
mov dword [rsp + 0x38], esi
or r8, 0xffffffffffffffff
inc r8
cmp word [rbx + r8*2], si
jne 0x14000610e
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x38]
mov rdx, rbx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
nop
mov dword [rsp + 0x38], esi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x38]
mov r8d, 2
lea rdx, [0x14001e414]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
nop
jmp 0x14000618a
mov r8b, byte [rax + 0x12]
mov rdx, qword [rax]
mov rcx, rbx
call fcn.140005bdc
nop
mov r8b, byte [rdi + 0x12]
mov rdx, qword [rdi]
lea rcx, [0x14001e414]
call fcn.140005bdc
nop
cmp byte [rdi + 0x11], sil
je 0x14000618a
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
lea rcx, [0x14001e414]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14000fd30
nop
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x140008a6c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, 0x7fffffff
mov rbx, rdx
mov rbp, rcx
cmp qword [rdx + 0x18], rdi
ja 0x140008a94
mov edi, dword [rdx + 0x18]
cmp qword [rdx + 0x18], 8
jb 0x140008a9e
mov rdx, qword [rdx]
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test eax, eax
je 0x140008ada
lfence
mov rcx, rbx
cmp esi, edi
jb 0x140008ad0
mov edx, esi
call fcn.140004d20
mov rdx, rax
mov r8d, esi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rcx, rbx
or edx, 0xffffffff
call fcn.140004d98
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14000d1d4
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x140027080]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, rdx
mov r8d, 0x30
lea rdx, [rsp + 0x20]
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x14000d214
lea ecx, [rax + 0x19]
int 0x29
test byte [rsp + 0x44], 0x44
je 0x14000d26d
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r9d, dword [rsp + 0x54]
xor edx, edx
mov r8d, r9d
neg r8
and r8, rbx
lea ecx, [r9 - 1]
mov eax, ecx
and ecx, ebx
and eax, edi
add eax, ecx
dec rax
add rax, r9
div r9
xor edx, edx
mov rcx, rax
mov rax, rdi
div r9
add rcx, rax
mov eax, ecx
test ecx, ecx
je 0x14000d26d
lock or dword [r8], 0
add r8, r9
sub rax, 1
jne 0x14000d25f
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14000fd30
mov rbx, qword [rsp + 0xa8]
add rsp, 0x90
pop rdi
ret

Function at 0x14000d290
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movsxd r8, dword [0x14000003c]
lea rdi, [0x140000000]
add r8, rdi
mov rsi, rdx
mov ebp, ecx
cmp dword [r8 + 0x84], 0xd
jbe 0x14000d378
mov r9d, dword [r8 + 0xf0]
test r9d, r9d
je 0x14000d378
movzx eax, word [r8 + 0x14]
lea rcx, [r8 + 0x18]
mov r10d, dword [r9 + rdi + 0xc]
add rcx, rax
movzx r11d, word [r8 + 6]
xor r9d, r9d
test r11d, r11d
je 0x14000d317
mov r8d, dword [rcx + 0xc]
cmp r10d, r8d
jb 0x14000d30b
mov edx, dword [rcx + 8]
lea eax, [rdx + r8]
cmp r10d, eax
jb 0x14000d350
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x14000d2f6
mov eax, dword [rsp + 0x40]
xor ebx, ebx
mov edx, dword [rsp + 0x40]
test rbx, rbx
je 0x14000d378
cmp dword [0x140028848], 0
jne 0x14000d359
mov dword [0x140028848], 1
test eax, eax
js 0x14000d344
mov ecx, 0x19
int 0x29
mov rcx, rbx
mov edi, edx
call fcn.14000d1d4
jmp 0x14000d35b
mov eax, dword [rcx + 0x24]
lea rbx, [rdi + r8]
jmp 0x14000d321
mov edi, edx
mov r9, rsi
mov r8d, ebp
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14000d37e
lea ecx, [rax + 0x19]
int 0x29
jmp 0x14000d37e
mov dword [rsi], 4
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x1400c0298
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea rax, [r9 + riz]
mov word [rsp + 6], bp
mov r9, qword [rsp + 1]
pop word [rsp + 6]
jmp 0x1400c0282

Function at 0x1400c06cc
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.1400bf792
mov byte [rsp + 2], r8b
mov qword [rsp], r13
jmp 0x1400bf804
call 0x1400bf80a
int 0x48
lea esp, [rsp + 0xb]
mov byte [rsp], r9b
pop word [rsp + 2]
jmp 0x1400bf88f
movabs r8, 0x1400acbdc
call fcn.1400c08f5
test al, 0xcb
invalid
lea rsp, [rsp + 5]
mov qword [rsp], rdx
call fcn.1400bf85d
mov qword [rsp + 2], r11
lea rsp, [rsp + 5]
lea rsp, [rsp + 0xa]
jmp 0x1400bf961
jle 0x1400bf91b
mov word [rsp + 2], dx
pushfq
jmp 0x1400bf941
mov word [rsp + 2], dx
pushfq
pop qword [rsp]
push qword [rsp + 8]
call fcn.1400bf902
js 0x1400bf92f
insb byte [rdi], dx
or eax, dword [rsi]
mov ecx, 0x2643d34a
invalid
pop qword [rsp]
push qword [rsp + 8]
jmp 0x1400bf92a
lea rsp, [rsp + 1]
push rbp
push rcx
push r9w
jmp 0x1400bf8f8
lea rsp, [rsp + 4]
lea rsp, [rsp + 1]
push word [rsp + 2]
ja 0x1400bf7e0
jbe 0x1400bf7e0
inc r10b
dec r13w
jp 0x1400c0794
not cx
jmp 0x1400c072b
rdtsc
sbb sil, bl
mov r13d, dword [rsp]
jmp 0x1400c074a
rdtsc
sbb sil, bl
mov r13d, dword [rsp]
jmp 0x1400c0776
mov esi, r8d
xchg si, bp
jmp 0x1400c07b1
xchg si, bp
mov r9b, 0x87
jmp 0x1400c07b4
jmp 0x1400c0799
rol r10b, 0
bt rbp, r15
jae 0x1400c074c
mov esi, r8d
jmp 0x1400c0758
not cx
jmp 0x1400c0741
bswap ebp
or dl, bl
lea rsp, [rsp]
jmp 0x1400c07f6
mov r9b, 0x87
mov r13, r10
push bx
jne 0x1400c0760
bswap ebp
or dl, bl
lea rsp, [rsp]
lea rsp, [rsp + 2]
jmp 0x1400c07fb
lea rsp, [rsp + 2]
shl r13, 2
lea rdx, [r9 + r14]
call fcn.1400c07cb
xchg r14, rax
rol dx, cl
je 0x1400c0840
lea rdi, [rdx + r10]
jmp 0x1400c0844
lea rdi, [rdx + r10]
jmp 0x1400c09df
mov r13d, dword [r13 + riz + reloc.UnityPlayer.dll_UnityMain]
mov r8w, si
lea rdi, [r8 + r14]
lea rdi, [r9 + riz + 4]
mov r14d, 0x94d0fc92
jmp 0x1400bf87c
Function at 0x1401df185
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg word [rsp + 5], si
rdtsc
mov qword [rsp], rsi
lea r14, [r15 + r13]
jmp 0x1401df0ce
bswap rbx
mov byte [rsp + 9], al
lea rsp, [rsp + 6]
push word [rsp + 4]
xor r9b, r10b
bt r10w, r12w
jmp 0x1401df087
push r9w
std
bswap r15
rdtsc
rdtsc
cmc
jmp 0x1401df155
mov r13, qword [rsp + 4]
xchg r9, rax
push word [rsp + 1]
push qword [rsp + 7]
pop rdx
sub rsp, 3
jmp 0x1401df0b8
lea r13, [rdi + r15]
xchg r11w, r9w
lea r15, [r14*8]
jmp 0x1401df134
mov word [rsp], r10w
xchg word [rsp], dx
mov r13d, dword [rsp]
add rsp, 0
mov al, r15b
jmp 0x1401df0e6
mov r15, 0xffffffffd8583587
pop rbp
mov r12w, word [rsp + 2]
pop bp
mov r11, rcx
mov r10w, word [rsp + 1]
jmp 0x1401df0fc
not r11
xchg edx, r10d
mov r13b, r14b
mov byte [rsp + 1], r15b
push r11
xchg dword [rsp + 2], edx
jmp 0x1401df16a
push r13
pop di
pop rax
xchg di, r11w
mov bx, word [rsp + 5]
xchg qword [rsp], rax
jmp 0x1401df118
xchg byte [rsp + 8], r14b
pop rbx
mov byte [rsp], r13b
bt r13w, r11w
xchg esi, eax
bsf r9d, r9d
jmp 0x1401df18f
mov r9b, byte [rsp + 9]
jmp 0x1401df09d
mov r12w, 0xfe85
not r11w
sbb al, 0xc0
neg bp
lea r15, [rsi*8]
mov r9, rdi
jmp 0x1401df20a
bswap rdi
mov dword [rsp + 4], edi
xchg r14w, dx
jmp 0x1401df221
sub rsp, 9
pop di
bswap r12d
bswap r13d
mov r9d, esi
mov dword [rsp], r12d
jmp 0x1401df1d0
mov dl, byte [rsp]
sub r9b, r11b
shr rbx, 0x27
mov r15b, r9b
lea rsp, [rsp + 1]
neg bp
jmp 0x1401df1e6
lea rbp, [rdi*4]
mov rsi, qword [rsp + 3]
mov r13b, r11b
lea r11, [rsi + riz - 0x7994995f]
lea rsp, [rsp + 8]
setbe bl
jmp 0x1401df4d5
mov bp, dx
call fcn.1401df263
setno bpl
pop word [rsp]
xchg word [rsp + 2], bx
mov word [rsp], bp
pop r13w
mov r15d, ebx
jmp 0x1401df3a8
mov rdi, qword [rsp]
xchg rdi, rax
mov dx, word [rsp]
mov r10, qword [rsp]
mov rbp, r12
mov r12d, dword [rsp]
jmp 0x1401df279
xchg dword [rsp], eax
push word [rsp]
neg r10b
rdtsc
mov r11, qword [rsp]
call fcn.1401df354
cmp esi, dword [rcx + reloc.UnityPlayer.dll_UnityMain]
xor byte [rbx], dh
sub al, byte [rbp + 0x66]
xchg ebx, edx
xchg bx, dx
xchg al, r14b
mov r13, qword [rsp]
not bx
xchg byte [rsp + 2], r11b
xchg word [rsp + 1], bp
jmp 0x1401df2c2
xchg di, bp
inc r11b
clc
mov dword [rsp], r14d
mov r11, r13
xchg dword [rsp], ebx
jmp 0x1401df2e1
mov r10b, cl
xchg r11, rsi
mov edi, 0x855fc3d5
xchg byte [rsp], r13b
not r12b
rdtsc
jmp 0x1401df2aa

Function at 0x1401df8f8
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [rsp + 0x14], bx
add rsp, 0x1c
pop word [rsp]
jmp 0x1401df934
mov eax, dword [rsp]
xchg si, di
lea r13, [rbx + r9]
btr r12, r12
bts r11d, edx
rdtsc
jmp 0x1401df91e