joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400855e0
Capabilities:
Get thread local storage value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov esi, ecx
mov r12, rdx
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ebp, eax
call fcn.1400847e0
mov ecx, dword [0x14014ffa8]
call qword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x1400856e0
lea r13, [rbx + 0x68]
mov rcx, r13
call fcn.140083fe0
cmp esi, dword [rbx + 0x48]
jae 0x140085660
mov rdi, qword [rbx + 0x50]
mov qword [rdi + rsi*8], r12
mov rax, qword [rbx + 0x58]
mov rcx, r13
mov byte [rax + rsi], 1
call fcn.140084020
mov ecx, ebp
call qword [sym.imp.KERNEL32.DLL_SetLastError]
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea r15d, [rsi + 1]
mov rcx, qword [rbx + 0x50]
movsxd r14, r15d
lea rdx, [r14*8]
call sub.msvcrt.dll_realloc
mov rdi, rax
test rax, rax
je 0x1400856ed
mov rcx, qword [rbx + 0x58]
mov rdx, r14
call sub.msvcrt.dll_realloc
mov r14, rax
test rax, rax
je 0x1400856ed
mov eax, dword [rbx + 0x48]
mov edx, r15d
sub edx, eax
lea rcx, [rdi + rax*8]
lea r8, [rdx*8]
xor edx, edx
call sub.msvcrt.dll_memset
mov ecx, dword [rbx + 0x48]
mov r8d, r15d
xor edx, edx
mov rax, rcx
add rcx, r14
sub r8d, eax
call sub.msvcrt.dll_memset
mov qword [rbx + 0x50], rdi
mov qword [rbx + 0x58], r14
mov dword [rbx + 0x48], r15d
jmp 0x14008562f
call fcn.140084890
mov rbx, rax
jmp 0x14008561a
mov rcx, r13
call fcn.140084020
mov eax, 0xc
jmp 0x14008564d

Function at 0x140085770
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
call fcn.1400847e0
mov ecx, dword [0x14014ffa8]
call qword [sym.imp.KERNEL32.DLL_TlsGetValue]
test rax, rax
je 0x140085798
mov rax, qword [rax + 0x30]
add rsp, 0x28
ret
call fcn.140084890
test rax, rax
jne 0x14008578a
add rsp, 0x28
ret

Function at 0x140085800
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
call fcn.1400847e0
mov ecx, dword [0x14014ffa8]
call qword [sym.imp.KERNEL32.DLL_TlsGetValue]
test rax, rax
je 0x140085828
add rax, 0x18
add rsp, 0x28
ret
call fcn.140084890
test rax, rax
jne 0x14008581a
jmp 0x14008581e

Function at 0x140085940
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x1401ffbc8]
test eax, eax
jne 0x140085958
xor eax, eax
add rsp, 0x28
ret
call fcn.1400847e0
mov ecx, dword [0x14014ffa8]
call qword [sym.imp.KERNEL32.DLL_TlsGetValue]
test rax, rax
je 0x140085988
mov edx, dword [rax + 0x20]
test edx, edx
jg 0x14008594e
test byte [rax + 0x40], 3
je 0x14008594e
mov eax, dword [rax + 0x44]
and eax, 1
jmp 0x140085950
call fcn.140084890
test rax, rax
jne 0x14008596e
jmp 0x14008594e

Function at 0x1400859a0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
call fcn.1400847e0
mov ecx, dword [0x14014ffa8]
call qword [sym.imp.KERNEL32.DLL_TlsGetValue]
test rax, rax
je 0x1400859e0
test ebx, ebx
jle 0x1400859d0
lock add dword [rax + 0x20], 1
add rsp, 0x20
pop rbx
ret
lock sub dword [rax + 0x20], 1
add rsp, 0x20
pop rbx
ret
call fcn.140084890
test rax, rax
jne 0x1400859bd
add rsp, 0x20
pop rbx
ret
Function at 0x140085ad0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
call fcn.1400847e0
mov ecx, dword [0x14014ffa8]
call qword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140085b48
test byte [rbx + 0x40], 0xc
jne 0x140085aff
mov eax, dword [0x1401ffbc8]
test eax, eax
jne 0x140085b10
add rsp, 0x28
pop rbx
pop rsi
ret
lea rsi, [rbx + 0x38]
mov rcx, rsi
call fcn.140083a00
movzx eax, byte [rbx + 0x40]
test al, 3
je 0x140085b33
mov edx, dword [rbx + 0x44]
test dl, 1
je 0x140085b33
mov ecx, dword [rbx + 0x20]
test ecx, ecx
jle 0x140085b5c
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.140083cd0
call fcn.140084890
mov rbx, rax
test rax, rax
jne 0x140085aef
add rsp, 0x28
pop rbx
pop rsi
ret
and eax, 0xfffffff3
mov rcx, qword [rbx + 0x30]
and edx, 0xfffffffe
or eax, 4
mov dword [rbx + 0x44], edx
mov byte [rbx + 0x40], al
test rcx, rcx
je 0x140085b7a
call qword [sym.imp.KERNEL32.DLL_ResetEvent]
mov rcx, rsi
call fcn.140083cd0
call fcn.1400859f0
nop
nop dword [rax + rax]
push rdi
push rsi
push rbx
sub rsp, 0x20
test rcx, rcx
je 0x140085c00
call fcn.1400837b0
mov rsi, rax
mov eax, 0xfffffffe
cmp rax, rsi
jb 0x140085c38
call fcn.1400847e0
mov ecx, dword [0x14014ffa8]
mov edi, esi
call qword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140085c90
test esi, esi
je 0x140085c16
call fcn.140085ad0
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140085c70
mov edx, edi
call fcn.140083860
call fcn.140085ad0
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.1400847e0
mov ecx, dword [0x14014ffa8]
call qword [sym.imp.KERNEL32.DLL_TlsGetValue]
test rax, rax
je 0x140085c80
call fcn.140085ad0
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_Sleep]
call fcn.140085ad0
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.1400847e0
mov ecx, dword [0x14014ffa8]
mov edi, 0xffffffff
call qword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov rbx, rax
test rax, rax
jne 0x140085bd5
call fcn.140084890
mov rbx, rax
jmp 0x140085bd5
mov ecx, edi
call qword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x140085bee
call fcn.140084890
jmp 0x140085c16
call fcn.140084890
mov rbx, rax
jmp 0x140085bd1
Function at 0x140085b90
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
call fcn.1400847e0
mov ecx, dword [0x14014ffa8]
call qword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140085b48
test byte [rbx + 0x40], 0xc
jne 0x140085aff
mov eax, dword [0x1401ffbc8]
test eax, eax
jne 0x140085b10
add rsp, 0x28
pop rbx
pop rsi
ret
lea rsi, [rbx + 0x38]
mov rcx, rsi
call fcn.140083a00
movzx eax, byte [rbx + 0x40]
test al, 3
je 0x140085b33
mov edx, dword [rbx + 0x44]
test dl, 1
je 0x140085b33
mov ecx, dword [rbx + 0x20]
test ecx, ecx
jle 0x140085b5c
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.140083cd0
call fcn.140084890
mov rbx, rax
test rax, rax
jne 0x140085aef
add rsp, 0x28
pop rbx
pop rsi
ret
and eax, 0xfffffff3
mov rcx, qword [rbx + 0x30]
and edx, 0xfffffffe
or eax, 4
mov dword [rbx + 0x44], edx
mov byte [rbx + 0x40], al
test rcx, rcx
je 0x140085b7a
call qword [sym.imp.KERNEL32.DLL_ResetEvent]
mov rcx, rsi
call fcn.140083cd0
call fcn.1400859f0
nop
nop dword [rax + rax]
push rdi
push rsi
push rbx
sub rsp, 0x20
test rcx, rcx
je 0x140085c00
call fcn.1400837b0
mov rsi, rax
mov eax, 0xfffffffe
cmp rax, rsi
jb 0x140085c38
call fcn.1400847e0
mov ecx, dword [0x14014ffa8]
mov edi, esi
call qword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140085c90
test esi, esi
je 0x140085c16
call fcn.140085ad0
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140085c70
mov edx, edi
call fcn.140083860
call fcn.140085ad0
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.1400847e0
mov ecx, dword [0x14014ffa8]
call qword [sym.imp.KERNEL32.DLL_TlsGetValue]
test rax, rax
je 0x140085c80
call fcn.140085ad0
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_Sleep]
call fcn.140085ad0
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.1400847e0
mov ecx, dword [0x14014ffa8]
mov edi, 0xffffffff
call qword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov rbx, rax
test rax, rax
jne 0x140085bd5
call fcn.140084890
mov rbx, rax
jmp 0x140085bd5
mov ecx, edi
call qword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x140085bee
call fcn.140084890
jmp 0x140085c16
call fcn.140084890
mov rbx, rax
jmp 0x140085bd1

Function at 0x140085ca0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov esi, ecx
call fcn.1400847e0
mov ecx, dword [0x14014ffa8]
call qword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140085d10
test esi, esi
je 0x140085cf0
call fcn.140085ad0
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140085d20
mov edx, esi
call fcn.140083860
call fcn.140085ad0
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
call fcn.140085ad0
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_Sleep]
call fcn.140085ad0
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
call fcn.140084890
mov rbx, rax
jmp 0x140085cc1
mov ecx, esi
call qword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x140085cda
Function at 0x1400862b0
Capabilities:
Create thread
Get thread local storage value
Resume thread

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rbp, rcx
mov rdi, rdx
mov rsi, r8
mov r12, r9
call fcn.140084570
mov rbx, rax
test rax, rax
je 0x1400864e4
test rbp, rbp
je 0x1400862eb
mov rax, qword [rax + 0x1d8]
mov qword [rbp], rax
mov r13, qword [sym.imp.KERNEL32.DLL_Sleep]
mov dword [rbx + 0x44], 1
mov dword [rbx + 0xbc], 0
mov qword [rbx + 0x28], 0xffffffffffffffff
mov r14, r13
mov qword [rbx + 8], r12
mov r12, qword [sym.imp.KERNEL32.DLL_CreateEventA]
mov qword [rbx + 0x10], rsi
xor esi, esi
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call r12
mov qword [rbx + 0x30], rax
test rax, rax
jne 0x140086360
test esi, esi
jne 0x140086350
xor ecx, ecx
mov esi, 1
call r14
jmp 0x14008631f
add esi, 1
mov ecx, 0x14
call r13
cmp esi, 5
jne 0x14008631f
mov qword [rbx + 0x38], 0xffffffffffffffff
lea r12, [rbx + 0x68]
mov rcx, r12
call fcn.140083fd0
cmp eax, 1
je 0x14008652f
cmp qword [rbx + 0x30], 0
mov dword [rbx], 0xbab1f00d
mov qword [rbx + 0x68], 0xffffffffffffffff
mov dword [rbx + 0xc0], 0
mov dword [rbx + 0xb8], 0
je 0x1400864cd
xor edx, edx
test rdi, rdi
je 0x1400863cd
mov eax, dword [rdi]
mov rsi, qword [rdi + 0x10]
mov dword [rbx + 0x44], eax
test al, 8
jne 0x1400864f0
mov eax, dword [rdi + 0x18]
mov dword [rbx + 0xc0], eax
mov edx, esi
lea r8, [0x140084b40]
mov r9, rbx
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov rsi, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140086498
mov eax, dword [rbx + 0xc0]
mov edx, 0xfffffff1
cmp eax, 0xfffffff2
jge 0x140086470
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_SetThreadPriority]
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.DLL_ResetEvent]
test byte [rbx + 0x44], 4
jne 0x140086450
mov qword [rbx + 0x28], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_ResumeThread]
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_Sleep]
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rcx, rsi
mov qword [rbx + 0x28], 0
call qword [sym.imp.KERNEL32.DLL_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x140086437
mov edx, 0xfffffffe
cmp eax, 0xffffffff
jl 0x140086411
mov edx, 2
cmp eax, edx
cmovle edx, eax
cmp eax, 0xf
mov eax, 0xf
cmovge edx, eax
jmp 0x140086411
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x1400864a7
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
lea rcx, [rbx + 0x38]
call fcn.140083e60
mov rcx, r12
call fcn.140083fd0
cmp eax, 1
je 0x14008652f
mov qword [rbx + 0x68], 0xffffffffffffffff
pxor xmm0, xmm0
movups xmmword [rbx + 0x28], xmm0
test rbp, rbp
je 0x1400864da
mov qword [rbp], 0
cmp qword [rbx + 0x1d0], 0
je 0x140086518
mov eax, 0xb
jmp 0x140086441
call fcn.1400847e0
mov ecx, dword [0x14014ffa8]
call qword [sym.imp.KERNEL32.DLL_TlsGetValue]
test rax, rax
je 0x140086528
mov eax, dword [rax + 0xc0]
jmp 0x1400863c5
mov rcx, rbx
call fcn.140084640
jmp 0x1400864e4
call fcn.140084890
jmp 0x140086506
call fcn.140084340
nop
nop word cs:[rax + rax]
Function at 0x140088cf0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtectEx]
mov r9d, 0x40
mov esi, r8d
lea r12, [rsp + 0x3c]
mov rbx, rcx
mov rdi, rdx
mov r8, rsi
mov rdx, rcx
mov qword [rsp + 0x20], r12
mov rcx, qword [0x1401992b0]
call rbp
xor eax, eax
mov r9, rsi
mov r8, rdi
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov rcx, qword [0x1401992b0]
call qword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
mov r9d, dword [rsp + 0x3c]
mov r8, rsi
mov rdx, rbx
mov rcx, qword [0x1401992b0]
mov qword [rsp + 0x20], r12
call rbp
nop
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x140089220
Capabilities:
Enumerate processes

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x1a0
xor edx, edx
mov r12, rcx
mov ecx, 2
lea rbp, [rsp + 0x70]
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov rdi, rbp
mov ecx, 0x4c
mov rdx, rbp
mov rbx, rax
xor eax, eax
rep stosd dword [rdi], eax
mov rcx, rbx
mov dword [rsp + 0x70], 0x130
call sub.KERNEL32.DLL_Process32First
test eax, eax
je 0x1400892d3
lea rsi, [rsp + 0x50]
lea r14, [rsp + 0x9c]
lea rdi, [rsp + 0x30]
mov rdx, r12
mov rcx, rsi
call fcn.14000196c
mov rdx, r14
mov rcx, rdi
call fcn.14000196c
mov rdx, rsi
mov rcx, rdi
call fcn.1401432e0
mov rcx, rdi
mov r13d, eax
call fcn.14011dda0
mov rcx, rsi
call fcn.14011dda0
test r13b, r13b
je 0x1400892c4
mov r8d, dword [rsp + 0x78]
mov dword [0x1401991f0], r8d
jmp 0x1400892d6
mov rdx, rbp
mov rcx, rbx
call sub.KERNEL32.DLL_Process32Next
test eax, eax
jne 0x14008927d
xor r8d, r8d
mov dword [rsp + 0x2c], r8d
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov r8d, dword [rsp + 0x2c]
xor eax, eax
test r8d, r8d
je 0x140089312
xor edx, edx
mov ecx, 0x38
call qword [sym.imp.KERNEL32.DLL_OpenProcess]
jmp 0x140089312
add rsp, 0x1a0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x140089870
Capabilities:
Enumerate process modules

Disassembly:
push r15
mov eax, 0x21d8
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.140070e80
sub rsp, rax
mov r8d, 0x2000
xor ebx, ebx
lea rbp, [rsp + 0x1d0]
lea r9, [rsp + 0x4c]
mov qword [rsp + 0x2220], rcx
mov rdx, rbp
lea rdi, [rsp + 0x88]
call sub.KERNEL32.DLL_K32EnumProcessModules
mov qword [rsp + 0x30], rdi
test eax, eax
je 0x140089a42
mov eax, dword [rsp + 0x4c]
shr rax, 3
cmp rbx, rax
jae 0x140089a69
mov rdx, qword [rbp + rbx*8]
mov rcx, qword [rsp + 0x2220]
lea rsi, [rsp + 0xc8]
mov r9d, 0x104
mov r8, rsi
call sub.KERNEL32.DLL_K32GetModuleFileNameExA
test eax, eax
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
je 0x140089a15
lea rax, [rsp + 0x68]
mov rdx, rsi
mov rcx, rax
mov qword [rsp + 0x28], rax
call fcn.14000196c
mov rcx, qword [rsp + 0x30]
lea rdx, str.Minecraft.Windows.exe
call fcn.14000196c
mov rdx, qword [rsp + 0x88]
lea rcx, [rsp + 0x52]
call sub.msvcrt.dll_strcpy
mov rcx, qword [rsp + 0x20]
mov rdx, rax
call fcn.14000196c
mov r13, qword [rsp + 0xb0]
mov r12, qword [rsp + 0xa8]
mov r8, qword [rsp + 0x70]
test r13, r13
je 0x1400899d2
test r8, r8
je 0x1400899ce
movsx eax, byte [r12]
mov rdi, qword [rsp + 0x68]
mov esi, 1
sub rsi, r13
mov dword [rsp + 0x3c], eax
lea r14, [rdi + r8]
mov rcx, rdi
cmp r8, r13
jb 0x1400899ce
add r8, rsi
je 0x1400899ce
mov edx, dword [rsp + 0x3c]
call sub.msvcrt.dll_memchr
mov r15, rax
test rax, rax
je 0x1400899ce
mov r8, r13
mov rdx, r12
mov rcx, rax
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x1400899c2
sub r15, rdi
mov r13, r15
jmp 0x1400899d2
lea rcx, [r15 + 1]
mov r8, r14
sub r8, rcx
jmp 0x14008998d
or r13, 0xffffffffffffffff
mov rcx, qword [rsp + 0x20]
call fcn.14011dda0
inc r13
je 0x140089a04
mov rcx, qword [rsp + 0x30]
mov ebx, ebx
mov rbx, qword [rsp + rbx*8 + 0x1d0]
call fcn.14011dda0
mov rcx, qword [rsp + 0x28]
call fcn.14011dda0
jmp 0x140089aab
mov rcx, qword [rsp + 0x30]
call fcn.14011dda0
mov rcx, qword [rsp + 0x28]
jmp 0x140089a35
mov rcx, qword [rsp + 0x20]
lea rdx, str.Could_not_invoke_call_to_GetModuleFileNameEx.
call fcn.14000196c
mov rcx, qword [rsp + 0x20]
call fcn.140088ba0
mov rcx, qword [rsp + 0x20]
call fcn.14011dda0
inc rbx
jmp 0x1400898c3
lea rbx, [rsp + 0xc8]
lea rdx, str.Could_not_invoke_call_to_EnumProcessModules.
mov rcx, rbx
call fcn.14000196c
mov rcx, rbx
call fcn.140088ba0
mov rcx, rbx
call fcn.14011dda0
xor ebx, ebx
jmp 0x140089aab
mov rax, rbx
add rsp, 0x21d8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14008f290
Capabilities:
Create thread

Disassembly:
sub rsp, 0x28
mov rdx, qword [0x14019e0b8]
cmp rdx, qword [0x14019e0c0]
mov qword [rsp + 0x30], rcx
je 0x14008f209
mov qword [rdx], rcx
add rdx, 8
mov qword [0x14019e0b8], rdx
jmp 0x14008f21b
lea r8, [rsp + 0x30]
lea rcx, [0x14019e0b0]
call fcn.14011cb10
nop
add rsp, 0x28
ret
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov ecx, 0x50
call fcn.140146780
lea rbx, [rsp + 0x30]
lea rdx, str.Reach
mov rcx, rbx
mov rdi, rax
call fcn.14000196c
mov rdx, rbx
mov rcx, rdi
call fcn.140095c30
mov rcx, rbx
call fcn.14011dda0
lea rax, fcn.1400957c0
mov rcx, rdi
mov qword [rdi], rax
movabs rax, 0x4040000040400000
mov qword [rdi + 0x40], rax
mov eax, 0x64000001
shl rax, 8
mov qword [rdi + 0x48], rax
call 0x14008f1e0
mov ecx, 0xa60
call fcn.140146780
mov rcx, rax
mov rsi, rax
call fcn.140097ea0
jmp 0x14008f320
mov rcx, rsi
call 0x14008f1e0
mov ecx, 0x68
call fcn.140146780
lea rdx, str.AntiCheatDisabler
mov rcx, rbx
mov rsi, rax
call fcn.14000196c
mov rdx, rbx
mov rcx, rsi
call fcn.140095c30
mov rcx, rbx
lea rbp, [0x1401a20f2]
call fcn.14011dda0
xor r8d, r8d
xor ecx, ecx
lea rax, fcn.14008fe30
mov dword [rsi + 0x48], r8d
mov qword [rsi + 0x40], rcx
mov qword [rsi], rax
call fcn.140119e90
mov qword [rsi + 0x58], rbp
mov rcx, rsi
mov qword [rsi + 0x50], rax
lea rax, str.Latency
mov qword [rsi + 0x60], rax
call 0x14008f1e0
mov ecx, 0x48
call fcn.140146780
lea rdx, str.HideFromTaskBar
mov rcx, rbx
mov rdi, rax
call fcn.14000196c
jmp 0x14008f3c3
mov rdx, rbx
mov rcx, rdi
call fcn.140095c30
mov rcx, rbx
call fcn.14011dda0
lea rax, fcn.14008fd00
mov byte [rdi + 0x28], 1
mov rcx, rdi
mov qword [rdi], rax
mov word [rdi + 0x40], 0x101
call 0x14008f1e0
mov ecx, 0x48
call fcn.140146780
lea rdx, str.StreamMode
mov rcx, rbx
mov rdi, rax
call fcn.14000196c
jmp 0x14008f412
mov rdx, rbx
mov rcx, rdi
call fcn.140095c30
mov rcx, rbx
call fcn.14011dda0
lea rax, fcn.140089d30
mov byte [rdi + 0x40], 1
mov rcx, rdi
mov qword [rdi], rax
mov byte [rdi + 0x28], 1
call 0x14008f1e0
mov ecx, 0x88
call fcn.140146780
lea rdx, str.AutoClicker
mov rcx, rbx
mov rsi, rax
call fcn.14000196c
jmp 0x14008f46d
mov rdx, rbx
mov rcx, rsi
call fcn.140095c30
mov rcx, rbx
call fcn.14011dda0
lea rax, fcn.14008a910
xor edx, edx
xor ecx, ecx
mov qword [rsi], rax
lea rax, str.Gaussian
xor r9d, r9d
lea r8, [0x14008a4d0]
mov qword [rsi + 0x48], rax
lea rax, str.Exponential
mov qword [rsi + 0x50], rax
xor eax, eax
mov qword [rsi + 0x40], rbp
mov qword [rsi + 0x58], rax
mov qword [rsi + 0x60], rax
mov qword [rsi + 0x68], rax
mov qword [rsi + 0x70], rax
mov qword [rsi + 0x78], rax
mov qword [rsi + 0x80], rax
mov dword [rsp + 0x20], edx
xor edx, edx
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov rcx, rsi
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
jmp 0x14008f1e0
Function at 0x1400fa660
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, qword [sym.imp.msvcrt.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
mov rcx, qword [rdi]
call sub.msvcrt.dll__fileno_1
mov ecx, eax
mov r8d, ebx
mov rdx, rsi
call sub.msvcrt.dll__read
movsxd rbp, eax
cmp eax, 0xffffffff
je 0x1400fa6a8
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call r12
cmp dword [rax], 4
je 0x1400fa67a
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x14010cfd0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov rdi, rcx
test rax, rax
je 0x14010cff8
mov rcx, qword [rcx]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov ebx, 4
lea rsi, [rsp + 0x2c]
nop dword [rax]
mov ecx, dword [rdi + 0x10]
mov r8d, ebx
mov rdx, rsi
call sub.msvcrt.dll__read
test eax, eax
jle 0x14010d040
cdqe
add rsi, rax
sub rbx, rax
jne 0x14010d010
mov eax, dword [rsp + 0x2c]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp eax, 0xffffffff
jne 0x14010d04c
call rbp
cmp dword [rax], 4
je 0x14010d010
lea rcx, str.random_device_could_not_be_read
call fcn.1401495b0
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x140119340
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [rcx], edx
mov edx, 1
mov r8d, dword [rcx + rdx*4 - 4]
mov eax, r8d
shr eax, 0x1e
xor eax, r8d
imul eax, eax, 0x6c078965
add eax, edx
mov dword [rcx + rdx*4], eax
inc rdx
cmp rdx, 0x270
jne 0x140119347
mov qword [rcx + 0x9c0], 0x270
ret

Function at 0x140119380
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 0x28
cmp qword [rcx + 0x9c0], 0x26f
mov r9, rcx
jbe 0x140119399
call fcn.140119270
mov rax, qword [r9 + 0x9c0]
lea rdx, [rax + 1]
mov eax, dword [r9 + rax*4]
mov qword [r9 + 0x9c0], rdx
mov edx, eax
shr edx, 0xb
xor edx, eax
mov eax, edx
shl eax, 7
and eax, 0x9d2c5680
xor eax, edx
mov edx, eax
shl edx, 0xf
and edx, 0xefc60000
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 0x28
ret
Function at 0xf500b0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00f50237
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0xf500e1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0xf500c7
add dl, dl
jne 0xf500ee
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0xf5014e
xor eax, eax
add dl, dl
jne 0xf500fd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0xf50205
add dl, dl
jne 0xf5010e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf5011b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf50128
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf50135
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0xf50142
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0xf500d6
mov eax, 1
add dl, dl
jne 0xf5015e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf5016b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0xf50153
sub eax, ebx
mov ebx, 1
jne 0xf501a4
mov ecx, 1
add dl, dl
jne 0xf50186
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xf50193
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0xf5017b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0xf500d6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xf501c0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xf501cd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0xf501b5
cmp eax, 0x7d00
jae 0xf501f3
cmp eax, 0x500
jb 0xf501ee
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0xf500d6
cmp eax, 0x7f
ja 0xf501f6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0xf500d6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0xf5022a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0xf500d6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20