joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000d144
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000d18e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000d18e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000d18e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000d18e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000d18e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000d190
xor al, al
add rsp, 0x28
ret

Function at 0x14000fe64
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000fed3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000fed3
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000fed3
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000fed3
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000fed3
cmp dword [rcx + 0x84], 0xe
jbe 0x14000fed3
cmp dword [rcx + 0xf8], 0
je 0x14000fed3
mov ecx, ebx
call fcn.14000ff84
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14000fd60
nop
cmp dword [rbp + 0x20], 0
je 0x14000ff21
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000ff2c
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000fe64

Function at 0x140010068
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000fed3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000fed3
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000fed3
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000fed3
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000fed3
cmp dword [rcx + 0x84], 0xe
jbe 0x14000fed3
cmp dword [rcx + 0xf8], 0
je 0x14000fed3
mov ecx, ebx
call fcn.14000ff84
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14000fd60
nop
cmp dword [rbp + 0x20], 0
je 0x14000ff21
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000ff2c
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000fe64
Function at 0x140019478
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400194ff
mov rsi, rbx
cmp word [rax], bp
je 0x1400194be
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400194a8
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400194a4
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140016ca8
mov rdi, rax
test rax, rax
je 0x1400194ec
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140020090
mov rbp, rdi
xor ecx, ecx
call fcn.140015db8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14001b66c
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14001b682
mov al, 1
jmp 0x14001b6e2
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14001b693
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14001b6e0
mov ecx, dword [rcx + 0x18]
nop
call fcn.1400197c0
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001b6e0
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14001b6e0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14001b6e0
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14001b6e2
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x14001f900
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14001f928
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14001f928
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x18003ade0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r14
sub rsp, 0x50
lea r14d, [rcx + 0x438]
mov rbp, r8
mov rsi, rdx
mov ebx, ecx
cmp ecx, r14d
jae 0x18003b08e
mov qword [rsp + 0x70], rdi
mov rdi, qword [rsp + 0x88]
mov qword [rsp + 0x78], r15
xor r15d, r15d
nop word [rax + rax]
cmp ebx, 0x2a7
ja 0x18003afda
je 0x18003afce
cmp ebx, 0x17b
ja 0x18003af2c
je 0x18003af20
mov eax, ebx
sub eax, 0xc7
je 0x18003af01
sub eax, 0x11
je 0x18003aee5
sub eax, 0x2b
je 0x18003ae90
cmp eax, 0x3c
jne 0x18003b078
mov ebx, 0x13f
mov r9, rsi
mov qword [rsp + 0x28], r15
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], r15
mov r8d, 0xe5
call fcn.1800c8790
jmp 0x18003b078
mov ebx, 0x5e
mov eax, ebx
sub eax, 0x5e
je 0x18003aeb0
cmp eax, 1
jne 0x18003aedc
cmp dword [rdi + 0x1c], r15d
je 0x18003aedc
mov rcx, qword [rdi + 0x20]
call qword [rbp + 0x10]
jmp 0x18003aedc
mov qword [rsp + 0x30], r15
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], r15
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 0x65
xor edx, edx
call fcn.1800c37c0
mov rdi, rax
test rax, rax
je 0x18003ae68
inc ebx
cmp ebx, 0x60
jb 0x18003ae95
jmp 0x18003ae90
mov r9d, 0xc2
mov qword [rsp + 0x20], r15
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.18000bc30
jmp 0x18003b078
lea r8, [rsi + 0x28]
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x40]
mov edx, 0x103
xor ecx, ecx
call fcn.18000f420
jmp 0x18003b078
mov byte [rsi + 0x103], r15b
jmp 0x18003b078
mov eax, ebx
sub eax, 0x1b7
je 0x18003afc2
sub eax, 0x3c
je 0x18003af9c
sub eax, 0x3c
je 0x18003af93
cmp eax, 0x3c
jne 0x18003b078
lea rcx, [rsi + 0xa0]
mov dword [rsp + 0x28], 0x56
xor r9d, r9d
mov qword [rsp + 0x20], r15
xor r8d, r8d
xor edx, edx
call fcn.180074920
lea rcx, [rsi + 0xd0]
mov dword [rsp + 0x28], 0x56
xor r9d, r9d
mov qword [rsp + 0x20], r15
xor r8d, r8d
xor edx, edx
call fcn.180074920
jmp 0x18003b078
lea r9, [rsi + 0x78]
jmp 0x18003ae70
lea r9, [rsi + 0x28]
mov qword [rsp + 0x28], r15
xor edx, edx
mov qword [rsp + 0x20], r15
xor ecx, ecx
mov r8d, 0xe5
call fcn.1800c8790
lea r9, [rsi + 0x50]
jmp 0x18003ae70
lea r9, [rsi + 0x108]
jmp 0x18003ae70
mov qword [rsi + 0x130], r15
jmp 0x18003b078
cmp ebx, 0x3d3
ja 0x18003b044
je 0x18003b034
mov eax, ebx
sub eax, 0x2e3
je 0x18003b024
sub eax, 0x3c
je 0x18003b018
sub eax, 0x3c
je 0x18003b00f
cmp eax, 0x3c
jne 0x18003b078
mov rcx, qword [rsi + 0x148]
call qword [rbp + 0x10]
mov qword [rsi + 0x148], r15
jmp 0x18003b078
mov qword [rsi + 0x160], r15
jmp 0x18003b078
mov rcx, qword [rsi + 0x160]
call qword [rbp + 0x10]
jmp 0x18003b078
mov qword [rsi + 0x138], r15
mov byte [rsi + 0x140], r15b
jmp 0x18003b078
mov dword [rsi + 0x15c], r15d
mov dword [rsi + 0x154], r15d
jmp 0x18003b078
mov eax, ebx
sub eax, 0x40f
je 0x18003b071
sub eax, 0x3c
je 0x18003b061
cmp eax, 0x3c
jne 0x18003b078
mov word [rsi + 0x101], r15w
jmp 0x18003b078
mov dword [rsi + 0x150], r15d
mov byte [rsi + 0x100], 1
jmp 0x18003b078
mov dword [rsi + 0x158], r15d
add ebx, 0x3c
cmp ebx, r14d
jb 0x18003ae20
mov r15, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rsi
pop rbp
ret
Function at 0x18004a810
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
lea r15d, [r9 + 0xb]
mov ebp, r9d
mov rsi, r8
mov rdi, rdx
cmp r9d, r15d
jae 0x18004a8b0
mov r12, qword [rsp + 0x98]
lea r14d, [r9 - 0x89]
lea r9, [0x180477410]
xor r13d, r13d
lea r10, [0x180000000]
lea rdx, [0x18004a7e0]
lea r8, [0x1804775a0]
nop dword [rax]
cmp r14d, 0x2c
ja case.0x18004a88e.11
movzx eax, byte [r10 + r14 + 0x4ab08]
mov ecx, dword [r10 + rax*4 + 0x4aad8]
add rcx, r10
jmp rcx
cmp byte [r12], r13b
je case.0x18004a88e.11
mov ebx, 0xa7
nop
cmp ebx, 0xa7
je 0x18004a8d5
cmp ebx, 0x7c99
jne 0x18004a8eb
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov r8d, 0x13
mov rdx, rsi
mov rcx, rdi
call fcn.1800b9e80
mov qword [rsp + 0x38], r13
add ebx, 0x7bf2
cmp ebx, 0xf7e4
jbe 0x18004a8a0
jmp 0x18004aa40
test rsi, rsi
jne case.0x18004a88e.11
mov eax, 0xf7
nop dword [rax]
cmp eax, 0xf7
je 0x18004a920
cmp eax, 0x153a
je 0x18004a8b0
jmp 0x18004a925
mov qword [rsp + 0x38], r13
add eax, 0x1443
cmp eax, 0x2886
jbe 0x18004a910
jmp case.0x18004a88e.11
mov dword [0x4000214], 0xffffffff
jmp case.0x18004a88e.11
mov dword [0x4000208], 1
jmp case.0x18004a88e.11
mov eax, dword [rsi]
cmp eax, 0xf
je 0x18004a967
cmp eax, 0x1b
je 0x18004a987
jmp case.0x18004a88e.11
mov eax, 0xcc
nop dword [rax]
cmp eax, 0xcc
je 0x18004aa6f
add eax, 0x56dc
cmp eax, 0x56dc
jbe 0x18004a970
mov ecx, 0x59
nop dword [rax]
cmp ecx, 0x59
je 0x18004a9a3
cmp ecx, 0x10e
je 0x18004a8b0
jmp 0x18004a9b5
mov rax, qword [0x180476500]
mov qword [rdi], rax
mov dword [rsp + 0x38], GetAcceptLanguagesW
add ecx, 0xb5
cmp ecx, 0x1c3
jb 0x18004a990
jmp case.0x18004a88e.11
mov dword [0x4000210], r13d
jmp case.0x18004a88e.11
mov ecx, 0x11
nop word [rax + rax]
mov rax, r9
cmp ecx, 0x11
je 0x18004a9f6
cmp ecx, 0xb3
jne 0x18004a9f9
mov dword [rax + 8], r13d
jmp 0x18004a9f9
mov qword [rax], rdx
add rax, 0x10
cmp rax, r8
jl 0x18004a9e3
add ecx, 0xa2
cmp ecx, 0x155
jb 0x18004a9e0
jmp case.0x18004a88e.11
mov eax, dword [rdi]
lea r8, [rsp + 0x88]
or eax, 0x70
mov dword [rsp + 0x88], 1
shl eax, 0x10
lea rcx, [rsp + 0x30]
mov edx, 0xb7
mov dword [rsp + 0x30], eax
call fcn.1800e2fe0
lea r10, [0x180000000]
lea r9, [0x180477410]
lea r8, [0x1804775a0]
lea rdx, [0x18004a7e0]
inc ebp
inc r14d
cmp ebp, r15d
jb 0x18004a870
jmp 0x18004a8b0
mov dword [rsp + 0x38], GetAcceptLanguagesW
jmp 0x18004a8b0
mov eax, dword [rsi]
lea r8, [rsp + 0x88]
mov r9d, 0x5a
mov dword [rsp + 0x88], eax
xor edx, edx
mov qword [rsp + 0x20], r13
mov rcx, rdi
call fcn.180030580
mov dword [rsp + 0x38], eax
jmp 0x18004a8b0
xor edx, edx
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 0x59]
call fcn.18004f870
mov byte [rsp + 0x38], al
jmp 0x18004a8b0
mov rax, rsi
jmp 0x18004a8b5
Function at 0x180058330
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
movzx ebx, byte [rsp + 0x50]
lea ebp, [rcx + 6]
mov r14, rdx
mov edi, ecx
cmp ecx, ebp
jae case.0x180058377.10
lea esi, [rcx - 0x3c]
lea r15, [0x180000000]
cmp esi, 0xa
ja case.0x180058377.1
mov ecx, dword [r15 + rsi*4 + 0x58414]
add rcx, r15
jmp rcx
cmp qword [r14], 0
jne case.0x180058377.1
xor al, al
jmp 0x1800583f8
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 0x18]
call fcn.1800999e0
mov word [0x180472364], ax
jmp case.0x180058377.1
mov bl, 1
jmp case.0x180058377.1
mov r9d, 0x9d
mov dword [rsp + 0x50], 1
xor r8d, r8d
lea rcx, [rsp + 0x50]
mov rdx, r14
call fcn.18005b1f0
jmp case.0x180058377.1
