joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000b1a7
Capabilities:
Encrypt data using rc4 prga
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
stc
mov qword [rsp + 8], rcx
sub rsp, 0x68
cmp r8b, r9b
test r12b, 0xac
cmp qword [rsp + 0x70], 0
jmp 0x14000b1cd
jne 0x14000b1e2
mov eax, 0xc00000ef
jmp 0x14000b1dd
jmp 0x14000b448
mov rax, qword [rsp + 0x70]
cmp r11w, 0x616e
movzx eax, word [rax]
stc
cmp eax, 0x5a4d
jmp 0x14000b1fb
je 0x14000b20b
mov eax, 0xc000012f
jmp 0x14000b448
mov rax, qword [rsp + 0x70]
shrd cx, cx, 0x3b
shld rcx, rdi, 0xb0
movsxd rax, dword [rax + 0x3c]
neg ch
ror cx, cl
and rcx, 0x73e0141f
mov rcx, qword [rsp + 0x70]
cmp r8b, spl
clc
lea rcx, [rcx + rax]
ror ah, 0x25
mov rax, rcx
mov qword [rsp + 0x30], rax
cmp r10w, r13w
add ax, 0x65df
mov eax, 8
shld ecx, r15d, 0x38
imul rax, rax, 0
sal cx, 0x7c
sbb cx, r10w
cmp r10b, sil
mov rcx, qword [rsp + 0x30]
test sil, r14b
mov eax, dword [rcx + rax + 0x88]
bsf rcx, rdx
shrd cx, si, 0x24
neg cl
mov rcx, qword [rsp + 0x70]
stc
lea rcx, [rcx + rax]
shl ah, 0xef
movzx rax, cx
add ah, 0x5d
mov rax, rcx
mov qword [rsp + 0x20], rax
and ah, 0x87
shr ah, 0x2b
xor al, r9b
mov rax, qword [rsp + 0x20]
sbb cl, 0xd7
mov eax, dword [rax + 0x1c]
rcl cx, cl
mov rcx, qword [rsp + 0x70]
lea rcx, [rcx + rax]
setns al
mov rax, rcx
rcr cx, cl
not cx
mov qword [rsp + 0x50], rax
shl cl, cl
cdqe
mov rax, qword [rsp + 0x20]
movzx rcx, r9w
bt cx, 0x62
btc cx, r13w
mov eax, dword [rax + 0x20]
sbb cl, 0xed
bsf ecx, r10d
cmp dil, 0x46
mov rcx, qword [rsp + 0x70]
lea rcx, [rcx + rax]
shld rax, r9, 0xb0
mov rax, rcx
and cx, r13w
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x24]
shl cl, cl
mov rcx, qword [rsp + 0x70]
cmp r11w, 0x2307
add rcx, rax
lahf
setge ah
movsx rax, bp
mov rax, rcx
jmp 0x14000b331
mov qword [rsp + 0x48], rax
jmp 0x14000b33b
mov qword [rsp + 0x28], 0
jmp 0x14000b349
jmp 0x14000b360
mov rax, qword [rsp + 0x28]
inc rax
cmp r12w, r11w
stc
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20]
cmp sil, 0xc2
cmp dil, bpl
mov eax, dword [rax + 0x18]
test r12b, 0x10
cmp spl, 0x79
cmp qword [rsp + 0x28], rax
jae 0x14000b43f
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
inc rdx
mov eax, dword [rax + rcx*4]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
cdq
movsx edx, bp
movzx dx, al
mov qword [rsp + 0x40], rax
movzx edx, si
movzx rcx, r10w
bswap dx
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x78]
jmp 0x14000b3c3
call sub.ntoskrnl.exe_strcmp
test eax, eax
jne 0x14000b43a
mov rax, qword [rsp + 0x48]
shld rcx, r15, 0x1a
xchg ecx, ecx
mov rcx, qword [rsp + 0x28]
movzx eax, word [rax + rcx*2]
inc rcx
test r9d, ebx
mov rcx, qword [rsp + 0x50]
test r11d, 0x56bf3379
mov eax, dword [rcx + rax*4]
shrd cx, si, 0x5c
rcl cl, 0x16
mov rcx, qword [rsp + 0x70]
lea rcx, [rcx + rax]
jmp 0x14000b410
mov rax, rcx
sar cx, cl
mov rcx, qword [rsp + 0x80]
mov qword [rcx], rax
cmp r15w, 0x86f
test ax, bp
test bpl, 0xf9
xor eax, eax
jmp 0x14000b435
jmp 0x14000b448
jmp 0x14000b34e
mov eax, 0xc0000225
cmc
cmp dil, r9b
add rsp, 0x68
jmp 0x14000b451
ret
Function at 0x140001eb0
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov rax, qword [rsp + 0x28]
syscall
ret

Function at 0x140001ebb
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov rax, qword [rsp + 0x38]
syscall
ret

Function at 0x140001ec6
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov rax, qword [rsp + 0x38]
syscall
ret

Function at 0x140001ed1
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov rax, qword [rsp + 0x30]
syscall
ret

Function at 0x140001edc
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov rax, qword [rsp + 0x28]
syscall
ret

Function at 0x140001ee7
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov rax, rdx
syscall
ret
Function at 0x140925058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1409251df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140925089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14092506f
add dl, dl
jne 0x140925096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409250f6
xor eax, eax
add dl, dl
jne 0x1409250a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409251ad
add dl, dl
jne 0x1409250b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409250c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409250d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409250dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1409250ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14092507e
mov eax, 1
add dl, dl
jne 0x140925106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140925113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409250fb
sub eax, ebx
mov ebx, 1
jne 0x14092514c
mov ecx, 1
add dl, dl
jne 0x14092512e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14092513b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140925123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14092507e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140925168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140925175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14092515d
cmp eax, 0x7d00
jae 0x14092519b
cmp eax, 0x500
jb 0x140925196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14092507e
cmp eax, 0x7f
ja 0x14092519e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14092507e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1409251d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14092507e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140011217
Capabilities:
Terminate process

Disassembly:
jmp 0x140015b80
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400112a3
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014250
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014270
xor al, al
jmp 0x1400142f1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014283
xor al, al
jmp 0x1400142f1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400142ad
xor al, al
jmp 0x1400142f1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400142c1
xor al, al
jmp 0x1400142f1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400142d3
xor al, al
jmp 0x1400142f1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400142ef
xor al, al
jmp 0x1400142f1
mov al, 1
add rsp, 0x38
ret
Function at 0x14000631c
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x140010960], rbx
je 0x140006383
cmp rax, rbx
jne 0x140006376
mov ebx, 1
mov esi, ebx
jmp 0x140006388
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14000635b
mov ebx, 1
mov eax, dword [0x140010968]
cmp eax, ebx
jne 0x1400063a0
mov edi, 0x1f
mov ecx, edi
call sub.msvcrt.dll__amsg_exit
jmp 0x14000640c
mov eax, dword [0x140010968]
test eax, eax
jne 0x140006401
mov dword [0x140010968], ebx
lea r15, [0x1400089c8]
lea rdi, [0x1400089b0]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x1400063f3
test eax, eax
jne 0x1400063f7
cmp qword [rdi], r14
je 0x1400063e8
mov rax, qword [rdi]
mov rcx, qword [0x140008930]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x1400063ca
test eax, eax
je 0x140006407
mov eax, 0xff
jmp 0x140006562
mov dword [0x14000e3e4], ebx
mov edi, 0x1f
mov eax, dword [0x140010968]
cmp eax, ebx
jne 0x140006433
lea rdx, [0x1400089a8]
lea rcx, [0x140008938]
call sub.msvcrt.dll__initterm
mov dword [0x140010968], 2
test esi, esi
jne 0x140006441
mov rax, r14
xchg qword [0x140010960], rax
cmp qword [0x140010970], r14
je 0x140006474
lea rcx, [0x140010970]
call fcn.140006730
test eax, eax
je 0x140006474
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140010970]
mov r9, qword [0x140008930]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x14000648d
mov eax, 0xff
jmp 0x140006562
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x140006513
test ax, ax
je 0x1400064a8
test edx, edx
jne 0x140006513
sub ax, bx
cmp ax, di
ja 0x1400064be
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x1400064a8
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140001394
mov dword [0x14000e3e0], eax
cmp dword [0x14000e400], r14d
jne 0x1400064fc
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14000e3e4], r14d
jne 0x140006511
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14000e3e0]
jmp 0x140006562
cmp ax, 0x22
jne 0x140006527
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x140006496
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.1401ad000
add rsp, 0x28
jmp 0x14000631c
Function at 0x1400f274e
Capabilities:
Write file on windows

Disassembly:
jmp 0x140129770
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1404c8429]
call fcn.1400f6b8c
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x1401297c7
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x1401298d3
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x14012986c
cmp qword [rbp + 0x28], 0
jle 0x14012986c
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x14012980c
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.1400f66e1
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rbp + 0x130], 0
jle 0x1401298c2
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x1401298c2
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x1400f2d16
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x14015e960
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x1404c95d7]
call fcn.1400f6b8c
mov qword [rbp + 8], 0
jmp 0x14015e99e
mov rax, qword [rbp + 8]
inc rax
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x110]
cmp qword [rbp + 8], rax
jae 0x14015e9f4
mov rax, qword [rbp + 8]
mov rcx, qword [rbp + 0x108]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rbp + 0x100]
xor rcx, rax
mov rax, rcx
mov qword [rbp + 0x100], rax
movabs rax, 0x100000001b3
mov rcx, qword [rbp + 0x100]
imul rcx, rax
mov rax, rcx
mov qword [rbp + 0x100], rax
jmp 0x14015e993
mov rax, qword [rbp + 0x100]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x1400f2ef1
Capabilities:
Create thread

Disassembly:
jmp 0x140150800
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x16
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
mov rax, qword [0x14049de40]
xor rax, rbp
mov qword [rbp + 0x100], rax
lea rcx, [0x1404c9017]
call fcn.1400f6b8c
mov edx, 8
lea rcx, [rbp + 8]
call fcn.1400f35ef
mov rdx, qword [rbp + 0x138]
lea rcx, [rbp + 8]
call fcn.1400f44e5
nop
lea rax, [0x1400f512e]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x130]
add rax, 8
mov qword [rbp + 0xf8], rax
lea rcx, [rbp + 8]
call fcn.1400f52eb
mov rcx, qword [rbp + 0xf8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll__beginthreadex]
mov rcx, qword [rbp + 0x130]
mov qword [rcx], rax
mov rax, qword [rbp + 0x130]
cmp qword [rax], 0
je 0x1401508da
lea rcx, [rbp + 8]
call fcn.1400f4021
jmp 0x1401508f3
mov rax, qword [rbp + 0x130]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.1400f30ae
nop
lea rcx, [rbp + 8]
call fcn.1400f3eb4
lea rcx, [rbp - 0x30]
lea rdx, [0x1402f70a0]
call fcn.1400f5e9e
mov rcx, qword [rbp + 0x100]
xor rcx, rbp
call fcn.1400f441d
lea rsp, [rbp + 0x118]
pop rdi
pop rbp
ret
Function at 0x1400f3a54
Capabilities:
Enumerate processes

Disassembly:
jmp 0x14011ece0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x538
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xe6
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x558]
mov rax, qword [0x14049de40]
xor rax, rbp
mov qword [rbp + 0x508], rax
mov qword [rbp + 0x308], 0
lea rcx, [0x1404c8132]
call fcn.1400f6b8c
mov dword [rbp + 0x10], 0x238
xor edx, edx
mov ecx, 0xf
call fcn.1400f4378
mov qword [rbp + 0x268], rax
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x268]
call fcn.1400f4d5a
mov dword [rbp + 0x284], 0
call fcn.1400f602e
mov dword [rbp + 0x2a4], eax
mov qword [rbp + 0x2c8], 0
mov qword [rbp + 0x2e8], 0
mov rcx, qword [rbp + 0x538]
call fcn.1400f26fe
mov qword [rbp + 0x4d8], rax
lea rax, [rbp + 0x3c]
mov qword [rbp + 0x2c8], rax
cmp qword [rbp + 0x2c8], 0
jne 0x14011edc6
mov qword [rbp + 0x4e0], 0
jmp 0x14011eeb1
mov rcx, qword [rbp + 0x2c8]
call qword [sym.imp.ucrtbased.dll_wcslen]
inc eax
mov dword [rbp + 0x284], eax
cmp dword [rbp + 0x284], 0x3fffffff
jle 0x14011edf7
mov qword [rbp + 0x4e8], 0
jmp 0x14011eea3
movsxd rax, dword [rbp + 0x284]
shl rax, 1
mov qword [rbp + 0x4f0], rax
movsxd rcx, dword [rbp + 0x284]
shl rcx, 1
add rcx, 0x24
mov qword [rbp + 0x4f8], rcx
mov rcx, qword [rbp + 0x4f8]
add rcx, 0xf
cmp rcx, qword [rbp + 0x4f8]
ja 0x14011ee3b
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400f2dde
sub rsp, rax
lea rax, [rsp + 0x20]
mov qword [rbp + 0x500], rax
lea r8, [rbp + 0x308]
mov rdx, qword [rbp + 0x4f8]
mov rcx, qword [rbp + 0x500]
call fcn.1400f72ad
add qword [rbp + 0x500], 0x20
mov r9d, dword [rbp + 0x2a4]
mov rax, qword [rbp + 0x4f0]
mov r8d, eax
mov rdx, qword [rbp + 0x2c8]
mov rcx, qword [rbp + 0x500]
call fcn.1400f39e1
mov qword [rbp + 0x4e8], rax
mov rax, qword [rbp + 0x4e8]
mov qword [rbp + 0x4e0], rax
mov rdx, qword [rbp + 0x4d8]
mov rcx, qword [rbp + 0x4e0]
call fcn.1400f7320
test eax, eax
jne 0x14011eef2
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0x18]
mov dword [rbp + 0x4a4], eax
mov rcx, qword [rbp + 0x538]
call fcn.1400f2e01
mov eax, dword [rbp + 0x4a4]
jmp 0x14011ef33
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x268]
call fcn.1400f6079
test eax, eax
jne 0x14011ed8e
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x4c4], 0
mov rcx, qword [rbp + 0x538]
call fcn.1400f2e01
mov eax, dword [rbp + 0x4c4]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1402eb980]
mov r8, qword [rbp + 0x308]
call fcn.1400f50c0
mov rax, rdi
mov rcx, qword [rbp + 0x508]
xor rcx, rbp
call fcn.1400f441d
lea rsp, [rbp + 0x518]
pop rdi
pop rbp
ret
Function at 0x1400f49c7
Capabilities:
Terminate process

Disassembly:
jmp 0x1402cf790
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400f500c
Capabilities:
Write file on windows

Disassembly:
jmp 0x1401a7920
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1404c9d7b]
call fcn.1400f6b8c
mov r9, qword [rbp + 0xf8]
mov r8, qword [rbp + 0xf0]
mov rdx, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.ucrtbased.dll_fwrite]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret
Function at 0x1400f5287
Capabilities:
Read file on windows

Disassembly:
jmp 0x1401a78b0
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1404c9d7b]
call fcn.1400f6b8c
mov r9, qword [rbp + 0xf8]
mov r8, qword [rbp + 0xf0]
mov rdx, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.ucrtbased.dll_fread]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x1400f52af
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x1401a98d0
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x198
lea rbp, [rsp + 0x20]
lea rcx, [0x1404c9d7b]
call fcn.1400f6b8c
mov eax, dword [rbp + 0x1a0]
not eax
mov dword [rbp + 0x1a0], eax
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x190]
mov qword [rbp + 0x28], rax
lea rax, [0x1402fbea0]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x198], 0
je 0x1401a9a15
mov rax, qword [rbp + 0x198]
mov qword [rbp + 0x158], rax
mov rax, qword [rbp + 0x198]
dec rax
mov qword [rbp + 0x198], rax
cmp qword [rbp + 0x158], 0
je 0x1401a9969
mov dword [rbp + 0x160], 1
jmp 0x1401a9973
mov dword [rbp + 0x160], 0
cmp dword [rbp + 0x160], 0
je 0x1401a9a10
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x154], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x154]
mov byte [rbp + 0x64], al
movzx eax, byte [rbp + 0x64]
cmp eax, 0x23
jne 0x1401a99ea
cmp qword [rbp + 0x198], 2
jb 0x1401a99ea
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1401a99ea
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1401a99ea
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x64]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x1401a9934
jmp 0x1401a9aaf
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x154], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x154]
mov byte [rbp + 0x84], al
movzx eax, byte [rbp + 0x84]
test eax, eax
je 0x1401a9aaf
movzx eax, byte [rbp + 0x84]
cmp eax, 0x23
jne 0x1401a9a86
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1401a9a86
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1401a9a86
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x84]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x1401a9a15
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x1400f5313
Capabilities:
Execute command
Set console window title

Disassembly:
jmp 0x14011fb40
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x20]
lea rcx, [0x1404c8147]
call fcn.1400f6b8c
lea rcx, str.unknowncheats.com
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
lea rax, [rbp + 0xe8]
mov qword [rbp + 0x128], rax
lea rdx, str.cs2.exe
mov rcx, qword [rbp + 0x128]
call fcn.1400f421f
mov qword [rbp + 0x178], rax
mov rdx, qword [rbp + 0x178]
lea rcx, [0x140371010]
call fcn.1400f692f
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
mov dword [rbp + 0x174], eax
cmp dword [rbp + 0x174], 1
je 0x14011fbcc
cmp dword [rbp + 0x174], 2
je 0x14011fbd1
cmp dword [rbp + 0x174], 3
je 0x14011fbd6
jmp 0x14011fbdb
jmp 0x14011fc8b
jmp 0x14011fc8b
jmp 0x14011fc8b
movzx eax, byte [0x14049f8f1]
test eax, eax
jne 0x14011fbeb
call fcn.1400f6880
lea rcx, [0x14049f760]
call fcn.1400f40df
mov rcx, rax
call fcn.1400f28c5
movzx eax, al
test eax, eax
jne 0x14011fc14
lea rcx, str._unknowncheats__failtd_to_init_offsets_n
call fcn.1400f4350
jmp 0x14011fc8b
lea rcx, str._unknowncheats__initialized_interfaces__n
call fcn.1400f4350
lea rcx, [0x14049f770]
call fcn.1400f30d1
mov rcx, rax
call fcn.1400f2c49
movzx eax, al
test eax, eax
jne 0x14011fc49
lea rcx, str._unknowncheats__failtd_to_init_addresses_n
call fcn.1400f4350
jmp 0x14011fc8b
movzx eax, byte [0x14049f8f2]
test eax, eax
jne 0x14011fc8b
call fcn.1400f548f
movzx eax, al
test eax, eax
jne 0x14011fc64
xor eax, eax
jmp 0x14011fcae
mov dword [rbp + 0x164], 1
lea rdx, [rbp + 0x164]
lea rcx, [rbp + 0x148]
call fcn.1400f57b4
mov rcx, rax
call fcn.1400f5e03
jmp 0x14011fc49
lea rdx, [0x1400f2361]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.pause
call qword [sym.imp.ucrtbased.dll_system]
xor eax, eax
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret