joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140088ad0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov rsi, rcx
xor edi, edi
xor ecx, ecx
mov dword [rsp + 0x20], edi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov ebp, eax
test eax, eax
je 0x140088b93
lea rdx, [rbp + 2]
mov eax, 2
mul rdx
mov r14, 0xffffffffffffffff
cmovo rax, r14
mov rcx, rax
call fcn.14009e2ac
mov rdx, rax
mov ecx, ebp
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x140088b93
movzx eax, word [rbx]
test ax, ax
je 0x140088b6a
cmp ax, 0x43
jae 0x140088b6a
mov rax, r14
nop dword [rax]
inc rax
cmp word [rbx + rax*2], di
jne 0x140088b50
lea rbx, [rbx + rax*2]
movzx eax, word [rbx + 2]
add rbx, 2
test ax, ax
jne 0x140088b40
mov qword [rsi + 0x18], 7
mov qword [rsi + 0x10], rdi
mov word [rsi], di
cmp word [rbx], di
je 0x140088b8b
mov rdi, r14
inc rdi
cmp word [rbx + rdi*2], 0
jne 0x140088b81
mov r8, rdi
mov rdx, rbx
jmp 0x140088bac
mov qword [rsi + 0x18], 7
lea rdx, [0x1400e6c40]
mov qword [rsi + 0x10], rdi
xor r8d, r8d
mov word [rsi], di
mov rcx, rsi
call fcn.140008a20
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x14008fa50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
push r15
mov eax, dword [r8]
lea rbx, [rdx + 0x1000]
mov edi, dword [r9]
mov r14, r9
mov r15, r8
mov r11, rdx
mov esi, reloc.WS2_32.dll_recv
mov ebp, 0xff
nop dword [rax + rax]
xor eax, dword [rbx]
lea rbx, [rbx + 4]
mov ecx, eax
movzx r10d, ax
mov r9d, eax
shr ecx, 8
movzx r8d, cx
and r10w, bp
shr ecx, 8
and r8w, bp
mov eax, ecx
shr eax, 8
movzx edx, al
movzx eax, cx
movzx ecx, al
mov eax, dword [r11 + rdx*4]
add eax, dword [r11 + rcx*4 + 0x400]
movzx ecx, r8w
xor eax, dword [r11 + rcx*4 + 0x800]
movzx ecx, r10w
add eax, dword [r11 + rcx*4 + 0xc00]
xor eax, edi
mov edi, r9d
sub rsi, 1
jne 0x14008fa90
mov ecx, dword [r11 + 0x1040]
mov rbx, qword [rsp + 0x18]
xor ecx, eax
mov eax, dword [r11 + 0x1044]
mov rbp, qword [rsp + 0x20]
xor eax, r9d
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov dword [r15], eax
mov dword [r14], ecx
pop r15
pop r14
ret

Function at 0x14008fb20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
push r15
mov eax, dword [r8]
lea rbx, [rdx + 0x1044]
mov edi, dword [r9]
mov r14, r9
mov r15, r8
mov r11, rdx
mov esi, reloc.WS2_32.dll_recv
mov ebp, 0xff
nop dword [rax + rax]
xor eax, dword [rbx]
lea rbx, [rbx - 4]
mov ecx, eax
movzx r10d, ax
mov r9d, eax
shr ecx, 8
movzx r8d, cx
and r10w, bp
shr ecx, 8
and r8w, bp
mov eax, ecx
shr eax, 8
movzx edx, al
movzx eax, cx
movzx ecx, al
mov eax, dword [r11 + rdx*4]
add eax, dword [r11 + rcx*4 + 0x400]
movzx ecx, r8w
xor eax, dword [r11 + rcx*4 + 0x800]
movzx ecx, r10w
add eax, dword [r11 + rcx*4 + 0xc00]
xor eax, edi
mov edi, r9d
sub rsi, 1
jne 0x14008fb60
mov ecx, dword [r11 + 0x1004]
mov rbx, qword [rsp + 0x18]
xor ecx, eax
mov eax, dword [r11 + 0x1000]
mov rbp, qword [rsp + 0x20]
xor eax, r9d
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov dword [r15], eax
mov dword [r14], ecx
pop r15
pop r14
ret
Function at 0x140092650
Capabilities:
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x140131088]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, rcx
mov rcx, qword [rcx + 8]
cmp rcx, 0xffffffffffffffff
je 0x14009267c
call qword [sym.imp.WS2_32.dll_closesocket]
mov edi, 2
xor r8d, r8d
mov edx, edi
mov ecx, edi
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rbx + 8], rax
cmp rax, 0xffffffffffffffff
jne 0x14009269f
xor al, al
jmp 0x140092735
xor eax, eax
mov qword [rsp + 0x48], rsi
mov qword [rbx + 0x10], rax
lea rcx, str.127.0.0.1
mov qword [rbx + 0x18], rax
mov word [rbx + 0x10], di
call qword [sym.imp.WS2_32.dll_inet_addr]
mov rcx, qword [rbx + 8]
lea rdx, [rbx + 0x10]
xor edi, edi
mov dword [rbx + 0x14], eax
mov word [rbx + 0x12], di
lea r8d, [rdi + 0x10]
call qword [sym.imp.WS2_32.dll_bind]
mov rcx, qword [rbx + 8]
test eax, eax
jne 0x140092701
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
lea rdx, [rbx + 0x10]
call qword [sym.imp.WS2_32.dll_getsockname]
mov rcx, qword [rbx + 8]
test eax, eax
je 0x140092713
call qword [sym.imp.WS2_32.dll_closesocket]
xor al, al
mov qword [rbx + 8], 0xffffffffffffffff
jmp 0x140092730
lea r8, [rsp + 0x24]
mov dword [rsp + 0x24], 1
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
sete al
mov rsi, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14009d860
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140095a20
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140131088]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp byte [rcx + 0x470], 0
mov esi, r8d
mov rbx, rdx
mov rdi, rcx
je 0x140095a50
mov al, 1
jmp 0x140095b68
mov qword [rcx + 0x480], r9
test rbx, rbx
je 0x140095a6b
add rcx, 0x3c
mov r8d, 0x3ff
call fcn.1400b19c0
mov edx, esi
mov dword [rdi + 0x38], esi
mov rcx, rbx
call fcn.1400954f0
mov qword [rdi + 0x478], rax
cmp rax, 0xffffffffffffffff
jne 0x140095a8c
xor al, al
jmp 0x140095b68
mov rcx, qword [rdi + 0x28]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [rdi + 0x478]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x20]
mov byte [rdi + 0x470], 1
mov dword [rsp + 0x30], reloc.WS2_32.dll_recv
call qword [sym.imp.WS2_32.dll_getsockname]
mov ecx, dword [rsp + 0x24]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
test rax, rax
lea rdx, str._NULL_
cmovne rdx, rax
xor ebx, ebx
cmp byte [rdx], bl
jne 0x140095adf
mov r8d, ebx
jmp 0x140095aec
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], bl
jne 0x140095ae3
lea rcx, [rdi + 8]
call fcn.140009260
mov r8d, 1
lea rdx, [0x1400eb200]
lea rcx, [rdi + 8]
call fcn.14000c010
movzx ecx, word [rsp + 0x22]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx r8d, ax
lea rdx, [0x1400f8274]
lea rcx, [rsp + 0x38]
call fcn.140009aa0
cmp byte [rsp + 0x38], bl
je 0x140095b49
lea rax, [rsp + 0x38]
or rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140095b40
mov r8, rbx
lea rdx, [rsp + 0x38]
lea rcx, [rdi + 8]
call fcn.14000c010
mov rcx, rdi
call fcn.140095c80
mov byte [rdi + 0x470], al
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14009d860
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140099350
Capabilities:
Connect socket
Get local ipv4 addresses
Get socket information
Reference google public dns server

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140131088]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov esi, 2
mov rdi, rcx
mov edx, esi
mov ecx, esi
xor r8d, r8d
call qword [sym.imp.WS2_32.dll_socket]
mov rbx, rax
lea ecx, [rsi + 0x33]
xor eax, eax
mov qword [rsp + 0x38], rax
mov word [rsp + 0x38], si
mov qword [rsp + 0x40], rax
call qword [sym.imp.WS2_32.dll_htons]
lea rcx, str.8.8.8.8
mov word [rsp + 0x3a], ax
call qword [sym.imp.WS2_32.dll_inet_addr]
lea r8d, [rsi + 0xe]
mov rcx, rbx
lea rdx, [rsp + 0x38]
mov dword [rsp + 0x3c], eax
call qword [sym.imp.WS2_32.dll_connect]
mov rcx, rbx
test eax, eax
js 0x1400993ee
lea r8, [rsp + 0x30]
mov dword [rsp + 0x30], reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jns 0x1400993f8
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
xor al, al
jmp 0x140099430
mov ecx, dword [rsp + 0x24]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
cmp byte [rax], 0
jne 0x14009940c
xor r8d, r8d
jmp 0x14009941a
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140099410
mov rdx, rax
mov rcx, rdi
call fcn.140009260
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
mov al, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14009d860
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x140099450
Capabilities:
Get hostname
Resolve dns

Disassembly:
mov r11, rsp
push rdi
push r14
push r15
sub rsp, 0xa0
mov qword [r11 - 0x78], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rax, qword [0x140131088]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov r14, rcx
xor eax, eax
mov qword [r11 - 0x68], rax
mov qword [r11 - 0x60], rax
mov qword [r11 - 0x58], rax
mov qword [r11 - 0x50], rax
mov qword [r11 - 0x48], rax
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x38], rax
mov qword [r11 - 0x30], rax
lea edx, [rax + 0x40]
lea rcx, [r11 - 0x68]
call qword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
je 0x1400994c2
xor al, al
jmp 0x140099615
lea rcx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov rbx, rax
call fcn.1400820a0
mov rcx, rax
mov r8, rbx
lea rdx, [rsp + 0x50]
call fcn.14007f550
mov rsi, rax
test rax, rax
je 0x1400994bb
mov rax, qword [rax + 0x18]
cmp qword [rax], 0
je 0x140099613
xor ebp, ebp
mov edi, ebp
mov ecx, ebp
movabs r15, 0x555555555555554
nop dword [rax + rax]
mov rax, qword [rcx + rax]
mov ecx, dword [rax]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x30], rbp
mov byte [rsp + 0x20], 0
cmp byte [rax], 0
jne 0x140099539
mov r8, rbp
jmp 0x14009954a
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140099540
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.140009260
nop
mov rbx, qword [r14]
lea r9, [rsp + 0x20]
mov r8, qword [rbx + 8]
mov rdx, rbx
call fcn.140099b40
mov rdx, qword [r14 + 8]
mov rcx, r15
sub rcx, rdx
cmp rcx, 1
jb 0x140099606
lea rcx, [rdx + 1]
mov qword [r14 + 8], rcx
mov qword [rbx + 8], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rax
mov rax, qword [rsp + 0x38]
cmp rax, 0x10
jb 0x1400995d3
mov rcx, qword [rsp + 0x20]
inc rax
cmp rax, 0x1000
jb 0x1400995ce
test cl, 0x1f
jne 0x140099600
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x1400995fa
sub rcx, rax
cmp rcx, 8
jb 0x1400995f4
cmp rcx, 0x27
ja 0x1400995ee
mov rcx, rax
call fcn.14009d844
inc rdi
lea rcx, [rdi*8]
mov rax, qword [rsi + 0x18]
cmp qword [rcx + rax], 0
je 0x140099613
jmp 0x140099510
call fcn.1400a26d8
int3
call fcn.1400a26d8
int3
call fcn.1400a26d8
int3
call fcn.1400a26d8
nop
lea rcx, str.list_T__too_long
call fcn.14009b264
nop
mov al, 1
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14009d860
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1400acbc4
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r11d, dword [rcx + r8 + 0x88]
add r11, r8
cmp r11, r8
je 0x1400acbe6
mov ebx, dword [r11 + 0x18]
test ebx, ebx
je 0x1400acbe6
mov r15d, dword [r11 + 0x20]
dec ebx
mov edi, 0xc9d1ffd2
lea rcx, [r15 + rbx*4]
mov r9d, dword [rcx + r8]
add r9, r8
mov r10b, byte [r9]
add r9, r12
test r10b, r10b
je 0x1400acbe2
movsx ecx, r10b
sub r10b, 0x41
mov edx, ecx
or edx, 0x20
cmp r10b, 0x19
mov r10b, byte [r9]
cmova edx, ecx
add r9, r12
xor edx, edi
imul edi, edx, 0x1000193
test r10b, r10b
jne 0x1400acbb3
cmp edi, 0xfb0d3058
je 0x1400acbeb
test ebx, ebx
jne 0x1400acb96
mov rax, qword [rax]
jmp 0x1400acb72
mov ecx, dword [r11 + 0x24]
add rcx, r8
movzx edx, word [rcx + rbx*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
mov rcx, r14
add rax, r8
call rax
jmp 0x1400ae08c
add rsp, 0x7c8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x1400acf20
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov ebx, dword [rcx + r8 + 0x88]
add rbx, r8
cmp rbx, r8
je 0x1400acf35
mov r11d, dword [rbx + 0x18]
test r11d, r11d
je 0x1400acf35
mov r14d, dword [rbx + 0x20]
add r11d, r12d
mov edi, 0xfbc5a831
lea rcx, [r14 + r11*4]
mov r9d, dword [rcx + r8]
add r9, r8
mov r10b, byte [r9]
inc r9
test r10b, r10b
je 0x1400acf30
movsx ecx, r10b
sub r10b, 0x41
mov edx, ecx
or edx, 0x20
cmp r10b, 0x19
mov r10b, byte [r9]
cmova edx, ecx
inc r9
xor edx, edi
imul edi, edx, 0x1000193
add dword [rax], eax
add dword [rbp - 0x7c], eax
sal byte [rbp - 0x27], cl
add dword [rax], eax
add dword [rbp - 0x7c], eax
sal byte [rbp - 0x27], cl
cmp edi, 0x4ba5806c
je 0x1400acf3a
test r11d, r11d
jne 0x1400acee3
mov rax, qword [rax]
jmp 0x1400acebe
mov ecx, dword [rbx + 0x24]
add rcx, r8
movzx edx, word [rcx + r11*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
lea rcx, [rbp - 0x70]
add rax, r8
call rax
mov r12, rax
test rax, rax
jle 0x1400ae08c
cmp qword [rsp + 0x70], r13
Function at 0x1400b5ad4
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x1400b58a8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400b58a8
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400b58a8
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400b58a8
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400b58a8
cmp dword [rcx + 0x84], 0xe
jbe 0x1400b58a8
cmp dword [rcx + 0xf8], esi
je 0x1400b58a8
mov ecx, r14d
call fcn.1400b59f0
mov ecx, 2
call fcn.1400b5b28
nop
cmp byte [0x1401385a8], 0
jne 0x1400b5972
mov r15d, 1
mov eax, r15d
xchg dword [0x140138598], eax
test ebx, ebx
jne 0x1400b591b
mov rdi, qword [0x140131088]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x1401385a0]
cmp rcx, rax
je 0x1400b5912
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.140009110]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x1401388f8]
jmp 0x1400b5927
cmp ebx, r15d
jne 0x1400b592d
lea rcx, [0x140138910]
call fcn.1400bb258
nop
test ebx, ebx
jne 0x1400b5944
lea rdx, [0x1400d7f20]
lea rcx, [0x1400d7ef8]
call fcn.1400bb590
lea rdx, [0x1400d7f30]
lea rcx, [0x1400d7f28]
call fcn.1400bb590
movzx eax, byte [0x1401385a8]
test esi, esi
cmove eax, r15d
mov byte [0x1401385a8], al
jmp 0x1400b5972
mov ecx, 2
call fcn.1400b5b7c
test esi, esi
jne 0x1400b5989
mov ecx, r14d
call fcn.1400b59a4
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x1400b5838
Function at 0x1400c35ec
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x1400c348c
call fcn.1400a8794
mov dword [rax], reloc.WS2_32.dll_shutdown
call fcn.1400a26b8
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1400c3474
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x1400c3474
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x1400c34be
lock or dword [rax + 0x14], 0x10
jmp 0x1400c3474
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x1400c34db
mov rcx, qword [rbp + 0x10]
call fcn.1400c3964
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.1400b0948
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.1400c1944
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x1400c3532
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x1400c3474
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x1400c359e
mov rcx, qword [rbp + 0x10]
call fcn.1400b0948
cmp eax, 0xffffffff
je 0x1400c3585
mov rcx, qword [rbp + 0x10]
call fcn.1400b0948
cmp eax, 0xfffffffe
je 0x1400c3585
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.1400b0948
movsxd rdi, eax
lea rsi, [0x140138b00]
mov rcx, rbx
sar rdi, 6
call fcn.1400b0948
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x1400c358c
lea rax, [0x140131460]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1400c359e
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x1400c35d4
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x1400c35d0
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x1400c35d0
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x1400c3477
jmp 0x1400c3444
Function at 0x415360
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4154eb
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00432900
xorps xmm15, xmm15
mov r14, qword [0x007bb3b0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x4153c5
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x4153d4
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x4153f3
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x415403
cmp rbx, 0x1000
jae 0x4153cb
jmp 0x41546d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x415415
xor edx, edx
jmp 0x415464
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00432900
xorps xmm15, xmm15
mov r14, qword [0x007bb3b0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x4153f9
jmp 0x4153e8
call fcn.00462d40
xorps xmm15, xmm15
mov r14, qword [0x007bb3b0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00436d00
lea rax, [0x004d7273]
mov ebx, 0x18
nop dword [rax]
call fcn.00437580
mov rax, qword [rsp + 0x38]
call fcn.004372c0
lea rax, [0x004d78ac]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00437580
mov rax, qword [rsp + 0x30]
call fcn.004372c0
call fcn.00436f40
call fcn.00436d60
lea rax, [0x004da0c7]
mov ebx, 0x21
call fcn.00435360
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f680
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00415360
Function at 0x415520
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x415746
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00432980
xorps xmm15, xmm15
mov r14, qword [0x007bb3b0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x415593
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x4155a2
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x4155c5
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x4155d5
cmp rbx, 0x1000
jae 0x415599
nop
jmp 0x415658
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x4155ed
xor esi, esi
jmp 0x41564a
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00432980
xorps xmm15, xmm15
mov r14, qword [0x007bb3b0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x4155cb
jmp 0x4155b6
call fcn.00462d40
xorps xmm15, xmm15
mov r14, qword [0x007bb3b0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x4156e0
nop dword [rax + rax]
call fcn.00436d00
lea rax, [0x004d78c5]
mov ebx, 0x19
call fcn.00437580
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.004372c0
lea rax, [0x004d78ac]
mov ebx, 0x19
call fcn.00437580
mov eax, dword [rsp + 0x34]
call fcn.004372c0
nop
call fcn.00436f40
call fcn.00436d60
lea rax, [0x004d374b]
mov ebx, 0xd
call fcn.00435360
nop dword [rax + rax]
cmp eax, 0x5af
je 0x415680
call fcn.00436d00
lea rax, [0x004d78c5]
mov ebx, 0x19
call fcn.00437580
mov rax, qword [rsp + 0x38]
call fcn.004372c0
lea rax, [0x004d78ac]
mov ebx, 0x19
call fcn.00437580
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.004372c0
call fcn.00436f40
call fcn.00436d60
lea rax, [0x004d98c4]
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.00435360
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f680
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00415520