joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400686e0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
cmp byte [0x14017b94b], 0
lea rcx, str..pipeMyPipe
mov edx, 0x40000000
sete al
xor ebx, ebx
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
mov byte [0x14017b94b], al
test al, al
je 0x140068741
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x14017b960], rax
cmp rax, 0xffffffffffffffff
je 0x140068789
mov r8d, 0xc
lea rdx, str.norecoilOn_n
jmp 0x140068761
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x14017b960], rax
cmp rax, 0xffffffffffffffff
je 0x140068789
mov r8d, 0xd
lea rdx, str.norecoilOff_n
lea r9, [0x14017b96c]
mov qword [rsp + 0x20], rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x14017b960]
add rsp, 0x40
pop rbx
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
add rsp, 0x40
pop rbx
jmp qword [sym.imp.KERNEL32.dll_Sleep]

Function at 0x1400687a0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
cmp byte [0x14017b94f], 0
lea rcx, str..pipeMyPipe
mov edx, 0x40000000
sete al
xor ebx, ebx
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
mov byte [0x14017b94f], al
test al, al
je 0x140068801
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x14017b960], rax
cmp rax, 0xffffffffffffffff
je 0x140068849
mov r8d, 0xb
lea rdx, str.ignoreKOn_n
jmp 0x140068821
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x14017b960], rax
cmp rax, 0xffffffffffffffff
je 0x140068849
mov r8d, 0xc
lea rdx, str.ignoreKOff_n
lea r9, [0x14017b96c]
mov qword [rsp + 0x20], rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x14017b960]
add rsp, 0x40
pop rbx
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
add rsp, 0x40
pop rbx
jmp qword [sym.imp.KERNEL32.dll_Sleep]

Function at 0x140068860
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
cmp byte [0x14017b96a], 0
lea rcx, str..pipeMyPipe
mov edx, 0x40000000
sete al
xor ebx, ebx
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
mov byte [0x14017b96a], al
test al, al
je 0x1400688c1
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x14017b960], rax
cmp rax, 0xffffffffffffffff
je 0x140068909
mov r8d, 0xb
lea rdx, str.drowFovOn_n
jmp 0x1400688e1
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x14017b960], rax
cmp rax, 0xffffffffffffffff
je 0x140068909
mov r8d, 0xc
lea rdx, str.drowFovOff_n
lea r9, [0x14017b96c]
mov qword [rsp + 0x20], rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x14017b960]
add rsp, 0x40
pop rbx
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
add rsp, 0x40
pop rbx
jmp qword [sym.imp.KERNEL32.dll_Sleep]
Function at 0x140068920
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
cmp byte [0x14017b990], 0
lea rcx, str..pipeMyPipe
mov edx, 0x40000000
sete al
xor ebx, ebx
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
mov byte [0x14017b990], al
test al, al
je 0x140068981
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x14017b960], rax
cmp rax, 0xffffffffffffffff
je 0x1400689c9
mov r8d, 0x10
lea rdx, str.ultimateModeOn_n
jmp 0x1400689a1
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x14017b960], rax
cmp rax, 0xffffffffffffffff
je 0x1400689c9
mov r8d, 0x11
lea rdx, str.ultimateModeOff_n
lea r9, [0x14017b96c]
mov qword [rsp + 0x20], rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x14017b960]
add rsp, 0x40
pop rbx
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
add rsp, 0x40
pop rbx
jmp qword [sym.imp.KERNEL32.dll_Sleep]

Function at 0x1400689e0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
cmp byte [0x14017b979], 0
lea rcx, str..pipeMyPipe
mov edx, 0x40000000
sete al
xor ebx, ebx
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
mov byte [0x14017b979], al
test al, al
je 0x140068a41
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x14017b960], rax
cmp rax, 0xffffffffffffffff
je 0x140068a89
mov r8d, 0xb
lea rdx, str.esplineOn_n
jmp 0x140068a61
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x14017b960], rax
cmp rax, 0xffffffffffffffff
je 0x140068a89
mov r8d, 0xc
lea rdx, str.esplineOff_n
lea r9, [0x14017b96c]
mov qword [rsp + 0x20], rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x14017b960]
add rsp, 0x40
pop rbx
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
add rsp, 0x40
pop rbx
jmp qword [sym.imp.KERNEL32.dll_Sleep]

Function at 0x140068aa0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
cmp byte [0x14017b94e], 0
lea rcx, str..pipeMyPipe
mov edx, 0x40000000
sete al
xor ebx, ebx
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
mov byte [0x14017b94e], al
test al, al
je 0x140068b01
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x14017b960], rax
cmp rax, 0xffffffffffffffff
je 0x140068b49
mov r8d, 0xa
lea rdx, str.espboxOn_n
jmp 0x140068b21
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x14017b960], rax
cmp rax, 0xffffffffffffffff
je 0x140068b49
mov r8d, 0xb
lea rdx, str.espboxOff_n
lea r9, [0x14017b96c]
mov qword [rsp + 0x20], rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x14017b960]
add rsp, 0x40
pop rbx
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
add rsp, 0x40
pop rbx
jmp qword [sym.imp.KERNEL32.dll_Sleep]
Function at 0x140068b60
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
cmp byte [0x14017b969], 0
lea rcx, str..pipeMyPipe
mov edx, 0x40000000
sete al
xor ebx, ebx
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
mov byte [0x14017b969], al
test al, al
je 0x140068bc1
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x14017b960], rax
cmp rax, 0xffffffffffffffff
je 0x140068c09
mov r8d, 0xb
lea rdx, str.espboxcOn_n
jmp 0x140068be1
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x14017b960], rax
cmp rax, 0xffffffffffffffff
je 0x140068c09
mov r8d, 0xc
lea rdx, str.espboxcOff_n
lea r9, [0x14017b96c]
mov qword [rsp + 0x20], rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x14017b960]
add rsp, 0x40
pop rbx
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
add rsp, 0x40
pop rbx
jmp qword [sym.imp.KERNEL32.dll_Sleep]

Function at 0x140068c20
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
cmp byte [0x14017b968], 0
lea rcx, str..pipeMyPipe
mov edx, 0x40000000
sete al
xor ebx, ebx
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
mov byte [0x14017b968], al
test al, al
je 0x140068c81
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x14017b960], rax
cmp rax, 0xffffffffffffffff
je 0x140068cc9
mov r8d, 0xe
lea rdx, str.espboxFillOn_n
jmp 0x140068ca1
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x14017b960], rax
cmp rax, 0xffffffffffffffff
je 0x140068cc9
mov r8d, 0xf
lea rdx, str.espboxFillOff_n
lea r9, [0x14017b96c]
mov qword [rsp + 0x20], rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x14017b960]
add rsp, 0x40
pop rbx
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
add rsp, 0x40
pop rbx
jmp qword [sym.imp.KERNEL32.dll_Sleep]

Function at 0x140068ce0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
cmp byte [0x14017b987], 0
lea rcx, str..pipeMyPipe
mov edx, 0x40000000
sete al
xor ebx, ebx
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
mov byte [0x14017b987], al
test al, al
je 0x140068d41
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x14017b960], rax
cmp rax, 0xffffffffffffffff
je 0x140068d89
mov r8d, 0xf
lea rdx, str.espskeletonOn_n
jmp 0x140068d61
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x14017b960], rax
cmp rax, 0xffffffffffffffff
je 0x140068d89
mov r8d, 0x10
lea rdx, str.espskeletonOff_n
lea r9, [0x14017b96c]
mov qword [rsp + 0x20], rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x14017b960]
add rsp, 0x40
pop rbx
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
add rsp, 0x40
pop rbx
jmp qword [sym.imp.KERNEL32.dll_Sleep]
Function at 0x140068da0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
cmp byte [0x14017b94a], 0
lea rcx, str..pipeMyPipe
mov edx, 0x40000000
sete al
xor ebx, ebx
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
mov byte [0x14017b94a], al
test al, al
je 0x140068e01
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x14017b960], rax
cmp rax, 0xffffffffffffffff
je 0x140068e49
mov r8d, 0xb
lea rdx, str.EspMocoOn_n
jmp 0x140068e21
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x14017b960], rax
cmp rax, 0xffffffffffffffff
je 0x140068e49
mov r8d, 0xc
lea rdx, str.EspMocoOff_n
lea r9, [0x14017b96c]
mov qword [rsp + 0x20], rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x14017b960]
add rsp, 0x40
pop rbx
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
add rsp, 0x40
pop rbx
jmp qword [sym.imp.KERNEL32.dll_Sleep]

Function at 0x140068e60
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
cmp byte [0x14017b94d], 0
lea rcx, str..pipeMyPipe
mov edx, 0x40000000
sete al
xor ebx, ebx
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
mov byte [0x14017b94d], al
test al, al
je 0x140068ec1
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x14017b960], rax
cmp rax, 0xffffffffffffffff
je 0x140068f09
mov r8d, 0xb
lea rdx, str.espinfoOn_n
jmp 0x140068ee1
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x14017b960], rax
cmp rax, 0xffffffffffffffff
je 0x140068f09
mov r8d, 0xc
lea rdx, str.espinfoOff_n
lea r9, [0x14017b96c]
mov qword [rsp + 0x20], rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x14017b960]
add rsp, 0x40
pop rbx
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
add rsp, 0x40
pop rbx
jmp qword [sym.imp.KERNEL32.dll_Sleep]

Function at 0x140068f20
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
cmp byte [0x14017b984], 0
lea rcx, str..pipeMyPipe
mov edx, 0x40000000
sete al
xor ebx, ebx
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
mov byte [0x14017b984], al
test al, al
je 0x140068f81
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x14017b960], rax
cmp rax, 0xffffffffffffffff
je 0x140068fc9
mov r8d, 0xa
lea rdx, str.espfixOn_n
jmp 0x140068fa1
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x14017b960], rax
cmp rax, 0xffffffffffffffff
je 0x140068fc9
mov r8d, 0xb
lea rdx, str.espfixOff_n
lea r9, [0x14017b96c]
mov qword [rsp + 0x20], rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x14017b960]
add rsp, 0x40
pop rbx
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
add rsp, 0x40
pop rbx
jmp qword [sym.imp.KERNEL32.dll_Sleep]
Function at 0x140068fe0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
cmp byte [0x14017b97b], 0
lea rcx, str..pipeMyPipe
mov edx, 0x40000000
sete al
xor ebx, ebx
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
mov byte [0x14017b97b], al
test al, al
je 0x140069041
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x14017b960], rax
cmp rax, 0xffffffffffffffff
je 0x140069089
mov r8d, 0xe
lea rdx, str.streammodeOn_n
jmp 0x140069061
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x14017b960], rax
cmp rax, 0xffffffffffffffff
je 0x140069089
mov r8d, 0xf
lea rdx, str.streammodeOff_n
lea r9, [0x14017b96c]
mov qword [rsp + 0x20], rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x14017b960]
add rsp, 0x40
pop rbx
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
add rsp, 0x40
pop rbx
jmp qword [sym.imp.KERNEL32.dll_Sleep]

Function at 0x1400690a0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x30], 0
lea rcx, str..pipeMyPipe
mov dword [rsp + 0x28], 0
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x14017b960], rax
cmp rax, 0xffffffffffffffff
je 0x14006911a
lea r9, [0x14017b96c]
mov qword [rsp + 0x20], 0
mov r8d, 0xf
lea rdx, str.esprefreshKey_n
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x14017b960]
add rsp, 0x48
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
add rsp, 0x48
jmp qword [sym.imp.KERNEL32.dll_Sleep]

Function at 0x140069130
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x30], 0
lea rcx, str..pipeMyPipe
mov dword [rsp + 0x28], 0
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x14017b960], rax
cmp rax, 0xffffffffffffffff
je 0x1400691aa
lea r9, [0x14017b96c]
mov qword [rsp + 0x20], 0
mov r8d, 7
lea rdx, str.espUp_n
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x14017b960]
add rsp, 0x48
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
add rsp, 0x48
jmp qword [sym.imp.KERNEL32.dll_Sleep]

Function at 0x1400691c0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x30], 0
lea rcx, str..pipeMyPipe
mov dword [rsp + 0x28], 0
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x14017b960], rax
cmp rax, 0xffffffffffffffff
je 0x14006923a
lea r9, [0x14017b96c]
mov qword [rsp + 0x20], 0
mov r8d, 6
lea rdx, str.espM_n
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x14017b960]
add rsp, 0x48
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
add rsp, 0x48
jmp qword [sym.imp.KERNEL32.dll_Sleep]
Function at 0x140069250
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x30], 0
lea rcx, str..pipeMyPipe
mov dword [rsp + 0x28], 0
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x14017b960], rax
cmp rax, 0xffffffffffffffff
je 0x1400692ca
lea r9, [0x14017b96c]
mov qword [rsp + 0x20], 0
mov r8d, 9
lea rdx, str.espDown_n
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x14017b960]
add rsp, 0x48
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
add rsp, 0x48
jmp qword [sym.imp.KERNEL32.dll_Sleep]

Function at 0x1400692e0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x30], 0
lea rcx, str..pipeMyPipe
mov dword [rsp + 0x28], 0
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x14017b960], rax
cmp rax, 0xffffffffffffffff
je 0x14006935a
lea r9, [0x14017b96c]
mov qword [rsp + 0x20], 0
mov r8d, 0xe
lea rdx, str.AimBotBanFix_n
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x14017b960]
add rsp, 0x48
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
add rsp, 0x48
jmp qword [sym.imp.KERNEL32.dll_Sleep]
Function at 0x14006c450
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rcx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
lea rcx, str..pipeMyPipe
xor r9d, r9d
mov dword [rsp + 0x20], 3
xor r8d, r8d
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14006c4c8
cmp qword [rbx + 0x18], 0xf
mov r8d, dword [rbx + 0x10]
jbe 0x14006c4a5
mov rbx, qword [rbx]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x20], 0
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140074790
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov ecx, 1
call fcn.1400dfb70
mov qword [rsp + 0x48], rax
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140076370]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x1400747ec
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov dword [rdi], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x140074800
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov ecx, 1
call fcn.1400dfb70
mov qword [rsp + 0x48], rax
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1400763a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x14007485c
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov dword [rdi], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x140074870
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov ecx, 1
call fcn.1400dfb70
mov qword [rsp + 0x48], rax
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140076490]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x1400748cc
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov dword [rdi], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x1400748e0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov ecx, 1
call fcn.1400dfb70
mov qword [rsp + 0x48], rax
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1400764e0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x14007493c
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov dword [rdi], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x140074950
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov ecx, 1
call fcn.1400dfb70
mov qword [rsp + 0x48], rax
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140076530]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x1400749ac
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov dword [rdi], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x1400749c0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov ecx, 1
call fcn.1400dfb70
mov qword [rsp + 0x48], rax
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140076560]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x140074a1c
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov dword [rdi], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x140088130
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x50
mov rax, qword [rcx + 8]
mov ebp, r8d
mov ecx, 0x3e80000
mov rbx, qword [rax + 0x2f0]
mov rax, qword [rdx + 0x80]
movzx edx, word [rdx + 0x68]
movzx edi, word [rax + 0x18]
mov eax, 0x40000
shl edi, 0x10
cmp edi, eax
cmovl edi, eax
shl edx, 0x10
call fcn.1400771e0
mov dword [rsp + 0x24], eax
mov ecx, eax
cmp eax, 0x28f
jge 0x140088186
xor eax, eax
add rsp, 0x50
pop rdi
pop rbp
pop rbx
ret
mov eax, dword [rbx + 0x24]
mov qword [rsp + 0x80], rsi
mov esi, dword [rbx + 0x28]
mov qword [rsp + 0x48], r12
mov r12d, dword [rbx + 0x3c]
mov qword [rsp + 0x40], r13
mov r13d, dword [rbx + 0x38]
mov dword [rsp + 0x88], eax
mov eax, dword [rbx + 0x2c]
mov qword [rsp + 0x38], r14
mov r14d, dword [rbx + 0x40]
mov dword [rsp + 0x70], eax
mov eax, dword [rbx + 0x34]
mov qword [rsp + 0x30], r15
mov r15d, dword [rbx + 0x30]
mov dword [rsp + 0x78], eax
mov dword [rsp + 0x20], r12d
test ebp, ebp
jg 0x1400881dd
mov ebp, 0x4b0000
jmp 0x1400881eb
shl ebp, 0x10
mov edx, ecx
mov ecx, ebp
call fcn.140079620
mov ebp, eax
bsr ecx, ebp
bsr eax, edi
shl r12d, 0x10
add eax, ecx
cmp eax, 0x2e
jl 0x140088201
mov eax, r12d
jmp 0x14008820a
mov edx, edi
mov ecx, ebp
call fcn.140079620
mov r9d, dword [rsp + 0x88]
mov ecx, r9d
shl ecx, 0x10
cmp eax, ecx
jge 0x140088226
shl esi, 0x10
mov ecx, esi
jmp 0x140088315
mov r8d, dword [rsp + 0x70]
mov edx, r8d
shl edx, 0x10
mov dword [rsp + 0x88], edx
cmp eax, edx
jge 0x140088284
mov ebx, r8d
mov edx, edi
sub ebx, r9d
call fcn.1400771e0
mov ecx, ebp
sub ecx, eax
test ebx, ebx
je 0x140088274
sub r15d, esi
mov r8d, ebx
mov edx, r15d
call fcn.1400794f0
shl esi, 0x10
mov edx, edi
mov ecx, esi
mov ebx, eax
call fcn.1400771e0
add ebx, eax
jmp 0x14008831e
mov esi, dword [rsp + 0x78]
mov ebx, esi
mov r8d, dword [rsp + 0x70]
shl ebx, 0x10
jmp 0x140088291
mov esi, dword [rsp + 0x78]
mov ebx, esi
shl ebx, 0x10
cmp eax, ebx
jge 0x1400882d0
mov ecx, dword [rsp + 0x88]
mov r12d, esi
mov edx, edi
sub r12d, r8d
call fcn.1400771e0
mov ecx, ebp
sub ecx, eax
test r12d, r12d
je 0x1400882d5
sub r13d, r15d
mov r8d, r12d
mov edx, r13d
call fcn.1400794f0
shl r15d, 0x10
mov edx, edi
mov ecx, r15d
mov ebx, eax
call fcn.1400771e0
add ebx, eax
jmp 0x14008831e
cmp eax, r12d
jge 0x14008830e
mov r15d, dword [rsp + 0x20]
mov edx, edi
mov ecx, ebx
call fcn.1400771e0
sub ebp, eax
sub r15d, esi
je 0x14008830e
sub r14d, r13d
mov r8d, r15d
mov edx, r14d
mov ecx, ebp
call fcn.1400794f0
shl r13d, 0x10
mov edx, edi
mov ecx, r13d
mov ebx, eax
call fcn.1400771e0
add ebx, eax
jmp 0x14008831e
shl r14d, 0x10
mov ecx, r14d
mov edx, edi
call fcn.1400771e0
mov ebx, eax
mov edx, dword [rsp + 0x24]
mov ecx, ebx
mov r15, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
mov r13, qword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rbp
pop rbx
jmp fcn.1400771e0