joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140080aa0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1400f7060]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x140080b68
lea edi, [rax + 1]
mov ecx, edi
mov eax, 2
mul rcx
mov rsi, 0xffffffffffffffff
cmovo rax, rsi
mov rcx, rax
call fcn.14005caec
mov rbp, rax
mov qword [rsp + 0x28], rax
mov edx, edi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x140080b56
inc rsi
cmp word [rbp + rsi*2], 0
jne 0x140080b14
xor ecx, ecx
mov qword [rbx], rcx
mov qword [rbx + 0x10], rcx
mov qword [rbx + 0x18], 7
mov word [rbx], cx
mov r8, rsi
mov rdx, rbp
mov rcx, rbx
call fcn.1400043e0
nop
test rbp, rbp
je 0x140080b86
mov edx, 2
mov rcx, rbp
call fcn.14005c5c0
jmp 0x140080b86
test rbp, rbp
je 0x140080b68
mov edx, 2
mov rcx, rbp
call fcn.14005c5c0
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
xor ecx, ecx
mov qword [rbx], rcx
mov qword [rbx + 0x10], rcx
mov qword [rbx + 0x18], 7
mov word [rbx], cx
mov rax, rbx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14005c5a0
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x140080d30
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1400f7060]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x140080df8
lea edi, [rax + 1]
mov ecx, edi
mov eax, 2
mul rcx
mov rsi, 0xffffffffffffffff
cmovo rax, rsi
mov rcx, rax
call fcn.14005caec
mov rbp, rax
mov qword [rsp + 0x28], rax
mov edx, edi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x140080de6
inc rsi
cmp word [rbp + rsi*2], 0
jne 0x140080da4
xor ecx, ecx
mov qword [rbx], rcx
mov qword [rbx + 0x10], rcx
mov qword [rbx + 0x18], 7
mov word [rbx], cx
mov r8, rsi
mov rdx, rbp
mov rcx, rbx
call fcn.1400043e0
nop
test rbp, rbp
je 0x140080e16
mov edx, 2
mov rcx, rbp
call fcn.14005c5c0
jmp 0x140080e16
test rbp, rbp
je 0x140080df8
mov edx, 2
mov rcx, rbp
call fcn.14005c5c0
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
xor ecx, ecx
mov qword [rbx], rcx
mov qword [rbx + 0x10], rcx
mov qword [rbx + 0x18], 7
mov word [rbx], cx
mov rax, rbx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14005c5a0
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x1400874e0
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov rax, qword [0x1400f7060]
xor rax, rsp
mov qword [rbp + 0x60], rax
mov rdi, rcx
mov dword [rsp + 0x20], 0
xor edx, edx
mov r8d, 0xf8
lea rcx, [rsp + 0x60]
call fcn.14009c250
mov edx, 1
lea rcx, [rsp + 0x60]
call fcn.14006b0c0
nop
lea rdx, str.err:0x
lea rcx, [rsp + 0x70]
call fcn.14005de80
mov rbx, rax
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov ecx, dword [rdx + rax + 0x18]
and ecx, 0xfffff9ff
bts ecx, 0xb
mov dword [rdx + rax + 0x18], ecx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.14006d400
nop
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0xf
mov byte [rsp + 0x28], 0
mov dword [rsp + 0x20], 2
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov rcx, qword [rbp - 0x18]
mov eax, ecx
and al, 0x22
cmp al, 2
je 0x1400875cd
mov rax, qword [rbp - 0x48]
mov r8, qword [rax]
test r8, r8
je 0x1400875cd
mov rax, qword [rbp - 0x68]
mov rdx, qword [rax]
cmp r8, qword [rbp - 0x20]
cmovb r8, qword [rbp - 0x20]
sub r8, rdx
jmp 0x1400875fe
test cl, 4
jne 0x1400875f4
mov rax, qword [rbp - 0x50]
mov rcx, qword [rax]
test rcx, rcx
je 0x1400875f4
mov rax, qword [rbp - 0x70]
mov rdx, qword [rax]
mov rax, qword [rbp - 0x38]
movsxd r8, dword [rax]
sub r8, rdx
add r8, rcx
jmp 0x1400875fe
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x14008760e
lea rcx, [rsp + 0x28]
call fcn.140004810
nop
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.1400139b0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x140087655
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008764f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140087680
call fcn.14005c5c0
nop
lea rcx, [rsp + 0x60]
call fcn.14006db70
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.14005c5a0
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.1400a87d8
nop
int3

Function at 0x1400889f0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x1400f7060]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, rdx
mov r8d, 0x30
lea rdx, [rsp + 0x20]
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x140088a32
mov ecx, 0x19
int 0x29
test byte [rsp + 0x44], 0x44
je 0x140088a8d
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r9d, dword [rsp + 0x54]
mov ecx, r9d
neg rcx
and rcx, rbx
lea edx, [r9 - 1]
mov eax, edx
and edx, ebx
and eax, edi
add eax, edx
xor edx, edx
dec rax
add rax, r9
div r9
xor edx, edx
mov r8, rax
mov rax, rdi
div r9
add r8, rax
mov eax, r8d
test r8d, r8d
je 0x140088a8d
nop
lock or dword [rcx], 0
add rcx, r9
sub rax, 1
jne 0x140088a80
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14005c5a0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x90
pop rdi
ret
Function at 0x140088ab0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movsxd r8, dword [0x14000003c]
lea rbx, [0x140000000]
add r8, rbx
mov rsi, rdx
mov ebp, ecx
cmp dword [r8 + 0x84], 0xd
jbe 0x140088b31
mov r9d, dword [r8 + 0xf0]
test r9d, r9d
je 0x140088b31
movzx eax, word [r8 + 0x14]
lea rcx, [r8 + 0x18]
movzx r11d, word [r8 + 6]
add rcx, rax
mov r10d, dword [r9 + rbx + 0xc]
xor edx, edx
test r11d, r11d
je 0x140088b31
nop dword [rax]
mov r8d, dword [rcx + 0xc]
cmp r10d, r8d
jb 0x140088b26
mov r9d, dword [rcx + 8]
lea eax, [r9 + r8]
cmp r10d, eax
jb 0x140088b4c
inc edx
add rcx, 0x28
cmp edx, r11d
jb 0x140088b10
mov dword [rsi], 4
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov eax, dword [rcx + 0x24]
mov rdi, r8
add rdi, rbx
je 0x140088b31
cmp dword [0x1400fc150], 0
jne 0x140088b85
mov dword [0x1400fc150], 1
test eax, eax
js 0x140088b75
mov ecx, 0x19
int 0x29
mov rdx, r9
mov rcx, rdi
mov rbx, r9
call fcn.1400889f0
jmp 0x140088b88
mov rbx, r9
mov r9, rsi
mov r8d, ebp
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140088b37
mov ecx, 0x19
int 0x29
jmp 0x140088b37

Function at 0x1400959d0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1400f7060]
xor rax, rsp
mov qword [rsp + 0x50], rax
add rdx, 0xffffffffffff0000
mov rdi, rcx
movzx eax, dx
mov rbx, rdx
sub rbx, rax
test rax, rax
cmove rbx, rdx
cmp rbx, rcx
jbe 0x140095ac5
nop dword [rax]
cmp rbx, qword [0x1400f8200]
jb 0x140095a2e
cmp rbx, qword [0x1400f8208]
ja 0x140095a2e
sub rbx, 0x8000000
jmp 0x140095abc
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
mov r8d, 0x30
mov rcx, rbx
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
je 0x140095ac5
cmp dword [rsp + 0x40], 0x10000
jne 0x140095aa0
cmp qword [rsp + 0x38], 0x10000
jb 0x140095aa0
mov edx, 0x10000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rbx
call sub.KERNEL32.dll_VirtualAlloc
test rax, rax
jne 0x140095ac7
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
je 0x140095ac5
sub rbx, 0x10000
jmp 0x140095abc
mov rcx, qword [rsp + 0x28]
add rcx, 0xffffffffffff0000
movzx eax, cx
mov rbx, rcx
sub rbx, rax
test rax, rax
cmove rbx, rcx
cmp rbx, rdi
ja 0x140095a10
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14005c5a0
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x140095ae0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1400f7060]
xor rax, rsp
mov qword [rsp + 0x50], rax
movzx eax, cx
mov rdi, rdx
mov rbx, rcx
test rax, rax
je 0x140095b11
sub rbx, rax
add rbx, 0x10000
cmp rbx, rdi
jae 0x140095bd7
nop word [rax + rax]
cmp rbx, qword [0x1400f8200]
jb 0x140095b3e
cmp rbx, qword [0x1400f8208]
ja 0x140095b3e
add rbx, 0x8000000
jmp 0x140095bce
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
mov r8d, 0x30
mov rcx, rbx
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
je 0x140095bd7
cmp dword [rsp + 0x40], 0x10000
mov rcx, qword [rsp + 0x38]
jne 0x140095bb3
cmp rcx, 0x10000
jb 0x140095bb3
mov edx, 0x10000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rbx
call sub.KERNEL32.dll_VirtualAlloc
test rax, rax
jne 0x140095bd9
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
je 0x140095bd7
add rbx, 0x10000
jmp 0x140095bce
mov rbx, qword [rsp + 0x20]
add rbx, rcx
movzx ecx, bx
test rcx, rcx
je 0x140095bce
mov eax, 0x10000
sub rax, rcx
add rbx, rax
cmp rbx, rdi
jb 0x140095b20
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14005c5a0
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x140095c00
Capabilities:
Hook routines via microsoft detours

Disassembly:
push rbx
sub rsp, 0x20
lea rbx, [rcx - 0x7ff80000]
mov r9, rcx
cmp rcx, 0x7ff80000
ja 0x140095c1e
mov ebx, 0x80000
mov qword [rsp + 0x30], rdi
lea rdi, [rcx + 0x7ff80000]
cmp r9, 0xffffffff80000000
jb 0x140095c3a
mov rdi, 0xfffffffffff80000
movzx eax, byte [rcx]
cmp al, 0xff
jne 0x140095c51
cmp byte [rcx + 1], 0x25
jne 0x140095c95
movsxd rax, dword [rcx + 2]
add rcx, 6
jmp 0x140095c5d
cmp al, 0xe9
jne 0x140095c95
movsxd rax, dword [rcx + 1]
add rcx, 5
add rcx, rax
cmp rcx, r9
jae 0x140095c80
cmp rcx, 0xffffffff80000000
jae 0x140095c77
lea rdi, [rcx + 0x7ff80000]
jmp 0x140095c95
mov rdi, 0xfffffffffff80000
jmp 0x140095c95
lea rbx, [rcx - 0x7ff80000]
cmp rcx, 0x7ff80000
ja 0x140095c95
mov ebx, 0x80000
mov rax, qword [0x1400fc160]
mov rcx, qword [0x1400fc158]
test rax, rax
jne 0x140095cb7
test rcx, rcx
je 0x140095cce
mov rax, rcx
mov qword [0x1400fc160], rcx
mov rdx, qword [rax + 0x10]
test rdx, rdx
je 0x140095cce
cmp rdx, rbx
jb 0x140095cce
cmp rdx, rdi
jbe 0x140095d79
mov qword [0x1400fc160], rcx
mov rax, rcx
test rcx, rcx
je 0x140095d09
test rcx, rcx
je 0x140095cf9
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x140095cf9
cmp rcx, rbx
jb 0x140095cf9
cmp rcx, rdi
jbe 0x140095d79
mov rax, qword [rax + 8]
mov qword [0x1400fc160], rax
test rax, rax
jne 0x140095ce2
movzx eax, r9w
mov r8, rdi
sub r9, rax
mov rdx, rbx
mov rcx, r9
call fcn.140095dd0
test rax, rax
je 0x140095dbc
mov dword [rax], 0x52727464
lea rdx, [rax + 0xffa8]
xor r8d, r8d
mov qword [0x1400fc160], rax
mov qword [rax + 0x10], r8
mov r9d, 0x2a7
mov rcx, qword [0x1400fc158]
mov qword [rax + 8], rcx
lea rcx, [rax + 0xff60]
mov qword [0x1400fc158], rax
mov qword [rdx], r8
lea rdx, [rdx - 0x60]
mov r8, rcx
sub rcx, 0x60
sub r9, 1
jne 0x140095d61
mov qword [rax + 0x10], r8
mov rdx, qword [rax + 0x10]
cmp rdx, rbx
jb 0x140095dbc
cmp rdx, rdi
ja 0x140095dbc
mov rcx, qword [rdx + 0x48]
movdqa xmm0, xmmword [0x1400d2770]
mov qword [rax + 0x10], rcx
mov rax, rdx
movups xmmword [rdx], xmm0
movups xmmword [rdx + 0x10], xmm0
movups xmmword [rdx + 0x20], xmm0
movups xmmword [rdx + 0x30], xmm0
movups xmmword [rdx + 0x40], xmm0
movups xmmword [rdx + 0x50], xmm0
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
mov rdi, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x1400960f0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1400f7060]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rdx
mov r8d, 0x30
lea rdx, [rsp + 0x20]
call sub.KERNEL32.dll_VirtualQuery
nop
mov eax, 0x5a4d
mov rcx, qword [rsp + 0x28]
cmp word [rcx], ax
je 0x14009612c
xor al, al
jmp 0x14009617b
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rdx + rcx], 0x4550
je 0x14009613d
xor al, al
jmp 0x14009617b
mov r8d, dword [rdx + rcx + 0xe8]
lea rax, [r8 + rcx]
cmp rbx, rax
jb 0x140096164
mov eax, dword [rdx + rcx + 0xec]
add rax, r8
add rax, rcx
cmp rbx, rax
jae 0x140096164
mov al, 1
jmp 0x14009617b
xor al, al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14005c5a0
add rsp, 0x60
pop rbx
ret
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14005c5a0
add rsp, 0x60
pop rbx
ret
Function at 0x1400966e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbp
push rsi
sub rsp, 0x38
mov rax, qword [0x1400f7060]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbp, rdx
mov rsi, rcx
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x1400fc170], eax
je 0x140096713
mov eax, 0x10dd
jmp 0x14009683c
mov eax, dword [0x1400fc174]
test eax, eax
jne 0x14009683c
test rbp, rbp
jne 0x14009672e
lea eax, [rbp + 0x57]
jmp 0x14009683c
test rsi, rsi
je 0x14009674a
cmp qword [rsi], 0
jne 0x140096754
mov dword [0x1400fc174], 6
mov qword [0x1400fc178], rsi
mov eax, 6
jmp 0x14009683c
mov qword [rsp + 0x60], rbx
mov ecx, 0x30
mov qword [rsp + 0x30], rdi
call fcn.14005c860
mov rbx, rax
test rax, rax
jne 0x140096778
lea edi, [rax + 8]
jmp 0x140096811
mov rcx, qword [rsi]
xor edx, edx
call fcn.140096630
xor edx, edx
mov rcx, rbp
mov rdi, rax
call fcn.140096630
movzx ecx, byte [rdi + 0x3e]
mov rbp, qword [rdi + 0x48]
sub rbp, rcx
test cl, cl
je 0x140096803
mov edx, ecx
cmp rcx, 0x1e
ja 0x140096803
cmp qword [rdi + 0x50], rax
jne 0x140096803
lea r9, [rsp + 0x20]
mov dword [rsp + 0x20], 0
mov r8d, 0x40
mov rcx, rbp
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x1400967d4
call sub.KERNEL32.dll_GetLastError
mov edi, eax
jmp 0x140096811
mov dword [rbx + 8], 1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x20], rdi
mov qword [rbx + 0x18], rbp
mov eax, dword [rsp + 0x20]
mov dword [rbx + 0x28], eax
mov rax, qword [0x1400fc188]
mov qword [rbx], rax
xor eax, eax
mov qword [0x1400fc188], rbx
jmp 0x140096832
cmp dword [0x1400fc168], 0
mov edi, 9
jne 0x14009681c
mov dword [0x1400fc174], edi
test rbx, rbx
je 0x140096829
mov edx, 0x30
mov rcx, rbx
call fcn.14005c5c0
mov qword [0x1400fc178], rsi
mov eax, edi
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14005c5a0
add rsp, 0x38
pop rsi
pop rbp
ret
Function at 0x140096850
Capabilities:
Resume thread

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1400f7060]
xor rax, rsp
mov qword [rsp + 0x28], rax
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x1400fc170], eax
je 0x140096887
mov eax, 0x10dd
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14005c5a0
add rsp, 0x38
ret
mov qword [rsp + 0x40], rbx
mov rbx, qword [0x1400fc188]
mov qword [rsp + 0x48], rsi
xor esi, esi
mov qword [rsp + 0x30], rdi
test rbx, rbx
je 0x140096924
nop dword [rax + rax]
mov rax, qword [rbx + 0x20]
lea r9, [rsp + 0x20]
mov r8d, dword [rbx + 0x28]
mov rcx, qword [rbx + 0x18]
movzx edx, byte [rax + 0x3e]
call sub.KERNEL32.dll_VirtualProtect
cmp dword [rbx + 8], esi
jne 0x14009690c
mov rdx, qword [rbx + 0x20]
test rdx, rdx
je 0x14009690c
xorps xmm0, xmm0
mov rcx, rdx
movups xmmword [rdx], xmm0
and rcx, 0xffffffffffff0000
movups xmmword [rdx + 0x10], xmm0
movups xmmword [rdx + 0x20], xmm0
movups xmmword [rdx + 0x30], xmm0
movups xmmword [rdx + 0x40], xmm0
movups xmmword [rdx + 0x50], xmm0
mov rax, qword [rcx + 0x10]
mov qword [rdx + 0x48], rax
mov qword [rcx + 0x10], rdx
mov qword [rbx + 0x20], rsi
mov rdi, qword [rbx]
mov edx, 0x30
mov rcx, rbx
call fcn.14005c5c0
mov rbx, rdi
test rdi, rdi
jne 0x1400968b0
mov qword [0x1400fc188], rsi
call fcn.140096190
mov rdi, qword [0x1400fc180]
test rdi, rdi
je 0x140096961
nop dword [rax]
mov rcx, qword [rdi + 8]
call sub.KERNEL32.dll_ResumeThread
mov rbx, qword [rdi]
mov edx, 0x10
mov rcx, rdi
call fcn.14005c5c0
mov rdi, rbx
test rbx, rbx
jne 0x140096940
mov rdi, qword [rsp + 0x30]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov qword [0x1400fc180], rsi
mov dword [0x1400fc170], esi
mov rsi, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14005c5a0
add rsp, 0x38
ret

Function at 0x1400969a0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1400f7060]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp dword [0x1400fc170], 0
jne 0x140096a62
call sub.KERNEL32.dll_GetCurrentThreadId
mov ecx, eax
xor eax, eax
lock cmpxchg dword [0x1400fc170], ecx
jne 0x140096a62
mov qword [rsp + 0x40], rbx
mov rbx, qword [0x1400fc158]
mov qword [rsp + 0x30], rdi
xor edi, edi
mov qword [0x1400fc188], rdi
mov qword [0x1400fc180], rdi
mov qword [0x1400fc178], rdi
test rbx, rbx
je 0x140096a3e
nop dword [rax]
nop dword [rax + rax]
lea r9, [rsp + 0x20]
mov edx, 0x10000
mov r8d, 0x40
mov rcx, rbx
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
je 0x140096a37
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x140096a10
jmp 0x140096a3e
call sub.KERNEL32.dll_GetLastError
mov edi, eax
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov dword [0x1400fc174], edi
mov rdi, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14005c5a0
add rsp, 0x38
ret
mov eax, 0x10dd
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14005c5a0
add rsp, 0x38
ret
Function at 0x140097020
Capabilities:
Suspend thread

Disassembly:
push rdi
sub rsp, 0x20
mov eax, dword [0x1400fc174]
mov rdi, rcx
test eax, eax
jne 0x1400970c0
call sub.KERNEL32.dll_GetCurrentThread
cmp rdi, rax
jne 0x140097049
xor eax, eax
add rsp, 0x20
pop rdi
ret
mov ecx, 0x10
mov qword [rsp + 0x30], rbx
call fcn.14005c860
mov rbx, rax
test rax, rax
jne 0x140097065
lea edi, [rax + 8]
jmp 0x140097086
mov rcx, rdi
call sub.KERNEL32.dll_SuspendThread
cmp eax, 0xffffffff
jne 0x1400970a4
call sub.KERNEL32.dll_GetLastError
mov edi, eax
mov edx, 0x10
mov rcx, rbx
call fcn.14005c5c0
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov dword [0x1400fc174], edi
mov qword [0x1400fc178], 0
add rsp, 0x20
pop rdi
ret
mov rax, qword [0x1400fc180]
mov qword [rbx], rax
xor eax, eax
mov qword [rbx + 8], rdi
mov qword [0x1400fc180], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x413d80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x413f0b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x00647768]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x413de5
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x413df4
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x413e13
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x413e23
cmp rbx, 0x1000
jae 0x413deb
jmp 0x413e8d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x413e35
xor edx, edx
jmp 0x413e84
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x00647768]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x413e19
jmp 0x413e08
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x00647768]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call sym.runtime.printlock
lea rax, [0x0051b304]
mov ebx, 0x18
nop dword [rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x0051b7d6]
mov ebx, 0x19
nop dword [rax + rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x30]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x0051e031]
mov ebx, 0x21
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.runtime.sysUnusedOS
Function at 0x413f40
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x414166
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x00647768]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x413fb3
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x413fc2
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x413fe5
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x413ff5
cmp rbx, 0x1000
jae 0x413fb9
nop
jmp 0x414078
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x41400d
xor esi, esi
jmp 0x41406a
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x00647768]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x413feb
jmp 0x413fd6
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x00647768]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x414100
nop dword [rax + rax]
call sym.runtime.printlock
lea rax, [0x0051b7ef]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call sym.runtime.printuint
lea rax, [0x0051b7d6]
mov ebx, 0x19
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
call sym.runtime.printuint
nop
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x00517eb9]
mov ebx, 0xd
call sym.runtime.throw
nop dword [rax + rax]
cmp eax, 0x5af
je 0x4140a0
call sym.runtime.printlock
lea rax, [0x0051b7ef]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x0051b7d6]
mov ebx, 0x19
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
nop dword [rax]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x0051d671]
mov ebx, 0x1f
nop dword [rax + rax]
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp sym.runtime.sysUsedOS