joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140008eea
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
jmp 0x140119560
sub rsp, 0x58
lea rcx, [rsp + 0x28]
call fcn.1400087ec
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax + 0x30]
lea rcx, [rsp + 0x30]
call fcn.14000882d
lea rcx, [rsp + 0x30]
call fcn.14000798c
movzx eax, al
test eax, eax
je 0x1401195e8
lea rcx, [rsp + 0x30]
call fcn.14000385a
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x24], 0
je 0x1401195e8
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.140008404
mov rcx, rax
call fcn.140006c49
cmp eax, 0x2fa62ca8
jne 0x1401195e6
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.140007167
jmp 0x1401195ff
jmp 0x1401195a0
lea rcx, [rsp + 0x28]
call fcn.140002e64
movzx eax, al
test eax, eax
jne 0x14011956e
xor eax, eax
add rsp, 0x58
ret

Function at 0x140008f8a
Capabilities:
Write file on windows

Disassembly:
jmp 0x1401db660
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rdi
sub rsp, 0x160
mov rax, qword [0x14039ae00]
xor rax, rsp
mov qword [rsp + 0x140], rax
cmp byte [rcx + 0xf1e], 0
mov rdi, rcx
jne 0x1401db6a3
cmp qword [rcx + 0x678], 0
je 0x1401db780
mov r8, rdx
mov qword [rsp + 0x158], rbx
mov edx, 0x100
lea r9, [rsp + 0x180]
lea rcx, [rsp + 0x30]
call fcn.1400039d1
lea rax, [rsp + 0x30]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x1401db6d1
mov rcx, qword [rdi + 0x678]
test rcx, rcx
je 0x1401db718
cmp byte [rdi + 0x1597], 0
jne 0x1401db718
lea rdx, [rsp + 0x30]
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
mov byte [rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x1401db700
mov byte [rdi + 0x1597], 1
cmp byte [rdi + 0xf1e], 0
je 0x1401db778
mov byte [rsp + rbx + 0x30], 0xa
inc rbx
cmp rbx, 0x102
jae 0x1401db7d3
cmp qword [rdi + 0x718], 0
mov byte [rsp + rbx + 0x30], 0
je 0x1401db799
mov dl, 1
mov rcx, rdi
call fcn.140006fe1
mov rax, qword [rdi + 0x670]
lea r8, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rdi
call qword [rdi + 0x718]
xor edx, edx
mov rcx, rdi
call fcn.140006fe1
mov rbx, qword [rsp + 0x158]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400048e5
add rsp, 0x160
pop rdi
ret
mov r9, qword [rdi + 0x668]
lea rcx, [0x1402a6e90]
mov edx, 2
lea r8d, [rdx - 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rdi + 0x668]
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x1401db778
call fcn.14000646a
int3

Function at 0x14000909d
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x140138ba0
mov byte [rsp + 0x10], dl
mov dword [rsp + 8], ecx
movsx eax, byte [rsp + 0x10]
mov ecx, dword [rsp + 8]
xor ecx, eax
mov eax, ecx
mov eax, eax
imul rax, rax, 0x1000193
ret
Function at 0x140041af0
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x140041af0
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x14025d980]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x10], 0
je 0x140041b7e
mov eax, dword [rsp]
shr eax, 8
mov ecx, dword [rsp]
and ecx, 0xff
mov rdx, qword [rsp + 8]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x18]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
mov eax, dword [rsp + 4]
mov dword [rsp], eax
jmp 0x140041b22
mov eax, dword [rsp]
not eax
add rsp, 0x28
ret

Function at 0x140041bb0
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x140041bb0
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x14025d980]
mov qword [rsp + 0x10], rax
cmp qword [rsp + 0x38], 0
je 0x140041cb4
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x18], 0
je 0x140041caf
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 2], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 2]
mov byte [rsp + 1], al
movzx eax, byte [rsp + 1]
cmp eax, 0x23
jne 0x140041c84
cmp qword [rsp + 0x38], 2
jb 0x140041c84
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140041c84
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140041c84
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp + 1]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x140041bf7
jmp 0x140041d46
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 3], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 3]
mov byte [rsp], al
movzx eax, byte [rsp]
test eax, eax
je 0x140041d46
movzx eax, byte [rsp]
cmp eax, 0x23
jne 0x140041d1c
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140041d1c
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140041d1c
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x140041cb4
mov eax, dword [rsp + 4]
not eax
add rsp, 0x28
ret
Function at 0x140085cf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x140085cf0
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0xd8
mov r8, qword [rsp + 0xf8]
mov rdx, qword [rsp + 0x100]
lea rcx, [rsp + 0x38]
call fcn.140071830
mov r8, qword [rsp + 0x108]
mov rdx, qword [rsp + 0x110]
lea rcx, [rsp + 0x40]
call fcn.140071830
movss xmm0, dword [rsp + 0x3c]
ucomiss xmm0, dword [0x14026a5cc]
jp 0x140085d4f
je 0x140085d63
movss xmm0, dword [rsp + 0x44]
divss xmm0, dword [rsp + 0x3c]
movss dword [rsp + 0x30], xmm0
jmp 0x140085d6c
xorps xmm0, xmm0
movss dword [rsp + 0x30], xmm0
movss xmm0, dword [rsp + 0x38]
ucomiss xmm0, dword [0x14026a5cc]
jp 0x140085d7d
je 0x140085d91
movss xmm0, dword [rsp + 0x40]
divss xmm0, dword [rsp + 0x38]
movss dword [rsp + 0x34], xmm0
jmp 0x140085d9a
xorps xmm0, xmm0
movss dword [rsp + 0x34], xmm0
movss xmm2, dword [rsp + 0x30]
movss xmm1, dword [rsp + 0x34]
lea rcx, [rsp + 0x58]
call fcn.140005a74
movsxd rax, dword [rsp + 0xe8]
imul rax, rax, 0x14
mov rcx, qword [rsp + 0xe0]
add rax, qword [rcx + 0x28]
mov qword [rsp + 0x48], rax
movsxd rax, dword [rsp + 0xf0]
imul rax, rax, 0x14
mov rcx, qword [rsp + 0xe0]
add rax, qword [rcx + 0x28]
mov qword [rsp + 0x50], rax
movzx eax, byte [rsp + 0x118]
test eax, eax
je 0x140085efe
mov r8, qword [rsp + 0x110]
mov rdx, qword [rsp + 0x108]
lea rcx, [rsp + 0x70]
call fcn.14007e8d0
mov r8, qword [rsp + 0x110]
mov rdx, qword [rsp + 0x108]
lea rcx, [rsp + 0x60]
call fcn.14007e800
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x20], rax
jmp 0x140085e48
mov rax, qword [rsp + 0x20]
add rax, 0x14
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x20], rax
jae 0x140085ef9
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x20]
movss xmm2, dword [rax + 4]
mov rax, qword [rsp + 0x20]
movss xmm1, dword [rax]
lea rcx, [rsp + 0x80]
call fcn.140005a74
mov r8, qword [rsp + 0xf8]
mov rdx, rax
lea rcx, [rsp + 0x88]
call fcn.140071830
lea r8, [rsp + 0x58]
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.14007e9a0
mov r8, rax
mov rdx, qword [rsp + 0x108]
lea rcx, [rsp + 0x98]
call fcn.1400718a0
mov qword [rsp + 0x78], rax
mov r9, qword [rsp + 0x68]
lea r8, [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0xa0]
call fcn.14007aec0
mov rax, qword [rax]
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 8], rax
jmp 0x140085e3a
jmp 0x140085f9a
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x28], rax
jmp 0x140085f18
mov rax, qword [rsp + 0x28]
add rax, 0x14
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x28], rax
jae 0x140085f9a
mov rax, qword [rsp + 0x28]
movss xmm2, dword [rax + 4]
mov rax, qword [rsp + 0x28]
movss xmm1, dword [rax]
lea rcx, [rsp + 0xa8]
call fcn.140005a74
mov r8, qword [rsp + 0xf8]
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.140071830
lea r8, [rsp + 0x58]
mov rdx, rax
lea rcx, [rsp + 0xb8]
call fcn.14007e9a0
mov r8, rax
mov rdx, qword [rsp + 0x108]
lea rcx, [rsp + 0xc0]
call fcn.1400718a0
mov rax, qword [rax]
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 8], rax
jmp 0x140085f0a
add rsp, 0xd8
ret
Function at 0x140090620
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov dword [rsp + 0x58], 1
mov dword [rsp + 0x5c], 0
xorps xmm0, xmm0
movss dword [rsp + 0x60], xmm0
xorps xmm0, xmm0
movss dword [rsp + 0x64], xmm0
xorps xmm0, xmm0
movss dword [rsp + 0x68], xmm0
xorps xmm0, xmm0
movss dword [rsp + 0x6c], xmm0
mov dword [rsp + 0x70], 0
mov dword [rsp + 0x74], 0
mov dword [rsp + 0x78], 0
mov dword [rsp + 0x7c], 0
mov qword [rsp + 0x80], 0
mov dword [rsp + 0x88], 0
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x24], 0
xorps xmm0, xmm0
movss dword [rsp + 0x28], xmm0
xorps xmm0, xmm0
movss dword [rsp + 0x2c], xmm0
xorps xmm0, xmm0
movss dword [rsp + 0x30], xmm0
xorps xmm0, xmm0
movss dword [rsp + 0x34], xmm0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x3c], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x50], 0
lea r8, [rsp + 0x58]
mov edx, dword [rsp + 0xa8]
mov rcx, qword [rsp + 0xa0]
call fcn.140096fb0
test eax, eax
je 0x1400907a7
movsxd rax, dword [rsp + 0x88]
imul rax, rax, 0xe
mov rcx, rax
call fcn.1400033aa
mov rcx, qword [rsp + 0xb0]
mov qword [rcx], rax
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
lea r8, [rsp + 0x20]
mov edx, dword [rsp + 0xa8]
mov rcx, qword [rsp + 0xa0]
call fcn.140096fb0
test eax, eax
je 0x1400907a7
mov eax, dword [rsp + 0x88]
cmp dword [rsp + 0x50], eax
je 0x14009079b
mov r8d, 0x8eb
lea rdx, [0x140273330]
lea rcx, str.output_ctx.num_vertices__count_ctx.num_vertices
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
xor eax, eax
xor eax, eax
test eax, eax
jne 0x140090772
mov eax, dword [rsp + 0x50]
jmp 0x1400907b8
mov rax, qword [rsp + 0xb0]
mov qword [rax], 0
xor eax, eax
add rsp, 0x98
ret
Function at 0x14010ff40
Capabilities:
Log keystrokes via polling

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14010ff66
mov dword [rsp + 0x20], 1
jmp 0x14010ff6e
mov dword [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x140116380
Capabilities:
Create thread

Disassembly:
jmp 0x140116380
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rcx, qword [rsp + 0x68]
call fcn.140002202
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140004a39
nop
lea rax, [0x140005c59]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x60]
add rax, 8
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x30]
call fcn.140005ef2
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x40]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov rax, qword [rsp + 0x60]
cmp qword [rax], 0
je 0x14011640d
lea rcx, [rsp + 0x30]
call fcn.14000420a
jmp 0x140116424
mov rax, qword [rsp + 0x60]
mov dword [rax + 8], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
lea rcx, [rsp + 0x30]
call fcn.140004002
add rsp, 0x58
ret

Function at 0x140117940
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
jmp 0x140117940
push rsi
push rdi
sub rsp, 0x88
mov dword [rsp + 0x24], 0
mov dword [rsp + 0x28], 0x3285501
lea rcx, [rsp + 0x40]
call fcn.14000545c
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
mov rdi, rax
lea rsi, [rcx + 0x58]
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
movzx eax, word [rsp + 0x50]
sub eax, 8
mov word [rsp + 0x50], ax
cmp dword [rsp + 0x24], 0
je 0x1401179a4
lea rcx, [rsp + 0x50]
call fcn.140002086
cmp eax, dword [rsp + 0x24]
jne 0x140117a6f
mov rax, qword [rsp + 0x40]
mov rdx, qword [rax + 0x30]
lea rcx, [rsp + 0x60]
call fcn.14000882d
lea rcx, [rsp + 0x60]
call fcn.14000798c
movzx eax, al
test eax, eax
je 0x140117a6f
lea rcx, [rsp + 0x60]
call fcn.14000385a
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x2c], 0
je 0x140117a6f
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.140008404
mov rcx, rax
call fcn.140006c49
cmp eax, dword [rsp + 0x28]
jne 0x140117a6a
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.140007167
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.14000346d
movzx eax, al
test eax, eax
je 0x140117a63
mov rcx, qword [rsp + 0x30]
call fcn.140008cfb
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x24], eax
lea rcx, [rsp + 0x40]
call fcn.140001a00
jmp 0x140117a6f
mov rax, qword [rsp + 0x30]
jmp 0x140117a86
jmp 0x1401179da
lea rcx, [rsp + 0x40]
call fcn.1400071da
movzx eax, al
test eax, eax
jne 0x140117964
xor eax, eax
add rsp, 0x88
pop rdi
pop rsi
ret
Function at 0x1401181b0
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
jmp 0x1401181b0
push rsi
push rdi
sub rsp, 0x88
mov dword [rsp + 0x24], 0
mov dword [rsp + 0x28], 0x820621f3
lea rcx, [rsp + 0x40]
call fcn.14000545c
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
mov rdi, rax
lea rsi, [rcx + 0x58]
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
movzx eax, word [rsp + 0x50]
sub eax, 8
mov word [rsp + 0x50], ax
cmp dword [rsp + 0x24], 0
je 0x140118214
lea rcx, [rsp + 0x50]
call fcn.140002086
cmp eax, dword [rsp + 0x24]
jne 0x1401182df
mov rax, qword [rsp + 0x40]
mov rdx, qword [rax + 0x30]
lea rcx, [rsp + 0x60]
call fcn.14000882d
lea rcx, [rsp + 0x60]
call fcn.14000798c
movzx eax, al
test eax, eax
je 0x1401182df
lea rcx, [rsp + 0x60]
call fcn.14000385a
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x2c], 0
je 0x1401182df
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.140008404
mov rcx, rax
call fcn.140006c49
cmp eax, dword [rsp + 0x28]
jne 0x1401182da
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.140007167
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.14000346d
movzx eax, al
test eax, eax
je 0x1401182d3
mov rcx, qword [rsp + 0x30]
call fcn.140008cfb
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x24], eax
lea rcx, [rsp + 0x40]
call fcn.140001a00
jmp 0x1401182df
mov rax, qword [rsp + 0x30]
jmp 0x1401182f6
jmp 0x14011824a
lea rcx, [rsp + 0x40]
call fcn.1400071da
movzx eax, al
test eax, eax
jne 0x1401181d4
xor eax, eax
add rsp, 0x88
pop rdi
pop rsi
ret
Function at 0x1401186c0
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
jmp 0x1401186c0
push rsi
push rdi
sub rsp, 0x88
mov dword [rsp + 0x24], 0
mov dword [rsp + 0x28], 0xfaba0065
lea rcx, [rsp + 0x40]
call fcn.14000545c
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
mov rdi, rax
lea rsi, [rcx + 0x58]
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
movzx eax, word [rsp + 0x50]
sub eax, 8
mov word [rsp + 0x50], ax
cmp dword [rsp + 0x24], 0
je 0x140118724
lea rcx, [rsp + 0x50]
call fcn.140002086
cmp eax, dword [rsp + 0x24]
jne 0x1401187ef
mov rax, qword [rsp + 0x40]
mov rdx, qword [rax + 0x30]
lea rcx, [rsp + 0x60]
call fcn.14000882d
lea rcx, [rsp + 0x60]
call fcn.14000798c
movzx eax, al
test eax, eax
je 0x1401187ef
lea rcx, [rsp + 0x60]
call fcn.14000385a
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x2c], 0
je 0x1401187ef
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.140008404
mov rcx, rax
call fcn.140006c49
cmp eax, dword [rsp + 0x28]
jne 0x1401187ea
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.140007167
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.14000346d
movzx eax, al
test eax, eax
je 0x1401187e3
mov rcx, qword [rsp + 0x30]
call fcn.140008cfb
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x24], eax
lea rcx, [rsp + 0x40]
call fcn.140001a00
jmp 0x1401187ef
mov rax, qword [rsp + 0x30]
jmp 0x140118806
jmp 0x14011875a
lea rcx, [rsp + 0x40]
call fcn.1400071da
movzx eax, al
test eax, eax
jne 0x1401186e4
xor eax, eax
add rsp, 0x88
pop rdi
pop rsi
ret

Function at 0x140118fb0
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
jmp 0x140118fb0
sub rsp, 0x58
lea rcx, [rsp + 0x28]
call fcn.14000545c
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax + 0x30]
lea rcx, [rsp + 0x38]
call fcn.14000882d
lea rcx, [rsp + 0x38]
call fcn.14000798c
movzx eax, al
test eax, eax
je 0x140119038
lea rcx, [rsp + 0x38]
call fcn.14000385a
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x24], 0
je 0x140119038
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.140008404
mov rcx, rax
call fcn.140006c49
cmp eax, 0xf8f45725
jne 0x140119036
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.140007167
jmp 0x14011904f
jmp 0x140118ff0
lea rcx, [rsp + 0x28]
call fcn.1400071da
movzx eax, al
test eax, eax
jne 0x140118fbe
xor eax, eax
add rsp, 0x58
ret
Function at 0x140119080
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
jmp 0x140119080
sub rsp, 0x58
lea rcx, [rsp + 0x28]
call fcn.14000545c
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax + 0x30]
lea rcx, [rsp + 0x38]
call fcn.14000882d
lea rcx, [rsp + 0x38]
call fcn.14000798c
movzx eax, al
test eax, eax
je 0x140119108
lea rcx, [rsp + 0x38]
call fcn.14000385a
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x24], 0
je 0x140119108
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.140008404
mov rcx, rax
call fcn.140006c49
cmp eax, 0x53b2070f
jne 0x140119106
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.140007167
jmp 0x14011911f
jmp 0x1401190c0
lea rcx, [rsp + 0x28]
call fcn.1400071da
movzx eax, al
test eax, eax
jne 0x14011908e
xor eax, eax
add rsp, 0x58
ret

Function at 0x140119560
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
jmp 0x140119560
sub rsp, 0x58
lea rcx, [rsp + 0x28]
call fcn.1400087ec
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax + 0x30]
lea rcx, [rsp + 0x30]
call fcn.14000882d
lea rcx, [rsp + 0x30]
call fcn.14000798c
movzx eax, al
test eax, eax
je 0x1401195e8
lea rcx, [rsp + 0x30]
call fcn.14000385a
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x24], 0
je 0x1401195e8
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.140008404
mov rcx, rax
call fcn.140006c49
cmp eax, 0x2fa62ca8
jne 0x1401195e6
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.140007167
jmp 0x1401195ff
jmp 0x1401195a0
lea rcx, [rsp + 0x28]
call fcn.140002e64
movzx eax, al
test eax, eax
jne 0x14011956e
xor eax, eax
add rsp, 0x58
ret

Function at 0x14011b420
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x14011b420
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r9d, 0x6c078965
mov r8d, 0xffffffff
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call fcn.140002fb8
mov rax, qword [rsp + 0x30]
add rsp, 0x28
ret
Function at 0x14011b710
Capabilities:
Enumerate gui resources

Disassembly:
jmp 0x14011b710
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xb0
lea rax, [rsp + 0x20]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x20]
call fcn.140008792
mov rcx, rax
call fcn.1400089db
xor edx, edx
mov rcx, rax
call fcn.14000459d
movzx eax, al
test eax, eax
je 0x14011b75a
xor ecx, ecx
int 0x29
lea rax, [rsp + 0x21]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x3e]
lea rcx, [rsp + 0x21]
call fcn.140005399
mov rcx, rax
call fcn.1400089db
xor edx, edx
mov rcx, rax
call fcn.14000459d
movzx eax, al
test eax, eax
je 0x14011b797
xor ecx, ecx
int 0x29
call fcn.140003544
xor edx, edx
lea rcx, [0x14000120d]
call qword [sym.imp.USER32.dll_EnumWindows]
xor r8d, r8d
lea rdx, [0x14028c268]
lea rcx, [rsp + 0x50]
call fcn.140002fd1
nop
lea rcx, [rsp + 0x50]
call fcn.140004557
mov byte [rsp + 0x22], al
lea rcx, [rsp + 0x50]
call fcn.140007a86
movzx eax, byte [rsp + 0x22]
test eax, eax
je 0x14011b857
lea rax, [rsp + 0x23]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x44]
lea rcx, [rsp + 0x23]
call fcn.1400034db
mov rcx, rax
call fcn.140007301
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x24]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x24]
call fcn.140005d8a
mov rcx, rax
call fcn.140007329
mov qword [rsp + 0x30], rax
mov r9d, 0x40
mov r8, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
int 0x29
call fcn.1400071d0
test eax, eax
je 0x14011b86b
mov dword [0], 0xdead
mov rax, qword [rsp + 0xc0]
add rsp, 0xb0
pop rdi
ret
Function at 0x14011ea40
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x198
mov dword [rsp + 0x48], 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x80]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameA]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x14011eac6
cmp qword [rsp + 0x40], 0xffffffffffffffff
jne 0x14011eafc
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x58], 0
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x1a8]
call fcn.1400025b8
mov rax, qword [rsp + 0x1a8]
jmp 0x14011ebb1
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 2
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
jne 0x14011eb6e
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x68], 0
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x1a8]
call fcn.1400025b8
mov rax, qword [rsp + 0x1a8]
jmp 0x14011ebb1
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 4
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsp + 0x78], rax
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0x1a8]
call fcn.140005763
mov rax, qword [rsp + 0x1a8]
add rsp, 0x198
ret