joyce8/EMBER2024-capa huggingface dataset:
Function at 0x484dc0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x484e8a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.004036e0
xorps xmm15, xmm15
mov r14, qword [0x006988c0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x484e6f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x004d3200]
xor ebx, ebx
mov rcx, rdx
call fcn.0044bd60
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.00485960
inc rbx
cmp rcx, rbx
jae 0x484e5e
mov edi, 1
lea rsi, [0x004d3200]
call fcn.0044be40
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x005713a0]
lea rsi, [0x00570978]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00464c00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00484dc0

Function at 0x49a850
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
test rdx, 0xf
jne 0x49a8ca
mov rax, 0
nop word [rax + rax]
nop dword [rax]
movdqu xmm0, xmmword [rsi + rax]
movdqu xmm1, xmmword [rcx + rax]
pxor xmm0, xmm1
movdqu xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rdx, rax
jne 0x49a880
ret
sub rdx, 1
mov dil, byte [rsi + rdx]
mov al, byte [rcx + rdx]
xor dil, al
mov byte [rbx + rdx], dil
test rdx, 7
jne 0x49a8a0
cmp rdx, 0
je 0x49a8ec
test rdx, 0xf
je 0x49a86d
test rdx, 7
jne 0x49a8a0
sub rdx, 8
mov rdi, qword [rsi + rdx]
mov rax, qword [rcx + rdx]
xor rdi, rax
mov qword [rbx + rdx], rdi
cmp rdx, 0x10
jge 0x49a86d
ret
Function at 0x4a5140
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a587f
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
movabs rcx, 0xcbf29ce484222325
jmp 0x4a516d
lea rax, [rdx + 0x10]
dec rbx
mov rcx, rsi
test rbx, rbx
jle 0x4a53f1
mov rdx, rax
mov rsi, qword [rax]
nop dword [rax]
test rsi, rsi
je 0x4a541d
mov edi, dword [rsi + 0x10]
shr edi, 1
mov r8, qword [rax + 8]
and edi, 0x3f
lea rax, [0x00572fe0]
jmp qword [rax + rdi*8]
mov rax, rcx
add rsp, 0x10
pop rbp
ret
lea rax, [0x004d3100]
lea rbx, [0x00571150]
call fcn.00436840
inc rax
cmp rax, r8
jge 0x4a5442
mov r9, qword [rsi + rax*8]
xor r10d, r10d
nop
jmp 0x4a5477
lea rdi, [0x004d3180]
mov rsi, rcx
movabs rcx, 0x100000001b3
jmp 0x4a5163
movzx r11d, r9b
xor rcx, r11
inc r10
shr r9, 8
movabs r11, 0x100000001b3
imul rcx, r11
cmp r10, 8
jl 0x4a545b
jmp 0x4a5430
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00464c00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004a5140

Function at 0x4a5a20
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x4a5a37
inc rax
cmp rax, 4
jge 0x4a5a4f
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x4a5a34
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x4a5a60
inc rax
cmp rax, 4
jge 0x4a5a6e
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x4a5a97
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x4a5a7b
jmp 0x4a5a5d
Function at 0x4be220
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea r12, [rsp - 0x40]
cmp r12, qword [r14 + 0x10]
jbe 0x4be45d
push rbp
mov rbp, rsp
sub rsp, 0xb8
mov rdx, rax
mov r8d, dword [rax + 0x3c]
add r8, rdx
nop
cmp dword [r8], 0x4550
jne 0x4be296
mov qword [rsp + 0x80], rdx
mov r8d, dword [r8 + 0x88]
add r8, rdx
mov qword [rsp + 0xb0], r8
mov r9d, dword [r8 + 0x1c]
mov r10d, dword [r8 + 0x20]
mov r11d, dword [r8 + 0x24]
add r9, rdx
mov qword [rsp + 0x58], r9
add r10, rdx
mov qword [rsp + 0x50], r10
add r11, rdx
mov qword [rsp + 0x48], r11
xor eax, eax
xor ecx, ecx
xor ebx, ebx
xor esi, esi
jmp 0x4be2b1
xor eax, eax
xor ebx, ebx
mov rcx, rbx
add rsp, 0xb8
pop rbp
ret
mov qword [rbx + rsi*8 - 0x18], rdi
inc rax
mov rsi, r15
mov r12d, dword [r8 + 0x18]
cmp rax, r12
jae 0x4be3aa
mov qword [rsp + 0x78], rax
lea r12, [r10 + rax*4]
mov r12d, dword [r12]
add r12, rdx
lea r13, [r11 + rax*2]
movzx r13d, word [r13]
lea r13, [r9 + r13*4]
mov r13d, dword [r13]
add r13, rdx
mov qword [rsp + 0x60], r13
test r12, r12
je 0x4be305
cmp byte [r12], 0
jne 0x4be2fa
xor edi, edi
xor r12d, r12d
jmp 0x4be30a
mov rdi, r12
xor r15d, r15d
jmp 0x4be3bf
xor edi, edi
xor r12d, r12d
lea r15, [rsi + 1]
cmp rcx, r15
jae 0x4be373
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x40], r12
mov rax, rbx
mov rbx, r15
mov edi, 1
lea rsi, [0x004dde00]
call fcn.0044be40
mov rdx, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x88]
mov r8, qword [rsp + 0xb0]
mov r9, qword [rsp + 0x58]
mov r10, qword [rsp + 0x50]
mov r11, qword [rsp + 0x48]
mov r12, qword [rsp + 0x40]
mov r13, qword [rsp + 0x60]
mov r15, rbx
mov rbx, rax
mov rax, qword [rsp + 0x78]
lea rsi, [r15 + r15*2]
mov qword [rbx + rsi*8 - 0x10], r12
mov qword [rbx + rsi*8 - 8], r13
cmp dword [0x00698900], 0
je 0x4be2a6
mov r12, r11
call fcn.00466b40
mov qword [r11], rdi
mov r13, qword [rbx + rsi*8 - 0x18]
mov qword [r11 + 8], r13
mov r11, r12
jmp 0x4be2a6
mov rax, rbx
mov rbx, rsi
add rsp, 0xb8
pop rbp
ret
inc r15
inc r12
cmp byte [r12], 0
jne 0x4be3b9
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x90], 0
movups xmmword [rsp + 0x98], xmm15
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x98], r15
mov qword [rsp + 0xa0], r15
mov rbx, qword [rsp + 0x90]
xor eax, eax
mov rcx, r15
call fcn.0044fe80
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x68]
mov r8, qword [rsp + 0xb0]
mov r9, qword [rsp + 0x58]
mov r10, qword [rsp + 0x50]
mov r11, qword [rsp + 0x48]
mov r13, qword [rsp + 0x60]
mov rdi, rax
mov r12, rbx
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0xa8]
jmp 0x4be30a
mov qword [rsp + 8], rax
call fcn.00464c00
mov rax, qword [rsp + 8]
jmp fcn.004be220
Function at 0x4bfd20
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, qword gs:[0x60]
nop
mov rax, qword [rax + 0x18]
nop
mov rax, qword [rax + 0x20]
nop
xor r10, r10
cmp r10, qword [rsp + 8]
nop
je 0x4bfd49
nop
mov rax, qword [rax]
nop
inc r10
jmp 0x4bfd37
mov rcx, qword [rax + 0x30]
nop
mov qword [rsp + 0x18], rcx
nop
mov rcx, qword [rax + 0x20]
nop
mov qword [rsp + 0x10], rcx
nop
mov rcx, rax
nop
add rcx, 0x38
nop
mov qword [rsp + 0x20], rcx
ret
Function at 0x4c1140
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x4c117f
jb 0x4c1194
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesdeclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret
Function at 0x4c29a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c2bdb
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x60], rbx
nop
call fcn.004a0280
xorps xmm15, xmm15
mov r14, qword [0x006988c0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
add qword [rcx + 0x68], rax
mov rdx, qword [rcx + 0x60]
test rdx, rdx
jle 0x4c2aea
nop dword [rax]
cmp rdx, 0x40
ja 0x4c2bcd
lea rsi, [rdx - 0x40]
mov rdi, rsi
neg rsi
sar rdi, 0x3f
and rdi, rdx
lea rdx, [rcx + rdi]
lea rdx, [rdx + 0x20]
cmp rax, rsi
cmovl rsi, rax
mov qword [rsp + 0x28], rsi
mov rbx, qword [rsp + 0x60]
cmp rbx, rdx
je 0x4c2a59
mov rax, rdx
mov rcx, rsi
nop
call fcn.00467860
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x60]
add rdx, rsi
mov qword [rcx + 0x60], rdx
cmp rdx, 0x40
jne 0x4c2ac1
mov qword [rsp], rcx
lea rax, [rcx + 0x20]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.004c3000
xorps xmm15, xmm15
mov r14, qword [0x006988c0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x60], 0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
cmp rax, rsi
jb 0x4c2bc2
mov rdi, qword [rsp + 0x70]
sub rdi, rsi
mov rdx, rdi
neg rdx
sar rdx, 0x3f
and rdx, rsi
mov r8, rax
sub r8, rsi
add rbx, rdx
jmp 0x4c2af7
mov r8, rax
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
cmp r8, 0x40
jl 0x4c2b75
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rdi
mov qword [rsp], rcx
mov qword [rsp + 8], rbx
and r8, 0xffffffffffffffc0
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], rdi
call fcn.004c3000
xorps xmm15, xmm15
mov r14, qword [0x006988c0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov r8, qword [rsp + 0x38]
and rax, r8
and rax, 0xffffffffffffffc0
mov rcx, qword [rsp + 0x40]
lea rbx, [rcx + rax]
sub r8, rdx
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
test r8, r8
je 0x4c2bb8
lea rdx, [rcx + 0x20]
cmp r8, 0x40
mov esi, 0x40
cmovl rsi, r8
cmp rbx, rdx
je 0x4c2bb4
mov qword [rsp + 0x38], rsi
mov rax, rdx
mov rcx, rsi
nop dword [rax + rax]
call fcn.00467860
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x38]
mov qword [rcx + 0x60], rsi
xor ebx, ebx
xor ecx, ecx
add rsp, 0x48
pop rbp
ret
mov rcx, rax
mov rax, rsi
call fcn.00466fa0
mov rax, rdx
mov ecx, 0x40
call fcn.00466fa0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00464c00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004c29a0
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x1400d9850]
mov dword [rax], 1
mov rax, qword [0x1400d9860]
mov dword [rax], 1
mov rax, qword [0x1400d9870]
mov dword [rax], 1
mov rax, qword [0x1400d9800]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x14003a8b0
Capabilities:
Query environment variable

Disassembly:
push r15
mov eax, 0x10088
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.1400b44d0
sub rsp, rax
xor edx, edx
mov rbp, rcx
xor ecx, ecx
mov word [rsp + 0x80], dx
lea r15, [rsp + 0x30]
movzx eax, byte [rbp]
mov word [rsp + 0x30], cx
test al, al
je 0x14003a975
xor edi, edi
lea r15, [rsp + 0x30]
lea r14, [rsp + 0x2a]
mov r12d, 0x28
lea r13, [rsp + 0x2c]
nop dword [rax]
mov rsi, r12
mov r8d, 2
mov rdx, r14
mov rcx, r13
sub rsi, rdi
mov byte [rsp + 0x2a], al
lea rbx, [r15 + rdi*2]
mov byte [rsp + 0x2b], 0
call sub.msvcrt.dll_mbstowcs
cmp rax, 1
jne 0x1400c53a2
cmp word [r15 + rdi*2], 0
movzx eax, word [rsp + 0x2c]
je 0x14003a956
nop dword [rax + rax]
add rbx, 2
sub rsi, 1
cmp word [rbx], 0
jne 0x14003a948
test rsi, rsi
je 0x1400c53a2
mov word [rbx], ax
add rdi, 1
xor eax, eax
mov word [rbx + 2], ax
movzx eax, byte [rbp + rdi]
test al, al
jne 0x14003a908
lea rbx, [rsp + 0x80]
mov r8d, 0x10000
mov rcx, r15
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea edx, [rax - 1]
xor eax, eax
cmp edx, 0xffff
ja 0x14003a9a4
mov rcx, rbx
call sub.msvcrt.dll__wcsdup
add rsp, 0x10088
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x14003a9c0
Capabilities:
Set environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
movzx eax, byte [rcx]
mov qword [rsp + 0xd8], rdx
xor edx, edx
mov rbp, rcx
lea r15, [rsp + 0x30]
mov word [rsp + 0x30], dx
test al, al
je 0x14003aa7d
xor edi, edi
lea r15, [rsp + 0x30]
lea r14, [rsp + 0x2a]
mov r12d, 0x28
lea r13, [rsp + 0x2c]
nop dword [rax]
mov rsi, r12
mov r8d, 2
mov rdx, r14
mov rcx, r13
sub rsi, rdi
mov byte [rsp + 0x2a], al
lea rbx, [r15 + rdi*2]
mov byte [rsp + 0x2b], 0
call sub.msvcrt.dll_mbstowcs
cmp rax, 1
jne 0x1400c53a8
cmp word [r15 + rdi*2], 0
movzx eax, word [rsp + 0x2c]
je 0x14003aa5e
nop dword [rax + rax]
add rbx, 2
sub rsi, 1
cmp word [rbx], 0
jne 0x14003aa50
test rsi, rsi
je 0x1400c53a8
mov word [rbx], ax
add rdi, 1
xor eax, eax
mov word [rbx + 2], ax
movzx eax, byte [rbp + rdi]
test al, al
jne 0x14003aa10
mov rdx, qword [rsp + 0xd8]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
nop
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400b0bd0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
cmp byte [0x1400ea961], 0
mov rbp, rcx
mov rdi, rdx
mov r12, r8
je 0x1400b0c78
lea rdx, [0x1400d57da]
mov rcx, r12
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x1400b0ce0
mov rbx, qword [0x1400ea800]
jmp 0x1400b0c15
lea rbx, [rdx + rax + 4]
mov rdx, rbx
mov rcx, r12
call sub.msvcrt.dll_strcmp
mov rcx, rbx
mov esi, eax
call sub.msvcrt.dll_strlen
lea rdx, [rbx + rax + 1]
mov eax, dword [rdx]
test esi, esi
jne 0x1400b0c10
movzx eax, word [rdx + 4]
lea r8, [rdx + 6]
test ax, ax
je 0x1400b0c67
lea rbx, [rdi + rax*8]
nop word cs:[rax + rax]
mov rdx, rdi
mov rcx, rbp
add rdi, 8
call fcn.1400a0bd0
mov r8, rax
cmp rdi, rbx
jne 0x1400b0c50
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r8d, 0xa
xor ecx, ecx
mov edx, 3
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
xor ecx, ecx
lea rdx, [rax + 4]
mov qword [0x1400ea800], rax
mov ebx, dword [rax]
mov qword [0x1400ea800], rdx
mov r8d, dword [rax + 4]
lea rdx, [rax + 8]
mov qword [0x1400ea800], rdx
call fcn.1400afd00
cmp eax, ebx
jne 0x1400b0d48
mov byte [0x1400ea961], 1
jmp 0x1400b0bf0
cmp byte [0x1400ea960], 0
jne 0x1400b0c07
mov rbx, qword [sym.imp.python312.dll_PyDict_New]
call rbx
mov qword [0x1400eb508], rax
call rbx
mov qword [0x1400eb500], rax
call rbx
mov qword [0x1400eb4f8], rax
call rbx
mov qword [0x1400eb4f0], rax
call rbx
mov qword [0x1400eb4e8], rax
call rbx
mov qword [0x1400eb4e0], rax
call rbx
mov qword [0x1400eb4d8], rax
call rbx
mov byte [0x1400ea960], 1
mov qword [0x1400eb4d0], rax
jmp 0x1400b0c07
lea rcx, str.Error__corrupted_constants_object
call sub.msvcrt.dll_puts
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]

Function at 0x1400b31b0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call fcn.1400c4930
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call fcn.1400c4930
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
Function at 0x1400b3e82
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x1400eb9c8]
test eax, eax
je 0x1400b3f1a
lea rax, [0x1400eb9a0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x1400eb9d0]
mov qword [rbp - 8], rax
jmp 0x1400b3efe
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x1400b3ef2
cmp qword [rbp - 0x10], 0
je 0x1400b3ef2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x1400b3eb8
lea rax, [0x1400eb9a0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x1400b3f1b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x1400b4020
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400b4048
mov eax, 0
jmp 0x1400b4096
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400b4071
mov eax, 0
jmp 0x1400b4096
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x1400b4091
mov eax, 0
jmp 0x1400b4096
mov eax, 1
add rsp, 0x20
pop rbp
ret

Function at 0x1400b409c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x1400b411a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x1400b4111
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x1400b4111
mov rax, qword [rbp - 8]
jmp 0x1400b412f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x1400b40e4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x1800173f0
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
movabs rdx, 0xd220bdd222ac4a1e
mov dword [0x1801f9be8], eax
mov dword [0x1801f9bf8], eax
jmp fcn.18005f7e0

Function at 0x180017410
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
lea rcx, [0x18019bcb0]
mov dword [0x1801f9be8], eax
movabs rdx, 0x202709f4c58a0424
mov dword [0x1801f9bf8], eax
mov rax, qword [0x1801f9bf0]
mov qword [rax], rcx
inc dword [0x1801f9be8]
jmp fcn.18005f7e0

Function at 0x1800174b0
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
lea rcx, [0x18019bcb0]
mov dword [0x1801f9be8], eax
movabs rdx, 0xb87a37eeb7faa67d
mov dword [0x1801f9bf8], eax
mov rax, qword [0x1801f9bf0]
mov qword [rax], rcx
inc dword [0x1801f9be8]
jmp fcn.18005f7e0

Function at 0x1800174f0
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
movabs rdx, 0x9d77056a530643f6
mov dword [0x1801f9be8], eax
mov dword [0x1801f9bf8], eax
mov rax, qword [0x1801f9bf0]
mov dword [rax], 0xbb8
mov eax, dword [0x1801f9be8]
inc eax
mov dword [0x1801f9be8], eax
mov ecx, eax
mov rax, qword [0x1801f9bf0]
mov dword [rax + rcx*8], 1
inc dword [0x1801f9be8]
jmp fcn.18005f7e0

Function at 0x180017540
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
movabs rdx, 0x6c188be134e074aa
mov dword [0x1801f9be8], eax
mov dword [0x1801f9bf8], eax
mov rax, qword [0x1801f9bf0]
mov qword [rax], rcx
inc dword [0x1801f9be8]
jmp fcn.18005f7e0

Function at 0x180017610
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [0x1801f9bf0]
xor ecx, ecx
mov dword [0x1801f9be8], ecx
movabs rdx, 0x5f4b6931816e599b
mov dword [0x1801f9bf8], ecx
mov dword [rax], ecx
inc dword [0x1801f9be8]
jmp fcn.18005f7e0

Function at 0x180017700
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
mov dword [0x1801f9be8], eax
mov dword [0x1801f9bf8], eax
mov rax, qword [0x1801f9bf0]
mov dword [rax], ecx
mov eax, dword [0x1801f9be8]
inc eax
mov dword [0x1801f9be8], eax
mov ecx, eax
mov rax, qword [0x1801f9bf0]
mov dword [rax + rcx*8], edx
movabs rdx, 0x262b14f48d29de80
mov eax, dword [0x1801f9be8]
inc eax
mov dword [0x1801f9be8], eax
mov ecx, eax
mov rax, qword [0x1801f9bf0]
mov dword [rax + rcx*8], r8d
mov eax, dword [0x1801f9be8]
inc eax
mov dword [0x1801f9be8], eax
mov ecx, eax
mov rax, qword [0x1801f9bf0]
mov dword [rax + rcx*8], r9d
mov eax, dword [0x1801f9be8]
inc eax
mov dword [0x1801f9be8], eax
mov ecx, eax
mov rax, qword [0x1801f9bf0]
mov dword [rax + rcx*8], 2
inc dword [0x1801f9be8]
jmp fcn.18005f7e0