joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004f28
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x1400b9fb8]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rdx
mov r9d, dword [rcx + 0x14]
mov r8d, dword [rcx + 0x10]
mov rdx, qword [rcx]
call fcn.1400027f0
mov r15d, eax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov r14, qword [rcx + 0x18]
mov rsi, r14
mov rsi, qword [rsi]
cmp qword [rsi + 0x30], 0
je 0x140004fa1
lea rdx, [0x1400966d8]
mov rcx, qword [rsi + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140004fa6
cmp r14, rsi
jne 0x140004f82
mov r9d, 0xa
lea r14d, [r9 + 2]
mov r8d, r14d
lea rdx, [0x1400966f8]
mov rcx, rdi
call fcn.1400027f0
mov dword [rsp + 0x20], 0xa
mov r9d, r14d
mov r8d, eax
mov rdx, qword [rsi + 0x30]
mov rcx, rdi
call fcn.1400028a8
mov rcx, qword [rdi + 8]
call rax
mov rdx, rax
mov eax, dword [rdi + 0x14]
mov dword [rsp + 0x20], eax
mov r9d, dword [rdi + 0x10]
mov r8d, r15d
mov rcx, rdi
call fcn.1400028a8
mov rdi, rax
mov qword [rsp + 0x38], rax
and qword [rsp + 0x78], 0
lea rcx, [rsp + 0x38]
call fcn.140001708
test al, al
je 0x140005032
lea rcx, vtable.std::_Func_impl_no_alloc_void____ptr64____cdecl___char_const____ptr64__struct__WIN32_FIND_DATAA____ptr64___void____ptr64__char_const____ptr64__struct__WIN32_FIND_DATAA____ptr64_.0
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdi
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x78], rcx
neg al
sbb rcx, rcx
lea rax, [rsp + 0x40]
and rcx, rax
mov qword [rbx + 0x38], 0
je 0x140005081
lea rax, [rsp + 0x40]
cmp rcx, rax
jne 0x14000507d
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 8]
mov qword [rbx + 0x38], rax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140005081
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
jmp 0x140005081
mov qword [rbx + 0x38], rcx
mov rax, rbx
jmp 0x14000508b
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14006d6b0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140007d0c
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x1400b9fb8]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rdx
mov r9d, dword [rcx + 0x14]
mov r8d, dword [rcx + 0x10]
mov rdx, qword [rcx]
call fcn.1400027f0
mov r15d, eax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov r14, qword [rcx + 0x18]
mov rsi, r14
mov rsi, qword [rsi]
cmp qword [rsi + 0x30], 0
je 0x140007d85
lea rdx, [0x1400966d8]
mov rcx, qword [rsi + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140007d8a
cmp r14, rsi
jne 0x140007d66
mov r9d, 0xa
lea r14d, [r9 + 2]
mov r8d, r14d
lea rdx, [0x1400966f8]
mov rcx, rdi
call fcn.1400027f0
mov dword [rsp + 0x20], 0xa
mov r9d, r14d
mov r8d, eax
mov rdx, qword [rsi + 0x30]
mov rcx, rdi
call fcn.1400028a8
mov rcx, qword [rdi + 8]
call rax
mov rdx, rax
mov eax, dword [rdi + 0x14]
mov dword [rsp + 0x20], eax
mov r9d, dword [rdi + 0x10]
mov r8d, r15d
mov rcx, rdi
call fcn.1400028a8
mov rdi, rax
mov qword [rsp + 0x38], rax
and qword [rsp + 0x78], 0
lea rcx, [rsp + 0x38]
call fcn.140001708
test al, al
je 0x140007e16
lea rcx, vtable.std::_Func_impl_no_alloc_int____cdecl___struct_HWND______ptr64__char_const____ptr64__struct__SECURITY_ATTRIBUTES_const____ptr64___int__struct_HWND______ptr64__char_const____ptr64__struct__SECURITY_ATTRIBUTES_const____ptr64_.0
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdi
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x78], rcx
neg al
sbb rcx, rcx
lea rax, [rsp + 0x40]
and rcx, rax
mov qword [rbx + 0x38], 0
je 0x140007e65
lea rax, [rsp + 0x40]
cmp rcx, rax
jne 0x140007e61
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 8]
mov qword [rbx + 0x38], rax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140007e65
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
jmp 0x140007e65
mov qword [rbx + 0x38], rcx
mov rax, rbx
jmp 0x140007e6f
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14006d6b0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140007e9c
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x1400b9fb8]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rdx
mov r9d, dword [rcx + 0x14]
mov r8d, dword [rcx + 0x10]
mov rdx, qword [rcx]
call fcn.1400027f0
mov r15d, eax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov r14, qword [rcx + 0x18]
mov rsi, r14
mov rsi, qword [rsi]
cmp qword [rsi + 0x30], 0
je 0x140007f15
lea rdx, [0x1400966d8]
mov rcx, qword [rsi + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140007f1a
cmp r14, rsi
jne 0x140007ef6
mov r9d, 0xa
lea r14d, [r9 + 2]
mov r8d, r14d
lea rdx, [0x1400966f8]
mov rcx, rdi
call fcn.1400027f0
mov dword [rsp + 0x20], 0xa
mov r9d, r14d
mov r8d, eax
mov rdx, qword [rsi + 0x30]
mov rcx, rdi
call fcn.1400028a8
mov rcx, qword [rdi + 8]
call rax
mov rdx, rax
mov eax, dword [rdi + 0x14]
mov dword [rsp + 0x20], eax
mov r9d, dword [rdi + 0x10]
mov r8d, r15d
mov rcx, rdi
call fcn.1400028a8
mov rdi, rax
mov qword [rsp + 0x38], rax
and qword [rsp + 0x78], 0
lea rcx, [rsp + 0x38]
call fcn.140001708
test al, al
je 0x140007fa6
lea rcx, vtable.std::_Func_impl_no_alloc_int____cdecl___struct__SHFILEOPSTRUCTA____ptr64___int__struct__SHFILEOPSTRUCTA____ptr64_.0
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdi
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x78], rcx
neg al
sbb rcx, rcx
lea rax, [rsp + 0x40]
and rcx, rax
mov qword [rbx + 0x38], 0
je 0x140007ff5
lea rax, [rsp + 0x40]
cmp rcx, rax
jne 0x140007ff1
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 8]
mov qword [rbx + 0x38], rax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140007ff5
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
jmp 0x140007ff5
mov qword [rbx + 0x38], rcx
mov rax, rbx
jmp 0x140007fff
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14006d6b0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x14000802c
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x1400b9fb8]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rdx
mov r9d, dword [rcx + 0x14]
mov r8d, dword [rcx + 0x10]
mov rdx, qword [rcx]
call fcn.1400027f0
mov r15d, eax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov r14, qword [rcx + 0x18]
mov rsi, r14
mov rsi, qword [rsi]
cmp qword [rsi + 0x30], 0
je 0x1400080a5
lea rdx, [0x1400966d8]
mov rcx, qword [rsi + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1400080aa
cmp r14, rsi
jne 0x140008086
mov r9d, 0xa
lea r14d, [r9 + 2]
mov r8d, r14d
lea rdx, [0x1400966f8]
mov rcx, rdi
call fcn.1400027f0
mov dword [rsp + 0x20], 0xa
mov r9d, r14d
mov r8d, eax
mov rdx, qword [rsi + 0x30]
mov rcx, rdi
call fcn.1400028a8
mov rcx, qword [rdi + 8]
call rax
mov rdx, rax
mov eax, dword [rdi + 0x14]
mov dword [rsp + 0x20], eax
mov r9d, dword [rdi + 0x10]
mov r8d, r15d
mov rcx, rdi
call fcn.1400028a8
mov rdi, rax
mov qword [rsp + 0x38], rax
and qword [rsp + 0x78], 0
lea rcx, [rsp + 0x38]
call fcn.140001708
test al, al
je 0x140008136
lea rcx, vtable.std::_Func_impl_no_alloc_int____cdecl___void____ptr64__struct__WIN32_FIND_DATAA____ptr64___int__void____ptr64__struct__WIN32_FIND_DATAA____ptr64_.0
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdi
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x78], rcx
neg al
sbb rcx, rcx
lea rax, [rsp + 0x40]
and rcx, rax
mov qword [rbx + 0x38], 0
je 0x140008185
lea rax, [rsp + 0x40]
cmp rcx, rax
jne 0x140008181
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 8]
mov qword [rbx + 0x38], rax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140008185
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
jmp 0x140008185
mov qword [rbx + 0x38], rcx
mov rax, rbx
jmp 0x14000818f
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14006d6b0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1400081bc
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x1400b9fb8]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rdx
mov r9d, dword [rcx + 0x14]
mov r8d, dword [rcx + 0x10]
mov rdx, qword [rcx]
call fcn.1400027f0
mov r15d, eax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov r14, qword [rcx + 0x18]
mov rsi, r14
mov rsi, qword [rsi]
cmp qword [rsi + 0x30], 0
je 0x140008235
lea rdx, [0x1400966d8]
mov rcx, qword [rsi + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14000823a
cmp r14, rsi
jne 0x140008216
mov r9d, 0xa
lea r14d, [r9 + 2]
mov r8d, r14d
lea rdx, [0x1400966f8]
mov rcx, rdi
call fcn.1400027f0
mov dword [rsp + 0x20], 0xa
mov r9d, r14d
mov r8d, eax
mov rdx, qword [rsi + 0x30]
mov rcx, rdi
call fcn.1400028a8
mov rcx, qword [rdi + 8]
call rax
mov rdx, rax
mov eax, dword [rdi + 0x14]
mov dword [rsp + 0x20], eax
mov r9d, dword [rdi + 0x10]
mov r8d, r15d
mov rcx, rdi
call fcn.1400028a8
mov rdi, rax
mov qword [rsp + 0x38], rax
and qword [rsp + 0x78], 0
lea rcx, [rsp + 0x38]
call fcn.140001708
test al, al
je 0x1400082c6
lea rcx, vtable.std::_Func_impl_no_alloc_int____cdecl___char_const____ptr64__char_const____ptr64__int___int__char_const____ptr64__char_const____ptr64__int_.0
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdi
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x78], rcx
neg al
sbb rcx, rcx
lea rax, [rsp + 0x40]
and rcx, rax
mov qword [rbx + 0x38], 0
je 0x140008315
lea rax, [rsp + 0x40]
cmp rcx, rax
jne 0x140008311
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 8]
mov qword [rbx + 0x38], rax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140008315
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
jmp 0x140008315
mov qword [rbx + 0x38], rcx
mov rax, rbx
jmp 0x14000831f
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14006d6b0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x14000834c
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x1400b9fb8]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rdx
mov r9d, dword [rcx + 0x14]
mov r8d, dword [rcx + 0x10]
mov rdx, qword [rcx]
call fcn.1400027f0
mov r15d, eax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov r14, qword [rcx + 0x18]
mov rsi, r14
mov rsi, qword [rsi]
cmp qword [rsi + 0x30], 0
je 0x1400083c5
lea rdx, [0x1400966d8]
mov rcx, qword [rsi + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1400083ca
cmp r14, rsi
jne 0x1400083a6
mov r9d, 0xa
lea r14d, [r9 + 2]
mov r8d, r14d
lea rdx, [0x1400966f8]
mov rcx, rdi
call fcn.1400027f0
mov dword [rsp + 0x20], 0xa
mov r9d, r14d
mov r8d, eax
mov rdx, qword [rsi + 0x30]
mov rcx, rdi
call fcn.1400028a8
mov rcx, qword [rdi + 8]
call rax
mov rdx, rax
mov eax, dword [rdi + 0x14]
mov dword [rsp + 0x20], eax
mov r9d, dword [rdi + 0x10]
mov r8d, r15d
mov rcx, rdi
call fcn.1400028a8
mov rdi, rax
mov qword [rsp + 0x38], rax
and qword [rsp + 0x78], 0
lea rcx, [rsp + 0x38]
call fcn.140001708
test al, al
je 0x140008456
lea rcx, vtable.std::_Func_impl_no_alloc_unsigned_long_int____cdecl___unsigned_long_int__char____ptr64___unsigned_long_int__unsigned_long_int__char____ptr64_.0
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdi
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x78], rcx
neg al
sbb rcx, rcx
lea rax, [rsp + 0x40]
and rcx, rax
mov qword [rbx + 0x38], 0
je 0x1400084a5
lea rax, [rsp + 0x40]
cmp rcx, rax
jne 0x1400084a1
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 8]
mov qword [rbx + 0x38], rax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1400084a5
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
jmp 0x1400084a5
mov qword [rbx + 0x38], rcx
mov rax, rbx
jmp 0x1400084af
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14006d6b0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1400084dc
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x1400b9fb8]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rdx
mov r9d, dword [rcx + 0x14]
mov r8d, dword [rcx + 0x10]
mov rdx, qword [rcx]
call fcn.1400027f0
mov r15d, eax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov r14, qword [rcx + 0x18]
mov rsi, r14
mov rsi, qword [rsi]
cmp qword [rsi + 0x30], 0
je 0x140008555
lea rdx, [0x1400966d8]
mov rcx, qword [rsi + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14000855a
cmp r14, rsi
jne 0x140008536
mov r9d, 0xa
lea r14d, [r9 + 2]
mov r8d, r14d
lea rdx, [0x1400966f8]
mov rcx, rdi
call fcn.1400027f0
mov dword [rsp + 0x20], 0xa
mov r9d, r14d
mov r8d, eax
mov rdx, qword [rsi + 0x30]
mov rcx, rdi
call fcn.1400028a8
mov rcx, qword [rdi + 8]
call rax
mov rdx, rax
mov eax, dword [rdi + 0x14]
mov dword [rsp + 0x20], eax
mov r9d, dword [rdi + 0x10]
mov r8d, r15d
mov rcx, rdi
call fcn.1400028a8
mov rdi, rax
mov qword [rsp + 0x38], rax
and qword [rsp + 0x78], 0
lea rcx, [rsp + 0x38]
call fcn.140001708
test al, al
je 0x1400085e6
lea rcx, vtable.std::_Func_impl_no_alloc_unsigned_long_int____cdecl___char_const____ptr64___unsigned_long_int__char_const____ptr64_.0
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdi
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x78], rcx
neg al
sbb rcx, rcx
lea rax, [rsp + 0x40]
and rcx, rax
mov qword [rbx + 0x38], 0
je 0x140008635
lea rax, [rsp + 0x40]
cmp rcx, rax
jne 0x140008631
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 8]
mov qword [rbx + 0x38], rax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140008635
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
jmp 0x140008635
mov qword [rbx + 0x38], rcx
mov rax, rbx
jmp 0x14000863f
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14006d6b0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x14000866c
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x1400b9fb8]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rdx
mov r9d, dword [rcx + 0x14]
mov r8d, dword [rcx + 0x10]
mov rdx, qword [rcx]
call fcn.1400027f0
mov r15d, eax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov r14, qword [rcx + 0x18]
mov rsi, r14
mov rsi, qword [rsi]
cmp qword [rsi + 0x30], 0
je 0x1400086e5
lea rdx, [0x1400966d8]
mov rcx, qword [rsi + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1400086ea
cmp r14, rsi
jne 0x1400086c6
mov r9d, 0xa
lea r14d, [r9 + 2]
mov r8d, r14d
lea rdx, [0x1400966f8]
mov rcx, rdi
call fcn.1400027f0
mov dword [rsp + 0x20], 0xa
mov r9d, r14d
mov r8d, eax
mov rdx, qword [rsi + 0x30]
mov rcx, rdi
call fcn.1400028a8
mov rcx, qword [rdi + 8]
call rax
mov rdx, rax
mov eax, dword [rdi + 0x14]
mov dword [rsp + 0x20], eax
mov r9d, dword [rdi + 0x10]
mov r8d, r15d
mov rcx, rdi
call fcn.1400028a8
mov rdi, rax
mov qword [rsp + 0x38], rax
and qword [rsp + 0x78], 0
lea rcx, [rsp + 0x38]
call fcn.140001708
test al, al
je 0x140008776
lea rcx, vtable.std::_Func_impl_no_alloc_unsigned_long_int____cdecl___char_const____ptr64__unsigned_long_int__char____ptr64__char____ptr64____ptr64___unsigned_long_int__char_const____ptr64__unsigned_long_int__char____ptr64__char____ptr64____ptr64_.0
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdi
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x78], rcx
neg al
sbb rcx, rcx
lea rax, [rsp + 0x40]
and rcx, rax
mov qword [rbx + 0x38], 0
je 0x1400087c5
lea rax, [rsp + 0x40]
cmp rcx, rax
jne 0x1400087c1
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 8]
mov qword [rbx + 0x38], rax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1400087c5
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
jmp 0x1400087c5
mov qword [rbx + 0x38], rcx
mov rax, rbx
jmp 0x1400087cf
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14006d6b0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x14003d940
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor ebp, ebp
mov r13d, r8d
mov rbx, rdx
mov r14, rcx
test rdx, rdx
je 0x14003d9c3
lea edx, [rbp + 0x10]
call fcn.1400391d0
mov rdi, rax
test rax, rax
je 0x14003d9c3
mov r8d, dword [rbx]
mov dword [rax], r8d
test r13b, 1
jne 0x14003d999
lea r8d, [rbp + 1]
cmp dword [rbx], r8d
jle 0x14003d999
add r8d, r8d
cmp r8d, dword [rbx]
jl 0x14003d991
movsxd rax, r8d
mov rcx, r14
lea rdx, [rax + rax*4]
shl rdx, 3
call fcn.1400391d0
mov qword [rdi + 8], rax
mov rsi, rax
test rax, rax
jne 0x14003d9e2
mov rdx, rdi
mov rcx, r14
call fcn.14003917c
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov r15, qword [rbx + 8]
cmp dword [rbx], ebp
jle 0x14003da5a
lea r12, [rax + 0x1c]
sub rsi, r15
mov rdx, qword [r15]
mov r8d, r13d
mov rcx, r14
call fcn.14003cfbc
mov qword [rsi + r15], rax
mov rcx, r14
mov rdx, qword [r15 + 8]
call fcn.14003943c
mov qword [r12 - 0x14], rax
mov rcx, r14
mov rdx, qword [r15 + 0x10]
call fcn.14003943c
mov qword [r12 - 0xc], rax
inc ebp
mov al, byte [r15 + 0x18]
lea r15, [r15 + 0x28]
and dword [r12], 0xfffffffe
mov byte [r12 - 4], al
mov eax, dword [r12]
xor eax, dword [r15 - 0xc]
and eax, 2
xor dword [r12], eax
lea r12, [r12 + 0x28]
mov eax, dword [r15 - 8]
mov dword [r12 - 0x24], eax
cmp ebp, dword [rbx]
jl 0x14003d9f1
mov rax, rdi
jmp 0x14003d9c5
Function at 0x140060ba0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
and qword [rcx], 0
mov rdi, rcx
mov ecx, 0x28
mov rsi, r8
mov rbp, rdx
call fcn.140044018
mov rbx, rax
test rax, rax
jne 0x14004f018
lea eax, [rbx + 7]
jmp 0x14004f07e
cmp dword [0x1400b87f4], 0
je 0x14004f052
mov qword [rax + 0x10], rbp
lea r8, [0x14004f108]
mov qword [rax + 0x18], rsi
mov r9, rbx
add rax, 8
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
and dword [rsp + 0x20], 0
call fcn.140079514
mov qword [rbx], rax
test rax, rax
jne 0x14004f060
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 0x28]
call fcn.14006f8b0
cmp qword [rbx + 0x10], 0
jne 0x14004f079
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, rsi
mov dword [rbx + 8], eax
call rbp
mov qword [rbx + 0x20], rax
mov qword [rdi], rbx
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
jmp 0x14004efe0

Function at 0x14007e5a8
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14007e3d4
Function at 0x140001840
Capabilities:
Access peb ldr_data
Encode data using xor
Get kernel32 base address
Get process filename
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x1400af040]
xor rax, rsp
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
mov r14, r8
movups xmmword [rsp + 0x20], xmm0
mov rsi, rdx
mov rbp, rcx
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140001907
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140001907
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xf0088e4c
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140001902
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x1400018e0
cmp r8d, 0x28683792
je 0x14000190c
test r9d, r9d
jne 0x1400018c0
mov rax, qword [rax]
jmp 0x140001890
mov ecx, dword [rbx + 0x24]
mov rdx, rsi
add rcx, r10
movzx r8d, word [rcx + r9*2]
xor r9d, r9d
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + r8*4]
lea r8d, [r9 + 0x30]
add rax, r10
mov rcx, rbp
call rax
cmp eax, 0xffffffff
je 0x140001a17
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400019c7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400019c7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xe90644b0
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1400019c2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x1400019a0
cmp r8d, 0x32c90288
je 0x1400019cc
test r9d, r9d
jne 0x140001980
mov rax, qword [rax]
jmp 0x140001950
mov edx, dword [rbx + 0x24]
mov rcx, rbp
add rdx, r10
movzx r9d, word [rdx + r9*2]
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov eax, dword [rdx + r9*4]
xor r9d, r9d
add rax, r10
lea rdx, [rsp + 0x20]
lea r8d, [r9 + 0x30]
call rax
cmp eax, 8
jb 0x140001a17
cmp dword [rsp + 0x20], 0x12345568
jne 0x140001a17
cmp dword [rsp + 0x24], 8
jne 0x140001a17
mov rax, qword [rsp + 0x28]
mov qword [r14], rax
mov al, 1
jmp 0x140001a19
xor al, al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14007fe40
add rsp, 0x60
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret