joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400783c0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1401f4040]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov ebx, edx
mov rdi, rcx
mov byte [rcx + 0x69], 1
mov ecx, 0x18
call fcn.14012adc0
mov dword [rax], ebx
mov qword [rax + 8], rdi
lea rcx, [0x140077f10]
mov qword [rax + 0x10], rcx
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140078490]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140078477
cmp dword [rsp + 0x38], 0
je 0x14007846b
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14007846b
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14012ada0
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x38], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x14007a070
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1401f4040]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, rcx
mov rbx, qword [rcx]
lea rcx, [rsp + 0x40]
call fcn.1400048a0
mov rdx, qword [rax]
mov qword [rdi + 0xa8], rdx
mov byte [rbx + 0xdc6], 1
mov byte [rdi + 0x98], 1
mov ecx, reloc.WS2_32.dll_recv
call fcn.14012adc0
mov qword [rax], rdi
lea rcx, [0x14007f590]
mov qword [rax + 8], rcx
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1400071e0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14007a16e
cmp dword [rdi + 0x90], 0
jne 0x14007a167
xorps xmm0, xmm0
movaps xmm1, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
movups xmmword [rdi + 0x88], xmm1
cmp dword [rdi + 0x90], 0
je 0x14007a15b
movaps xmmword [rsp + 0x30], xmm1
lea rcx, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14007a15b
xorps xmm0, xmm0
movups xmmword [rdi + 0x88], xmm0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14012ada0
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
nop
mov dword [rsp + 0x38], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x14007fe10
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x14007fe38
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14007fe5e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14007fe60
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14007feb9
test ecx, ecx
jle 0x14007fe99
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x14007feb9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14007feb9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
Function at 0x14007fee0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x14007ff02
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x14007ff18
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14007ff34
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14007ff36
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14007ff72
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14008000e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14007ffad
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14007ffee
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14008000e
cmp rbx, rax
ja 0x14007ffc0
test rbx, rbx
je 0x14008000e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x140080430
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1401f4040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14008045d
xor eax, eax
jmp 0x1400805c9
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140080497
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140080497
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x1400805c9
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1400805bc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400804da
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140080505
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400805c1
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140080574
sub eax, 1
je 0x140080574
cmp eax, 2
jne 0x1400805bc
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400805c1
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1400805a2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1400805bc
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x1400805c1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14012ada0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x1400807f0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1401f4040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400808c3
cmp byte [rcx + 0x71], 0
je 0x1400808c3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1400808bf
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140080884
sub eax, 1
je 0x140080888
cmp eax, 2
jne 0x1400808bf
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14012ada0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1400808b6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1400808bf
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14008086c
xor al, al
jmp 0x14008086c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14012ada0
add rsp, 0x60
pop rbx
ret
Function at 0x1400829b0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0xd0
mov rax, qword [0x1401f4040]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov r14, rcx
xor ebx, ebx
mov dword [rsp + 0x30], ebx
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1401fd12c], eax
jle 0x140082a58
lea rcx, [0x1401fd12c]
call fcn.14012b128
cmp dword [0x1401fd12c], 0xffffffff
jne 0x140082a58
xorps xmm0, xmm0
movups xmmword [0x1401fd0e8], xmm0
xorps xmm1, xmm1
movdqu xmmword [0x1401fd0f8], xmm1
mov r8d, 0x1a
lea rdx, str.Growtopiacacheitems.dat
lea rcx, [0x1401fd0e8]
call fcn.140013b60
lea rcx, [0x140137170]
call fcn.14012b024
nop
lea rcx, [0x1401fd12c]
call fcn.14012b0bc
lea rcx, str.LOCALAPPDATA
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x140082bcb
lea rcx, [rsp + 0xa0]
call fcn.140081db0
nop
lea rax, str.items.dat
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 9
call fcn.14012a5f8
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea r8, [rsp + 0x30]
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.140081490
nop
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x60]
call fcn.140081950
nop
mov rsi, rax
cmp qword [rax + 0x18], 7
jbe 0x140082ad8
mov rsi, qword [rax]
mov rdi, qword [rax + 0x10]
call fcn.14012a5f8
mov ebp, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x80], xmm0
movdqa xmm1, xmmword [0x1401d22b0]
movdqu xmmword [rsp + 0x90], xmm1
mov byte [rsp + 0x80], 0
mov dword [rsp + 0x30], 0x8c
test rdi, rdi
je 0x140082b8a
cmp rdi, 0x7fffffff
ja 0x140082bfd
mov dword [rsp + 0x20], ebx
xor r9d, r9d
mov r8d, edi
mov rdx, rsi
mov ecx, eax
call fcn.14012a668
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x140082c03
movsxd rdx, ebx
lea rcx, [rsp + 0x80]
call fcn.140016a20
lea r9, [rsp + 0x80]
cmp qword [rsp + 0x98], 0xf
cmova r9, qword [rsp + 0x80]
mov dword [rsp + 0x20], ebx
mov r8d, edi
mov rdx, rsi
mov ecx, ebp
call fcn.14012a668
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x140082bf3
lea rcx, [rsp + 0x60]
call fcn.140082eb0
nop
lea rcx, [rsp + 0x40]
call fcn.140082eb0
lea rdx, [rsp + 0x80]
mov rcx, r14
call fcn.140082700
nop
lea rcx, [rsp + 0x80]
call fcn.140006950
nop
lea rcx, [rsp + 0xa0]
call fcn.140082eb0
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14012ada0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
shr rcx, 0x20
call fcn.140081450
int3
call fcn.140081170
int3
shr rbx, 0x20
mov ecx, ebx
call fcn.140081450
int3
Function at 0x14008ea90
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x1401f4040]
xor rax, rsp
mov qword [rsp + 0x20], rax
movabs rax, 0x14057b7ef767814f
lea r8, [rsp + 0x10]
mov qword [rcx], rax
mov r9, rdx
mov r11, qword [rdx]
mov r10, rcx
movabs rbx, 0x5851f42d4c957f2d
nop word [rax + rax]
mov rdx, qword [r9 + 8]
mov rax, rdx
mov rcx, rdx
imul rax, rbx
shr rcx, 0x3b
add rax, r11
mov qword [r9 + 8], rax
mov rax, rdx
shr rax, 0x2d
shr rdx, 0x1b
xor eax, edx
ror eax, cl
mov dword [r8], eax
add r8, 4
lea rax, [rsp + 0x20]
cmp r8, rax
jne 0x14008ead0
lea r8, [rsp]
lea rax, [rsp + 0x10]
nop dword [rax]
nop word [rax + rax]
mov ecx, dword [rax + 4]
mov edx, dword [rax]
lea rax, [rax + 8]
shl rcx, 0x20
or rcx, rdx
mov qword [r8], rcx
add r8, 8
lea rcx, [rsp + 0x10]
cmp r8, rcx
jne 0x14008eb20
mov rcx, qword [rsp]
mov rax, r10
mov rdx, qword [rsp + 8]
lea r8, [rcx + rcx]
or r8, 1
add rdx, r8
mov qword [r10], r8
imul rdx, rbx
add rdx, r8
mov qword [r10 + 8], rdx
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.14012ada0
add rsp, 0x30
pop rbx
ret

Function at 0x140091100
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbp
push rdi
lea rdi, [rcx + 0x20]
mov rbp, rcx
mov r9d, 0x43b0d7e5
mov r10, rcx
cmp rcx, rdi
je 0x1400911c9
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
nop dword [rax]
imul r11d, r9d, 0x931e8875
cmp rdx, r8
je 0x140091146
mov rax, rdx
add rdx, 4
xor r9d, dword [rax]
imul r9d, r11d
mov eax, r9d
shr eax, 0x10
xor eax, r9d
mov r9d, r11d
mov dword [r10], eax
add r10, 4
cmp r10, rdi
jne 0x140091130
mov rbx, rbp
mov rsi, rdi
mov r10, rbp
nop dword [rax + rax]
cmp rbx, r10
je 0x1400911a5
mov ecx, r11d
imul r11d, r11d, 0x931e8875
xor ecx, dword [rbx]
imul ecx, r11d
mov eax, ecx
shr eax, 0x10
xor eax, ecx
imul ecx, dword [r10], 0xca01f9dd
imul eax, eax, 0x4973f715
sub ecx, eax
mov eax, ecx
shr eax, 0x10
xor eax, ecx
mov dword [r10], eax
add r10, 4
mov rax, rdx
mov r9d, r11d
cmp r10, rdi
jne 0x140091170
add rbx, 4
cmp rbx, rsi
jne 0x140091168
mov rsi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
jmp 0x1400911cc
mov rax, rdx
cmp rax, r8
je 0x140091222
mov r10, rbp
cmp rbp, rdi
je 0x140091219
nop dword [rax]
mov edx, r9d
imul r9d, r9d, 0x931e8875
xor edx, dword [rax]
imul edx, r9d
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
imul edx, dword [r10], 0xca01f9dd
imul ecx, ecx, 0x4973f715
sub edx, ecx
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
mov dword [r10], ecx
add r10, 4
cmp r10, rdi
jne 0x1400911e0
add rax, 4
cmp rax, r8
jne 0x1400911d1
mov rbp, qword [rsp + 0x28]
pop rdi
ret
Function at 0x140091510
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x40], rbx
lea rax, [rdx - 1]
mov qword [rsp + 0x48], rbp
mov rbx, rdx
mov ebp, 0xffffffff
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x10], r14
mov r11, rcx
mov r8d, ebp
mov r9d, 1
cmp rbp, rax
jae 0x14009155f
nop word [rax + rax]
shl r8, 0x20
inc r9d
or r8, rbp
cmp r8, rax
jb 0x140091550
mov rcx, qword [rcx]
lea esi, [r9 - 1]
movabs r14, 0x5851f42d4c957f2d
mov r9d, esi
mov rdx, qword [rcx + 8]
mov rax, rdx
mov r10, rdx
shr r10, 0x2d
imul rax, r14
add rax, qword [rcx]
mov qword [rcx + 8], rax
mov rcx, rdx
shr rdx, 0x1b
xor r10d, edx
shr rcx, 0x3b
ror r10d, cl
test esi, esi
je 0x1400915d8
mov rcx, qword [r11]
shl r10, 0x20
mov rdx, qword [rcx + 8]
mov rax, rdx
imul rax, r14
add rax, qword [rcx]
mov qword [rcx + 8], rax
mov rax, rdx
shr rax, 0x2d
mov rcx, rdx
shr rdx, 0x1b
xor eax, edx
shr rcx, 0x3b
ror eax, cl
or r10, rax
add r9d, ebp
jne 0x1400915a1
mov rax, rbx
mov qword [rsp + 0x18], rdi
mul r10
mov rcx, rax
mov qword [rsp], rax
and rcx, r8
mov qword [rsp + 8], rdx
mov r9, rdx
mov r10, rax
cmp rcx, rbx
jae 0x1400916cb
xor edx, edx
mov rax, r8
sub rax, rbx
inc rax
div rbx
mov rdi, rdx
cmp rcx, rdx
jae 0x1400916cb
nop dword [rax + rax]
mov rcx, qword [r11]
mov r10d, esi
mov r9, qword [rcx + 8]
mov rax, r9
imul rax, r14
add rax, qword [rcx]
mov qword [rcx + 8], rax
mov rax, r9
mov rcx, r9
shr rax, 0x2d
shr r9, 0x1b
xor r9d, eax
shr rcx, 0x3b
ror r9d, cl
test esi, esi
je 0x140091697
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [r11]
shl r9, 0x20
mov rdx, qword [rcx + 8]
mov rax, rdx
imul rax, r14
add rax, qword [rcx]
mov qword [rcx + 8], rax
mov rax, rdx
shr rax, 0x2d
mov rcx, rdx
shr rdx, 0x1b
xor eax, edx
shr rcx, 0x3b
ror eax, cl
or r9, rax
add r10d, ebp
jne 0x140091660
mov rax, rbx
mul r9
mov qword [rsp], rax
and rax, r8
mov qword [rsp + 8], rdx
movaps xmm1, xmmword [rsp]
cmp rax, rdi
jb 0x140091620
movdqa xmm0, xmm1
movq r10, xmm1
psrldq xmm0, 8
movq r9, xmm0
jmp 0x1400916cf
movaps xmm1, xmmword [rsp]
cmp dword [reloc.WS2_32.dll_accept], 2
mov r14, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
jge 0x14009174c
mov rax, r8
movabs rcx, 0x5555555555555555
shr rax, 1
and rax, rcx
movabs rcx, 0x3333333333333333
sub r8, rax
mov rax, r8
and r8, rcx
shr rax, 2
and rax, rcx
add rax, r8
mov rcx, rax
shr rcx, 4
add rcx, rax
movabs rax, 0xf0f0f0f0f0f0f0f
and rcx, rax
movabs rax, 0x101010101010101
imul rcx, rax
shr rcx, 0x38
jmp 0x140091751
popcnt rcx, r8
mov ecx, ecx
test cl, cl
je 0x140091779
cmp cl, 0x40
jb 0x14009176d
movzx ecx, cl
and ecx, 0x3f
shr r9, cl
mov rax, r9
add rsp, 0x28
ret
shrd r10, r9, cl
mov rax, r10
add rsp, 0x28
ret
movq rax, xmm1
add rsp, 0x28
ret
Function at 0x1400957b0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
test rdx, rdx
jne 0x1400957d6
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.lua54.dll_lua_pushnil]
xor r8d, r8d
movaps xmmword [rsp + 0x20], xmm7
xor edx, edx
call qword [sym.imp.lua54.dll_lua_createtable]
lea rdx, str.name
mov rcx, rbx
call qword [sym.imp.lua54.dll_lua_pushstring]
cmp qword [rdi + 0x10], 0
je 0x14009580c
cmp qword [rdi + 0x18], 0xf
mov rdx, rdi
jbe 0x140095813
mov rdx, qword [rdi]
jmp 0x140095813
lea rdx, [0x1401c4fe4]
mov rcx, rbx
call qword [sym.imp.lua54.dll_lua_pushstring]
mov edx, 0xfffffffd
mov rcx, rbx
call qword [sym.imp.lua54.dll_lua_settable]
lea rdx, str.country
mov rcx, rbx
call qword [sym.imp.lua54.dll_lua_pushstring]
cmp qword [rdi + 0x40], 0
je 0x140095851
cmp qword [rdi + 0x48], 0xf
lea rdx, [rdi + 0x30]
jbe 0x140095858
mov rdx, qword [rdx]
jmp 0x140095858
lea rdx, [0x1401c4fe4]
mov rcx, rbx
call qword [sym.imp.lua54.dll_lua_pushstring]
mov edx, 0xfffffffd
mov rcx, rbx
call qword [sym.imp.lua54.dll_lua_settable]
lea rdx, str.netid
mov rcx, rbx
call qword [sym.imp.lua54.dll_lua_pushstring]
movsxd rax, dword [rdi + 0x24]
mov rcx, rbx
mov rdx, rax
test eax, eax
jns 0x140095894
mov rdx, 0xffffffffffffffff
call qword [sym.imp.lua54.dll_lua_pushinteger]
mov edx, 0xfffffffd
mov rcx, rbx
call qword [sym.imp.lua54.dll_lua_settable]
lea rdx, str.userid
mov rcx, rbx
call qword [sym.imp.lua54.dll_lua_pushstring]
movsxd rax, dword [rdi + 0x20]
mov rcx, rbx
mov rdx, rax
test eax, eax
jns 0x1400958cd
mov rdx, 0xffffffffffffffff
call qword [sym.imp.lua54.dll_lua_pushinteger]
mov edx, 0xfffffffd
mov rcx, rbx
call qword [sym.imp.lua54.dll_lua_settable]
lea rdx, [0x1401c4f08]
mov rcx, rbx
call qword [sym.imp.lua54.dll_lua_pushstring]
movss xmm0, dword [rdi + 0x28]
xorps xmm7, xmm7
comiss xmm0, xmm7
jb 0x14009590c
call sub.api_ms_win_crt_math_l1_1_0.dll_floorf
xorps xmm1, xmm1
cvtss2sd xmm1, xmm0
jmp 0x140095914
movsd xmm1, qword [0x1401d2228]
mov rcx, rbx
call qword [sym.imp.lua54.dll_lua_pushnumber]
mov edx, 0xfffffffd
mov rcx, rbx
call qword [sym.imp.lua54.dll_lua_settable]
lea rdx, [0x1401c4f04]
mov rcx, rbx
call qword [sym.imp.lua54.dll_lua_pushstring]
movss xmm0, dword [rdi + 0x2c]
comiss xmm0, xmm7
movaps xmm7, xmmword [rsp + 0x20]
jb 0x140095958
call sub.api_ms_win_crt_math_l1_1_0.dll_floorf
xorps xmm1, xmm1
cvtss2sd xmm1, xmm0
jmp 0x140095960
movsd xmm1, qword [0x1401d2228]
mov rcx, rbx
call qword [sym.imp.lua54.dll_lua_pushnumber]
mov edx, 0xfffffffd
mov rcx, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.lua54.dll_lua_settable]
Function at 0x140096bd0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp dword [r8 + 0x40], 1
mov rdi, r9
mov rbx, r8
mov r14, rdx
mov rbp, rcx
je 0x140096bff
xor eax, eax
jmp 0x140096dba
mov ecx, dword [r9 + 0x10]
mov qword [rsp + 0x30], rsi
call qword [sym.imp.WS2_32.dll_ntohl]
mov esi, eax
lea rax, [rsi - 1]
cmp rax, 0xfe
ja 0x140096d97
mov ecx, dword [rdi + 0x1c]
call qword [sym.imp.WS2_32.dll_ntohl]
cmp eax, dword [rbx + 0xd0]
jne 0x140096d97
mov ecx, dword [rdi + 0x20]
call qword [sym.imp.WS2_32.dll_ntohl]
cmp eax, dword [rbx + 0xc8]
jne 0x140096d97
mov ecx, dword [rdi + 0x24]
call qword [sym.imp.WS2_32.dll_ntohl]
cmp eax, dword [rbx + 0xcc]
jne 0x140096d97
mov eax, dword [rbx + 0x1c]
cmp dword [rdi + 0x28], eax
jne 0x140096d97
mov edx, 1
mov r8b, 0xff
mov rcx, rbx
call fcn.140095da0
cmp rsi, qword [rbx + 0x50]
jae 0x140096c85
mov qword [rbx + 0x50], rsi
movzx ecx, word [rdi + 4]
call qword [sym.imp.WS2_32.dll_ntohs]
mov word [rbx + 0x18], ax
movzx eax, byte [rdi + 6]
mov byte [rbx + 0x21], al
movzx eax, byte [rdi + 7]
mov byte [rbx + 0x20], al
mov ecx, dword [rdi + 8]
call qword [sym.imp.WS2_32.dll_ntohl]
mov ecx, 0x240
mov esi, 0x1000
cmp eax, ecx
jb 0x140096cbf
cmp eax, esi
mov ecx, eax
cmova ecx, esi
cmp ecx, dword [rbx + 0xfc]
jae 0x140096ccd
mov dword [rbx + 0xfc], ecx
mov ecx, dword [rdi + 0xc]
call qword [sym.imp.WS2_32.dll_ntohl]
cmp eax, esi
jb 0x140096ce6
mov ecx, 0x10000
mov esi, eax
cmp eax, ecx
cmova esi, ecx
cmp esi, dword [rbx + 0x100]
jae 0x140096cf4
mov dword [rbx + 0x100], esi
mov ecx, dword [rdi + 0x14]
call qword [sym.imp.WS2_32.dll_ntohl]
mov dword [rbx + 0x58], eax
mov ecx, dword [rdi + 0x18]
call qword [sym.imp.WS2_32.dll_ntohl]
mov dword [rbx + 0x5c], eax
mov dword [rbp + 0x80], 1
mov ecx, dword [rbx + 0x40]
test r14, r14
je 0x140096d7c
lea eax, [rcx - 5]
cmp eax, 1
jbe 0x140096d42
cmp dword [rbx + 0x58], 0
je 0x140096d37
mov rax, qword [rbx + 0x10]
inc qword [rax + 0x2b60]
mov rax, qword [rbx + 0x10]
inc qword [rax + 0x2b58]
xor eax, eax
mov dword [rbx + 0x40], 5
mov qword [rbx + 0x80], rax
mov qword [rbx + 0x70], rax
mov qword [rbx + 0xa0], rax
mov dword [rbx + 0xac], eax
mov dword [r14], 1
mov qword [r14 + 8], rbx
mov eax, dword [rbx + 0x1f8]
mov dword [r14 + 0x14], eax
xor eax, eax
jmp 0x140096db5
xor eax, eax
mov rdx, rbx
cmp ecx, 1
mov rcx, rbp
sete al
lea r8d, [rax + 3]
call fcn.1400074a0
xor eax, eax
jmp 0x140096db5
xor eax, eax
mov r8d, 9
mov rdx, rbx
mov dword [rbx + 0x1f8], eax
mov rcx, rbp
call fcn.1400074a0
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret