joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004f590
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0xd0
mov rax, qword [0x1400f9280]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, qword [rcx + 0xa00]
lea rax, [rsp + 0x30]
mov rdi, qword [rcx]
mov r14, rcx
mov dword [rsp + 0x30], 0x80
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov r8d, dword [rbx + 0x15c]
mov rdx, qword [rbx + 0x168]
add r8d, 4
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [rbx + 0x150], 0
mov dword [rbx + 0x154], eax
jne 0x14004f625
movsxd r8, dword [rsp + 0x30]
lea rcx, [rbx + 0xd0]
lea rdx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x30]
mov dword [rbx + 0x150], eax
mov r8d, dword [rbx + 0x154]
mov qword [rsp + 0xf8], rbp
mov qword [rsp + 0x100], rsi
cmp r8d, 4
jge 0x14004f686
lea rdx, str.Received_too_short_packet
mov rcx, rdi
call fcn.140028f50
mov dword [rbx + 0xc], 7
xor eax, eax
mov rsi, qword [rsp + 0x100]
mov rbp, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140062c80
add rsp, 0xd0
pop r14
pop rdi
pop rbx
ret
mov rdx, qword [rbx + 0x168]
movzx eax, byte [rdx]
movzx ecx, byte [rdx + 1]
shl eax, 8
or ecx, eax
mov dword [rbx + 0xc], ecx
sub ecx, 3
je 0x14004f741
sub ecx, 1
je 0x14004f7b4
sub ecx, 1
je 0x14004f6f0
cmp ecx, 1
je 0x14004f6d3
lea r8, str.Internal_error:_Unexpected_packet
mov rcx, rdi
lea rdx, [0x14006d7e0]
call fcn.140028f50
jmp 0x14004f7b4
add r8d, 0xfffffffe
add rdx, 2
mov rcx, rbx
call fcn.14004f2c0
test eax, eax
je 0x14004f7b4
jmp 0x14004f65a
movzx ecx, byte [rdx + 2]
lea eax, [r8 - 4]
movsxd rbp, eax
lea rsi, [rdx + 4]
movzx eax, byte [rdx + 3]
mov r8, rbp
shl ecx, 8
xor edx, edx
or ecx, eax
mov dword [rbx + 8], ecx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x14004f7b4
sub rax, rsi
cmp rax, rbp
jae 0x14004f7b4
mov r8, rsi
lea rdx, str.TFTP_error:__s_n
mov rcx, rdi
call fcn.1400290d0
jmp 0x14004f7b4
cmp r8d, 4
jle 0x14004f7b4
movzx eax, byte [rdx + 3]
movzx ecx, byte [rdx + 2]
shl ecx, 8
or ecx, eax
movzx eax, word [rbx + 0x48]
inc eax
movzx eax, ax
cmp eax, ecx
jne 0x14004f7b4
lea eax, [r8 - 4]
mov rcx, r14
lea r8, [rdx + 4]
movsxd r9, eax
mov edx, 1
call fcn.140028e70
mov esi, eax
test eax, eax
je 0x14004f793
mov edx, 5
mov rcx, rbx
call fcn.140050280
mov eax, esi
jmp 0x14004f65a
mov eax, dword [rbx + 0x154]
mov rcx, rdi
sub eax, 4
cdqe
add qword [rdi + 0xf8], rax
mov rdx, qword [rdi + 0xf8]
call fcn.1400384e0
mov rcx, r14
call fcn.1400387c0
test eax, eax
je 0x14004f658
mov edx, 5
mov rcx, rbx
call fcn.140050280
mov eax, Ordinal_46
jmp 0x14004f65a
Function at 0x140062690
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x1400626d2
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x140062719
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x140062772
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x140062730
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x1400627b3
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x140072ffa]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x140072ffb]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x140062780
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x140063690
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400636da
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400636da
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400636da
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400636da
cmp dword [rcx + 0x84], 0xe
jbe 0x1400636da
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400636dc
xor al, al
add rsp, 0x28
ret
Function at 0x14000f1c0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae 0x14000f1e5
cmp rax, rcx
je 0x14000f1eb
cmp rdx, 4
jae 0x14000f1ef
xor eax, eax
xor r8d, r8d
jmp 0x14000f280
pop rbp
jmp fcn.140002520
xor eax, eax
pop rbp
ret
mov r8d, edx
and r8d, 0x1c
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x1400314a0]
movdqa xmm3, xmmword [0x1400314b0]
pxor xmm1, xmm1
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x14000f210
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x14000f297
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x14000f280
pop rbp
ret

Function at 0x140013480
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov rsi, rcx
movups xmm0, xmmword [0x144088100]
movaps xmmword [rbp], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov rax, rbp
mov qword [rsp + 0x20], rax
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x1400134f1
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rbp]
cmp eax, 0x103
je 0x14001351e
test eax, eax
js 0x1400134fd
mov rdx, qword [rbp + 8]
xor eax, eax
jmp 0x140013514
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa8
pop rsi
pop rbp
ret
mov dword [rbp + 0x18], 0
mov byte [rbp + 0x1c], 0
lea rax, [0x144088160]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x18]
lea rdx, [rbp - 0x38]
call fcn.140012b80
mov qword [rbp - 8], rax
lea rcx, [rbp - 8]
call fcn.140012c40
mov ecx, 7
int 0x29
ud2
Function at 0x140024be0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov rsi, rcx
lea rcx, [rbp - 0x28]
call fcn.1400182d0
mov rcx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x20]
movabs rbx, 0x8000000000000000
cmp rcx, rbx
jne 0x140024c1e
mov qword [rbp - 8], rax
mov qword [rbp - 0x10], rbx
jmp 0x140024c44
mov rdx, qword [rbp - 0x18]
mov qword [rbp - 0x40], rcx
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rdx
lea rcx, [rbp - 0x10]
lea rdx, [rbp - 0x40]
call fcn.140024b00
mov r14, qword [rbp - 0x10]
cmp r14, rbx
jne 0x140024c5d
lea rcx, [rbp - 8]
call fcn.140012c60
mov qword [rsi], rbx
mov rdi, qword [rbp - 8]
mov r15, qword [rbp]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
invalid
je 0x140024c80
mov qword [rsi], r14
mov qword [rsi], rbx
test r14, r14
je 0x140024c50
mov rcx, qword [0x144091228]
xor edx, edx
mov r8, rdi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
pop rsi
Function at 0x14002dde0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002de2a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002de2a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002de2a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002de2a
cmp dword [rcx + 0x84], 0xe
jbe 0x14002de2a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14002de2c
xor al, al
add rsp, 0x28
ret

Function at 0x14002f450
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 8], 0xfffffffffffffffe
lea rcx, [0x144085235]
call sub.KERNEL32.dll_GetModuleHandleA
test rax, rax
je 0x14002f4b0
mov rdi, rax
lea rdx, [0x144085256]
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
je 0x14002f4b0
mov rsi, rax
lea rdx, [0x144085264]
mov rcx, rdi
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
je 0x14002f4b0
mov r14, rax
xor ebx, ebx
jmp 0x14002f532
lea rcx, [0x1440851f0]
call sub.KERNEL32.dll_GetModuleHandleA
test rax, rax
je 0x14002f598
mov rsi, rax
lea rdx, [0x1440851fa]
mov rcx, rax
mov ecx, eax
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
je 0x14002f598
mov rdi, rax
lea rdx, [0x14408520d]
mov rcx, rsi
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
je 0x14002f598
mov rbx, rax
lea rdx, [0x144085221]
mov rcx, rsi
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
je 0x14002f598
mov rsi, rax
lea rcx, [rbp - 0x20]
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call rdi
test eax, eax
jne 0x14002f598
mov r14, qword [rbp - 0x20]
movzx eax, byte [0x1440912a0]
mov ecx, 0x18
call fcn.140029840
dec dword [rax - 0x7b]
invalid
je 0x14002f59d
mov rdi, rax
mov qword [rax], rbx
mov qword [rax + 8], rsi
mov qword [rax + 0x10], r14
xor eax, eax
lock cmpxchg qword [0x144091168], rdi
je 0x14002f58a
mov rsi, rax
cmp qword [rdi], 0
je 0x14002f575
mov rcx, qword [rdi + 0x10]
call sub.KERNEL32.dll_CloseHandle
mov rcx, qword [0x144091228]
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdi, rsi
mov rax, rdi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
call fcn.14002f5f0
mov qword [rbp - 0x10], r14
mov qword [rbp - 0x18], rbx
mov ecx, 8
mov edx, 0x18
call fcn.14002e3c0
ud2
Function at 0x140001504
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x40
mov r8, rdx
mov ecx, 0x100000
xor edx, edx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenEventW]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x1400015c4
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp dword [section..data], 2
mov ebx, eax
jbe 0x1400015aa
mov eax, 0x800
test qword [0x14000c010], rax
je 0x1400015aa
mov rcx, qword [0x14000c018]
and rcx, rax
cmp rcx, qword [0x14000c018]
jne 0x1400015aa
lea rax, str.onecorexboxgameinput2published_svcgameinputservermanager.cpp
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x68], rax
lea rdx, [0x140009d0e]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x60], 0x17
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
call fcn.140001008
test ebx, ebx
jne 0x1400015b5
mov eax, 0x8000ffff
jmp 0x1400015e7
movzx eax, bx
or eax, 0x80070000
test ebx, ebx
cmovle eax, ebx
jmp 0x1400015e7
or edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
xor eax, eax
add rsp, 0x40
pop rbx
ret
Function at 0x1400023a4
Capabilities:
Check if file exists
Delete file

Disassembly:
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x40
mov rdi, rcx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
nop dword [rax + rax]
test eax, eax
jne 0x1400024db
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
cmp eax, 2
je 0x1400024db
cmp eax, 5
jne 0x140002461
mov rdx, rdi
xor ecx, ecx
call fcn.140004ed4
mov ebx, eax
test eax, eax
jns 0x1400024db
cmp dword [section..data], 2
jbe 0x14000245d
mov r8d, 0x800
test qword [0x14000c010], r8
je 0x14000245d
mov rcx, qword [0x14000c018]
and rcx, r8
cmp rcx, qword [0x14000c018]
jne 0x14000245d
mov dword [rbp + 0x28], eax
lea rdx, [0x140009c81]
lea rax, [0x140009588]
mov dword [rbp + 0x30], 0x78
mov qword [rbp + 0x38], rax
lea rax, [rbp + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x38]
mov qword [rsp + 0x20], rax
call fcn.140001008
mov eax, ebx
jmp 0x1400024dd
test ebx, ebx
je 0x1400024cc
cmp dword [section..data], 2
jbe 0x1400024cc
mov r8d, 0x800
test qword [0x14000c010], r8
je 0x1400024cc
mov rax, qword [0x14000c018]
and rax, r8
cmp rax, qword [0x14000c018]
jne 0x1400024cc
lea rax, [0x140009588]
mov dword [rbp + 0x28], ebx
mov qword [rbp + 0x38], rax
lea rdx, [0x140009d0e]
lea rax, [rbp + 0x28]
mov dword [rbp + 0x30], 0x7c
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x38]
mov qword [rsp + 0x20], rax
call fcn.140001008
movzx eax, bx
or eax, 0x80070000
test ebx, ebx
cmovle eax, ebx
jmp 0x1400024dd
xor eax, eax
add rsp, 0x40
pop rdi
pop rbx
pop rbp
ret
Function at 0x1400024ec
Capabilities:
Check if file exists

Disassembly:
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x60
mov rdi, r8
mov ebx, 0x28
mov ecx, ebx
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, qword gs:[0x60]
mov r8, rax
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov qword [rbp - 0x18], rax
mov rdx, rax
test rax, rax
je 0x140002626
mov r8d, ebx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
nop dword [rax + rax]
test eax, eax
je 0x14000258f
cmp eax, ebx
jne 0x140002576
mov rcx, qword [rbp - 0x18]
call fcn.1400062b4
xor eax, eax
mov qword [rbp - 0x18], rax
add ebx, ebx
jmp 0x14000257a
mov rax, qword [rbp - 0x18]
test rax, rax
je 0x140002507
xor edx, edx
mov qword [rdi], rax
mov qword [rbp - 0x18], rdx
xor ebx, ebx
jmp 0x140002696
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp dword [section..data], 2
mov edi, eax
jbe 0x140002604
mov r8d, 0x800
test qword [0x14000c010], r8
je 0x140002604
mov rcx, qword [0x14000c018]
and rcx, r8
cmp rcx, qword [0x14000c018]
jne 0x140002604
mov dword [rbp + 0x28], eax
lea rdx, [0x140009d0e]
lea rax, [0x140009588]
mov dword [rbp + 0x20], 0x95
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
call fcn.140001008
mov rdx, qword [rbp - 0x18]
test edi, edi
jne 0x140002616
mov ebx, 0x8000ffff
jmp 0x140002696
movzx ebx, di
or ebx, 0x80070000
test edi, edi
cmovle ebx, edi
jmp 0x140002696
cmp dword [section..data], 2
mov ebx, 0x8007000e
jbe 0x140002696
mov r8d, 0x800
test qword [0x14000c010], r8
je 0x140002696
mov rax, qword [0x14000c018]
and rax, r8
cmp rax, qword [0x14000c018]
jne 0x140002696
lea rax, [0x140009588]
mov dword [rbp + 0x38], ebx
mov qword [rbp - 8], rax
lea rdx, [0x140009cbe]
lea rax, [rbp + 0x38]
mov dword [rbp - 0x20], 0x92
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 8]
mov qword [rsp + 0x20], rax
call fcn.140001008
mov rdx, qword [rbp - 0x18]
test rdx, rdx
je 0x1400026a3
mov rcx, rdx
call fcn.1400062b4
mov eax, ebx
add rsp, 0x60
pop rdi
pop rbx
pop rbp
ret
Function at 0x1400033d0
Capabilities:
Check if file exists

Disassembly:
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x40
lea rax, [0x14000c6b0]
mov rdi, rcx
lea rcx, [0x14000c688]
mov qword [0x14000c6b8], rax
mov qword [0x14000c6b0], rax
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_InitializeCriticalSection]
nop dword [rax + rax]
call fcn.140004930
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateEventW]
nop dword [rax + rax]
mov qword [rdi], rax
test rax, rax
jne 0x14000344b
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ecx, eax
movzx eax, ax
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
jmp 0x14000359f
mov cl, 1
call fcn.140002734
test eax, eax
jns 0x14000345d
xor ecx, ecx
call fcn.140002734
call qword [sym.imp.api_ms_win_core_kernel32_legacy_l1_1_0.dll_WTSGetActiveConsoleSessionId]
nop dword [rax + rax]
mov ecx, eax
call fcn.1400046fc
mov ebx, eax
test eax, eax
jns 0x1400034e4
cmp dword [section..data], 2
jbe 0x1400034dd
mov r8d, 0x800
test qword [0x14000c010], r8
je 0x1400034dd
mov rcx, qword [0x14000c018]
and rcx, r8
cmp rcx, qword [0x14000c018]
jne 0x1400034dd
mov dword [rbp + 0x20], eax
lea rdx, [0x140009c81]
lea rax, str.onecorexboxgameinput2published_svc_service.cpp
mov dword [rbp + 0x28], 0x240
mov qword [rbp + 0x30], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x28]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.140001008
mov eax, ebx
jmp 0x14000359f
mov r8, rdi
lea rdx, [0x1400026c0]
lea rcx, str.GameInputSvc
call qword [sym.imp.api_ms_win_service_core_l1_1_0.dll_RegisterServiceCtrlHandlerExW]
nop dword [rax + rax]
mov qword [rdi + 8], rax
test rax, rax
jne 0x14000359d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp dword [section..data], 2
mov ebx, eax
jbe 0x140003583
mov r8d, 0x800
test qword [0x14000c010], r8
je 0x140003583
mov rcx, qword [0x14000c018]
and rcx, r8
cmp rcx, qword [0x14000c018]
jne 0x140003583
mov dword [rbp + 0x20], eax
lea rdx, [0x140009d0e]
lea rax, str.onecorexboxgameinput2published_svc_service.cpp
mov dword [rbp + 0x28], 0x243
mov qword [rbp + 0x30], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x28]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.140001008
test ebx, ebx
jne 0x14000358e
mov eax, 0x8000ffff
jmp 0x14000359f
movzx eax, bx
or eax, 0x80070000
test ebx, ebx
cmovle eax, ebx
jmp 0x14000359f
xor eax, eax
add rsp, 0x40
pop rdi
pop rbx
pop rbp
ret
Function at 0x14000384c
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rcx
mov rcx, qword [rcx + 0x68]
test rcx, rcx
je 0x14000396d
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x78]
test rcx, rcx
je 0x14000392d
mov edx, 0x1388
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
test eax, eax
je 0x14000391d
mov rcx, qword [rbx + 0x78]
mov edx, 0x5b4
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
nop dword [rax + rax]
cmp dword [section..data], 2
jbe 0x14000391d
mov edx, 0x800
test qword [0x14000c010], rdx
je 0x14000391d
mov rax, qword [0x14000c018]
and rax, rdx
cmp rax, qword [0x14000c018]
jne 0x14000391d
lea rax, str.GameInput_Instance_timeout_during_Session_deletion
mov dword [rsp + 0x50], 0x45
mov qword [rsp + 0x58], rax
lea rdx, [0x140009dcd]
lea rax, str.onecorexboxgameinput2published_svc_session.cpp
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call fcn.140001168
mov rcx, qword [rbx + 0x78]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x80]
test rcx, rcx
je 0x14000395d
mov edx, 0x1388
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x68]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, rbx
add rsp, 0x40
pop rbx
jmp fcn.1400062b4
Function at 0x140004c68
Capabilities:
Check if file exists
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rdi, r8
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFileAttributesW]
nop dword [rax + rax]
test eax, eax
jne 0x140004d26
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp dword [section..data], 2
mov ebx, eax
jbe 0x140004d09
mov r8d, 0x800
test qword [0x14000c010], r8
je 0x140004d09
mov rcx, qword [0x14000c018]
and rcx, r8
cmp rcx, qword [0x14000c018]
jne 0x140004d09
mov dword [rbp + 0x28], eax
lea rdx, [0x140009d0e]
lea rax, str.onecorexboxgameinput2published_svc_sfpmodify.cpp
mov dword [rbp - 0x10], 0x5d
mov qword [rbp - 8], rax
lea rax, [rbp + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 8]
mov qword [rsp + 0x20], rax
call fcn.140001008
test ebx, ebx
jne 0x140004d17
mov eax, 0x8000ffff
jmp 0x140004da4
movzx eax, bx
or eax, 0x80070000
test ebx, ebx
cmovle eax, ebx
jmp 0x140004da4
mov r8, rdi
mov rcx, rbx
call fcn.140004ad8
mov ebx, eax
test eax, eax
jns 0x140004da2
cmp dword [section..data], 2
jbe 0x140004d9e
mov r8d, 0x800
test qword [0x14000c010], r8
je 0x140004d9e
mov rcx, qword [0x14000c018]
and rcx, r8
cmp rcx, qword [0x14000c018]
jne 0x140004d9e
mov dword [rbp + 0x28], eax
lea rdx, [0x140009c81]
lea rax, str.onecorexboxgameinput2published_svc_sfpmodify.cpp
mov dword [rbp - 0x10], 0x62
mov qword [rbp - 8], rax
lea rax, [rbp + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 8]
mov qword [rsp + 0x20], rax
call fcn.140001008
mov eax, ebx
jmp 0x140004da4
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret