joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18008d6c0
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x18008d6f0
xor eax, eax
jmp 0x18008d7b3
mov rbp, rbx
cmp word [rax], si
je 0x18008d715
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x18008d6fc
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x18008d6f8
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.18008d540
movsxd r14, eax
test eax, eax
jne 0x18008d753
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x18008d6e9
mov rcx, r14
call fcn.180080c4c
mov rdi, rax
test rax, rax
jne 0x18008d76c
xor ecx, ecx
call fcn.180080c10
jmp 0x18008d748
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.18008d540
test eax, eax
jne 0x18008d79d
mov rcx, rdi
call fcn.180080c10
jmp 0x18008d7a7
xor ecx, ecx
call fcn.180080c10
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140de91b8
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140de933f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140de91e9
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140de91cf
add dl, dl
jne 0x140de91f6
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140de9256
xor eax, eax
add dl, dl
jne 0x140de9205
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140de930d
add dl, dl
jne 0x140de9216
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140de9223
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140de9230
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140de923d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140de924a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140de91de
mov eax, 1
add dl, dl
jne 0x140de9266
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140de9273
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140de925b
sub eax, ebx
mov ebx, 1
jne 0x140de92ac
mov ecx, 1
add dl, dl
jne 0x140de928e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140de929b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140de9283
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140de91de
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140de92c8
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140de92d5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140de92bd
cmp eax, 0x7d00
jae 0x140de92fb
cmp eax, 0x500
jb 0x140de92f6
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140de91de
cmp eax, 0x7f
ja 0x140de92fe
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140de91de
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140de9332
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140de91de
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x180003f80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [rsp + 0x70]
mov rcx, qword [rsp + 0x188]
cmp eax, dword [rcx + 0x18]
jae 0x18000401c
mov rax, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0x438]
mov edx, dword [rsp + 0x70]
mov ecx, dword [rcx + rdx*4]
add rax, rcx
mov qword [rsp + 0x428], rax
mov rax, qword [rsp + 0x428]
mov ecx, dword [rsp + 0x1f8]
mov qword [rsp + 0x320], rax
mov dword [rsp + 0x23c], ecx
mov dword [rsp + 0x108], 0
mov rcx, qword [rsp + 0x320]
call fcn.180003332
mov dword [rsp + 0x238], eax
mov dword [rsp + 0xa0], 0
mov eax, dword [rsp + 0xa0]
cmp eax, dword [rsp + 0x238]
jae 0x180003fcc
mov rax, qword [rsp + 0x320]
movsxd rcx, dword [rsp + 0xa0]
mov al, byte [rax + rcx]
mov byte [rsp + 0x5c], al
mov eax, dword [rsp + 0x23c]
mov ecx, dword [rsp + 0x108]
mov dword [rsp + 0x274], eax
mov dword [rsp + 0x270], ecx
mov dword [rsp + 0x134], 0
mov dword [rsp + 0x130], 0
mov eax, dword [rsp + 0x130]
cmp eax, dword [rsp + 0x274]
jae 0x180003fa1
mov eax, dword [rsp + 0x270]
add eax, dword [rsp + 0x134]
mov dword [rsp + 0x134], eax
mov eax, dword [rsp + 0x130]
add eax, 1
mov dword [rsp + 0x130], eax
jmp 0x180003f69
mov eax, dword [rsp + 0x134]
movzx ecx, byte [rsp + 0x5c]
add eax, ecx
mov dword [rsp + 0x108], eax
mov eax, dword [rsp + 0xa0]
add eax, 1
mov dword [rsp + 0xa0], eax
jmp 0x180003f0c
mov eax, dword [rsp + 0x108]
cmp eax, dword [rsp + 0x1f4]
jne 0x18000400c
mov rax, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0x430]
mov rdx, qword [rsp + 0x440]
mov esi, dword [rsp + 0x70]
movzx edx, word [rdx + rsi*2]
mov ecx, dword [rcx + rdx*4]
add rax, rcx
mov qword [rsp + 0x2e8], rax
jmp 0x180004028
mov eax, dword [rsp + 0x70]
add eax, 1
mov dword [rsp + 0x70], eax
jmp 0x180003e8d
mov qword [rsp + 0x2e8], 0
mov rax, qword [rsp + 0x2e8]
mov qword [rsp + 0x370], rax
mov rax, qword [rsp + 0x370]
mov rcx, qword [rsp + 0x2a8]
xor edx, edx
call rax
mov dword [rsp + 0x164], eax
cmp dword [rsp + 0x164], 0
jne 0x180004067
mov byte [rsp + 0x47], 0
jmp 0x180004b8b
mov rax, qword [rsp + 0x150]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x54]
mov rcx, qword [rsp + 0x38]
mov ecx, dword [rcx + 0x24]
mov rdx, qword [rsp + 0xe8]
mov rsi, qword [rsp + 0x38]
mov esi, dword [rsi + 0x10]
mov dword [rsp + 0x1ec], eax
mov dword [rsp + 0x1e8], ecx
mov qword [rsp + 0xc0], rdx
mov dword [rsp + 0x1e4], esi
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xc0]
movsxd rcx, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp + 0x420], rax
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x420]
mov edx, dword [rsp + 0x1e4]
mov ecx, dword [rcx + rdx*8 + 0x88]
add rax, rcx
mov qword [rsp + 0x180], rax
mov rax, qword [rsp + 0xc0]
add byte [rax - 0x75], cl
mov word [rax + rax*4], fs
add dword [rax], eax
add byte [rbx + 0x1482449], cl
enter 0xffffffffffff8948, 0xffffffffffffff84
and al, 0x18
add al, 0
add byte [rax - 0x75], cl
test byte [rax + rax*8], ah
add byte [rax], al
add byte [rax - 0x75], cl
mov ecx, dword [rsp + 0x180]
mov qword [rsp + 0x2e0], 0
Function at 0x180003fc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [rsp + 0x70]
mov rcx, qword [rsp + 0x188]
cmp eax, dword [rcx + 0x18]
jae 0x18000401c
mov rax, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0x438]
mov edx, dword [rsp + 0x70]
mov ecx, dword [rcx + rdx*4]
add rax, rcx
mov qword [rsp + 0x428], rax
mov rax, qword [rsp + 0x428]
mov ecx, dword [rsp + 0x1f8]
mov qword [rsp + 0x320], rax
mov dword [rsp + 0x23c], ecx
mov dword [rsp + 0x108], 0
mov rcx, qword [rsp + 0x320]
call fcn.180003332
mov dword [rsp + 0x238], eax
mov dword [rsp + 0xa0], 0
mov eax, dword [rsp + 0xa0]
cmp eax, dword [rsp + 0x238]
jae 0x180003fcc
mov rax, qword [rsp + 0x320]
movsxd rcx, dword [rsp + 0xa0]
mov al, byte [rax + rcx]
mov byte [rsp + 0x5c], al
mov eax, dword [rsp + 0x23c]
mov ecx, dword [rsp + 0x108]
mov dword [rsp + 0x274], eax
mov dword [rsp + 0x270], ecx
mov dword [rsp + 0x134], 0
mov dword [rsp + 0x130], 0
mov eax, dword [rsp + 0x130]
cmp eax, dword [rsp + 0x274]
jae 0x180003fa1
mov eax, dword [rsp + 0x270]
add eax, dword [rsp + 0x134]
mov dword [rsp + 0x134], eax
mov eax, dword [rsp + 0x130]
add eax, 1
mov dword [rsp + 0x130], eax
jmp 0x180003f69
mov eax, dword [rsp + 0x134]
movzx ecx, byte [rsp + 0x5c]
add eax, ecx
mov dword [rsp + 0x108], eax
mov eax, dword [rsp + 0xa0]
add eax, 1
mov dword [rsp + 0xa0], eax
jmp 0x180003f0c
mov eax, dword [rsp + 0x108]
cmp eax, dword [rsp + 0x1f4]
jne 0x18000400c
mov rax, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0x430]
mov rdx, qword [rsp + 0x440]
mov esi, dword [rsp + 0x70]
movzx edx, word [rdx + rsi*2]
mov ecx, dword [rcx + rdx*4]
add rax, rcx
mov qword [rsp + 0x2e8], rax
jmp 0x180004028
mov eax, dword [rsp + 0x70]
add eax, 1
mov dword [rsp + 0x70], eax
jmp 0x180003e8d
mov qword [rsp + 0x2e8], 0
mov rax, qword [rsp + 0x2e8]
mov qword [rsp + 0x370], rax
mov rax, qword [rsp + 0x370]
mov rcx, qword [rsp + 0x2a8]
xor edx, edx
call rax
mov dword [rsp + 0x164], eax
cmp dword [rsp + 0x164], 0
jne 0x180004067
mov byte [rsp + 0x47], 0
jmp 0x180004b8b
mov rax, qword [rsp + 0x150]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x54]
mov rcx, qword [rsp + 0x38]
mov ecx, dword [rcx + 0x24]
mov rdx, qword [rsp + 0xe8]
mov rsi, qword [rsp + 0x38]
mov esi, dword [rsi + 0x10]
mov dword [rsp + 0x1ec], eax
mov dword [rsp + 0x1e8], ecx
mov qword [rsp + 0xc0], rdx
mov dword [rsp + 0x1e4], esi
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xc0]
movsxd rcx, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp + 0x420], rax
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x420]
mov edx, dword [rsp + 0x1e4]
mov ecx, dword [rcx + rdx*8 + 0x88]
add rax, rcx
mov qword [rsp + 0x180], rax
mov rax, qword [rsp + 0xc0]
add byte [rax - 0x75], cl
mov word [rax + rax*4], fs
add dword [rax], eax
add byte [rbx + 0x1482449], cl
enter 0xffffffffffff8948, 0xffffffffffffff84
and al, 0x18
add al, 0
add byte [rax - 0x75], cl
test byte [rax + rax*8], ah
add byte [rax], al
add byte [rax - 0x75], cl
mov ecx, dword [rsp + 0x180]
mov qword [rsp + 0x2e0], 0
Function at 0x1800041b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x10c], 0
invalid
invalid
mov word [rax + rbp], fs

Function at 0x1800041e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [rsp + 0xa4]
cmp eax, dword [rsp + 0x240]
jae 0x18000429a
add byte [rbx], bh
test byte [rax + rax*2], ah
add al, byte [rax]
add byte [rdi], cl
sub dword [rax + rax - 0x74b80000], 0xffffff84
and al, 0x28
add eax, dword [rax]
add byte [rax + 0x63], cl
mov word [rsp + riz*4], fs
add byte [rax], al
add byte [rdx + 0x44880804], cl
and al, 0x5d
mov rax, qword [rsp + 0x328]
movsxd rcx, dword [rsp + 0xa4]
mov al, byte [rax + rcx]
mov byte [rsp + 0x5d], al
mov eax, dword [rsp + 0x244]
mov ecx, dword [rsp + 0x10c]
add dword [rax], eax
add byte [rcx + 0x26c2484], cl
add byte [rax], al
mov dword [rsp + 0x268], ecx
mov dword [rsp + 0x12c], 0
mov dword [rsp + 0x128], 0
add dword [rax], eax
add byte [rax], al
add byte [rax], al
invalid
mov eax, dword [rsp + 0x128]
cmp eax, dword [rsp + 0x26c]
jae 0x18000426f
mov eax, dword [rsp + 0x268]
add eax, dword [rsp + 0x12c]
mov dword [rsp + 0x12c], eax
mov eax, dword [rsp + 0x128]
add eax, 1
mov dword [rsp + 0x128], eax
jmp 0x180004237
mov eax, dword [rsp + 0x12c]
movzx ecx, byte [rsp + 0x5d]
add eax, ecx
mov dword [rsp + 0x10c], eax
or al, 1
add byte [rax], al
mov eax, dword [rsp + 0xa4]
add eax, 1
mov dword [rsp + 0xa4], eax
jmp 0x1800041da
mov eax, dword [rsp + 0x10c]
cmp eax, dword [rsp + 0x1e8]
jne 0x1800042da
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x408]
mov rdx, qword [rsp + 0x418]
add byte [rax], al
mov esi, dword [rsp + 0x6c]
movzx edx, word [rdx + rsi*2]
mov ecx, dword [rcx + rdx*4]
add rax, rcx
mov qword [rsp + 0x2e0], rax
jmp 0x1800042f6
mov eax, dword [rsp + 0x6c]
add eax, 1
mov dword [rsp + 0x6c], eax
jmp 0x18000415b
mov rax, qword [rsp + 0x2e0]
mov qword [rsp + 0x368], rax
mov dword [rsp + 0x160], 0
add byte [rax - 0x75], cl
test byte [rax + rbp*2], ah
add eax, dword [rax]
add byte [rbx + rcx*4 - 0x7c], al
and al, 0x64
add dword [rax], eax
add byte [rax - 0x75], cl
push rsp
and al, 0x48
mov rcx, qword [rsp + 0x2a8]
lea r9, [rsp + 0x160]
mov qword [rsp + 0x20], 0
call rax
rol byte [rbx + 0x27500f8], 1
jmp 0x180004348
mov rax, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x160]
invalid
add dword [rax], eax
add byte [rax + 1], cl
enter 0xffffffffffff8948, 0xffffffffffffff84
and al, 0xb0
add dword [rax], eax
add byte [rax - 0x75], cl
mov eax, dword [rsp + 0x38]
Function at 0x180004230
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [rsp + 0xa4]
cmp eax, dword [rsp + 0x240]
jae 0x18000429a
add byte [rbx], bh
test byte [rax + rax*2], ah
add al, byte [rax]
add byte [rdi], cl
sub dword [rax + rax - 0x74b80000], 0xffffff84
and al, 0x28
add eax, dword [rax]
add byte [rax + 0x63], cl
mov word [rsp + riz*4], fs
add byte [rax], al
add byte [rdx + 0x44880804], cl
and al, 0x5d
mov rax, qword [rsp + 0x328]
movsxd rcx, dword [rsp + 0xa4]
mov al, byte [rax + rcx]
mov byte [rsp + 0x5d], al
mov eax, dword [rsp + 0x244]
mov ecx, dword [rsp + 0x10c]
add dword [rax], eax
add byte [rcx + 0x26c2484], cl
add byte [rax], al
mov dword [rsp + 0x268], ecx
mov dword [rsp + 0x12c], 0
mov dword [rsp + 0x128], 0
add dword [rax], eax
add byte [rax], al
add byte [rax], al
invalid
mov eax, dword [rsp + 0x128]
cmp eax, dword [rsp + 0x26c]
jae 0x18000426f
mov eax, dword [rsp + 0x268]
add eax, dword [rsp + 0x12c]
mov dword [rsp + 0x12c], eax
mov eax, dword [rsp + 0x128]
add eax, 1
mov dword [rsp + 0x128], eax
jmp 0x180004237
mov eax, dword [rsp + 0x12c]
movzx ecx, byte [rsp + 0x5d]
add eax, ecx
mov dword [rsp + 0x10c], eax
or al, 1
add byte [rax], al
mov eax, dword [rsp + 0xa4]
add eax, 1
mov dword [rsp + 0xa4], eax
jmp 0x1800041da
mov eax, dword [rsp + 0x10c]
cmp eax, dword [rsp + 0x1e8]
jne 0x1800042da
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x408]
mov rdx, qword [rsp + 0x418]
add byte [rax], al
mov esi, dword [rsp + 0x6c]
movzx edx, word [rdx + rsi*2]
mov ecx, dword [rcx + rdx*4]
add rax, rcx
mov qword [rsp + 0x2e0], rax
jmp 0x1800042f6
mov eax, dword [rsp + 0x6c]
add eax, 1
mov dword [rsp + 0x6c], eax
jmp 0x18000415b
mov rax, qword [rsp + 0x2e0]
mov qword [rsp + 0x368], rax
mov dword [rsp + 0x160], 0
add byte [rax - 0x75], cl
test byte [rax + rbp*2], ah
add eax, dword [rax]
add byte [rbx + rcx*4 - 0x7c], al
and al, 0x64
add dword [rax], eax
add byte [rax - 0x75], cl
push rsp
and al, 0x48
mov rcx, qword [rsp + 0x2a8]
lea r9, [rsp + 0x160]
mov qword [rsp + 0x20], 0
call rax
rol byte [rbx + 0x27500f8], 1
jmp 0x180004348
mov rax, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x160]
invalid
add dword [rax], eax
add byte [rax + 1], cl
enter 0xffffffffffff8948, 0xffffffffffffff84
and al, 0xb0
add dword [rax], eax
add byte [rax - 0x75], cl
mov eax, dword [rsp + 0x38]
Function at 0x180004280
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [rsp + 0xa4]
cmp eax, dword [rsp + 0x240]
jae 0x18000429a
add byte [rbx], bh
test byte [rax + rax*2], ah
add al, byte [rax]
add byte [rdi], cl
sub dword [rax + rax - 0x74b80000], 0xffffff84
and al, 0x28
add eax, dword [rax]
add byte [rax + 0x63], cl
mov word [rsp + riz*4], fs
add byte [rax], al
add byte [rdx + 0x44880804], cl
and al, 0x5d
mov rax, qword [rsp + 0x328]
movsxd rcx, dword [rsp + 0xa4]
mov al, byte [rax + rcx]
mov byte [rsp + 0x5d], al
mov eax, dword [rsp + 0x244]
mov ecx, dword [rsp + 0x10c]
add dword [rax], eax
add byte [rcx + 0x26c2484], cl
add byte [rax], al
mov dword [rsp + 0x268], ecx
mov dword [rsp + 0x12c], 0
mov dword [rsp + 0x128], 0
add dword [rax], eax
add byte [rax], al
add byte [rax], al
invalid
mov eax, dword [rsp + 0x128]
cmp eax, dword [rsp + 0x26c]
jae 0x18000426f
mov eax, dword [rsp + 0x268]
add eax, dword [rsp + 0x12c]
mov dword [rsp + 0x12c], eax
mov eax, dword [rsp + 0x128]
add eax, 1
mov dword [rsp + 0x128], eax
jmp 0x180004237
mov eax, dword [rsp + 0x12c]
movzx ecx, byte [rsp + 0x5d]
add eax, ecx
mov dword [rsp + 0x10c], eax
or al, 1
add byte [rax], al
mov eax, dword [rsp + 0xa4]
add eax, 1
mov dword [rsp + 0xa4], eax
jmp 0x1800041da
mov eax, dword [rsp + 0x10c]
cmp eax, dword [rsp + 0x1e8]
jne 0x1800042da
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x408]
mov rdx, qword [rsp + 0x418]
add byte [rax], al
mov esi, dword [rsp + 0x6c]
movzx edx, word [rdx + rsi*2]
mov ecx, dword [rcx + rdx*4]
add rax, rcx
mov qword [rsp + 0x2e0], rax
jmp 0x1800042f6
mov eax, dword [rsp + 0x6c]
add eax, 1
mov dword [rsp + 0x6c], eax
jmp 0x18000415b
mov rax, qword [rsp + 0x2e0]
mov qword [rsp + 0x368], rax
mov dword [rsp + 0x160], 0
add byte [rax - 0x75], cl
test byte [rax + rbp*2], ah
add eax, dword [rax]
add byte [rbx + rcx*4 - 0x7c], al
and al, 0x64
add dword [rax], eax
add byte [rax - 0x75], cl
push rsp
and al, 0x48
mov rcx, qword [rsp + 0x2a8]
lea r9, [rsp + 0x160]
mov qword [rsp + 0x20], 0
call rax
rol byte [rbx + 0x27500f8], 1
jmp 0x180004348
mov rax, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x160]
invalid
add dword [rax], eax
add byte [rax + 1], cl
enter 0xffffffffffff8948, 0xffffffffffffff84
and al, 0xb0
add dword [rax], eax
add byte [rax - 0x75], cl
mov eax, dword [rsp + 0x38]
Function at 0x1800042c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [rsp + 0xa4]
cmp eax, dword [rsp + 0x240]
jae 0x18000429a
add byte [rbx], bh
test byte [rax + rax*2], ah
add al, byte [rax]
add byte [rdi], cl
sub dword [rax + rax - 0x74b80000], 0xffffff84
and al, 0x28
add eax, dword [rax]
add byte [rax + 0x63], cl
mov word [rsp + riz*4], fs
add byte [rax], al
add byte [rdx + 0x44880804], cl
and al, 0x5d
mov rax, qword [rsp + 0x328]
movsxd rcx, dword [rsp + 0xa4]
mov al, byte [rax + rcx]
mov byte [rsp + 0x5d], al
mov eax, dword [rsp + 0x244]
mov ecx, dword [rsp + 0x10c]
add dword [rax], eax
add byte [rcx + 0x26c2484], cl
add byte [rax], al
mov dword [rsp + 0x268], ecx
mov dword [rsp + 0x12c], 0
mov dword [rsp + 0x128], 0
add dword [rax], eax
add byte [rax], al
add byte [rax], al
invalid
mov eax, dword [rsp + 0x128]
cmp eax, dword [rsp + 0x26c]
jae 0x18000426f
mov eax, dword [rsp + 0x268]
add eax, dword [rsp + 0x12c]
mov dword [rsp + 0x12c], eax
mov eax, dword [rsp + 0x128]
add eax, 1
mov dword [rsp + 0x128], eax
jmp 0x180004237
mov eax, dword [rsp + 0x12c]
movzx ecx, byte [rsp + 0x5d]
add eax, ecx
mov dword [rsp + 0x10c], eax
or al, 1
add byte [rax], al
mov eax, dword [rsp + 0xa4]
add eax, 1
mov dword [rsp + 0xa4], eax
jmp 0x1800041da
mov eax, dword [rsp + 0x10c]
cmp eax, dword [rsp + 0x1e8]
jne 0x1800042da
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x408]
mov rdx, qword [rsp + 0x418]
add byte [rax], al
mov esi, dword [rsp + 0x6c]
movzx edx, word [rdx + rsi*2]
mov ecx, dword [rcx + rdx*4]
add rax, rcx
mov qword [rsp + 0x2e0], rax
jmp 0x1800042f6
mov eax, dword [rsp + 0x6c]
add eax, 1
mov dword [rsp + 0x6c], eax
jmp 0x18000415b
mov rax, qword [rsp + 0x2e0]
mov qword [rsp + 0x368], rax
mov dword [rsp + 0x160], 0
add byte [rax - 0x75], cl
test byte [rax + rbp*2], ah
add eax, dword [rax]
add byte [rbx + rcx*4 - 0x7c], al
and al, 0x64
add dword [rax], eax
add byte [rax - 0x75], cl
push rsp
and al, 0x48
mov rcx, qword [rsp + 0x2a8]
lea r9, [rsp + 0x160]
mov qword [rsp + 0x20], 0
call rax
rol byte [rbx + 0x27500f8], 1
jmp 0x180004348
mov rax, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x160]
invalid
add dword [rax], eax
add byte [rax + 1], cl
enter 0xffffffffffff8948, 0xffffffffffffff84
and al, 0xb0
add dword [rax], eax
add byte [rax - 0x75], cl
mov eax, dword [rsp + 0x38]
Function at 0x180004310
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [rsp + 0xa4]
cmp eax, dword [rsp + 0x240]
jae 0x18000429a
add byte [rbx], bh
test byte [rax + rax*2], ah
add al, byte [rax]
add byte [rdi], cl
sub dword [rax + rax - 0x74b80000], 0xffffff84
and al, 0x28
add eax, dword [rax]
add byte [rax + 0x63], cl
mov word [rsp + riz*4], fs
add byte [rax], al
add byte [rdx + 0x44880804], cl
and al, 0x5d
mov rax, qword [rsp + 0x328]
movsxd rcx, dword [rsp + 0xa4]
mov al, byte [rax + rcx]
mov byte [rsp + 0x5d], al
mov eax, dword [rsp + 0x244]
mov ecx, dword [rsp + 0x10c]
add dword [rax], eax
add byte [rcx + 0x26c2484], cl
add byte [rax], al
mov dword [rsp + 0x268], ecx
mov dword [rsp + 0x12c], 0
mov dword [rsp + 0x128], 0
add dword [rax], eax
add byte [rax], al
add byte [rax], al
invalid
mov eax, dword [rsp + 0x128]
cmp eax, dword [rsp + 0x26c]
jae 0x18000426f
mov eax, dword [rsp + 0x268]
add eax, dword [rsp + 0x12c]
mov dword [rsp + 0x12c], eax
mov eax, dword [rsp + 0x128]
add eax, 1
mov dword [rsp + 0x128], eax
jmp 0x180004237
mov eax, dword [rsp + 0x12c]
movzx ecx, byte [rsp + 0x5d]
add eax, ecx
mov dword [rsp + 0x10c], eax
or al, 1
add byte [rax], al
mov eax, dword [rsp + 0xa4]
add eax, 1
mov dword [rsp + 0xa4], eax
jmp 0x1800041da
mov eax, dword [rsp + 0x10c]
cmp eax, dword [rsp + 0x1e8]
jne 0x1800042da
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x408]
mov rdx, qword [rsp + 0x418]
add byte [rax], al
mov esi, dword [rsp + 0x6c]
movzx edx, word [rdx + rsi*2]
mov ecx, dword [rcx + rdx*4]
add rax, rcx
mov qword [rsp + 0x2e0], rax
jmp 0x1800042f6
mov eax, dword [rsp + 0x6c]
add eax, 1
mov dword [rsp + 0x6c], eax
jmp 0x18000415b
mov rax, qword [rsp + 0x2e0]
mov qword [rsp + 0x368], rax
mov dword [rsp + 0x160], 0
add byte [rax - 0x75], cl
test byte [rax + rbp*2], ah
add eax, dword [rax]
add byte [rbx + rcx*4 - 0x7c], al
and al, 0x64
add dword [rax], eax
add byte [rax - 0x75], cl
push rsp
and al, 0x48
mov rcx, qword [rsp + 0x2a8]
lea r9, [rsp + 0x160]
mov qword [rsp + 0x20], 0
call rax
rol byte [rbx + 0x27500f8], 1
jmp 0x180004348
mov rax, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x160]
invalid
add dword [rax], eax
add byte [rax + 1], cl
enter 0xffffffffffff8948, 0xffffffffffffff84
and al, 0xb0
add dword [rax], eax
add byte [rax - 0x75], cl
mov eax, dword [rsp + 0x38]

Function at 0x180004410
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [rax], 0
add byte [rax - 0x7d], cl
rol byte [rax + rcx*2], 0x89
test byte [rax + rax*4], ah
add byte [rax], al
add bl, ch
mov dh, 0x48
mov eax, dword [rsp + 0x38]