mov qword [rsp + 0x28], 0
lea r8, [0x1800113a0]
mov r9, r14
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [r14], rax
inc edi
inc esi
cmp edi, ebp
jb 0x180058367
movzx eax, bl
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x18007dea0
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
imul r14d, ecx, 0x47c
mov rdi, r9
mov rbp, r8
mov r15, rdx
mov esi, ecx
mov ebx, ecx
cmp ecx, r14d
ja 0x18007dfc0
lea r13, [0x18010e210]
xor r12d, r12d
cmp ebx, 0xcc
ja 0x18007df5d
je 0x18007df8f
cmp ebx, 0x29
je 0x18007df47
cmp ebx, 0x46
je 0x18007df2c
cmp ebx, 0x64
jne 0x18007df7c
movzx eax, byte [r15]
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x28], rdi
xor r9d, r9d
mov r8, rbp
mov byte [rsp + 0x70], al
xor edx, edx
mov dword [rsp + 0x20], 0x49
call fcn.1800dd0d0
jmp 0x18007dfbc
lea r9, [rsp + 0x70]
mov r8, rdi
mov edx, 0x7e
mov rcx, rbp
call fcn.180074ef0
mov byte [rsp + 0x30], al
jmp 0x18007df7c
movzx eax, byte [rdi]
mov ecx, eax
cmp al, 0x7f
jbe 0x18007df58
mov ecx, dword [r13 + rax*4 - 0x200]
mov dword [rbp + 0xc], ecx
jmp 0x18007df7c
cmp ebx, 0x1a6d
je 0x18007df77
cmp ebx, 0x2d1e
je 0x18007dfc0
cmp ebx, 0x34b1
je 0x18007dfc0
jmp 0x18007df7c
mov dword [rsp + 0x30], r12d
imul eax, esi, 0xa4
add ebx, eax
cmp ebx, r14d
jbe 0x18007dee3
jmp 0x18007dfc0
mov eax, 0x2a
cmp eax, 0x2a
je 0x18007dfa7
add eax, 0x9a
cmp eax, 0xc4
jb 0x18007df94
jmp 0x18007dfc0
xor edx, edx
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 0x59]
call fcn.18004f870
mov byte [rsp + 0x30], al
mov eax, dword [rsp + 0x30]
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1800d86b0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
movzx ebx, byte [rsp + 0x60]
lea ebp, [rcx + 0xb]
mov r15, r8
mov r14, rdx
mov edi, ecx
cmp ecx, ebp
jae case.0x1800d8710.10
mov rdx, qword [rsp + 0x78]
lea esi, [rcx - 0x4b]
lea r12, [0x180000000]
mov r8d, 0xe0ff
cmp esi, 0x3b
ja case.0x1800d8710.11
movzx eax, byte [r12 + rsi + 0xd8844]
mov ecx, dword [r12 + rax*4 + 0xd8814]
add rcx, r12
jmp rcx
movsxd rax, dword [r14]
mov rcx, qword [r12 + rax*8 + 0x472200]
movzx eax, word [r15]
shl ax, 8
or word [rcx], ax
jmp case.0x1800d8710.11
mov qword [0x180476398], r14
mov qword [r14 + 0x80], r15
jmp case.0x1800d8710.11
mov qword [rsp + 0x28], 0
lea r8, [0x1800162e0]
mov r9, r14
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
je 0x1800d8810
mov r8d, 0xe0ff
jmp case.0x1800d8710.11
mov rcx, qword [r14]
mov rax, qword [r15]
mov qword [rcx + 0xc0], rax
jmp case.0x1800d8710.11
movzx eax, word [0x1804775a8]
mov word [0x1804775ac], ax
mov ax, word [0x9fffffe]
not ax
mov word [0x1804775a8], ax
jmp case.0x1800d8710.11
mov bl, 1
jmp case.0x1800d8710.11
mov rcx, qword [r14]
mov rax, qword [r15]
mov qword [rcx + 0xd0], rax
jmp case.0x1800d8710.11
movsxd rax, dword [r14]
mov rax, qword [r12 + rax*8 + 0x472200]
and word [rax], r8w
jmp case.0x1800d8710.11
mov rax, rdx
xchg qword [0x1804763a0], rax
jmp case.0x1800d8710.11
mov dword [0x4000504], 0
inc edi
inc esi
cmp edi, ebp
jb 0x1800d86f3
movzx eax, bl
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
jmp 0x1800d87f4
Function at 0x1400010cc
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x38
lea rcx, str.Launching_Pixel_Gun_3D_via_Steam...
call fcn.1400014c0
mov dword [rsp + 0x28], 1
lea r8, str.steam:__rungameid_2524890
and qword [rsp + 0x20], 0
lea rdx, str.open
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
add rsp, 0x38
ret
Function at 0x1400013b4
Capabilities:
Get common file path
Set console window title

Disassembly:
push rbx
sub rsp, 0x140
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x130], rax
lea rcx, str.PG3D_Simple_DLL_Injector
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea rdx, [0x1400033fc]
lea rcx, [rsp + 0x20]
call fcn.1400014f8
lea rdx, str.BoolPG.dll
lea rcx, [rsp + 0x20]
call fcn.1400014f8
lea rcx, [rsp + 0x20]
call fcn.1400010b4
xor ebx, ebx
test al, al
jne 0x140001442
call fcn.140001508
lea rcx, str.DLL_file_not_found.
call fcn.140001540
lea rcx, str.Ensure_that_the_DLL_is_in_the_same_folder_as_the_injector.
call fcn.1400014c0
mov ebx, 1
jmp 0x1400014a0
lea rcx, str.Checking_if_Pixel_Gun_3D_is_running...
call fcn.1400014c0
lea rdx, [rsp + 0x20]
call fcn.140001108
test al, al
jne 0x140001494
lea rcx, str.Pixel_Gun_3D_not_found._Launching_the_game...
call fcn.140001540
call fcn.1400010cc
jmp 0x140001486
lea rcx, str.Waiting_for_Pixel_Gun_3D_to_start...
call fcn.140001540
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x20]
call fcn.140001108
test al, al
je 0x14000146f
lea rcx, str.DLL_injected_successfully.
call fcn.1400014c0
call fcn.140001364
mov eax, ebx
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.140001590
add rsp, 0x140
pop rbx
ret

Function at 0x140001e50
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001e9a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001e9a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001e9a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001e9a
cmp dword [rcx + 0x84], 0xe
jbe 0x140001e9a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001e9c
xor al, al
add rsp, 0x28
ret
Function at 0x412c40
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x412dcb
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x005c9b30]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x412ca5
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x412cb4
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x412cd3
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x412ce3
cmp rbx, 0x1000
jae 0x412cab
jmp 0x412d4d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x412cf5
xor edx, edx
jmp 0x412d44
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x005c9b30]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x412cd9
jmp 0x412cc8
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x005c9b30]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call sym.runtime.printlock
lea rax, [0x004d0b58]
mov ebx, 0x18
nop dword [rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x004d0fc7]
mov ebx, 0x19
nop dword [rax + rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x30]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x004d33c5]
mov ebx, 0x21
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.runtime.sysUnusedOS
Function at 0x412e00
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x413026
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x005c9b30]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x412e73
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x412e82
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x412ea5
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x412eb5
cmp rbx, 0x1000
jae 0x412e79
nop
jmp 0x412f38
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x412ecd
xor esi, esi
jmp 0x412f2a
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x005c9b30]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x412eab
jmp 0x412e96
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x005c9b30]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x412fc0
nop dword [rax + rax]
call sym.runtime.printlock
lea rax, [0x004d0fe0]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call sym.runtime.printuint
lea rax, [0x004d0fc7]
mov ebx, 0x19
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
call sym.runtime.printuint
nop
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x004cdae2]
mov ebx, 0xd
call sym.runtime.throw
nop dword [rax + rax]
cmp eax, 0x5af
je 0x412f60
call sym.runtime.printlock
lea rax, [0x004d0fe0]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x004d0fc7]
mov ebx, 0x19
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
nop dword [rax]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x004d2c0b]
mov ebx, 0x1f
nop dword [rax + rax]
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp sym.runtime.sysUsedOS