joyce8/EMBER2024-capa huggingface dataset:
Function at 0x27118
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
sub rsp, 0x20
mov rbx, rdx
mov rdx, qword [rdx + 0xb8]
cmp rcx, qword [0x00065eb0]
jne 0x271a8
cmp byte [rdx], 0
je 0x27181
cmp byte [rdx], 2
je 0x27181
cmp byte [rdx], 0xe
je 0x2719c
cmp byte [rdx], 0x10
je 0x2715d
and qword [rbx + 0x38], 0
mov esi, 0xc0000010
mov dword [rbx + 0x30], esi
jmp 0x2718a
mov rcx, qword [0x00065e88]
or dword [0x00065e70], 0x10
call fcn.0001ee00
mov rcx, qword [0x00065e80]
mov edx, 3
call fcn.0001c6ec
xor esi, esi
and dword [rbx + 0x30], esi
and qword [rbx + 0x38], rsi
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, esi
jmp 0x27256
mov rdx, rbx
call fcn.00023868
mov esi, eax
jmp 0x2718a
cmp rcx, qword [0x00065eb8]
jne 0x271ba
mov rsi, qword [0x00065ed0]
jmp 0x271dc
cmp rcx, qword [0x00065ec0]
jne 0x271cc
mov rsi, qword [0x00065ed8]
jmp 0x271dc
cmp rcx, qword [0x00065ec8]
jne 0x2723d
mov rsi, qword [0x00065ee0]
mov al, byte [rdx]
test al, al
jne 0x271ef
mov r8, rsi
mov rdx, rbx
call fcn.00024d88
jmp 0x27256
cmp al, 0x12
jne 0x27223
mov rbp, qword [0x00065e68]
mov rdx, qword [rdx + 0x30]
mov rcx, rbp
call fcn.00026aa8
test rax, rax
je 0x27216
mov rdx, rax
mov rcx, rbp
call fcn.000269e0
add qword [rbx + 0xb8], 0x48
mov rcx, rsi
jmp 0x2724a
cmp al, 0xe
je 0x27230
cmp al, 0xf
je 0x27230
mov rcx, rsi
jmp 0x2723f
mov r8, rsi
mov rdx, rbx
call fcn.000250b4
jmp 0x27256
xor ecx, ecx
lea rax, [rdx + 0x48]
mov qword [rbx + 0xb8], rax
inc byte [rbx + 0x43]
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_IofCallDriver]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret

Function at 0x2726c
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
and dword [rsp + 0x30], 0
cmp qword [0x00065ea0], 0
je 0x27295
cmp dword [0x00065e74], 0
je 0x27295
xor eax, eax
jmp 0x27336
xor edx, edx
lea r9, [rsp + 0x30]
xor r8d, r8d
lea edi, [rdx + 0xb]
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov r11d, dword [rsp + 0x30]
test r11d, r11d
jne 0x272bb
mov eax, 0xc000009a
jmp 0x27336
mov rdx, r11
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rbx, rax
test rax, rax
je 0x272b4
mov r8d, dword [rsp + 0x30]
xor edx, edx
mov rcx, rax
call fcn.00028240
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov edi, eax
test eax, eax
js 0x27329
xor edx, edx
lea rcx, [rbx + 8]
cmp dword [rbx], edx
jbe 0x27329
test edx, edx
je 0x27315
inc edx
add rcx, 0x128
cmp edx, dword [rbx]
jb 0x27302
jmp 0x27329
mov rax, qword [rcx + 0x10]
mov qword [0x00065ea0], rax
mov eax, dword [rcx + 0x18]
mov dword [0x00065e74], eax
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, edi
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x392068
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
movzx r11d, bp
bt r10w, 0x56
mov qword [rsp + 0x10], rdi
bt r9w, 0xfd
xor edi, edi
movsx r9d, ax
xchg r9, r9
movsx r9, r10w
movzx ebx, r8b
movzx r8d, r15w
jmp 0x39209c
mov r11, rcx
movsx r9, r11w
movsx r10w, dil
mov r8, rdi
movsx r10d, bx
movzx r10w, r8b
mov r10b, al
nop
movsxd r10, r12d
movsx r10, r15w
movsx r9d, bp
movzx r9d, byte [r11]
movsx r10d, dx
movzx r10w, r8b
movzx r10d, byte [rdx]
jmp 0x3920d9
inc r11
inc rdx
test spl, 0xd9
jmp 0x3920e9
test bl, bl
jmp 0x3920f0
je 0x392121
mov ecx, r8d
ror ax, cl
movsx eax, sp
mov eax, 0x4b344ecb
stc
rol eax, cl
cmp r10b, 0x32
add al, r8b
cmp ax, 0x3481
test rsp, r11
xor r9b, al
jmp 0x39211d
inc r8
clc
test r9b, r9b
jmp 0x392129
je 0x39213d
cmp r9b, r10b
jmp 0x392137
je 0x3920c3
cmp r9b, r10b
jmp 0x392145
jae 0x39215d
or eax, 0xffffffff
mov rbx, qword [rsp + 8]
movzx rdi, di
mov rdi, qword [rsp + 0x10]
ret
mov rbx, qword [rsp + 8]
mov rax, rsp
seta dil
sete al
cmovl rax, rbp
mov eax, edi
movsx rdi, r10w
movzx rdi, cx
movsx edi, r11w
mov rdi, qword [rsp + 0x10]
jmp 0x392188
ret
Function at 0x180002f20
Capabilities:
Terminate process

Disassembly:
push rdi
sub rsp, 0x90
lea rdi, [rsp + 0x20]
mov ecx, 0x1c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x18045c280]
xor rax, rsp
mov qword [rsp + 0x80], rax
lea rcx, [0x1804b6033]
call fcn.1801a9330
mov eax, 0x6110
mov eax, eax
mov ecx, dword [0x18047a040]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
movzx eax, byte [rcx + rax]
test eax, eax
jne 0x180002f7f
call fcn.1801a8cc0
mov eax, reloc.WS2_32.dll_recv
mov eax, eax
mov ecx, dword [0x18047a040]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov rcx, qword [rcx + rax + 8]
call fcn.1800da4a0
mov qword [rsp + 0x60], rax
mov eax, 0x6110
mov eax, eax
mov ecx, dword [0x18047a040]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
movzx eax, byte [rcx + rax]
test eax, eax
jne 0x180002fcf
call fcn.1801a8cc0
mov eax, reloc.WS2_32.dll_recv
mov eax, eax
mov ecx, dword [0x18047a040]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov rax, qword [rcx + rax + 8]
mov qword [rsp + 0x68], rax
mov eax, 0x6110
mov eax, eax
mov ecx, dword [0x18047a040]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
movzx eax, byte [rcx + rax]
test eax, eax
jne 0x18000301a
call fcn.1801a8cc0
mov eax, reloc.WS2_32.dll_recv
mov eax, eax
mov ecx, dword [0x18047a040]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
mov dword [rsp + 0x70], eax
mov r9, qword [rsp + 0x60]
mov r8, qword [rsp + 0x68]
mov edx, dword [rsp + 0x70]
lea rcx, str.Fatal_error__0x_08X__at_0x_p__0x_p_._nA_minidump_has_been_written._n
call fcn.1801132d0
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.180022780
nop
call fcn.180119220
call fcn.180002ef0
lea rcx, [rsp + 0x28]
call fcn.1800305f0
mov r9d, reloc.WS2_32.dll_recv
lea r8, str.Project_BO4_ERROR
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 0x6110
mov eax, eax
mov ecx, dword [0x18047a040]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
movzx eax, byte [rcx + rax]
test eax, eax
jne 0x1800030b6
call fcn.1801a8cc0
mov eax, reloc.WS2_32.dll_recv
mov eax, eax
mov ecx, dword [0x18047a040]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
mov dword [rsp + 0x74], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x78], rax
mov edx, dword [rsp + 0x74]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
lea rcx, [rsp + 0x28]
call fcn.180024210
mov rcx, rsp
lea rdx, [0x180337f70]
call fcn.1801a9100
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1801a9570
add rsp, 0x90
pop rdi
ret
Function at 0x18003c500
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x60
lea rdi, [rsp + 0x30]
mov ecx, recv
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x70]
lea rcx, [0x1804b6072]
call fcn.1801a9330
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0x38]
call fcn.180041370
nop
lea rax, [0x18003c310]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x70]
add rax, 8
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x38]
call fcn.180055980
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x48]
xor edx, edx
xor ecx, ecx
call fcn.1801d3040
mov rcx, qword [rsp + 0x70]
mov qword [rcx], rax
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
je 0x18003c5a7
lea rcx, [rsp + 0x38]
call fcn.180056f00
jmp 0x18003c5be
mov rax, qword [rsp + 0x70]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.180164700
nop
lea rcx, [rsp + 0x38]
call fcn.1800460f0
mov rcx, rsp
lea rdx, [0x180349bc0]
call fcn.1801a9100
add rsp, 0x60
pop rdi
ret

Function at 0x18004a880
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
lea rcx, [0x1804b60a4]
call fcn.1801a9330
mov qword [rsp + 0x20], 0
jmp 0x18004a8b8
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x20], rax
jae 0x18004a904
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x40]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
movabs rax, 0x100000001b3
mov rcx, qword [rsp + 0x40]
imul rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x18004a8ab
mov rax, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x18005c410
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x1c0
lea rdi, [rsp + 0x20]
mov ecx, 0x68
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x1d0]
lea rcx, [0x1804b610e]
call fcn.1801a9330
mov rcx, qword [rsp + 0x1d8]
call fcn.1800303e0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, 1
lea rcx, [rsp + 0x30]
call fcn.18005e700
nop
mov r9d, 0x40
mov r8d, 8
lea rdx, str.project_bo4.log
lea rcx, [rsp + 0x30]
call fcn.180062f10
xor ecx, ecx
call fcn.18005c3e0
mov qword [rsp + 0x158], rax
lea rcx, [rsp + 0x158]
call fcn.18005c3b0
mov qword [rsp + 0x168], rax
lea rdx, [0x18034b1c6]
lea rcx, [rsp + 0x30]
call fcn.18005cc30
mov qword [rsp + 0x188], rax
lea r8, str._Y__m__d__H:_M:_S
mov rdx, qword [rsp + 0x168]
lea rcx, [rsp + 0x170]
call fcn.18005e170
mov qword [rsp + 0x190], rax
mov rdx, qword [rsp + 0x190]
mov rcx, qword [rsp + 0x188]
call fcn.18005c8a0
lea rdx, [0x18034b1f0]
mov rcx, rax
call fcn.18005cc30
lea rdx, [0x18034b20c]
lea rcx, [rsp + 0x30]
call fcn.18005cc30
mov qword [rsp + 0x198], rax
movsxd rax, dword [rsp + 0x1d0]
lea rcx, str.DEBUG
mov rax, qword [rcx + rax*8]
mov qword [rsp + 0x1a0], rax
mov rdx, qword [rsp + 0x1a0]
mov rcx, qword [rsp + 0x198]
call fcn.18005cc30
lea rdx, [0x18034b1f4]
mov rcx, rax
call fcn.18005cc30
mov qword [rsp + 0x1a8], rax
mov rax, qword [rsp + 0x1d8]
mov qword [rsp + 0x1b0], rax
mov rdx, qword [rsp + 0x1b0]
mov rcx, qword [rsp + 0x1a8]
call fcn.18005cbd0
mov qword [rsp + 0x1b8], rax
lea rdx, [0x18005dfd0]
mov rcx, qword [rsp + 0x1b8]
call fcn.18005fa10
nop
lea rcx, [rsp + 0x30]
call fcn.18005fe70
nop
mov rcx, qword [rsp + 0x1d8]
call fcn.180024210
mov rcx, rsp
lea rdx, [0x18034b410]
call fcn.1801a9100
add rsp, 0x1c0
pop rdi
ret
Function at 0x180064cc0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x80
lea rdi, [rsp + 0x20]
mov ecx, 0x18
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x90]
lea rcx, [0x1804b60fe]
call fcn.1801a9330
cmp qword [rsp + 0xa0], 0
jg 0x180064d0e
xor eax, eax
jmp 0x180064f04
mov rax, qword [rsp + 0x90]
cmp qword [rax + 0x68], 0
je 0x180064d3f
mov r8, qword [rsp + 0xa0]
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x90]
call fcn.180064f30
jmp 0x180064f04
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x90]
call fcn.180060c30
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jbe 0x180064ded
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x28]
call fcn.18001f160
mov rax, qword [rax]
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x90]
call fcn.180062a40
mov r8, qword [rsp + 0x58]
mov rdx, rax
mov rcx, qword [rsp + 0x98]
call fcn.1800304c0
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x98]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x28]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov edx, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x90]
call fcn.1800628e0
mov rax, qword [rsp + 0x90]
cmp qword [rax + 0x80], 0
je 0x180064ef4
mov rcx, qword [rsp + 0x90]
call fcn.180061510
mov qword [rsp + 0x60], 0xfff
cmp qword [rsp + 0x28], 0xfff
jbe 0x180064ea2
mov rax, qword [rsp + 0x90]
mov r9, qword [rax + 0x80]
mov r8d, 0xfff
mov edx, 1
mov rcx, qword [rsp + 0x98]
call fcn.1801d62a0
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x98]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x28]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x68], 0xfff
je 0x180064e9d
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
jmp 0x180064f04
jmp 0x180064e19
cmp qword [rsp + 0x28], 0
jbe 0x180064ef4
mov rax, qword [rsp + 0x90]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x28]
mov edx, 1
mov rcx, qword [rsp + 0x98]
call fcn.1801d62a0
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov rdi, rax
mov rcx, rsp
lea rdx, [0x18034bc70]
call fcn.1801a9100
mov rax, rdi
add rsp, 0x80
pop rdi
ret
Function at 0x180065690
Capabilities:
Create process on windows
Terminate process

Disassembly:
push rdi
sub rsp, 0xa0
lea rdi, [rsp + 0x30]
mov ecx, 0x1c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x18045c280]
xor rax, rsp
mov qword [rsp + 0x98], rax
lea rcx, [0x1804b6153]
call fcn.1801a9330
lea rcx, [rsp + 0x38]
call fcn.180066710
nop
lea rdx, str.SOFTWAREBlizzard_EntertainmentBattle.net
lea rcx, [rsp + 0x68]
call fcn.180066630
mov dword [rsp + 0x20], 0x2011f
lea r9, [rsp + 0x68]
mov r8, 0xffffffff80000001
lea rdx, [rsp + 0x54]
lea rcx, [rsp + 0x38]
call fcn.180066c40
lea rcx, [rsp + 0x68]
call fcn.180066830
lea rcx, [rsp + 0x54]
call fcn.1800669b0
movzx eax, al
test eax, eax
jne 0x18006578e
mov r9d, gethostbyname
lea r8, [0x18034c90c]
lea rdx, str.You_need_to_have_BlackOps4_from_Battle.Net_to_use_this_product...
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.http:__battle.net_
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rdx, str.__PLATFORM__:_Couldnt_find_Battle.Net_Launcher__Shutting_down...
mov ecx, 1
call fcn.18005c5f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
lea rcx, [rsp + 0x38]
call fcn.180066940
mov rcx, rsp
lea rdx, [0x1803505f8]
call fcn.1801a9100
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1801a9570
add rsp, 0xa0
pop rdi
ret

Function at 0x18006c1a0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x60
lea rdi, [rsp + 0x30]
mov ecx, recv
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x70]
lea rcx, [0x1804b615a]
call fcn.1801a9330
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0x38]
call fcn.18006d0b0
nop
lea rax, [0x18006bf90]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x70]
add rax, 8
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x38]
call fcn.18006dd80
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x48]
xor edx, edx
xor ecx, ecx
call fcn.1801d3040
mov rcx, qword [rsp + 0x70]
mov qword [rcx], rax
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
je 0x18006c247
lea rcx, [rsp + 0x38]
call fcn.18006df10
jmp 0x18006c25e
mov rax, qword [rsp + 0x70]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.180164700
nop
lea rcx, [rsp + 0x38]
call fcn.18006d4f0
mov rcx, rsp
lea rdx, [0x1803515a0]
call fcn.1801a9100
add rsp, 0x60
pop rdi
ret
Function at 0x18006e2f0
Capabilities:
Hide graphical window

Disassembly:
push rdi
sub rsp, 0x20
lea rcx, [0x1804b6192]
call fcn.1801a9330
cmp qword [0x180476ef0], 0
je 0x18006e370
mov rcx, qword [0x180476ef0]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x18006e370
xor edx, edx
mov rcx, qword [0x180476ef0]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x180476ef0]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov qword [0x180476ef0], 0
lea rcx, [0x180476ed8]
call fcn.180055af0
movzx eax, al
test eax, eax
je 0x18006e363
lea rcx, [0x180476ed8]
call fcn.180055a40
mov qword [0x180476ef0], 0
jmp 0x18006e38f
lea rcx, [0x180476ed8]
call fcn.180055af0
movzx eax, al
test eax, eax
je 0x18006e38f
lea rcx, [0x180476ed8]
call fcn.18006f560
add rsp, 0x20
pop rdi
ret
Function at 0x18006ece0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x60
lea rdi, [rsp + 0x30]
mov ecx, recv
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x70]
lea rcx, [0x1804b618d]
call fcn.1801a9330
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0x38]
call fcn.18006ef20
nop
lea rax, [0x18006ec50]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x70]
add rax, 8
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x38]
call fcn.18006f5f0
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x48]
xor edx, edx
xor ecx, ecx
call fcn.1801d3040
mov rcx, qword [rsp + 0x70]
mov qword [rcx], rax
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
je 0x18006ed87
lea rcx, [rsp + 0x38]
call fcn.18006f6c0
jmp 0x18006ed9e
mov rax, qword [rsp + 0x70]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.180164700
nop
lea rcx, [rsp + 0x38]
call fcn.18006f180
mov rcx, rsp
lea rdx, [0x1803523a0]
call fcn.1801a9100
add rsp, 0x60
pop rdi
ret
Function at 0x180077e10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x70
lea rcx, [0x1804b61db]
call fcn.1801a9330
cmp dword [rsp + 0x88], 0
jne 0x180077e40
xor al, al
jmp 0x18007800f
mov rax, qword [rsp + 0x80]
mov eax, dword [rax + 0x28]
add eax, dword [rsp + 0x88]
mov eax, eax
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x80]
call fcn.180032060
shl rax, 3
mov rcx, qword [rsp + 0x48]
cmp rcx, rax
jbe 0x180077e7b
xor al, al
jmp 0x18007800f
mov rax, qword [rsp + 0x80]
mov eax, dword [rax + 0x28]
shr eax, 3
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x24], 0
mov rax, qword [rsp + 0x80]
mov rcx, rax
call fcn.1800305c0
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x30], rax
cmp dword [rsp + 0x88], 0
jbe 0x18007800d
cmp dword [rsp + 0x88], 8
jae 0x180077edc
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0x50], eax
jmp 0x180077ee4
mov dword [rsp + 0x50], 8
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x38], eax
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
movsx eax, byte [rcx + rax]
and eax, 0xff
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x3c], eax
mov rax, qword [rsp + 0x80]
mov eax, dword [rax + 0x28]
and eax, 7
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
mov ecx, dword [rsp + 0x38]
add ecx, eax
mov eax, ecx
cmp eax, 8
jg 0x180077f70
mov eax, 8
sub eax, dword [rsp + 0x38]
mov ecx, 0xff
mov dword [rsp + 0x58], ecx
movzx ecx, al
mov eax, dword [rsp + 0x58]
sar eax, cl
mov ecx, dword [rsp + 0x40]
mov edx, dword [rsp + 0x3c]
sar edx, cl
mov ecx, edx
and eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov rdx, qword [rsp + 0x30]
mov byte [rdx + rcx], al
jmp 0x180077fce
mov eax, 8
sub eax, dword [rsp + 0x38]
mov ecx, 0xff
mov dword [rsp + 0x5c], ecx
movzx ecx, al
mov eax, dword [rsp + 0x5c]
sar eax, cl
movsxd rcx, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
movsx ecx, byte [rdx + rcx]
mov dword [rsp + 0x60], ecx
mov edx, 8
sub edx, dword [rsp + 0x40]
movzx ecx, dl
mov edx, dword [rsp + 0x60]
shl edx, cl
mov ecx, edx
and eax, ecx
mov ecx, dword [rsp + 0x40]
mov edx, dword [rsp + 0x3c]
sar edx, cl
mov ecx, edx
or eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov rdx, qword [rsp + 0x30]
mov byte [rdx + rcx], al
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x80]
mov eax, dword [rax + 0x28]
add eax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x80]
mov dword [rcx + 0x28], eax
mov eax, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x88]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x88], eax
jmp 0x180077eb7
mov al, 1
add rsp, 0x70
pop rdi
ret
Function at 0x1800cc010
Capabilities:
Terminate process

Disassembly:
push rdi
sub rsp, 0x30
lea rcx, [0x1804b67e4]
call fcn.1801a9330
mov eax, 0x6114
mov eax, eax
mov ecx, dword [0x18047a040]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rax + rcx]
cmp dword [0x1804770ac], eax
jle 0x1800cc078
lea rcx, [0x1804770ac]
call fcn.1801a8ee0
cmp dword [0x1804770ac], 0xffffffff
jne 0x1800cc078
lea rcx, [rsp + 0x20]
call fcn.1800cc600
mov byte [0x1804770a8], al
lea rcx, [0x1804770ac]
call fcn.1801a8e80
movzx eax, byte [0x1804770a8]
test eax, eax
jne 0x1800cc097
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x30
pop rdi
ret

Function at 0x1800cc0b0
Capabilities:
Terminate process

Disassembly:
push rdi
sub rsp, 0x30
lea rcx, [0x1804b67e4]
call fcn.1801a9330
mov eax, 0x6114
mov eax, eax
mov ecx, dword [0x18047a040]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rax + rcx]
cmp dword [0x1804770b4], eax
jle 0x1800cc118
lea rcx, [0x1804770b4]
call fcn.1801a8ee0
cmp dword [0x1804770b4], 0xffffffff
jne 0x1800cc118
lea rcx, [rsp + 0x20]
call fcn.1800cc6e0
mov byte [0x1804770b0], al
lea rcx, [0x1804770b4]
call fcn.1801a8e80
movzx eax, byte [0x1804770b0]
test eax, eax
jne 0x1800cc137
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x30
pop rdi
ret

Function at 0x1800d3ec0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x220
lea rdi, [rsp + 0x20]
mov ecx, 0x80
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x230]
mov rax, qword [0x18045c280]
xor rax, rsp
mov qword [rsp + 0x210], rax
lea rcx, [0x1804b6807]
call fcn.1801a9330
lea rax, [rsp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
mov edx, 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov r8d, 0xa
lea rdx, str._d3d11.dll
lea rcx, [rsp + 0x168]
call fcn.1800288c0
mov qword [rsp + 0x1f0], rax
mov rax, qword [rsp + 0x1f0]
mov qword [rsp + 0x1f8], rax
mov r8, qword [rsp + 0x1f8]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x190]
call fcn.1800d4420
mov qword [rsp + 0x200], rax
mov rax, qword [rsp + 0x200]
mov qword [rsp + 0x208], rax
mov rdx, qword [rsp + 0x208]
lea rcx, [rsp + 0x158]
call fcn.180107db0
nop
lea rcx, [rsp + 0x190]
call fcn.180024210
nop
lea rcx, [rsp + 0x168]
call fcn.180024210
lea rdx, [0x180374560]
lea rcx, [rsp + 0x1b8]
call fcn.180022780
nop
lea rdx, [rsp + 0x1b8]
lea rcx, [rsp + 0x158]
call fcn.1800d7250
mov qword [rsp + 0x1e8], rax
lea rcx, [rsp + 0x1b8]
call fcn.180024210
mov rax, qword [rsp + 0x1e8]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x180373d28]
call fcn.1801a9100
mov rax, rdi
mov rcx, qword [rsp + 0x210]
xor rcx, rsp
call fcn.1801a9570
add rsp, 0x220
pop rdi
ret

Function at 0x1800defa0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
lea rcx, [0x1804b6b39]
call fcn.1801a9330
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add rsp, 0x20
pop rdi
ret