joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007340c
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x1404879f8]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x140483428]
test eax, eax
je 0x140073457
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140483428]
test eax, eax
jne 0x140073460
call fcn.140015390
test eax, eax
je 0x14007347c
lea rdx, [rsp + 0x48]
mov rcx, qword [0x140278390]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x140073484
xor eax, eax
jmp 0x1400734e1
test rbx, rbx
jne 0x1400734a4
lea rcx, str.ImageList_GetImageCount
call fcn.14001ddcc
mov rbx, rax
test rax, rax
je 0x1400734af
mov qword [0x1404879f8], rax
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x1400734c4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1400734c6
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x1400734df
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x1401163a8
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x14048ae70]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x140483428]
test eax, eax
je 0x1401163f3
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140483428]
test eax, eax
jne 0x1401163fc
call fcn.140015390
test eax, eax
je 0x140116418
lea rdx, [rsp + 0x48]
mov rcx, qword [0x140278390]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x140116420
xor eax, eax
jmp 0x14011647d
test rbx, rbx
jne 0x140116440
lea rcx, str.ChooseColorW
call fcn.14003f9e8
mov rbx, rax
test rax, rax
je 0x14011644b
mov qword [0x14048ae70], rax
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x140116460
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140116462
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14011647b
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x14011cfd0
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x14048b068]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x140483428]
test eax, eax
je 0x14011d01b
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140483428]
test eax, eax
jne 0x14011d024
call fcn.140015390
test eax, eax
je 0x14011d040
lea rdx, [rsp + 0x48]
mov rcx, qword [0x140278390]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x14011d048
xor eax, eax
jmp 0x14011d0a5
test rbx, rbx
jne 0x14011d068
lea rcx, str.PrintDlgW
call fcn.14003f9e8
mov rbx, rax
test rax, rax
je 0x14011d073
mov qword [0x14048b068], rax
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x14011d088
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14011d08a
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14011d0a3
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x140122728
Capabilities:
Delete registry value

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x140122864
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x38
mov rcx, qword [rcx + 8]
lea rax, [r11 + 8]
lea r9, [r11 + 0x20]
mov qword [r11 - 0x10], rax
mov qword [r11 - 0x18], r8
xor r8d, r8d
mov dword [rsp + 0x40], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor edx, edx
test eax, eax
jne 0x1401228a6
mov ecx, dword [rsp + 0x58]
sub ecx, 4
neg ecx
sbb eax, eax
and eax, 0xd
test eax, eax
sete dl
mov eax, edx
add rsp, 0x38
ret
Function at 0x140122cb4
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, r9
mov rbx, r8
mov rsi, rdx
mov rbp, rcx
test rdx, rdx
je 0x140122d86
test rbx, rbx
je 0x140122d8c
test r9, r9
je 0x140122d92
and qword [r8], 0
and dword [r9], 0
mov rcx, qword [rcx + 8]
mov qword [rax - 0x10], r9
and qword [rax - 0x18], 0
lea r9, [rax + 0x10]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140122d6f
cmp dword [rsp + 0x48], 3
jne 0x140122d6f
test eax, eax
jne 0x140122d6f
cmp dword [rdi], eax
je 0x140122d6f
mov ecx, dword [rdi]
call fcn.140012af8
lea r9, [rsp + 0x48]
xor r8d, r8d
mov qword [rbx], rax
mov rcx, qword [rbp + 8]
mov rdx, rsi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140122d63
cmp dword [rsp + 0x48], 3
jne 0x140122d63
test eax, eax
jne 0x140122d63
mov eax, 1
jmp 0x140122d71
mov rcx, qword [rbx]
call fcn.140012b44
and qword [rbx], 0
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
call fcn.140013d5c
int3
call fcn.140013d5c
int3
call fcn.140013d5c
int3

Function at 0x140123050
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
cmp dword [rcx + 0x28], ebx
je 0x140123061
xor eax, eax
jmp 0x14012308f
mov rcx, qword [rcx + 8]
lea rax, [rsp + 0x40]
mov r9d, 4
mov dword [rsp + 0x40], r8d
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x140123098
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
cmp dword [rcx + 0x28], ebx
je 0x1401230a9
xor eax, eax
jmp 0x1401230cd
mov rcx, qword [rcx + 8]
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], r8
mov r9d, 3
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret
Function at 0x140176ecc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
test byte [rdx + 4], 1
mov esi, r8d
mov rbx, rdx
mov rbp, rcx
je 0x140176ef5
mov rdi, qword [rdx + 0x10]
jmp 0x140176f46
mov rdx, qword [rdx + 0x10]
mov rcx, qword [rbx + 8]
mov r8d, 5
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
jne 0x140176f16
call fcn.140020d98
mov rcx, qword [rbx + 8]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
jne 0x140176f30
call fcn.140020d98
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
jne 0x140176f46
call fcn.140020d98
call fcn.1400225c4
cmp qword [rax + 0x68], 0
je 0x140176f60
mov rdx, rdi
mov rcx, rbp
call fcn.140176538
mov rdi, rax
mov edx, esi
mov rcx, rdi
call fcn.1401771c4
mov rcx, qword [rbp + 0xe8]
mov rsi, rax
test rcx, rcx
je 0x140176f87
call qword [sym.imp.KERNEL32.dll_GlobalFree]
and qword [rbp + 0xe8], 0
test rsi, rsi
je 0x140176f96
mov rdi, rsi
mov qword [rbp + 0xe8], rsi
or dword [rbx + 4], 1
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov qword [rbx + 0x10], rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140177334
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov rdi, rcx
xor ebx, ebx
mov qword [rax - 0x18], rbx
mov r14, qword [0x14048c088]
and qword [rax + 8], rbx
xor esi, esi
mov eax, dword [0x140483428]
test eax, eax
je 0x140177380
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140483428]
test eax, eax
jne 0x140177389
call fcn.140015390
test eax, eax
je 0x1401773a5
lea rdx, [rsp + 0x40]
mov rcx, qword [0x140278390]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x1401773b0
xor eax, eax
jmp 0x140177434
test r14, r14
jne 0x1401773cd
lea rcx, str.CreatePropertySheetPageW
call fcn.140177630
test rax, rax
je 0x1401773ff
mov qword [0x14048c088], rax
mov eax, dword [rdi + 4]
mov ecx, 0x4000
test ecx, eax
jne 0x1401773ee
cmp dword [rdi], 0x60
jb 0x1401773ee
or eax, ecx
mov dword [rdi + 4], eax
mov rax, qword [0x140278390]
mov qword [rdi + 0x58], rax
mov rcx, rdi
call qword [0x14048c088]
mov rbx, rax
mov qword [rsp + 0x20], rax
xor edi, edi
test rbx, rbx
sete dil
test edi, edi
je 0x140177416
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140177418
xor esi, esi
mov rdx, qword [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test edi, edi
je 0x140177431
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rbx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x14017744c
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x14048c090]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x140483428]
test eax, eax
je 0x140177497
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140483428]
test eax, eax
jne 0x1401774a0
call fcn.140015390
test eax, eax
je 0x1401774bc
lea rdx, [rsp + 0x48]
mov rcx, qword [0x140278390]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x1401774c4
xor eax, eax
jmp 0x140177521
test rbx, rbx
jne 0x1401774e4
lea rcx, str.DestroyPropertySheetPage
call fcn.140177630
mov rbx, rax
test rax, rax
je 0x1401774ef
mov qword [0x14048c090], rax
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x140177504
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140177506
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14017751f
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x140177538
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
or rdi, 0xffffffffffffffff
mov qword [rax - 0x18], rdi
mov rbx, qword [0x14048c098]
and qword [rax + 0x10], 0
xor esi, esi
mov eax, dword [0x140483428]
test eax, eax
je 0x140177587
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140483428]
test eax, eax
jne 0x140177590
call fcn.140015390
test eax, eax
je 0x1401775ac
lea rdx, [rsp + 0x48]
mov rcx, qword [0x140278390]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x1401775b6
or rax, 0xffffffffffffffff
jmp 0x140177618
test rbx, rbx
jne 0x1401775d6
lea rcx, str.PropertySheetW
call fcn.140177630
mov rbx, rax
test rax, rax
je 0x1401775e3
mov qword [0x14048c098], rax
mov rcx, r14
call rbx
mov rdi, rax
mov qword [rsp + 0x20], rax
xor ebx, ebx
cmp rdi, 0xffffffffffffffff
sete bl
test ebx, ebx
je 0x1401775fa
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1401775fc
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x140177615
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x14019e350
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.14019e1b8
Function at 0x180002f80
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov rax, qword gs:[0x60]
mov rbp, rdx
mov r14, rcx
mov rsi, qword [rax + 0x18]
add rsi, 0x10
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x180003026
movzx ebx, word [rdi + 0x58]
xor eax, eax
shr rbx, 1
je 0x180003015
mov r10, qword [rdi + 0x60]
nop dword [rax]
nop dword [rax + rax]
movzx edx, word [r10]
movsx r11d, byte [rax + rbp]
movzx r9d, r11w
lea ecx, [rdx - 0x61]
cmp cx, 0x19
lea r8d, [rdx - 0x20]
lea ecx, [r9 - 0x61]
cmova r8w, dx
cmp cx, 0x19
lea edx, [r9 - 0x20]
cmova dx, r11w
cmp r8w, dx
jne 0x18000301e
test r11b, r11b
je 0x18000301e
inc rax
add r10, 2
cmp rax, rbx
jb 0x180002fd0
mov rax, qword [rdi + 0x30]
mov qword [r14], rax
jmp 0x18000302d
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x180002fb5
mov qword [r14], 0
mov rbx, qword [rsp + 0x10]
mov rax, r14
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
pop r14
ret
Function at 0x1800071e0
Capabilities:
Parse pe header

Disassembly:
push rbx
push r13
sub rsp, 0x18
mov r11, qword [rcx]
xor r9d, r9d
mov r13, r8
mov rbx, rdx
test r11, r11
je 0x180007319
mov qword [rsp + 0x30], rbp
mov eax, 0x5a4d
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x10], r12
mov qword [rsp + 8], r14
mov qword [rsp], r15
cmp word [r11], ax
jne 0x1800072ee
movsxd rax, dword [r11 + 0x3c]
add rax, r11
cmp dword [rax], 0x4550
cmovne rax, r9
test rax, rax
je 0x1800072ee
add rax, 0x18
mov ecx, 0x20b
cmp word [rax], cx
jne 0x1800072ee
test rax, rax
je 0x1800072ee
cmp dword [rax + 0x6c], r9d
jbe 0x1800072ee
lea r14, [rax + 0x70]
test r14, r14
je 0x1800072ee
mov r15d, dword [r14]
mov r10d, r9d
mov edi, dword [r11 + r15 + 0x18]
lea rsi, [r11 + r15]
test edi, edi
je 0x1800072ee
mov r12d, dword [rsi + 0x20]
nop dword [rax]
mov ebp, r10d
mov r8, r13
lea rax, [r12 + rbp*4]
mov eax, dword [rax + r11]
add rax, r11
sub r8, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1800072b7
inc rax
test ecx, ecx
jne 0x1800072a4
test edx, edx
je 0x1800072c5
inc r10d
cmp r10d, edi
jb 0x180007290
jmp 0x1800072ee
mov ecx, dword [rsi + 0x24]
add rcx, r11
movzx edx, word [rcx + rbp*2]
mov ecx, dword [rsi + 0x1c]
add rcx, r11
mov r8d, dword [rcx + rdx*4]
cmp r8d, r15d
jb 0x1800072ea
mov eax, r8d
sub eax, r15d
cmp eax, dword [r14 + 4]
jb 0x1800072ee
lea r9, [r11 + r8]
mov qword [rbx], r9
mov rax, rbx
mov r15, qword [rsp]
mov r14, qword [rsp + 8]
mov r12, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
add rsp, 0x18
pop r13
pop rbx
ret
mov qword [rdx], r9
mov rax, rbx
add rsp, 0x18
pop r13
pop rbx
ret

Function at 0x180007770
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r9, qword [rcx]
mov rbx, rdx
xor edx, edx
mov rdi, rcx
test r9, r9
je 0x18000780f
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x1800077f0
movsxd r8, dword [r9 + 0x3c]
add r8, r9
cmp dword [r8], 0x4550
cmovne r8, rdx
test r8, r8
je 0x1800077f0
movzx ecx, word [r8 + 0x14]
movzx eax, word [r8 + 6]
add rcx, 0x18
add rcx, r8
lea rax, [rax + rax*4]
lea r8, [rcx + rax*8]
cmp rcx, r8
je 0x1800077f0
nop
test dword [rcx + 0x24], 0x40000000
je 0x1800077e7
cmp dword [rcx], 0x7461642e
jne 0x1800077e7
cmp byte [rcx + 4], 0x61
je 0x180007804
add rcx, 0x28
cmp rcx, r8
jne 0x1800077d0
mov qword [rbx + 8], rdx
mov rax, rdx
mov ecx, 8
mov r9, rbx
add r9, rcx
jmp 0x180007816
mov eax, dword [rcx + 0xc]
mov edx, dword [rcx + 8]
add rax, r9
jmp 0x1800077f7
lea r9, [rbx + 8]
mov rax, rdx
mov qword [rbx], rax
mov rcx, rdi
mov qword [r9], rdx
lea rdx, [rbx + 0x10]
call fcn.180007840
mov rax, qword [rdi]
mov qword [rbx + 0x20], rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180007840
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r10, qword [rcx]
xor r8d, r8d
test r10, r10
je 0x1800078d5
mov eax, 0x5a4d
cmp word [r10], ax
jne 0x1800078b2
movsxd rcx, dword [r10 + 0x3c]
add rcx, r10
cmp dword [rcx], 0x4550
cmovne rcx, r8
test rcx, rcx
je 0x1800078b2
movzx eax, word [rcx + 0x14]
add rax, 0x18
add rax, rcx
movzx ecx, word [rcx + 6]
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8]
cmp rax, r9
je 0x1800078b2
nop dword [rax]
test dword [rax + 0x24], 0x40000000
je 0x1800078a9
cmp dword [rax], 0x6164722e
jne 0x1800078a9
cmp word [rax + 4], 0x6174
je 0x1800078c9
add rax, 0x28
cmp rax, r9
jne 0x180007890
mov qword [rdx + 8], r8
mov rcx, r8
mov eax, 8
mov qword [rdx], rcx
mov qword [rax + rdx], r8
mov rax, rdx
ret
mov ecx, dword [rax + 0xc]
mov r8d, dword [rax + 8]
add rcx, r10
jmp 0x1800078b9
mov qword [rdx], r8
mov rax, rdx
mov qword [rdx + 8], r8
ret
Function at 0x180009180
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x58
cmp qword [0x180015028], 0
jne 0x180009388
mov qword [rsp + 0x70], rbx
lea rdx, str.SDL3.dll
mov qword [rsp + 0x50], rdi
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x78], rsi
call fcn.180002f80
mov rax, qword [rsp + 0x60]
xor ebx, ebx
test rax, rax
je 0x18000922b
mov edx, 0x5a4d
mov rcx, rax
cmp word [rax], dx
cmovne rcx, rbx
test rcx, rcx
je 0x18000922b
movsxd r8, dword [rcx + 0x3c]
add r8, rax
cmp dword [r8], 0x4550
cmovne r8, rbx
test r8, r8
je 0x18000922b
movzx edx, word [r8 + 0x14]
movzx ecx, word [r8 + 6]
add rdx, 0x18
add rdx, r8
lea rcx, [rcx + rcx*4]
lea r8, [rdx + rcx*8]
cmp rdx, r8
je 0x18000922b
test dword [rdx + 0x24], 0x20000000
je 0x180009222
cmp dword [rdx], 0x7865742e
jne 0x180009222
cmp byte [rdx + 4], 0x74
je 0x1800092d5
add rdx, 0x28
cmp rdx, r8
jne 0x180009207
mov rdi, rbx
mov rsi, rbx
lea rcx, [0x1800155e0]
mov qword [0x1800155e0], 0xf4240
mov qword [0x180015030], rcx
lea r8, str.SDL_PeepEvents
lea rcx, [rsp + 0x60]
mov qword [0x1800155e8], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x60], rax
call fcn.1800071e0
mov rdx, qword [rax]
cmp rdx, rdi
jb 0x180009359
cmp rsi, 7
jb 0x180009359
mov rcx, rdx
lea rax, [rsi - 7]
sub rcx, rdi
cmp rcx, rax
ja 0x180009359
lea r8, [0x180012e74]
mov rcx, rdx
sub r8, rdx
movzx eax, byte [r8 + rcx]
cmp byte [rcx], al
je 0x1800092af
cmp al, 0x3f
jne 0x1800092e3
inc rcx
mov rax, rcx
sub rax, rdx
cmp rax, 7
jb 0x1800092a2
mov al, 1
test al, al
je 0x180009359
test rdx, rdx
je 0x1800092e7
mov rcx, rdx
sub rcx, rdi
jmp 0x1800092f0
mov edi, dword [rdx + 0xc]
mov esi, dword [rdx + 8]
add rdi, rax
jmp 0x180009231
xor al, al
jmp 0x1800092c0
mov rcx, rbx
mov rdi, rbx
mov rdx, rbx
test rdi, rdi
je 0x180009359
mov r8d, 3
movsxd rax, dword [rdx + r8]
add rax, rcx
mov qword [0x180015040], rbx
add rax, rdi
mov byte [0x1800155d8], 0
lea rcx, [r8 + 4]
add rcx, rax
lea rax, [0x180015030]
mov qword [0x180015028], rax
mov qword [0x180015038], rcx
je 0x180009379
mov rax, qword [rcx]
mov rsi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x50]
mov qword [0x180015040], rax
lea rax, [0x18000e0c3]
mov qword [rcx], rax
add rsp, 0x58
ret
xorps xmm0, xmm0
mov byte [0x1800155d8], 0
lea rax, [0x180015030]
movdqu xmmword [0x180015038], xmm0
mov qword [0x180015028], rax
mov rsi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x50]
add rsp, 0x58
ret
Function at 0x140001010
Capabilities:
Manipulate console buffer

Disassembly:
push rbx
sub rsp, 0x30
mov word [rsp + 0x40], cx
mov ecx, 0xfffffff5
mov ebx, r8d
mov word [rsp + 0x42], dx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, dword [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
test ebx, ebx
jle 0x1400010ea
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r12
mov esi, ebx
mov edi, ebx
mov r12d, 4
lea rbp, [0x1401fe040]
mov rbx, rsi
nop dword [rax + rax]
call fcn.140001a90
dec rbx
jne 0x140001070
mov dl, 0xa
mov rcx, rbp
call fcn.140001e90
mov rax, qword [0x1401fe040]
movsxd rcx, dword [rax + 4]
test byte [rcx + rbp + 0x10], 6
jne 0x1400010af
mov rcx, qword [rcx + rbp + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x68]
cmp eax, 0xffffffff
mov rax, qword [0x1401fe040]
cmove ebx, r12d
movsxd rcx, dword [rax + 4]
add rcx, rbp
test ebx, ebx
je 0x1400010d1
mov edx, dword [rcx + 0x10]
or edx, ebx
cmp qword [rcx + 0x48], 0
jne 0x1400010c9
or edx, r12d
xor r8d, r8d
call fcn.1400020d0
dec rdi
jne 0x140001068
mov r12, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
add rsp, 0x30
pop rbx
ret

Function at 0x140001350
Capabilities:
Allocate or change rwx memory
Parse pe header

Disassembly:
push rdi
push r12
push r13
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
mov rbx, rcx
xor edi, edi
mov qword [rsp + 0x58], rdi
mov eax, 0x5a4d
cmp ax, word [rcx]
je 0x140001388
xor eax, eax
jmp 0x14000142b
movsxd r12, dword [rcx + 0x3c]
cmp dword [r12 + rcx], 0x4550
je 0x14000139d
xor eax, eax
jmp 0x14000142b
lea rsi, [r12 + rcx + 0x108]
mov edx, dword [r12 + rcx + 0x50]
mov r9d, 4
mov r8d, 0x3000
mov rcx, qword [r12 + rcx + 0x30]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r13, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x14000142b
mov r8d, dword [r12 + rbx + 0x54]
mov rdx, rbx
mov rcx, rax
call fcn.140146300
nop
movzx eax, word [r12 + rbx + 6]
cmp edi, eax
jge 0x140001407
mov r8d, dword [rsi + 0x10]
mov edx, dword [rsi + 0x14]
add rdx, rbx
mov ecx, dword [rsi + 0xc]
add rcx, r13
call fcn.140146300
add rsi, 0x28
inc edi
jmp 0x1400013e0
mov edx, dword [r12 + rbx + 0x50]
lea r9, [rsp + 0x50]
mov r8d, 0x40
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
jmp 0x140001428
mov rax, r13
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r13
pop r12
pop rdi
ret