joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14010a2be
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x1401add20
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x198
lea rbp, [rsp + 0x20]
lea rcx, [0x140469f36]
call fcn.14010bbb9
mov eax, dword [rbp + 0x1a0]
not eax
mov dword [rbp + 0x1a0], eax
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x190]
mov qword [rbp + 0x28], rax
lea rax, [0x140338560]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x198], 0
je 0x1401ade65
mov rax, qword [rbp + 0x198]
mov qword [rbp + 0x158], rax
mov rax, qword [rbp + 0x198]
dec rax
mov qword [rbp + 0x198], rax
cmp qword [rbp + 0x158], 0
je 0x1401addb9
mov dword [rbp + 0x160], 1
jmp 0x1401addc3
mov dword [rbp + 0x160], 0
cmp dword [rbp + 0x160], 0
je 0x1401ade60
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x154], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x154]
mov byte [rbp + 0x64], al
movzx eax, byte [rbp + 0x64]
cmp eax, 0x23
jne 0x1401ade3a
cmp qword [rbp + 0x198], 2
jb 0x1401ade3a
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1401ade3a
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1401ade3a
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x64]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x1401add84
jmp 0x1401adeff
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x154], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x154]
mov byte [rbp + 0x84], al
movzx eax, byte [rbp + 0x84]
test eax, eax
je 0x1401adeff
movzx eax, byte [rbp + 0x84]
cmp eax, 0x23
jne 0x1401aded6
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1401aded6
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1401aded6
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x84]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x1401ade65
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret

Function at 0x14010a462
Capabilities:
Create process on windows

Disassembly:
jmp 0x1402bf480
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xf8
lea rbp, [rsp + 0x30]
lea rcx, [0x14046a2ba]
call fcn.14010bbb9
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rbp + 0xe8]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret
Function at 0x14010a4a3
Capabilities:
Parse pe header

Disassembly:
jmp 0x140313160
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140313180
xor al, al
jmp 0x140313201
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140313193
xor al, al
jmp 0x140313201
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1403131bd
xor al, al
jmp 0x140313201
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1403131d1
xor al, al
jmp 0x140313201
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1403131e3
xor al, al
jmp 0x140313201
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1403131ff
xor al, al
jmp 0x140313201
mov al, 1
add rsp, 0x38
ret
Function at 0x14010a6f6
Capabilities:
Log keystrokes via polling

Disassembly:
jmp 0x14016b850
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x14046963d]
call fcn.14010bbb9
movzx eax, byte [0x14044395d]
test eax, eax
jne 0x14016b87b
jmp 0x14016babe
mov dword [rbp + 4], 0x20
movss xmm0, dword [0x1403334b8]
call fcn.1401070e1
xorps xmm2, xmm2
movss xmm1, dword [0x140333670]
lea rcx, [rbp + 0xe4]
call fcn.140109fdf
xor edx, edx
mov rcx, rax
call fcn.14010813a
mov r8d, dword [rbp + 4]
xor edx, edx
lea rcx, str.Cheats_List
call fcn.14010a967
movzx eax, byte [0x140443154]
test eax, eax
je 0x14016b8f5
movzx eax, byte [0x140443155]
test eax, eax
jne 0x14016b8e9
mov ecx, dword [0x1403b31fc]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x14016b8f5
lea rcx, str.Aimbot__Toggle_
call fcn.140109acb
movzx edx, byte [0x1404431bb]
lea rcx, str.Anti_Record
call fcn.14016bb70
movzx edx, byte [0x140443318]
lea rcx, str.Bomb_Timer
call fcn.14016bb70
movzx edx, byte [0x1404432cb]
lea rcx, str.Crosshair
call fcn.14016bb70
movzx edx, byte [0x140443959]
lea rcx, str.Enemy_Sensor
call fcn.14016bb70
movzx edx, byte [0x1404431d3]
lea rcx, [0x140335958]
call fcn.14016bb70
movzx edx, byte [0x1404432fb]
lea rcx, str.External_Radar
call fcn.14016bb70
movzx edx, byte [0x140443965]
lea rcx, str.Fake_Duck
call fcn.14016bb70
movzx edx, byte [0x140443958]
lea rcx, str.Fast_Stop
call fcn.14016bb70
movss xmm0, dword [0x140443960]
ucomiss xmm0, dword [0x1403334a8]
jp 0x14016b9a0
je 0x14016b9ac
lea rcx, str.Flash_Immunity
call fcn.140109acb
movzx edx, byte [0x14044395e]
lea rcx, str.Force_Scope
call fcn.14016bb70
cmp dword [0x1403b31f4], 0x5a
je 0x14016b9d4
lea rcx, str.Fov_Changer
call fcn.140109acb
movzx edx, byte [0x14044318c]
lea rcx, str.Headshot_Line
call fcn.14016bb70
cmp dword [0x140443314], 0
je 0x14016b9f9
mov byte [rbp + 0xf4], 1
jmp 0x14016ba00
mov byte [rbp + 0xf4], 0
movzx edx, byte [rbp + 0xf4]
lea rcx, str.HitSound
call fcn.14016bb70
movzx edx, byte [0x14044331b]
lea rcx, str.Money_Service
call fcn.14016bb70
movzx edx, byte [0x14044395a]
lea rcx, str.No_Smoke
call fcn.14016bb70
movzx edx, byte [0x14044331a]
lea rcx, str.Radar_Hack
call fcn.14016bb70
movzx edx, byte [0x140443160]
lea rcx, [0x140332324]
call fcn.14016bb70
movzx edx, byte [0x14044395b]
lea rcx, str.Smoke_Color
call fcn.14016bb70
movzx edx, byte [0x140443319]
lea rcx, str.Spec_List
call fcn.14016bb70
movzx eax, byte [0x140443183]
test eax, eax
je 0x14016bab8
movzx eax, byte [0x140443184]
test eax, eax
jne 0x14016baac
mov ecx, dword [0x140443188]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x14016bab8
lea rcx, str.TriggerBot__Toggle_
call fcn.140109acb
call fcn.140109125
nop
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x14010b5e2
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x1401adc00
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x158
lea rbp, [rsp + 0x20]
lea rcx, [0x140469f36]
call fcn.14010bbb9
mov eax, dword [rbp + 0x160]
not eax
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0x28], rax
lea rax, [0x140338560]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x158]
mov qword [rbp + 0x118], rax
mov rax, qword [rbp + 0x158]
dec rax
mov qword [rbp + 0x158], rax
cmp qword [rbp + 0x118], 0
je 0x1401adc7f
mov dword [rbp + 0x120], 1
jmp 0x1401adc89
mov dword [rbp + 0x120], 0
cmp dword [rbp + 0x120], 0
je 0x1401adcd2
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
mov rdx, qword [rbp + 0x28]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 0x114], eax
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
mov eax, dword [rbp + 0x114]
mov dword [rbp + 4], eax
jmp 0x1401adc4a
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret
Function at 0x14010b67d
Capabilities:
Enumerate process modules

Disassembly:
jmp 0x140178850
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x7f8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x166
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x818]
mov rax, qword [0x140441900]
xor rax, rbp
mov qword [rbp + 0x7c8], rax
mov qword [rbp + 0x508], 0
lea rcx, [0x140469b34]
call fcn.14010bbb9
mov dword [rbp + 0x10], 0x438
mov rax, qword [rbp + 0x7f0]
mov edx, dword [rax + 0x10]
mov ecx, 8
call fcn.1401093c3
mov qword [rbp + 0x468], rax
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x468]
call fcn.140109ea9
mov dword [rbp + 0x484], 0
call fcn.14010b09c
mov dword [rbp + 0x4a4], eax
mov qword [rbp + 0x4c8], 0
mov qword [rbp + 0x4e8], 0
mov rcx, qword [rbp + 0x7f8]
call fcn.140107686
mov qword [rbp + 0x798], rax
lea rax, [rbp + 0x40]
mov qword [rbp + 0x4c8], rax
cmp qword [rbp + 0x4c8], 0
jne 0x14017893e
mov qword [rbp + 0x7a0], 0
jmp 0x140178a29
mov rcx, qword [rbp + 0x4c8]
call qword [sym.imp.ucrtbased.dll_wcslen]
inc eax
mov dword [rbp + 0x484], eax
cmp dword [rbp + 0x484], 0x3fffffff
jle 0x14017896f
mov qword [rbp + 0x7a8], 0
jmp 0x140178a1b
movsxd rax, dword [rbp + 0x484]
shl rax, 1
mov qword [rbp + 0x7b0], rax
movsxd rcx, dword [rbp + 0x484]
shl rcx, 1
add rcx, 0x24
mov qword [rbp + 0x7b8], rcx
mov rcx, qword [rbp + 0x7b8]
add rcx, 0xf
cmp rcx, qword [rbp + 0x7b8]
ja 0x1401789b3
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.140107d0c
sub rsp, rax
lea rax, [rsp + 0x20]
mov qword [rbp + 0x7c0], rax
lea r8, [rbp + 0x508]
mov rdx, qword [rbp + 0x7b8]
mov rcx, qword [rbp + 0x7c0]
call fcn.14010c2c6
add qword [rbp + 0x7c0], 0x20
mov r9d, dword [rbp + 0x4a4]
mov rax, qword [rbp + 0x7b0]
mov r8d, eax
mov rdx, qword [rbp + 0x4c8]
mov rcx, qword [rbp + 0x7c0]
call fcn.140108a18
mov qword [rbp + 0x7a8], rax
mov rax, qword [rbp + 0x7a8]
mov qword [rbp + 0x7a0], rax
mov rdx, qword [rbp + 0x798]
mov rcx, qword [rbp + 0x7a0]
call fcn.14010c31b
test eax, eax
jne 0x140178a6d
mov rcx, qword [rbp + 0x468]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp + 0x38]
mov qword [rbp + 0x768], rax
mov rcx, qword [rbp + 0x7f8]
call fcn.140107d57
mov rax, qword [rbp + 0x768]
jmp 0x140178ab0
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x468]
call fcn.140107aa5
test eax, eax
jne 0x140178906
mov rcx, qword [rbp + 0x468]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x788], 0
mov rcx, qword [rbp + 0x7f8]
call fcn.140107d57
mov rax, qword [rbp + 0x788]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x140336d50]
mov r8, qword [rbp + 0x508]
call fcn.14010a0d9
mov rax, rdi
mov rcx, qword [rbp + 0x7c8]
xor rcx, rbp
call fcn.14010946d
lea rsp, [rbp + 0x7d8]
pop rdi
pop rbp
ret
Function at 0x14010c02d
Capabilities:
Log keystrokes via polling

Disassembly:
jmp 0x14014bfd0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x228
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x4e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x248]
mov rax, qword [0x140441900]
xor rax, rbp
mov qword [rbp + 0x1e0], rax
lea rcx, [0x1404692d6]
call fcn.14010bbb9
movzx eax, byte [0x140443160]
test eax, eax
jne 0x14014c035
mov rcx, qword [rbp + 0x210]
call fcn.1401084ff
jmp 0x14014c219
mov eax, 0x130
mov eax, eax
mov ecx, dword [0x14044cfcc]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rax + rcx]
cmp dword [0x14044338c], eax
jle 0x14014c088
lea rcx, [0x14044338c]
call fcn.14010b3a8
cmp dword [0x14044338c], 0xffffffff
jne 0x14014c088
lea rcx, [0x140443380]
call fcn.14010bd49
nop
lea rcx, [0x14044338c]
call fcn.14010b5a1
mov rax, qword [rbp + 0x210]
mov ecx, dword [0x1403b31f8]
cmp dword [rax + 0xd8], ecx
jbe 0x14014c1f1
mov rax, qword [rbp + 0x210]
mov rax, qword [rax + 0x80]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x210]
add rax, 0xdc
mov qword [rbp + 0x1d8], rax
movss xmm2, dword [0x140329cfc]
lea rdx, [rbp + 0x144]
mov rcx, qword [rbp + 0x1d8]
call fcn.14010892d
mov r8, qword [rax]
lea rdx, [rbp + 0x164]
lea rcx, [0x140443380]
call fcn.140108603
mov r8, qword [rax]
lea rdx, [rbp + 0x184]
lea rcx, [rbp + 8]
call fcn.14010a359
mov r8, qword [rax]
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 8]
call fcn.140108603
mov rax, qword [rbp + 0x210]
movss xmm0, dword [rax + 0x128]
mulss xmm0, dword [str.X94_]
movss xmm1, dword [rbp + 0x2c]
divss xmm1, xmm0
movaps xmm0, xmm1
mulss xmm0, dword [0x140443370]
cvttss2si eax, xmm0
mov dword [rbp + 0x44], eax
mov rax, qword [rbp + 0x210]
movss xmm0, dword [rax + 0x128]
mulss xmm0, dword [str.X94_]
movss xmm1, dword [rbp + 0x28]
divss xmm1, xmm0
movaps xmm0, xmm1
mulss xmm0, dword [0x140443374]
cvttss2si eax, xmm0
mov dword [rbp + 0x64], eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14014c1b6
mov eax, dword [rbp + 0x64]
neg eax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, eax
mov edx, dword [rbp + 0x44]
mov ecx, 1
call qword [sym.imp.USER32.dll_mouse_event]
mov rax, qword [rbp + 0x210]
add rax, 0xdc
mov qword [rbp + 0x1d8], rax
movss xmm2, dword [0x140329cfc]
lea rdx, [rbp + 0x1a4]
mov rcx, qword [rbp + 0x1d8]
call fcn.14010892d
mov rax, qword [rax]
mov qword [0x140443380], rax
jmp 0x14014c20d
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rbp + 0x1c4]
call fcn.14010b853
mov rax, qword [rax]
mov qword [0x140443380], rax
mov rcx, qword [rbp + 0x210]
call fcn.1401084ff
lea rcx, [rbp - 0x30]
lea rdx, [0x14032a470]
call fcn.14010af02
mov rcx, qword [rbp + 0x1e0]
xor rcx, rbp
call fcn.14010946d
lea rsp, [rbp + 0x1f8]
pop rdi
pop rbp
ret
Function at 0x14016e5c0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
movss dword [rsp + 0x20], xmm3
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x14046963c]
call fcn.14010bbb9
mov ecx, dword [rbp + 0xe0]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14016e610
mov rax, qword [rbp + 0xe8]
mov byte [rax], 1
jmp 0x14016e681
mov rax, qword [rbp + 0xe8]
movzx eax, byte [rax]
test eax, eax
je 0x14016e681
xor edx, edx
mov ecx, dword [rbp + 0xf0]
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
mov r8d, 8
movzx edx, al
movzx ecx, byte [rbp + 0xf0]
call qword [sym.imp.USER32.dll_keybd_event]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov ecx, dword [rbp + 0xf0]
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
mov r8d, 2
movzx edx, al
movzx ecx, byte [rbp + 0xf0]
call qword [sym.imp.USER32.dll_keybd_event]
mov rax, qword [rbp + 0xe8]
mov byte [rax], 0
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret
Function at 0x140004540
Capabilities:
Enumerate processes

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x298
mov qword [rsp + 0x2e0], rcx
call fcn.140061090
mov rdx, qword [rsp + 0x2e0]
lea rcx, [rsp + 0x2e0]
call fcn.140061120
mov qword [rsp + 0x30], 0
lea rbp, [rsp + 0x50]
mov r8d, 0x238
xor edx, edx
mov rcx, rbp
call fcn.1400276e0
lea r12, [rsp + 0x30]
lea r13, [0x1400e6010]
mov rdx, r13
mov rcx, r12
call fcn.1400614a0
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400611d0
mov edx, eax
mov rcx, qword [rsp + 0x2e0]
call fcn.140058ed0
call fcn.1400611d0
mov edx, eax
lea rcx, [rsp + 0x2e0]
call fcn.140061320
test rdi, rdi
je 0x140004805
mov dword [rsp + 0x50], 0x238
mov rdx, rbp
mov rcx, rdi
call sub.KERNEL32.dll_Process32FirstW
mov rsi, 0xffffffffffffffff
test rax, rax
je 0x1400047cf
xor ebx, ebx
lea r15, [rsp + 0x48]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
jmp 0x140004643
mov rdx, r13
mov rcx, r12
call fcn.1400614a0
mov rdx, rbp
mov rcx, rdi
call sub.KERNEL32.dll_Process32NextW
test rax, rax
je 0x1400047c0
movsxd rsi, dword [rsp + 0x58]
mov r8, rsi
xor edx, edx
mov ecx, 0x410
call sub.KERNEL32.dll_OpenProcess
mov rbx, rax
test rax, rax
je 0x140004643
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400611d0
movsxd rcx, eax
call fcn.1400613f0
call fcn.140061090
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0x104
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400611d0
mov rcx, qword [rsp + 0x40]
mov edx, eax
call fcn.140058f60
call fcn.1400611d0
mov edx, eax
mov rcx, r15
call fcn.140061320
mov r9, qword [rsp + 0x20]
mov r8, qword [rsp + 0x48]
xor edx, edx
mov rcx, rbx
call sub.KERNEL32.dll_QueryFullProcessImageNameW
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400611d0
mov edx, eax
mov rcx, qword [rsp + 0x48]
call fcn.1400594e0
call fcn.1400611d0
mov edx, eax
mov rcx, qword [rsp + 0x28]
call fcn.140061320
mov rcx, rbx
call sub.KERNEL32.dll_CloseHandle
call fcn.1400612c0
mov rcx, qword [rsp + 0x38]
call fcn.140061430
call fcn.140061290
mov rcx, qword [rsp + 0x38]
call fcn.1400613b0
mov rcx, qword [rsp + 0x48]
call fcn.1400613b0
call fcn.1400611d0
mov edx, eax
mov rcx, r12
call fcn.140061320
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400611d0
mov edx, eax
mov rcx, qword [rsp + 0x30]
call fcn.14005ae48
call fcn.140061290
mov r14, rax
call fcn.1400611d0
mov edx, eax
mov rcx, r14
call fcn.140058ed0
mov r14, qword [rsp + 0x2e0]
call fcn.140061250
mov rcx, rax
mov rdx, r14
call fcn.140061190
test eax, eax
je 0x140004638
jmp 0x1400047c7
mov rsi, 0xffffffffffffffff
mov rcx, rbx
call sub.KERNEL32.dll_CloseHandle
mov rcx, rdi
call sub.KERNEL32.dll_CloseHandle
mov rcx, qword [rsp + 0x30]
call fcn.1400613b0
mov rcx, qword [rsp + 0x2e0]
call fcn.1400613b0
mov rax, rsi
add rsp, 0x298
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rsi, 0xffffffffffffffff
jmp 0x1400047d7
Function at 0x1400067d0
Capabilities:
Terminate process

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov qword [rsp + 0x40], rcx
call fcn.140061090
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x40]
call fcn.140061120
mov rcx, qword [rsp + 0x40]
call fcn.140004540
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000681e
call fcn.140061090
mov r8, rbx
xor edx, edx
mov ecx, 1
call sub.KERNEL32.dll_OpenProcess
mov rbx, rax
test rax, rax
jne 0x140006838
xor esi, esi
mov rcx, qword [rsp + 0x40]
call fcn.1400613b0
mov rax, rsi
add rsp, 0x28
pop rbx
pop rsi
ret
mov edx, 1
mov rcx, rax
call sub.KERNEL32.dll_TerminateProcess
xor esi, esi
test rax, rax
setne sil
mov rcx, rbx
call sub.KERNEL32.dll_CloseHandle
jmp 0x140006820
Function at 0x140008660
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, dword [0x1400e6020]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
jne 0x1400086ba
mov r8, qword [section..data]
lea edx, [rax + 8]
mov rcx, qword [0x1400e5fb0]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x1400e6020]
mov rdx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, rbx
call fcn.140006860
mov rdx, rbx
lea rcx, [0x140008638]
call fcn.1400087dc
mov rax, rbx
add rsp, 0x20
pop rbx
ret
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1400e6020], eax
add rsp, 0x28
jmp 0x140008660

Function at 0x1400086c4
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, dword [0x1400e6020]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
jne 0x1400086ba
mov r8, qword [section..data]
lea edx, [rax + 8]
mov rcx, qword [0x1400e5fb0]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x1400e6020]
mov rdx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, rbx
call fcn.140006860
mov rdx, rbx
lea rcx, [0x140008638]
call fcn.1400087dc
mov rax, rbx
add rsp, 0x20
pop rbx
ret
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1400e6020], eax
add rsp, 0x28
jmp 0x140008660
Function at 0x1400087dc
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
cmp dword [0x1400e6028], 0
lea rbx, [0x1400e6038]
mov r14, rdx
mov r15, rcx
jne 0x140008829
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rcx, rbx
mov dword [0x1400e602c], eax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x1400e6028], 1
mov ecx, dword [0x1400e602c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbp, rax
test rax, rax
jne 0x1400088fe
mov rcx, qword [0x1400e5fb0]
lea edx, [rax + 8]
lea r8d, [rax + 0x28]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
je 0x140008929
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x1400e6030]
test rax, rax
je 0x140008879
mov qword [rax], rbp
mov rcx, rbx
mov qword [rbp + 8], rax
mov qword [0x1400e6030], rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
and dword [rsp + 0x30], 0
lea r9, [rbp + 0x20]
and dword [rsp + 0x28], 0
mov rcx, rax
mov r8, rdi
mov dword [rsp + 0x20], 0x100000
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rdx, qword [rbp + 0x20]
lea rcx, [rbp + 0x18]
mov r9, rbp
mov dword [rsp + 0x28], 8
or dword [rsp + 0x20], 0xffffffff
lea r8, [0x140008944]
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
mov ecx, dword [0x1400e602c]
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, qword [0x1400e5fb0]
xor edx, edx
lea r8d, [rdx + 0x18]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x140008929
mov qword [rax + 8], r15
mov qword [rax + 0x10], r14
mov rcx, qword [rbp + 0x10]
mov qword [rax], rcx
mov qword [rbp + 0x10], rax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret

Function at 0x14000929c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400092e6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400092e6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400092e6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400092e6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400092e6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400092e8
xor al, al
add rsp, 0x28
ret
Function at 0x14000dc04
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000dc73
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000dc73
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000dc73
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000dc73
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000dc73
cmp dword [rcx + 0x84], 0xe
jbe 0x14000dc73
cmp dword [rcx + 0xf8], 0
je 0x14000dc73
mov ecx, ebx
call fcn.14000dd78
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14000da38
nop
cmp dword [rbp + 0x20], 0
je 0x14000dcc1
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000dccc
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x14000dc04

Function at 0x14000de64
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14000dc04