joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d6080
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d6186
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
lea rax, [0x0055e3a0]
mov ebx, 0x40
mov rcx, rbx
call fcn.0044a120
mov qword [rsp + 0x68], rax
mov ebx, 0x40
mov rcx, rbx
xor edi, edi
nop dword [rax + rax]
call fcn.0042dbe0
movabs rdx, 0x6e6974756f726f67
mov qword [rsp + 0x36], rdx
mov word [rsp + 0x3e], 0x2065
nop
mov rax, qword [rsp + 0x68]
lea rbx, [rsp + 0x36]
mov ecx, 0xa
call fcn.00402d00
test al, al
je 0x4d6104
mov rax, qword [rsp + 0x68]
add rax, 0xa
mov ecx, 0x36
jmp 0x4d610e
mov ecx, 0x40
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x28], rcx
nop
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rcx
mov byte [rsp + 0x18], 0x20
call fcn.004031e0
xorps xmm15, xmm15
mov r14, qword [0x0073b288]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
cmp rdx, rcx
jb 0x4d6180
lea rax, [rsp + 0x40]
mov rbx, qword [rsp + 0x60]
nop dword [rax]
call fcn.0044e320
mov ecx, 0xa
mov edi, 0x40
call fcn.0047acc0
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
call fcn.00464c20
nop
call fcn.00462540
jmp fcn.004d6080

Function at 0x4dc9a0
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4dcae6
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x80], rbx
mov rcx, qword [rax]
mov qword [rsp + 0x18], rcx
movups xmm0, xmmword [rax + 8]
movups xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [rax + 0x18]
movups xmmword [rsp + 0x30], xmm0
lea rax, [rsp + 0x18]
nop
call fcn.004dc640
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
mov rcx, qword [rsp + 0x18]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x48], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x60], rcx
mov rcx, qword [rsp + 0x80]
xor eax, eax
jmp 0x4dca40
inc rax
mov rcx, rbx
nop dword [rax + rax]
cmp rax, 5
jge 0x4dca83
imul rdx, rax, 0x33
mov rsi, rdx
sar rdx, 0x3f
shr rdx, 0x3d
add rdx, rsi
mov rdi, rdx
and rdx, 0xfffffffffffffff8
sub rsi, rdx
cmp rsi, 0x40
sbb rdx, rdx
mov r8, qword [rsp + rax*8 + 0x40]
mov rbx, rcx
mov rcx, rsi
shl r8, cl
and r8, rdx
mov qword [rsp + 0x10], r8
xor ecx, ecx
jmp 0x4dcaac
test byte [rcx], al
mov rax, rcx
mov ebx, 0x20
mov rcx, rbx
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
movzx r8d, byte [rbx + rdi]
or r8d, edx
mov byte [rbx + rdi], r8b
inc rcx
mov rdi, rsi
cmp rcx, 8
jge 0x4dca35
movzx edx, byte [rsp + rcx + 0x10]
mov rsi, rdi
sar rdi, 3
add rdi, rcx
cmp rdi, 0x20
jge 0x4dca35
test byte [rbx], al
cmp rdi, 0x20
jb 0x4dca9a
mov rax, rdi
mov ecx, 0x20
nop dword [rax + rax]
call fcn.00464ba0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00462540
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.004dc9a0
Function at 0x4edb80
Capabilities:
Hash data using sha384
Hash data using sha512

Disassembly:
mov rcx, qword [rax + 0xd0]
cmp rcx, 6
jne 0x4edc05
movabs rcx, 0xcbbb9d5dc1059ed8
mov qword [rax], rcx
movabs rcx, 0x629a292a367cd507
mov qword [rax + 8], rcx
movabs rcx, 0x9159015a3070dd17
mov qword [rax + 0x10], rcx
movabs rcx, 0x152fecd8f70e5939
mov qword [rax + 0x18], rcx
movabs rcx, 0x67332667ffc00b31
mov qword [rax + 0x20], rcx
movabs rcx, 0x8eb44a8768581511
mov qword [rax + 0x28], rcx
movabs rcx, 0xdb0c2e0d64f98fa7
mov qword [rax + 0x30], rcx
movabs rcx, 0x47b5481dbefa4fa4
mov qword [rax + 0x38], rcx
nop dword [rax]
jmp 0x4edd66
cmp rcx, 0xe
jne 0x4edc80
movabs rcx, 0x8c3d37c819544da2
mov qword [rax], rcx
movabs rcx, 0x73e1996689dcd4d6
mov qword [rax + 8], rcx
movabs rcx, 0x1dfab7ae32ff9c82
mov qword [rax + 0x10], rcx
movabs rcx, 0x679dd514582f9fcf
mov qword [rax + 0x18], rcx
movabs rcx, 0xf6d2b697bd44da8
mov qword [rax + 0x20], rcx
movabs rcx, 0x77e36f7304c48942
mov qword [rax + 0x28], rcx
movabs rcx, 0x3f9d85a86a1d36c8
mov qword [rax + 0x30], rcx
movabs rcx, 0x1112e6ad91d692a1
mov qword [rax + 0x38], rcx
jmp 0x4edd66
cmp rcx, 0xf
jne 0x4edcf7
movabs rcx, 0x22312194fc2bf72c
mov qword [rax], rcx
movabs rcx, 0x9f555fa3c84c64c2
mov qword [rax + 8], rcx
movabs rcx, 0x2393b86b6f53b151
mov qword [rax + 0x10], rcx
movabs rcx, 0x963877195940eabd
mov qword [rax + 0x18], rcx
movabs rcx, 0x96283ee2a88effe3
mov qword [rax + 0x20], rcx
movabs rcx, 0xbe5e1e2553863992
mov qword [rax + 0x28], rcx
movabs rcx, 0x2b0199fc2c85b8aa
mov qword [rax + 0x30], rcx
movabs rcx, 0xeb72ddc81c52ca2
mov qword [rax + 0x38], rcx
jmp 0x4edd66
movabs rcx, 0x6a09e667f3bcc908
mov qword [rax], rcx
movabs rcx, 0xbb67ae8584caa73b
mov qword [rax + 8], rcx
movabs rcx, 0x3c6ef372fe94f82b
mov qword [rax + 0x10], rcx
movabs rcx, 0xa54ff53a5f1d36f1
mov qword [rax + 0x18], rcx
movabs rcx, 0x510e527fade682d1
mov qword [rax + 0x20], rcx
movabs rcx, 0x9b05688c2b3e6c1f
mov qword [rax + 0x28], rcx
movabs rcx, 0x1f83d9abfb41bd6b
mov qword [rax + 0x30], rcx
movabs rcx, 0x5be0cd19137e2179
mov qword [rax + 0x38], rcx
movups xmmword [rax + 0xc0], xmm15
ret
Function at 0x501b80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x501cdb
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
movups xmmword [rsp + 0x40], xmm15
mov qword [rsp + 0x30], 0
mov rax, qword [0x006e4ed0]
call fcn.00489900
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
movups xmmword [rsp + 0x50], xmm15
mov qword [rsp + 0x60], 0
lea rcx, [0x00501d00]
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x2b
call fcn.00403200
xorps xmm15, xmm15
mov r14, qword [0x0073b288]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x18]
cmp rcx, 0xffffffffffffffff
je 0x501c9b
mov rdx, qword [rsp + 0x28]
cmp rdx, rcx
jb 0x501cd5
mov qword [rsp + 0x20], rcx
mov rsi, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, rcx
lea rdx, [rsp + 0x50]
call rsi
mov rax, qword [rsp + 0x20]
lea rcx, [rax + 1]
mov rbx, qword [rsp + 0x28]
cmp rbx, rcx
jb 0x501cca
mov rsi, qword [rsp + 0x50]
sub rbx, rax
dec rbx
mov rdi, rbx
neg rbx
sar rbx, 0x3f
and rcx, rbx
mov r8, qword [rsp + 0x38]
lea rax, [r8 + rcx]
mov rbx, rdi
lea rdx, [rsp + 0x50]
nop
call rsi
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
lea rdx, [rsp + 0x50]
call rcx
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rax, rcx
mov rcx, rbx
call fcn.00464c60
call fcn.00464be0
nop
nop dword [rax + rax]
call fcn.00462540
jmp fcn.00501b80
Function at 0x51daa0
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x51dd01
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
test rax, rax
je 0x51dce5
mov qword [rsp + 0xb8], rax
mov rbx, qword [rax + 8]
mov rdx, qword [rax]
mov rcx, qword [rax + 0x10]
test rbx, rbx
jne 0x51daed
xor ebx, ebx
xor ecx, ecx
jmp 0x51db00
mov rax, rdx
call fcn.0050ea40
mov rcx, rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x48], rbx
cmp qword [rax + 0x28], 0
je 0x51dc18
mov rcx, qword [rax + 0x18]
mov rax, rcx
nop
call fcn.00480ce0
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0xb8]
mov r8, qword [rcx + 0x20]
mov r9, qword [rcx + 0x28]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x005e0478]
mov esi, 1
lea rax, [rsp + 0x68]
mov rbx, qword [rsp + 0x88]
call fcn.0044e020
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.00403200
xorps xmm15, xmm15
mov r14, qword [0x0073b288]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x51dbdb
xor eax, eax
lea rbx, [0x005e0608]
mov ecx, 1
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x60]
lea r8, [0x0058f3b7]
mov r9d, 2
mov r10, qword [rsp + 0x98]
mov r11, qword [rsp + 0x58]
call fcn.0044e100
jmp 0x51dc08
xor eax, eax
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x60]
lea rdi, [0x005e0508]
mov esi, 1
mov r8, qword [rsp + 0x98]
mov r9, qword [rsp + 0x58]
call fcn.0044e020
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov rax, qword [rax + 0x18]
nop dword [rax]
call fcn.00480ce0
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsp + 0x88]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 0x3a
call fcn.00403200
xorps xmm15, xmm15
mov r14, qword [0x0073b288]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x51dca8
xor eax, eax
lea rbx, [0x005e0608]
mov ecx, 1
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x48]
lea r8, [0x0058f3b7]
mov r9d, 2
mov r10, qword [rsp + 0x90]
mov r11, qword [rsp + 0x50]
call fcn.0044e100
jmp 0x51dcd5
xor eax, eax
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x005e0508]
mov esi, 1
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x50]
call fcn.0044e020
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
lea rax, [0x0058f7ee]
mov ebx, 5
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov qword [rsp + 8], rax
call fcn.00462540
mov rax, qword [rsp + 8]
jmp fcn.0051daa0
Function at 0x522340
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x522358
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x522358
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x522360
xor eax, eax
ret
cmp rbx, 3
je 0x52236c
cmp rbx, 4
jne 0x522399
cmp al, 0x2c
ja 0x522386
lea ecx, [rax - 0x21]
cmp cl, 1
jbe 0x522396
cmp al, 0x24
je 0x522396
nop dword [rax]
cmp al, 0x26
jae 0x522396
jmp 0x522399
lea ecx, [rax - 0x3a]
cmp cl, 4
jbe 0x522396
cmp al, 0x5b
je 0x522396
cmp al, 0x5d
jne 0x522399
xor eax, eax
ret
cmp al, 0x2f
ja 0x5223d2
nop dword [rax]
cmp al, 0x26
ja 0x5223b1
cmp al, 0x24
je 0x5223f1
cmp al, 0x26
je 0x5223f1
jmp 0x52246b
lea ecx, [rax - 0x2b]
cmp cl, 1
jbe 0x5223f1
lea ecx, [rax - 0x2d]
nop dword [rax]
cmp cl, 1
jbe 0x522468
cmp al, 0x2f
je 0x5223f1
jmp 0x52246b
cmp al, 0x3d
ja 0x5223e9
lea ecx, [rax - 0x3a]
cmp cl, 1
jbe 0x5223f1
nop
cmp al, 0x3d
je 0x5223f1
jmp 0x52246b
lea ecx, [rax - 0x3f]
cmp cl, 1
ja 0x522460
cmp rbx, 2
jg 0x522427
cmp rbx, 1
je 0x522421
nop dword [rax]
cmp rbx, 2
jne 0x52246b
cmp al, 0x2f
je 0x522412
cmp al, 0x3b
je 0x522412
cmp al, 0x2c
jne 0x522419
mov ecx, 1
jmp 0x52241e
cmp al, 0x3f
sete cl
mov eax, ecx
ret
cmp al, 0x3f
sete al
ret
cmp rbx, 5
jne 0x52244a
cmp al, 0x40
je 0x522439
cmp al, 0x2f
je 0x522439
cmp al, 0x3f
jne 0x522442
mov ecx, 1
nop
jmp 0x522447
cmp al, 0x3a
sete cl
mov eax, ecx
ret
cmp rbx, 6
je 0x522459
cmp rbx, 7
jne 0x52246b
xor eax, eax
ret
mov eax, 1
ret
cmp al, 0x5f
je 0x522468
cmp al, 0x7e
jne 0x52246b
xor eax, eax
ret
cmp rbx, 7
jne 0x522481
cmp al, 0x21
je 0x52247d
lea ecx, [rax - 0x28]
cmp cl, 2
ja 0x522481
xor eax, eax
nop
ret
mov eax, 1
ret
Function at 0x140001008
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
lea rcx, str._JAVA_LAUNCHER_DEBUG
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x140001069
lea rcx, str.Windows_original_main_args:_n
call fcn.140001148
xor ebx, ebx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
cmp dword [rax], ebx
jle 0x140001069
xor edi, edi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argv]
mov edx, ebx
lea rcx, str.wwwd_args__d____s_n
mov r8, qword [rax]
mov r8, qword [rdi + r8]
call fcn.140001148
inc ebx
lea rdi, [rdi + 8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
cmp ebx, dword [rax]
jl 0x14000103e
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
call sub.jli.dll_JLI_CmdToArgs
call sub.jli.dll_JLI_GetStdArgc
movsxd rdi, eax
lea ecx, [rdi + 1]
movsxd rcx, ecx
shl rcx, 3
call sub.jli.dll_JLI_MemAlloc
mov rbx, rax
call sub.jli.dll_JLI_GetStdArgs
xor r9d, r9d
test edi, edi
jle 0x1400010b5
xor edx, edx
mov r9d, edi
mov rcx, qword [rax]
lea rax, [rax + 0x10]
mov qword [rbx + rdx*8], rcx
inc rdx
cmp rdx, rdi
jl 0x1400010a2
mov rcx, qword [str.java]
movsxd rax, r9d
and qword [rbx + rax*8], 0
test rcx, rcx
jne 0x1400010cc
mov rcx, qword [rbx]
mov rax, qword [section..data]
test rax, rax
jne 0x1400010db
mov rax, qword [rbx]
and dword [rsp + 0x68], 0
lea r9, str._J_ms8m
mov byte [rsp + 0x60], 0
mov r8d, 2
mov byte [rsp + 0x58], 0
mov rdx, rbx
mov byte [rsp + 0x50], 1
mov qword [rsp + 0x48], rcx
mov ecx, edi
mov qword [rsp + 0x40], rax
lea rax, [0x1400022cc]
mov qword [rsp + 0x38], rax
lea rax, [0x1400022d0]
mov qword [rsp + 0x30], rax
lea rax, str._lib_tools.jar
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r8d
call sub.jli.dll_JLI_Launch
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret

Function at 0x14000173c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001786
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001786
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001786
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001786
cmp dword [rcx + 0x84], 0xe
jbe 0x140001786
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001788
xor al, al
add rsp, 0x28
ret
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x0042b940]
xor edx, edx
mov dword [rax], 1
mov rax, qword [0x0042b950]
mov dword [rax], 1
mov rax, qword [0x0042b960]
mov dword [rax], 1
mov rax, qword [0x0042b930]
mov dword [rax], 1
mov rax, qword [0x0042b7e0]
cmp word [rax], 0x5a4d
je 0x4010b0
mov rax, qword [0x0042b920]
mov dword [0x00430008], edx
mov eax, dword [rax]
test eax, eax
je 0x4010a0
mov ecx, 2
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x0042b8a0]
mov edx, dword [rdx]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x0042b790]
cmp dword [rax], 1
je 0x4010f0
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x401075
movsxd rcx, dword [rax + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x401058
movzx ecx, word [rax + 0x18]
cmp cx, 0x10b
je 0x401103
cmp cx, 0x20b
jne 0x401058
cmp dword [rax + 0x84], 0xe
jbe 0x401058
mov ecx, dword [rax + 0xf8]
xor edx, edx
test ecx, ecx
setne dl
jmp 0x401058
lea rcx, [sym._matherr]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401058
mov r8d, dword [rax + 0xe8]
xor edx, edx
test r8d, r8d
setne dl
jmp 0x401058
Function at 0x404c7f
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
lea rax, str.echoBinSafe
mov qword [rbp - 0x48], rax
lea rax, str.F:_nim_1.6.0lib_systemio.nim
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x40], 0
mov word [rbp - 0x30], 0
lea rax, [rbp - 0x50]
mov rcx, rax
call sym.nimFrame_4
mov qword [rbp - 0x10], 0
mov qword [rbp - 0x40], 8
lea rax, [0x004284a8]
mov qword [rbp - 0x38], rax
mov qword [rbp - 8], 0
mov qword [rbp - 0x40], 9
lea rax, [0x004284a8]
mov qword [rbp - 0x38], rax
mov rax, qword [rbp - 8]
cmp rax, qword [rbp + 0x28]
jge 0x404dca
mov qword [rbp - 0x40], 0x321
lea rax, str.F:_nim_1.6.0lib_systemio.nim
mov qword [rbp - 0x38], rax
mov rdx, qword [rbp - 8]
mov rax, qword [rbp + 0x28]
cmp rdx, rax
jb 0x404d40
mov rax, qword [rbp + 0x28]
lea rdx, [rax - 1]
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.raiseIndexError2
mov rax, qword [rbp - 8]
lea rdx, [rax*8]
mov rax, qword [rbp + 0x20]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov rbx, qword [rax]
mov ecx, 1
mov rax, qword [sym.__acrt_iob_func]
call rax
mov r8d, 0
mov rdx, rbx
mov rcx, rax
call sym.writeWindows_systemZio_205
mov qword [rbp - 0x40], 0xb
lea rax, [0x004284a8]
mov qword [rbp - 0x38], rax
mov edx, 0
mov rax, qword [rbp - 8]
add rax, 1
jno 0x404da4
mov edx, 1
mov rcx, rax
lea rax, [rbp - 0x58]
mov qword [rax], rcx
mov rax, rdx
and eax, 1
test al, al
je 0x404dbd
call sym.raiseOverflow
mov rax, qword [rbp - 0x58]
mov qword [rbp - 8], rax
jmp 0x404cfe
nop
mov qword [rbp - 0x40], 0x327
lea rax, str.F:_nim_1.6.0lib_systemio.nim
mov qword [rbp - 0x38], rax
mov dword [rbp - 0x14], 0
mov ecx, 1
mov rax, qword [sym.__acrt_iob_func]
call rax
mov r9, rax
mov r8d, 1
mov edx, 1
lea rcx, [0x004284ce]
call sym.fwrite
mov dword [rbp - 0x14], eax
mov qword [rbp - 0x40], 0x328
lea rax, str.F:_nim_1.6.0lib_systemio.nim
mov qword [rbp - 0x38], rax
mov dword [rbp - 0x18], 0
mov ecx, 1
mov rax, qword [sym.__acrt_iob_func]
call rax
mov rcx, rax
call sym.fflush
mov dword [rbp - 0x18], eax
call sym.popFrame_4
nop
add rsp, 0x88
pop rbx
pop rbp
ret

Function at 0x406c17
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov dword [rbp - 4], 0
cmp qword [rbp + 0x18], 0
je 0x406c46
mov rax, qword [rbp + 0x18]
mov rcx, rax
call sym.nimCStrLen_1
mov rdx, rax
jmp 0x406c4b
mov edx, 0
mov rax, qword [rbp + 0x18]
mov r9, qword [rbp + 0x10]
mov r8, rdx
mov edx, 1
mov rcx, rax
call sym.fwrite
mov dword [rbp - 4], eax
mov dword [rbp - 8], 0
mov rcx, qword [rbp + 0x10]
call sym.fflush
mov dword [rbp - 8], eax
nop
add rsp, 0x30
pop rbp
ret
Function at 0x40f15f
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov dword [rbp - 4], 0
mov rdx, qword [rbp + 0x20]
mov rax, qword [rbp + 0x18]
mov r9, qword [rbp + 0x10]
mov r8, rdx
mov edx, 1
mov rcx, rax
call sym.fwrite
mov dword [rbp - 4], eax
mov dword [rbp - 8], 0
mov rcx, qword [rbp + 0x10]
call sym.fflush
mov dword [rbp - 8], eax
nop
add rsp, 0x30
pop rbp
ret

Function at 0x425840
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x00431b64]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x4259c8
mov rax, qword [0x00431b68]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x42588c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x425915
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x425870
mov rcx, rbx
call sym.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x4259fd
mov rax, qword [0x00431b68]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call sym._GetPEImageBase
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x00431b68]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x4259e0
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x42590e
sub eax, 0x40
and eax, 0xffffffbf
jne 0x425970
add dword [0x00431b64], 1
cmp edi, 8
jae 0x425943
test dil, 4
jne 0x4259b4
test edi, edi
je 0x425938
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x4259cf
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x425938
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x42595c
jmp 0x425938
add rsi, qword [0x00431b68]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x42590e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x425938
xor esi, esi
jmp 0x425897
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x425938
mov rax, qword [0x00431b68]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call sym.__report_error
nop
nop dword [rax]
Function at 0x426150
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00431e40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x00431e20]
test rbx, rbx
je 0x4261a4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x42619b
test rsi, rsi
je 0x42619b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x426180
lea rcx, [0x00431e40]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x4263e0
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x4263f0
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x426400
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x426441
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x426438
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x426443
add rax, 0x28
cmp rax, r9
jne 0x426424
xor eax, eax
ret

Function at 0x4264e0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x0042b7e0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x42654d
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x42654d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x42654d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x426544
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x42654f
add rax, 0x28
cmp rax, r9
jne 0x426530
xor eax, eax
add rsp, 0x28
ret

Function at 0x426650
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x0042b7e0]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
je 0x426670
add rsp, 0x28
ret
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x426668
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x4266cd
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x4266c4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x4266d4
add rax, 0x28
cmp rax, r9
jne 0x4266b0
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret