joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140054240
Capabilities:
Log keystrokes via polling

Disassembly:
push rsi
sub rsp, 0x30
mov ecx, 0x210
call fcn.140024c60
test al, al
je 0x14005429c
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x14005429c
call fcn.14000e260
mov rsi, rax
mov rcx, rax
mov edx, 0x210
xor r8d, r8d
call fcn.140002200
mov dword [rsp + 0x20], 0xffffffff
mov rcx, rsi
mov edx, 0x210
mov r8d, 0xa0
mov r9d, 0xffffffff
call fcn.140002230
mov ecx, 0x214
call fcn.140024c60
test al, al
je 0x1400543a1
cmp dword [0x1406e7b1c], 0xa
jl 0x1400542c8
mov eax, dword [0x1406e7b18]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
jne 0x1400542ed
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetKeyState]
cmp dword [0x1406e7b1c], 0xa
jl 0x1400542fa
mov ecx, dword [0x1406e7b18]
lea edx, [rcx - 1]
imul edx, ecx
and edx, 1
je 0x1400542fa
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetKeyState]
jmp 0x1400542c8
test ax, ax
js 0x1400543a1
nop word cs:[rax + rax]
nop dword [rax]
call fcn.14000e260
mov rsi, rax
mov rcx, rax
mov edx, 0x214
xor r8d, r8d
call fcn.140002200
mov dword [rsp + 0x20], 0xffffffff
mov rcx, rsi
mov edx, 0x214
mov r8d, 0xa1
mov r9d, 0xffffffff
call fcn.140002230
cmp dword [0x1406e7b1c], 0xa
jl 0x1400543a1
mov eax, dword [0x1406e7b18]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x1400543a1
call fcn.14000e260
mov rsi, rax
mov rcx, rax
mov edx, 0x214
xor r8d, r8d
call fcn.140002200
mov dword [rsp + 0x20], 0xffffffff
mov rcx, rsi
mov edx, 0x214
mov r8d, 0xa1
mov r9d, 0xffffffff
call fcn.140002230
jmp 0x140054310
mov ecx, 0x212
call fcn.140024c60
test al, al
je 0x1400543f8
mov ecx, 0x5b
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x1400543f8
call fcn.14000e260
mov rsi, rax
mov rcx, rax
mov edx, 0x212
xor r8d, r8d
call fcn.140002200
mov dword [rsp + 0x20], 0xffffffff
mov rcx, rsi
mov edx, 0x212
mov r8d, 0x5b
mov r9d, 0xffffffff
call fcn.140002230
mov ecx, 0x216
call fcn.140024c60
test al, al
je 0x140054494
cmp dword [0x1406e7b1c], 0xa
jl 0x140054424
mov eax, dword [0x1406e7b18]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
jne 0x140054449
mov ecx, 0x5c
call qword [sym.imp.USER32.dll_GetKeyState]
cmp dword [0x1406e7b1c], 0xa
jl 0x140054456
mov ecx, dword [0x1406e7b18]
lea edx, [rcx - 1]
imul edx, ecx
and edx, 1
je 0x140054456
mov ecx, 0x5c
call qword [sym.imp.USER32.dll_GetKeyState]
jmp 0x140054424
test ax, ax
js 0x140054494
call fcn.14000e260
mov rsi, rax
mov rcx, rax
mov edx, 0x216
xor r8d, r8d
call fcn.140002200
mov dword [rsp + 0x20], 0xffffffff
mov rcx, rsi
mov edx, 0x216
mov r8d, 0x5c
mov r9d, 0xffffffff
call fcn.140002230
nop
add rsp, 0x30
pop rsi
ret

Function at 0x1400561b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rax, qword [0x1406deb70]
mov rsi, qword [rax + 0x3ea8]
mov rdi, qword [rsi + 0x190]
cmp dword [rdi + 0x10], 1
jne 0x1400561d8
add rsp, 0x28
pop rdi
pop rsi
ret
lea rdx, [rdi + 0x3c]
mov rcx, rsi
call fcn.140054690
mov r8d, dword [rdi + 0xc]
add rdi, 0x70
add r8d, 1
mov rdx, qword [rsi + 0x280]
mov rcx, rdi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.14003c030
Function at 0x14007a140
Capabilities:
Create process on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x20], 0xfffffffffffffffe
mov rcx, rdx
lea r8, [0x14026eba7]
mov r9d, 3
mov qword [rbp + 0x18], rdx
xor edx, edx
call fcn.14008e210
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x30], xmm0
movabs rax, 0x4000000070
mov qword [rbp - 0x60], rax
movups xmmword [rbp - 0x58], xmm0
lea rax, str.cmd.exe
mov qword [rbp - 0x48], rax
mov rsi, qword [rbp + 0x18]
cmp qword [rsi + 0x18], 0x10
mov rax, rsi
jb 0x14007a1b5
mov rax, qword [rsi]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], 0
mov dword [rbp - 0x30], 0
mov qword [rbp - 0x28], 0
lea rcx, [rbp - 0x60]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x14007a1ed
mov rcx, qword [rbp + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 8]
lea rdx, [rbp + 0x14]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call fcn.14008d6a0
cmp dword [0x1406e7e80], 0xa
jl 0x14007a232
mov eax, dword [0x1406e7e84]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x14007a232
nop word [rax + rax]
jmp 0x14007a230
add rsp, 0xa8
pop rsi
pop rbp
ret
Function at 0x14007a280
Capabilities:
Enumerate processes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x158
mov rsi, rdx
mov rax, qword [0x1406de900]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov dword [rsp + 0x20], 0x130
xor edi, edi
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
je 0x14007a40c
mov r14, rax
lea rdx, [rsp + 0x20]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
lea r13, [rsp + 0x4c]
mov rcx, r13
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rbp, rax
mov rdi, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0x10
mov rcx, rsi
jb 0x14007a2f9
mov rcx, qword [rsi]
xor ebx, ebx
cmp rbp, rdi
setb bl
mov r8, rdi
cmovb r8, rbp
mov rdx, r13
call sub.VCRUNTIME140.dll_memcmp
cmp rdi, rbp
mov r12d, 0xffffffff
cmovb ebx, r12d
test eax, eax
cmovne ebx, eax
test ebx, ebx
je 0x14007a3c2
lea r15, [rsp + 0x20]
jmp 0x14007a35c
xor ecx, ecx
cmp rbp, rdi
setb cl
cmp rdi, rbp
cmovb ecx, r12d
test eax, eax
cmovne ecx, eax
test ecx, ecx
je 0x14007a3ff
mov rcx, r14
mov rdx, r15
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x14007a3f2
mov rcx, r13
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rbp, rax
cmp qword [rsi + 0x18], 0x10
mov rcx, rsi
jb 0x14007a387
mov rcx, qword [rsi]
mov rdi, qword [rsi + 0x10]
cmp rbp, rdi
mov r8, rdi
cmovb r8, rbp
mov rdx, r13
call sub.VCRUNTIME140.dll_memcmp
cmp dword [0x1406e7ad4], 0xa
jl 0x14007a340
mov ecx, dword [0x1406e7ad0]
lea edx, [rcx - 1]
imul edx, ecx
and edx, 1
je 0x14007a340
nop word [rax + rax]
jmp 0x14007a3c0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x1406e7ad4], 0xa
jl 0x14007a408
mov eax, dword [0x1406e7ad0]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x14007a408
nop word cs:[rax + rax]
nop
jmp 0x14007a3f0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
jmp 0x14007a40c
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [rsp + 0x28]
mov rcx, rsi
call fcn.14008d6a0
cmp dword [0x1406e7e80], 0xa
jl 0x14007a432
mov eax, dword [0x1406e7e84]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x14007a432
nop
jmp 0x14007a430
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1401fc630
mov eax, edi
add rsp, 0x158
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140088860
Capabilities:
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
cmp dword [0x1406e8494], 0xa
jl 0x140088892
mov eax, dword [0x1406e8490]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x140088892
nop word [rax + rax]
jmp 0x140088890
mov eax, dword [0x1406e7fb4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete al
cmp dword [0x1406e7fb0], 0xa
setl r8b
or r8b, al
mov ecx, dword [0x1406e7fbc]
mov esi, dword [0x1406e7fb8]
jne 0x1400888cb
lea ebp, [rcx - 1]
imul ebp, ecx
and ebp, 1
jmp 0x1400888f5
lea ebp, [rcx - 1]
imul ebp, ecx
and ebp, 1
sete bl
cmp esi, 0xa
setl al
or al, bl
cmp al, 1
jne 0x140088924
mov rdi, qword gs:[0x60]
test al, al
je 0x140088924
test r8b, r8b
jne 0x14008892f
mov rax, qword gs:[0x60]
cmp esi, 0xa
jl 0x1400888cb
test ebp, ebp
je 0x1400888cb
mov rax, qword gs:[0x60]
mov rax, qword gs:[0x60]
mov rax, qword gs:[0x60]
jmp 0x140088910
mov rbx, qword gs:[0x60]
jmp 0x1400888e3
mov r9, qword [rdi + 0x18]
add r9, 0x10
mov eax, dword [0x1406e84a0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete al
cmp dword [0x1406e84a4], 0xa
setl r8b
or r8b, al
mov eax, dword [0x1406e8488]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete al
cmp dword [0x1406e848c], 0xa
setl r15b
or r15b, al
mov eax, dword [0x1406e7f9c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete cl
cmp dword [0x1406e7f98], 0xa
setl al
or al, cl
mov ecx, dword [0x1406e7fa8]
lea ebp, [rcx - 1]
imul ebp, ecx
test bpl, 1
sete cl
cmp dword [0x1406e7fac], 0xa
setl r10b
or r10b, cl
mov r11d, 0xffffffff
mov r9, qword [r9]
mov r13, qword [r9 + 0x30]
movsxd rcx, dword [r13 + 0x3c]
mov r12d, dword [rcx + r13 + 0x88]
test r12, r12
je 0x140088a4f
mov ecx, dword [r13 + r12 + 0x18]
mov rbx, rcx
sub rbx, 1
jb 0x140088a5f
test r8b, r8b
je 0x140088a90
add rcx, r11
mov esi, dword [r13 + r12 + 0x20]
add rsi, r13
mov r14d, ecx
mov edi, dword [rsi + r14*4]
add rdi, r13
mov rcx, rdi
test r15b, r15b
je 0x140088a40
mov ebp, 0x811c9dc5
mov rcx, rdi
jmp 0x140088a20
add rcx, 1
xor ebp, esi
imul ebp, ebp, 0x1000193
nop
test al, al
je 0x140088a20
movsx esi, byte [rcx]
test esi, esi
jne 0x140088a12
mov rcx, rdi
test r15b, r15b
je 0x140088a40
mov rcx, rbx
cmp ebp, 0xcded1a85
jne 0x1400889dc
jmp 0x140088ab2
test al, al
je 0x140088a80
cmp byte [rcx], 0
lea rcx, [rcx + 1]
jne 0x140088a40
jmp 0x140088a08
test r15b, r15b
je 0x140088ab0
test r10b, r10b
jne 0x1400889bc
jmp 0x140088aa0
test r15b, r15b
jne 0x140088a54
nop word cs:[rax + rax]
nop
jmp 0x140088a70
jmp 0x140088a80
jmp 0x140088a90
jmp 0x140088aa0
jmp 0x140088ab0
mov eax, dword [r13 + r12 + 0x1c]
mov ecx, dword [r13 + r12 + 0x24]
add rcx, r13
movzx ecx, word [rcx + r14*2]
add rax, r13
mov eax, dword [rax + rcx*4]
add rax, r13
mov ecx, dword [rdx]
call rax
int3
Function at 0x140088ae0
Capabilities:
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
cmp dword [0x1406e8494], 0xa
jl 0x140088b12
mov eax, dword [0x1406e8490]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x140088b12
nop dword [rax + rax]
jmp 0x140088b10
mov eax, dword [0x1406e7fb4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete al
cmp dword [0x1406e7fb0], 0xa
setl r8b
or r8b, al
mov ecx, dword [0x1406e7fbc]
mov esi, dword [0x1406e7fb8]
jne 0x140088b4b
lea edi, [rcx - 1]
imul edi, ecx
and edi, 1
jmp 0x140088b75
lea edi, [rcx - 1]
imul edi, ecx
and edi, 1
sete bl
cmp esi, 0xa
setl al
or al, bl
cmp al, 1
jne 0x140088ba4
mov rbp, qword gs:[0x60]
test al, al
je 0x140088ba4
test r8b, r8b
jne 0x140088baf
mov rax, qword gs:[0x60]
cmp esi, 0xa
jl 0x140088b4b
test edi, edi
je 0x140088b4b
mov rax, qword gs:[0x60]
mov rax, qword gs:[0x60]
mov rax, qword gs:[0x60]
jmp 0x140088b90
mov rbp, qword gs:[0x60]
jmp 0x140088b63
mov r8, qword [rbp + 0x18]
add r8, 0x10
mov eax, dword [0x1406e7b70]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete al
cmp dword [0x1406e7b74], 0xa
setl r15b
or r15b, al
mov eax, dword [0x1406e84a0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete al
cmp dword [0x1406e84a4], 0xa
setl r9b
or r9b, al
mov eax, dword [0x1406e7f9c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete cl
cmp dword [0x1406e7f98], 0xa
setl al
or al, cl
mov ecx, dword [0x1406e7fa8]
lea ebp, [rcx - 1]
imul ebp, ecx
test bpl, 1
sete cl
cmp dword [0x1406e7fac], 0xa
setl r10b
or r10b, cl
mov r11d, 0xffffffff
jmp 0x140088c49
test r10b, r10b
je 0x140088ce0
mov r8, qword [r8]
nop dword [rax]
test r15b, r15b
je 0x140088c50
mov rsi, qword [r8 + 0x30]
movsxd rcx, dword [rsi + 0x3c]
mov r14d, dword [rcx + rsi + 0x88]
test r14, r14
je 0x140088c40
mov ecx, dword [rsi + r14 + 0x18]
mov rbx, rcx
jmp 0x140088c8b
mov rcx, rbx
cmp ebp, 0xe80fd3a
je 0x140088ce2
sub rbx, 1
jb 0x140088c40
test r9b, r9b
je 0x140088cd0
add rcx, r11
mov edi, dword [rsi + r14 + 0x20]
add rdi, rsi
mov r12d, ecx
mov ecx, dword [rdi + r12*4]
add rcx, rsi
mov ebp, 0x811c9dc5
test al, al
je 0x140088cb0
movsx edi, byte [rcx]
test edi, edi
je 0x140088c80
add rcx, 1
xor ebp, edi
imul ebp, ebp, 0x1000193
jmp 0x140088cb0
jmp 0x140088cd0
jmp 0x140088ce0
mov eax, dword [rsi + r14 + 0x1c]
mov ecx, dword [rsi + r14 + 0x24]
add rax, rsi
add rcx, rsi
movzx ecx, word [rcx + r12*2]
mov eax, dword [rax + rcx*4]
add rax, rsi
mov ecx, dword [rdx]
call rax
int3
Function at 0x140088d10
Capabilities:
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
cmp dword [0x1406e7b68], 0xa
jl 0x140088d42
mov eax, dword [0x1406e7b6c]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x140088d42
nop word cs:[rax + rax]
jmp 0x140088d40
cmp dword [0x1406e8494], 0xa
jl 0x140088d62
mov eax, dword [0x1406e8490]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x140088d62
nop dword [rax]
jmp 0x140088d60
mov eax, dword [0x1406e7fb4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete al
cmp dword [0x1406e7fb0], 0xa
setl r8b
or r8b, al
mov ecx, dword [0x1406e7fbc]
mov edi, dword [0x1406e7fb8]
jne 0x140088d9b
lea ebx, [rcx - 1]
imul ebx, ecx
and ebx, 1
jmp 0x140088dc5
lea ebx, [rcx - 1]
imul ebx, ecx
and ebx, 1
sete dl
cmp edi, 0xa
setl al
or al, dl
cmp al, 1
jne 0x140088df4
mov rbp, qword gs:[0x60]
test al, al
je 0x140088df4
test r8b, r8b
jne 0x140088dff
mov rax, qword gs:[0x60]
cmp edi, 0xa
jl 0x140088d9b
test ebx, ebx
je 0x140088d9b
mov rax, qword gs:[0x60]
mov rax, qword gs:[0x60]
mov rax, qword gs:[0x60]
jmp 0x140088de0
mov rdx, qword gs:[0x60]
jmp 0x140088db3
mov r9, qword [rbp + 0x18]
add r9, 0x10
mov eax, dword [0x1406e84b8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete al
cmp dword [0x1406e84bc], 0xa
setl r8b
or r8b, al
mov eax, dword [0x1406e84a0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete al
cmp dword [0x1406e84a4], 0xa
setl r14b
or r14b, al
mov eax, dword [0x1406e7f9c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete al
cmp dword [0x1406e7f98], 0xa
setl cl
or cl, al
mov eax, dword [0x1406e7fa8]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x1406e7fac], 0xa
setl r10b
or r10b, al
mov r11d, 0xffffffff
jmp 0x140088e96
test r10b, r10b
je 0x140088f30
mov r9, qword [r9]
mov rax, qword [r9 + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov r15d, dword [rdx + rax + 0x88]
test r15, r15
je 0x140088e8d
test r8b, r8b
je 0x140088f40
mov edx, dword [rax + r15 + 0x18]
mov rdi, rdx
jmp 0x140088edb
mov rdx, rdi
cmp ebp, 0xa52bcaf9
je 0x140088f42
sub rdi, 1
jb 0x140088e8d
test r14b, r14b
je 0x140088f20
add rdx, r11
mov esi, dword [rax + r15 + 0x20]
add rsi, rax
mov ebx, edx
mov edx, dword [rsi + rbx*4]
add rdx, rax
mov ebp, 0x811c9dc5
nop
test cl, cl
je 0x140088f00
movsx esi, byte [rdx]
test esi, esi
je 0x140088ed0
add rdx, 1
xor ebp, esi
imul ebp, ebp, 0x1000193
jmp 0x140088f00
jmp 0x140088f20
jmp 0x140088f30
jmp 0x140088f40
mov ecx, dword [rax + r15 + 0x1c]
mov edx, dword [rax + r15 + 0x24]
add rdx, rax
movzx edx, word [rdx + rbx*2]
add rcx, rax
mov ecx, dword [rcx + rdx*4]
add rcx, rax
call rcx
int3
Function at 0x14008ec00
Capabilities:
Create thread

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp], 0xfffffffffffffffe
mov rbx, r8
mov r15, rdx
mov r14, rcx
mov ecx, reloc.WS2_32.dll_recv
call fcn.1401fc420
mov rdi, rax
cmp dword [0x1406ea18c], 0xa
jl 0x14008ec52
mov eax, dword [0x1406ea188]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x14008ec52
nop dword [rax]
jmp 0x14008ec50
mov eax, dword [0x1406ea190]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete cl
cmp dword [0x1406ea194], 0xa
setl al
or al, cl
mov ecx, dword [0x1406e9a04]
mov edx, dword [0x1406e9a00]
jne 0x14008ec90
lea esi, [rcx - 1]
imul esi, ecx
and esi, 1
cmp edx, 0xa
jl 0x14008ec90
test esi, esi
jne 0x14008ece0
lea esi, [rcx - 1]
imul esi, ecx
and esi, 1
cmp edx, 0xa
jl 0x14008eca2
test esi, esi
jne 0x14008ecf0
test al, al
je 0x14008ec87
mov rcx, qword [rbx]
mov eax, dword [0x1406e9a0c]
cmp dword [0x1406e9a08], 0xa
mov qword [rdi], rcx
jl 0x14008ecf2
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x14008ecf2
nop word cs:[rax + rax]
jmp 0x14008ecd0
jmp 0x14008ece0
jmp 0x14008ecf0
cmp dword [0x1406ea19c], 0xa
jl 0x14008ed12
mov eax, dword [0x1406ea198]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x14008ed12
nop dword [rax]
jmp 0x14008ed10
mov rax, qword [r15]
mov qword [rdi + 8], rax
lea rsi, [r14 + 8]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 0
lea r8, [0x14008ee40]
xor ecx, ecx
xor edx, edx
mov r9, rdi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [r14], rax
test rax, rax
je 0x14008ed8f
cmp dword [0x1406ea1bc], 0xa
jl 0x14008ed62
mov eax, dword [0x1406ea1b8]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x14008ed62
jmp 0x14008ed60
cmp dword [0x1406ea184], 0xa
jl 0x14008ed82
mov eax, dword [0x1406ea180]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x14008ed82
nop dword [rax]
jmp 0x14008ed80
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov qword [rbp - 8], rdi
mov dword [rsi], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x1400a3d80
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r15, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x68], 0
je 0x1400a3e19
mov rcx, rbx
mov rdx, rdi
mov r8, r15
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
cmp dword [0x1406e7de4], 0xa
jl 0x1400a3f53
mov ecx, dword [0x1406e7de0]
lea edx, [rcx - 1]
imul edx, ecx
and edx, 1
je 0x1400a3f53
mov rsi, qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
nop word cs:[rax + rax]
nop
mov rcx, rbx
mov rdx, rdi
mov r8, r15
call rsi
mov rcx, rbx
mov rdx, rdi
mov r8, r15
call rsi
cmp dword [0x1406e7de4], 0xa
jl 0x1400a3f53
mov ecx, dword [0x1406e7de0]
lea edx, [rcx - 1]
imul edx, ecx
and edx, 1
jne 0x1400a3de0
jmp 0x1400a3f53
mov rax, qword [rbx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x1400a3eaa
test r15, r15
jle 0x1400a3eaa
mov rax, qword [rbx + 0x58]
mov eax, dword [rax]
test eax, eax
jle 0x1400a3eaa
movsxd r12, eax
cmp r12, r15
cmovg r12, r15
movsxd rsi, r12d
nop dword [rax]
mov rdx, rdi
mov r8, r12
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rbx + 0x58]
sub dword [rax], esi
mov rax, qword [rbx + 0x40]
add qword [rax], rsi
cmp dword [0x1406e7de4], 0xa
jl 0x1400a3eb7
mov eax, dword [0x1406e7de0]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x1400a3eb7
mov rax, qword [rbx + 0x40]
mov rcx, qword [rax]
mov rdx, rdi
mov r8, r12
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rbx + 0x58]
sub dword [rax], esi
mov rax, qword [rbx + 0x40]
add qword [rax], rsi
mov rax, qword [rbx + 0x40]
mov rcx, qword [rax]
jmp 0x1400a3e50
mov r14, r15
test r14, r14
jg 0x1400a3ec9
jmp 0x1400a3f4d
mov r14, r15
sub r14, r12
add rdi, r12
test r14, r14
jle 0x1400a3f4d
mov rbx, qword [rbx + 0x80]
test rbx, rbx
je 0x1400a3f4d
mov edx, 1
mov rcx, rdi
mov r8, r14
mov r9, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp dword [0x1406e7de4], 0xa
jl 0x1400a3f4a
mov ecx, dword [0x1406e7de0]
lea edx, [rcx - 1]
imul edx, ecx
and edx, 1
je 0x1400a3f4a
mov rsi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
nop word [rax + rax]
mov edx, 1
mov rcx, rdi
mov r8, r14
mov r9, rbx
call rsi
mov edx, 1
mov rcx, rdi
mov r8, r14
mov r9, rbx
call rsi
cmp dword [0x1406e7de4], 0xa
jl 0x1400a3f4a
mov ecx, dword [0x1406e7de0]
lea edx, [rcx - 1]
imul edx, ecx
and edx, 1
jne 0x1400a3f10
sub r14, rax
sub r15, r14
mov rax, r15
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1400a4440
Capabilities:
Write file on windows

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x10
lea rbp, [rsp + 0x10]
mov rsi, rcx
mov rax, qword [0x1406de900]
xor rax, rbp
mov qword [rbp - 8], rax
mov eax, dword [0x1406e7e04]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete al
cmp dword [0x1406e7e00], 0xa
setl cl
or cl, al
nop
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.1401fc5d0
sub rsp, rax
mov rdi, rsp
test cl, cl
je 0x1400a4480
mov eax, reloc.WS2_32.dll_recv
call fcn.1401fc5d0
sub rsp, rax
mov r14, rsp
mov bl, 1
cmp qword [rsi + 0x68], 0
je 0x1400a45e7
cmp byte [rsi + 0x71], 0
je 0x1400a45e7
mov rax, qword [rsi]
sub rsp, 0x20
mov rcx, rsi
mov edx, 0xffffffff
call qword [rax + Ordinal_26]
add rsp, 0x20
cmp eax, 0xffffffff
je 0x1400a45e5
mov eax, dword [0x1406e7e04]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete cl
cmp dword [0x1406e7e00], 0xa
setl al
or al, cl
nop dword [rax + rax]
test al, al
je 0x1400a4500
mov rcx, qword [rsi + 0x68]
lea r9, [rdi + 0x20]
lea rdx, [rsi + 0x74]
mov rax, qword [rcx]
sub rsp, 0x30
mov qword [rsp + 0x20], r14
mov r8, rdi
call qword [rax + 0x40]
add rsp, 0x30
test eax, eax
jle 0x1400a453a
cmp eax, 3
jge 0x1400a456e
cmp eax, 1
jne 0x1400a45e5
jmp 0x1400a4546
test eax, eax
jne 0x1400a45e5
mov byte [rsi + 0x71], 0
mov rbx, qword [r14]
sub rbx, rdi
je 0x1400a45dc
cmp dword [0x1406e7e00], 0xa
jl 0x1400a457b
mov eax, dword [0x1406e7e04]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
jne 0x1400a45b5
jmp 0x1400a457b
cmp eax, 3
jne 0x1400a45e5
mov byte [rsi + 0x71], 0
mov bl, 1
jmp 0x1400a45e7
mov r9, qword [rsi + 0x80]
sub rsp, 0x20
mov edx, 1
mov rcx, rdi
mov r8, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add rsp, 0x20
cmp dword [0x1406e7e00], 0xa
jl 0x1400a45d7
mov ecx, dword [0x1406e7e04]
lea edx, [rcx - 1]
imul edx, ecx
and edx, 1
je 0x1400a45d7
mov r9, qword [rsi + 0x80]
sub rsp, 0x20
mov edx, 1
mov rcx, rdi
mov r8, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add rsp, 0x20
jmp 0x1400a457b
cmp rbx, rax
jne 0x1400a45e5
cmp byte [rsi + 0x71], 0
sete bl
jmp 0x1400a45e7
xor ebx, ebx
mov rcx, qword [rbp - 8]
xor rcx, rbp
sub rsp, 0x20
call fcn.1401fc630
add rsp, 0x20
mov eax, ebx
mov rsp, rbp
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret