joyce8/EMBER2024-capa huggingface dataset:
Function at 0x462d60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4030cf
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
nop
call fcn.00409820
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460cc0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x4030a0
cmp byte [0x006d9ddf], 0
je 0x462d75
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x45fdc0
jmp 0x4030a0

Function at 0x462d80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x006da180]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x006d9ddf], 0
je 0x462db5
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x006da500]
aesenc xmm0, xmmword [0x006da510]
aesenc xmm0, xmmword [0x006da520]
movq rax, xmm0
ret
jmp 0x409a20

Function at 0x462dc0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x006da180]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x006d9ddf], 0
je 0x462df6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x006da500]
aesenc xmm0, xmmword [0x006da510]
aesenc xmm0, xmmword [0x006da520]
movq rax, xmm0
ret
jmp 0x409a80

Function at 0x464800
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x30
mov rcx, 0xfffffffffffffff4
mov qword [rsp], rcx
mov rax, qword [sym.imp.kernel32.dll_GetStdHandle]
call rax
mov rcx, rax
mov qword [rsp], rcx
lea rdx, [0x006da480]
mov qword [rsp + 8], rdx
lea r8d, [0x006d9dfc]
mov qword [rsp + 0x10], r8
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.kernel32.dll_WriteFile]
call rax
call fcn.00462ca0
add rsp, 0x30
ret

Function at 0x464d40
Capabilities:
Allocate thread local storage

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x464d6c
call fcn.00462ca0
shl rcx, 3
add rcx, 0x1480
mov qword [0x006d9fe0], rcx
ret
Function at 0x4af220
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4af366
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x80], rbx
mov rcx, qword [rax]
mov qword [rsp + 0x18], rcx
movups xmm0, xmmword [rax + 8]
movups xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [rax + 0x18]
movups xmmword [rsp + 0x30], xmm0
lea rax, [rsp + 0x18]
nop
call fcn.004aeec0
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
mov rcx, qword [rsp + 0x18]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x48], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x60], rcx
mov rcx, qword [rsp + 0x80]
xor eax, eax
jmp 0x4af2c0
inc rax
mov rcx, rbx
nop dword [rax + rax]
cmp rax, 5
jge 0x4af303
imul rdx, rax, 0x33
mov rsi, rdx
sar rdx, 0x3f
shr rdx, 0x3d
add rdx, rsi
mov rdi, rdx
and rdx, 0xfffffffffffffff8
sub rsi, rdx
cmp rsi, 0x40
sbb rdx, rdx
mov r8, qword [rsp + rax*8 + 0x40]
mov rbx, rcx
mov rcx, rsi
shl r8, cl
and r8, rdx
mov qword [rsp + 0x10], r8
xor ecx, ecx
jmp 0x4af32c
test byte [rcx], al
mov rax, rcx
mov ebx, 0x20
mov rcx, rbx
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
movzx r8d, byte [rbx + rdi]
or r8d, edx
mov byte [rbx + rdi], r8b
inc rcx
mov rdi, rsi
cmp rcx, 8
jge 0x4af2b5
movzx edx, byte [rsp + rcx + 0x10]
mov rsi, rdi
sar rdi, 3
add rdi, rcx
cmp rdi, 0x20
jge 0x4af2b5
test byte [rbx], al
cmp rdi, 0x20
jb 0x4af31a
mov rax, rdi
mov ecx, 0x20
nop dword [rax + rax]
call fcn.00463320
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460cc0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.004af220
Function at 0x4c3600
Capabilities:
Hash data using sha384
Hash data using sha512

Disassembly:
mov rcx, qword [rax + 0xd0]
cmp rcx, 6
jne 0x4c3685
movabs rcx, 0xcbbb9d5dc1059ed8
mov qword [rax], rcx
movabs rcx, 0x629a292a367cd507
mov qword [rax + 8], rcx
movabs rcx, 0x9159015a3070dd17
mov qword [rax + 0x10], rcx
movabs rcx, 0x152fecd8f70e5939
mov qword [rax + 0x18], rcx
movabs rcx, 0x67332667ffc00b31
mov qword [rax + 0x20], rcx
movabs rcx, 0x8eb44a8768581511
mov qword [rax + 0x28], rcx
movabs rcx, 0xdb0c2e0d64f98fa7
mov qword [rax + 0x30], rcx
movabs rcx, 0x47b5481dbefa4fa4
mov qword [rax + 0x38], rcx
nop dword [rax]
jmp 0x4c37e6
cmp rcx, 0xe
jne 0x4c3700
movabs rcx, 0x8c3d37c819544da2
mov qword [rax], rcx
movabs rcx, 0x73e1996689dcd4d6
mov qword [rax + 8], rcx
movabs rcx, 0x1dfab7ae32ff9c82
mov qword [rax + 0x10], rcx
movabs rcx, 0x679dd514582f9fcf
mov qword [rax + 0x18], rcx
movabs rcx, 0xf6d2b697bd44da8
mov qword [rax + 0x20], rcx
movabs rcx, 0x77e36f7304c48942
mov qword [rax + 0x28], rcx
movabs rcx, 0x3f9d85a86a1d36c8
mov qword [rax + 0x30], rcx
movabs rcx, 0x1112e6ad91d692a1
mov qword [rax + 0x38], rcx
jmp 0x4c37e6
cmp rcx, 0xf
jne 0x4c3777
movabs rcx, 0x22312194fc2bf72c
mov qword [rax], rcx
movabs rcx, 0x9f555fa3c84c64c2
mov qword [rax + 8], rcx
movabs rcx, 0x2393b86b6f53b151
mov qword [rax + 0x10], rcx
movabs rcx, 0x963877195940eabd
mov qword [rax + 0x18], rcx
movabs rcx, 0x96283ee2a88effe3
mov qword [rax + 0x20], rcx
movabs rcx, 0xbe5e1e2553863992
mov qword [rax + 0x28], rcx
movabs rcx, 0x2b0199fc2c85b8aa
mov qword [rax + 0x30], rcx
movabs rcx, 0xeb72ddc81c52ca2
mov qword [rax + 0x38], rcx
jmp 0x4c37e6
movabs rcx, 0x6a09e667f3bcc908
mov qword [rax], rcx
movabs rcx, 0xbb67ae8584caa73b
mov qword [rax + 8], rcx
movabs rcx, 0x3c6ef372fe94f82b
mov qword [rax + 0x10], rcx
movabs rcx, 0xa54ff53a5f1d36f1
mov qword [rax + 0x18], rcx
movabs rcx, 0x510e527fade682d1
mov qword [rax + 0x20], rcx
movabs rcx, 0x9b05688c2b3e6c1f
mov qword [rax + 0x28], rcx
movabs rcx, 0x1f83d9abfb41bd6b
mov qword [rax + 0x30], rcx
movabs rcx, 0x5be0cd19137e2179
mov qword [rax + 0x38], rcx
movups xmmword [rax + 0xc0], xmm15
ret
Function at 0x4d79c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d7b1b
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
movups xmmword [rsp + 0x40], xmm15
mov qword [rsp + 0x30], 0
mov rax, qword [0x006849b0]
call fcn.004b2fc0
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
movups xmmword [rsp + 0x50], xmm15
mov qword [rsp + 0x60], 0
lea rcx, [0x004d7b40]
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x2b
call fcn.00402f00
xorps xmm15, xmm15
mov r14, qword [0x006d9fe0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x18]
cmp rcx, 0xffffffffffffffff
je 0x4d7adb
mov rdx, qword [rsp + 0x28]
cmp rdx, rcx
jb 0x4d7b15
mov qword [rsp + 0x20], rcx
mov rsi, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, rcx
lea rdx, [rsp + 0x50]
call rsi
mov rax, qword [rsp + 0x20]
lea rcx, [rax + 1]
mov rbx, qword [rsp + 0x28]
cmp rbx, rcx
jb 0x4d7b0a
mov rsi, qword [rsp + 0x50]
sub rbx, rax
dec rbx
mov rdi, rbx
neg rbx
sar rbx, 0x3f
and rcx, rbx
mov r8, qword [rsp + 0x38]
lea rax, [r8 + rcx]
mov rbx, rdi
lea rdx, [rsp + 0x50]
nop
call rsi
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
lea rdx, [rsp + 0x50]
call rcx
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rax, rcx
mov rcx, rbx
call fcn.004633e0
call fcn.00463360
nop
nop dword [rax + rax]
call fcn.00460cc0
jmp fcn.004d79c0
Function at 0x4f3340
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x4f35a1
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
test rax, rax
je 0x4f3585
mov qword [rsp + 0xb8], rax
mov rbx, qword [rax + 8]
mov rdx, qword [rax]
mov rcx, qword [rax + 0x10]
test rbx, rbx
jne 0x4f338d
xor ebx, ebx
xor ecx, ecx
jmp 0x4f33a0
mov rax, rdx
call fcn.004e4880
mov rcx, rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x48], rbx
cmp qword [rax + 0x28], 0
je 0x4f34b8
mov rcx, qword [rax + 0x18]
mov rax, rcx
nop
call fcn.004782c0
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0xb8]
mov r8, qword [rcx + 0x20]
mov r9, qword [rcx + 0x28]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x0059edd0]
mov esi, 1
lea rax, [rsp + 0x68]
mov rbx, qword [rsp + 0x88]
call fcn.0044d500
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.00402f00
xorps xmm15, xmm15
mov r14, qword [0x006d9fe0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x4f347b
xor eax, eax
lea rbx, [0x00553202]
mov ecx, 1
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x60]
lea r8, [0x00553292]
mov r9d, 2
mov r10, qword [rsp + 0x98]
mov r11, qword [rsp + 0x58]
call fcn.0044d5e0
jmp 0x4f34a8
xor eax, eax
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x60]
lea rdi, [0x0059ee50]
mov esi, 1
mov r8, qword [rsp + 0x98]
mov r9, qword [rsp + 0x58]
call fcn.0044d500
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov rax, qword [rax + 0x18]
nop dword [rax]
call fcn.004782c0
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsp + 0x88]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 0x3a
call fcn.00402f00
xorps xmm15, xmm15
mov r14, qword [0x006d9fe0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x4f3548
xor eax, eax
lea rbx, [0x00553202]
mov ecx, 1
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x48]
lea r8, [0x00553292]
mov r9d, 2
mov r10, qword [rsp + 0x90]
mov r11, qword [rsp + 0x50]
call fcn.0044d5e0
jmp 0x4f3575
xor eax, eax
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x0059ee50]
mov esi, 1
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x50]
call fcn.0044d500
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
lea rax, [0x0055369b]
mov ebx, 5
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov qword [rsp + 8], rax
call fcn.00460cc0
mov rax, qword [rsp + 8]
jmp fcn.004f3340
Function at 0x4f7a00
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x4f7a18
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x4f7a18
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x4f7a20
xor eax, eax
ret
cmp rbx, 3
je 0x4f7a2c
cmp rbx, 4
jne 0x4f7a59
cmp al, 0x2c
ja 0x4f7a46
lea ecx, [rax - 0x21]
cmp cl, 1
jbe 0x4f7a56
cmp al, 0x24
je 0x4f7a56
nop dword [rax]
cmp al, 0x26
jae 0x4f7a56
jmp 0x4f7a59
lea ecx, [rax - 0x3a]
cmp cl, 4
jbe 0x4f7a56
cmp al, 0x5b
je 0x4f7a56
cmp al, 0x5d
jne 0x4f7a59
xor eax, eax
ret
cmp al, 0x2f
ja 0x4f7a92
nop dword [rax]
cmp al, 0x26
ja 0x4f7a71
cmp al, 0x24
je 0x4f7ab1
cmp al, 0x26
je 0x4f7ab1
jmp 0x4f7b2b
lea ecx, [rax - 0x2b]
cmp cl, 1
jbe 0x4f7ab1
lea ecx, [rax - 0x2d]
nop dword [rax]
cmp cl, 1
jbe 0x4f7b28
cmp al, 0x2f
je 0x4f7ab1
jmp 0x4f7b2b
cmp al, 0x3d
ja 0x4f7aa9
lea ecx, [rax - 0x3a]
cmp cl, 1
jbe 0x4f7ab1
nop
cmp al, 0x3d
je 0x4f7ab1
jmp 0x4f7b2b
lea ecx, [rax - 0x3f]
cmp cl, 1
ja 0x4f7b20
cmp rbx, 2
jg 0x4f7ae7
cmp rbx, 1
je 0x4f7ae1
nop dword [rax]
cmp rbx, 2
jne 0x4f7b2b
cmp al, 0x2f
je 0x4f7ad2
cmp al, 0x3b
je 0x4f7ad2
cmp al, 0x2c
jne 0x4f7ad9
mov ecx, 1
jmp 0x4f7ade
cmp al, 0x3f
sete cl
mov eax, ecx
ret
cmp al, 0x3f
sete al
ret
cmp rbx, 5
jne 0x4f7b0a
cmp al, 0x40
je 0x4f7af9
cmp al, 0x2f
je 0x4f7af9
cmp al, 0x3f
jne 0x4f7b02
mov ecx, 1
nop
jmp 0x4f7b07
cmp al, 0x3a
sete cl
mov eax, ecx
ret
cmp rbx, 6
je 0x4f7b19
cmp rbx, 7
jne 0x4f7b2b
xor eax, eax
ret
mov eax, 1
ret
cmp al, 0x5f
je 0x4f7b28
cmp al, 0x7e
jne 0x4f7b2b
xor eax, eax
ret
cmp rbx, 7
jne 0x4f7b41
cmp al, 0x21
je 0x4f7b3d
lea ecx, [rax - 0x28]
cmp cl, 2
ja 0x4f7b41
xor eax, eax
nop
ret
mov eax, 1
ret
Function at 0x180023e40
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
imul ebp, ecx, 0x2e9
mov esi, ecx
mov edi, ecx
cmp ecx, ebp
ja 0x180023e8c
xor r14d, r14d
cmp edi, 0x36
je 0x180023f13
cmp edi, 0xd2
je 0x180023eb7
cmp edi, 0x7b0c
je 0x180023eae
cmp edi, 0xf546
je 0x180023ea4
cmp edi, 0x16f80
jne 0x180023efe
mov rax, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov dword [rsp + 0x48], 1
jmp 0x180023efe
mov byte [0x180184338], 1
jmp 0x180023efe
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x18018433c], eax
cmp eax, 0xffffffff
jne 0x180023efe
mov ebx, 0x126
nop dword [rax]
mov eax, ebx
sub eax, 0x125
je 0x180023e8c
cmp eax, 1
jne 0x180023ef4
lea rdx, str.System.Reflection.RuntimeAssembly
mov ecx, 0x10008
call fcn.180025af0
mov dword [rsp + 0x48], r14d
dec ebx
cmp ebx, 0x124
ja 0x180023ed0
imul eax, esi, 0x95
add edi, eax
cmp edi, ebp
jbe 0x180023e63
jmp 0x180023e8c
mov rax, qword [0x1801d8150]
jmp 0x180023e91
Function at 0x18009cb10
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov rbx, qword [rsp + 0x78]
lea r15d, [r8 + 4]
mov edi, r8d
mov r14, rdx
mov rbp, rcx
cmp r8d, r15d
jae 0x18009cc1b
mov rsi, qword [rsp + 0x78]
xor r12d, r12d
nop dword [rax]
mov eax, edi
sub eax, 0xfd
je 0x18009cbfd
sub eax, 1
je 0x18009cbd3
sub eax, 3
je 0x18009cb91
cmp eax, 1
jne 0x18009cc10
mov eax, 0xcc
cmp eax, 0xcc
je 0x18009cc35
add eax, 0x4488
cmp eax, 0x4488
jbe 0x18009cb75
jmp 0x18009cc10
mov dword [rsp + 0x28], 0x92
xor r9d, r9d
mov r8, rbp
mov qword [rsp + 0x20], r12
xor edx, edx
xor ecx, ecx
call fcn.180044830
xor r9d, r9d
mov dword [rsp + 0x28], 0x92
mov r8, rbp
mov dword [rsp + 0x78], eax
xor edx, edx
mov qword [rsp + 0x20], r12
xor ecx, ecx
call fcn.180044830
mov dword [rsp + 0x7c], eax
jmp 0x18009cc10
cmp qword [rsi], r12
jne 0x18009cc40
mov ecx, 0xed
nop dword [rax]
mov eax, ecx
sub eax, 0xec
je 0x18009cc1b
cmp eax, 1
jne 0x18009cbf1
mov rbx, r12
dec ecx
cmp ecx, 0xeb
ja 0x18009cbe0
jmp 0x18009cc10
mov rsi, r14
test r14, r14
jne 0x18009cc09
lea rsi, [rbp + 0x30]
mov rax, qword [rbp + 8]
mov qword [rsi], rax
inc edi
cmp edi, r15d
jb 0x18009cb50
mov rax, rbx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov rax, qword [rsp + 0x78]
jmp 0x18009cc1e
mov rax, qword [rsi]
add rax, 0x10
jmp 0x18009cc1e

Function at 0x1800a2950
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
imul r14d, r8d, 0x126
mov ebp, r8d
mov rdi, rdx
mov rsi, rcx
mov ebx, r8d
cmp r8d, r14d
ja 0x1800a2a66
mov qword [rsp + 0x50], r15
xor r15d, r15d
cmp ebx, 0x22
je 0x1800a29de
cmp ebx, 0xda
je 0x1800a29ab
cmp ebx, 0x544e
jne 0x1800a2a53
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, rsi
lea rdx, [0x18016bffc]
mov rcx, rax
call fcn.18015ba50
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
jmp 0x1800a2a53
xor r9d, r9d
mov qword [rsp + 0x20], r15
mov r8, rsi
mov edx, 0xc9
xor ecx, ecx
call fcn.1800966f0
test eax, eax
jne 0x1800a2a53
nop dword [rax]
movzx eax, byte [rdi]
lea r8, [rsp + 0x60]
xor r9d, r9d
mov byte [rsp + 0x60], al
mov edx, 0x8a
xor ecx, ecx
call fcn.18000ddb0
test eax, eax
je 0x1800a2a53
mov r9d, 0xdd
mov qword [rsp + 0x20], r15
mov r8, rsi
xor edx, edx
xor ecx, ecx
call fcn.180141cf0
xor r9d, r9d
mov byte [rdi], al
mov r8, rsi
mov qword [rsp + 0x20], r15
mov edx, 0xc9
xor ecx, ecx
call fcn.1800966f0
test eax, eax
je 0x1800a2a00
imul eax, ebp, 0x62
add ebx, eax
cmp ebx, r14d
jbe 0x1800a2986
mov r15, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x1800a47e0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
imul r12d, edx, 0x436
mov r14, r8
mov r15d, edx
mov r13, rcx
mov esi, edx
cmp edx, r12d
ja 0x1800a494c
mov edi, dword [rsp + 0x68]
xor ebp, ebp
mov edx, dword [rsp + 0x68]
cmp esi, 0x9d6c
ja 0x1800a4909
je 0x1800a4900
cmp esi, 0x25
je 0x1800a488d
cmp esi, 0x59
je 0x1800a487a
cmp esi, 0x104
jne 0x1800a493a
cmp qword [0x1801d5a20], rbp
jne 0x1800a493a
mov r9d, dword [r13]
lea rdx, str.Server.prototype._getServerData__function___
mov r8, r14
mov ecx, 1
call fcn.1801205a0
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rax, qword [r14 + 0xc8]
mov qword [r14 + 0xb8], rax
jmp 0x1800a493a
mov rax, qword [r14]
cmp rax, 0x40
jbe 0x1800a4980
mov ebx, 0xa2
nop
mov eax, ebx
sub eax, 0x9f
je 0x1800a496d
sub eax, 1
je 0x1800a48ed
sub eax, 1
je 0x1800a48e4
cmp eax, 1
jne 0x1800a48f4
mov edi, dword [r14]
lea rdx, [rsp + 0x68]
dec edi
mov qword [rsp + 0x20], rbp
xor r9d, r9d
mov dword [rsp + 0x68], edi
xor r8d, r8d
mov ecx, 0xb6
call fcn.180027f00
lea edx, [rax - 3]
jmp 0x1800a48f4
mov ecx, edx
shr edi, cl
add edx, 0xfffffffd
jmp 0x1800a48f4
lea edx, [rdx*4]
dec ebx
cmp ebx, 0x9e
ja 0x1800a48a0
jmp 0x1800a493a
mov byte [0x1801d4eeb], 1
jmp 0x1800a493a
cmp esi, 0x139d4
je 0x1800a492c
cmp esi, 0x1d63c
je 0x1800a4923
cmp esi, 0x272a4
je 0x1800a4990
jmp 0x1800a493a
mov qword [0x1801d5a60], rbp
jmp 0x1800a493a
mov qword [0x1801d4e78], rbp
mov byte [0x1801d4ee9], bpl
imul eax, r15d, 0x9a
add esi, eax
cmp esi, r12d
jbe 0x1800a4821
mov eax, dword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea eax, [rdx + rdi]
jmp 0x1800a4950
test rax, rax
setne bpl
sub rax, rbp
shr rax, 3
jmp 0x1800a4950
mov rcx, qword [0x1801d5a20]
mov edx, 0xffffffff
call sub.VCRUNTIME140.dll_longjmp
int3
Function at 0x1800afe10
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov esi, dword [rsp + 0xa0]
mov r15, r9
mov r14, r8
mov r13, rdx
lea ebx, [rsi + 0xa14]
mov dword [rsp + 0x40], ebx
cmp esi, ebx
mov rbx, qword [rsp + 0x48]
jae 0x1800afeda
mov r12, qword [rsp + 0xa8]
xor edi, edi
mov ebp, dword [rsp + 0xa0]
mov eax, dword [rsp + 0x40]
nop dword [rax]
cmp esi, 0x1da
ja 0x1800afffa
je 0x1800affb6
cmp esi, 0xc5
ja 0x1800aff8c
je 0x1800aff77
mov eax, esi
sub eax, 0x2f
je 0x1800afefb
sub eax, 0x1f
je 0x1800afeb8
cmp eax, 0x34
mov eax, dword [rsp + 0x40]
jne 0x1800afed0
mov ebp, dword [r13]
imul ebp, dword [r15]
imul ebp, dword [r12]
jmp 0x1800afed0
mov ecx, dword [r14]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rcx, qword [rsp + 0x80]
mov eax, dword [rsp + 0x40]
add esi, 0xac
cmp esi, eax
jb 0x1800afe70
mov rax, rbx
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
cmp qword [r12], rdi
jbe 0x1800aff08
movzx eax, byte [r15 + 1]
jmp 0x1800aff0a
xor al, al
mov byte [rsp + 0x30], al
lea r9, [rsp + 0xa0]
movzx eax, byte [r13]
lea r8, [rsp + 0x30]
mov byte [rsp + 0xa0], al
lea rdx, [rsp + 0x38]
lea rax, [rcx + 4]
mov qword [rsp + 0x28], r14
mov ecx, 0x7f
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x38], 0x64
call fcn.180025bf0
test eax, eax
jne 0x1800aff6f
lea r9, str.quot_
mov qword [rsp + 0x48], 6
mov r8, r14
lea rdx, [rsp + 0x48]
mov ecx, 0xd6
call fcn.180158020
mov rbx, rdi
jmp 0x1800afec4
cmp byte [0x1801d9019], dil
jne 0x1800afed0
mov rax, rdi
jmp 0x1800afedd
mov eax, esi
sub eax, 0xdb
je 0x1800afeda
sub eax, 0x1f
je 0x1800afeda
cmp eax, 0x77
jne 0x1800afecc
call qword [0x1801d8ff0]
jmp 0x1800afec1
cmp qword [r14], rdi
je 0x1800afed0
movzx eax, byte [r14 + 0x18]
cmp byte [rcx], al
jne 0x1800afecc
mov eax, dword [r14 + 0xc]
cmp dword [r13], eax
jne 0x1800afecc
mov eax, dword [r14 + 0x10]
cmp dword [r15], eax
jne 0x1800afecc
mov eax, dword [r14 + 0x14]
cmp dword [r12], eax
je 0x1800afeda
jmp 0x1800afecc
cmp esi, 0x3de
ja 0x1800b008d
je 0x1800b0079
mov eax, esi
sub eax, 0x21d
je 0x1800afeda
sub eax, 0x69
je 0x1800b005f
cmp eax, 0xac
jne 0x1800afecc
movzx eax, byte [rcx]
lea r9, [rsp + 0xa0]
xor ecx, ecx
mov byte [rsp + 0xa0], al
xor r8d, r8d
mov dword [rsp + 0x20], 0x92
xor edx, edx
call fcn.180075f40
imul eax, ebp
movsxd rcx, eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [r14], rax
jmp 0x1800afec4
mov rcx, qword [r14]
test rcx, rcx
je 0x1800afec4
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [r14], rdi
jmp 0x1800afec4
movzx eax, byte [rcx]
mov byte [r14 + 0x18], al
mov eax, dword [r13]
mov dword [r14 + 0xc], eax
jmp 0x1800afecc
cmp esi, 0x48a
je 0x1800b00aa
cmp esi, 0x536
jne 0x1800afed0
mov dword [r14 + 8], ebp
jmp 0x1800afed0
mov eax, dword [r15]
mov dword [r14 + 0x10], eax
mov eax, dword [r12]
mov dword [r14 + 0x14], eax
jmp 0x1800afecc
Function at 0x1801205a0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x380]
sub rsp, 0x480
mov rax, qword [0x180183c70]
xor rax, rsp
mov qword [rbp + 0x370], rax
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x447349
dec rdx
movzx edi, cl
cmp byte [rdx + 1], 0
lea rdx, [rdx + 1]
jne 0x1801205e5
movzx eax, word [0x180165ff8]
mov word [rdx], ax
mov eax, 0x62
mov word [rsp + 0x34], ax
mov eax, dword [str.uggerP]
mov dword [rsp + 0x35], eax
movzx eax, word [0x18016f4a4]
mov word [rsp + 0x39], ax
movzx eax, byte [0x18016f4a6]
mov byte [rsp + 0x3b], al
lea rax, [rsp + 0x30]
dec rax
nop dword [rax]
cmp byte [rax + 1], 0
lea rax, [rax + 1]
jne 0x180120630
movzx ecx, word [0x18016f4a8]
mov word [rax], cx
movzx ecx, byte [0x18016f4aa]
mov byte [rax + 2], cl
lea rcx, [rsp + 0x30]
movzx eax, word [0x18016c568]
dec rcx
mov word [rsp + 0x3d], ax
movzx eax, byte [0x18016c56a]
mov byte [rsp + 0x3f], al
nop dword [rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x180120670
movzx eax, word [0x18016f4ac]
lea rdx, [0x180165b38]
movsd xmm0, qword [str.kern]
mov r8d, 4
mov word [rcx], ax
movzx eax, byte [0x18016f4ae]
mov byte [rcx + 2], al
lea rcx, [rsp + 0x50]
movzx eax, word [0x18016f4b8]
mov word [rsp + 0x50], ax
movsd qword [rsp + 0x48], xmm0
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov eax, dword [0x1801667e0]
lea rdx, [0x1801655b0]
mov dword [rsp + 0x56], eax
lea rcx, [rsp + 0x48]
movzx eax, word [0x1801667e4]
mov r8d, 1
mov word [rsp + 0x5a], ax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov eax, dword [0x18016583c]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x5c], eax
lea rcx, [rsp + 0x48]
movzx eax, word [0x180165840]
mov r9d, 0x110
xor r8d, r8d
mov word [rsp + 0x60], ax
call fcn.18002fce0
mov rbx, rax
call fcn.18015b7e0
mov r9, qword [rbp + 0x3a8]
lea rdx, [rsp + 0x70]
mov r8d, 0x400
mov rcx, qword [rax]
lea rax, [rbp + 0x3b0]
mov qword [rsp + 0x28], rax
or rcx, 2
mov qword [rsp + 0x20], 0
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vsprintf]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [0x1801688fc]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test dil, dil
je 0x180120781
call rbx
test eax, eax
je 0x180120781
call qword [sym.imp.KERNEL32.dll_DebugBreak]
mov rcx, qword [rbp + 0x370]
xor rcx, rsp
call fcn.18015c4c0
add rsp, 0x480
pop rdi
pop rbx
pop rbp
ret