joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400183a0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x30
mov rbx, qword [rsp + 0x80]
mov r12, r9
mov rsi, r8
mov r15, rdx
mov rdi, rcx
cmp r8, rbx
jne 0x1400183e8
lea rdx, str.RegistryEx.cpp
lea rcx, str.pszValue___pszDefaultValue
mov r8d, 0x126
call fcn.1400010d0
xor ebp, ebp
mov r13d, ebp
test r15, r15
je 0x140018580
test rsi, rsi
je 0x140018580
test r12, r12
je 0x140018580
mov rcx, qword [rdi + 0x10]
or rdi, 0xffffffffffffffff
mov qword [rsp + 0x60], r14
test rcx, rcx
je 0x140018535
mov r14, qword [rsp + 0x88]
mov r13d, dword [r12]
mov qword [rsp + 0x68], rcx
test r14, r14
je 0x14001845d
lea rax, [rsp + 0x68]
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140018535
mov rcx, qword [rsp + 0x68]
lea r9, [rsp + 0x80]
xor r8d, r8d
mov rdx, r15
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r15d, eax
test r14, r14
je 0x14001848e
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [rsp + 0x80]
cmp ecx, 2
jne 0x140018500
mov eax, 2
mul r13
cmovo rax, rdi
mov rcx, rax
call fcn.140018e64
mov r14, rax
test rax, rax
je 0x1400184f9
mov r8d, r13d
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rdx, rsi
mov rcx, r14
sub rdx, r14
nop
movzx eax, word [rcx]
lea rcx, [rcx + 2]
mov word [rdx + rcx - 2], ax
test ax, ax
jne 0x1400184d0
mov rax, rdi
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400184e4
mov rcx, r14
mov dword [r12], eax
call fcn.14001a1b0
mov ecx, dword [rsp + 0x80]
test r15d, r15d
jne 0x140018535
lea eax, [rcx - 1]
cmp eax, 1
jbe 0x140018512
cmp ecx, 7
jne 0x140018517
mov ebp, 1
mov eax, ebp
mov r14, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret
test rbx, rbx
je 0x14001857c
nop word [rax + rax]
cmp word [rbx + rdi*2 + 2], bp
lea rdi, [rdi + 1]
jne 0x140018540
lea ecx, [rdi*2 + 2]
cmp ecx, r13d
ja 0x14001857c
sub rsi, rbx
nop word [rax + rax]
movzx eax, word [rbx]
lea rbx, [rbx + 2]
mov word [rsi + rbx - 2], ax
test ax, ax
jne 0x140018560
mov dword [r12], ecx
mov eax, 1
jmp 0x140018519
xor eax, eax
jmp 0x140018519
xor eax, eax
jmp 0x14001851e
Function at 0x1400187b0
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push r14
sub rsp, 0x60
mov rcx, qword [rcx + 0x10]
mov rsi, r9
mov r14d, r8d
mov rbp, rdx
test rcx, rcx
je 0x140018893
test rdx, rdx
je 0x140018893
test r9, r9
je 0x140018893
mov qword [r11 + 0x10], rbx
xor ebx, ebx
mov qword [r11 - 0x18], rcx
cmp qword [rsp + 0x98], rbx
je 0x140018854
mov rdx, qword [rsp + 0x98]
lea rax, [r11 + 8]
xor r9d, r9d
mov qword [r11 - 0x28], rax
lea rax, [r11 - 0x18]
xor r8d, r8d
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x38], rbx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14001884f
xor eax, eax
mov rbx, qword [rsp + 0x78]
lea r11, [rsp + 0x60]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
mov rcx, qword [rsp + 0x50]
mov eax, dword [rsp + 0x90]
mov r9d, r14d
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rdx, rbp
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
cmp qword [rsp + 0x98], rbx
je 0x14001888a
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
sete bl
mov eax, ebx
jmp 0x140018837
lea r11, [rsp + 0x60]
xor eax, eax
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret

Function at 0x14001b468
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14001b47e
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14001b480
xor eax, eax
test eax, eax
je 0x14001b490
mov ecx, eax
call fcn.14001c71c
or eax, 0xffffffff
jmp 0x14001b492
xor eax, eax
add rsp, 0x28
ret
Function at 0x180d5de32
Capabilities:
Encode data using xor

Disassembly:
or dword [rbx + 0x18], esp
sub al, 0x43
push rsi
sahf
adc al, byte [rax - 0x50df053d]
stosb byte [rdi], al
adc r13b, byte [rbp + r8*2 - 0x421a2f42]
popfq
cmp bh, byte [rcx - 0x6a]
nop
stc
wait
push 0x16
out 0x58, eax
cmp edi, esp
pop rbp
out dx, al
sub edi, dword [rcx + 0x3bfb3726]
cmpsd dword [rsi], dword [rdi]
cld
retf
and cl, dl
jrcxz 0x180d5dd8f
pushf
movabs r15, 0x21b373ca582508e5
or r15d, r15d
xor r15d, r15d
add qword [rsp + 0x20], 0x7f1bf86f
bswap r15
movabs r15, 0x73262bcf74224d31
mov r15, qword [rsp + 0x10]
call fcn.180cd2f52
mov rbp, qword [rsp + 0x18]
js 0x180d5de4b
add qword [rsp + 8], 0x7f27ca94
push qword [rsp + 0x30]
popfq
lea rsp, [rsp + 0x38]
call fcn.180ec0d35
int 0x47
add byte [rcx - 0x22e727d0], dh
cmp byte [rbx + 0x3a], 0x4f
fiadd word [rax + 0x2b95156a]
jg 0x180d5dded
call 0x18a56af98
insb byte [rdi], dx
invalid

Function at 0x180e29912
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rcx
add rdx, 0x711000ed
add edx, 0x711000ed
sub rdx, 0x69d95047
mov rdx, qword [rsp + 0x10]
movabs rcx, 0x420121776be15db0
movzx cx, cl
or rcx, 0xd4e4b98
setns cl
or cx, 0x273c
xor cl, 0xb8
lea rcx, [rcx + rcx*4 + 0x216820cb]
mov rcx, qword [rsp]
call fcn.180e1ae5a
xlatb
mov al, 0xce
test eax, 0x8fc84924
pop rbx
movabs byte [0x6c4672305b8e3020], al
and al, 0xa4
adc esi, edx
jnp 0x180e29914
sahf
add byte [rdi - 0x74], ch
fild dword [rbp - 0x5b8ddad0]
adc dh, byte [rbx]
int 0x73
and al, 0x44
invalid

Function at 0x180e2f831
Capabilities:
Encode data using xor

Disassembly:
push qword [rsp]
popfq
lea rsp, [rsp + 0x28]
call fcn.180f75724
outsb dx, byte [rsi]
xor dword [rcx + 0x70aeb31f], 0x45
invalid
not ebp
pushfq
sub bpl, 0x1b
bswap rbp
and bp, 0x2028
bswap ebp
mov rbp, qword [rsp + 0x18]
jo 0x180e2f833
je 0x180d7f6eb
add byte [rax], al
add byte [rbx + rsi + 0x44], al
outsd dx, dword [rsi]
insd dword [rdi], dx
jo 0x180e2f8c7
insb byte [rdi], dx
add byte gs:[rcx], al
add eax, 0xb3809489
in al, 0x4f
invalid
invalid

Function at 0x180e3b833
Capabilities:
Encode data using xor

Disassembly:
push qword [rsp + 0x60]
popfq
lea rsp, [rsp + 0x68]
call fcn.180ec0d35
or byte [rax], al
push rsi
push r10
push rbp
push rsp
xor dword [r8 + rsi], r14d
insb byte [rdi], dx
insb byte [rdi], dx
add cl, ch
and byte [rcx + 0x5600507f], bl
xchg ebp, eax
jg 0x180e3b840
test byte [rcx + 0x7ccf806d], dh
std
or byte gs:[rcx - 6], 0x9d
adc byte gs:[rbx + 0x7f90de44], 0x18
xor byte [rcx + 0x6f], ch
add byte [0x1014c14bc], 0xdc
push rdi
cdq
pop rsp
push 0xffffffff9957dc80
imul eax, dword [rax + 0x6b2665da], 0x1aacf080
xchg esi, eax
jg 0x180e3b877
jb 0x180e3b8b8
imul eax, dword [rax + 0x686de699], 0xffffff80
invalid
invalid
Function at 0x140001180
Capabilities:
Check if file exists
Download url
Get file attributes
Receive data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rdx, rdi
cmp eax, 0xffffffff
jne 0x14000120e
lea rcx, str.Downloading__s..._n
call fcn.140001010
xor ebx, ebx
xor r9d, r9d
mov r8, rdi
mov qword [rsp + 0x20], rbx
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
test eax, eax
jne 0x1400011ee
lea rcx, str.Download_successful._n
call fcn.140001010
mov ebx, 1
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov edx, eax
lea rcx, str.Failed_to_download_file._Error_code:__08lx_n
call fcn.140001010
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
lea rcx, str._s_already_exists._Checking_for_updates..._n
call fcn.140001010
mov rdx, rsi
mov rcx, rdi
call fcn.140001ad0
cmp eax, 2
jne 0x140001239
mov rdx, rdi
lea rcx, str.Updating__s..._n
jmp 0x1400011aa
mov rbx, qword [rsp + 0x40]
mov eax, 1
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400016b0
Capabilities:
Check if file exists
Create directory
Enumerate gui resources
Enumerate processes
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x280
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea rcx, str.utils
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14000170d
xor edx, edx
lea rcx, str.utils
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140001724
lea rcx, str.Failed_to_create_directory:__s_n
jmp 0x140001718
test al, 0x10
jne 0x140001724
lea rcx, str.A_file_with_the_name__s_already_exists._Cannot_create_directory._n
lea rdx, str.utils
call fcn.140001010
lea rdx, str.http:__96.126.111.48_MusicToSoundpad_MusicToSoundpad.exe
lea rcx, str.MusicToSoundpad.exe
call fcn.140001180
test eax, eax
je 0x140001886
lea rdx, str.http:__96.126.111.48_MusicToSoundpad_ffmpeg.exe
lea rcx, str.utils_ffmpeg.exe
call fcn.140001180
test eax, eax
je 0x140001886
lea rdx, str.https:__github.com_yt_dlp_yt_dlp_releases_latest_download_yt_dlp.exe
lea rcx, str.utilsyt_dlp.exe
call fcn.140001180
test eax, eax
je 0x140001886
xor ebp, ebp
lea r14, str.Spotify.exe
xor esi, esi
xor edi, edi
xor edx, edx
lea ecx, [rdi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000185e
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400017f6
nop dword [rax]
nop dword [rax + rax]
lea rdx, [rsp + 0x5c]
xor eax, eax
nop word [rax + rax]
movzx ecx, word [rdx + rax*2]
cmp cx, word [r14 + rax*2]
jne 0x140001846
movzx ecx, word [rdx + rax*2 + 2]
cmp cx, word [r14 + rax*2 + 2]
jne 0x140001846
add rax, 2
cmp rax, 0xc
jne 0x1400017d0
mov edi, dword [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x14000185e
test ebp, ebp
jne 0x140001820
mov r8d, edi
lea rcx, str.Process_ID_of__s:__lu_n
mov rdx, r14
call fcn.140001010
xor esi, esi
mov ebp, 1
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], edi
lea rcx, [0x140001250]
call qword [sym.imp.USER32.dll_EnumWindows]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140001780
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400017c0
jmp 0x1400017f6
test esi, esi
jne 0x140001876
mov rdx, r14
lea rcx, str.Process__s_is_not_running._n
call fcn.140001010
xor ebp, ebp
lea esi, [rbp + 1]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140001780
mov eax, 1
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400023f0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x140001910
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x370]
sub rsp, 0x470
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x360], rax
xor esi, esi
mov dword [rsp + 0x20], 0xf0000000
mov rdi, rdx
mov qword [rsp + 0x50], rsi
mov rbx, rcx
mov qword [rsp + 0x48], rsi
xor r8d, r8d
mov dword [rsp + 0x40], esi
lea r9d, [rsi + 1]
xor edx, edx
lea rcx, [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140001ac5
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x8003
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140001ab8
mov qword [rsp + 0x30], rsi
lea r8d, [rsi + 1]
mov dword [rsp + 0x28], 0x8000000
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140001aad
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rsi
mov r8d, 0x400
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140001a3a
mov r8d, dword [rsp + 0x40]
test r8d, r8d
je 0x140001a3a
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x60]
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, rbx
test eax, eax
je 0x140001aa7
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rsi
mov r8d, 0x400
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400019f3
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x58]
mov r8, rdi
mov dword [rsp + 0x58], 0x10
mov edx, 2
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov rcx, rbx
test eax, eax
je 0x140001aa7
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x50]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov al, 1
mov rcx, qword [rbp + 0x360]
xor rcx, rsp
call fcn.1400023f0
mov rbx, qword [rsp + 0x4a0]
add rsp, 0x470
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x50]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor al, al
jmp 0x140001a85
Function at 0x140001f50
Capabilities:
Read file on windows
Terminate process
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x1060
call fcn.1400031f0
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1050], rax
mov rbx, rcx
xor edi, edi
mov rcx, qword [0x140007658]
lea rax, [rcx + 1]
test rax, 0xfffffffffffffffe
jne 0x140001fdc
mov qword [rsp + 0x30], rdi
lea rcx, str..pipe_sp_remote_control
mov dword [rsp + 0x28], edi
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x140007658], rax
mov rcx, rax
cmp rax, 0xffffffffffffffff
jne 0x140001fdc
lea rcx, str.Error_opening_pipe_n
call fcn.140001e90
lea ecx, [rdi + 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rbx + r8], dil
jne 0x140001fe3
lea r9, [rsp + 0x44]
mov qword [rsp + 0x20], rdi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14000201b
lea rcx, str.Error_writing_to_pipe_n
call fcn.140001e90
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [0x140007658]
lea r9, [rsp + 0x40]
mov r8d, 0xfff
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140002059
lea rcx, str.Error_reading_from_pipe_n
call fcn.140001e90
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov eax, dword [rsp + 0x40]
cmp rax, 0x1000
jae 0x140002096
lea rcx, [rsp + 0x50]
mov byte [rsp + rax + 0x50], dil
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov rcx, qword [rsp + 0x1050]
xor rcx, rsp
call fcn.1400023f0
mov rbx, qword [rsp + 0x1078]
add rsp, 0x1060
pop rdi
ret
call fcn.140002518
int3

Function at 0x140002dc8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002e12
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002e12
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002e12
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002e12
cmp dword [rcx + 0x84], 0xe
jbe 0x140002e12
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002e14
xor al, al
add rsp, 0x28
ret
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x14000b970]
mov dword [rax], 1
mov rax, qword [0x14000b980]
mov dword [rax], 1
mov rax, qword [0x14000b990]
mov dword [rax], 1
mov rax, qword [0x14000b920]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140002260
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x140002f32
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x14000f108]
test eax, eax
je 0x140002fca
lea rax, [0x14000f0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x14000f110]
mov qword [rbp - 8], rax
jmp 0x140002fae
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x140002fa2
cmp qword [rbp - 0x10], 0
je 0x140002fa2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140002f68
lea rax, [0x14000f0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x140002fcb
nop
add rsp, 0x30
pop rbp
ret
Function at 0x1400030d0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400030f8
mov eax, 0
jmp 0x140003146
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140003121
mov eax, 0
jmp 0x140003146
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x140003141
mov eax, 0
jmp 0x140003146
mov eax, 1
add rsp, 0x20
pop rbp
ret

Function at 0x14000314c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x1400031ca
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x1400031c1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x1400031c1
mov rax, qword [rbp - 8]
jmp 0x1400031df
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x140003194
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x1400025b8
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
not r8d
mov r10, rcx
mov r9d, r8d
test rdx, rdx
je 0x140002612
mov r11b, 0x23
lea rbx, [0x14003ad70]
movzx edi, byte [r10]
dec rdx
inc r10
cmp dil, r11b
jne 0x1400025fc
cmp rdx, 2
jb 0x1400025fc
cmp byte [r10], r11b
jne 0x1400025fc
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
xor rcx, rdi
shr r9d, 8
xor r9d, dword [rbx + rcx*4]
test rdx, rdx
jne 0x1400025da
jmp 0x140002653
mov dl, byte [rcx]
inc r10
test dl, dl
je 0x140002653
mov r11b, 0x23
lea rbx, [0x14003ad70]
cmp dl, r11b
jne 0x140002637
cmp byte [r10], r11b
jne 0x140002637
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
movzx eax, dl
mov dl, byte [r10]
xor rcx, rax
shr r9d, 8
inc r10
xor r9d, dword [rbx + rcx*4]
test dl, dl
jne 0x140002625
mov rbx, qword [rsp + 8]
not r9d
mov rdi, qword [rsp + 0x10]
mov eax, r9d
ret

Function at 0x140002788
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
test r8, r8
je 0x1400027a8
and qword [r8], 0
lea rdx, [0x14003a7e8]
call fcn.140002664
mov rbx, rax
test rax, rax
je 0x140002899
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x140002890
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140002890
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140002890
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140002890
mov rbp, rdi
cmp rdi, 0xffffffffffffffff
je 0x140002890
mov rax, qword [0x140084940]
test rax, rax
je 0x14000282d
inc dword [rax + 0x3b0]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
je 0x140002890
mov r9, rbx
mov r8, rbp
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rbp
je 0x14000287d
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x140084940]
test rax, rax
je 0x140002872
dec dword [rax + 0x3b0]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140002899
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x14000288b
mov qword [rsi], rbp
mov rax, rdi
jmp 0x14000289b
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret