joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001ed84
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x180031010]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov dword [rbp - 0x20], 0x65536c61
mov dword [rbp - 0x1a], 0x6e6f69
mov dword [rbp - 0x2a], 0x657a696c
mov dword [rbp - 0x2e], 0x61697469
mov word [rbp - 0x1c], 0x7463
mov word [rbp - 0x25], 0x6972
mov word [rbp - 0x30], 0x6e49
mov word [rbp - 0x22], 0x6369
mov byte [rbp - 0x26], 0x43
mov byte [rbp - 0x23], 0x74
call fcn.18001f520
mov rcx, rax
lea rdx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001edf7
lea rcx, [0x18005cb28]
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180001600
add rsp, 0x50
pop rbp
ret

Function at 0x18001f0cc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180031010]
xor rax, rsp
mov qword [rbp - 8], rax
mov r14, r8
mov word [rbp - 0x12], 0x6e6f
mov rsi, rdx
mov dword [rbp - 0x17], 0x74637572
mov rdi, rcx
mov word [rbp - 0xf], 0x6361
xor ebx, ebx
mov word [rbp - 0x1a], 0x736e
mov word [rbp - 0xc], 0x65
mov byte [rbp - 0x10], 0x43
mov dword [rbp - 0x1f], 0x6873756c
mov byte [rbp - 0x18], 0x74
mov byte [rbp - 0x20], 0x46
mov byte [rbp - 0xd], 0x68
mov byte [rbp - 0x1b], 0x49
mov byte [rbp - 0x13], 0x69
call fcn.18001f520
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001f155
mov r8, r14
mov rdx, rsi
mov rcx, rdi
call rax
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180001600
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x18001f24c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180031010]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, rdx
mov word [rbp - 0x19], 0x4e32
mov rdi, rcx
mov word [rbp - 0x1c], 0x6461
xor ebx, ebx
mov dword [rbp - 0x17], 0x747865
mov byte [rbp - 0x1a], 0x33
mov word [rbp - 0x1f], 0x7268
mov byte [rbp - 0x1d], 0x65
mov byte [rbp - 0x20], 0x54
call fcn.18001f520
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001f2b7
mov rdx, rsi
mov rcx, rdi
call rax
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180001600
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x18001f740
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rax, qword [0x180031010]
xor rax, rsp
mov qword [rbp + 0x90], rax
cmp edx, 1
jne 0x18001f9a4
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x1b8], rdi
mov word [rsp + 0x39], 0x6946
mov dword [rsp + 0x34], 0x6c75646f
mov dword [rsp + 0x30], 0x4d746547
mov word [rsp + 0x3e], 0x6d61
mov byte [rsp + 0x38], 0x65
mov word [rsp + 0x41], 0x41
mov word [rsp + 0x3c], 0x4e65
mov byte [rsp + 0x3b], 0x6c
mov byte [rsp + 0x40], 0x65
mov dword [rsp + 0x27], 0x6c642e32
mov word [rsp + 0x2b], 0x6c
mov dword [rsp + 0x21], 0x656e7265
mov word [rsp + 0x25], 0x336c
mov byte [rsp + 0x20], 0x4b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001f7fd
mov r8d, 0x104
lea rdx, [rbp - 0x80]
xor ecx, ecx
call rax
mov edx, 0x104
mov qword [rsp + 0x1b0], rbx
lea rcx, [rbp - 0x80]
call fcn.180009760
xor edi, edi
mov dword [rsp + 0x6e], 0x75732074
lea rcx, [rsp + 0x58]
mov byte [rsp + 0x2b], dil
mov byte [rsp + 0x3c], dil
mov dword [rsp + 0x74], 0x74726f
mov dword [rsp + 0x69], 0x6174736e
mov word [rsp + 0x72], 0x7070
mov byte [rsp + 0x68], 0x69
mov byte [rsp + 0x6d], 0x6e
mov dword [rsp + 0x20], 0x776c6853
mov dword [rsp + 0x24], 0x2e697061
mov word [rsp + 0x29], 0x6c6c
mov byte [rsp + 0x28], 0x64
mov word [rsp + 0x3a], 0x4179
mov dword [rsp + 0x35], 0x61726269
mov dword [rsp + 0x30], 0x64616f4c
mov byte [rsp + 0x39], 0x72
mov byte [rsp + 0x34], 0x4c
mov dword [rsp + 0x5f], 0x6c642e32
mov word [rsp + 0x63], 0x6c
mov dword [rsp + 0x59], 0x656e7265
mov word [rsp + 0x5d], 0x336c
mov byte [rsp + 0x58], 0x4b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001f91f
lea rcx, [rsp + 0x20]
call rax
mov rbx, rax
test rax, rax
je 0x18001f91f
lea rdx, [rsp + 0x48]
mov dword [rsp + 0x4d], 0x414972
mov rcx, rax
mov word [rsp + 0x4b], 0x7453
mov word [rsp + 0x48], 0x7453
mov byte [rsp + 0x4a], 0x72
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001f911
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x80]
call rax
mov rdi, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test rdi, rdi
jne 0x18001f977
lea rdx, [sym.gphelper.dll_czvg3o]
lea rcx, [0x18005c900]
call fcn.180021868
test eax, eax
je 0x18001f977
lea rdx, [sym.gphelper.dll_rtx62k]
lea rcx, [0x18005c868]
call fcn.180021868
test eax, eax
je 0x18001f977
lea rdx, [sym.gphelper.dll_eu8d1z]
lea rcx, [0x18005c8d0]
call fcn.180021868
test eax, eax
je 0x18001f977
lea rdx, [sym.gphelper.dll_c3htpc]
lea rcx, [0x18005c8b8]
call fcn.180021868
mov rbx, qword [rsp + 0x1b0]
mov eax, 1
mov rdi, qword [rsp + 0x1b8]
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.180001600
add rsp, 0x1a0
pop rbp
ret
test edx, edx
jne 0x18001f9d8
lea rcx, [0x18005c900]
call fcn.180021acc
lea rcx, [0x18005c868]
call fcn.180021acc
lea rcx, [0x18005c8d0]
call fcn.180021acc
lea rcx, [0x18005c8b8]
call fcn.180021acc
mov eax, 1
jmp 0x18001f98c
Function at 0x14000ae90
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, 0x28
call fcn.14005c970
sub rsp, rax
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x14000aed0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, 0x28
call fcn.14005c970
sub rsp, rax
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x14000aef0
Capabilities:
Set thread local storage value

Disassembly:
mov eax, 0x28
call fcn.14005c970
sub rsp, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
neg eax
sbb eax, eax
neg eax
dec eax
add rsp, 0x28
ret

Function at 0x14000c420
Capabilities:
Hash data using fnv

Disassembly:
mov eax, 0x18
call fcn.14005c970
sub rsp, rax
mov rax, qword [0x1400dc160]
xor rax, rsp
mov qword [rsp + 8], rax
mov r10, r9
mov r11, rcx
mov r9d, edx
test edx, edx
jne 0x14000c45d
xor eax, eax
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.14005c600
add rsp, 0x18
ret
mov rcx, qword [r8]
xor edx, edx
mov qword [rsp], rcx
movzx eax, byte [rsp + 1]
movzx r8d, cl
xor r8d, 0x811c9dc5
imul r8d, r8d, 0x1000193
xor r8d, eax
movzx eax, byte [rsp + 2]
imul r8d, r8d, 0x1000193
xor r8d, eax
movzx eax, byte [rsp + 3]
imul r8d, r8d, 0x1000193
xor r8d, eax
movzx eax, byte [rsp + 4]
imul r8d, r8d, 0x1000193
xor r8d, eax
movzx eax, byte [rsp + 5]
imul r8d, r8d, 0x1000193
xor r8d, eax
movzx eax, byte [rsp + 6]
imul r8d, r8d, 0x1000193
xor r8d, eax
movzx eax, byte [rsp + 7]
imul r8d, r8d, 0x1000193
xor r8d, eax
imul r8d, r8d, 0x1000193
mov eax, r8d
div r9d
mov rax, qword [r11 + rdx*8]
lea rdx, [r11 + rdx*8]
test rax, rax
je 0x14000c505
cmp qword [rax + 8], rcx
je 0x14000c505
mov rdx, rax
mov rax, qword [rax]
test rax, rax
jne 0x14000c4f4
test r10, r10
je 0x14000c50d
mov dword [r10], r8d
mov rax, rdx
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.14005c600
add rsp, 0x18
ret
Function at 0x14000d010
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
mov eax, 0x20
call fcn.14005c970
sub rsp, rax
xor ebx, ebx
mov rsi, rcx
mov ebp, ebx
test rcx, rcx
je 0x14000d0f7
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
or rcx, 0xffffffffffffffff
mov rdi, rsi
mov r12d, eax
xor eax, eax
repne scasw ax, word [rdi]
not rcx
lea rdx, [rcx - 1]
lea ecx, [r12 + 1]
add rdx, rcx
lea ecx, [rbx + 0x40]
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbp, rax
test rax, rax
je 0x14000d0fa
mov edx, r12d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea ecx, [rax - 1]
cmp word [rbp + rcx*2], 0x5c
je 0x14000d0a4
mov ecx, eax
mov edx, 0x5c
inc eax
mov word [rbp + rcx*2], dx
or rcx, 0xffffffffffffffff
movsxd r8, eax
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
dec rcx
je 0x14000d0f7
add r8, r8
mov rdx, rsi
sub r8, rsi
add r8, rbp
nop word [rax + rax]
movzx eax, word [rdx]
or rcx, 0xffffffffffffffff
inc ebx
mov word [r8 + rdx], ax
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
mov eax, ebx
add rdx, 2
not rcx
dec rcx
cmp rax, rcx
jb 0x14000d0d0
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret

Function at 0x14000d2a0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x20
call fcn.14005c970
sub rsp, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, 0x40
mov edx, eax
mov edi, eax
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x14000d30b
mov edx, edi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x14000d300
cmp edi, eax
jb 0x14000d300
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14000f7a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x30
call fcn.14005c970
sub rsp, rax
mov rdi, rcx
xor ecx, ecx
xor esi, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rdi, rdi
je 0x14000f9a2
mov rcx, rdi
call fcn.14000d1d0
test eax, eax
jne 0x14000f9a2
mov rcx, rdi
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
call fcn.14000f520
mov rbp, rax
test rax, rax
je 0x14000f8cd
mov qword [rsp + 0x50], r12
call fcn.14000d2a0
mov r12, rax
test rax, rax
je 0x14000f8ba
mov rcx, rbp
call fcn.14000d1d0
test eax, eax
je 0x14000f8a3
lea rax, str.system32_
lea rbx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
lea rax, str.SystemRoot_system32_
mov qword [rsp + 0x28], rax
nop word [rax + rax]
mov rdx, qword [rbx]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdi, [rcx - 1]
mov rcx, rbp
call fcn.14008ca98
test eax, eax
je 0x14000f876
lea rax, [rsp + 0x30]
add rbx, 8
cmp rbx, rax
jb 0x14000f840
jmp 0x14000f886
lea rdx, [rbp + rdi*2]
mov rcx, r12
call fcn.14000f1d0
mov rsi, rax
lea rax, [rsp + 0x30]
cmp rbx, rax
jne 0x14000f8b1
mov rcx, rbp
call fcn.14000d240
test eax, eax
je 0x14000f8b1
mov rsi, rbp
xor ebp, ebp
jmp 0x14000f8b1
mov rdx, rbp
mov rcx, r12
call fcn.14000f1d0
mov rsi, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r12, qword [rsp + 0x50]
jmp 0x14000f96e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7e
jne 0x14000f977
mov rcx, rdi
call fcn.14000e420
mov rbx, rax
test rax, rax
je 0x14000f977
mov ecx, 0x37e4
call fcn.14000e010
test eax, eax
je 0x14000f90c
lea rcx, [0x1400b22d8]
call fcn.14000ef00
jmp 0x14000f911
call fcn.14000d2a0
mov rdi, rax
test rax, rax
je 0x14000f965
mov rdx, rbx
mov rcx, rax
call fcn.14000f1d0
mov rsi, rax
test rax, rax
je 0x14000f95c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000f93e
test al, 0x50
je 0x14000f95c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x14000f951
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor esi, esi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rsi, rsi
je 0x14000f977
xor ecx, ecx
jmp 0x14000f984
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14000f98a
lea ecx, [rax + 0x7e]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov ecx, 0xa0
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rsi, qword [rsp + 0x58]
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x140013b90
Capabilities:
Manipulate console buffer

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1400dc160]
xor rax, rsp
mov qword [rsp + 0x40], rax
and dword [rcx + 0x58], 0xfffffeff
mov rbx, rcx
sub dword [rcx + 0x7c], 1
mov eax, dword [rcx + 0x58]
jne 0x140013bd1
test al, 1
jne 0x140013bd1
test al, 0x40
je 0x140013bd1
and eax, 0xffffffbf
mov dword [rcx + 0x58], eax
test al, 0x20
je 0x140013bd1
mov rax, qword [rcx + 8]
dec dword [rax + 8]
mov eax, dword [rcx + 0x58]
bt eax, 0x11
jae 0x140013c3e
bt eax, 0x19
jae 0x140013c28
mov rcx, qword [rcx + 0x110]
lea r9, [rsp + 0x20]
xor eax, eax
lea rdx, [rsp + 0x28]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], eax
lea r8d, [rax + 1]
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
test eax, eax
jne 0x140013c3e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14005c600
add rsp, 0x50
pop rbx
ret
bt eax, 0x16
jb 0x140013c3e
call fcn.140013c60
test eax, eax
jne 0x140013c40
or dword [rbx + 0x58], 0x400000
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14005c600
add rsp, 0x50
pop rbx
ret

Function at 0x140013c60
Capabilities:
Log keystrokes
Manipulate console buffer

Disassembly:
push rbp
push rdi
sub rsp, 0x78
mov rax, qword [0x1400dc160]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbp, rcx
or edx, 0xffffffff
mov rcx, qword [0x1400e4ad8]
xor edi, edi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140013dc3
mov eax, 2
mov qword [rsp + 0xa0], rsi
xchg dword [0x1400e483c], eax
cmp eax, 1
je 0x140013ccd
mov rcx, qword [0x1400e4ad8]
lea edx, [rdi + 1]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
je 0x140013dc9
xor eax, eax
jmp 0x140013da7
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x98], rbx
lea rcx, str.conout_
mov dword [rsp + 0x28], 0x80
mov edx, 0xc0000000
mov qword [rsp + 0x70], r14
lea r8d, [r9 + 3]
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140013d2d
lea rdx, [0x1400e4ac0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x140013d2d
lock or dword [0x1400e4abc], 1
mov esi, 1
mov dword [rsp + 0x50], 0xd0001
mov r14d, select
mov word [rsp + 0x48], si
mov ecx, r14d
mov dword [rsp + 0x4c], esi
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov rcx, qword [rbp + 0x110]
lea r9, [rsp + 0x40]
mov r8d, esi
mov word [rsp + 0x54], ax
lea rdx, [rsp + 0x48]
mov word [rsp + 0x56], r14w
mov dword [rsp + 0x58], edi
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov r14, qword [rsp + 0x70]
test eax, eax
jne 0x140013d8e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp rbx, 0xffffffffffffffff
je 0x140013d9d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x98]
mov eax, edi
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14005c600
add rsp, 0x78
pop rdi
pop rbp
ret
call fcn.14008a194
int3
call fcn.14008a194
int3
Function at 0x140013e20
Capabilities:
Manipulate console buffer

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x1400dc160]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r14, qword [rsp + 0xb8]
mov esi, r9d
movzx ebp, r8b
mov edi, edx
mov rbx, rcx
cmp dword [r14], 0
je 0x140013e5c
or eax, 0xffffffff
jmp 0x140013f83
mov qword [rsp + 0x58], r12
xor r12d, r12d
mov qword [rsp + 0x50], r15
movzx r15d, byte [rsp + 0xb0]
mov rcx, qword [rbx + 0x110]
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
jne 0x140013e91
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [r14], eax
movsx eax, word [rsp + 0x34]
mov edx, edi
movsx r8d, word [rsp + 0x38]
movsx r11d, word [rsp + 0x28]
sub r8d, eax
mov eax, dword [0x1400dcdd4]
inc r8d
movsx r9d, word [rsp + 0x2e]
mov dword [0x1400dcdbc], r11d
mov dword [0x1400dcdd0], r8d
cmp eax, 0xffffffff
jne 0x140013ece
mov eax, r9d
jmp 0x140013edb
mov ecx, r9d
sub ecx, r8d
inc ecx
cmp eax, ecx
cmovl eax, ecx
movsx r10d, word [rsp + 0x2a]
lea ecx, [r8 + rax]
cmp ecx, r10d
jle 0x140013ef0
mov eax, r10d
sub eax, r8d
test eax, eax
lea ecx, [r9 + rsi]
cmovs eax, r12d
mov dword [0x1400dcdd4], eax
test r15b, r15b
jne 0x140013f08
lea ecx, [rax + rsi]
cmp ecx, eax
jge 0x140013f10
mov ecx, eax
jmp 0x140013f1d
lea r9d, [r8 + rax]
cmp ecx, r9d
jl 0x140013f1d
lea ecx, [r9 - 1]
test bpl, bpl
je 0x140013f29
movsx edx, word [rsp + 0x2c]
add edx, edi
test edx, edx
jns 0x140013f32
mov edx, r12d
jmp 0x140013f3b
cmp edx, r11d
jl 0x140013f3b
lea edx, [r11 - 1]
mov word [rsp + 0x22], cx
mov rcx, qword [rbx + 0x110]
mov word [rsp + 0x20], dx
mov edx, dword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
test eax, eax
jne 0x140013f77
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
je 0x140013e72
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [r14], eax
or eax, 0xffffffff
jmp 0x140013f79
xor eax, eax
mov r12, qword [rsp + 0x58]
mov r15, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14005c600
add rsp, 0x60
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140013fa0
Capabilities:
Manipulate console buffer

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x1400dc160]
xor rax, rsp
mov qword [rsp + 0x50], rax
movzx ebp, word [reloc.WS2_32.dll_getsockopt]
xor r14d, r14d
mov rsi, rdx
mov rdi, rcx
mov dword [rsp + 0x30], r14d
cmp dword [rdx], r14d
jne 0x140013ff2
mov rcx, qword [rcx + 0x110]
movzx edx, bp
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
test eax, eax
jne 0x140013ffa
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
or eax, 0xffffffff
jmp 0x1400140ac
mov rcx, qword [rdi + 0x110]
mov qword [rsp + 0x90], rbx
mov ebx, dword [rsp + 0x30]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
test eax, eax
je 0x140014099
nop dword [rax]
mov rcx, qword [rdi + 0x110]
lea rdx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x140014099
movsx eax, word [rsp + 0x38]
mov edx, 0x20
movsx r8d, word [rsp + 0x3a]
mov r9d, ebx
mov rcx, qword [rdi + 0x110]
imul r8d, eax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
test eax, eax
je 0x14001408e
mov r8d, dword [rsp + 0x34]
lea rax, [rsp + 0x34]
mov rcx, qword [rdi + 0x110]
mov r9d, ebx
movzx edx, bp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
test eax, eax
jne 0x1400140ca
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
je 0x140014020
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
or eax, 0xffffffff
mov rbx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14005c600
mov rbp, qword [rsp + 0x98]
add rsp, 0x60
pop r14
pop rdi
pop rsi
ret
movsx eax, word [rsp + 0x38]
mov ecx, r14d
movsx edx, word [rsp + 0x48]
movsx r8d, word [rsp + 0x3a]
mov dword [0x1400dcdbc], eax
movsx eax, word [rsp + 0x44]
sub edx, eax
movsx eax, word [rsp + 0x3e]
inc edx
sub eax, edx
mov dword [0x1400dcdd0], edx
inc eax
test eax, eax
cmovg ecx, eax
lea eax, [rdx + rcx]
cmp eax, r8d
jle 0x14001410d
mov ecx, r8d
sub ecx, edx
test ecx, ecx
cmovs ecx, r14d
xor eax, eax
mov dword [0x1400dcdd4], ecx
jmp 0x1400140a4
Function at 0x140014860
Capabilities:
Manipulate console buffer

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x70
mov rax, qword [0x1400dc160]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp dword [r8], 0
mov rsi, r8
movzx r14d, dl
mov rbx, rcx
je 0x140014890
or eax, 0xffffffff
jmp 0x140014a07
test dword [rcx + 0x58], 0x4000000
mov qword [rsp + 0x98], rbp
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x60], r15
je 0x1400149a7
movsx ebp, word [rcx + 0x12a]
xor r15d, r15d
movsx edi, word [rcx + 0x128]
mov rcx, qword [rbx + 0x110]
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
jne 0x1400148de
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
movsx eax, word [rsp + 0x34]
mov r9d, edi
movsx edx, word [rsp + 0x38]
movsx r10d, word [rsp + 0x28]
sub edx, eax
mov eax, dword [0x1400dcdd4]
inc edx
mov dword [0x1400dcdbc], r10d
mov dword [0x1400dcdd0], edx
cmp eax, 0xffffffff
jne 0x140014914
movsx eax, word [rsp + 0x2e]
jmp 0x140014922
movsx ecx, word [rsp + 0x2e]
sub ecx, edx
inc ecx
cmp eax, ecx
cmovl eax, ecx
movsx r8d, word [rsp + 0x2a]
lea ecx, [rdx + rax]
cmp ecx, r8d
jle 0x140014935
mov eax, r8d
sub eax, edx
test eax, eax
cmovs eax, r15d
mov dword [0x1400dcdd4], eax
lea ecx, [rax + rbp]
cmp ecx, eax
jge 0x14001494c
mov ecx, eax
jmp 0x140014959
lea r8d, [rdx + rax]
cmp ecx, r8d
jl 0x140014959
lea ecx, [r8 - 1]
test edi, edi
jns 0x140014962
mov r9d, r15d
jmp 0x14001496b
cmp edi, r10d
jl 0x14001496b
lea r9d, [r10 - 1]
mov word [rsp + 0x22], cx
mov rcx, qword [rbx + 0x110]
mov word [rsp + 0x20], r9w
mov edx, dword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
test eax, eax
jne 0x1400149a7
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
je 0x1400148c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
or eax, 0xffffffff
jmp 0x1400149f5
test r14b, r14b
je 0x1400149f3
test dword [rbx + 0x58], 0x8000000
je 0x1400149f3
mov rcx, qword [rbx + 0x110]
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x14001499a
movzx eax, word [rsp + 0x48]
mov ecx, 0xff77
movzx edx, word [rbx + 0x12c]
and ax, cx
mov rcx, qword [rbx + 0x110]
or dx, ax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
test eax, eax
je 0x14001499a
xor eax, eax
mov rdi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x98]
mov r15, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14005c600
add rsp, 0x70
pop r14
pop rsi
pop rbx
ret
Function at 0x140017670
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
xor r9d, r9d
mov rdi, rcx
mov r10d, r9d
mov ebx, r9d
mov r11d, r9d
cmp edx, 2
jb 0x140010df7
lea eax, [rdx - 2]
mov r8, rcx
shr eax, 1
inc eax
mov ecx, eax
lea r11d, [rax + rax]
nop
mov eax, dword [r8]
lea r8, [r8 + 0x20]
add r9, rax
mov eax, dword [r8 - 0x10]
add r10, rax
sub rcx, 1
jne 0x140010de0
cmp r11d, edx
jae 0x140010e05
mov eax, r11d
add rax, rax
mov ebx, dword [rdi + rax*8]
mov rdi, qword [rsp + 0x10]
lea rax, [r10 + r9]
add rax, rbx
mov rbx, qword [rsp + 8]
ret
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov eax, dword [rcx + 0x58]
mov ebx, r8d
mov rdi, rdx
test al, 1
je 0x140017697
mov eax, 0xfffff00d
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
bt eax, 0x10
jb 0x1400176ad
mov eax, 0xfffff031
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov eax, dword [rcx + 0x10]
cmp eax, 7
je 0x14001776b
cmp eax, 0xc
je 0x140017715
cmp eax, 0xe
je 0x1400176d3
mov eax, 0xfffff02a
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
cmp dword [rcx + 0x100], 0
ja 0x14001776b
lea r9, [rsp + 0x50]
call fcn.140014aa0
test eax, eax
je 0x140017701
mov ecx, dword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
jmp fcn.14001dc20
mov edx, ebx
mov rcx, rdi
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
jmp 0x140010db0
cmp dword [rcx + 0x100], 0
ja 0x14001776b
mov rcx, qword [rcx + 0x110]
lea r9, [rsp + 0x50]
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
call qword [sym.imp.WS2_32.dll_WSASend]
cmp eax, 0xffffffff
jne 0x14001775c
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
jmp fcn.14001dc20
mov eax, dword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov eax, 0xfffff008
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret