joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400450e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rsi, rcx
lea rcx, [0x1402041b8]
call fcn.14008c210
cmp qword [rsi], 0
jne 0x140045122
mov r8d, dword [0x1401d9878]
lea rdx, str.z:project_sw_svndip_asryzenmaster_asryzenmasterwinregistry.cpp
inc r8d
lea rcx, str.m_base___NULL
call fcn.140106930
xor r15d, r15d
nop word [rax + rax]
inc qword [rsi + 8]
mov rbx, qword [rsi]
mov rbp, qword [rsi + 8]
mov eax, dword [rbx + 0x10]
mov rdi, qword [rbx + 8]
mov dword [rsp + 0x70], eax
nop word [rax + rax]
mov rcx, qword [rbx]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], r15
lea r9, [rsp + 0x70]
mov qword [rsp + 0x30], r15
mov r8, rdi
mov qword [rsp + 0x28], rax
mov edx, ebp
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
je 0x140045187
cmp eax, 0xea
jne 0x1400451ef
mov ecx, dword [rbx + 0x10]
lea eax, [rcx - 1]
cmp dword [rsp + 0x70], eax
jb 0x1400451ba
lea eax, [rcx + rcx]
mov ecx, eax
mov dword [rsp + 0x70], eax
call fcn.14008cc70
mov rcx, qword [rbx + 8]
mov rdi, rax
call fcn.14008cc90
mov eax, dword [rsp + 0x70]
mov dword [rbx + 0x10], eax
mov qword [rbx + 8], rdi
jmp 0x140045150
mov rdx, qword [rbx + 8]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], r15b
jne 0x1400451c5
lea rcx, [rsi + 0x10]
call fcn.140034ad0
mov eax, dword [rsp + 0x78]
lea rdx, [rsi + 0x40]
mov rcx, rbx
mov dword [rsi + 0x38], eax
call fcn.140044b80
jmp 0x140045130
mov rbx, qword [rsp + 0x80]
mov qword [rsi + 8], 0xffffffffffffffff
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x140045640
Capabilities:
Query or enumerate registry key

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, [0x1402041b8]
call fcn.14008c210
cmp qword [rbx], 0
jne 0x140045678
mov r8d, dword [0x1401d9880]
lea rdx, str.z:project_sw_svndip_asryzenmaster_asryzenmasterwinregistry.cpp
inc r8d
lea rcx, str.m_base___NULL
call fcn.140106930
cmp qword [rbx + 8], 0xffffffffffffffff
jne 0x14004569c
mov r8d, dword [0x1401d9884]
lea rdx, str.z:project_sw_svndip_asryzenmaster_asryzenmasterwinregistry.cpp
inc r8d
lea rcx, str._IsDone__
call fcn.140106930
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.140044fa0

Function at 0x1400456b0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, [0x1402041b8]
call fcn.14008c210
cmp qword [rbx], 0
jne 0x1400456e8
mov r8d, dword [0x1401d9870]
lea rdx, str.z:project_sw_svndip_asryzenmaster_asryzenmasterwinregistry.cpp
inc r8d
lea rcx, str.m_base___NULL
call fcn.140106930
cmp qword [rbx + 8], 0xffffffffffffffff
jne 0x14004570c
mov r8d, dword [0x1401d9874]
lea rdx, str.z:project_sw_svndip_asryzenmaster_asryzenmasterwinregistry.cpp
inc r8d
lea rcx, str._IsDone__
call fcn.140106930
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.1400450e0
Function at 0x1400469f0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rbx, rcx
mov edi, r8d
lea rcx, [0x1402041b8]
mov rsi, rdx
call fcn.14008c210
mov rcx, qword [rbx]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], 4
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov dword [rsp + 0x50], edi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rbx, qword [rsp + 0x40]
test eax, eax
mov rsi, qword [rsp + 0x48]
sete al
add rsp, 0x30
pop rdi
ret

Function at 0x140046a60
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rbx, rdx
lea rcx, [0x1402041b8]
call fcn.14008c210
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rbx, qword [rsp + 0x40]
test eax, eax
sete al
add rsp, 0x30
pop rdi
ret

Function at 0x140046b90
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rdi, r8
lea rcx, [0x1402041b8]
mov rsi, rdx
call fcn.14008c210
cmp qword [rdi + 0x20], 0x10
lea r8, [rdi + 8]
mov rax, qword [rdi + 0x18]
jb 0x140046bc6
mov r8, qword [r8]
mov rcx, qword [rbx]
inc eax
mov dword [rsp + 0x28], eax
mov r9d, 1
mov qword [rsp + 0x20], r8
mov rdx, rsi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rbx, qword [rsp + 0x40]
test eax, eax
mov rsi, qword [rsp + 0x48]
sete al
add rsp, 0x30
pop rdi
ret
Function at 0x140121bb0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x1400023a0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400023ea
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400023ea
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400023ea
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400023ea
cmp dword [rcx + 0x84], 0xe
jbe 0x1400023ea
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400023ec
xor al, al
add rsp, 0x28
ret

Function at 0x14000ca34
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14000c84c
Function at 0x140013274
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14001328a
mov al, 1
jmp 0x1400132f6
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14001329b
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1400132f4
mov ecx, dword [rcx + 0x18]
nop
call fcn.14000f534
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400132f4
and qword [rsp + 0x38], 0
lea r8, [rsp + 0x38]
mov r9d, 1
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400132f4
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400132f4
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1400132f6
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x14001506c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14001509c
xor eax, eax
jmp 0x14001515f
mov rbp, rbx
cmp word [rax], si
je 0x1400150c1
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1400150a8
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1400150a4
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140014f8c
movsxd r14, eax
mov rcx, r14
test eax, eax
jne 0x140015102
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140015095
call fcn.1400102c0
mov rdi, rax
test rax, rax
jne 0x140015118
xor ecx, ecx
call fcn.14000d9b0
jmp 0x1400150f7
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140014f8c
test eax, eax
jne 0x140015149
mov rcx, rdi
call fcn.14000d9b0
jmp 0x140015153
xor ecx, ecx
call fcn.14000d9b0
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140016a98
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
xor edi, edi
mov rax, r15
lea rcx, [0x140060180]
and eax, 0x3f
mov r12, r15
sar r12, 6
mov rsi, rdx
lea r9d, [rdi + 0xa]
mov r14, r15
lea rbp, [rax + rax*8]
mov rax, qword [rcx + r12*8]
mov r10, qword [rax + rbp*8 + 0x28]
test r8, r8
je 0x140016aee
cmp word [rdx], r9w
jne 0x140016aee
or byte [rax + rbp*8 + 0x38], 4
jmp 0x140016af3
and byte [rax + rbp*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rax, rsi
mov rbx, rsi
cmp rsi, r8
jae 0x140016c72
mov r11d, 0xd
lea r13d, [r11 - 0xb]
movzx edx, word [rax]
cmp dx, 0x1a
je 0x140016c3d
lea rcx, [rax + 2]
cmp dx, r11w
jne 0x140016b3b
cmp rcx, r8
jae 0x140016b5b
cmp word [rcx], r9w
jne 0x140016b3b
add rax, 4
mov edx, r9d
jmp 0x140016b3e
mov rax, rcx
mov word [rbx], dx
mov r9, r13
mov rcx, rbx
mov r9d, 0xa
lea rbx, [rbx + r13]
cmp rax, r8
jb 0x140016b10
jmp 0x140016c72
lea r9, [rsp + 0x80]
mov word [rsp + 0x70], di
mov r8d, r13d
mov dword [rsp + 0x80], edi
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x20], rdi
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140016c36
cmp dword [rsp + 0x80], edi
je 0x140016c36
lea r9, [0x140060180]
mov rax, qword [r9 + r12*8]
test byte [rax + rbp*8 + 0x38], 0x48
mov ebp, 0xa
je 0x140016c10
movzx eax, word [rsp + 0x70]
cmp ax, bp
jne 0x140016bc3
mov word [rbx], bp
jmp 0x140016c6f
mov word [rsp + 0x78], ax
mov rdx, r14
mov rax, r14
sar rdx, 6
and eax, 0x3f
mov word [rbx], 0xd
lea r8, [rax + rax*8]
mov rax, qword [r9 + rdx*8]
lea rcx, [rax + r8*8]
mov al, byte [rsp + rdi + 0x78]
mov byte [rcx + rdi + 0x3a], al
inc rdi
cmp rdi, r13
jl 0x140016bde
mov rax, r14
sar rax, 6
and r14d, 0x3f
mov rax, qword [r9 + rax*8]
lea rcx, [r14 + r14*8]
mov byte [rax + rcx*8 + 0x3c], bpl
jmp 0x140016c6f
cmp word [rsp + 0x70], bp
jne 0x140016c1c
cmp rbx, rsi
je 0x140016bbb
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.1400169b4
cmp word [rsp + 0x70], bp
je 0x140016c72
mov word [rbx], 0xd
jmp 0x140016c6f
mov rcx, r15
lea r9, [0x140060180]
and ecx, 0x3f
mov rax, r15
sar rax, 6
lea r8, [rcx + rcx*8]
mov rcx, qword [r9 + rax*8]
mov al, byte [rcx + r8*8 + 0x38]
test al, 0x40
jne 0x140016c6c
or al, r13b
mov byte [rcx + r8*8 + 0x38], al
jmp 0x140016c72
mov word [rbx], dx
add rbx, r13
sub rbx, rsi
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001b294
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.140012ef4
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14001b31e
cmp byte [rbp - 0x21], r15b
je 0x14001b319
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x14001b354
call fcn.14000dc50
test eax, eax
jne 0x14001b340
cmp byte [rbp - 0x21], r15b
je 0x14001b338
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x14001b354
cmp byte [rbp - 0x21], r15b
je 0x14001b351
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.140012d54
test eax, eax
jne 0x14001b3f4
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.140012ef4
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14001b393
cmp byte [rbp - 0x21], r15b
je 0x14001b3c8
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x14001b3c8
call fcn.14000dc50
test eax, eax
jne 0x14001b3b4
cmp byte [rbp - 0x21], r15b
je 0x14001b3ad
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x14001b3c8
cmp byte [rbp - 0x21], r15b
je 0x14001b3c5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.140012d54
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x14001b3f4
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14001b3f7
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x14001b405
mov rcx, rdi
call fcn.14000d9b0
cmp byte [rbp + 0x3f], r15b
je 0x14001b414
mov rcx, qword [rbp + 0x27]
call fcn.14000d9b0
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14001c5c8
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1400169b4
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1400169b4
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14001c715
cmp rax, 0xffffffffffffffff
je 0x14001c715
xor edi, edi
test rbp, rbp
jle 0x14001c6c3
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14000d930
mov rbx, rax
test rax, rax
jne 0x14001c650
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14001c6b9
mov edx, 0x8000
mov ecx, r14d
call fcn.14000cab0
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14000ff90
cmp eax, 0xffffffff
je 0x14001c699
cdqe
sub rbp, rax
test rbp, rbp
jg 0x14001c660
mov edx, r15d
mov ecx, r14d
call fcn.14000cab0
jmp 0x14001c6b9
cmp byte [rsi + 0x38], dil
je 0x14001c6b0
cmp dword [rsi + 0x34], 5
jne 0x14001c6b0
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14001c6b9
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14000d9b0
jmp 0x14001c727
jns 0x14001c727
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1400169b4
cmp rax, 0xffffffffffffffff
jne 0x14001c6e1
cmp byte [rsi + 0x30], dil
je 0x14001c727
jmp 0x14001c71d
mov ecx, r14d
call fcn.14000f534
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x14001c727
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x14001c727
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x14001c722
mov edi, dword [rsi + 0x2c]
jmp 0x14001c727
mov edi, 0x16
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1400169b4
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x14001d380
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14001d3a8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14001d3a8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x100003240
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x100005100]
jne 0x10000325b
rol rcx, 0x10
test cx, 0xffff
jne 0x100003257
ret 0
ror rcx, 0x10
jmp 0x100003268
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rbx, rcx
lea rsi, [0x1000051c0]
mov rcx, rsi
call sub.ntdll.dll_RtlCaptureContext
mov rdi, qword [0x1000052b8]
lea rdx, [rsp + 0x70]
mov rcx, rdi
xor r8d, r8d
call sub.ntdll.dll_RtlLookupFunctionEntry
test rax, rax
je 0x1000032db
and qword [rsp + 0x38], 0
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x80]
mov r9, rax
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov r8, rdi
mov qword [rsp + 0x20], rsi
call sub.ntdll.dll_RtlVirtualUnwind
mov r11, qword [0x1000052b8]
jmp 0x1000032f7
mov r11, qword [rsp + 0x68]
lea rax, [rsp + 0x68]
add rax, 8
mov qword [0x1000052b8], r11
mov qword [0x100005258], rax
mov rax, qword [0x100005100]
mov qword [0x100005240], rbx
mov qword [0x100005130], r11
mov dword [0x100005124], 1
mov ebx, 0xc0000409
lea rcx, [0x100001370]
mov dword [0x100005120], ebx
mov qword [rsp + 0x40], rax
mov rax, qword [0x100005108]
mov qword [rsp + 0x48], rax
call sub.ntdll.dll_RtlUnhandledExceptionFilter
mov edx, ebx
or rcx, 0xffffffffffffffff
call sub.ntdll.dll_NtTerminateProcess
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x100003268
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x100005100]
jne 0x10000325b
rol rcx, 0x10
test cx, 0xffff
jne 0x100003257
ret 0
ror rcx, 0x10
jmp 0x100003268
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rbx, rcx
lea rsi, [0x1000051c0]
mov rcx, rsi
call sub.ntdll.dll_RtlCaptureContext
mov rdi, qword [0x1000052b8]
lea rdx, [rsp + 0x70]
mov rcx, rdi
xor r8d, r8d
call sub.ntdll.dll_RtlLookupFunctionEntry
test rax, rax
je 0x1000032db
and qword [rsp + 0x38], 0
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x80]
mov r9, rax
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov r8, rdi
mov qword [rsp + 0x20], rsi
call sub.ntdll.dll_RtlVirtualUnwind
mov r11, qword [0x1000052b8]
jmp 0x1000032f7
mov r11, qword [rsp + 0x68]
lea rax, [rsp + 0x68]
add rax, 8
mov qword [0x1000052b8], r11
mov qword [0x100005258], rax
mov rax, qword [0x100005100]
mov qword [0x100005240], rbx
mov qword [0x100005130], r11
mov dword [0x100005124], 1
mov ebx, 0xc0000409
lea rcx, [0x100001370]
mov dword [0x100005120], ebx
mov qword [rsp + 0x40], rax
mov rax, qword [0x100005108]
mov qword [rsp + 0x48], rax
call sub.ntdll.dll_RtlUnhandledExceptionFilter
mov edx, ebx
or rcx, 0xffffffffffffffff
call sub.ntdll.dll_NtTerminateProcess
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x100003938
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x100003985
cmp rcx, 0xffffffffffffffff
je 0x100003985
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x10000397d
cmp dword [rcx + 0x3c], edx
jl 0x10000397d
cmp dword [rcx + 0x3c], 0x10000000
jae 0x10000397d
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x100003985
mov rax, rdx
add rsp, 0x18
ret
Function at 0x1800183b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test edx, edx
je 0x1800183c1
mov ecx, edx
jmp 0x18001840a
mov ecx, 1
call fcn.1800184c0
mov rcx, rax
call fcn.180018430
mov rcx, rax
mov rdx, rbx
call 0x1800185c0
test rax, rax
jne 0x180018427
mov ecx, 3
call fcn.1800184c0
mov rcx, rax
call fcn.180018430
mov rcx, rax
mov rdx, rbx
call 0x1800185c0
test rax, rax
jne 0x180018427
mov ecx, 2
call fcn.1800184c0
mov rcx, rax
call fcn.180018430
mov rdx, rbx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp 0x1800185c0
add rsp, 0x20
pop rbx
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
movsxd rax, dword [rcx + 0x3c]
mov rbp, rdx
mov rsi, rcx
mov edi, dword [rax + rcx + 0x88]
add rdi, rcx
mov r12d, dword [rdi + 0x1c]
mov r13d, dword [rdi + 0x24]
add r12, rcx
add r13, rcx
cmp rdx, 0xffff
ja 0x18001861f
sub bp, word [rdi + 0x10]
movzx eax, bp
cmp eax, dword [rdi + 0x14]
jae 0x18001864a
movzx eax, bp
mov eax, dword [r12 + rax*4]
add rax, rcx
jmp 0x18001864c
mov r15d, dword [rdi + 0x20]
xor ebx, ebx
add r15, rsi
cmp dword [rdi + 0x18], ebx
jbe 0x18001864a
nop dword [rax]
mov edx, dword [r15 + rbx*4]
mov rcx, rbp
add rdx, rsi
call 0x180018ad0
test eax, eax
je 0x180018669
inc ebx
cmp ebx, dword [rdi + 0x18]
jb 0x180018630
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
movzx eax, word [r13 + rbx*2]
mov eax, dword [r12 + rax*4]
add rax, rsi
jmp 0x18001864c

Function at 0x180018560
Capabilities:
Access peb ldr_data

Disassembly:
cmp qword [rcx + 0x30], 0
jne 0x18001857e
mov rax, qword gs:[0x30]
mov rdx, qword [rax + 0x60]
mov rax, qword [rdx + 0x18]
mov rdx, qword [rax + 0x20]
jmp 0x180018582
mov rdx, qword [rcx + 0x10]
movups xmm0, xmmword [rdx - 0x10]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x50], xmm1
movsd xmm0, qword [rdx + 0x50]
movsd qword [rcx + 0x60], xmm0
mov rax, qword [rcx + 0x30]
ret
Function at 0x1800185c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test edx, edx
je 0x1800183c1
mov ecx, edx
jmp 0x18001840a
mov ecx, 1
call fcn.1800184c0
mov rcx, rax
call fcn.180018430
mov rcx, rax
mov rdx, rbx
call 0x1800185c0
test rax, rax
jne 0x180018427
mov ecx, 3
call fcn.1800184c0
mov rcx, rax
call fcn.180018430
mov rcx, rax
mov rdx, rbx
call 0x1800185c0
test rax, rax
jne 0x180018427
mov ecx, 2
call fcn.1800184c0
mov rcx, rax
call fcn.180018430
mov rdx, rbx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp 0x1800185c0
add rsp, 0x20
pop rbx
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
movsxd rax, dword [rcx + 0x3c]
mov rbp, rdx
mov rsi, rcx
mov edi, dword [rax + rcx + 0x88]
add rdi, rcx
mov r12d, dword [rdi + 0x1c]
mov r13d, dword [rdi + 0x24]
add r12, rcx
add r13, rcx
cmp rdx, 0xffff
ja 0x18001861f
sub bp, word [rdi + 0x10]
movzx eax, bp
cmp eax, dword [rdi + 0x14]
jae 0x18001864a
movzx eax, bp
mov eax, dword [r12 + rax*4]
add rax, rcx
jmp 0x18001864c
mov r15d, dword [rdi + 0x20]
xor ebx, ebx
add r15, rsi
cmp dword [rdi + 0x18], ebx
jbe 0x18001864a
nop dword [rax]
mov edx, dword [r15 + rbx*4]
mov rcx, rbp
add rdx, rsi
call 0x180018ad0
test eax, eax
je 0x180018669
inc ebx
cmp ebx, dword [rdi + 0x18]
jb 0x180018630
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
movzx eax, word [r13 + rbx*2]
mov eax, dword [r12 + rax*4]
add rax, rsi
jmp 0x18001864c

Function at 0x180018680
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, qword gs:[0x30]
mov rdx, qword [rax + 0x60]
mov rax, qword [rdx + 0x18]
mov rax, qword [rax + 0x10]
test rax, rax
je 0x1800186c4
nop word [rax + rax]
cmp qword [rax + 0x30], rcx
je 0x1800186af
mov rax, qword [rax]
test rax, rax
jne 0x1800186a0
ret
mov rdx, qword [rax + 8]
mov rcx, qword [rax]
mov qword [rdx], rcx
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov qword [rdx + 8], rcx
ret