joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000a1b0
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rsi, rdx
mov r14, rcx
mov rax, qword [0x140036030]
xor rax, rsp
mov qword [rsp + 0x48], rax
call fcn.140013abc
test rax, rax
je 0x14000a3e4
mov rbx, rax
movzx eax, word [r14 + rax*2 - 2]
cmp eax, 0x5c
je 0x14000a3dc
cmp eax, 0x2f
je 0x14000a3dc
mov rax, rbx
add rax, 2
lea r15, [rbx + rbx + 4]
mov rcx, 0xffffffffffffffff
cmovns rcx, r15
call fcn.14000a420
mov rdi, rax
xor r12d, r12d
mov rcx, rax
xor edx, edx
mov r8, r15
call fcn.14000b870
lea r8, [rbx + 1]
mov rcx, rdi
mov rdx, r14
call fcn.140013f84
mov rcx, rdi
call fcn.140011b00
mov dword [rsp + 0x30], 0
lea rcx, [rsp + 0x40]
mov qword [rcx], r12
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x20], 0xf0000000
xor edx, edx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x14000a3e8
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov edx, 0x8003
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x14000a41b
add ebx, ebx
mov rcx, qword [rsp + 0x38]
mov rdx, rdi
mov r8d, ebx
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x14000a41b
lea r9, [rsp + 0x34]
mov dword [r9], 4
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0x20], 0
lea r8, [rsp + 0x30]
mov edx, 4
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x14000a41b
lea r14, [rsp + 0x30]
mov r15d, dword [r14]
mov rcx, r15
call fcn.14000a420
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, r15
call fcn.14000b870
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0x20], 0
mov edx, 2
mov r8, rbx
mov r9, r14
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x14000a41b
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14000a345
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14000a357
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, rdi
call fcn.14000a474
lea rdx, str.SOFTWAREMozillaMaintenanceService_
mov r8d, 0x104
mov rcx, rsi
call fcn.140013f84
mov ebp, 1
cmp dword [rsp + 0x30], 0
je 0x14000a3b3
add rsi, 0x48
xor r14d, r14d
lea rdi, str._.2x
mov r15, qword [sym.imp.USER32.dll_wsprintfW]
movzx r8d, byte [rbx + r14]
mov rcx, rsi
mov rdx, rdi
call r15
add rsi, 4
inc r14
mov eax, dword [rsp + 0x30]
cmp r14, rax
jb 0x14000a395
mov rdi, rbx
mov rcx, rdi
call fcn.14000a474
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140018400
mov eax, ebp
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
dec rbx
jmp 0x14000a1fc
xor ebp, ebp
jmp 0x14000a3be
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x14000a41b
mov dword [rsp + 0x20], 0xf0000008
lea rcx, [rsp + 0x40]
xor edx, edx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x14000a278
xor ebp, ebp
jmp 0x14000a3b6
Function at 0x140025a70
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rdi, rdx
mov rax, qword [0x140036030]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea rdx, [0x14002fa8c]
call fcn.140011f90
test rax, rax
je 0x140025ae7
mov rsi, rax
mov rcx, rax
xor edx, edx
mov r8d, 2
call fcn.140012944
mov ebp, 6
test eax, eax
je 0x140025aee
mov rcx, rsi
call fcn.140012090
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140018400
mov eax, ebp
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ebp, 6
jmp 0x140025ac7
mov rcx, rsi
call fcn.140012b54
test eax, eax
jle 0x140025abf
mov r14d, eax
lea rcx, [r14 + 1]
call fcn.14000a420
mov rbx, rax
mov rcx, rsi
xor edx, edx
xor r8d, r8d
call fcn.140012944
mov ebp, 6
test eax, eax
je 0x140025b29
mov rcx, rbx
call fcn.14000a474
jmp 0x140025abf
mov edx, 1
mov rcx, rbx
mov r8, r14
mov r9, rsi
call fcn.1400126b0
cmp rax, r14
jne 0x140025b1f
mov byte [rbx + r14], 0
lea r14, [rsp + 0x38]
mov qword [r14], rbx
lea r15, [0x14002cfb0]
xor r12d, r12d
xor r13d, r13d
mov rcx, r15
mov rdx, r14
call fcn.140025ca0
test rax, rax
je 0x140025c4e
mov rbp, rax
movzx eax, byte [rax]
cmp eax, 0x23
je 0x140025b5b
cmp eax, 0x3b
je 0x140025b5b
jmp 0x140025b87
mov al, byte [rbp + 1]
inc rbp
cmp al, 9
je 0x140025b81
movzx ecx, al
cmp ecx, 0x20
je 0x140025b81
mov qword [rsp + 0x30], rbp
test al, al
je 0x140025b5b
cmp ecx, 0x5b
jne 0x140025bc7
inc rbp
mov qword [rsp + 0x30], rbp
lea rcx, [0x14002cfb6]
lea r13, [rsp + 0x30]
mov rdx, r13
call fcn.140025ca0
test rax, rax
je 0x140025b58
jmp 0x140025c5f
test r13b, 1
je 0x140025b5b
lea rcx, [0x14002cfb8]
lea rdx, [rsp + 0x30]
call fcn.140025ca0
test rax, rax
je 0x140025b5b
mov rcx, rbp
call fcn.140025d30
test eax, eax
jne 0x140025b5b
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x28], rcx
call fcn.1400139a0
lea rcx, [rax + 1]
mov qword [rsp + 0x20], rcx
call fcn.14000a420
mov rbp, rax
mov rcx, rax
xor edx, edx
mov r8, qword [rsp + 0x20]
call fcn.14000b870
mov rcx, qword [rdi]
mov qword [rdi], rbp
test rcx, rcx
je 0x140025c39
call fcn.14000a474
mov rbp, qword [rdi]
mov rcx, rbp
mov rdx, qword [rsp + 0x28]
call fcn.1400134c0
inc r12d
jmp 0x140025b5b
xor eax, eax
cmp r12d, 1
setne al
lea ebp, [rax + rax*4]
jmp 0x140025b1f
lea rcx, [0x14002cfb3]
mov rdx, r13
call fcn.140025ca0
test rax, rax
jne 0x140025b58
mov rcx, rbp
lea rdx, str.Strings
call fcn.1400133a0
test eax, eax
sete r13b
jmp 0x140025b5b
Function at 0x140319890
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14031989d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1403198ad
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140319895
lea eax, [rcx + 1]
jmp 0x1403198bb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1403198ce
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1403198b4
sub eax, 3
jb 0x1403198ee
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14031993d
sar eax, 1
movsxd rbp, eax
jb 0x140319924
jmp 0x1403198fc
add ebx, ebx
jne 0x1403198fa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140319924
inc ecx
add ebx, ebx
jne 0x14031990a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140319924
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14031991d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14031990c
add ecx, 2
jmp 0x140319929
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140319852
jmp 0x14031989d
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x316000]
mov eax, dword [rdi]
or eax, eax
je 0x140319999
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x3191e4]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140319949
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140319993
mov qword [rbx], rax
add rbx, 8
jmp 0x140319969
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x237]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1403199f1
sub rsp, 0xffffffffffffff80
jmp 0x1400521a8
Function at 0x453490
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x45349d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x4534ad
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x453495
lea eax, [rcx + 1]
jmp 0x4534bb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x4534ce
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x4534b4
sub eax, 3
jb 0x4534ee
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x45353d
sar eax, 1
movsxd rbp, eax
jb 0x453524
jmp 0x4534fc
add ebx, ebx
jne 0x4534fa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x453524
inc ecx
add ebx, ebx
jne 0x45350a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x453524
call r11
adc ecx, ecx
add ebx, ebx
jne 0x45351d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x45350c
add ecx, 2
jmp 0x453529
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.00453452
jmp 0x45349d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x32c00
mov dl, 0x11
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x45358d
cmp rsi, rcx
jae 0x453595
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x453574
cmp al, 0x8f
ja 0x453574
cmp byte [rsi - 2], 0xf
je 0x45357a
sub al, 0xe8
cmp al, 1
ja 0x45355e
cmp rsi, rcx
jae 0x453595
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x453564
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x453595
lodsb al, byte [rsi]
jmp 0x453574
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x51000]
mov eax, dword [rdi]
or eax, eax
je 0x4535f2
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x54178]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x4535a2
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x4535ec
mov qword [rbx], rax
add rbx, 8
jmp 0x4535c2
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x45362c
cmp al, 0xef
ja 0x45361e
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x4535fe
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x45360d
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.004536ab], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.004536ab
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x45369b
sub rsp, 0xffffffffffffff80
jmp 0x4014e0
Function at 0x140008b6c
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1400089d7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400089d7
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400089d7
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400089d7
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400089d7
cmp dword [rcx + 0x84], 0xe
jbe 0x1400089d7
cmp dword [rcx + 0xf8], 0
je 0x1400089d7
mov ecx, ebx
call fcn.140008a88
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140008864
nop
cmp dword [rbp + 0x20], 0
je 0x140008a25
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140008a30
int3
xor r8d, r8d
xor edx, edx
jmp 0x140008968
Function at 0x14000dfbc
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14000e043
mov rsi, rbx
cmp word [rax], bp
je 0x14000e002
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14000dfec
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14000dfe8
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14000b2fc
mov rdi, rax
test rax, rax
je 0x14000e030
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140005510
mov rbp, rdi
xor ecx, ecx
call fcn.140009ecc
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140012308
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14001231e
mov al, 1
jmp 0x14001237e
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14001232f
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14001237c
mov ecx, dword [rcx + 0x18]
nop
call fcn.14000e760
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001237c
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14001237c
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14001237c
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14001237e
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x1400028c0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x2270
call fcn.140058ad0
sub rsp, rax
mov rax, qword [0x14007a180]
xor rax, rsp
mov qword [rsp + 0x2260], rax
mov rbx, rdx
mov r8d, ecx
xor edx, edx
mov ecx, 0x410
xor r15d, r15d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x20], rax
mov r14, rax
test rax, rax
je 0x140002ae4
lea r9, [rsp + 0x28]
mov r8d, 0x2000
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x140002adb
test dword [rsp + 0x28], 0xfffffff8
mov r12d, r15d
jbe 0x140002adb
mov eax, r12d
lea r13, [rsp + 0x50]
mov rdx, qword [r13 + rax*8]
lea r13, [r13 + rax*8]
mov r9d, 0x104
lea r8, [rsp + 0x2050]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExW]
test eax, eax
je 0x140002ac8
xorps xmm0, xmm0
mov qword [rsp + 0x40], r15
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x48], r15
lea rax, [rsp + 0x2050]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], r15w
jne 0x1400029a2
lea rdx, [rsp + 0x2050]
lea rcx, [rsp + 0x30]
call fcn.1400078a0
mov r10, 0xffffffffffffffff
inc r10
cmp word [rbx + r10*2], r15w
jne 0x1400029c5
mov rsi, qword [rsp + 0x48]
lea rbp, [rsp + 0x30]
mov rdi, qword [rsp + 0x30]
cmp rsi, 7
mov rax, qword [rsp + 0x40]
cmova rbp, rdi
cmp r10, rax
ja 0x140002a8d
sub rax, r10
test r10, r10
je 0x140002b26
movzx r11d, word [rbx]
lea r14, [rax*2]
mov rax, rbp
nop
lea rcx, [rbp + 2]
mov rdx, r15
add rcx, r14
sub rcx, rax
sar rcx, 1
je 0x140002a3e
cmp word [rax], r11w
je 0x140002a3b
cmp rcx, 1
je 0x140002a3e
add rax, 2
dec rcx
cmp word [rax], r11w
jne 0x140002a28
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x140002a88
mov r8, r10
mov rdx, rbx
test r10, r10
je 0x140002a78
mov r9, rax
sub r9, rbx
nop word [rax + rax]
movzx ecx, word [r9 + rdx]
cmp cx, word [rdx]
jne 0x140002b18
add rdx, 2
sub r8, 1
jne 0x140002a60
sub rax, rbp
sar rax, 1
cmp rax, 0xffffffffffffffff
jne 0x140002b21
mov r14, qword [rsp + 0x20]
cmp rsi, 7
jbe 0x140002ac8
lea rdx, [rsi*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140002ac0
mov rdi, qword [rdi - 8]
add rdx, 0x27
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002b66
mov rcx, rdi
call fcn.140058714
mov eax, dword [rsp + 0x28]
inc r12d
shr eax, 3
cmp r12d, eax
jb 0x140002950
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, r15
mov rcx, qword [rsp + 0x2260]
xor rcx, rsp
call fcn.140058280
lea r11, [rsp + 0x2270]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
add rax, 2
jmp 0x140002a10
mov r14, qword [rsp + 0x20]
mov r15, qword [r13]
cmp rsi, 7
jbe 0x140002adb
lea rdx, [rsi*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140002b59
mov rdi, qword [rdi - 8]
add rdx, 0x27
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002b66
mov rcx, rdi
call fcn.140058714
jmp 0x140002adb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140008900
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x14007a180]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r12, r8
mov rbx, rdx
mov r15, rcx
mov rdx, qword [rcx]
mov r14, rbx
sub r14, rdx
mov rax, qword [rcx + 8]
sub rax, rdx
sar rax, 4
movabs r9, 0xfffffffffffffff
cmp rax, r9
je 0x140008b4e
lea r8, [rax + 1]
mov qword [rsp + 0x48], r8
mov rcx, qword [rcx + 0x10]
sub rcx, rdx
sar rcx, 4
mov rdx, rcx
shr rdx, 1
mov rax, r9
sub rax, rdx
cmp rcx, rax
ja 0x140008b48
lea rax, [rdx + rcx]
mov rsi, r8
cmp rax, r8
cmovae rsi, rax
cmp rsi, r9
ja 0x140008b48
mov rcx, rsi
shl rcx, 4
mov qword [rsp + 0x38], rsi
cmp rcx, 0x1000
jb 0x1400089da
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140008b48
mov rcx, rax
call fcn.1400583c0
test rax, rax
je 0x1400089d3
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400089fa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x1400089f3
call fcn.1400583c0
mov rdi, rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
jmp 0x1400089ff
xor edi, edi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rdi
and r14, 0xfffffffffffffff0
lea r13, [r14 + rdi]
lea r14, [r13 + 0x10]
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x30], r14
mov ecx, reloc.WS2_32.dll_recv
call fcn.1400583c0
mov r9, rax
mov rax, qword [r12]
mov qword [r9], rax
mov rax, qword [r12 + 8]
mov qword [r9 + 8], rax
mov qword [rsp + 0x58], r9
lea r12, [r13 + 8]
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], 0
lea r8, [0x140009ce0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [r13], rax
test rax, rax
je 0x140008b34
mov qword [rsp + 0x30], r13
mov rdx, qword [r15 + 8]
mov rax, qword [r15]
cmp rbx, rdx
jne 0x140008a9a
cmp rax, rdx
je 0x140008af7
mov rcx, rdi
sub rcx, rax
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rcx + rax], xmm1
add rax, 0x10
cmp rax, rdx
jne 0x140008a82
jmp 0x140008af7
cmp rax, rbx
je 0x140008ac6
mov rcx, rdi
sub rcx, rax
nop word [rax + rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rcx + rax], xmm1
add rax, 0x10
cmp rax, rbx
jne 0x140008ab0
mov qword [rsp + 0x30], rdi
mov rax, qword [r15 + 8]
cmp rbx, rax
je 0x140008af7
sub r14, rbx
nop word [rax + rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rbx]
movups xmmword [rbx], xmm0
movups xmmword [r14 + rbx], xmm1
add rbx, 0x10
cmp rbx, rax
jne 0x140008ae0
mov r9, rsi
mov r8, qword [rsp + 0x48]
mov rdx, rdi
mov rcx, r15
call fcn.140009620
mov rax, r13
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140058280
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov dword [r12], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
call fcn.140001580
int3
call fcn.140006a90
int3
Function at 0x140008d60
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x14007a180]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbx, rdx
mov r15, rcx
mov rdx, qword [rcx]
mov r14, rbx
sub r14, rdx
mov rax, qword [rcx + 8]
sub rax, rdx
sar rax, 4
movabs r9, 0xfffffffffffffff
cmp rax, r9
je 0x140008f9e
lea r8, [rax + 1]
mov qword [rsp + 0x48], r8
mov rcx, qword [rcx + 0x10]
sub rcx, rdx
sar rcx, 4
mov rdx, rcx
shr rdx, 1
mov rax, r9
sub rax, rdx
cmp rcx, rax
ja 0x140008f98
lea rax, [rdx + rcx]
mov rsi, r8
cmp rax, r8
cmovae rsi, rax
cmp rsi, r9
ja 0x140008f98
mov rcx, rsi
shl rcx, 4
mov qword [rsp + 0x38], rsi
cmp rcx, 0x1000
jb 0x140008e37
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140008f98
mov rcx, rax
call fcn.1400583c0
test rax, rax
je 0x140008e30
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140008e57
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140008e50
call fcn.1400583c0
mov rdi, rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
jmp 0x140008e5c
xor edi, edi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rdi
and r14, 0xfffffffffffffff0
lea r13, [r14 + rdi]
lea r14, [r13 + 0x10]
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x30], r14
mov ecx, 8
call fcn.1400583c0
lea rcx, [0x140004200]
mov qword [rax], rcx
mov qword [rsp + 0x58], rax
lea r12, [r13 + 8]
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140009940]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [r13], rax
test rax, rax
je 0x140008f84
mov qword [rsp + 0x30], r13
mov rdx, qword [r15 + 8]
mov rax, qword [r15]
cmp rbx, rdx
jne 0x140008ef8
cmp rax, rdx
je 0x140008f47
mov rcx, rdi
sub rcx, rax
nop dword [rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rcx + rax], xmm1
add rax, 0x10
cmp rax, rdx
jne 0x140008ee0
jmp 0x140008f47
cmp rax, rbx
je 0x140008f19
mov rcx, rdi
sub rcx, rax
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rcx + rax], xmm1
add rax, 0x10
cmp rax, rbx
jne 0x140008f03
mov qword [rsp + 0x30], rdi
mov rax, qword [r15 + 8]
cmp rbx, rax
je 0x140008f47
sub r14, rbx
nop word [rax + rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rbx]
movups xmmword [rbx], xmm0
movups xmmword [r14 + rbx], xmm1
add rbx, 0x10
cmp rbx, rax
jne 0x140008f30
mov r9, rsi
mov r8, qword [rsp + 0x48]
mov rdx, rdi
mov rcx, r15
call fcn.140009620
mov rax, r13
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140058280
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov dword [r12], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
call fcn.140001580
int3
call fcn.140006a90
int3
Function at 0x1400098a0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x14007a180]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, r8
mov rdi, rdx
mov ecx, reloc.WS2_32.dll_recv
call fcn.1400583c0
mov rcx, qword [rbx]
mov qword [rax], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rsp + 0x30], rax
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140009ce0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
je 0x140009921
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140058280
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov dword [rbx], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3