joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400112d0
Capabilities:
Hide graphical window

Disassembly:
jmp 0x140011820
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x230
lea rbp, [rsp + 0x60]
lea rdi, [rsp + 0x60]
mov ecx, 0x44
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x258]
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x1c8], rax
lea rcx, [0x14002309f]
call fcn.1400113a7
lea rax, [rbp + 8]
lea rcx, str.HelloWin
mov rdi, rax
mov rsi, rcx
mov ecx, 0x12
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0xb0]
mov rdi, rax
xor eax, eax
mov ecx, 0x48
rep stosb byte [rdi], al
mov dword [rbp + 0xb0], 3
lea rax, [0x1400111f9]
mov qword [rbp + 0xb8], rax
mov dword [rbp + 0xc0], 0
mov dword [rbp + 0xc4], 0
mov rax, qword [rbp + 0x1f0]
mov qword [rbp + 0xc8], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadIconW]
mov qword [rbp + 0xd0], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [rbp + 0xd8], rax
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetStockObject]
mov qword [rbp + 0xe0], rax
mov qword [rbp + 0xe8], 0
lea rax, [rbp + 8]
mov qword [rbp + 0xf0], rax
lea rcx, [rbp + 0xb0]
call qword [sym.imp.USER32.dll_RegisterClassW]
movzx eax, ax
test eax, eax
jne 0x14001195f
mov r9d, 0x10
lea r8, [rbp + 8]
lea rdx, str.This_program_requires_Windows_NT_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x140011a0c
mov qword [rsp + 0x58], 0
mov rax, qword [rbp + 0x1f0]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0x80000000
mov dword [rsp + 0x30], 0x80000000
mov dword [rsp + 0x28], 0x80000000
mov dword [rsp + 0x20], 0x80000000
mov r9d, 0xcf0000
lea r8, str.The_Hello_Program
lea rdx, [rbp + 8]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov qword [rbp + 0x38], rax
mov edx, dword [rbp + 0x208]
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.USER32.dll_UpdateWindow]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x58]
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x140011a09
lea rcx, [rbp + 0x58]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x58]
call qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x1400119dd
mov eax, dword [rbp + 0x68]
mov rdi, rax
lea rcx, [rbp - 0x60]
lea rdx, [0x14001ac90]
call fcn.140011334
mov rax, rdi
mov rcx, qword [rbp + 0x1c8]
xor rcx, rbp
call fcn.1400111c7
lea rsp, [rbp + 0x1d0]
pop rdi
pop rsi
pop rbp
ret
Function at 0x14013ef18
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x14020b260
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x1404a90e7]
call fcn.140148ed7
mov rax, qword [rbp + 0x100]
cmp dword [rax], 0x270
jne 0x14020b29c
mov rcx, qword [rbp + 0x100]
call fcn.14013f4fe
jmp 0x14020b2b7
mov rax, qword [rbp + 0x100]
cmp dword [rax], 0x4e0
jb 0x14020b2b7
mov rcx, qword [rbp + 0x100]
call fcn.140142dfc
mov rax, qword [rbp + 0x100]
mov eax, dword [rax]
mov rcx, qword [rbp + 0x100]
mov eax, dword [rcx + rax*4 + 4]
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x100]
mov eax, dword [rax]
inc eax
mov rcx, qword [rbp + 0x100]
mov dword [rcx], eax
mov eax, dword [rbp + 4]
shr eax, 0xb
mov rcx, qword [rbp + 0x100]
and eax, dword [rcx + 0x1384]
mov ecx, dword [rbp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shl eax, 7
and eax, 0x9d2c5680
mov ecx, dword [rbp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shl eax, 0xf
and eax, 0xefc60000
mov ecx, dword [rbp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 0x12
mov ecx, dword [rbp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x14013f706
Capabilities:
Print debug messages

Disassembly:
jmp 0x140211e10
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
push rdi
mov eax, 0x16d8
call fcn.14013f189
sub rsp, rax
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x42e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x16f8]
mov rax, qword [0x1404746f8]
xor rax, rbp
mov qword [rbp + 0x16a0], rax
lea rcx, [0x1404a9401]
call fcn.140148ed7
lea rax, [rbp + 0x10]
mov qword [rbp + 0x1028], rax
lea rax, [rbp + 0x16d8]
mov qword [rbp + 0x1048], rax
mov r9, qword [rbp + 0x1048]
mov r8, qword [rbp + 0x16d0]
mov edx, 0xffd
mov rcx, qword [rbp + 0x1028]
call fcn.14013ea31
mov dword [rbp + 0x1064], eax
mov qword [rbp + 0x1048], 0
cmp dword [rbp + 0x1064], 0
jge 0x140211ecd
mov qword [rbp + 0x1698], 0xffd
jmp 0x140211edb
movsxd rax, dword [rbp + 0x1064]
mov qword [rbp + 0x1698], rax
mov rax, qword [rbp + 0x1698]
mov rcx, qword [rbp + 0x1028]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x1028], rax
lea rax, [rbp + 0x10]
cmp qword [rbp + 0x1028], rax
jbe 0x140211f3f
mov eax, 1
imul rax, rax, 0xffffffffffffffff
mov rcx, qword [rbp + 0x1028]
movsx eax, byte [rcx + rax]
mov ecx, eax
call fcn.1401417bd
test eax, eax
je 0x140211f3f
mov rax, qword [rbp + 0x1028]
dec rax
mov qword [rbp + 0x1028], rax
mov rax, qword [rbp + 0x1028]
mov byte [rax], 0
jmp 0x140211ef6
mov rax, qword [rbp + 0x1028]
mov byte [rax], reloc.WS2_32.dll_listen
mov rax, qword [rbp + 0x1028]
inc rax
mov qword [rbp + 0x1028], rax
mov rax, qword [rbp + 0x1028]
mov byte [rax], 0xa
mov rax, qword [rbp + 0x1028]
inc rax
mov qword [rbp + 0x1028], rax
mov rax, qword [rbp + 0x1028]
mov byte [rax], 0
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rbp - 0x20]
lea rdx, reloc.WS2_32.dll_bind
call fcn.140146cb8
mov rcx, qword [rbp + 0x16a0]
xor rcx, rbp
call fcn.140142c7b
lea rsp, [rbp + 0x16b8]
pop rdi
pop rbp
ret
Function at 0x14014255a
Capabilities:
Encode data using xor

Disassembly:
jmp 0x14033e090
mov rax, rcx
neg rcx
test rax, 7
je 0x14033e0ad
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x14033e108
test al, 7
jne 0x14033e0a0
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x14033e0c1
mov rdx, qword [rax - 8]
test dl, dl
je 0x14033e132
test dh, dh
je 0x14033e12c
shr rdx, 0x10
test dl, dl
je 0x14033e126
test dh, dh
je 0x14033e120
shr rdx, 0x10
test dl, dl
je 0x14033e11a
test dh, dh
je 0x14033e114
shr edx, 0x10
test dl, dl
je 0x14033e10e
test dh, dh
jne 0x14033e0c1
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret

Function at 0x140142609
Capabilities:
Query environment variable

Disassembly:
jmp 0x1403a5000
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.1403a4b80
lea rcx, [rsp + 0x20]
call fcn.1403a4bd0
movzx eax, al
test eax, eax
jne 0x1403a5045
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x20]
call fcn.1403a4bb0
mov rax, qword [rsp + 0x40]
jmp 0x1403a513f
lea rcx, [rsp + 0x20]
call fcn.1403a4cd0
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.1403a4c70
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r9d, 0x40
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, rax
call fcn.140142ece
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.140141709
lea rcx, [rsp + 0x28]
call fcn.140143a04
movzx eax, al
test eax, eax
jne 0x1403a50df
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x28]
call fcn.1401467a9
lea rcx, [rsp + 0x20]
call fcn.1403a4bb0
mov rax, qword [rsp + 0x50]
jmp 0x1403a513f
lea rcx, [rsp + 0x20]
call fcn.1403a4cd0
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call fcn.140148c75
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r8, rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.140142d02
lea rcx, [rsp + 0x28]
call fcn.14014a2e1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x28]
call fcn.1401467a9
lea rcx, [rsp + 0x20]
call fcn.1403a4bb0
mov rax, qword [rsp + 0x68]
add rsp, 0x78
ret
Function at 0x140142d11
Capabilities:
Parse credit card information

Disassembly:
jmp 0x1401b8f50
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rcx, qword [rsp + 0x40]
call fcn.140145d7c
movzx eax, al
cmp eax, 0x3c
je 0x1401b8fd0
mov rcx, qword [rsp + 0x40]
call fcn.140145d7c
movzx eax, al
cmp eax, 0x3d
je 0x1401b8fd0
mov rcx, qword [rsp + 0x40]
call fcn.140145d7c
movzx eax, al
cmp eax, 0x41
je 0x1401b8fd0
mov rcx, qword [rsp + 0x40]
call fcn.140145d7c
movzx eax, al
cmp eax, 0x42
je 0x1401b8fd0
mov rcx, qword [rsp + 0x40]
call fcn.140145d7c
movzx eax, al
cmp eax, 0x43
je 0x1401b8fd0
mov rcx, qword [rsp + 0x40]
call fcn.140145d7c
movzx eax, al
cmp eax, 0x44
je 0x1401b8fd0
mov dword [rsp + 0x20], 0
jmp 0x1401b8fd8
mov dword [rsp + 0x20], 1
movzx eax, byte [rsp + 0x20]
add rsp, 0x30
pop rdi
ret
Function at 0x140142dfc
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x14020bc60
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x20]
lea rcx, [0x1404a90e7]
call fcn.140148ed7
mov qword [rbp + 8], 0x26f
mov qword [rbp + 0x28], 0xe3
mov qword [rbp + 0x48], 0
jmp 0x14020bca4
mov rax, qword [rbp + 0x48]
inc rax
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0xe3
jae 0x14020bd35
mov rax, qword [rbp + 0x1e0]
mov rcx, qword [rbp + 0x48]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x48]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rbp + 0x64], eax
mov eax, dword [rbp + 0x64]
and eax, 1
test eax, eax
je 0x14020bcfa
mov dword [rbp + 0x1b4], 0x9908b0df
jmp 0x14020bd04
mov dword [rbp + 0x1b4], 0
mov eax, dword [rbp + 0x64]
shr eax, 1
xor eax, dword [rbp + 0x1b4]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x48]
xor eax, dword [rcx + rdx*4 + 0xff8]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x48]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x14020bc99
mov qword [rbp + 0x88], 0xe3
jmp 0x14020bd53
mov rax, qword [rbp + 0x88]
inc rax
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0x26f
jae 0x14020bdfc
mov rax, qword [rbp + 0x1e0]
mov rcx, qword [rbp + 0x88]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x88]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rbp + 0xa4], eax
mov eax, dword [rbp + 0xa4]
and eax, 1
test eax, eax
je 0x14020bdb8
mov dword [rbp + 0x1b4], 0x9908b0df
jmp 0x14020bdc2
mov dword [rbp + 0x1b4], 0
mov eax, dword [rbp + 0xa4]
shr eax, 1
xor eax, dword [rbp + 0x1b4]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x88]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x88]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x14020bd42
mov qword [rbp + 0xc8], 0x26f
mov eax, 4
imul rax, rax, 0x4df
mov rcx, qword [rbp + 0x1e0]
mov eax, dword [rcx + rax + 4]
and eax, 0x80000000
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rbp + 0x1e0]
mov ecx, dword [rdx + rcx + 4]
btr ecx, 0x1f
or eax, ecx
mov dword [rbp + 0xe4], eax
mov eax, dword [rbp + 0xe4]
and eax, 1
test eax, eax
je 0x14020be5c
mov dword [rbp + 0x1b4], 0x9908b0df
jmp 0x14020be66
mov dword [rbp + 0x1b4], 0
mov eax, dword [rbp + 0xe4]
shr eax, 1
xor eax, dword [rbp + 0x1b4]
mov ecx, 4
imul rcx, rcx, 0x18c
mov rdx, qword [rbp + 0x1e0]
xor eax, dword [rdx + rcx + 4]
mov ecx, 4
imul rcx, rcx, 0x26f
mov rdx, qword [rbp + 0x1e0]
mov dword [rdx + rcx + 4], eax
mov rax, qword [rbp + 0x1e0]
mov dword [rax], 0
lea rsp, [rbp + 0x1c8]
pop rdi
pop rbp
ret
Function at 0x140143252
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x1402d7a40
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.1402d73c0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1402d7a7f
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1404ac020]
jmp 0x1402d7a89
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret

Function at 0x140143851
Capabilities:
Query environment variable

Disassembly:
jmp 0x1403a4d50
sub rsp, 0xb8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1403a4b80
lea rcx, [rsp + 0x40]
call fcn.1403a4d00
movzx eax, al
test eax, eax
jne 0x1403a4d98
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call fcn.1403a4bb0
mov rax, qword [rsp + 0x70]
jmp 0x1403a4f69
lea rcx, [rsp + 0x40]
call fcn.1403a4cd0
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.1403a4c70
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x40]
call fcn.1403a4cd0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.140145f2f
cdqe
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x1403a4e3e
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x40]
call fcn.1403a4bb0
mov rax, qword [rsp + 0x80]
jmp 0x1403a4f69
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, qword [rsp + 0x58]
call fcn.140142ece
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.14014295b
lea rcx, [rsp + 0x48]
call fcn.140141bd2
movzx eax, al
test eax, eax
jne 0x1403a4ea5
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x48]
call fcn.14013ecfc
lea rcx, [rsp + 0x40]
call fcn.1403a4bb0
mov rax, qword [rsp + 0x88]
jmp 0x1403a4f69
lea rcx, [rsp + 0x48]
call fcn.140144314
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x40]
call fcn.1403a4cd0
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call fcn.140145f2f
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x1403a4f3b
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x48]
call fcn.14013ecfc
lea rcx, [rsp + 0x40]
call fcn.1403a4bb0
mov rax, qword [rsp + 0xa0]
jmp 0x1403a4f69
lea rcx, [rsp + 0x48]
call fcn.1401428a7
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x48]
call fcn.14013ecfc
lea rcx, [rsp + 0x40]
call fcn.1403a4bb0
mov rax, qword [rsp + 0xa8]
add rsp, 0xb8
ret
Function at 0x140143874
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x1402d7970
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.1402d7340
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1402d79b1
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1404ac020]
jmp 0x1402d79b7
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x48
ret

Function at 0x140143a13
Capabilities:
Get geographical location

Disassembly:
jmp 0x14037d8f0
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
call fcn.14037c860
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x14037d957
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
movabs r10, 0xe375262d7cd44270
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
call qword [0x1404ac030]
jmp 0x14037d979
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.140141a83
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x58
ret

Function at 0x140143a54
Capabilities:
Terminate process

Disassembly:
jmp 0x1402b4200
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140143e5a
Capabilities:
Initialize winsock library

Disassembly:
jmp 0x14020fb60
push rbp
push rdi
sub rsp, 0x2a8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, WSACleanup
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1404746f8]
xor rax, rbp
mov qword [rbp + 0x278], rax
lea rcx, [0x1404a93c5]
call fcn.140148ed7
lea rdx, [rbp + 0x10]
mov cx, 2
call qword [sym.imp.WS2_32.dll_WSAStartup]
lea rcx, [rbp - 0x20]
lea rdx, [0x1403ff840]
call fcn.140146cb8
mov rcx, qword [rbp + 0x278]
xor rcx, rbp
call fcn.140142c7b
lea rsp, [rbp + 0x288]
pop rdi
pop rbp
ret
Function at 0x140144210
Capabilities:
Print debug messages

Disassembly:
jmp 0x1403af700
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x30]
mov rax, qword [0x1404746f8]
xor rax, rbp
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x30], 0
jne 0x1403af726
jmp 0x1403af7a3
mov rcx, qword [rbp + 0x30]
call fcn.14014255a
inc rax
mov qword [rbp], rax
cmp qword [rbp], 0
jne 0x1403af73f
jmp 0x1403af7a3
mov rax, qword [rbp]
shl rax, 1
mov rcx, rax
add rcx, 0xf
cmp rcx, rax
ja 0x1403af75c
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.14013f189
sub rsp, rax
lea rax, [rsp + 0x30]
mov qword [rbp + 8], rax
mov rax, qword [rbp]
dec rax
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x30]
mov r8, qword [rbp]
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x10]
call fcn.140140070
test eax, eax
jne 0x1403af7a3
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
call fcn.140142c7b
lea rsp, [rbp + 0x20]
pop rbp
ret
Function at 0x140144986
Capabilities:
Create process on windows

Disassembly:
jmp 0x1403b7430
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x128
lea rcx, [rsp + 0xe8]
call fcn.140141669
lea rcx, [rsp + 0xb8]
call fcn.140141669
lea rcx, [rsp + 0x88]
call fcn.140141669
call fcn.14014369e
mov r8d, eax
lea rdx, [rsp + 0xe8]
mov rcx, qword [rsp + 0x130]
call fcn.140140f0c
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
je 0x1403b74d2
mov dword [rsp + 0x54], 0
lea rcx, [rsp + 0x88]
call fcn.1401422c6
lea rcx, [rsp + 0xb8]
call fcn.1401422c6
lea rcx, [rsp + 0xe8]
call fcn.1401422c6
mov eax, dword [rsp + 0x54]
jmp 0x1403b7678
call fcn.14014369e
mov r8d, eax
lea rdx, [rsp + 0xb8]
mov rcx, qword [rsp + 0x138]
call fcn.140140f0c
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0
je 0x1403b7532
mov dword [rsp + 0x5c], 0
lea rcx, [rsp + 0x88]
call fcn.1401422c6
lea rcx, [rsp + 0xb8]
call fcn.1401422c6
lea rcx, [rsp + 0xe8]
call fcn.1401422c6
mov eax, dword [rsp + 0x5c]
jmp 0x1403b7678
mov qword [rsp + 0x70], 0
cmp qword [rsp + 0x168], 0
je 0x1403b75b8
call fcn.14014369e
mov r8d, eax
lea rdx, [rsp + 0x88]
mov rcx, qword [rsp + 0x168]
call fcn.140140f0c
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
je 0x1403b75a6
mov dword [rsp + 0x64], 0
lea rcx, [rsp + 0x88]
call fcn.1401422c6
lea rcx, [rsp + 0xb8]
call fcn.1401422c6
lea rcx, [rsp + 0xe8]
call fcn.1401422c6
mov eax, dword [rsp + 0x64]
jmp 0x1403b7678
lea rcx, [rsp + 0x88]
call fcn.140141425
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0xb8]
call fcn.140141425
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0xe8]
call fcn.140141425
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x170]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x160]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x158]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x150]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x148]
mov r8, qword [rsp + 0x140]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [rsp + 0x68], eax
lea rcx, [rsp + 0x88]
call fcn.1401422c6
lea rcx, [rsp + 0xb8]
call fcn.1401422c6
lea rcx, [rsp + 0xe8]
call fcn.1401422c6
mov eax, dword [rsp + 0x68]
add rsp, 0x128
ret

Function at 0x140144b4d
Capabilities:
Set environment variable

Disassembly:
jmp 0x1403a6e70
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add rsp, 0x28
ret
Function at 0x140144f03
Capabilities:
Set console window title

Disassembly:
jmp 0x140181af0
push rdi
sub rsp, 0x50
lea rcx, str.AI_Server_v1534
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov edx, 1
lea rcx, [0x14014737f]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
lea rcx, [0x1404777c0]
call fcn.140146a6f
call fcn.14013e2d4
mov ecx, 0xb50
call fcn.14013d799
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x140181b4e
mov rcx, qword [rsp + 0x28]
call fcn.140147096
mov qword [rsp + 0x38], rax
jmp 0x140181b57
mov qword [rsp + 0x38], 0
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [0x1404777b0], rax
mov rcx, qword [0x1404777b0]
call fcn.14013d389
movzx eax, al
test eax, eax
je 0x140181b9a
lea rcx, str._nServer_started_up_successfully__n
call fcn.140142a96
lea rcx, [0x1404777c0]
call fcn.14013f945
jmp 0x140181ba6
lea rcx, str.pause
call fcn.140142906
lea rcx, str.Server_shutting_down__please_wait..._n
call fcn.140142a96
mov byte [section..data], 0
mov rax, qword [0x1404777b0]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x140181be3
mov edx, 1
mov rcx, qword [rsp + 0x30]
call fcn.140148f54
mov qword [rsp + 0x40], rax
jmp 0x140181bec
mov qword [rsp + 0x40], 0
call fcn.14013fbd9
call fcn.140142de8
xor eax, eax
add rsp, 0x50
pop rdi
ret
Function at 0x140145246
Capabilities:
Parse pe header

Disassembly:
jmp 0x1402b6a90
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1402b6ab0
xor al, al
jmp 0x1402b6b31
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1402b6ac3
xor al, al
jmp 0x1402b6b31
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1402b6aed
xor al, al
jmp 0x1402b6b31
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1402b6b01
xor al, al
jmp 0x1402b6b31
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1402b6b13
xor al, al
jmp 0x1402b6b31
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1402b6b2f
xor al, al
jmp 0x1402b6b31
mov al, 1
add rsp, 0x38
ret
Function at 0x14014652e
Capabilities:
Terminate process

Disassembly:
jmp 0x1402d8a50
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov ecx, SQLCloseCursor
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x1402d8a7e
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
mov ecx, 2
call fcn.140148059
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000417
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140148149
Capabilities:
Print debug messages

Disassembly:
jmp 0x140373780
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret