joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4460a0
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x446207
push rbp
mov rbp, rsp
sub rsp, 0x18
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x4460b2
cmp edx, ecx
jne 0x4461f5
nop word [rax + rax]
test rsi, rsi
jne 0x4461f5
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x446114
nop
call fcn.00468a80
xorps xmm15, xmm15
mov r14, qword [0x009c6840]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call fcn.00445fc0
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx]
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1b
add edx, ebx
mov esi, edx
and edx, 0xffffffe0
sub ebx, edx
test ebx, ebx
jl 0x4461f0
mov rdx, qword [0x00971d08]
sar esi, 5
mov rax, rcx
mov ecx, ebx
mov edi, 1
shl edi, cl
movsxd rsi, esi
cmp ecx, 0x20
sbb r8d, r8d
and edi, r8d
cmp rdx, rsi
jbe 0x4461e5
mov rcx, qword [0x00971d00]
lea rcx, [rcx + rsi*4]
lock or dword [rcx], edi
mov rcx, qword [0x00972fd0]
mov qword [rax + 8], rcx
mov rcx, rax
nop
mov qword [0x00972fd0], rax
nop
mov edx, 1
lea rsi, [0x00972fd8]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1228]
shr rdx, 0x3d
test dl, dl
jne 0x4461d3
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
nop
nop
xchg qword [rcx + 0x1228], rdx
add rsp, 0x18
pop rbp
ret
lea rax, [0x006c7cdb]
mov ebx, 0x28
nop
call fcn.00437500
mov rax, rsi
mov rcx, rdx
call fcn.004671e0
call fcn.00435a00
lea rax, [0x006c5b30]
mov ebx, 0x23
call fcn.00437500
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00464f20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004460a0
Function at 0x453320
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x453497
movzx edx, byte [rax]
test edx, edx
jne 0x453354
nop dword [rax]
test r8b, r8b
jne 0x453354
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x453367
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x453457
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x453445
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x453437
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x4533bd
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x453400
mov eax, 1
cmp rax, rbx
ja 0x4533eb
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call fcn.004672a0
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x45342f
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x4533f3
mov rcx, r11
mov eax, r12d
jmp 0x4533c2
mov rcx, rbx
call fcn.004671e0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.004671e0
mov eax, r8d
mov rcx, rbx
call fcn.004672a0
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x45348d
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x453450
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x45336d
mov eax, edx
mov rcx, rbx
call fcn.004671e0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.004671e0
nop
int3
Function at 0x45ad00
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45adaf
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x0045ae00]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00464de0
xorps xmm15, xmm15
mov r14, qword [0x009c6840]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00464f20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.0045ad00
Function at 0x466d60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x009c6b40]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x009c65b7], 0
je 0x466d96
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x009c6e80]
aesenc xmm0, xmmword [0x009c6e90]
aesenc xmm0, xmmword [0x009c6ea0]
movq rax, xmm0
ret
jmp 0x409e20
Function at 0x14000a8f0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor r14d, r14d
lea rbx, [rsp + 0x30]
mov rbp, rdx
mov rdi, rcx
mov word [rsp + 0x30], r14w
lea esi, [r14 + 0x28]
cmp byte [rcx], r14b
je 0x14000a9a2
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdi]
lea rdx, [rsp + 0x20]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rcx, [rsp + 0x24]
mov byte [rsp + 0x21], r14b
call fcn.14000de40
cmp rax, 1
jne 0x14000a9de
mov rcx, rsi
mov rax, rbx
cmp word [rbx], r14w
je 0x14000a980
add rax, 2
dec rcx
cmp word [rax], r14w
jne 0x14000a973
cmp rcx, 1
jb 0x14000a9d8
movzx ecx, word [rsp + 0x24]
inc rdi
add rbx, 2
mov word [rax], cx
dec rsi
mov word [rax + 2], r14w
cmp byte [rdi], r14b
jne 0x14000a940
mov rdx, rbp
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14000bcc0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.14000dafc
int3
call fcn.14000dafc
int3

Function at 0x14000ab70
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x250
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, r8
lea rax, [rsp + 0x30]
mov rbx, rcx
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor ecx, ecx
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x14000abb5
xor al, al
jmp 0x14000ac02
cmp word [rbx], 0
je 0x14000abcd
nop dword [rax + rax]
add rbx, 2
dec rdi
cmp word [rbx], 0
jne 0x14000abc0
cmp word [rsp + 0x30], 0
je 0x14000abfb
lea rcx, [rsp + 0x30]
sub rcx, rbx
nop dword [rax]
cmp rdi, 1
jb 0x14000ac23
movzx eax, word [rcx + rbx]
dec rdi
mov word [rbx], ax
add rbx, 2
cmp word [rcx + rbx], 0
jne 0x14000abe0
xor eax, eax
mov word [rbx], ax
mov al, 1
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14000bcc0
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
ret
call fcn.14000dafc
int3
Function at 0x14000b2c0
Capabilities:
Write file on windows

Disassembly:
test rdx, rdx
je 0x14000b353
push rbx
push rbp
sub rsp, 0x38
mov qword [rsp + 0x50], rsi
mov rbx, rdx
mov qword [rsp + 0x60], rdi
mov rbp, rcx
mov qword [rsp + 0x30], r14
xor r14d, r14d
nop word [rax + rax]
mov edi, 0x8000
lea rcx, [0x140036d70]
cmp rbx, rdi
cmovbe edi, ebx
movsxd rsi, edi
mov rdx, rsi
call fcn.14000b180
cmp rbp, 0xffffffffffffffff
je 0x14000b339
lea r9, [rsp + 0x58]
mov dword [rsp + 0x58], r14d
mov r8d, edi
mov qword [rsp + 0x20], r14
lea rdx, [0x140036d70]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000b354
sub rbx, rsi
jne 0x14000b2f0
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x50]
mov r14, qword [rsp + 0x30]
add rsp, 0x38
pop rbp
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Error__couldnt_unpack_file_to_target_path.
call fcn.14000b040
int3

Function at 0x14000b370
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x2030
call fcn.14001dea0
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2020], rax
mov r11d, dword [0x14002fd0c]
lea rsi, [0x140031d60]
mov rdi, rcx
test r11d, r11d
jne 0x14000b3e9
mov r8d, 0x1000
lea rdx, str.HOME
lea rcx, [rsp + 0x20]
call fcn.14000ac30
test al, al
je 0x14000b4c9
lea rcx, [rsp + 0x20]
call fcn.1400121b4
movsxd r11, dword [0x14002fd0c]
mov qword [rsi + r11*8], rax
inc r11d
mov dword [0x14002fd0c], r11d
xor r9d, r9d
test r11d, r11d
jle 0x14000b428
mov r10, rsi
mov r8, qword [r10]
mov rax, rdi
sub r8, rdi
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14000b414
add rax, 2
test ecx, ecx
jne 0x14000b400
test edx, edx
je 0x14000b4c5
inc r9d
add r10, 8
cmp r9d, r11d
jl 0x14000b3f4
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x14000b430
cmp rax, 2
jne 0x14000b447
cmp word [rdi + 2], 0x3a
je 0x14000b4c5
xor edx, edx
mov qword [rsp + 0x2048], rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne bl
test bl, bl
jne 0x14000b472
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000b499
mov bl, 1
cmp dword [0x14002fd0c], 0x400
jge 0x14000b499
mov rcx, rdi
call fcn.1400121b4
movsxd rdx, dword [0x14002fd0c]
mov qword [rsi + rdx*8], rax
inc edx
mov dword [0x14002fd0c], edx
movzx eax, bl
mov rbx, qword [rsp + 0x2048]
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.14000bcc0
mov rsi, qword [rsp + 0x2050]
add rsp, 0x2030
pop rdi
ret
mov al, 1
jmp 0x14000b4a4
mov ecx, 2
call fcn.14000dffc
mov rcx, rax
lea r8, str.HOME
lea rdx, str.Error__couldnt_runtime_expand_spec__ls._n
call fcn.140001010
call fcn.14000dafc
int3
Function at 0x14000d908
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000d977
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000d977
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000d977
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000d977
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000d977
cmp dword [rcx + 0x84], 0xe
jbe 0x14000d977
cmp dword [rcx + 0xf8], 0
je 0x14000d977
mov ecx, ebx
call fcn.14000da1c
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14000d810
nop
cmp dword [rbp + 0x20], 0
jne 0x14000d9d8
call fcn.140012724
cmp eax, 1
jne 0x14000d9c8
xor dl, dl
jmp 0x14000d9d2
call fcn.1400126f0
test al, al
sete dl
cmp dword [rbp + 0x20], 0
je 0x14000d9e3
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000d9ec
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000d908

Function at 0x14000daf0
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000d977
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000d977
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000d977
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000d977
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000d977
cmp dword [rcx + 0x84], 0xe
jbe 0x14000d977
cmp dword [rcx + 0xf8], 0
je 0x14000d977
mov ecx, ebx
call fcn.14000da1c
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14000d810
nop
cmp dword [rbp + 0x20], 0
jne 0x14000d9d8
call fcn.140012724
cmp eax, 1
jne 0x14000d9c8
xor dl, dl
jmp 0x14000d9d2
call fcn.1400126f0
test al, al
sete dl
cmp dword [rbp + 0x20], 0
je 0x14000d9e3
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000d9ec
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000d908
Function at 0x1400172ec
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140017373
mov rsi, rbx
cmp word [rax], bp
je 0x140017332
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14001731c
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140017318
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140012500
mov rdi, rax
test rax, rax
je 0x140017360
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14000c910
mov rbp, rdi
xor ecx, ecx
call fcn.1400124a0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140019890
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x1400198a6
mov al, 1
jmp 0x140019912
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x1400198b7
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140019910
mov ecx, dword [rcx + 0x18]
nop
call fcn.140017a90
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140019910
and qword [rsp + 0x38], 0
lea r8, [rsp + 0x38]
mov r9d, 1
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140019910
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140019910
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x140019912
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x2fc4ebd30
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4ecdf0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4ec732
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc511108]
test eax, eax
je 0x2fc4ec7ca
lea rax, [0x2fc5110e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc511110]
mov qword [rbp - 8], rax
jmp 0x2fc4ec7ae
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4ec7a2
cmp qword [rbp - 0x10], 0
je 0x2fc4ec7a2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4ec768
lea rax, [0x2fc5110e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4ec7cb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4ec8d0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4ec8f8
mov eax, 0
jmp 0x2fc4ec946
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4ec921
mov eax, 0
jmp 0x2fc4ec946
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4ec941
mov eax, 0
jmp 0x2fc4ec946
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4ec94c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4ec9ca
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4ec9c1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4ec9c1
mov rax, qword [rbp - 8]
jmp 0x2fc4ec9df
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4ec994
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x14000942c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140009476
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140009476
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140009476
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140009476
cmp dword [rcx + 0x84], 0xe
jbe 0x140009476
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140009478
xor al, al
add rsp, 0x28
ret

Function at 0x140009780
Capabilities:
Accept command line arguments

Disassembly:
push r12
sub rsp, 0x50
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x60]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov r12, rax
test rax, rax
jne 0x1400097ae
call fcn.140009740
add rsp, 0x50
pop r12
ret
mov eax, dword [rsp + 0x60]
mov qword [rsp + 0x70], rbx
inc eax
movsxd rbx, eax
shl rbx, 3
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r15, rax
test rax, rax
jne 0x1400097fa
call fcn.140009740
mov rbx, qword [rsp + 0x70]
mov r15, qword [rsp + 0x20]
add rsp, 0x50
pop r12
ret
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rdi
xor edi, edi
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r14
mov r14d, edi
cmp dword [rsp + 0x60], edi
jle 0x1400098bf
sub rax, r12
mov rsi, r12
mov qword [rsp + 0x68], rax
nop dword [rax]
mov rcx, qword [rsi]
call sub.SDL2.dll_SDL_wcslen
mov r8, qword [rsi]
lea rdx, str.UTF_16LE
lea rcx, str.UTF_8
lea r9, [rax*2 + 2]
call sub.SDL2.dll_SDL_iconv_string
mov rbp, rax
test rax, rax
je 0x140009950
mov rcx, rax
call sub.SDL2.dll_SDL_strlen
mov r13d, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [r13 + 1]
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rsp + 0x68]
mov qword [rcx + rsi], rax
test rax, rax
je 0x140009950
mov r8d, r13d
mov rdx, rbp
mov rcx, rax
call sub.SDL2.dll_SDL_memcpy
mov rcx, rbp
call sub.SDL2.dll_SDL_free
inc r14d
add rsi, 8
cmp r14d, dword [rsp + 0x60]
jl 0x140009830
movsxd rax, r14d
mov rcx, r12
mov qword [r15 + rax*8], rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
call sub.SDL2.dll_SDL_SetMainReady
mov ecx, dword [rsp + 0x60]
mov rdx, r15
call fcn.140006e40
mov esi, eax
cmp dword [rsp + 0x60], edi
jle 0x140009910
mov rbx, r15
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbx]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
inc edi
lea rbx, [rbx + 8]
cmp edi, dword [rsp + 0x60]
jl 0x1400098f0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r15
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, esi
mov r14, qword [rsp + 0x28]
mov r13, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x70]
mov r15, qword [rsp + 0x20]
add rsp, 0x50
pop r12
ret
call fcn.140009740
jmp 0x140009926
Function at 0x140130e3b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x3b], 0x7c6f7d7f
mov dword [rsp + 0x34], 0xf6f6f6f6
jmp 0x140130f8a
xchg rbx, rax
mov r9, rbx
invalid
xchg rbx, rax
mov r8d, r13d
movsxd rcx, dword [rax + 0x3c]
mov r11d, dword [rcx + rax + 0x88]
jmp 0x140130e9d
nop dword [rax]
movsx eax, al
lea rdx, [rdx + 1]
xor eax, ecx
imul ecx, eax, 0x1000193
movzx eax, byte [rdx - 1]
test al, al
jmp 0x140130f0a
jmp 0x140130ead
inc rdx
test al, al
je 0x140130f1c
jmp 0x140130e6b
mov ebx, dword [r11 + rax + 0x20]
nop word [rax + rax]
mov r10d, r8d
lea rcx, [rbx + r10*4]
mov edx, dword [rcx + r9]
jne 0x140130ee7
je 0x140130ee7
and r13d, 0x1357035e
test rsi, rbx
cmp r12, rbp
syscall
cmp r9d, 0x1a300dd3
pause
test ecx, 0x2876aca3
call fcn.1401305a9
jb 0x1401306ee
movabs r14, 0x6d43db632f6e11eb
cmp rbp, rdx
test r14d, 0x19294b76
ret
jmp 0x140130efa
mov ecx, 0xccdb5780
add rdx, r9
movzx eax, byte [rdx]
jmp 0x140130e8d
jne 0x140130e6e
cmp ecx, 0x8a7f62cb
je 0x140131001
inc r8d
jmp 0x140130e88
cmp rdx, 0xa
jb 0x140130fe4
xor edx, edx
lea rcx, [rsp + 0x3b]
mov r8d, 0x800
call r9
jmp 0x140130e50
mov r9d, dword [rcx + rdx*4]
xchg rdx, r13
mov r13, rdx
xchg rdx, r13
add r9, r10
xor eax, eax
mov byte [rsp + 0x45], al
je 0x140130f74
jne 0x140130f74
cmp ebx, 0xcf582a3c
ror r13d, 0x9e
ror r10d, 0xec
or r15d, 0x83b5d2e6
movabs r13, 0x46db04f068e69eb
xor esi, 0x7552be10
cmp r8d, 0xac241fb9
ret
jmp 0x140130fdf
mov dword [rsp + 0x3f], 0x6e383c3d
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov word [rsp + 0x38], 0xf6f6
mov word [rsp + 0x43], 0x7676
jne 0x140130fc3
je 0x140130fc3
call rcx
call rcx
rol r14d, 9
rcl r8d, 0x66
or edx, 0x87be5d0d
movabs r14, 0x4115e8ffffff7be9
call rcx
jp 0x140131ea3
jmp 0x140130f43
popfq
popf
lea edi, [rcx + 0xd509]
ret 0x10
nop dword [rax + rax]
movzx eax, byte [rsp + rdx + 0x3b]
movzx ecx, byte [rsp + rdx + 0x30]
add cl, al
mov byte [rsp + rdx + 0x3b], cl
mov byte [rsp + rdx + 0x30], r13b
inc rdx
jmp 0x140130f24
mov ecx, dword [r11 + r9 + 0x24]
xchg r13, rax
mov r13, rax
xchg r13, rax
add rcx, r9
movzx edx, word [rcx + r10*2]
mov ecx, dword [r11 + r9 + 0x1c]
jmp 0x1401311ab
and al, 1
add byte [rax], al
div rsi
call rcx
bswap rdi
ror ecx, 0x30
inc r10
test r8d, 0x87389940
cmp rsi, rbp
jne 0x140131e61
je 0x140131e61
push r10
rcl ecx, 0x5a
lea edx, [rbx - 0xa7cb]
pushfq
sub r8d, 0xfa115e5a
add ebp, 0x58ea7f29
call rcx
test r9d, 0x49bb02d3
cmp r15, rbp
pushf
lea r13d, [rbp + 0xe218]
movabs r8, 0x72c860000045ce9
int3
jmp 0x1401322c2
ror ecx, 0xf6
jne 0x140131eaf
je 0x140131eaf
mul r10
movabs rsi, 0x2f55a8ffffff61e9
jne 0x140131a99
jmp 0x140131e15
cpuid
jmp rcx
add ecx, 0x5cd08af8
rcr ecx, 0x61
lea r10d, [rdx - 0x8de6]
rol edx, 0xec
jmp rcx