joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46b0c0
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x78
mov qword [rsp + 0x30], r14
mov rax, qword [r14 + 0x30]
inc dword [rax + 0xd8]
mov byte [r14 + 0xbf], 1
mov qword [r14 + 0x10], 0xfffffffffffffade
mov rax, qword [r14 + 0x30]
mov rcx, qword [rax + 0xa0]
mov ecx, dword [rcx + 0x14]
mov dword [rax + 0x2b4], ecx
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
inc dword [rax + 0x14]
lea rax, [rsp + 0x88]
mov qword [rsp + 0x18], rax
call fcn.00449f00
mov qword [rsp + 0x20], rax
mov rbx, qword [rsp + 0x18]
mov rcx, rax
mov rax, qword [rsp + 0x80]
call fcn.00442140
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 0x38]
mov qword [rax + 0x70], rcx
mov rdx, qword [rax + 0x40]
mov qword [rax + 0x78], rdx
mov rdx, qword [rax + 0x68]
mov qword [rax + 0x80], rdx
cmp qword [rax], rcx
ja 0x46b166
nop word [rax + rax]
cmp qword [rax + 8], rcx
jae 0x46b1b4
mov rdx, qword [rax + 0x38]
lea rbx, [0x00442ac0]
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsp + 0x18]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x50]
mov qword [rsp], rcx
call fcn.00470e00
xorps xmm15, xmm15
mov r14, qword [0x00d1a480]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x30]
mov ebx, 2
mov ecx, 3
nop
call fcn.0043bc40
mov rdx, qword [rsp + 0x30]
mov rsi, qword [rdx + 0x70]
cmp qword [rdx], rsi
ja 0x46b1d9
cmp qword [rdx + 8], rsi
jae 0x46b21c
lea rax, [0x004429c0]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rdx
lea rax, [rsp + 0x38]
mov qword [rsp], rax
nop dword [rax]
call fcn.00470e00
xorps xmm15, xmm15
mov r14, qword [0x00d1a480]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x30]
mov rax, qword [rdx + 0x80]
test rax, rax
je 0x46b22d
cmp qword [rdx], rax
ja 0x46b233
cmp qword [rdx + 8], rax
jae 0x46b26e
lea rax, [0x004428c0]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rdx
lea rax, [rsp + 0x38]
mov qword [rsp], rax
call fcn.00470e00
xorps xmm15, xmm15
mov r14, qword [0x00d1a480]
mov r14, qword gs:[r14]
mov r14, qword [r14]
lea rax, [0x00938ac8]
mov qword [rsp], rax
call fcn.00470e00
xorps xmm15, xmm15
mov r14, qword [0x00d1a480]
mov r14, qword gs:[r14]
mov r14, qword [r14]
lea rax, [rsp + 0x88]
mov qword [rsp + 0x28], rax
nop dword [rax]
call fcn.00449f00
mov rbx, qword [rsp + 0x28]
mov rcx, rax
mov rax, qword [rsp + 0x80]
call fcn.00442140
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x30]
dec dword [rax + 0xd8]
add rsp, 0x78
pop rbp
ret
Function at 0x46dfa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x46e117
movzx edx, byte [rax]
test edx, edx
jne 0x46dfd4
nop dword [rax]
test r8b, r8b
jne 0x46dfd4
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x46dfe7
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x46e0d7
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x46e0c5
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x46e0b7
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x46e03d
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x46e080
mov eax, 1
cmp rax, rbx
ja 0x46e06b
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call fcn.004732c0
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x46e0af
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x46e073
mov rcx, r11
mov eax, r12d
jmp 0x46e042
mov rcx, rbx
call fcn.00473200
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.00473200
mov eax, r8d
mov rcx, rbx
call fcn.004732c0
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x46e10d
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x46e0d0
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x46dfed
mov eax, edx
mov rcx, rbx
call fcn.00473200
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.00473200
nop
int3

Function at 0x46f800
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46f8af
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x0045a660]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00470e00
xorps xmm15, xmm15
mov r14, qword [0x00d1a480]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00470f20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.0046f800
Function at 0x14010c970
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14010c97d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14010c98d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14010c975
lea eax, [rcx + 1]
jmp 0x14010c99b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14010c9ae
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14010c994
sub eax, 3
jb 0x14010c9ce
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14010ca1d
sar eax, 1
movsxd rbp, eax
jb 0x14010ca04
jmp 0x14010c9dc
add ebx, ebx
jne 0x14010c9da
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14010ca04
inc ecx
add ebx, ebx
jne 0x14010c9ea
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14010ca04
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14010c9fd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14010c9ec
add ecx, 2
jmp 0x14010ca09
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.14010c932
jmp 0x14010c97d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0xccc00
mov dl, 0x16
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14010ca6d
cmp rsi, rcx
jae 0x14010ca75
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14010ca54
cmp al, 0x8f
ja 0x14010ca54
cmp byte [rsi - 2], 0xf
je 0x14010ca5a
sub al, 0xe8
cmp al, 1
ja 0x14010ca3e
cmp rsi, rcx
jae 0x14010ca75
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14010ca44
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14010ca75
lodsb al, byte [rsi]
jmp 0x14010ca54
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x109000]
mov eax, dword [rdi]
or eax, eax
je 0x14010cad2
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x10c4ec]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14010ca82
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14010cacc
mov qword [rbx], rax
add rbx, 8
jmp 0x14010caa2
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14010cb0c
cmp al, 0xef
ja 0x14010cafe
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14010cade
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x14010caed
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.14010cb8b], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.14010cb8b
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14010cb7b
sub rsp, 0xffffffffffffff80
jmp 0x140001125
Function at 0x14001102d
Capabilities:
Enumerate processes

Disassembly:
jmp 0x140011ba0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x428
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xa2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x448]
mov rax, qword [0x14001f2c0]
xor rax, rbp
mov qword [rbp + 0x3f8], rax
lea rcx, [0x1400250a4]
call fcn.14001141a
nop
mov dword [rbp + 0x10], 0x238
xor edx, edx
mov ecx, 2
call fcn.1400111d6
mov qword [rbp + 0x268], rax
cmp qword [rbp + 0x268], 0xffffffffffffffff
jne 0x140011c15
xor eax, eax
jmp 0x140011c9c
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x268]
call fcn.14001128f
nop
lea rdx, [rbp + 0x3c]
mov rcx, qword [rbp + 0x420]
call qword [sym.imp.ucrtbased.dll__wcsicmp]
test eax, eax
jne 0x140011c4e
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, dword [rbp + 0x18]
jmp 0x140011c9c
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x268]
call fcn.1400113bb
test eax, eax
je 0x140011c8c
lea rdx, [rbp + 0x3c]
mov rcx, qword [rbp + 0x420]
call qword [sym.imp.ucrtbased.dll__wcsicmp]
test eax, eax
jne 0x140011c8a
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, dword [rbp + 0x18]
jmp 0x140011c9c
jmp 0x140011c4e
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001c470]
call fcn.14001138e
mov rax, rdi
mov rcx, qword [rbp + 0x3f8]
xor rcx, rbp
call fcn.1400111ef
lea rsp, [rbp + 0x408]
pop rdi
pop rbp
ret
Function at 0x1400111fe
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
jmp 0x1400120f0
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x40]
lea rcx, [0x1400250a4]
call fcn.14001141a
nop
mov qword [rbp + 8], 0
mov qword [rbp + 0x28], 0
mov eax, dword [rbp + 0x130]
mov dword [rsp + 0x20], 0x20
mov r9d, 0x1000
mov r8d, eax
xor edx, edx
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 8], rax
mov eax, dword [rbp + 0x130]
mov qword [rsp + 0x20], 0
mov r9d, eax
mov r8, qword [rbp + 0x128]
mov rdx, qword [rbp + 8]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, qword [rbp + 8]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
je 0x1400121d9
mov edx, 0x1f4
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
xor eax, eax
jmp 0x1400121de
mov eax, 0xffffffff
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x14001124e
Capabilities:
Terminate process

Disassembly:
jmp 0x1400148b0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret
Function at 0x1400112d5
Capabilities:
Get memory capacity
Get system information on windows
Query or enumerate registry key

Disassembly:
jmp 0x140012780
push rbp
push rdi
sub rsp, 0x238
lea rbp, [rsp + 0x60]
lea rdi, [rsp + 0x60]
mov ecx, 0x46
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14001f2c0]
xor rax, rbp
mov qword [rbp + 0x1c8], rax
lea rcx, [0x1400250a4]
call fcn.14001141a
nop
lea rax, [rbp + 8]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
mov dword [rbp + 0x60], 0x40
mov dword [rbp + 0x64], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x80], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x90], 0
mov qword [rbp + 0x98], 0
mov qword [rbp + 0xb8], 0
mov dword [rbp + 0xd4], 0
mov dword [rbp + 0xf4], 0
lea rcx, [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
nop
cmp dword [rbp + 0x28], 2
jae 0x14001285a
mov eax, 1
jmp 0x140012954
lea rcx, [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
jne 0x14001286f
xor eax, eax
jmp 0x140012954
cmp dword [rbp + 0x68], 0x80000000
jae 0x140012882
mov eax, 1
jmp 0x140012954
lea rax, [rbp + 0xb8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SYSTEMControlSet001EnumUSBSTOR
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rbp + 0xf4], eax
cmp dword [rbp + 0xf4], 0
je 0x1400128c1
xor eax, eax
jmp 0x140012954
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rax, [rbp + 0xd4]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0xb8]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov dword [rbp + 0xf4], eax
cmp dword [rbp + 0xf4], 0
je 0x140012934
xor eax, eax
jmp 0x140012954
cmp dword [rbp + 0xd4], 2
jae 0x140012944
mov eax, 1
jmp 0x140012954
mov rcx, qword [rbp + 0xb8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x60]
lea rdx, [0x14001c2d0]
call fcn.14001138e
mov rax, rdi
mov rcx, qword [rbp + 0x1c8]
xor rcx, rbp
call fcn.1400111ef
lea rsp, [rbp + 0x1d8]
pop rdi
pop rbp
ret
Function at 0x1400112f3
Capabilities:
Parse pe header

Disassembly:
jmp 0x140015c00
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140015c20
xor al, al
jmp 0x140015ca1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140015c33
xor al, al
jmp 0x140015ca1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140015c5d
xor al, al
jmp 0x140015ca1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140015c71
xor al, al
jmp 0x140015ca1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140015c83
xor al, al
jmp 0x140015ca1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140015c9f
xor al, al
jmp 0x140015ca1
mov al, 1
add rsp, 0x38
ret
Function at 0x1400113c5
Capabilities:
Enumerate processes

Disassembly:
jmp 0x140011920
push rbp
push rdi
sub rsp, 0x468
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xb2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14001f2c0]
xor rax, rbp
mov qword [rbp + 0x438], rax
lea rcx, [0x1400250a4]
call fcn.14001141a
nop
mov qword [rbp + 8], 0
mov dword [rbp + 0x30], 0x238
mov dword [rbp + 0x34], 0
mov dword [rbp + 0x38], 0
mov qword [rbp + 0x40], 0
mov dword [rbp + 0x48], 0
mov dword [rbp + 0x4c], 0
mov dword [rbp + 0x50], 0
mov dword [rbp + 0x54], 0
mov dword [rbp + 0x58], 0
lea rax, [rbp + 0x5c]
mov rdi, rax
xor eax, eax
mov ecx, 0x20c
rep stosb byte [rdi], al
mov dword [rbp + 0x284], 0
xor edx, edx
mov ecx, 2
call fcn.1400111d6
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0xffffffffffffffff
jne 0x1400119d9
jmp 0x140011a4e
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.14001128f
test eax, eax
jne 0x1400119ec
jmp 0x140011a4e
mov dword [rbp + 0x2a4], 0
jmp 0x140011a06
mov eax, dword [rbp + 0x2a4]
inc eax
mov dword [rbp + 0x2a4], eax
cmp dword [rbp + 0x2a4], 5
jge 0x140011a3d
movsxd rax, dword [rbp + 0x2a4]
lea rcx, str.x64dbg.exe
mov rdx, qword [rcx + rax*8]
lea rcx, [rbp + 0x5c]
call qword [sym.imp.ucrtbased.dll_wcscmp]
test eax, eax
jne 0x140011a3b
mov dword [rbp + 0x284], 1
jmp 0x140011a3d
jmp 0x1400119f8
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.1400113bb
test eax, eax
jne 0x1400119ec
cmp qword [rbp + 8], 0
je 0x140011a60
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, dword [rbp + 0x284]
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001c170]
call fcn.14001138e
mov eax, edi
mov rcx, qword [rbp + 0x438]
xor rcx, rbp
call fcn.1400111ef
lea rsp, [rbp + 0x448]
pop rdi
pop rbp
ret
Function at 0x140013ae0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.140011447
movzx eax, al
test eax, eax
jne 0x140013b00
mov ecx, 7
call fcn.14001139d
nop
mov byte [rsp + 0x20], 0
call fcn.1400113b1
mov byte [rsp + 0x21], al
cmp dword [0x14001fb28], 1
jne 0x140013b24
mov ecx, 7
call fcn.14001139d
nop
jmp 0x140013b7c
cmp dword [0x14001fb28], 0
jne 0x140013b77
mov dword [0x14001fb28], 1
lea rdx, [0x14001b660]
lea rcx, [0x14001b330]
call fcn.1400111d1
test eax, eax
je 0x140013b58
mov eax, 0xff
jmp 0x140013c81
lea rdx, [0x14001b220]
lea rcx, [section..rdata]
call fcn.1400113a7
mov dword [0x14001fb28], 2
jmp 0x140013b7c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.140011384
call fcn.140011316
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140013bd9
mov rcx, qword [rsp + 0x30]
call fcn.140011172
movzx eax, al
test eax, eax
je 0x140013bd9
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140026020]
nop
call fcn.14001134d
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x140013c0d
mov rcx, qword [rsp + 0x38]
call fcn.140011172
movzx eax, al
test eax, eax
je 0x140013c0d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.1400113fc
nop
call fcn.140013d30
mov dword [rsp + 0x28], eax
call fcn.1400112f3
movzx eax, al
test eax, eax
jne 0x140013c2c
mov ecx, dword [rsp + 0x28]
call fcn.14001105f
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x140013c3b
call fcn.14001140b
nop
xor edx, edx
mov cl, 1
call fcn.140011163
mov eax, dword [rsp + 0x28]
jmp 0x140013c81
add rsp, 0x68
ret
Function at 0x412f80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41310b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x005729a0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x412fe5
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x412ff4
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x413013
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x413023
cmp rbx, 0x1000
jae 0x412feb
jmp 0x41308d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x413035
xor edx, edx
jmp 0x413084
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x005729a0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x413019
jmp 0x413008
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x005729a0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call sym.runtime.printlock
lea rax, [0x0047bfbc]
mov ebx, 0x18
nop dword [rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x0047c283]
mov ebx, 0x19
nop dword [rax + rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x30]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x0047da64]
mov ebx, 0x21
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.runtime.sysUnusedOS
Function at 0x413140
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x413366
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x005729a0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x4131b3
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x4131c2
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x4131e5
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x4131f5
cmp rbx, 0x1000
jae 0x4131b9
nop
jmp 0x413278
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x41320d
xor esi, esi
jmp 0x41326a
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x005729a0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x4131eb
jmp 0x4131d6
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x005729a0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x413300
nop dword [rax + rax]
call sym.runtime.printlock
lea rax, [0x0047c29c]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call sym.runtime.printuint
lea rax, [0x0047c283]
mov ebx, 0x19
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
call sym.runtime.printuint
nop
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x00479e38]
mov ebx, 0xd
call sym.runtime.throw
nop dword [rax + rax]
cmp eax, 0x5af
je 0x4132a0
call sym.runtime.printlock
lea rax, [0x0047c29c]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x0047c283]
mov ebx, 0x19
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
nop dword [rax]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x0047d4a6]
mov ebx, 0x1f
nop dword [rax + rax]
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp sym.runtime.sysUsedOS