joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005070
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
test rcx, rcx
je 0x140005213
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140005213
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x140005213
mov edx, 0x20b
cmp word [rax + rcx + 0x18], dx
jne 0x140005213
mov qword [rbx], rcx
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
mov qword [rsp + 0x40], rdi
mov qword [rbx + 8], rcx
xor edi, edi
mov qword [rsp + 0x48], r14
lea rax, [rcx + 0x18]
mov qword [rbx + 0x18], rax
lea rdx, [rcx + 4]
mov qword [rbx + 0x10], rdx
lea rax, [rcx + 0x88]
mov qword [rbx + 0x20], rax
lea r14, [rcx + 0x18]
lea rax, [rcx + 0x90]
mov qword [rbx + 0x28], rax
lea rax, [rcx + 0x98]
mov qword [rbx + 0x30], rax
lea rax, [rcx + 0xa0]
mov qword [rbx + 0x38], rax
lea rax, [rcx + 0xa8]
mov qword [rbx + 0x40], rax
lea rax, [rcx + 0xb0]
mov qword [rbx + 0x48], rax
lea rax, [rcx + 0xb8]
mov qword [rbx + 0x50], rax
lea rax, [rcx + 0xc0]
mov qword [rbx + 0x58], rax
lea rax, [rcx + 0xc8]
mov qword [rbx + 0x60], rax
lea rax, [rcx + 0xd0]
mov qword [rbx + 0x68], rax
lea rax, [rcx + 0xd8]
mov qword [rbx + 0x70], rax
lea rax, [rcx + 0xe0]
mov qword [rbx + 0x78], rax
lea rax, [rcx + 0xe8]
mov qword [rbx + 0x80], rax
lea rax, [rcx + 0xf0]
mov qword [rbx + 0x88], rax
lea rax, [rcx + 0xf8]
mov qword [rbx + 0x90], rax
lea rax, [rcx + 0x100]
mov qword [rbx + 0x98], rax
movzx eax, word [rcx + 0x14]
add r14, rax
cmp di, word [rdx + 2]
jae 0x140005201
mov qword [rsp + 0x38], rsi
nop dword [rax]
mov rdx, qword [rbx + 0xa8]
movsxd rax, edi
lea rcx, [rax + rax*4]
lea rax, [r14 + rcx*8]
mov qword [rsp + 0x30], rax
cmp rdx, qword [rbx + 0xb0]
je 0x1400051dd
mov qword [rdx], rax
add qword [rbx + 0xa8], 8
jmp 0x1400051ee
lea r8, [rsp + 0x30]
lea rcx, [rbx + 0xa0]
call fcn.140005220
mov rax, qword [rbx + 0x10]
inc edi
movzx ecx, word [rax + 2]
cmp edi, ecx
jl 0x1400051b0
mov rsi, qword [rsp + 0x38]
mov r14, qword [rsp + 0x48]
mov al, 1
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop rbx
ret
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x140005a10
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x140114200]
xor rax, rsp
mov qword [rbp + 0x20], rax
xorps xmm0, xmm0
movdqa xmmword [rbp], xmm0
mov qword [rbp + 0x10], 0
lea rdx, [rsp + 0x60]
call fcn.140005070
mov r15, qword [rbp]
test al, al
je 0x140005b71
mov dword [rsp + 0x22], 0x747865
mov word [rsp + 0x20], 0x742e
mov byte [rsp + 0x26], 0
mov rbx, r15
mov rdi, qword [rbp + 8]
cmp r15, rdi
je 0x140005aa5
mov r12, qword [rbx]
mov r8d, 8
lea rdx, [rsp + 0x20]
mov rcx, r12
call fcn.1400c1b60
test eax, eax
je 0x140005aa8
add rbx, 8
cmp rbx, rdi
jne 0x140005a82
xor r12d, r12d
mov word [rsp + 0x2d], 0x61
mov dword [rsp + 0x28], 0x6164722e
mov byte [rsp + 0x2c], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x2f], 0
mov rbx, r15
cmp r15, rdi
je 0x140005af3
nop dword [rax]
mov rsi, qword [rbx]
mov r8d, 8
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.1400c1b60
test eax, eax
je 0x140005af5
add rbx, 8
cmp rbx, rdi
jne 0x140005ad0
xor esi, esi
mov dword [rsp + 0x22], 0x617461
mov word [rsp + 0x20], 0x642e
mov byte [rsp + 0x26], 0
mov rbx, r15
cmp r15, rdi
je 0x140005b34
mov r14, qword [rbx]
mov r8d, 8
lea rdx, [rsp + 0x20]
mov rcx, r14
call fcn.1400c1b60
test eax, eax
je 0x140005b37
add rbx, 8
cmp rbx, rdi
jne 0x140005b11
xor r14d, r14d
test r12, r12
je 0x140005b71
cmp r12, rsi
jae 0x140005b71
cmp rsi, r14
jae 0x140005b71
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
mov eax, dword [rsi + 0xc]
mov rcx, qword [rsp + 0x58]
div ecx
test edx, edx
jne 0x140005b71
xor edx, edx
mov eax, dword [r14 + 0xc]
div ecx
test edx, edx
jne 0x140005b71
mov bl, 1
jmp 0x140005b73
xor bl, bl
test r15, r15
je 0x140005bac
mov rdx, qword [rbp + 0x10]
sub rdx, r15
and rdx, 0xfffffffffffffff8
mov rax, r15
cmp rdx, 0x1000
jb 0x140005ba4
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005bd7
mov rcx, r15
call fcn.14001c0cc
movzx eax, bl
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.14001c070
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.140096c14
int3
Function at 0x1400092b0
Capabilities:
Read file on windows

Disassembly:
push rbx
push r14
push r15
sub rsp, 0x30
mov r15, r8
mov r14, rdx
mov rbx, rcx
test r8, r8
jg 0x1400092d4
xor eax, eax
add rsp, 0x30
pop r15
pop r14
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
je 0x140009362
mov rdi, r15
mov qword [rsp + 0x68], rbp
lea rsi, [rcx + 0x50]
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x140009330
mov rax, qword [rsi]
movsxd rcx, dword [rax]
test ecx, ecx
jle 0x140009330
cmp rdi, rcx
mov rbp, rdi
cmovge rbp, rcx
mov rcx, r14
mov r8, rbp
call fcn.1400c0fa0
mov rax, qword [rsi]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14000934d
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + gethostname]
cmp eax, 0xffffffff
je 0x140009355
mov byte [r14], al
lea rsi, [rbx + 0x50]
dec rdi
mov ebp, 1
add r14, rbp
test rdi, rdi
jg 0x1400092f1
mov rbp, qword [rsp + 0x68]
sub r15, rdi
jmp 0x140009440
mov rax, qword [rcx + 0x38]
mov rsi, r15
mov rdx, qword [rax]
test rdx, rdx
je 0x140009379
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14000937b
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400093ad
cmp rax, r15
mov rdi, r15
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call fcn.1400c0fa0
mov rax, qword [rbx + 0x50]
add r14, rdi
sub rsi, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14000943d
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400093e8
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rsi, 0xfff
jbe 0x14000941e
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call fcn.14009dfc8
add r14, rax
sub rsi, rax
cmp rax, 0xfff
jne 0x14000943d
cmp rsi, rax
ja 0x1400093f1
test rsi, rsi
je 0x14000943d
mov r9, qword [rbx + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.14009dfc8
sub rsi, rax
sub r15, rsi
mov rsi, qword [rsp + 0x28]
mov rax, r15
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r15
pop r14
pop rbx
ret
Function at 0x14000c980
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x140114200]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rax, qword [rcx + 0x10]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov rbx, rcx
mov rax, qword [rcx + 8]
mov r9d, 0xffffffff
mov ecx, 2
mov qword [rsp + 0x28], rax
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lock xadd dword [0x14011a72c], eax
test eax, eax
mov rax, qword [rbx + 8]
je 0x14000c9fd
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14001c070
add rsp, 0x40
pop rbx
ret
xor r8d, r8d
lea rcx, [fcn.140005060]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, qword [rbx + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14001c070
add rsp, 0x40
pop rbx
ret
Function at 0x14000e920
Capabilities:
Set socket configuration

Disassembly:
push rbp
push rsi
push rdi
push r12
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140114200]
xor rax, rsp
mov qword [rbp - 0x18], rax
xor r12d, r12d
mov r15, r9
mov rsi, rdx
mov rdi, rcx
cmp rcx, 0xffffffffffffffff
je 0x14000eb05
movzx eax, byte [rdx]
mov qword [rsp + 0xc0], rbx
test al, 8
je 0x14000e998
or al, 8
mov dword [rbp - 0x20], r12d
mov byte [rdx], al
lea r9, [rbp - 0x20]
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x80
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
lea rcx, [rbp - 0x38]
setne dl
call fcn.14000e200
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
mov rcx, r15
mov ebx, eax
setne dl
call fcn.14000e200
test ebx, ebx
je 0x14000eb01
mov qword [rsp + 0x78], r13
movabs rcx, 0x4d54ee85da812030
mov qword [rsp + 0x70], r14
lea r13, [0x140115b98]
mov r14, qword [0x140115ba0]
add rcx, r14
mov dword [rbp - 0x4c], r12d
cmp rcx, 1
jbe 0x14000ea02
mov rax, qword [0x140115b98]
mov edx, 0x2733
mov rcx, r13
call qword [rax + Ordinal_50]
mov r14, qword [0x140115ba0]
jmp 0x14000ea04
mov al, 1
movzx eax, al
lea rdx, [rbp - 0x38]
add rax, 2
mov dword [rbp - 0x50], 0x2733
mov qword [rbp - 0x40], rax
mov rcx, r15
movsd xmm1, qword [rbp - 0x40]
mov qword [rbp - 0x48], r13
movups xmm0, xmmword [rbp - 0x50]
movsd qword [rbp - 0x28], xmm1
movups xmmword [rbp - 0x38], xmm0
call fcn.14000bbd0
test al, al
jne 0x14000eaa1
movabs rax, 0x4d54ee85da812030
mov dword [rbp - 0x4c], r12d
add rax, r14
cmp rax, 1
jbe 0x14000ea67
mov rax, qword [0x140115b98]
mov edx, 0x4d5
mov rcx, r13
call qword [rax + Ordinal_50]
jmp 0x14000ea69
mov al, 1
movzx eax, al
lea rdx, [rbp - 0x38]
add rax, 2
mov dword [rbp - 0x50], 0x4d5
mov qword [rbp - 0x40], rax
mov rcx, r15
movsd xmm1, qword [rbp - 0x40]
mov qword [rbp - 0x48], r13
movups xmm0, xmmword [rbp - 0x50]
movsd qword [rbp - 0x28], xmm1
movups xmmword [rbp - 0x38], xmm0
call fcn.14000bbd0
test al, al
je 0x14000ead2
lea r8, [rbp - 0x20]
mov dword [rbp - 0x20], r12d
mov edx, 0x8004667e
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
and byte [rsi], 0xfc
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
mov rcx, r15
mov ebx, eax
setne dl
call fcn.14000e200
mov r13, qword [rsp + 0x78]
mov eax, ebx
mov r14, qword [rsp + 0x70]
mov rbx, qword [rsp + 0xc0]
mov rcx, qword [rbp - 0x18]
xor rcx, rsp
call fcn.14001c070
add rsp, 0x80
pop r15
pop r12
pop rdi
pop rsi
pop rbp
ret
mov eax, ebx
jmp 0x14000eade
mov eax, r12d
jmp 0x14000eae6
Function at 0x14000f050
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140114200]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, qword [rbp + 0x50]
lea r9, [rbp - 0x18]
xor r15d, r15d
mov r8d, 1
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
mov dword [rbp - 0x18], r15d
call qword [sym.imp.WS2_32.dll_WSASend]
mov esi, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rdx, qword [0x140115ba0]
lea r14, [0x140115b98]
movabs r12, 0x4d54ee85da812030
mov dword [rbp - 0x2c], r15d
add rdx, r12
mov edi, eax
cmp rdx, 1
jbe 0x14000f0e5
mov rcx, qword [0x140115b98]
mov edx, eax
mov r8, qword [rcx + 0x30]
mov rcx, r14
call r8
jmp 0x14000f0ea
test edi, edi
setne al
movzx eax, al
movabs r10, 0x4800144005b3
add rax, 2
mov dword [rbp - 0x30], edi
mov qword [rbp - 0x28], r14
movups xmm0, xmmword [rbp - 0x30]
mov qword [rbp - 0x20], rax
movsd xmm1, qword [rbp - 0x20]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
mov r9, qword [rbx + 0x10]
cmp r9, 1
je 0x14000f128
mov eax, dword [rbx]
mov r8d, eax
jmp 0x14000f158
mov rcx, qword [rbx + 8]
mov rax, r10
mov r8d, dword [rbx]
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul eax, ecx, 0x3e8
add eax, r8d
cmp eax, 0x40
jne 0x14000f197
mov rcx, qword [0x140115ba0]
add rcx, r12
mov dword [rbp - 0x2c], r15d
cmp rcx, 1
jbe 0x14000f18c
mov rax, qword [0x140115b98]
mov edx, 0x2746
mov rcx, r14
call qword [rax + Ordinal_50]
mov dword [rbp - 0x30], 0x2746
jmp 0x14000f204
mov al, 1
mov dword [rbp - 0x30], 0x2746
jmp 0x14000f204
cmp r9, 1
jne 0x14000f1ca
mov rcx, qword [rbx + 8]
mov rax, r10
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul eax, ecx, 0x3e8
add r8d, eax
cmp r8d, 0x4d2
jne 0x14000f224
mov rcx, qword [0x140115ba0]
add rcx, r12
mov dword [rbp - 0x2c], r15d
cmp rcx, 1
jbe 0x14000f1fb
mov rax, qword [0x140115b98]
mov edx, 0x274d
mov rcx, r14
call qword [rax + Ordinal_50]
jmp 0x14000f1fd
mov al, 1
mov dword [rbp - 0x30], 0x274d
movzx eax, al
mov qword [rbp - 0x28], r14
add rax, 2
movups xmm0, xmmword [rbp - 0x30]
mov qword [rbp - 0x20], rax
movsd xmm1, qword [rbp - 0x20]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
test esi, esi
je 0x14000f22f
mov eax, 0xffffffff
jmp 0x14000f246
mov eax, dword [rbp - 0x18]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbp - 0x20], r15
movsd xmm0, qword [rbp - 0x20]
movsd qword [rbx + 0x10], xmm0
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14001c070
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x14000f270
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x140114200]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rdi, r9
cmp rcx, 0xffffffffffffffff
jne 0x14000f307
movabs rcx, 0x4d54ee85da812030
mov dword [rsp + 0x34], 0
add rcx, qword [0x140115ba0]
lea rbx, [0x140115b98]
cmp rcx, 1
jbe 0x14000f2d2
mov rax, qword [0x140115b98]
mov edx, 0x2719
mov rcx, rbx
call qword [rax + Ordinal_50]
jmp 0x14000f2d4
mov al, 1
movzx eax, al
add rax, 2
mov dword [rsp + 0x30], 0x2719
mov qword [rsp + 0x40], rax
mov eax, 0xffffffff
movsd xmm1, qword [rsp + 0x40]
mov qword [rsp + 0x38], rbx
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rdi], xmm0
movsd qword [rdi + 0x10], xmm1
jmp 0x14000f341
mov qword [rsp + 0x58], rcx
lea rdx, [rsp + 0x50]
inc ecx
mov dword [rsp + 0x50], 1
xor r9d, r9d
mov qword [rsp + 0x20], 0
xor r8d, r8d
call qword [sym.imp.WS2_32.dll_select]
mov edx, eax
mov rcx, rdi
shr edx, 0x1f
mov ebx, eax
call fcn.14000e200
mov eax, ebx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14001c070
mov rbx, qword [rsp + 0x288]
add rsp, 0x270
pop rdi
ret
Function at 0x14000f940
Capabilities:
Set socket configuration

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
mov rax, qword [0x140114200]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r12d, r9d
mov rsi, r8
mov rbx, rdx
mov r13, rcx
mov ebp, dword [rsp + 0xd0]
mov r8d, dword [rsp + 0xd8]
mov rdi, qword [rsp + 0xe0]
xor r15d, r15d
cmp qword [rsi], 0xffffffffffffffff
je 0x14000f9fe
mov dword [rsp + 0x3c], r15d
movabs rcx, 0x4d54ee85da812030
add rcx, qword [0x140115b30]
lea rsi, [0x140115b28]
cmp rcx, 1
jbe 0x14000f9c3
mov rax, qword [0x140115b28]
mov edx, 1
mov rcx, rsi
call qword [rax + Ordinal_50]
jmp 0x14000f9c5
mov al, 1
movzx eax, al
add rax, 2
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x40], rsi
movups xmm2, xmmword [rsp + 0x38]
movups xmmword [rdi], xmm2
movsd xmm1, qword [rsp + 0x48]
movsd qword [rdi + 0x10], xmm1
movups xmmword [rbx], xmm2
movsd qword [rbx + 0x10], xmm1
jmp 0x14000fb1f
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], r15d
xor r9d, r9d
mov edx, ebp
mov ecx, r12d
call qword [sym.imp.WS2_32.dll_WSASocketW]
mov r14, rax
cmp rax, 0xffffffffffffffff
sete dl
mov rcx, rdi
call fcn.14000e200
cmp r14, 0xffffffffffffffff
je 0x14000fa5e
cmp r12d, 0x17
jne 0x14000fa5e
mov dword [rsp + 0x50], r15d
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x50]
mov edx, reloc.WLDAP32.dll_Ordinal_41
mov r8d, reloc.WLDAP32.dll_Ordinal_27
mov rcx, r14
call qword [sym.imp.WS2_32.dll_setsockopt]
nop
cmp r14, 0xffffffffffffffff
jne 0x14000fa74
movups xmm0, xmmword [rdi]
movups xmmword [rbx], xmm0
movsd xmm1, qword [rdi + 0x10]
jmp 0x14000fb1a
mov r9, rdi
mov r8, r14
lea rdx, [rsp + 0x38]
mov rcx, qword [r13 + 8]
call fcn.14000d490
mov rcx, qword [rax + 0x10]
test cl, 1
je 0x14000fad2
cmp rcx, 1
jne 0x14000fa9c
cmp dword [rax], 0
je 0x14000fad2
movups xmm0, xmmword [rdi]
movups xmmword [rbx], xmm0
movsd xmm1, qword [rdi + 0x10]
movsd qword [rbx + 0x10], xmm1
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r15
mov byte [rsp + 0x30], 0
lea r9, [rsp + 0x38]
lea rdx, [rsp + 0x30]
mov rcx, r14
call fcn.14000e920
jmp 0x14000fb1f
mov qword [rsp + 0x50], 0xffffffffffffffff
mov qword [rsi], r14
sub ebp, 1
je 0x14000faf4
cmp ebp, 1
je 0x14000faee
mov byte [rsi + 8], 0
jmp 0x14000faf8
mov byte [rsi + 8], reloc.WLDAP32.dll_Ordinal_32
jmp 0x14000faf8
mov byte [rsi + 8], reloc.WS2_32.dll_recv
lea rcx, [rsi + 0x10]
call fcn.140015630
xorps xmm2, xmm2
mov qword [rsp + 0x48], r15
movups xmmword [rdi], xmm2
movsd xmm1, qword [rsp + 0x48]
movsd qword [rdi + 0x10], xmm1
movups xmmword [rbx], xmm2
movsd qword [rbx + 0x10], xmm1
mov rax, rbx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14001c070
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140010ad0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x160
mov rax, qword [0x140114200]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rsi, rcx
mov dword [rsp + 0x20], 0x130
mov ecx, 2
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x140010b17
xor eax, eax
jmp 0x140010c06
mov qword [rsp + 0x170], rbx
lea rdx, [rsp + 0x20]
mov rcx, rbp
mov qword [rsp + 0x178], rdi
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rax, [rsp + 0x4c]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x140010b41
cmp qword [rsi + 0x18], 0xf
mov rcx, rsi
mov rdi, qword [rsi + 0x10]
jbe 0x140010b5b
mov rcx, qword [rsi]
cmp rbx, rdi
lea rdx, [rsp + 0x4c]
mov r8, rdi
cmovb r8, rbx
call fcn.1400c1a80
test eax, eax
jne 0x140010b7e
cmp rdi, rbx
jb 0x140010b7e
jbe 0x140010c27
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x140010beb
lea rax, [rsp + 0x4c]
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140010ba0
cmp qword [rsi + 0x18], 0xf
mov rcx, rsi
mov rdi, qword [rsi + 0x10]
jbe 0x140010bba
mov rcx, qword [rsi]
cmp rbx, rdi
lea rdx, [rsp + 0x4c]
mov r8, rdi
cmovb r8, rbx
call fcn.1400c1a80
test eax, eax
jne 0x140010bd9
cmp rdi, rbx
jb 0x140010bd9
jbe 0x140010c27
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140010b90
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rbx, qword [rsp + 0x170]
mov rdi, qword [rsp + 0x178]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14001c070
mov rbp, qword [rsp + 0x180]
add rsp, 0x160
pop rsi
ret
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
jmp 0x140010bf6

Function at 0x1400120f0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
lea rcx, str._s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x140012103
add rsp, 0x28
ret
Function at 0x140014e40
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x200
mov rax, qword [0x140114200]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
movzx ebx, dl
mov rdi, rcx
mov eax, 1
lock xadd dword [0x14011a7a8], eax
inc eax
cmp eax, 1
jne 0x140014e8f
mov ecx, 0x202
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [0x14011a7ac], eax
test bl, bl
je 0x140014f33
xor ebx, ebx
lock xadd dword [0x14011a7ac], ebx
test ebx, ebx
je 0x140014f33
movabs rcx, 0x4d54ee85da812030
mov qword [rsp + 0x210], rsi
add rcx, qword [0x140115ba0]
lea rsi, [0x140115b98]
mov dword [rsp + 0x3c], 0
cmp rcx, 1
jbe 0x140014ee8
mov rax, qword [0x140115b98]
mov edx, ebx
mov rcx, rsi
call qword [rax + Ordinal_50]
jmp 0x140014eea
mov al, 1
lea rcx, str.C:AresCheatsLoaderRuzyLoaderRuzyLoader_boost_1_86_0_boost_asiodetailimplwinsock_init.ipp
movzx eax, al
add rax, 2
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x40], rsi
lea rcx, str.void___cdecl_boost::asio::detail::winsock_init_base::throw_on_error_struct_boost::asio::detail::winsock_init_base::data__
mov rsi, qword [rsp + 0x210]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], Ordinal_79
mov dword [rsp + 0x34], reloc.WLDAP32.dll_Ordinal_26
test al, 1
jne 0x140014f57
mov rax, rdi
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.14001c070
mov rbx, qword [rsp + 0x218]
add rsp, 0x200
pop rdi
ret
lea r8, [rsp + 0x20]
lea rdx, str.winsock
lea rcx, [rsp + 0x38]
call fcn.14000c550
int3
Function at 0x14001d064
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001d0ae
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001d0ae
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001d0ae
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001d0ae
cmp dword [rcx + 0x84], 0xe
jbe 0x14001d0ae
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001d0b0
xor al, al
add rsp, 0x28
ret
Function at 0x140028020
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x140028102
call fcn.140048ca0
test al, al
jne 0x140028102
mov qword [rsp + 0x30], rsi
xor esi, esi
mov qword [rsp + 0x38], rdi
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rbx + rdi], sil
jne 0x140028052
mov r8, rdi
mov edx, reloc.WLDAP32.dll_Ordinal_46
mov rcx, rbx
call fcn.140052970
test rax, rax
je 0x140028097
sub rax, rbx
mov edx, reloc.WLDAP32.dll_Ordinal_46
mov r8, rax
mov rcx, rbx
call fcn.140052970
mov rsi, rax
test rax, rax
je 0x140028097
inc rsi
mov rcx, rbx
sub rcx, rsi
add rdi, rcx
test rsi, rsi
cmovne rbx, rsi
lea rsi, [rbx + rdi]
mov edi, 0x1505
cmp rbx, rsi
jae 0x1400280cb
nop dword [rax]
movzx ecx, byte [rbx]
call fcn.140040ef0
imul rdi, rdi, 0x21
movsx rcx, al
inc rbx
xor rdi, rcx
cmp rbx, rsi
jb 0x1400280b0
mov rsi, qword [rsp + 0x30]
mov rcx, rdi
movabs rax, 0x410410410410411
mul rdi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 5
imul rcx, rcx, 0x3f
sub rdi, rcx
mov rax, rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret