joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008bda0
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x4a8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x420], 0xfffffffffffffffe
mov rsi, rcx
lea rcx, [rbp - 0x60]
call fcn.14008c130
mov rax, qword [rbp - 0x60]
movabs al, byte [0xbf48]
add byte [rax + 0x75f83948], al
invalid
lea rcx, [rbp - 0x58]
call fcn.1400870b0
mov qword [rsi], rdi
jmp 0x14008c047
mov qword [rbp + 0x3f8], rsi
mov qword [rbp + 0x3f0], rax
mov rax, qword [rbp - 0x58]
mov qword [rbp + 0x400], rax
mov qword [rbp + 0x408], 0
add byte [rax], al
mov qword [rbp + 0x410], 2
mov qword [rbp + 0x418], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor edi, edi
xor ebx, ebx
xor r14d, r14d
cmp r8, 0x201
jae 0x14008be80
jmp 0x14008be6f
jae 0x14008bf46
cmp r8, 0x201
jae 0x14008be80
mov r15d, 0x200
lea r12, [rbp - 0x60]
mov r13, r8
jmp 0x14008bed8
sub r8, r14
sub rbx, r14
cmp rbx, r8
jae 0x14008beaf
lea rcx, [rbp + 0x408]
mov rdx, r14
call fcn.1400a5cd0
mov rdi, qword [rbp + 0x408]
add byte [rax], al
mov rax, qword [rbp + 0x410]
mov qword [rbp + 0x3e8], rax
mov eax, 0xffffffff
cmp rdi, rax
mov r14d, 0xffffffff
dec dword [rdi + rcx + 0x42]
test dword [rcx + rcx*4 - 0x4b], 0x418
mov rbx, rdi
mov r15, r14
mov r12, qword [rbp + 0x3e8]
mov r13, r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rbp + 0x400]
mov rdx, r12
mov r8d, r13d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test eax, eax
jne 0x14008bf07
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14008bfcb
mov r8d, esi
cmp r13, r8
jne 0x14008be60
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14008c05c
add r13, r13
mov eax, 0xffffffff
cmp r13, rax
cmovae r13, rax
mov r8, r13
cmp r8, 0x201
jb 0x14008be6f
jmp 0x14008be80
cmp r15, r8
jb 0x14008c076
lea rcx, [rbp + 0x3a0]
mov rdx, r12
call fcn.14008ac40
movups xmm0, xmmword [rbp + 0x3a0]
movups xmm1, xmmword [rbp + 0x3b0]
movaps xmmword [rbp + 0x3d0], xmm1
rol byte [rbx], 1
add byte [rax], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
and byte [rax - 0x7d], cl
enter 0x4802, 0xffffffffffffff89
test eax, ecx
add eax, dword [rax]
add byte [rax - 0x42], cl
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax - 0x3f4a76b8], al
add eax, dword [rax]
add byte [rax - 0x7d], cl
mov ebp, 0x408
invalid
je 0x14008c011
mov r8, qword [rbp + 0x410]
mov rcx, qword [0x14010b208]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [rbp + 0x3f8]
lea rcx, str.internal_error:_entered_unreachable_code_rustc_129f3b9964af4d4a709d1383930ade12dfe7c081library_std_src_threadmod.rs
lea r8, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.1400a2fe0
jmp 0x14008c08b
lea rax, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r15
mov r8, rax
call fcn.1400a2fd0
ud2
Function at 0x14008dc00
Capabilities:
Resolve dns

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x1e8
lea rbp, [rsp + 0x80]
mov rax, rdx
mov rsi, rcx
mov rdx, qword [rdx]
mov rdi, qword [rax + 8]
movzx eax, word [rax + 0x10]
mov word [rbp + 0x166], ax
mov rax, qword [0x14010b210]
cmp rax, 3
jne 0x14008ddf2
lea rax, [rbp + 0x166]
mov qword [rbp + 0x150], rax
cmp rdi, 0x17f
ja 0x14008de02
lea rbx, [rbp - 0x60]
mov rcx, rbx
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rdi - 0x60], 0
lea rax, [rdi + 1]
cmp rdi, 0xe
ja 0x14008dc98
xor edx, edx
nop word [rax + rax]
cmp byte [rbp + rdx - 0x60], 0
je 0x14008dd54
inc rdx
cmp rax, rdx
jne 0x14008dc80
jmp 0x14008ddbd
lea rcx, [rbp - 0x59]
and rcx, 0xfffffffffffffff8
sub rcx, rbx
je 0x14008dcce
xor edx, edx
nop word [rax + rax]
cmp byte [rbp + rdx - 0x60], 0
je 0x14008dd54
inc rdx
cmp rcx, rdx
jne 0x14008dcb0
lea rdx, [rdi - 0xf]
cmp rcx, rdx
jbe 0x14008dcd2
jmp 0x14008dd1e
lea rdx, [rdi - 0xf]
movdqa xmm0, xmmword [0x1400a8590]
movabs r8, 0x8080808080808080
nop word cs:[rax + rax]
movdqu xmm1, xmmword [rbp + rcx - 0x60]
movdqa xmm2, xmm1
paddq xmm2, xmm0
pandn xmm1, xmm2
pshufd xmm2, xmm1, 0xee
por xmm2, xmm1
movq r9, xmm2
test r9, r8
jne 0x14008dd1e
add rcx, 0x10
cmp rcx, rdx
jbe 0x14008dcf0
sub rax, rcx
je 0x14008ddbd
lea r8, [rcx + rbp]
add r8, 0xffffffffffffffa0
xor edx, edx
nop word cs:[rax + rax]
cmp byte [r8 + rdx], 0
je 0x14008dd51
inc rdx
cmp rax, rdx
jne 0x14008dd40
jmp 0x14008ddbd
add rdx, rcx
cmp rdx, rdi
jne 0x14008ddbd
pxor xmm0, xmm0
movdqa xmmword [rbp + 0x120], xmm0
movdqa xmmword [rbp + 0x140], xmm0
movdqa xmmword [rbp + 0x130], xmm0
mov dword [rbp + 0x128], 1
mov qword [rbp + 0x158], 0
lea rcx, [rbp - 0x60]
lea r8, [rbp + 0x120]
lea r9, [rbp + 0x158]
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x14008ddd1
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov ecx, 1
jmp 0x14008dde9
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x14008de14
mov rax, qword [rbp + 0x158]
movzx ecx, word [rbp + 0x166]
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], cx
xor ecx, ecx
mov qword [rsi + 8], rax
mov qword [rsi], rcx
jmp 0x14008de14
mov rbx, rdx
call fcn.1400a5f10
mov rdx, rbx
jmp 0x14008dc3c
lea r9, [rbp + 0x150]
mov rcx, rsi
mov r8, rdi
call fcn.1400a5f70
nop
add rsp, 0x1e8
pop rbx
pop rdi
pop rsi
pop rbp
ret
Function at 0x14008e400
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov r14, rdx
mov rsi, rcx
movzx eax, byte [0x14010b298]
mov edx, 0x10
xor ecx, ecx
call fcn.14008ec10
test rax, rax
je 0x14008e4f3
mov rbx, rax
mov qword [rax], r14
mov qword [rax + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x14008e5b0]
xor edi, edi
xor ecx, ecx
mov rdx, rsi
mov r9, rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x14008e4e5
mov rcx, qword [rbx]
mov qword [rbp - 0x20], rbx
mov rax, qword [rbx + 8]
mov qword [rbp - 0x10], rcx
mov qword [rbp - 0x18], rax
call qword [rax]
mov rax, qword [rbp - 0x18]
cmp qword [rax + 8], 0
mov rsi, qword [rbp - 0x20]
je 0x14008e4be
cmp qword [rax + 0x10], 0x11
jae 0x14008e4a7
mov r8, qword [rbp - 0x10]
jmp 0x14008e4af
mov r8, qword [rbp - 0x10]
mov r8, qword [r8 - 8]
mov rcx, qword [0x14010b208]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x14010b208]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov edi, 1
mov rax, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], rdi
mov ecx, 8
mov edx, 0x10
call fcn.1400a2b10
ud2
Function at 0x14009449e
Capabilities:
Access peb ldr_data

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov eax, dword [0x14010b29c]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp byte [rax + 0x50], 0
jne 0x1400944c5
call fcn.14001cf87
mov eax, dword [0x14010b29c]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rcx, qword [rax + 0x58]
mov rdx, qword [rax + 0x60]
lea r8, [rcx + 1]
mov qword [rax + 0x58], r8
movabs rax, 0x736f6d6570736575
xor rax, rcx
movabs r8, 0x646f72616e646f6d
xor r8, rdx
movabs r9, 0x6c7967656e657261
xor r9, rcx
movabs r10, 0x7465646279746573
xor r10, rdx
lea rdi, [rsp + 0x30]
mov qword [rdi], rax
mov qword [rdi + 8], r9
mov qword [rdi + 0x10], r8
mov qword [rdi + 0x18], r10
mov qword [rdi + 0x20], rcx
mov qword [rdi + 0x28], rdx
xorps xmm0, xmm0
movups xmmword [rdi + 0x30], xmm0
mov qword [rdi + 0x40], 0
mov eax, 1
lock xadd dword [0x14010b048], eax
mov esi, 1
lea rdx, [rsp + 0x2c]
mov dword [rdx], eax
mov r8d, 4
mov rcx, rdi
call fcn.14000f379
mov rax, qword [rdi + 0x10]
mov r9, qword [rdi + 0x30]
shl r9, 0x38
or r9, qword [rdi + 0x38]
mov rcx, qword [rdi + 0x18]
mov r8, qword [rdi]
add r8, rax
rol rax, 0xd
xor rcx, r9
xor rax, r8
rol r8, 0x20
mov rdx, qword [rdi + 8]
add rdx, rcx
rol rcx, 0x10
xor rcx, rdx
add r8, rcx
rol rcx, 0x15
add rdx, rax
rol rax, 0x11
xor rcx, r8
xor rax, rdx
rol rdx, 0x20
xor r8, r9
add r8, rax
rol rax, 0xd
xor rax, r8
rol r8, 0x20
xor rdx, 0xff
add rdx, rcx
rol rcx, 0x10
xor rcx, rdx
add r8, rcx
rol rcx, 0x15
add rdx, rax
rol rax, 0x11
xor rax, rdx
rol rdx, 0x20
xor rcx, r8
add r8, rax
rol rax, 0xd
xor rax, r8
rol r8, 0x20
add rdx, rcx
rol rcx, 0x10
xor rcx, rdx
add r8, rcx
rol rcx, 0x15
add rdx, rax
rol rax, 0x11
xor rax, rdx
rol rdx, 0x20
xor rcx, r8
add r8, rax
rol rax, 0xd
add rdx, rcx
rol rcx, 0x10
xor rax, r8
xor rcx, rdx
rol rcx, 0x15
add rdx, rax
rol rax, 0x11
mov r8, rdx
rol r8, 0x20
xor r8, rax
xor r8, rcx
xor r8, rdx
mov rax, r8
shr rax, 0x20
cmp r8d, 2
cmovae esi, r8d
mov edx, esi
add rsp, 0x78
pop rdi
pop rsi
ret

Function at 0x1400969f2
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx]
mov rdx, rax
xor rdx, 3
lock cmpxchg qword [rcx], rdx
jne 0x1400969f9
test al, 1
je 0x140096a18
test al, 2
jne 0x140096a30
xor rax, 3
add rsp, 0x28
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x1400dddb0]
mov edx, 0x23
call fcn.1400a2fe0
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x1400dddf0]
mov edx, 0x25
call fcn.1400a2fe0
int3

Function at 0x140097325
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
cmp rcx, 0xffffffffffffffff
je 0x14009736f
movzx eax, dl
lea r9, [rsp + 0x34]
mov dword [r9], eax
mov dword [rsp + 0x20], 4
mov edx, 6
mov r8d, 1
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x14009735c
xor eax, eax
jmp 0x14009736a
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
add rsp, 0x38
ret
lea rcx, str.C:Usersmorker.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.38.1_srciopoll_evented.rs_b
call fcn.1400a3320
int3
Function at 0x1400975e4
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
lea r14, [rsp + 0x2a]
lea r12, [rsp + 0x42]
mov r13, qword [rcx + 8]
mov r15, qword [rcx + 0x10]
mov eax, 0x7fffffff
cmp r9, rax
cmovb rax, r9
mov qword [rsp + 0x50], rax
mov rax, qword [rcx + 0x18]
mov qword [rsp + 0x48], rax
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x30], r13
mov rcx, rbp
mov rdx, r13
mov r8, rdi
mov r9b, 1
call fcn.140097060
mov al, byte [rsp + 0x29]
cmp al, 3
je 0x14009775c
mov rbp, qword [rsp + 0x20]
cmp al, 2
je 0x140097755
mov cl, byte [rsp + 0x28]
movzx edx, word [r14 + 4]
mov word [r12 + 4], dx
mov edx, dword [r14]
mov dword [r12], edx
mov qword [rsp + 0x38], rbp
mov byte [rsp + 0x40], cl
mov byte [rsp + 0x41], al
cmp r15, 0xffffffffffffffff
je 0x14009777c
mov rcx, r15
mov rdx, rsi
mov r8, qword [rsp + 0x50]
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_send]
cmp eax, 0xffffffff
jne 0x140097763
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
mov ebp, eax
shl rbp, 0x20
or rbp, 2
mov rcx, rbp
call fcn.140012264
cmp al, 0xd
jne 0x140097725
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x140097725
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
lock inc qword [rdx]
jle 0x140097788
mov r13, r15
mov r15, rbx
mov rbx, r14
mov r14, rdi
mov rdi, rsi
add rcx, 0x10
mov r8, qword [rax + 0x10]
mov r9b, byte [rax + 0x18]
call fcn.1400322f2
test rax, rax
je 0x140097711
mov rsi, rax
mov rcx, rbp
call fcn.14001211c
mov rbp, rsi
mov rsi, rdi
mov rdi, r14
mov r14, rbx
mov rbx, r15
mov r15, r13
mov r13, qword [rsp + 0x30]
mov rcx, rbp
call fcn.140012264
cmp al, 0xd
jne 0x140097755
mov qword [rsp + 0x20], rbp
mov rcx, rbx
lea rdx, [rsp + 0x38]
call fcn.14009726e
lea rbp, [rsp + 0x20]
mov rcx, rbp
call fcn.1400935ce
jmp 0x140097633
mov eax, 1
jmp 0x140097768
mov eax, 2
jmp 0x140097768
movsxd rbp, eax
xor eax, eax
mov rdx, rbp
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.C:Usersmorker.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.38.1_srciopoll_evented.rs_b
call fcn.1400a3320
ud2
Function at 0x1400a25d0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400a261a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400a261a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400a261a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400a261a
cmp dword [rcx + 0x84], 0xe
jbe 0x1400a261a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400a261c
xor al, al
add rsp, 0x28
ret

Function at 0x1400a5f70
Capabilities:
Resolve dns

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov r14, r8
inc r14
sete r13b
je 0x1400a60ec
js 0x1400a60f8
mov rdi, r9
mov rbx, r8
mov r12, rdx
mov rsi, rcx
movzx eax, byte [0x14010b298]
xor ecx, ecx
mov rdx, r14
call fcn.14008ec10
test rax, rax
je 0x1400a60fd
mov r15, rax
mov rcx, rax
mov rdx, r12
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
cmp rbx, 0xf
ja 0x1400a5ff1
test rbx, rbx
je 0x1400a6041
xor eax, eax
nop
cmp byte [r12 + rax], 0
je 0x1400a6003
inc rax
cmp rbx, rax
jne 0x1400a5fe0
jmp 0x1400a6041
xor ecx, ecx
mov rdx, r12
mov r8, rbx
call fcn.14000d440
test rax, rax
je 0x1400a6041
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
test r13b, r13b
jne 0x1400a60da
mov rcx, qword [0x14010b208]
xor edx, edx
mov r8, r15
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
jmp qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], r15
mov qword [rbp - 0x20], rbx
lea rcx, [rbp - 0x30]
call fcn.140005ef0
mov rbx, rax
mov r14, rdx
xorps xmm0, xmm0
movaps xmmword [rbp - 0x30], xmm0
movaps xmmword [rbp - 0x10], xmm0
movaps xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x28], 1
mov qword [rbp], 0
lea r8, [rbp - 0x30]
mov r9, rbp
mov rcx, rax
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x1400a60a5
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov ecx, 1
jmp 0x1400a60b9
mov rcx, qword [rdi]
mov rax, qword [rbp]
movzx ecx, word [rcx]
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], cx
xor ecx, ecx
mov qword [rsi + 8], rax
mov qword [rsi], rcx
mov byte [rbx], 0
test r14, r14
je 0x1400a60da
mov rcx, qword [0x14010b208]
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, str.library_alloc_src_ffic_str.rs
call fcn.1400a3320
call fcn.140005dc0
mov ecx, 1
mov rdx, r14
call fcn.1400a2af0
int3
Function at 0x10109f1f0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x10109f1fd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x10109f20d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x10109f1f5
lea eax, [rcx + 1]
jmp 0x10109f21b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x10109f22e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x10109f214
sub eax, 3
jb 0x10109f24e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x10109f29d
sar eax, 1
movsxd rbp, eax
jb 0x10109f284
jmp 0x10109f25c
add ebx, ebx
jne 0x10109f25a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x10109f284
inc ecx
add ebx, ebx
jne 0x10109f26a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x10109f284
call r11
adc ecx, ecx
add ebx, ebx
jne 0x10109f27d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x10109f26c
add ecx, 2
jmp 0x10109f289
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.10109f1b2
jmp 0x10109f1fd
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x109b000]
mov eax, dword [rdi]
or eax, eax
je 0x10109f2f9
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x10a72a4]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x10109f2a9
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x10109f2f3
mov qword [rbx], rax
add rbx, 8
jmp 0x10109f2c9
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.10109f37c], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.10109f37c
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x10109f36c
sub rsp, 0xffffffffffffff80
jmp 0x1000034b0
Function at 0x2acef5bc0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x2acef5d4b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [0x2acf77840]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.2acf12800
xorps xmm15, xmm15
mov r14, qword [0x2ad0b5130]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x2acef5c25
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x2acef5c34
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x2acef5c53
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x2acef5c63
cmp rbx, 0x1000
jae 0x2acef5c2b
jmp 0x2acef5ccd
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x2acef5c75
xor edx, edx
jmp 0x2acef5cc4
mov rcx, qword [0x2acf77840]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.2acf12800
xorps xmm15, xmm15
mov r14, qword [0x2ad0b5130]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x2acef5c59
jmp 0x2acef5c48
call fcn.2acf44120
xorps xmm15, xmm15
mov r14, qword [0x2ad0b5130]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.2acf168a0
lea rax, [0x2acf9eb98]
mov ebx, 0x18
nop dword [rax]
call fcn.2acf17120
mov rax, qword [rsp + 0x38]
call fcn.2acf16e60
lea rax, [0x2acf9eea0]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.2acf17120
mov rax, qword [rsp + 0x30]
call fcn.2acf16e60
call fcn.2acf16ae0
call fcn.2acf16900
lea rax, [0x2acfa0ab9]
mov ebx, 0x21
call fcn.2acf14e00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.2acf409a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.2acef5bc0
Function at 0x2acef5d80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x2acef5fa6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [0x2acf77838]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.2acf12880
xorps xmm15, xmm15
mov r14, qword [0x2ad0b5130]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x2acef5df3
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x2acef5e02
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x2acef5e25
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x2acef5e35
cmp rbx, 0x1000
jae 0x2acef5df9
nop
jmp 0x2acef5eb8
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x2acef5e4d
xor esi, esi
jmp 0x2acef5eaa
mov rax, qword [0x2acf77838]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.2acf12880
xorps xmm15, xmm15
mov r14, qword [0x2ad0b5130]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x2acef5e2b
jmp 0x2acef5e16
call fcn.2acf44120
xorps xmm15, xmm15
mov r14, qword [0x2ad0b5130]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x2acef5f40
nop dword [rax + rax]
call fcn.2acf168a0
lea rax, [0x2acf9eeb9]
mov ebx, 0x19
call fcn.2acf17120
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.2acf16e60
lea rax, [0x2acf9eea0]
mov ebx, 0x19
call fcn.2acf17120
mov eax, dword [rsp + 0x34]
call fcn.2acf16e60
nop
call fcn.2acf16ae0
call fcn.2acf16900
lea rax, [0x2acf9c47f]
mov ebx, 0xd
call fcn.2acf14e00
nop dword [rax + rax]
cmp eax, 0x5af
je 0x2acef5ee0
call fcn.2acf168a0
lea rax, [0x2acf9eeb9]
mov ebx, 0x19
call fcn.2acf17120
mov rax, qword [rsp + 0x38]
call fcn.2acf16e60
lea rax, [0x2acf9eea0]
mov ebx, 0x19
call fcn.2acf17120
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.2acf16e60
call fcn.2acf16ae0
call fcn.2acf16900
lea rax, [0x2acfa0398]
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.2acf14e00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.2acf409a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.2acef5d80