joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140023c20
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x20]
lea rcx, [0x1401f0394]
call fcn.140143790
nop
mov qword [rbp + 8], 0x26f
mov qword [rbp + 0x28], 0xe3
mov qword [rbp + 0x48], 0
jmp 0x140023c65
mov rax, qword [rbp + 0x48]
inc rax
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0xe3
jae 0x140023cf6
mov rax, qword [rbp + 0x1e0]
mov rcx, qword [rbp + 0x48]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x48]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rbp + 0x64], eax
mov eax, dword [rbp + 0x64]
and eax, 1
test eax, eax
je 0x140023cbb
mov dword [rbp + 0x1b4], 0x9908b0df
jmp 0x140023cc5
mov dword [rbp + 0x1b4], 0
mov eax, dword [rbp + 0x64]
shr eax, 1
xor eax, dword [rbp + 0x1b4]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x48]
xor eax, dword [rcx + rdx*4 + 0xff8]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x48]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x140023c5a
mov qword [rbp + 0x88], 0xe3
jmp 0x140023d14
mov rax, qword [rbp + 0x88]
inc rax
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0x26f
jae 0x140023dbd
mov rax, qword [rbp + 0x1e0]
mov rcx, qword [rbp + 0x88]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x88]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rbp + 0xa4], eax
mov eax, dword [rbp + 0xa4]
and eax, 1
test eax, eax
je 0x140023d79
mov dword [rbp + 0x1b4], 0x9908b0df
jmp 0x140023d83
mov dword [rbp + 0x1b4], 0
mov eax, dword [rbp + 0xa4]
shr eax, 1
xor eax, dword [rbp + 0x1b4]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x88]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x88]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x140023d03
mov qword [rbp + 0xc8], 0x26f
mov eax, 4
imul rax, rax, 0x4df
mov rcx, qword [rbp + 0x1e0]
mov eax, dword [rcx + rax + 4]
and eax, 0x80000000
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rbp + 0x1e0]
mov ecx, dword [rdx + rcx + 4]
btr ecx, 0x1f
or eax, ecx
mov dword [rbp + 0xe4], eax
mov eax, dword [rbp + 0xe4]
and eax, 1
test eax, eax
je 0x140023e1d
mov dword [rbp + 0x1b4], 0x9908b0df
jmp 0x140023e27
mov dword [rbp + 0x1b4], 0
mov eax, dword [rbp + 0xe4]
shr eax, 1
xor eax, dword [rbp + 0x1b4]
mov ecx, 4
imul rcx, rcx, 0x18c
mov rdx, qword [rbp + 0x1e0]
xor eax, dword [rdx + rcx + 4]
mov ecx, 4
imul rcx, rcx, 0x26f
mov rdx, qword [rbp + 0x1e0]
mov dword [rdx + rcx + 4], eax
mov rax, qword [rbp + 0x1e0]
mov dword [rax], 0
lea rsp, [rbp + 0x1c8]
pop rdi
pop rbp
ret
Function at 0x140026e80
Capabilities:
Terminate process

Disassembly:
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x20]
lea rcx, [0x1401f03ec]
call fcn.140143790
nop
mov dword [rbp + 4], 0
mov qword [rbp + 0x28], 0
lea rax, str.OllyDbg____CPU_
mov qword [rbp + 0x48], rax
lea rax, str.Immunity_Debugger____CPU_
mov qword [rbp + 0x68], rax
mov rdx, qword [rbp + 0x48]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
je 0x140026edf
mov dword [rbp + 4], 1
mov rdx, qword [rbp + 0x68]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
je 0x140026efd
mov dword [rbp + 4], 1
cmp dword [rbp + 4], 0
je 0x140026f0c
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_exit]
nop
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret

Function at 0x1400270e0
Capabilities:
Terminate process

Disassembly:
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x1401f03ec]
call fcn.140143790
nop
mov dword [rbp + 4], 0
cmp dword [rbp + 4], 0
je 0x140027118
call fcn.1400278c0
nop
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_exit]
nop
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret

Function at 0x14002a280
Capabilities:
Execute command

Disassembly:
push rbp
push rdi
sub rsp, 0x2c8
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x72
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1401d7f80]
xor rax, rbp
mov qword [rbp + 0x278], rax
lea rcx, [0x1401f03ec]
call fcn.140143790
nop
lea rax, str..kdstinker
mov qword [rbp + 8], rax
lea rax, str..NiGgEr
mov qword [rbp + 0x10], rax
lea rax, str..KsDumper
mov qword [rbp + 0x18], rax
lea rax, str..kprocesshacker
mov qword [rbp + 0x20], rax
mov eax, 4
mov word [rbp + 0x44], ax
mov dword [rbp + 0x64], 0
jmp 0x14002a304
mov eax, dword [rbp + 0x64]
inc eax
mov dword [rbp + 0x64], eax
movzx eax, word [rbp + 0x44]
cmp dword [rbp + 0x64], eax
jge 0x14002a391
movsxd rax, dword [rbp + 0x64]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
mov rcx, qword [rbp + rax*8 + 8]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rbp + 0x88], rax
movzx eax, byte [0x14014ec52]
mov byte [rbp + 0xb0], al
lea rax, [rbp + 0xb1]
mov rdi, rax
xor eax, eax
mov ecx, 0xff
rep stosb byte [rdi], al
cmp qword [rbp + 0x88], 0xffffffffffffffff
je 0x14002a38c
lea rcx, str.start_cmd__c_START_CMD__C__COLOR_C__TITLE_Protection__ECHO_KsDumper_Detected.__TIMEOUT_10__nul
call qword [sym.imp.ucrtbased.dll_system]
nop
call fcn.1400278c0
nop
jmp 0x14002a2fc
lea rcx, [rbp - 0x40]
lea rdx, [0x140155f80]
call fcn.140143560
mov rcx, qword [rbp + 0x278]
xor rcx, rbp
call fcn.1401439d0
lea rsp, [rbp + 0x288]
pop rdi
pop rbp
ret

Function at 0x14002b6b0
Capabilities:
Terminate process

Disassembly:
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1401f03ec]
call fcn.140143790
nop
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14002b6f4
call fcn.1400278c0
nop
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
nop
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret
Function at 0x14002b760
Capabilities:
Check for outputdebugstring error
Print debug messages
Terminate process

Disassembly:
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1401f03ec]
call fcn.140143790
nop
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
lea rcx, str.leksa
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14002b7bb
call fcn.1400278c0
nop
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
nop
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x14002d360
Capabilities:
Hash data using fnv

Disassembly:
mov byte [rsp + 0x10], dl
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1401f03e8]
call fcn.140143790
nop
movsx eax, byte [rbp + 0xe8]
mov ecx, dword [rbp + 0xe0]
xor ecx, eax
mov eax, ecx
mov eax, eax
imul rax, rax, 0x1000193
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret
Function at 0x140051df0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1401f057f]
call fcn.140143790
nop
mov r9, qword [rbp + 0xf8]
mov r8, qword [rbp + 0xf0]
mov rdx, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.ucrtbased.dll_fread]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x140051e50
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1401f057f]
call fcn.140143790
nop
mov r9, qword [rbp + 0xf8]
mov r8, qword [rbp + 0xf0]
mov rdx, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.ucrtbased.dll_fwrite]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x140052950
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x158
lea rbp, [rsp + 0x20]
lea rcx, [0x1401f057f]
call fcn.140143790
nop
mov eax, dword [rbp + 0x160]
not eax
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0x28], rax
lea rax, [0x140159970]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x158]
mov qword [rbp + 0x118], rax
mov rax, qword [rbp + 0x158]
dec rax
mov qword [rbp + 0x158], rax
cmp qword [rbp + 0x118], 0
je 0x1400529d0
mov dword [rbp + 0x120], 1
jmp 0x1400529da
mov dword [rbp + 0x120], 0
cmp dword [rbp + 0x120], 0
je 0x140052a23
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
mov rdx, qword [rbp + 0x28]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 0x114], eax
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
mov eax, dword [rbp + 0x114]
mov dword [rbp + 4], eax
jmp 0x14005299b
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret
Function at 0x140052a40
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x198
lea rbp, [rsp + 0x20]
lea rcx, [0x1401f057f]
call fcn.140143790
nop
mov eax, dword [rbp + 0x1a0]
not eax
mov dword [rbp + 0x1a0], eax
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x190]
mov qword [rbp + 0x28], rax
lea rax, [0x140159970]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x198], 0
je 0x140052b86
mov rax, qword [rbp + 0x198]
mov qword [rbp + 0x158], rax
mov rax, qword [rbp + 0x198]
dec rax
mov qword [rbp + 0x198], rax
cmp qword [rbp + 0x158], 0
je 0x140052ada
mov dword [rbp + 0x160], 1
jmp 0x140052ae4
mov dword [rbp + 0x160], 0
cmp dword [rbp + 0x160], 0
je 0x140052b81
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x154], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x154]
mov byte [rbp + 0x64], al
movzx eax, byte [rbp + 0x64]
cmp eax, 0x23
jne 0x140052b5b
cmp qword [rbp + 0x198], 2
jb 0x140052b5b
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140052b5b
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140052b5b
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x64]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x140052aa5
jmp 0x140052c20
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x154], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x154]
mov byte [rbp + 0x84], al
movzx eax, byte [rbp + 0x84]
test eax, eax
je 0x140052c20
movzx eax, byte [rbp + 0x84]
cmp eax, 0x23
jne 0x140052bf7
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140052bf7
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140052bf7
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x84]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x140052b86
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x140138b50
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x1401f0829]
call fcn.140143790
nop
mov qword [rbp + 8], 0
jmp 0x140138b8f
mov rax, qword [rbp + 8]
inc rax
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x110]
cmp qword [rbp + 8], rax
jae 0x140138be5
mov rax, qword [rbp + 8]
mov rcx, qword [rbp + 0x108]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rbp + 0x100]
xor rcx, rax
mov rax, rcx
mov qword [rbp + 0x100], rax
movabs rax, 0x100000001b3
mov rcx, qword [rbp + 0x100]
imul rcx, rax
mov rax, rcx
mov qword [rbp + 0x100], rax
jmp 0x140138b84
mov rax, qword [rbp + 0x100]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret

Function at 0x14013fc70
Capabilities:
Execute command
Hide graphical window

Disassembly:
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x60]
lea rcx, [0x1401f09f1]
call fcn.140143790
nop
lea rcx, [0x1401dfcd8]
call fcn.14000f4c0
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_system]
mov dword [0x1401dfcd0], eax
mov dword [0x1401dfc10], 0x50
lea rax, [0x1401422a0]
mov qword [0x1401dfc18], rax
mov rax, qword [0x1401dfca0]
mov qword [0x1401dfc28], rax
lea rax, str.CiceroUIWndFrame
mov qword [0x1401dfc50], rax
lea rcx, [0x1401dfc10]
call qword [sym.imp.USER32.dll_RegisterClassExA]
movzx eax, ax
test eax, eax
jne 0x14013fcf6
xor eax, eax
jmp 0x14013fe2e
mov qword [rsp + 0x58], 0
mov rax, qword [0x1401dfca0]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov eax, dword [0x1401dfcc4]
mov dword [rsp + 0x38], eax
mov eax, dword [0x1401dfcc0]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x90000000
lea r8, str.CiceroUIWndFrame
lea rdx, str.CiceroUIWndFrame
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [0x1401dfcb8], rax
cmp qword [0x1401dfcb8], 0
jne 0x14013fd75
xor eax, eax
jmp 0x14013fe2e
mov r8d, 0x80088
mov edx, 0xffffffec
mov rcx, qword [0x1401dfcb8]
call qword [sym.imp.USER32.dll_SetWindowLongA]
nop
lea rdx, [0x1401bc298]
mov rcx, qword [0x1401dfcb8]
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
nop
mov edx, 5
mov rcx, qword [0x1401dfcb8]
call qword [sym.imp.USER32.dll_ShowWindow]
nop
mov rcx, qword [0x1401dfcb8]
call qword [sym.imp.USER32.dll_UpdateWindow]
nop
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, 0xffffffffffffffff
mov rcx, qword [0x1401dfcb8]
call qword [sym.imp.USER32.dll_SetWindowPos]
nop
mov r8d, 0x800a8
mov edx, 0xffffffec
mov rcx, qword [0x1401dfcb8]
call qword [sym.imp.USER32.dll_SetWindowLongA]
nop
mov r8d, 0x800a8
mov edx, 0xffffffec
mov rcx, qword [0x1401dfcb8]
call qword [sym.imp.USER32.dll_SetWindowLongA]
nop
mov eax, 1
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret
Function at 0x140140eb0
Capabilities:
Create thread

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x188
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x26
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x1a8]
mov rax, qword [0x1401d7f80]
xor rax, rbp
mov qword [rbp + 0x148], rax
lea rcx, [0x1401f09e9]
call fcn.140143790
nop
mov qword [rbp + 8], 0
cmp dword [rbp + 0x170], 0
jl 0x140140f33
cmp dword [rbp + 0x170], 0x7c
jge 0x140140f33
lea r8, [rbp + 8]
mov edx, dword [rbp + 0x170]
lea rcx, str.Keybind
call fcn.140142030
nop
lea rcx, [rbp + 0x28]
call fcn.140008a90
nop
cmp qword [rbp + 8], 0
jne 0x140140f57
lea rdx, str.Select_Key
lea rcx, [rbp + 0x28]
call fcn.14013fa20
nop
jmp 0x140140f65
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x28]
call fcn.14013fa20
nop
cmp dword [rbp + 0x180], 1
jne 0x140140f7f
lea rdx, str.Press_the_Key
lea rcx, [rbp + 0x28]
call fcn.14013fa20
nop
movss xmm2, dword [0x140159950]
movss xmm1, dword [0x140198ad4]
lea rcx, [rbp + 0x124]
call fcn.14001b3e0
mov qword [rbp + 0x138], rax
lea rcx, [rbp + 0x28]
call fcn.14000f4c0
mov qword [rbp + 0x140], rax
mov rdx, qword [rbp + 0x138]
mov rcx, qword [rbp + 0x140]
call fcn.1400fd1d0
movzx eax, al
test eax, eax
je 0x140140ffb
cmp dword [rbp + 0x180], 0
jne 0x140140ffb
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rbp + 0x178]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
lea rcx, [rbp + 0x28]
call fcn.14000a170
nop
lea rcx, [rbp - 0x30]
lea rdx, [0x140198330]
call fcn.140143560
mov rcx, qword [rbp + 0x148]
xor rcx, rbp
call fcn.1401439d0
lea rsp, [rbp + 0x158]
pop rdi
pop rbp
ret

Function at 0x1401425f0
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 7
syscall
ret
Function at 0x1401444d0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.1401431b0
movzx eax, al
test eax, eax
jne 0x1401444f0
mov ecx, 7
call fcn.140145160
nop
mov byte [rsp + 0x20], 0
call fcn.140142fe0
mov byte [rsp + 0x21], al
cmp dword [0x1401dfd80], 1
jne 0x140144514
mov ecx, 7
call fcn.140145160
nop
jmp 0x14014456c
cmp dword [0x1401dfd80], 0
jne 0x140144567
mov dword [0x1401dfd80], 1
lea rdx, [0x14014ec10]
lea rcx, [0x14014ebf8]
call sub.ucrtbased.dll__initterm_e
test eax, eax
je 0x140144548
mov eax, 0xff
jmp 0x140144671
lea rdx, [0x14014ebf0]
lea rcx, [0x14014eac8]
call sub.ucrtbased.dll__initterm
mov dword [0x1401dfd80], 2
jmp 0x14014456c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.1401433a0
call fcn.140145f90
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x1401445c9
mov rcx, qword [rsp + 0x30]
call fcn.140143310
movzx eax, al
test eax, eax
je 0x1401445c9
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x14014eaa0]
nop
call fcn.140145fa0
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x1401445fd
mov rcx, qword [rsp + 0x38]
call fcn.140143310
movzx eax, al
test eax, eax
je 0x1401445fd
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call sub.ucrtbased.dll__register_thread_local_exe_atexit_callback
nop
call fcn.140144680
mov dword [rsp + 0x28], eax
call fcn.140145380
movzx eax, al
test eax, eax
jne 0x14014461c
mov ecx, dword [rsp + 0x28]
call sub.ucrtbased.dll_exit
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14014462b
call sub.ucrtbased.dll__cexit
nop
xor edx, edx
mov cl, 1
call fcn.1401433d0
mov eax, dword [rsp + 0x28]
jmp 0x140144671
add rsp, 0x68
ret
Function at 0x416aa0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x416c2b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [0x0058f138]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00435220
xorps xmm15, xmm15
mov r14, qword [0x007ed4e0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x416b05
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x416b14
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x416b33
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x416b43
cmp rbx, 0x1000
jae 0x416b0b
jmp 0x416bad
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x416b55
xor edx, edx
jmp 0x416ba4
mov rcx, qword [0x0058f138]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00435220
xorps xmm15, xmm15
mov r14, qword [0x007ed4e0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x416b39
jmp 0x416b28
call fcn.0046a420
xorps xmm15, xmm15
mov r14, qword [0x007ed4e0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00439660
lea rax, [0x004e04bc]
mov ebx, 0x18
nop dword [rax]
call fcn.00439ee0
mov rax, qword [rsp + 0x38]
call fcn.00439c20
lea rax, [0x004e095a]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00439ee0
mov rax, qword [rsp + 0x30]
call fcn.00439c20
call fcn.004398a0
call fcn.004396c0
lea rax, [0x004e2b26]
mov ebx, 0x21
call fcn.00437bc0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00466ce0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00416aa0
Function at 0x416c60
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x416e86
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [0x0058f140]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.004352a0
xorps xmm15, xmm15
mov r14, qword [0x007ed4e0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x416cd3
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x416ce2
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x416d05
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x416d15
cmp rbx, 0x1000
jae 0x416cd9
nop
jmp 0x416d98
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x416d2d
xor esi, esi
jmp 0x416d8a
mov rax, qword [0x0058f140]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.004352a0
xorps xmm15, xmm15
mov r14, qword [0x007ed4e0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x416d0b
jmp 0x416cf6
call fcn.0046a420
xorps xmm15, xmm15
mov r14, qword [0x007ed4e0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x416e20
nop dword [rax + rax]
call fcn.00439660
lea rax, [0x004e0973]
mov ebx, 0x19
call fcn.00439ee0
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.00439c20
lea rax, [0x004e095a]
mov ebx, 0x19
call fcn.00439ee0
mov eax, dword [rsp + 0x34]
call fcn.00439c20
nop
call fcn.004398a0
call fcn.004396c0
lea rax, [0x004dd293]
mov ebx, 0xd
call fcn.00437bc0
nop dword [rax + rax]
cmp eax, 0x5af
je 0x416dc0
call fcn.00439660
lea rax, [0x004e0973]
mov ebx, 0x19
call fcn.00439ee0
mov rax, qword [rsp + 0x38]
call fcn.00439c20
lea rax, [0x004e095a]
mov ebx, 0x19
call fcn.00439ee0
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.00439c20
call fcn.004398a0
call fcn.004396c0
lea rax, [0x004e2382]
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.00437bc0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00466ce0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00416c60