joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180015690
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x180085140]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov esi, edx
mov rdi, rcx
cmp edx, 0xffffffff
jne 0x1800156bd
xor eax, eax
jmp 0x180015826
mov qword [rsp + 0xa0], rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
test rax, rax
je 0x1800156fd
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::epptr_void_const___ptr64]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
cmp rax, rbx
jae 0x1800156fd
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], sil
mov eax, esi
jmp 0x18001581e
cmp qword [rdi + 0x80], 0
je 0x180015819
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const___ptr64]
lea rcx, [rdi + 0x70]
cmp rax, rcx
jne 0x180015737
mov rdx, qword [rdi + 0x88]
mov rcx, rdi
mov r9, qword [rdi + 0x90]
mov r8, rdx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::setg_char____ptr64__char____ptr64__char____ptr64____ptr64]
mov rcx, qword [rdi + 0x68]
test rcx, rcx
jne 0x180015762
mov rdx, qword [rdi + 0x80]
movsx ecx, sil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x18001581e
lea rax, [rsp + 0x48]
mov byte [rsp + 0x40], sil
mov qword [rsp + 0x38], rax
lea rdx, [rdi + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1800157d1
sub eax, 1
je 0x1800157d1
cmp eax, 2
jne 0x180015819
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rdi + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x18001581e
mov rbx, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
sub rbx, rax
je 0x1800157ff
mov r9, qword [rdi + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x180015819
lea rax, [rsp + 0x40]
mov byte [rdi + 0x71], 1
cmp qword [rsp + 0x50], rax
mov ecx, 0xffffffff
cmovne ecx, esi
mov eax, ecx
jmp 0x18001581e
mov eax, 0xffffffff
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1800467b0
mov rsi, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x180015cd0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rsi, r8
mov r14, rdx
mov rbp, rcx
test r8, r8
jg 0x180015d01
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je 0x180015d1f
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x30], rbx
mov rbx, rsi
mov qword [rsp + 0x38], rdi
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
test rax, rax
je 0x180015d69
cmp rax, rsi
mov rdi, rsi
mov rcx, rbp
cmovb rdi, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, rdi
mov rcx, r14
mov rdx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, edi
mov rcx, rbp
add r14, rdi
sub rbx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
cmp qword [rbp + 0x80], 0
mov rdi, rbx
je 0x180015de1
mov rcx, rbp
call fcn.180017e30
cmp rbx, 0xfff
jbe 0x180015dc1
nop word [rax + rax]
mov r9, qword [rbp + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add r14, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x180015e02
cmp rbx, rax
ja 0x180015d90
test rdi, rdi
je 0x180015de1
mov r9, qword [rbp + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
sub rsi, rdi
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
sub rsi, rbx
jmp 0x180015de4
Function at 0x180015e10
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x180015e38
add rsp, 0x20
pop r14
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov rbp, rax
test rbx, rbx
jle 0x180015eac
test rax, rax
jle 0x180015e8c
cmp rbx, rax
mov rcx, rdi
cmovl rbp, rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, rbp
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebp
mov rcx, rdi
add r14, rbp
sub rbx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
test rbx, rbx
jle 0x180015eac
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x180015eac
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x40]
sub rsi, rbx
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rbx
ret
Function at 0x180017c30
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x180085140]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x180017d03
cmp byte [rcx + 0x71], 0
je 0x180017d03
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x180017cff
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180017cc4
sub eax, 1
je 0x180017cc8
cmp eax, 2
jne 0x180017cff
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800467b0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x180017cf6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x180017cff
cmp byte [rbx + 0x71], 0
sete al
jmp 0x180017cac
xor al, al
jmp 0x180017cac
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800467b0
add rsp, 0x60
pop rbx
ret
Function at 0x180018660
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x180085140]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rsi, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
lea rcx, [rsp + 0x20]
call fcn.180004940
nop
movabs r9, 0xcbf29ce484222325
lea rax, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova rax, qword [rsp + 0x20]
lea rdx, [rsp + 0x20]
cmova rdx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
add rcx, rdx
cmp rax, rcx
je 0x1800186f3
movabs r8, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
imul r9, r8
movsx rdx, byte [rax]
xor r9, rdx
inc rax
cmp rax, rcx
jne 0x1800186e0
mov qword [rsi + 0x40], r9
mov byte [rsi + 0x68], 0
lea r8, [rsi + 0x20]
mov rdx, rsi
lea rcx, [rsp + 0x20]
call fcn.180018860
mov rax, qword [rsi + 0x30]
mov qword [rsi + 0x48], rax
mov rbx, qword [0x180094300]
mov rcx, qword [rbx + 8]
mov rax, rcx
mov rdi, rbx
cmp byte [rcx + 0x19], 0
jne 0x180018758
mov r8, qword [rsi + 0x40]
nop
mov rdx, qword [rax + 0x20]
cmp rdx, r8
jae 0x18001873f
mov rax, qword [rax + 0x10]
jmp 0x180018752
cmp byte [rdi + 0x19], 0
je 0x18001874c
cmp r8, rdx
cmovb rdi, rax
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x180018730
cmp byte [rdi + 0x19], 0
jne 0x180018761
mov rcx, qword [rdi]
cmp byte [rcx + 0x19], 0
jne 0x180018788
mov rax, qword [rsi + 0x40]
nop dword [rax + rax]
cmp rax, qword [rcx + 0x20]
jae 0x18001877e
mov rdi, rcx
mov rcx, qword [rcx]
jmp 0x180018782
mov rcx, qword [rcx + 0x10]
cmp byte [rcx + 0x19], 0
je 0x180018770
cmp rbx, rdi
je 0x180018809
nop dword [rax]
mov rdx, qword [rbx + 0x28]
mov rcx, rsi
call fcn.1800184b0
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x1800187c8
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1800187c3
cmp rbx, qword [rax + 0x10]
jne 0x1800187c3
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1800187b0
mov rbx, rax
jmp 0x1800187ef
mov rbx, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x1800187ef
nop dword [rax]
nop dword [rax + rax]
mov rbx, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x1800187e0
cmp rbx, rdi
jne 0x180018790
mov rax, qword [rsi + 0x58]
sub rax, qword [rsi + 0x50]
sar rax, 3
test rax, rax
je 0x180018809
mov byte [rsi + 0x68], 1
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x180018849
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180018844
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180018844
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18004637c
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1800467b0
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800457b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rsi, rdx
mov r15, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
movsxd r8, dword [rax + 0x3c]
mov r14d, dword [r8 + rax + 0x50]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
xor ebp, ebp
mov r11d, ebp
mov qword [rsp + 0x40], rbp
lea r12, [0x180058120]
mov r9, qword [rsp + 0x38]
nop word [rax + rax]
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x28], rbp
mov rdi, rbp
movzx edx, byte [rsi]
inc rsi
test dl, dl
je 0x1800458c7
nop dword [rax + rax]
movzx eax, dil
shl al, 2
not al
and al, 4
movzx ecx, dl
movzx r8d, byte [rcx + r12]
cmp r8b, 0xff
je 0x180045867
mov rdx, rdi
shr rdx, 1
movzx ecx, al
mov eax, 0xf
shl al, cl
or byte [rsp + rdx + 0x28], al
shl r8b, cl
or byte [rsp + rdx + 0x20], r8b
jmp 0x180045870
cmp dl, 0x3f
je 0x180045870
test al, al
jne 0x180045879
inc rdi
cmp rdi, 0x10
je 0x180045883
movzx edx, byte [rsi]
inc rsi
test dl, dl
jne 0x180045830
test rdi, rdi
je 0x1800458bd
cmp r9, r11
je 0x1800458a1
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [r9], xmm0
add r9, 0x10
mov qword [rsp + 0x38], r9
jmp 0x1800458bd
lea r8, [rsp + 0x20]
mov rdx, r9
lea rcx, [rsp + 0x30]
call fcn.180045390
mov r11, qword [rsp + 0x40]
mov r9, qword [rsp + 0x38]
cmp rdi, 0x10
jae 0x180045810
lea r10, [r14 + rbx]
mov r8, qword [rsp + 0x30]
cmp rbx, r10
jae 0x180045918
sub r9, r8
sar r9, 4
mov rcx, rbp
test r9, r9
je 0x18004591b
mov rdx, r8
nop word [rax + rax]
mov rax, qword [rbx + rcx*8]
xor rax, qword [rdx]
test qword [rdx + 8], rax
jne 0x18004590b
inc rcx
add rdx, 0x10
cmp rcx, r9
jb 0x1800458f0
jmp 0x18004591b
inc rbx
cmp rbx, r10
jae 0x180045918
mov rcx, rbp
jmp 0x1800458e4
mov rbx, rbp
test r8, r8
je 0x18004595a
sub r11, r8
and r11, 0xfffffffffffffff0
mov rax, r8
cmp r11, 0x1000
jb 0x18004594f
add r11, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18004594f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, r11
mov rcx, r8
call fcn.18004637c
mov rax, r15
test rbx, rbx
je 0x180045967
mov qword [r15], rbx
jmp 0x18004596a
mov qword [r15], rbp
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x180045cc4
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x180045cfe
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x180045d03
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x180045d4c
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x180058230]
cmp byte [rcx + rax], 0
je 0x180045d4c
dec r8
sub rdx, 1
jne 0x180045d32
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x140131942
Capabilities:
Write file on windows

Disassembly:
jmp 0x14032cf00
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x14052f702]
call fcn.140137801
nop
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x14032cf58
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x14032d06a
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x14032d003
cmp qword [rbp + 0x28], 0
jle 0x14032d003
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x14032cfa1
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.14013716c
nop
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
nop
cmp qword [rbp + 0x130], 0
jle 0x14032d059
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x14032d059
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x140131e15
Capabilities:
Link many functions at runtime

Disassembly:
jmp 0x14038b2d0
push rdi
sub rsp, 0x70
lea rdi, [rsp + 0x20]
mov ecx, 0x14
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1404f5d40]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rax, str.libOSMesa.dll
mov qword [rsp + 0x38], rax
lea rax, str.OSMesa.dll
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0
cmp qword [0x14050bfd8], 0
je 0x14038b32b
mov eax, 1
jmp 0x14038b4ab
mov dword [rsp + 0x20], 0
jmp 0x14038b33f
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
cmp qword [rsp + rax*8 + 0x38], 0
je 0x14038b371
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + rax*8 + 0x38]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x14050bfd8], rax
cmp qword [0x14050bfd8], 0
je 0x14038b36f
jmp 0x14038b371
jmp 0x14038b335
cmp qword [0x14050bfd8], 0
jne 0x14038b393
lea rdx, str.OSMesa:_Library_not_found
mov ecx, 0x10006
call fcn.1401347fa
xor eax, eax
jmp 0x14038b4ab
lea rdx, str.OSMesaCreateContextExt
mov rcx, qword [0x14050bfd8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14050bfe0], rax
lea rdx, str.OSMesaCreateContextAttribs
mov rcx, qword [0x14050bfd8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14050bfe8], rax
lea rdx, str.OSMesaDestroyContext
mov rcx, qword [0x14050bfd8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14050bff0], rax
lea rdx, str.OSMesaMakeCurrent
mov rcx, qword [0x14050bfd8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14050bff8], rax
lea rdx, str.OSMesaGetColorBuffer
mov rcx, qword [0x14050bfd8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14050c000], rax
lea rdx, str.OSMesaGetDepthBuffer
mov rcx, qword [0x14050bfd8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14050c008], rax
lea rdx, str.OSMesaGetProcAddress
mov rcx, qword [0x14050bfd8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14050c010], rax
cmp qword [0x14050bfe0], 0
je 0x14038b48c
cmp qword [0x14050bff0], 0
je 0x14038b48c
cmp qword [0x14050bff8], 0
je 0x14038b48c
cmp qword [0x14050c000], 0
je 0x14038b48c
cmp qword [0x14050c008], 0
je 0x14038b48c
cmp qword [0x14050c010], 0
jne 0x14038b4a6
lea rdx, str.OSMesa:_Failed_to_load_required_entry_points
mov ecx, 0x10008
call fcn.1401347fa
call fcn.140131d6b
xor eax, eax
jmp 0x14038b4ab
mov eax, 1
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1404319b0]
call fcn.1401365c8
mov rax, rdi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140134205
add rsp, 0x70
pop rdi
ret
Function at 0x140132432
Capabilities:
Create thread

Disassembly:
jmp 0x1402996e0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x16
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
mov rax, qword [0x1404f5d40]
xor rax, rbp
mov qword [rbp + 0x100], rax
lea rcx, [0x14052f72c]
call fcn.140137801
nop
mov edx, 8
lea rcx, [rbp + 8]
call fcn.140132e1e
mov rdx, qword [rbp + 0x138]
lea rcx, [rbp + 8]
call fcn.140134372
nop
lea rax, [0x140135399]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x130]
add rax, 8
mov qword [rbp + 0xf8], rax
lea rcx, [rbp + 8]
call fcn.140135565
mov rcx, qword [rbp + 0xf8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll__beginthreadex]
mov rcx, qword [rbp + 0x130]
mov qword [rcx], rax
mov rax, qword [rbp + 0x130]
cmp qword [rax], 0
je 0x1402997bc
lea rcx, [rbp + 8]
call fcn.140133c56
nop
jmp 0x1402997d5
mov rax, qword [rbp + 0x130]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.140132658
nop
lea rcx, [rbp + 8]
call fcn.140133a9e
nop
lea rcx, [rbp - 0x30]
lea rdx, [0x140401910]
call fcn.1401365c8
mov rcx, qword [rbp + 0x100]
xor rcx, rbp
call fcn.140134205
lea rsp, [rbp + 0x118]
pop rdi
pop rbp
ret

Function at 0x140132559
Capabilities:
Enumerate processes

Disassembly:
jmp 0x1402ead20
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x428
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xa2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x448]
mov rax, qword [0x1404f5d40]
xor rax, rbp
mov qword [rbp + 0x3f8], rax
lea rcx, [0x14052f6d5]
call fcn.140137801
nop
xor edx, edx
mov ecx, 2
call fcn.140134110
mov qword [rbp + 8], rax
lea rax, [rbp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 0x238
rep stosb byte [rdi], al
mov dword [rbp + 0x30], 0x238
cmp qword [rbp + 8], 0xffffffffffffffff
jne 0x1402ead9c
xor eax, eax
jmp 0x1402eadfe
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.140134eee
test eax, eax
jne 0x1402eadb1
xor eax, eax
jmp 0x1402eadfe
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.1401368a2
test eax, eax
je 0x1402eadf1
mov rcx, qword [rbp + 0x420]
call fcn.140133328
mov rdx, rax
lea rcx, [rbp + 0x5c]
call qword [sym.imp.ucrtbased.dll_wcscmp]
test eax, eax
jne 0x1402eadef
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, dword [rbp + 0x38]
jmp 0x1402eadfe
jmp 0x1402eadb1
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1403f7f40]
call fcn.1401365c8
mov rax, rdi
mov rcx, qword [rbp + 0x3f8]
xor rcx, rbp
call fcn.140134205
lea rsp, [rbp + 0x408]
pop rdi
pop rbp
ret
Function at 0x140132667
Capabilities:
Enumerate process modules

Disassembly:
jmp 0x1402ebbd0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0xa20
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x1c0
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xa48]
mov rax, qword [0x1404f5d40]
xor rax, rbp
mov qword [rbp + 0x9f8], rax
lea rcx, [0x14052f6d5]
call fcn.140137801
nop
mov rax, qword [rbp + 0xa20]
mov qword [rax], 0
mov rax, qword [rbp + 0xa20]
mov qword [rax + 8], 0
mov rax, qword [rbp + 0xa20]
mov qword [rax + 0x10], 0
mov edx, dword [rbp + 0xa28]
mov ecx, 0x18
call fcn.140134110
mov qword [rbp + 0x38], rax
cmp qword [rbp + 0x38], 0xffffffffffffffff
jne 0x1402ebcaf
mov r9, qword [rbp + 0xa30]
lea r8, str.Failed_to_get__s__invalid_handle_value
mov edx, 0xff
lea rcx, [rbp + 0x60]
call fcn.140132cac
nop
mov r9d, 0x10
lea r8, str.ERROR
lea rdx, [rbp + 0x60]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
mov rax, qword [rbp + 0xa20]
jmp 0x1402ebd4e
mov dword [rbp + 0x280], 0x438
lea rdx, [rbp + 0x280]
mov rcx, qword [rbp + 0x38]
call fcn.140135060
test eax, eax
je 0x1402ebd3c
mov rdx, qword [rbp + 0xa30]
lea rcx, [rbp + 0x2b0]
call qword [sym.imp.ucrtbased.dll__wcsicmp]
test eax, eax
jne 0x1402ebd28
mov rax, qword [rbp + 0x298]
mov qword [rbp + 0x9d8], rax
mov rax, qword [rbp + 0x2a8]
mov qword [rbp + 0x9e0], rax
mov eax, dword [rbp + 0x2a0]
mov qword [rbp + 0x9e8], rax
lea rax, [rbp + 0x9d8]
mov rdi, qword [rbp + 0xa20]
mov rsi, rax
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
jmp 0x1402ebd3c
lea rdx, [rbp + 0x280]
mov rcx, qword [rbp + 0x38]
call fcn.140131efb
test eax, eax
jne 0x1402ebccd
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rax, qword [rbp + 0xa20]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1403f7ea0]
call fcn.1401365c8
mov rax, rdi
mov rcx, qword [rbp + 0x9f8]
xor rcx, rbp
call fcn.140134205
lea rsp, [rbp + 0xa00]
pop rdi
pop rsi
pop rbp
ret