joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002c496
Capabilities:
Write file on windows

Disassembly:
jmp 0x140042930
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x32
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1d8]
mov rax, qword [0x140098040]
xor rax, rbp
mov qword [rbp + 0x170], rax
lea rcx, [0x1400a5126]
call fcn.14002c4eb
nop
mov rax, qword [rbp + 0x1a0]
cmp qword [rax + 0x68], 0
je 0x140042997
mov rax, qword [rbp + 0x1a0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14004299e
mov al, 1
jmp 0x140042b0e
mov rax, qword [rbp + 0x1a0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rbp + 0x158], rax
call fcn.14002b5c3
mov dword [rbp + 0x160], eax
mov edx, dword [rbp + 0x160]
mov rcx, qword [rbp + 0x1a0]
call qword [rbp + 0x158]
mov dword [rbp + 0x164], eax
call fcn.14002b5c3
mov dword [rbp + 0x168], eax
mov edx, dword [rbp + 0x164]
mov ecx, dword [rbp + 0x168]
call fcn.14002c05e
movzx eax, al
test eax, eax
je 0x140042a01
xor al, al
jmp 0x140042b0e
mov qword [rbp + 8], 0x20
mov rax, qword [rbp + 0x1a0]
mov rax, qword [rax + 0x68]
mov qword [rbp + 0x158], rax
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x1a0]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rcx, qword [rbp + 0x158]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x160], eax
cmp dword [rbp + 0x160], 0
je 0x140042a74
cmp dword [rbp + 0x160], 1
je 0x140042a7f
cmp dword [rbp + 0x160], 3
je 0x140042afd
jmp 0x140042b0c
mov rax, qword [rbp + 0x1a0]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x140042acf
mov rax, qword [rbp + 0x1a0]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x140042acf
xor al, al
jmp 0x140042b0e
mov rax, qword [rbp + 0x1a0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140042aea
mov dword [rbp + 0x154], 1
jmp 0x140042af4
mov dword [rbp + 0x154], 0
movzx eax, byte [rbp + 0x154]
jmp 0x140042b0e
mov rax, qword [rbp + 0x1a0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x140042b0e
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14008ad80]
call fcn.14002c13f
mov rax, rdi
mov rcx, qword [rbp + 0x170]
xor rcx, rbp
call fcn.14002ba00
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret
Function at 0x14007db60
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.14002c59f
movzx eax, al
test eax, eax
jne 0x14007db80
mov ecx, 7
call fcn.14002c167
nop
mov byte [rsp + 0x20], 0
call fcn.14002c1da
mov byte [rsp + 0x21], al
cmp dword [0x140098968], 1
jne 0x14007dba4
mov ecx, 7
call fcn.14002c167
nop
jmp 0x14007dbfc
cmp dword [0x140098968], 0
jne 0x14007dbf7
mov dword [0x140098968], 1
lea rdx, [0x140088770]
lea rcx, [0x140088440]
call fcn.14002b9bf
test eax, eax
je 0x14007dbd8
mov eax, 0xff
jmp 0x14007dd01
lea rdx, [0x140088330]
lea rcx, [section..rdata]
call fcn.14002c1c1
mov dword [0x140098968], 2
jmp 0x14007dbfc
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.14002c126
call fcn.14002bef1
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x14007dc59
mov rcx, qword [rsp + 0x30]
call fcn.14002b807
movzx eax, al
test eax, eax
je 0x14007dc59
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x1400a6020]
nop
call fcn.14002bfd2
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x14007dc8d
mov rcx, qword [rsp + 0x38]
call fcn.14002b807
movzx eax, al
test eax, eax
je 0x14007dc8d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.14002c43c
nop
call fcn.14007ddb0
mov dword [rsp + 0x28], eax
call fcn.14002be56
movzx eax, al
test eax, eax
jne 0x14007dcac
mov ecx, dword [rsp + 0x28]
call fcn.14002b19f
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14007dcbb
call fcn.14002c478
nop
xor edx, edx
mov cl, 1
call fcn.14002b78f
mov eax, dword [rsp + 0x28]
jmp 0x14007dd01
add rsp, 0x68
ret
Function at 0x18003cc00
Capabilities:
Terminate process

Disassembly:
push rdi
sub rsp, 0x90
lea rdi, [rsp + 0x20]
mov ecx, 0x1c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x180591580]
xor rax, rsp
mov qword [rsp + 0x80], rax
lea rcx, [0x180605052]
call fcn.180278fb0
mov eax, 0x7144
mov eax, eax
mov ecx, dword [0x1805b294c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
movzx eax, byte [rcx + rax]
test eax, eax
jne 0x18003cc60
call fcn.180279330
nop
mov eax, reloc.WS2_32.dll_recv
mov eax, eax
mov ecx, dword [0x1805b294c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov rcx, qword [rcx + rax + 8]
call fcn.1801938d0
mov qword [rsp + 0x60], rax
mov eax, 0x7144
mov eax, eax
mov ecx, dword [0x1805b294c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
movzx eax, byte [rcx + rax]
test eax, eax
jne 0x18003ccb1
call fcn.180279330
nop
mov eax, reloc.WS2_32.dll_recv
mov eax, eax
mov ecx, dword [0x1805b294c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov rax, qword [rcx + rax + 8]
mov qword [rsp + 0x68], rax
mov eax, 0x7144
mov eax, eax
mov ecx, dword [0x1805b294c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
movzx eax, byte [rcx + rax]
test eax, eax
jne 0x18003ccfd
call fcn.180279330
nop
mov eax, reloc.WS2_32.dll_recv
mov eax, eax
mov ecx, dword [0x1805b294c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
mov dword [rsp + 0x70], eax
mov r9, qword [rsp + 0x60]
mov r8, qword [rsp + 0x68]
mov edx, dword [rsp + 0x70]
lea rcx, str.Fatal_error__0x_08X__at_0x_p__0x_p_._nA_minidump_has_been_written._n
call fcn.1801d1860
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.180037460
nop
call fcn.1801e93c0
call fcn.18003cbd0
lea rcx, [rsp + 0x28]
call fcn.18003b560
mov r9d, reloc.WS2_32.dll_recv
lea r8, str.Project_BO4_ERROR
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 0x7144
mov eax, eax
mov ecx, dword [0x1805b294c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
movzx eax, byte [rcx + rax]
test eax, eax
jne 0x18003cd9a
call fcn.180279330
nop
mov eax, reloc.WS2_32.dll_recv
mov eax, eax
mov ecx, dword [0x1805b294c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
mov dword [rsp + 0x74], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x78], rax
mov edx, dword [rsp + 0x74]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
lea rcx, [rsp + 0x28]
call fcn.180038190
nop
mov rcx, rsp
lea rdx, [0x18041ded0]
call fcn.180278d80
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1802791f0
add rsp, 0x90
pop rdi
ret
Function at 0x180072a40
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
lea rcx, [0x180605070]
call fcn.180278fb0
nop
mov qword [rsp + 0x20], 0
jmp 0x180072a79
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x20], rax
jae 0x180072ac5
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x40]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
movabs rax, 0x100000001b3
mov rcx, qword [rsp + 0x40]
imul rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x180072a6c
mov rax, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x180076cf0
Capabilities:
Manipulate console buffer

Disassembly:
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x60
lea rdi, [rsp + 0x20]
mov ecx, reloc.WS2_32.dll_recv
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x70]
mov rax, qword [0x180591580]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea rcx, [0x18060509f]
call fcn.180278fb0
lea rax, [rsp + 0x28]
mov rdi, rax
xor eax, eax
mov ecx, 0x16
rep stosb byte [rdi], al
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdx, [rsp + 0x28]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx eax, word [rsp + 0x70]
mov word [rsp + 0x2c], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, dword [rsp + 0x2c]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
nop
mov rcx, rsp
lea rdx, [0x18042b9c0]
call fcn.180278d80
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1802791f0
add rsp, 0x60
pop rdi
ret

Function at 0x1800789c0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x60
lea rdi, [rsp + 0x30]
mov ecx, recv
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x70]
lea rcx, [0x180605089]
call fcn.180278fb0
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0x38]
call fcn.180079200
nop
lea rax, [0x180078700]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x70]
add rax, 8
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x38]
call fcn.18007cc90
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x48]
xor edx, edx
xor ecx, ecx
call fcn.1802e5db0
mov rcx, qword [rsp + 0x70]
mov qword [rcx], rax
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
je 0x180078a68
lea rcx, [rsp + 0x38]
call fcn.18007d3d0
nop
jmp 0x180078a7f
mov rax, qword [rsp + 0x70]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.180237a60
nop
lea rcx, [rsp + 0x38]
call fcn.180079f70
nop
mov rcx, rsp
lea rdx, [0x18042c6b0]
call fcn.180278d80
add rsp, 0x60
pop rdi
ret
Function at 0x18007d1f0
Capabilities:
Set console window title

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x90
lea rdi, [rsp + 0x20]
mov ecx, 0x1c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xa0]
mov rax, qword [0x180591580]
xor rax, rsp
mov qword [rsp + 0x88], rax
lea rcx, [0x18060509f]
call fcn.180278fb0
call qword [sym.imp.KERNEL32.dll_AllocConsole]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_AttachConsole]
xor ecx, ecx
call fcn.1802a4a70
mov r9, rax
lea r8, [0x18042c818]
lea rdx, [0x18042c820]
lea rcx, [rsp + 0x28]
call fcn.1802a56f0
mov ecx, 1
call fcn.1802a4a70
mov r9, rax
lea r8, [0x18042c828]
lea rdx, [0x18042c820]
lea rcx, [rsp + 0x28]
call fcn.1802a56f0
mov ecx, 2
call fcn.1802a4a70
mov r9, rax
lea r8, [0x18042c828]
lea rdx, [0x18042c820]
lea rcx, [rsp + 0x28]
call fcn.1802a56f0
lea rcx, str.Project_Bo4:
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
lea r8, [0x180077b60]
lea rdx, [fcn.18007d5c0]
lea rcx, [0x1805a9198]
call fcn.1801cbac0
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov edx, 5
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [0x1805a9238], rax
lea rdx, str.Console
lea rcx, [rsp + 0x38]
call fcn.180037460
nop
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x70]
call fcn.180078df0
mov qword [rsp + 0x80], rax
mov rdx, qword [rsp + 0x80]
lea rcx, [0x1805a9228]
call fcn.18007a090
lea rcx, [rsp + 0x70]
call fcn.18007a050
nop
lea rcx, [rsp + 0x38]
call fcn.180038190
nop
mov rcx, rsp
lea rdx, [0x18042c230]
call fcn.180278d80
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1802791f0
add rsp, 0x90
pop rdi
ret

Function at 0x180086bb0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x60
lea rdi, [rsp + 0x30]
mov ecx, recv
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x70]
lea rcx, [0x1806050d6]
call fcn.180278fb0
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0x38]
call fcn.18008a7b0
nop
lea rax, [0x1800869b0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x70]
add rax, 8
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x38]
call fcn.18009e750
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x48]
xor edx, edx
xor ecx, ecx
call fcn.1802e5db0
mov rcx, qword [rsp + 0x70]
mov qword [rcx], rax
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
je 0x180086c58
lea rcx, [rsp + 0x38]
call fcn.18009fa50
nop
jmp 0x180086c6f
mov rax, qword [rsp + 0x70]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.180237a60
nop
lea rcx, [rsp + 0x38]
call fcn.18008f5d0
nop
mov rcx, rsp
lea rdx, [0x180430a80]
call fcn.180278d80
add rsp, 0x60
pop rdi
ret
Function at 0x1800e3140
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x80
lea rdi, [rsp + 0x20]
mov ecx, 0x18
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x90]
lea rcx, [0x1806051ff]
call fcn.180278fb0
nop
cmp qword [rsp + 0xa0], 0
jg 0x1800e318f
xor eax, eax
jmp 0x1800e3386
mov rax, qword [rsp + 0x90]
cmp qword [rax + 0x68], 0
je 0x1800e31c0
mov r8, qword [rsp + 0xa0]
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x90]
call fcn.1800e33b0
jmp 0x1800e3386
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x90]
call fcn.1800de160
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jbe 0x1800e326f
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x28]
call fcn.180037020
mov rax, qword [rax]
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x90]
call fcn.1800e10f0
mov r8, qword [rsp + 0x58]
mov rdx, rax
mov rcx, qword [rsp + 0x98]
call fcn.18003b420
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x98]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x28]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov edx, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x90]
call fcn.1800e0f10
nop
mov rax, qword [rsp + 0x90]
cmp qword [rax + 0x80], 0
je 0x1800e3376
mov rcx, qword [rsp + 0x90]
call fcn.1800df200
mov qword [rsp + 0x60], 0xfff
cmp qword [rsp + 0x28], 0xfff
jbe 0x1800e3324
mov rax, qword [rsp + 0x90]
mov r9, qword [rax + 0x80]
mov r8d, 0xfff
mov edx, 1
mov rcx, qword [rsp + 0x98]
call fcn.1802eb1e0
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x98]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x28]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x68], 0xfff
je 0x1800e331f
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
jmp 0x1800e3386
jmp 0x1800e329b
cmp qword [rsp + 0x28], 0
jbe 0x1800e3376
mov rax, qword [rsp + 0x90]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x28]
mov edx, 1
mov rcx, qword [rsp + 0x98]
call fcn.1802eb1e0
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov rdi, rax
mov rcx, rsp
lea rdx, [0x180440af0]
call fcn.180278d80
mov rax, rdi
add rsp, 0x80
pop rdi
ret
Function at 0x18012b740
Capabilities:
Create process on windows
Terminate process

Disassembly:
push rdi
sub rsp, 0xa0
lea rdi, [rsp + 0x30]
mov ecx, 0x1c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x180591580]
xor rax, rsp
mov qword [rsp + 0x98], rax
lea rcx, [0x180605344]
call fcn.180278fb0
lea rcx, [rsp + 0x38]
call fcn.18012bd60
nop
lea rdx, str.SOFTWAREBlizzard_EntertainmentBattle.net
lea rcx, [rsp + 0x68]
call fcn.180037530
mov dword [rsp + 0x20], 0x2011f
lea r9, [rsp + 0x68]
mov r8, 0xffffffff80000001
lea rdx, [rsp + 0x54]
lea rcx, [rsp + 0x38]
call fcn.18012c140
lea rcx, [rsp + 0x68]
call fcn.180038240
nop
lea rcx, [rsp + 0x54]
call fcn.18012bea0
movzx eax, al
test eax, eax
jne 0x18012b83f
mov r9d, gethostbyname
lea r8, [0x18044e5e8]
lea rdx, str.You_need_to_have_BlackOps4_from_Battle.Net_to_use_this_product...
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.http:__battle.net_
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rdx, str.__PLATFORM__:_Couldnt_find_Battle.Net_Launcher__Shutting_down...
mov ecx, 1
call fcn.1800e6f90
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
lea rcx, [rsp + 0x38]
call fcn.18012be50
nop
mov rcx, rsp
lea rdx, [0x1804502e0]
call fcn.180278d80
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1802791f0
add rsp, 0xa0
pop rdi
ret

Function at 0x180130f10
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x60
lea rdi, [rsp + 0x30]
mov ecx, recv
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x70]
lea rcx, [0x180605350]
call fcn.180278fb0
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0x38]
call fcn.180131d50
nop
lea rax, [0x180130cf0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x70]
add rax, 8
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x38]
call fcn.180132870
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x48]
xor edx, edx
xor ecx, ecx
call fcn.1802e5db0
mov rcx, qword [rsp + 0x70]
mov qword [rcx], rax
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
je 0x180130fb8
lea rcx, [rsp + 0x38]
call fcn.180132a30
nop
jmp 0x180130fcf
mov rax, qword [rsp + 0x70]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.180237a60
nop
lea rcx, [rsp + 0x38]
call fcn.1801320a0
nop
mov rcx, rsp
lea rdx, [0x180451000]
call fcn.180278d80
add rsp, 0x60
pop rdi
ret
Function at 0x180132e20
Capabilities:
Hide graphical window

Disassembly:
push rdi
sub rsp, 0x20
lea rcx, [0x18060537f]
call fcn.180278fb0
nop
cmp qword [0x1805af720], 0
je 0x180132ea2
mov rcx, qword [0x1805af720]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x180132ea2
xor edx, edx
mov rcx, qword [0x1805af720]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1805af720]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov qword [0x1805af720], 0
lea rcx, [0x1805af708]
call fcn.18007cda0
movzx eax, al
test eax, eax
je 0x180132e95
lea rcx, [0x1805af708]
call fcn.18007ccf0
nop
mov qword [0x1805af720], 0
jmp 0x180132ec2
lea rcx, [0x1805af708]
call fcn.18007cda0
movzx eax, al
test eax, eax
je 0x180132ec2
lea rcx, [0x1805af708]
call fcn.1801340c0
nop
add rsp, 0x20
pop rdi
ret
Function at 0x180133840
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x60
lea rdi, [rsp + 0x30]
mov ecx, recv
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x70]
lea rcx, [0x180605379]
call fcn.180278fb0
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0x38]
call fcn.180133a80
nop
lea rax, [0x1801337a0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x70]
add rax, 8
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x38]
call fcn.180134150
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x48]
xor edx, edx
xor ecx, ecx
call fcn.1802e5db0
mov rcx, qword [rsp + 0x70]
mov qword [rcx], rax
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
je 0x1801338e8
lea rcx, [rsp + 0x38]
call fcn.180134230
nop
jmp 0x1801338ff
mov rax, qword [rsp + 0x70]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.180237a60
nop
lea rcx, [rsp + 0x38]
call fcn.180133ce0
nop
mov rcx, rsp
lea rdx, [0x180451960]
call fcn.180278d80
add rsp, 0x60
pop rdi
ret
Function at 0x18013e2c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x70
lea rcx, [0x180605416]
call fcn.180278fb0
nop
cmp dword [rsp + 0x88], 0
jne 0x18013e2f1
xor al, al
jmp 0x18013e4c0
mov rax, qword [rsp + 0x80]
mov eax, dword [rax + 0x28]
add eax, dword [rsp + 0x88]
mov eax, eax
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x80]
call fcn.18006a860
shl rax, 3
mov rcx, qword [rsp + 0x48]
cmp rcx, rax
jbe 0x18013e32c
xor al, al
jmp 0x18013e4c0
mov rax, qword [rsp + 0x80]
mov eax, dword [rax + 0x28]
shr eax, 3
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x24], 0
mov rax, qword [rsp + 0x80]
mov rcx, rax
call fcn.180069090
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x30], rax
cmp dword [rsp + 0x88], 0
jbe 0x18013e4be
cmp dword [rsp + 0x88], 8
jae 0x18013e38d
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0x50], eax
jmp 0x18013e395
mov dword [rsp + 0x50], 8
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x38], eax
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
movsx eax, byte [rcx + rax]
and eax, 0xff
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x3c], eax
mov rax, qword [rsp + 0x80]
mov eax, dword [rax + 0x28]
and eax, 7
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
mov ecx, dword [rsp + 0x38]
add ecx, eax
mov eax, ecx
cmp eax, 8
jg 0x18013e421
mov eax, 8
sub eax, dword [rsp + 0x38]
mov ecx, 0xff
mov dword [rsp + 0x58], ecx
movzx ecx, al
mov eax, dword [rsp + 0x58]
sar eax, cl
mov ecx, dword [rsp + 0x40]
mov edx, dword [rsp + 0x3c]
sar edx, cl
mov ecx, edx
and eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov rdx, qword [rsp + 0x30]
mov byte [rdx + rcx], al
jmp 0x18013e47f
mov eax, 8
sub eax, dword [rsp + 0x38]
mov ecx, 0xff
mov dword [rsp + 0x5c], ecx
movzx ecx, al
mov eax, dword [rsp + 0x5c]
sar eax, cl
movsxd rcx, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
movsx ecx, byte [rdx + rcx]
mov dword [rsp + 0x60], ecx
mov edx, 8
sub edx, dword [rsp + 0x40]
movzx ecx, dl
mov edx, dword [rsp + 0x60]
shl edx, cl
mov ecx, edx
and eax, ecx
mov ecx, dword [rsp + 0x40]
mov edx, dword [rsp + 0x3c]
sar edx, cl
mov ecx, edx
or eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov rdx, qword [rsp + 0x30]
mov byte [rdx + rcx], al
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x80]
mov eax, dword [rax + 0x28]
add eax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x80]
mov dword [rcx + 0x28], eax
mov eax, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x88]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x88], eax
jmp 0x18013e368
mov al, 1
add rsp, 0x70
pop rdi
ret