joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140011bc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
xor esi, esi
movsxd rax, dword [rcx + 0x3c]
mov edi, dword [rcx + rax + 0x88]
add rdi, rcx
mov rbx, rcx
mov rbp, rdx
mov r12d, dword [rdi + 0x20]
mov r13d, dword [rdi + 0x18]
add r12, rcx
cmp esi, r13d
jae 0x140011c2c
mov edx, dword [r12 + rsi*4]
mov rcx, rbp
add rdx, rbx
call sub.msvcrt.dll_strcmp
mov edx, eax
lea rax, [rsi + 1]
test edx, edx
jne 0x140011c27
mov eax, dword [rdi + 0x24]
add rsi, rsi
add rsi, rbx
movzx edx, word [rsi + rax]
mov eax, dword [rdi + 0x1c]
lea rdx, [rbx + rdx*4]
mov eax, dword [rdx + rax]
add rax, rbx
jmp 0x140011c2e
mov rsi, rax
jmp 0x140011bed
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret

Function at 0x140011c40
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x438
mov r14, qword [sym.imp.msvcrt.dll_wcscpy_s]
xor r13d, r13d
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rbx, qword [rax + 0x20]
lea r15, [rax + 0x20]
mov r12, rcx
lea rsi, [rsp + 0x228]
lea rbp, [rsp + 0x20]
cmp rbx, r15
je 0x140011cd5
mov eax, r13d
mov ecx, 0x82
mov rdi, rbp
mov edx, 0x104
rep stosd dword [rdi], eax
mov ecx, 0x82
mov rdi, rsi
rep stosd dword [rdi], eax
mov rcx, rbp
mov r8, qword [rbx + 0x40]
call r14
mov edx, 0x104
mov rcx, rsi
mov r8, r12
call r14
mov rdx, rbp
mov rcx, rsi
call fcn.140011af0
test eax, eax
je 0x140011cd0
mov rax, qword [rbx + 0x20]
jmp 0x140011cd7
mov rbx, qword [rbx]
jmp 0x140011c82
xor eax, eax
add rsp, 0x438
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140011d10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
xor esi, esi
movsxd rax, dword [rcx + 0x3c]
mov edi, dword [rcx + rax + 0x88]
add rdi, rcx
mov rbx, rcx
mov r12d, edx
mov r13d, dword [rdi + 0x20]
mov ebp, dword [rdi + 0x1c]
add r13, rcx
cmp esi, ebp
jae 0x140011d76
mov ecx, dword [r13 + rsi*4]
add rcx, rbx
call fcn.140011ab0
mov edx, eax
lea rax, [rsi + 1]
cmp edx, r12d
jne 0x140011d71
mov eax, dword [rdi + 0x24]
add rsi, rsi
add rsi, rbx
movzx eax, word [rsi + rax]
lea rax, [rbx + rax*4]
mov eax, dword [rax + rbp]
add rax, rbx
jmp 0x140011d78
mov rsi, rax
jmp 0x140011d3c
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x14001e300
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
lea rcx, [0x14001f1c0]
jmp 0x14000c100

Function at 0x14001e310
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
lea rcx, [0x14001f1c0]
jmp 0x14000c100
Function at 0x1400011c0
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov qword [rcx + 0x10], rdx
lea rbx, [rcx + 0x18]
mov rcx, rdx
mov rdx, rbx
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rdi, rax
mov qword [rsi], rax
test rax, rax
je 0x140001259
cmp dword [rbx], 2
jl 0x14000121d
mov ebp, 1
lea r14, str.__system_level
mov r13, qword [sym.imp.KERNEL32.dll_lstrcmpiW]
lea r15, str.__chrome_beta
lea r12, str.__chrome_dev
jmp 0x1400012a2
cmp byte [rsi + 0x1c], 0
jne 0x140001259
xor eax, eax
lea rbx, [rsp + 0x22]
mov word [rbx + 4], ax
mov word [rbx], ax
lea rcx, str.GoogleUpdateIsMachine
mov rdx, rbx
mov r8d, 2
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp eax, 1
sete al
cmp word [rbx], 0x31
sete cl
and cl, al
mov byte [rsi + 0x1c], cl
test rdi, rdi
setne al
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rax, str.401C381F_E0DE_4B85_8BD8_3F3F14FBDA57
jmp 0x14000128f
lea rax, str.4ea16ac7_fd5a_47c3_875b_dbf4a2008c20
jmp 0x14000128f
mov byte [rsi + 0x1c], 1
jmp 0x140001293
lea rax, str.8237E44A_0054_442C_B6B6_EA0509993955
mov qword [rsi + 8], rax
inc rbp
movsxd rax, dword [rbx]
cmp rbp, rax
jge 0x14000121d
mov rax, qword [rsi]
mov rcx, qword [rax + rbp*8]
mov rdx, r14
call r13
test eax, eax
je 0x140001282
mov rax, qword [rsi]
mov rcx, qword [rax + rbp*8]
mov rdx, r15
call r13
test eax, eax
je 0x140001288
mov rax, qword [rsi]
mov rcx, qword [rax + rbp*8]
mov rdx, r12
call r13
test eax, eax
je 0x140001270
mov rax, qword [rsi]
mov rcx, qword [rax + rbp*8]
lea rdx, str.__chrome_sxs
call r13
test eax, eax
je 0x140001279
mov rax, qword [rsi]
mov rcx, qword [rax + rbp*8]
lea rdx, str.__cleanup
call r13
test eax, eax
je 0x140001318
mov rax, qword [rsi]
mov rcx, qword [rax + rbp*8]
lea rdx, str.__chrome_frame
call r13
test eax, eax
jne 0x140001293
mov byte [rsi + 0x1d], 1
jmp 0x140001293
Function at 0x140001ad0
Capabilities:
Self delete using alternate data streams

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm6
mov rsi, rdx
mov rdi, rcx
mov dword [rdx], 1
mov r15, qword [sym.imp.KERNEL32.dll_CreateFileW]
xorps xmm6, xmm6
lea rbx, [rsp + 0x40]
mov r13, qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001b3a
mov rcx, r14
call r13
mov eax, dword [rsi]
cmp eax, 0x64
je 0x140001c96
inc eax
mov dword [rsi], eax
mov rax, qword [0x140007060]
test rax, rax
je 0x140001b98
mov rcx, qword [0x140007068]
call qword [0x140009008]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2200000
mov dword [rsp + 0x20], 3
mov rcx, rdi
mov edx, 0x10000
mov r8d, 7
xor r9d, r9d
call r15
cmp rax, 0xffffffffffffffff
je 0x140001bb6
mov r14, rax
mov byte [rsp + 0x40], 1
mov rcx, rax
mov edx, 4
mov r8, rbx
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_SetFileInformationByHandle]
test eax, eax
je 0x140001ba5
mov rcx, r14
call r13
jmp 0x140001b3a
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140001b3a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
mov rcx, r14
call r13
jmp 0x140001bbf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
mov ebp, r12d
and ebp, 0xfffffffe
cmp ebp, 2
je 0x140001c96
cmp r12d, 0x91
je 0x140001b12
cmp r12d, 0x20
je 0x140001b12
cmp r12d, 5
jne 0x140001c96
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2200000
mov dword [rsp + 0x20], 3
mov rcx, rdi
mov edx, 0x180
mov r8d, 7
xor r9d, r9d
call r15
cmp rax, 0xffffffffffffffff
je 0x140001b12
mov r14, rax
movaps xmmword [rsp + 0x50], xmm6
movaps xmmword [rsp + 0x40], xmm6
mov qword [rsp + 0x60], 0
mov rcx, rax
xor edx, edx
mov r8, rbx
mov r9d, 0x28
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandleEx]
test eax, eax
je 0x140001b0c
mov eax, dword [rsp + 0x60]
test al, 1
je 0x140001b0c
and eax, 0xfffffffe
mov dword [rsp + 0x60], eax
mov rcx, r14
xor edx, edx
mov r8, rbx
mov r9d, 0x28
call qword [sym.imp.KERNEL32.dll_SetFileInformationByHandle]
mov r12d, eax
mov rcx, r14
call r13
test r12d, r12d
jne 0x140001b3a
jmp 0x140001b12
cmp ebp, 2
sete al
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140002da0
Capabilities:
Get disk information

Disassembly:
push rsi
push rdi
sub rsp, 0x2a8
mov rsi, rdx
mov qword [rdx], 0
xor eax, eax
lea rdx, [rsp + 0x4e]
mov word [rdx + 0x208], ax
mov word [rdx], ax
mov dword [rsp + 0x40], 0
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
test eax, eax
je 0x140002e9f
xor eax, eax
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x38], 0
lea rcx, [rsp + 0x4e]
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x140002e9f
test byte [rsp + 0x40], 8
mov dil, 1
je 0x140002ea2
lea rcx, [rsp + 0x40]
mov qword [rcx], 0
call fcn.140002cc0
xor edi, edi
test al, al
je 0x140002ea2
lea rcx, [rsp + 0x4e]
mov word [rcx + 0x258], di
mov word [rcx], di
lea r8, [0x1400054d0]
mov edx, 0x12c
call fcn.1400034b0
test al, al
je 0x140002e92
mov r8, qword [rsp + 0x40]
lea rcx, [rsp + 0x4e]
mov edx, 0x12c
call fcn.1400034b0
test al, al
je 0x140002e90
lea r8, [0x14000558a]
lea rcx, [rsp + 0x4e]
mov edx, 0x12c
call fcn.1400034b0
test al, al
jne 0x140002eae
xor edi, edi
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140002ea2
mov dil, 1
mov eax, edi
add rsp, 0x2a8
pop rdi
pop rsi
ret
lea rcx, [rsp + 0x4e]
mov edx, 1
mov r8, rsi
xor r9d, r9d
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
setne dil
jmp 0x140002e92
Function at 0x140002ed0
Capabilities:
Create directory
Generate random numbers via rtlgenrandom

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, r8
mov rdi, rdx
mov r15, rcx
mov qword [r8], 0x6c
mov edx, 0x104
mov rcx, rdi
mov r8, r15
call fcn.140003470
test al, al
je 0x140002f37
lea r8, [0x140005662]
mov ebx, 0x104
mov edx, 0x104
mov rcx, rdi
call fcn.1400034b0
test al, al
je 0x140002f37
mov edx, 0x104
mov rcx, rdi
call fcn.140003440
sub rbx, rax
cmp rbx, 0xb
jae 0x140002f4a
xor eax, eax
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r14, rax
xorps xmm0, xmm0
lea rdx, [rsp + 0x38]
movaps xmmword [rdx - 8], xmm0
mov qword [rdx + 8], 0
mov dword [rdx - 8], 0x18
mov rcx, r15
call fcn.140002da0
test al, al
jne 0x140002f87
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 0x75
mov qword [rsi], rax
jmp 0x140002f37
mov qword [rsi], 0x6d
lea r15, [rdi + r14*2]
mov rbp, r14
add rbp, 5
mov r13d, 0xfffffff6
lea r12, [rsp + 0x2c]
jmp 0x14000301b
lea r8, [0x140005598]
mov edx, 0x104
mov rcx, rdi
call fcn.1400034b0
mov qword [rsi], 0
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140002fd1
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [rsi], 0
sete al
jmp 0x140002f39
mov word [rdi + r14*2 + 0xa], 0
mov edx, 0x104
mov rcx, rdi
lea r8, str..tmp
call fcn.1400034b0
mov rdx, qword [rsp + 0x38]
test rdx, rdx
lea rax, [rsp + 0x30]
cmovne rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140002fa6
inc r13d
je 0x140002fc1
mov rcx, r12
mov edx, 4
call sub.ADVAPI32.dll_SystemFunction036
mov edx, 4
mov rcx, r12
mov r8, r15
mov r9, rbx
call fcn.1400033e0
cmp rbp, 0x103
ja 0x140002fe4
jmp 0x140002fdc

Function at 0x1400036f0
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rdi, r9
mov rsi, r8
lea r9, [rsp + 0x34]
mov dword [r9], 0
lea eax, [rdi + rdi]
lea r8, [rsp + 0x30]
mov dword [r8], eax
mov rcx, qword [rcx]
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], rsi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140003734
add rsp, 0x38
pop rdi
pop rsi
ret
mov eax, 0x32
cmp dword [rsp + 0x34], 1
jne 0x14000372d
mov ecx, dword [rsp + 0x30]
cmp rcx, 2
jb 0x140003762
shr ecx, 1
cmp word [rsi + rcx*2 - 2], 0
je 0x140003767
mov eax, 0xea
cmp rcx, rdi
jae 0x14000372d
lea rsi, [rsi + rcx*2]
mov word [rsi], 0
xor eax, eax
jmp 0x14000372d

Function at 0x140003770
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
lea r9, [rsp + 0x34]
mov dword [r9], 0
lea rax, [rsp + 0x30]
mov dword [rax], 4
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1400037aa
add rsp, 0x38
ret
mov eax, 0x32
cmp dword [rsp + 0x34], 4
jne 0x1400037a5
xor ecx, ecx
cmp dword [rsp + 0x30], 4
mov eax, 0xe8
cmove eax, ecx
jmp 0x1400037a5
Function at 0x1400037d0
Capabilities:
Set registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax*2 + 2]
mov rcx, qword [rbx]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov rdx, rdi
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret

Function at 0x140003820
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
lea rax, [rsp + 0x34]
mov dword [rax], r8d
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
add rsp, 0x38
ret

Function at 0x140003860
Capabilities:
Query or enumerate registry value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, r9
mov rbx, r8
lea rax, [rsp + 0x40]
mov qword [rax], 0
mov qword [rsp + 0x20], rax
xor edi, edi
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400038b1
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400038a5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
mov r14, qword [rsp + 0x90]
lea r9, [rsp + 0x3c]
mov dword [r9], 0
lea eax, [r14 + r14]
lea rdx, [rsp + 0x38]
mov dword [rdx], eax
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rsi
xor edi, edi
mov rdx, rbx
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140003895
cmp dword [rsp + 0x3c], 1
jne 0x140003895
mov eax, dword [rsp + 0x38]
cmp rax, 2
jb 0x140003915
shr eax, 1
cmp word [rsi + rax*2 - 2], 0
je 0x14000391a
cmp rax, r14
jae 0x140003922
lea rsi, [rsi + rax*2]
mov word [rsi], 0
mov dil, 1
jmp 0x140003895
xor edi, edi
jmp 0x140003895

Function at 0x1400039d0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x248
mov rsi, rdx
mov rdi, rcx
lea rbx, [rsp + 0x30]
mov rcx, rbx
call fcn.140001d90
mov rcx, rbx
mov rdx, rsi
call fcn.140001df0
test al, al
je 0x140003aa3
mov rbx, qword [rdi + 8]
mov sil, 1
test rbx, rbx
je 0x140003aa5
xor r13d, r13d
mov ebp, 0x800000
lea r14, [rsp + 0x30]
lea r15, [rsp + 0x2c]
mov rsi, qword [sym.imp.KERNEL32.dll_WriteFile]
sub rbx, r13
cmp rbx, rbp
cmovae rbx, rbp
mov dword [rsp + 0x2c], 0
mov r12, qword [rdi]
add r12, r13
mov rcx, r14
call fcn.140001f60
mov qword [rsp + 0x20], 0
mov rcx, rax
mov rdx, r12
mov r8d, ebx
mov r9, r15
call rsi
test eax, eax
je 0x140003a7e
add r13, rbx
mov rbx, qword [rdi + 8]
cmp r13, rbx
jb 0x140003a32
mov sil, 1
jmp 0x140003aa5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea rdi, [rsp + 0x30]
mov rcx, rdi
call fcn.140001ea0
mov rcx, rdi
call fcn.140001db0
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
lea rcx, [rsp + 0x30]
call fcn.140001db0
mov eax, esi
add rsp, 0x248
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140003b68
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x14000003c]
lea rsi, [0x140000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x140003be0
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x140003be0
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x140003be0
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x140003bd4
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x140003bf2
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x140003bc2
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x140003be2
Function at 0x414340
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4144e6
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00432400
xorps xmm15, xmm15
mov r14, qword [0x00518e40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x4143ab
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x4143c7
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
call fcn.0044c180
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
sub rbx, rcx
test rbx, rbx
jbe 0x4143eb
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x4143ff
cmp rbx, 0x1000
jae 0x4143b5
jmp 0x414469
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x414411
xor edx, edx
jmp 0x414460
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00432400
xorps xmm15, xmm15
mov r14, qword [0x00518e40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x4143f5
jmp 0x4143e0
call fcn.0045fe00
xorps xmm15, xmm15
mov r14, qword [0x00518e40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.004369e0
lea rax, [0x0047471f]
mov ebx, 0x18
call fcn.004372e0
mov rax, qword [rsp + 0x38]
call fcn.00436fe0
lea rax, [0x004747c7]
mov ebx, 0x19
call fcn.004372e0
mov rax, qword [rsp + 0x30]
nop
call fcn.00436fe0
call fcn.00436c40
call fcn.00436a60
lea rax, [0x00475b2a]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.004351a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045c2c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00414340
Function at 0x414520
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41474a
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.004324a0
xorps xmm15, xmm15
mov r14, qword [0x00518e40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x414599
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x4145c0
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rax, rcx
call fcn.0044c180
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
sub rbx, rcx
mov rcx, rax
mov rax, qword [rsp + 0x68]
test rbx, rbx
jbe 0x4145e5
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x4145f9
cmp rbx, 0x1000
jae 0x4145a3
nop dword [rax]
jmp 0x414674
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x41460d
xor esi, esi
jmp 0x41466a
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.004324a0
xorps xmm15, xmm15
mov r14, qword [0x00518e40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x4145ef
jmp 0x4145d4
call fcn.0045fe00
xorps xmm15, xmm15
mov r14, qword [0x00518e40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x4146ec
call fcn.004369e0
lea rax, [0x0047493e]
mov ebx, 0x19
call fcn.004372e0
mov rax, qword [rsp + 0x68]
call fcn.00436fe0
lea rax, [0x004747c7]
mov ebx, 0x19
call fcn.004372e0
mov eax, dword [rsp + 0x34]
call fcn.00436fe0
call fcn.00436c40
call fcn.00436a60
lea rax, [0x00473358]
mov ebx, 0xd
call fcn.004351a0
cmp eax, 0x5af
je 0x414697
call fcn.004369e0
lea rax, [0x0047493e]
mov ebx, 0x19
call fcn.004372e0
mov rax, qword [rsp + 0x38]
call fcn.00436fe0
lea rax, [0x004747c7]
mov ebx, 0x19
nop
call fcn.004372e0
mov eax, dword [rsp + 0x34]
call fcn.00436fe0
call fcn.00436c40
call fcn.00436a60
lea rax, [0x00475686]
mov ebx, 0x1f
call fcn.004351a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045c2c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00414520
Function at 0x41ece0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41edde
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 8], 0
jmp 0x41ed20
mov rax, qword [rsp + 0x50]
mov rcx, rdx
mov rbx, qword [rsp + 0x58]
nop
cmp qword [rsp + 8], rbx
jae 0x41edcf
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov rax, rcx
call fcn.0041f840
nop dword [rax]
test rax, rax
je 0x41edcf
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
lea rcx, [0x0041ee20]
mov qword [rsp + 0x10], rcx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rbx, [rsp + 0x10]
mov qword [rsp], rbx
call fcn.0045c180
xorps xmm15, xmm15
mov r14, qword [0x00518e40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x60]
test rdx, rdx
jne 0x41edbd
xor eax, eax
jmp 0x41edc7
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x60]
test al, al
je 0x41ed12
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045c2c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0041ece0

Function at 0x455e40
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x455ef9
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rdx, [0x00455f40]
mov qword [rsp + 0x10], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x28], rdx
mov rdx, r14
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.0045c180
xorps xmm15, xmm15
mov r14, qword [0x00518e40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045c2c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00455e40