joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005f10
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x38
mov rdi, rcx
mov dword [rsp + 0x20], 0
call fcn.140002690
mov rcx, rax
test rax, rax
je 0x14000611e
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x70], rax
call fcn.140002690
mov rcx, rax
test rax, rax
je 0x140006129
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
call fcn.140002690
mov rcx, rax
test rax, rax
je 0x140006113
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi], rax
mov dword [rsp + 0x20], 1
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x70]
call fcn.140006140
mov r8d, 4
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x68]
call fcn.1400090f0
nop
lea rbp, str.beta
mov rdx, rbp
mov rcx, qword [rax]
call fcn.14002bd88
test eax, eax
sete sil
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov rbx, 0xffffffffffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140005ff0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
test sil, sil
je 0x140006023
mov rdx, rbp
lea rcx, [0x14004dfb0]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rax, rbx
nop dword [rax + rax]
inc rax
cmp word [rbp + rax*2], 0
jne 0x140006010
mov rdx, rbp
jmp 0x1400060c0
mov r8d, 2
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x68]
call fcn.1400090f0
nop
lea rbp, [0x14004dd54]
mov rdx, rbp
mov rcx, qword [rax]
call fcn.14002bd88
test eax, eax
sete sil
mov rdx, qword [rsp + 0x28]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000606f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
lea rcx, [0x14004dfb0]
test sil, sil
je 0x1400060a0
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rax, rbx
nop word [rax + rax]
inc rax
cmp word [rbp + rax*2], 0
jne 0x140006090
mov rdx, rbp
jmp 0x1400060c0
lea rsi, str.release
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rax, rbx
inc rax
cmp word [rsi + rax*2], 0
jne 0x1400060b3
mov rdx, rsi
mov r8d, eax
mov rcx, rdi
call fcn.140009d40
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400060eb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x140006107
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rax, rdi
add rsp, 0x38
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x80004005
call fcn.140002530
nop
mov ecx, 0x80004005
call fcn.140002530
nop
mov ecx, 0x80004005
call fcn.140002530
int3
Function at 0x140006fc0
Capabilities:
Check if file exists
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rbx, rdx
mov rbp, rcx
mov dword [rsp + 0x20], 0
lea rdx, [rsp + 0x70]
call fcn.140006a80
nop
lea rdx, str.main_
mov rsi, 0xffffffffffffffff
mov rax, rsi
nop
inc rax
cmp word [rdx + rax*2], 0
jne 0x140007000
mov r8d, eax
lea rcx, [rsp + 0x70]
call fcn.140004bb0
mov r14, qword [rsp + 0x70]
add r14, 0xffffffffffffffe8
mov rcx, r14
call fcn.140004ed0
add rax, 0x18
mov qword [rbx], rax
mov dword [rsp + 0x20], 1
lea rdx, [rsp + 0x78]
mov rcx, rbp
call fcn.140007fd0
nop
mov rdx, qword [rax]
mov r8d, dword [rdx - 0x10]
mov rcx, rbx
call fcn.140004bb0
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140007073
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rcx, qword [rbx]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x14000711c
mov rdi, qword [rbx]
sub rdi, 0x18
cmp r14, rdi
je 0x1400070e0
mov eax, dword [rdi + 0x10]
shr eax, 0x1f
test al, al
jne 0x1400070cf
mov rax, qword [rdi]
cmp qword [r14], rax
jne 0x1400070cf
mov rcx, r14
call fcn.140004ed0
mov r15, rax
mov ecx, esi
lock xadd dword [rdi + 0x10], ecx
sub ecx, 1
jg 0x1400070c6
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [rVariantCopy + 8]
lea rax, [r15 + 0x18]
mov qword [rbx], rax
jmp 0x1400070e0
mov r8d, dword [r14 + 8]
mov rdx, qword [rsp + 0x70]
mov rcx, rbx
call fcn.140009d40
lea rdx, [rsp + 0x28]
mov rcx, rbp
call fcn.140007180
nop
mov rdx, qword [rax]
mov r8d, dword [rdx - 0x10]
mov rcx, rbx
call fcn.140004bb0
nop
mov rdx, qword [rsp + 0x28]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000711c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
lea rdx, [0x14004da90]
mov rax, rsi
inc rax
cmp word [rdx + rax*2], 0
jne 0x140007126
mov r8d, eax
mov rcx, rbx
call fcn.140004bb0
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
lock xadd dword [r14 + 0x10], esi
sub esi, 1
jg 0x14000715c
mov rcx, qword [r14]
mov rax, qword [rcx]
mov rdx, r14
call qword [rax + VariantCopy]
mov rax, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140009ec0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140009f35
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140009f35
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x140009f25
nop
cmp rbx, rcx
jae 0x140009f35
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x140009f10
cmp rbx, rcx
jae 0x140009f35
cmp word [rbx], 0
je 0x140009f35
mov rax, rbx
jmp 0x140009f37
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140009fa0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140069798]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14000a074
cmp byte [rcx + 0x72], 0
je 0x14000a074
mov rax, qword [rcx]
mov qword [rsp + 0x78], rdi
mov edi, 0xffff
mov edx, edi
call qword [rax + 0x18]
cmp di, ax
je 0x14000a070
mov rcx, qword [rbx + 0x68]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r8
lea rdx, [rbx + 0x74]
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
je 0x14000a036
sub eax, 1
je 0x14000a03a
cmp eax, 2
jne 0x14000a070
mov byte [rbx + 0x72], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140024fc0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x72], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14000a067
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call fcn.140030644
cmp rdi, rax
jne 0x14000a070
cmp byte [rbx + 0x72], 0
sete al
jmp 0x14000a01e
xor al, al
jmp 0x14000a01e
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140024fc0
add rsp, 0x60
pop rbx
ret
Function at 0x14000b950
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x140069798]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, 0xffff
movzx esi, dx
mov rbx, rcx
cmp di, dx
jne 0x14000b981
xor eax, eax
jmp 0x14000bacf
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x14000b9be
mov r9, qword [rcx + 0x58]
movsxd r10, dword [r9]
lea rdx, [r8 + r10*2]
cmp r8, rdx
jae 0x14000b9be
lea ecx, [r10 - 1]
movzx eax, si
mov dword [r9], ecx
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], si
jmp 0x14000bacf
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xb0], rbp
je 0x14000bac4
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x14000ba05
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14000ba2e
movzx ecx, si
mov rdx, qword [rbx + 0x80]
call fcn.14002c7d4
cmp ax, di
je 0x14000bac4
movzx edi, si
jmp 0x14000bac4
lea r8, [rsp + 0x48]
mov word [rsp + 0x40], si
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x42]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x50]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x40]
call qword [rax + 0x38]
test eax, eax
je 0x14000ba84
sub eax, 1
je 0x14000ba84
cmp eax, 2
jne 0x14000bac4
movzx ecx, word [rsp + 0x40]
jmp 0x14000ba11
mov rbp, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
sub rbp, rax
je 0x14000bab1
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbp
mov edx, 1
call fcn.140030644
cmp rbp, rax
jne 0x14000bac4
lea rax, [rsp + 0x40]
mov byte [rbx + 0x72], 1
cmp qword [rsp + 0x50], rax
movzx eax, si
jne 0x14000bac7
movzx eax, di
mov rbp, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140024fc0
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret

Function at 0x14000e1a0
Capabilities:
Create thread
Print debug messages

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rcx
call fcn.14000e130
test al, al
jne 0x14000e1c7
lea rcx, str._pre_loader__ModulePreloader::PreLoadModule_is_disable
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor al, al
add rsp, 0x50
pop rbx
ret
mov ecx, 0x10
call fcn.140024c18
test rax, rax
je 0x14000e1e4
mov qword [rax], rbx
lea rcx, [0x14000e270]
mov qword [rax + 8], rcx
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x14000d040]
xor edx, edx
xor ecx, ecx
call fcn.1400312e8
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14000e248
cmp dword [rsp + 0x38], 0
je 0x14000e25b
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.140023a24
test eax, eax
jne 0x14000e240
mov al, 1
add rsp, 0x50
pop rbx
ret
mov ecx, eax
call fcn.140023d84
nop
mov dword [rsp + 0x38], 0
mov ecx, 6
call fcn.140023dc0
nop
mov ecx, 1
call fcn.140023dc0
int3
Function at 0x14000ea70
Capabilities:
Print debug messages

Disassembly:
push r14
sub rsp, 0x70
mov rax, qword [0x140069798]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov r14, rcx
call fcn.14000e130
test al, al
jne 0x14000eab2
lea rcx, str._pre_loader__ModulePreloader::PreLoadModule_is_disable
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140024fc0
add rsp, 0x70
pop r14
ret
movzx eax, byte [r14]
nop
test al, al
jne 0x14000ec80
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rbp
movabs rbp, 0x311cdad160000
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x60], r12
movabs r12, 0x112e0be826d694b3
mov qword [rsp + 0x58], r13
movabs r13, 0x7ffffffffa0a1eff
mov qword [rsp + 0x50], r15
movabs r15, 0x7fffffffffffffff
movaps xmmword [rsp + 0x40], xmm6
movsd xmm6, qword [0x14004e7a0]
call fcn.14002389c
mov rbx, rax
call fcn.140023880
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rdi, rcx, 0x3b9aca00
cqo
idiv rbx
add rdi, rax
cmp rdi, r13
jge 0x14000eb5c
add rdi, 0x5f5e100
mov rsi, rdi
jmp 0x14000eb62
mov rdi, r15
mov rsi, r15
call fcn.14002389c
mov rbx, rax
call fcn.140023880
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
mov rbx, rax
imul rax, rcx, 0x3b9aca00
add rbx, rax
cmp rbx, rdi
jge 0x14000ec42
nop dword [rax]
call fcn.14002399c
imul rcx, rax, 0x64
xorps xmm0, xmm0
mov rax, rsi
sub rax, rbx
lea r8, [rcx + rbp]
cvtsi2sd xmm0, rax
comisd xmm0, xmm6
seta r9b
test r9b, r9b
jne 0x14000ebcc
lea r8, [rcx + rax]
add rax, rcx
lea rdx, [rcx + rbp]
test r9b, r9b
lea rcx, [rsp + 0x20]
cmove rdx, rax
mov rax, r12
imul rdx
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul eax, edx, 0x3b9aca00
mov qword [rsp + 0x20], rdx
sub r8d, eax
mov dword [rsp + 0x28], r8d
call fcn.140023a48
call fcn.14002389c
mov rbx, rax
call fcn.140023880
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
mov rbx, rax
imul rax, rcx, 0x3b9aca00
add rbx, rax
cmp rbx, rsi
jl 0x14000eba0
movzx eax, byte [r14]
nop
test al, al
je 0x14000eb20
movaps xmm6, xmmword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140024fc0
add rsp, 0x70
pop r14
ret
Function at 0x140011900
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
add rdx, 0xffffffffffff0000
mov rdi, rcx
movzx eax, dx
mov rbx, rdx
sub rbx, rax
test rax, rax
cmove rbx, rdx
cmp rbx, rcx
jbe 0x1400119db
nop dword [rax]
cmp rbx, qword [0x140069258]
jb 0x14001194e
cmp rbx, qword [0x140069260]
ja 0x14001194e
sub rbx, 0x8000000
jmp 0x1400119d2
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
mov r8d, 0x30
mov rcx, rbx
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400119db
cmp dword [rsp + 0x40], 0x10000
jne 0x1400119b6
cmp qword [rsp + 0x38], 0x10000
jb 0x1400119b6
mov edx, 0x10000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x1400119dd
sub rbx, 0x10000
jmp 0x1400119d2
mov rcx, qword [rsp + 0x28]
add rcx, 0xffffffffffff0000
movzx eax, cx
mov rbx, rcx
sub rbx, rax
test rax, rax
cmove rbx, rcx
cmp rbx, rdi
ja 0x140011930
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x1400119f0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
movzx eax, cx
mov rdi, rdx
mov rbx, rcx
test rax, rax
je 0x140011a12
sub rbx, rax
add rbx, 0x10000
cmp rbx, rdi
jae 0x140011acd
nop dword [rax + rax]
cmp rbx, qword [0x140069258]
jb 0x140011a3e
cmp rbx, qword [0x140069260]
ja 0x140011a3e
add rbx, 0x8000000
jmp 0x140011ac4
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
mov r8d, 0x30
mov rcx, rbx
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140011acd
cmp dword [rsp + 0x40], 0x10000
mov rcx, qword [rsp + 0x38]
jne 0x140011aa9
cmp rcx, 0x10000
jb 0x140011aa9
mov edx, 0x10000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x140011acf
add rbx, 0x10000
jmp 0x140011ac4
mov rbx, qword [rsp + 0x20]
add rbx, rcx
movzx ecx, bx
test rcx, rcx
je 0x140011ac4
mov eax, 0x10000
sub rax, rcx
add rbx, rax
cmp rbx, rdi
jb 0x140011a20
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x140011ae0
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
lea rdi, [rcx - 0x7ff80000]
mov rbx, rcx
cmp rcx, 0x7ff80000
ja 0x140011b02
mov edi, 0x80000
mov qword [rsp + 0x38], rsi
lea rsi, [rcx + 0x7ff80000]
cmp rbx, 0xffffffff80000000
jb 0x140011b1e
mov rsi, 0xfffffffffff80000
movzx eax, byte [rcx]
cmp al, 0xff
jne 0x140011b35
cmp byte [rcx + 1], 0x25
jne 0x140011b79
movsxd rax, dword [rcx + 2]
add rcx, 6
jmp 0x140011b41
cmp al, 0xe9
jne 0x140011b79
movsxd rax, dword [rcx + 1]
add rcx, 5
add rcx, rax
cmp rcx, rbx
jae 0x140011b64
cmp rcx, 0xffffffff80000000
jae 0x140011b5b
lea rsi, [rcx + 0x7ff80000]
jmp 0x140011b79
mov rsi, 0xfffffffffff80000
jmp 0x140011b79
lea rdi, [rcx - 0x7ff80000]
cmp rcx, 0x7ff80000
ja 0x140011b79
mov edi, 0x80000
mov rdx, qword [0x14006b380]
mov rax, qword [0x14006b370]
mov qword [rsp + 0x30], rbp
test rdx, rdx
jne 0x140011ba0
test rax, rax
je 0x140011bb7
mov rdx, rax
mov qword [0x14006b380], rax
mov rcx, qword [rdx + 0x10]
test rcx, rcx
je 0x140011bb7
cmp rcx, rdi
jb 0x140011bb7
cmp rcx, rsi
jbe 0x140011cfa
mov qword [0x14006b380], rax
mov rdx, rax
test rax, rax
je 0x140011bf2
test rax, rax
je 0x140011be2
mov rax, qword [rdx + 0x10]
test rax, rax
je 0x140011be2
cmp rax, rdi
jb 0x140011be2
cmp rax, rsi
jbe 0x140011cfa
mov rdx, qword [rdx + 8]
mov qword [0x14006b380], rdx
test rdx, rdx
jne 0x140011bcb
movzx eax, bx
movabs rbp, 0xffffffff40000000
sub rbx, rax
cmp rbx, 0x40000000
jbe 0x140011c2b
lea rdx, [rbx - 0x40000000]
mov rcx, rdi
call fcn.140011900
mov rdx, rax
test rax, rax
jne 0x140011ca8
cmp rbx, rbp
jae 0x140011c4b
lea rcx, [rbx + 0x40000000]
mov rdx, rsi
call fcn.1400119f0
mov rdx, rax
test rax, rax
jne 0x140011ca8
cmp rbx, 0x40000000
jbe 0x140011c62
lea rcx, [rbx - 0x40000000]
mov rdx, rbx
call fcn.1400119f0
mov rdx, rax
test rax, rax
jne 0x140011ca8
cmp rbx, rbp
jae 0x140011c7e
lea rdx, [rbx + 0x40000000]
mov rcx, rbx
call fcn.140011900
mov rdx, rax
test rax, rax
jne 0x140011ca8
mov rdx, rbx
mov rcx, rdi
call fcn.140011900
mov rdx, rax
test rax, rax
jne 0x140011ca8
mov rdx, rsi
mov rcx, rbx
call fcn.1400119f0
mov rdx, rax
test rax, rax
je 0x140011d31
mov dword [rdx], 0x52727464
lea rcx, [rdx + 0xffa8]
xor r8d, r8d
mov qword [0x14006b380], rdx
mov qword [rdx + 0x10], r8
mov r9d, 0x2a7
mov rax, qword [0x14006b370]
mov qword [rdx + 8], rax
lea rax, [rdx + 0xff60]
mov qword [0x14006b370], rdx
mov qword [rcx], r8
lea rcx, [rcx - 0x60]
mov r8, rax
sub rax, 0x60
sub r9, 1
jne 0x140011ce2
mov qword [rdx + 0x10], r8
mov rax, qword [rdx + 0x10]
cmp rax, rdi
jb 0x140011d31
cmp rax, rsi
ja 0x140011d31
mov rcx, qword [rax + 0x48]
movdqa xmm0, xmmword [0x14004e7c0]
mov qword [rdx + 0x10], rcx
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
jmp 0x140011d33
xor eax, eax
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140011fa0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rdx
mov r8d, 0x30
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
nop
mov eax, 0x5a4d
mov rcx, qword [rsp + 0x28]
cmp word [rcx], ax
je 0x140011fce
xor al, al
jmp 0x140012010
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rdx + rcx], 0x4550
je 0x140011fdf
xor al, al
jmp 0x140012010
mov r8d, dword [rdx + rcx + 0xe8]
lea rax, [r8 + rcx]
cmp rbx, rax
jb 0x140012006
mov eax, dword [rdx + rcx + 0xec]
add rax, r8
add rax, rcx
cmp rbx, rax
jae 0x140012006
mov al, 1
jmp 0x140012010
xor al, al
add rsp, 0x50
pop rbx
ret
add rsp, 0x50
pop rbx
ret
Function at 0x1400124e0
Capabilities:
Resume thread

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x14006b378], eax
je 0x1400124fc
mov eax, 0x10dd
add rsp, 0x28
ret
mov qword [rsp + 0x38], rbx
mov rbx, qword [0x14006b3a8]
mov qword [rsp + 0x40], rsi
xor esi, esi
mov qword [rsp + 0x20], rdi
test rbx, rbx
je 0x140012590
nop dword [rax]
mov rax, qword [rbx + 0x20]
lea r9, [rsp + 0x30]
mov r8d, dword [rbx + 0x28]
mov rcx, qword [rbx + 0x18]
movzx edx, byte [rax + 0x3e]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [rbx + 8], esi
jne 0x14001257d
mov rdx, qword [rbx + 0x20]
test rdx, rdx
je 0x14001257d
xorps xmm0, xmm0
mov rcx, rdx
movups xmmword [rdx], xmm0
and rcx, 0xffffffffffff0000
movups xmmword [rdx + 0x10], xmm0
movups xmmword [rdx + 0x20], xmm0
movups xmmword [rdx + 0x30], xmm0
movups xmmword [rdx + 0x40], xmm0
movups xmmword [rdx + 0x50], xmm0
mov rax, qword [rcx + 0x10]
mov qword [rdx + 0x48], rax
mov qword [rcx + 0x10], rdx
mov qword [rbx + 0x20], rsi
mov rdi, qword [rbx]
mov rcx, rbx
call fcn.140024c54
mov rbx, rdi
test rdi, rdi
jne 0x140012520
mov qword [0x14006b3a8], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, qword [0x14006b370]
mov rdi, rax
test rbx, rbx
je 0x1400125e4
nop dword [rax]
lea r9, [rsp + 0x30]
mov edx, 0x10000
mov r8d, 0x20
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, 0x10000
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x1400125b0
mov rdi, qword [0x14006b3a0]
test rdi, rdi
je 0x14001260d
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rbx, qword [rdi]
mov rcx, rdi
call fcn.140024c54
mov rdi, rbx
test rbx, rbx
jne 0x1400125f0
mov rdi, qword [rsp + 0x20]
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov qword [0x14006b3a0], rsi
mov dword [0x14006b378], esi
mov rsi, qword [rsp + 0x40]
add rsp, 0x28
ret

Function at 0x140012630
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x28
cmp dword [0x14006b378], 0
jne 0x1400126d7
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
xor eax, eax
lock cmpxchg dword [0x14006b378], ecx
jne 0x1400126d7
mov qword [rsp + 0x38], rbx
mov rbx, qword [0x14006b370]
mov qword [rsp + 0x20], rdi
xor edi, edi
mov qword [0x14006b3a8], rdi
mov qword [0x14006b3a0], rdi
mov qword [0x14006b398], rdi
test rbx, rbx
je 0x1400126c0
nop word [rax + rax]
lea r9, [rsp + 0x30]
mov edx, 0x10000
mov r8d, 0x40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1400126b8
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x140012690
jmp 0x1400126c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rbx, qword [rsp + 0x38]
mov eax, edi
mov dword [0x14006b390], edi
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
ret
mov eax, 0x10dd
add rsp, 0x28
ret
Function at 0x140012d00
Capabilities:
Suspend thread

Disassembly:
push rdi
sub rsp, 0x20
mov eax, dword [0x14006b390]
mov rdi, rcx
test eax, eax
jne 0x140012d9e
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp rdi, rax
jne 0x140012d2a
xor eax, eax
add rsp, 0x20
pop rdi
ret
mov ecx, 0x10
mov qword [rsp + 0x30], rbx
call fcn.140024c18
mov rbx, rax
test rax, rax
jne 0x140012d46
lea edi, [rax + 8]
jmp 0x140012d64
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x140012d82
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, rbx
call fcn.140024c54
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov dword [0x14006b390], edi
mov qword [0x14006b398], 0
add rsp, 0x20
pop rdi
ret
mov rax, qword [0x14006b3a0]
mov qword [rbx], rax
xor eax, eax
mov qword [rbx + 8], rdi
mov qword [0x14006b3a0], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret