joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c60d0
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
movdqa xmm2, xmmword [0x140139070]
lea r9, [rcx + rdx]
movdqa xmm3, xmmword [0x140139050]
movdqa xmm4, xmmword [0x140139080]
movdqa xmm5, xmmword [0x140139040]
cmp rcx, r9
jae 0x1400c6121
add rcx, 0x20
aesenc xmm2, xmmword [rcx - 0x20]
aesdec xmm3, xmmword [rcx - 0x10]
aesenc xmm4, xmmword [rcx]
aesdec xmm5, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x40]
lea rax, [rcx - 0x20]
cmp rax, r9
jb 0x1400c60fd
movdqa xmm0, xmmword [0x140139000]
movdqa xmm1, xmmword [0x140139090]
aesenc xmm2, xmm0
aesdec xmm3, xmm0
aesenc xmm4, xmm0
aesdec xmm5, xmm0
aesenc xmm2, xmm1
aesdec xmm3, xmm1
aesenc xmm4, xmm1
aesdec xmm5, xmm1
movdqu xmmword [r8], xmm2
movdqu xmmword [r8 + 0x10], xmm3
movdqu xmmword [r8 + 0x20], xmm4
movdqu xmmword [r8 + 0x30], xmm5
ret

Function at 0x1400cd540
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x28
movdqa xmm2, xmmword [0x140139070]
lea r11, [rcx + 0x1c00]
movdqa xmm3, xmmword [0x140139050]
mov r10, rcx
movdqa xmm4, xmmword [0x140139080]
mov rax, rcx
movdqa xmm5, xmmword [0x140139040]
lea rcx, [rdx - 0x1c00]
movdqu xmm0, xmmword [r9]
add rcx, rax
movdqu xmm1, xmmword [r9 + 0x10]
mov edx, 2
movaps xmmword [rsp + 0x10], xmm6
movdqu xmm6, xmmword [r9 + 0x20]
movaps xmmword [rsp], xmm7
movdqu xmm7, xmmword [r9 + 0x30]
jmp 0x1400cd657
aesenc xmm2, xmmword [rax]
aesdec xmm3, xmmword [rax + 0x10]
aesenc xmm4, xmmword [rax + 0x20]
aesdec xmm5, xmmword [rax + 0x30]
aesenc xmm2, xmmword [rax + 0x40]
aesdec xmm3, xmmword [rax + 0x50]
aesenc xmm4, xmmword [rax + 0x60]
aesdec xmm5, xmmword [rax + 0x70]
aesdec xmm0, xmmword [0x140139060]
aesenc xmm1, xmmword [0x140139010]
aesdec xmm6, xmmword [0x140139020]
aesenc xmm7, xmmword [0x140139030]
movdqu xmmword [rax], xmm0
aesdec xmm0, xmmword [0x140139060]
movdqu xmmword [rax + 0x10], xmm1
aesenc xmm1, xmmword [0x140139010]
movdqu xmmword [rax + 0x20], xmm6
aesdec xmm6, xmmword [0x140139020]
movdqu xmmword [rax + 0x30], xmm7
aesenc xmm7, xmmword [0x140139030]
movdqu xmmword [rax + 0x40], xmm0
movdqu xmmword [rax + 0x50], xmm1
movdqu xmmword [rax + 0x60], xmm6
movdqu xmmword [rax + 0x70], xmm7
prefetcht0 byte [r11]
prefetcht0 byte [r11 + 0x40]
sub rax, 0xffffffffffffff80
lea r11, [r11 + 0x80]
cmp rax, rcx
jb 0x1400cd5a5
add rcx, 0x1c00
mov r11, r10
sub rdx, 1
jne 0x1400cd657
movdqu xmmword [r9], xmm0
movdqa xmm0, xmmword [0x140139000]
movdqu xmmword [r9 + 0x10], xmm1
movdqa xmm1, xmmword [0x140139090]
movdqu xmmword [r9 + 0x20], xmm6
movaps xmm6, xmmword [rsp + 0x10]
movdqu xmmword [r9 + 0x30], xmm7
movaps xmm7, xmmword [rsp]
aesenc xmm2, xmm0
aesdec xmm3, xmm0
aesenc xmm4, xmm0
aesdec xmm5, xmm0
aesenc xmm2, xmm1
aesdec xmm3, xmm1
aesenc xmm4, xmm1
aesdec xmm5, xmm1
movdqu xmmword [r8], xmm2
movdqu xmmword [r8 + 0x10], xmm3
movdqu xmmword [r8 + 0x20], xmm4
movdqu xmmword [r8 + 0x30], xmm5
add rsp, 0x28
ret
Function at 0x1400ce4f4
Capabilities:
Encode data using xor
Hash data using sha512

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rdx, rdx
je 0x1400ce57a
test rcx, rcx
je 0x1400ce57a
xor edx, edx
mov r8d, 0xf0
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x40
lea rdx, [0x1401390c0]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rsi, rbx
mov rbp, rdi
mov r14d, 8
mov r8d, 8
lea rcx, [rsp + 0x48]
mov rdx, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x48]
add rbp, 8
xor qword [rsi], rax
lea rsi, [rsi + 8]
sub r14, 1
jne 0x1400ce544
movzx eax, byte [rdi]
mov dword [rbx + 0xe4], eax
xor eax, eax
jmp 0x1400ce57d
or eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x1400d18d4
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, rsp
sub rsp, 0x98
movdqu xmm2, xmmword [rcx]
movdqu xmm3, xmmword [rcx + 0x10]
movdqu xmm4, xmmword [rcx + 0x20]
movdqu xmm5, xmmword [rcx + 0x30]
mov ecx, 2
movaps xmmword [rax - 0x18], xmm6
movdqa xmm6, xmmword [0x14015e0e0]
movaps xmmword [rax - 0x28], xmm7
movdqa xmm7, xmmword [0x14015e0f0]
movaps xmmword [rax - 0x38], xmm8
movdqa xmm8, xmmword [0x14015e100]
movaps xmmword [rax - 0x48], xmm9
movdqa xmm9, xmmword [0x14015e110]
movaps xmmword [rax - 0x58], xmm10
movdqa xmm10, xmmword [0x14015e120]
movaps xmmword [rax - 0x68], xmm11
movdqa xmm11, xmmword [0x14015e130]
movaps xmmword [rax - 0x78], xmm12
lea rax, [rdx + r8]
movdqa xmm12, xmmword [0x14015e140]
movaps xmmword [rsp + 0x10], xmm13
movdqa xmm13, xmmword [0x14015e150]
movaps xmmword [rsp], xmm14
aesdec xmm2, xmm6
aesenc xmm3, xmm6
aesdec xmm4, xmm10
aesenc xmm5, xmm10
aesdec xmm2, xmm7
aesenc xmm3, xmm7
aesdec xmm4, xmm11
aesenc xmm5, xmm11
aesdec xmm2, xmm8
aesenc xmm3, xmm8
aesdec xmm4, xmm12
aesenc xmm5, xmm12
aesdec xmm2, xmm9
aesenc xmm3, xmm9
aesdec xmm4, xmm13
aesenc xmm5, xmm13
movdqu xmmword [r8], xmm2
movdqu xmmword [r8 + 0x10], xmm3
movdqu xmmword [r8 + 0x20], xmm4
movdqu xmmword [r8 + 0x30], xmm5
add r8, 0x40
sub rcx, 1
jne 0x1400c51d4
movdqa xmm14, xmmword [0x140138fe0]
jmp 0x1400c52f6
aesdec xmm2, xmm6
aesenc xmm3, xmm6
aesdec xmm4, xmm10
aesenc xmm5, xmm10
aesdec xmm2, xmm7
aesenc xmm3, xmm7
aesdec xmm4, xmm11
aesenc xmm5, xmm11
aesdec xmm2, xmm8
aesenc xmm3, xmm8
aesdec xmm2, xmm9
movdqa xmm0, xmm14
movdqa xmm1, xmm14
andps xmm0, xmm2
movdqu xmmword [r8], xmm0
movdqa xmm0, xmm14
aesenc xmm3, xmm9
andps xmm1, xmm3
movdqu xmmword [r8 + 0x10], xmm1
movdqa xmm1, xmm14
aesdec xmm4, xmm12
aesenc xmm5, xmm12
aesdec xmm4, xmm13
aesenc xmm5, xmm13
andps xmm0, xmm4
andps xmm1, xmm5
movdqu xmmword [r8 + 0x20], xmm0
movdqu xmmword [r8 + 0x30], xmm1
add r8, 0x40
cmp r8, rax
jb 0x1400c525f
movaps xmm7, xmmword [rsp + 0x70]
lea r11, [rsp + 0x98]
movaps xmm6, xmmword [r11 - 0x18]
movaps xmm8, xmmword [r11 - 0x38]
movaps xmm9, xmmword [r11 - 0x48]
movaps xmm10, xmmword [r11 - 0x58]
movaps xmm11, xmmword [r11 - 0x68]
movaps xmm12, xmmword [r11 - 0x78]
movaps xmm13, xmmword [rsp + 0x10]
movaps xmm14, xmmword [rsp]
mov rsp, r11
ret
mov eax, dword [0x14015e05c]
lea r8, [rcx + 0x40]
mov r9, rdx
mov rcx, r9
lea edx, [rax*8 + 0x80]
jmp 0x1400c513c
Function at 0x1400d1eec
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x140159cc0]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rcx, qword [rcx + 0xab8]
mov rbx, r8
shr rdx, 6
mov r8d, edx
lea rdx, [rsp + 0x20]
call fcn.1400cf4b8
lea rdx, [rsp + 0x20]
mov ecx, 8
sub rdx, rbx
mov rax, qword [rbx + rdx]
xor qword [rbx], rax
lea rbx, [rbx + 8]
sub rcx, 1
jne 0x1400d1f29
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14011ae70
add rsp, 0x70
pop rbx
ret

Function at 0x1400d1fec
Capabilities:
Encode data using xor

Disassembly:
mov r9, qword [rcx + 0xaa8]
mov ecx, 8
add r9, rdx
sub r9, r8
mov rax, qword [r8 + r9]
xor qword [r8], rax
lea r8, [r8 + 8]
sub rcx, 1
jne 0x1400d1ffe
ret

Function at 0x1400d23c8
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.1400d18d4
mov rcx, rbx
call fcn.1400d1a68
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x1400d2010

Function at 0x1400d3b84
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x50
mov rdi, rcx
mov rax, qword [rsp + 0x90]
mov qword [r11 - 0x28], rax
mov rax, qword [rsp + 0x88]
mov qword [r11 - 0x30], rax
mov rax, qword [rsp + 0x80]
mov qword [r11 - 0x38], rax
lea rcx, [r11 + 8]
call fcn.1400d3c2c
mov rsi, qword [rax]
and qword [rax], 0
mov qword [rsp + 0x40], rsi
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400d3be4
mov edx, 0x28
call fcn.14011ad24
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
and dword [rsp + 0x20], 0
mov r9, rsi
lea r8, [0x1400d3aa0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
je 0x1400d3c1e
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
and dword [rbx], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3

Function at 0x1400d6d38
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rbx, r9
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
mov ecx, 0x20
call fcn.14011ace8
mov r9, rax
test rax, rax
je 0x1400d6d88
mov rax, qword [rsp + 0x60]
mov r10, qword [rax]
mov qword [r9], r10
mov eax, dword [rbx]
mov dword [r9 + 8], eax
mov rax, qword [rsi]
mov qword [r9 + 0x10], rax
mov qword [r9 + 0x18], rbp
jmp 0x1400d6d8b
xor r9d, r9d
mov qword [rsp + 0x40], r9
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
and dword [rsp + 0x20], 0
lea r8, [0x1400d6c8c]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
je 0x1400d6dcc
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
and dword [rbx], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x1400d6ddc
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rbx, r9
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
mov ecx, 0x18
call fcn.14011ace8
mov r9, rax
test rax, rax
je 0x1400d6e37
mov rax, qword [rsp + 0x68]
mov r10b, byte [rax]
mov byte [r9], r10b
mov rax, qword [rsp + 0x60]
mov cl, byte [rax]
mov byte [r9 + 1], cl
mov eax, dword [rbx]
mov dword [r9 + 4], eax
mov rax, qword [rsi]
mov qword [r9 + 8], rax
mov qword [r9 + 0x10], rbp
jmp 0x1400d6e3a
xor r9d, r9d
mov qword [rsp + 0x40], r9
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
and dword [rsp + 0x20], 0
lea r8, [0x1400d6cc4]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
je 0x1400d6e7b
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
and dword [rbx], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3

Function at 0x1400d6e8c
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rbx, r9
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
mov ecx, 0x18
call fcn.14011ace8
mov r9, rax
test rax, rax
je 0x1400d6edc
mov rax, qword [rsp + 0x60]
mov r10b, byte [rax]
mov byte [r9], r10b
mov eax, dword [rbx]
mov dword [r9 + 4], eax
mov rax, qword [rsi]
mov qword [r9 + 8], rax
mov qword [r9 + 0x10], rbp
jmp 0x1400d6edf
xor r9d, r9d
mov qword [rsp + 0x40], r9
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
and dword [rsp + 0x20], 0
lea r8, [0x1400d6d00]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
je 0x1400d6f20
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
and dword [rbx], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x1400daba0
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [rcx + 0x58]
test al, 1
je 0x1400dabad
mov eax, 0xfffff00d
ret
bt eax, 0xf
jb 0x1400dabb9
mov eax, 0xfffff031
ret
mov eax, dword [rcx + 0x10]
cmp eax, 7
je 0x1400dabdb
cmp eax, 0xc
je 0x1400dabd6
cmp eax, 0xe
je 0x1400dabd1
mov eax, 0xfffff02a
ret
jmp 0x1400dcb60
jmp 0x1400e7d20
mov eax, 0xfffff008
ret
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0x100], 0
mov ebx, r8d
mov rdi, rdx
jbe 0x1400dcb89
mov eax, 0xfffff008
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
lea r9, [rsp + 0x30]
call fcn.1400dcd10
test eax, eax
je 0x1400dcbaa
mov ecx, dword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1400ee860
mov edx, ebx
mov rcx, rdi
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1400d9970
sub rsp, 0x48
cmp dword [rcx + 0x100], 0
jbe 0x1400e7d37
mov eax, 0xfffff008
add rsp, 0x48
ret
mov rcx, qword [rcx + 0x110]
lea r9, [rsp + 0x50]
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
call qword [sym.imp.WS2_32.dll_WSASend]
cmp eax, 0xffffffff
jne 0x1400e7d70
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.1400ee860
add rsp, 0x48
ret
mov eax, dword [rsp + 0x50]
add rsp, 0x48
ret

Function at 0x1400db420
Capabilities:
Log keystrokes
Manipulate console buffer

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rax, qword [0x140159cc0]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, rcx
xor edi, edi
lea rcx, [0x140161030]
call fcn.1400e30d0
mov eax, 2
xchg dword [0x140160fe8], eax
cmp eax, 1
je 0x1400db46a
lea rcx, [0x140161030]
call fcn.1400e30a0
xor eax, eax
jmp 0x1400db554
xor r9d, r9d
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0x30], rdi
lea rcx, str.conout_
mov qword [rsp + 0xa0], rbp
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0x80
lea r8d, [r9 + 3]
mov qword [rsp + 0x70], r14
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400db4d2
lea rdx, [0x140160ff0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x1400db4d2
lock or dword [0x140160fec], 1
mov r14d, 1
mov dword [rsp + 0x50], 0xd0001
mov ebp, reloc.WS2_32.dll_listen
mov word [rsp + 0x48], r14w
mov ecx, ebp
mov dword [rsp + 0x4c], r14d
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov rcx, qword [rsi + 0x110]
lea r9, [rsp + 0x40]
mov r8d, r14d
mov word [rsp + 0x54], ax
lea rdx, [rsp + 0x48]
mov word [rsp + 0x56], bp
mov dword [rsp + 0x58], edi
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov r14, qword [rsp + 0x70]
mov rbp, qword [rsp + 0xa0]
test eax, eax
jne 0x1400db53b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp rbx, 0xffffffffffffffff
je 0x1400db54a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x98]
mov eax, edi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14011ae70
add rsp, 0x78
pop rdi
pop rsi
ret
Function at 0x1400dbee0
Capabilities:
Manipulate console buffer

Disassembly:
push rbx
push rbp
push rdi
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x140159cc0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, qword [rsp + 0xb8]
mov r15d, r9d
movzx r14d, r8b
mov ebp, edx
mov rbx, rcx
cmp dword [rdi], 0
je 0x1400dbf1e
mov eax, 0xffffffff
jmp 0x1400dbfa0
mov qword [rsp + 0x58], rsi
movzx esi, byte [rsp + 0xb0]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x110]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
jne 0x1400dbf4e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
mov byte [rsp + 0x28], sil
lea rdx, [rsp + 0x30]
movzx r9d, r14b
mov dword [rsp + 0x20], r15d
mov r8d, ebp
mov rcx, rbx
call fcn.1400dbe40
mov rcx, qword [rbx + 0x110]
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
test eax, eax
jne 0x1400dbf99
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
je 0x1400dbf30
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
mov eax, 0xffffffff
jmp 0x1400dbf9b
xor eax, eax
mov rsi, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14011ae70
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rbp
pop rbx
ret

Function at 0x1400dc2e0
Capabilities:
Manipulate console buffer

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140159cc0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
mov ecx, dword [rcx + 0x58]
btr ecx, 0xc
mov eax, ecx
sub dword [rbx + 0x7c], 1
mov dword [rbx + 0x58], ecx
jne 0x1400dc328
test cl, 1
jne 0x1400dc328
test cl, 4
je 0x1400dc328
and eax, 0xfffffffb
mov dword [rbx + 0x58], eax
test al, 8
je 0x1400dc328
mov rax, qword [rbx + 8]
dec dword [rax + 8]
mov eax, dword [rbx + 0x58]
bt eax, 0x10
jae 0x1400dc39d
bt eax, 0x19
jae 0x1400dc384
mov rcx, qword [rbx + 0x110]
lea r9, [rsp + 0x20]
xor eax, eax
lea rdx, [rsp + 0x28]
mov dword [rsp + 0x38], eax
xorps xmm0, xmm0
mov eax, select
movups xmmword [rsp + 0x28], xmm0
mov word [rsp + 0x28], ax
lea r8d, [rax - 0xf]
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
test eax, eax
jne 0x1400dc39d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14011ae70
add rsp, 0x50
pop rbx
ret
bt eax, 0x15
jb 0x1400dc39d
mov rcx, rbx
call fcn.1400db420
test eax, eax
jne 0x1400dc39f
or dword [rbx + 0x58], 0x200000
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14011ae70
add rsp, 0x50
pop rbx
ret
Function at 0x1400dc3c0
Capabilities:
Manipulate console buffer

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x140159cc0]
xor rax, rsp
mov qword [rsp + 0x50], rax
movzx ebp, word [reloc.WS2_32.dll_getsockopt]
xor r14d, r14d
mov rsi, rdx
mov rdi, rcx
mov dword [rsp + 0x30], r14d
cmp dword [rdx], r14d
jne 0x1400dc412
mov rcx, qword [rcx + 0x110]
movzx edx, bp
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
test eax, eax
jne 0x1400dc41c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov eax, 0xffffffff
jmp 0x1400dc4ce
mov rcx, qword [rdi + 0x110]
mov qword [rsp + 0x90], rbx
mov ebx, dword [rsp + 0x30]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
test eax, eax
je 0x1400dc4b9
nop
mov rcx, qword [rdi + 0x110]
lea rdx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x1400dc4b9
movsx eax, word [rsp + 0x38]
mov edx, 0x20
movsx r8d, word [rsp + 0x3a]
mov r9d, ebx
mov rcx, qword [rdi + 0x110]
imul r8d, eax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
test eax, eax
je 0x1400dc4ae
mov r8d, dword [rsp + 0x34]
lea rax, [rsp + 0x34]
mov rcx, qword [rdi + 0x110]
mov r9d, ebx
movzx edx, bp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
test eax, eax
jne 0x1400dc4ec
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
je 0x1400dc440
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14011ae70
mov rbp, qword [rsp + 0x98]
add rsp, 0x60
pop r14
pop rdi
pop rsi
ret
lea rcx, [rsp + 0x38]
mov dword [0x140159af8], r14d
call fcn.1400dcbc0
mov rcx, qword [rdi + 0x110]
lea rdx, [0x140161040]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
test eax, eax
je 0x1400dc4b9
xor eax, eax
jmp 0x1400dc4c6
Function at 0x1400e02a0
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r14, rdx
mov rdi, rcx
mov eax, dword [rcx + 0x150]
mov dword [rsp + 0x90], eax
mov eax, dword [rdx]
and al, 3
cmp al, 1
jne 0x1400e0302
mov dword [rcx + 0x14c], 0x3ec
mov ecx, 0x3ec
call fcn.1400ee860
movsxd rdx, eax
mov qword [rdi + 0x88], rdx
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
cmp byte [rdx + 4], 0
je 0x1400e0336
mov dword [rcx + 0x14c], 1
mov ecx, 1
call fcn.1400ee860
movsxd rcx, eax
mov qword [rdi + 0x88], rcx
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov rcx, qword [rcx + 0x180]
cmp rcx, 0xffffffffffffffff
jne 0x1400e0347
mov rcx, qword [rdx + 0x18]
mov r12, qword [rdx + 0x10]
xor r13d, r13d
cmp rcx, r12
jge 0x1400e04e5
mov r8d, r13d
mov eax, dword [rdi + 0x170]
test eax, eax
je 0x1400e037f
mov rdx, qword [rdi + 0x178]
mov r9d, eax
nop
mov eax, dword [rdx]
add r8, rax
lea rdx, [rdx + 0x10]
sub r9, 1
jne 0x1400e0370
sub r12, rcx
cmp r8, r12
cmovl r12, r8
test r12, r12
je 0x1400e04e5
lea rbx, [r12 + rcx]
mov r8d, dword [0x140161078]
mov rax, rcx
cqo
idiv r8
mov rax, rdx
mov qword [rsp + 0x38], rdx
sub rcx, rdx
add rax, r12
mov r8, rcx
shr r8, 0x20
mov qword [rsp + 0x20], rax
mov r9d, ecx
mov edx, 4
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdx, rax
mov qword [rsp + 0x98], rax
test rax, rax
jne 0x1400e040e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi + 0x14c], eax
mov ecx, eax
call fcn.1400ee860
movsxd rcx, eax
mov qword [rdi + 0x88], rcx
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov rsi, r13
mov r15d, r13d
cmp r15d, dword [rdi + 0x170]
jae 0x1400e049b
cmp rsi, r12
jae 0x1400e049b
mov ecx, r15d
shl rcx, 4
add rcx, qword [rdi + 0x178]
mov r14d, dword [rcx]
mov rax, r12
sub rax, rsi
cmp r14, rax
cmovae r14, rax
mov dword [rsp + 0x30], r13d
add rdx, rsi
add rdx, qword [rsp + 0x38]
mov r8, r14
mov rcx, qword [rcx + 8]
call sub.VCRUNTIME140.dll_memcpy
nop
add rsi, r14
inc r15d
mov rdx, qword [rsp + 0x98]
jmp 0x1400e0414
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test eax, eax
je 0x1400e03e1
cmp qword [rdi + 0x180], 0xffffffffffffffff
jne 0x1400e04ce
mov rdx, qword [rsp + 0x88]
mov qword [rdx + 0x18], rbx
mov ecx, dword [rsp + 0x90]
call fcn.1400e2280
mov qword [rdi + 0x88], r12
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov qword [rdi + 0x88], r13
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400e25a0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x48]
lea rcx, [0x140161050]
mov dword [0x140161078], eax
call fcn.1400e2ff0
test eax, eax
jne 0x1400e25fd
lea rax, [0x1403e9088]
mov edx, 0x100
lea rcx, [0x140161080]
xor r8d, r8d
nop
mov qword [rax], rcx
add rcx, 0x2880
mov qword [rax - 8], r8
lea rax, [rax + 0x10]
sub rdx, 1
jne 0x1400e25e0
add rsp, 0x58
ret
lea rdx, str.uv_mutex_init
mov ecx, eax
call fcn.1400ee7b0
int3
Function at 0x1400e2f90
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
xor ecx, ecx
mov edx, 0xfffff027
cmp eax, 0xffffffff
mov dword [rbx], eax
cmove ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret

Function at 0x1400e2fc0
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1400e2fd5
add rsp, 0x28
ret
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
int3

Function at 0x1400e3100
Capabilities:
Create thread
Get system information on windows
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x60
test byte [rdx], 1
mov rbp, r9
mov r14, r8
mov rsi, rcx
je 0x1400e3160
mov rbx, qword [rdx + 8]
test rbx, rbx
je 0x1400e3162
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [rsp + 0x34]
dec rbx
add rbx, rax
dec rax
not rax
and rbx, rax
mov eax, ebx
cmp rax, rbx
je 0x1400e3162
mov eax, 0xfffff019
jmp 0x1400e31f4
xor ebx, ebx
mov ecx, 0x18
call fcn.1400d9bc0
mov rdi, rax
test rax, rax
jne 0x1400e317b
mov eax, 0xfffff027
jmp 0x1400e31f4
mov qword [rsp + 0x28], 0
lea r8, [0x1400e2ed0]
mov r9, rdi
mov dword [rsp + 0x20], 4
mov edx, ebx
mov qword [rax], r14
xor ecx, ecx
mov qword [rax + 8], rbp
call sub.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex
test rax, rax
jne 0x1400e31e2
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov rcx, rdi
mov ebx, dword [rax]
call fcn.1400d9a00
test ebx, ebx
je 0x1400e31f2
cmp ebx, 0xb
je 0x1400e31db
cmp ebx, 0xd
je 0x1400e31d4
cmp ebx, 0x16
je 0x1400e3156
mov eax, 0xfffff01a
jmp 0x1400e31f4
mov eax, 0xfffff004
jmp 0x1400e31f4
mov eax, 0xfffff008
jmp 0x1400e31f4
mov qword [rsi], rax
mov rcx, rax
mov qword [rdi + 0x10], rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret