joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140007b50
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x2c0
mov rax, qword [0x1400471b0]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov rdi, r8
mov rbx, rdx
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], r8
xor ebp, ebp
mov dword [rsp + 0x20], ebp
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx], rbp
mov qword [rdx + 8], rbp
mov qword [rdx + 0x10], rbp
mov dword [rsp + 0x20], 1
lea r8, str._.
mov rdx, rdi
lea rcx, [rsp + 0x38]
call fcn.140004800
nop
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140007caf
nop
mov rdx, qword [rbx + 8]
cmp rdx, qword [rbx + 0x10]
je 0x140007c82
lea rax, [rsp + 0x60]
mov ecx, 4
nop dword [rax + rax]
movups xmm0, xmmword [rax]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rdx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rcx, 1
jne 0x140007c00
movups xmm0, xmmword [rax]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rdx + 0x40], xmm0
add qword [rbx + 8], 0x250
jmp 0x140007c8f
lea r8, [rsp + 0x60]
mov rcx, rbx
call fcn.140004930
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindNextFileW]
test eax, eax
jne 0x140007be0
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindClose]
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x140007cf1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007cec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007d74
call fcn.140012fbc
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], 7
mov word [rsp + 0x38], bp
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140007d3f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140007d3a
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140007d7a
mov rcx, r8
call fcn.140012fbc
mov qword [rdi + 0x10], rbp
mov qword [rdi + 0x18], 7
mov word [rdi], bp
mov rax, rbx
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.140012f70
mov rbx, qword [rsp + 0x2e0]
add rsp, 0x2c0
pop rdi
pop rsi
pop rbp
ret
call fcn.140019554
nop
call fcn.140019554
int3
Function at 0x14000adf0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1400471b0]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rbp - 0x30], rdx
xor esi, esi
mov qword [rbp - 0x28], rsi
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x10], 7
mov word [rbp - 0x28], si
xor r8d, r8d
lea rdx, [0x14003e314]
lea rcx, [rbp - 0x28]
call fcn.140003d50
nop
mov qword [rbp - 0x30], rsi
cmp qword [rdi + 0x10], rsi
je 0x14000aea0
mov rdx, rdi
mov rcx, rbx
call fcn.140003a60
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x14000afa4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ae96
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000afc9
call fcn.140012fbc
jmp 0x14000afa4
lea r9, [rbp - 0x30]
xor r8d, r8d
xor edx, edx
lea rcx, [0x140030db0]
call qword [sym.imp.ext_ms_win_shell32_shellfolders_l1_1_0.dll_SHGetKnownFolderPath]
test eax, eax
js 0x14000af46
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x38], 7
mov rdx, qword [rbp - 0x30]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x14000aee0
lea rcx, [rbp - 0x50]
call fcn.140003d50
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x14000af34
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000af2f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000afc3
call fcn.140012fbc
movups xmm0, xmmword [rbp - 0x50]
movups xmmword [rbp - 0x28], xmm0
movups xmm0, xmmword [rbp - 0x40]
movups xmmword [rbp - 0x18], xmm0
jmp 0x14000af4a
movups xmm0, xmmword [rbp - 0x18]
movups xmmword [rbp - 0x50], xmm0
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x14000af61
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
mov qword [rbp - 0x30], rsi
movups xmm1, xmmword [rbp - 0x50]
movq r8, xmm1
test r8, r8
je 0x14000af99
lea rax, [rbp - 0x28]
cmp rdi, rax
je 0x14000af99
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rdx, qword [rbp - 0x28]
mov rcx, rdi
call fcn.140003d50
movups xmm0, xmmword [rbp - 0x18]
movups xmmword [rbp - 0x50], xmm0
movups xmm1, xmm0
movups xmm0, xmmword [rbp - 0x28]
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm1
mov rax, rbx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140012f70
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
call fcn.140019554
nop
call fcn.140019554
int3
Function at 0x14000b7a0
Capabilities:
Get file size
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x1400471b0]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, rcx
xor esi, esi
mov rcx, qword [0x14004b130]
test rcx, rcx
je 0x14000b7e2
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov qword [0x14004b130], rsi
lea rcx, str.ProgramData
call fcn.14001c8d0
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x208
mov rdi, rax
call fcn.140015a40
movaps xmm0, xmmword [rbx]
pextrw ecx, xmm0, 3
movzx r9d, cx
mov dword [rsp + 0x30], r9d
mov r9, rdi
pextrw ecx, xmm0, 1
movzx r8d, cx
movq rcx, xmm0
movzx edx, cx
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x28], r8d
lea r8, str._sASUSGlideXlogGlideXLog__04d_02d_02d.txt
mov dword [rsp + 0x20], edx
mov edx, 0x104
call fcn.140003e80
xor r9d, r9d
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
lea rcx, [rsp + 0x50]
mov edx, 0x1f01ff
mov dword [rsp + 0x20], 4
lea r8d, [r9 + 3]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
mov qword [0x14004b130], rax
mov dword [rsp + 0x44], esi
test rax, rax
je 0x14000b8d9
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileSize]
test eax, eax
jne 0x14000b8cf
mov rcx, qword [0x14004b130]
lea r9, [rsp + 0x44]
mov eax, 0xfeff
mov qword [rsp + 0x20], rsi
mov r8d, 2
mov word [rsp + 0x40], ax
lea rdx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
test eax, eax
je 0x14000b8cf
mov rcx, qword [0x14004b130]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FlushFileBuffers]
movaps xmm0, xmmword [rbx]
movups xmmword [0x14004b138], xmm0
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140012f70
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14002827c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140028303
mov rsi, rbx
cmp word [rax], bp
je 0x1400282c2
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400282ac
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400282a8
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140022100
mov rdi, rax
test rax, rax
je 0x1400282f0
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140015370
mov rbp, rdi
xor ecx, ecx
call fcn.1400220c4
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400011c0
Capabilities:
Create process on windows
Create process suspended
Resume thread
Terminate process

Disassembly:
sub rsp, 0x1e8
mov rax, qword [0x14000a200]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
xor edx, edx
lea rcx, [rsp + 0x78]
mov dword [rsp + 0x70], 0x68
lea r8d, [rdx + 0x60]
call fcn.1400051d0
mov eax, dword [0x140008484]
mov r11d, 1
lea rcx, [rsp + 0x150]
lea r8d, [r11 + 0x71]
xor edx, edx
mov dword [rcx], eax
movzx eax, word [0x140008488]
mov dword [rsp + 0xac], r11d
mov word [rcx + 4], ax
lea rcx, [rsp + 0x156]
mov word [rsp + 0xb0], r11w
call fcn.1400051d0
lea r8, str.O21Kg_HWID.exe
lea rcx, [rsp + 0x150]
mov edx, 0x3c
call fcn.140001584
lea rcx, str.O21Kg_HWID.exe
call fcn.140001620
lea rcx, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rcx
xor ecx, ecx
mov rdx, rax
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov eax, dword [0x140008484]
lea r11, [rsp + 0xe0]
xor edx, edx
lea rcx, [rsp + 0xe6]
mov dword [r11], eax
movzx eax, word [0x140008488]
lea r8d, [rdx + 0x5e]
mov word [r11 + 4], ax
call fcn.1400051d0
lea r8, str.version.dll
lea rcx, [rsp + 0xe0]
mov edx, 0x32
call fcn.140001584
mov edx, dword [rsp + 0x60]
lea rcx, [rsp + 0xe0]
call fcn.140001000
mov ecx, 0x320
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x140001a44
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x1400018ac
Function at 0x14002eb60
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14002eb6d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14002eb7d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14002eb65
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x14002eb95
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14002eb82
sub eax, 3
jb 0x14002ebaf
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14002ebe6
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x14002ebd6
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14002ebd4
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14002ebc3
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.14002eb22
jmp 0x14002eb6d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x1b400
mov dl, 9
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14002ec32
cmp rsi, rcx
jae 0x14002ec3a
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14002ec19
cmp al, 0x8f
ja 0x14002ec19
cmp byte [rsi - 2], 0xf
je 0x14002ec1f
sub al, 0xe8
cmp al, 1
ja 0x14002ec03
cmp rsi, rcx
jae 0x14002ec3a
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14002ec09
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14002ec3a
lodsb al, byte [rsi]
jmp 0x14002ec19
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x2c000]
mov eax, dword [rdi]
or eax, eax
je 0x14002eca3
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x324a0]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14002ec47
jns 0x14002ec7c
movzx rdx, word [rdi]
add rdi, 2
jmp 0x14002ec86
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14002ec9d
mov qword [rbx], rax
add rbx, 8
jmp 0x14002ec67
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x18f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14002ecfb
sub rsp, 0xffffffffffffff80
jmp 0x14001bce0
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x0046f5c0]
xor edx, edx
mov dword [rax], 1
mov rax, qword [0x0046f5d0]
mov dword [rax], 1
mov rax, qword [0x0046f5e0]
mov dword [rax], 1
mov rax, qword [0x0046f5b0]
mov dword [rax], 1
mov rax, qword [0x0046f3a0]
cmp word [rax], 0x5a4d
je 0x4010d0
mov rax, qword [0x0046f5a0]
mov dword [0x00477008], edx
mov eax, dword [rax]
test eax, eax
je 0x4010c2
mov ecx, 2
call sym.__set_app_type
mov rcx, 0xffffffffffffffff
call sym._encode_pointer
mov rdx, qword [0x0046f440]
mov qword [rdx], rax
mov rdx, qword [0x0046f430]
mov qword [rdx], rax
mov rax, qword [0x0046f4a0]
mov edx, dword [rax]
mov rax, qword [sym.imp.msvcrt.dll__fmode]
mov rax, qword [rax]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x0046f350]
cmp dword [rax], 1
je 0x401120
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x401075
movsxd rcx, dword [rax + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x401058
movzx ecx, word [rax + 0x18]
cmp cx, 0x10b
je 0x401133
cmp cx, 0x20b
jne 0x401058
cmp dword [rax + 0x84], 0xe
jbe 0x401058
mov ecx, dword [rax + 0xf8]
xor edx, edx
test ecx, ecx
setne dl
jmp 0x401058
lea rcx, [sym._matherr]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401058
mov r8d, dword [rax + 0xe8]
xor edx, edx
test r8d, r8d
setne dl
jmp 0x401058

Function at 0x4041a9
Capabilities:
Read file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp - 8], 0
mov qword [rbp - 0x10], 0
mov rdx, qword [rbp + 0x20]
mov rax, qword [rbp + 0x18]
mov r9, qword [rbp + 0x10]
mov r8, rdx
mov edx, 1
mov rcx, rax
call sym.fread
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
cmp rax, qword [rbp + 0x20]
je 0x40420a
mov rcx, qword [rbp + 0x10]
call sym.checkErr__fU6ZlJAtQ9bre04EDZLdGsA_2
jmp 0x40420b
nop
mov rax, qword [rbp - 8]
add rsp, 0x30
pop rbp
ret

Function at 0x40583a
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp - 8], 0
mov dword [rbp - 0xc], 0
mov rdx, qword [rbp + 0x20]
mov rax, qword [rbp + 0x18]
mov r9, qword [rbp + 0x10]
mov r8, rdx
mov edx, 1
mov rcx, rax
call sym.fwrite
mov dword [rbp - 0xc], eax
mov eax, dword [rbp - 0xc]
cdqe
mov qword [rbp - 8], rax
mov rcx, qword [rbp + 0x10]
call sym.checkErr__fU6ZlJAtQ9bre04EDZLdGsA_2
mov rax, qword [rbp - 8]
add rsp, 0x30
pop rbp
ret
Function at 0x405b9d
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
lea rax, str.echoBinSafe
mov qword [rbp - 0x48], rax
lea rax, [0x0045f4a8]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x40], 0
mov word [rbp - 0x30], 0
lea rax, [rbp - 0x50]
mov rcx, rax
call sym.nimFrame_2
mov qword [rbp - 0x10], 0
mov qword [rbp - 0x40], 8
lea rax, [0x0045f6d8]
mov qword [rbp - 0x38], rax
mov qword [rbp - 8], 0
mov qword [rbp - 0x40], 9
lea rax, [0x0045f6d8]
mov qword [rbp - 0x38], rax
mov rax, qword [rbp - 8]
cmp rax, qword [rbp + 0x28]
jge 0x405cfa
mov qword [rbp - 0x40], 0x31d
lea rax, [0x0045f4a8]
mov qword [rbp - 0x38], rax
mov rdx, qword [rbp - 8]
mov rax, qword [rbp + 0x28]
cmp rdx, rax
jb 0x405c5e
mov rax, qword [rbp + 0x28]
lea rdx, [rax - 1]
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.raiseIndexError2
mov rax, qword [rbp - 8]
lea rdx, [rax*8]
mov rax, qword [rbp + 0x20]
add rax, rdx
mov qword [rbp - 0x10], rax
mov qword [rbp - 0x40], 0x31f
lea rax, [0x0045f4a8]
mov qword [rbp - 0x38], rax
mov rax, qword [rbp - 0x10]
mov rbx, qword [rax]
mov rax, qword [sym.imp.msvcrt.dll___iob_func]
call rax
add rax, 0x30
mov r8d, 0
mov rdx, rbx
mov rcx, rax
call sym.writeWindows__JO9bn8JE1R6MjKZqdvhBrWg
mov qword [rbp - 0x40], 0xb
lea rax, [0x0045f6d8]
mov qword [rbp - 0x38], rax
mov edx, 0
mov rax, qword [rbp - 8]
add rax, 1
jno 0x405cd4
mov edx, 1
mov rcx, rax
lea rax, [rbp - 0x58]
mov qword [rax], rcx
mov rax, rdx
and eax, 1
test al, al
je 0x405ced
call sym.raiseOverflow
mov rax, qword [rbp - 0x58]
mov qword [rbp - 8], rax
jmp 0x405c1c
nop
mov qword [rbp - 0x40], 0x323
lea rax, [0x0045f4a8]
mov qword [rbp - 0x38], rax
mov dword [rbp - 0x14], 0
mov rax, qword [sym.imp.msvcrt.dll___iob_func]
call rax
add rax, 0x30
mov r9, rax
mov r8d, 1
mov edx, 1
lea rcx, [0x0045f713]
call sym.fwrite
mov dword [rbp - 0x14], eax
mov qword [rbp - 0x40], 0x324
lea rax, [0x0045f4a8]
mov qword [rbp - 0x38], rax
mov dword [rbp - 0x18], 0
mov rax, qword [sym.imp.msvcrt.dll___iob_func]
call rax
add rax, 0x30
mov rcx, rax
call sym.fflush
mov dword [rbp - 0x18], eax
call sym.popFrame_2
nop
add rsp, 0x88
pop rbx
pop rbp
ret

Function at 0x408d1c
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov dword [rbp - 4], 0
cmp qword [rbp + 0x18], 0
je 0x408d4b
mov rax, qword [rbp + 0x18]
mov rcx, rax
call sym.nimCStrLen_1
mov rdx, rax
jmp 0x408d50
mov edx, 0
mov rax, qword [rbp + 0x18]
mov r9, qword [rbp + 0x10]
mov r8, rdx
mov edx, 1
mov rcx, rax
call sym.fwrite
mov dword [rbp - 4], eax
mov dword [rbp - 8], 0
mov rcx, qword [rbp + 0x10]
call sym.fflush
mov dword [rbp - 8], eax
nop
add rsp, 0x30
pop rbp
ret
Function at 0x419b33
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
lea rax, str.startsWith
mov qword [rbp - 0x48], rax
lea rax, str._var_lib_snapd_snap_nim_lang_1589_lib_pure_strutils.nim
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x40], 0
mov word [rbp - 0x30], 0
lea rax, [rbp - 0x50]
mov rcx, rax
call sym.nimFrame_4
mov byte [rbp - 1], 0
mov qword [rbp - 0x40], 0x669
lea rax, str._var_lib_snapd_snap_nim_lang_1589_lib_pure_strutils.nim
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x10], 0
mov qword [rbp - 0x40], 0x66a
lea rax, str._var_lib_snapd_snap_nim_lang_1589_lib_pure_strutils.nim
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x40], 0x66b
lea rax, str._var_lib_snapd_snap_nim_lang_1589_lib_pure_strutils.nim
mov qword [rbp - 0x38], rax
cmp qword [rbp + 0x18], 0
je 0x419bc8
mov rax, qword [rbp + 0x18]
mov rax, qword [rax]
jmp 0x419bcd
mov eax, 0
cmp rax, qword [rbp - 0x10]
jg 0x419bdc
mov byte [rbp - 1], 1
jmp 0x419d3b
nop
mov qword [rbp - 0x40], 0x66c
lea rax, str._var_lib_snapd_snap_nim_lang_1589_lib_pure_strutils.nim
mov qword [rbp - 0x38], rax
mov byte [rbp - 0x11], 0
cmp qword [rbp + 0x10], 0
je 0x419c04
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
jmp 0x419c09
mov eax, 0
cmp rax, qword [rbp - 0x10]
setle al
mov byte [rbp - 0x11], al
cmp byte [rbp - 0x11], 0
jne 0x419cdb
cmp qword [rbp + 0x10], 0
je 0x419c30
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov rdx, rax
jmp 0x419c35
mov edx, 0
mov rax, qword [rbp - 0x10]
cmp rdx, rax
ja 0x419c65
cmp qword [rbp + 0x10], 0
je 0x419c52
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
lea rdx, [rax - 1]
jmp 0x419c59
mov rdx, 0xffffffffffffffff
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.raiseIndexError2
cmp qword [rbp + 0x18], 0
je 0x419c78
mov rax, qword [rbp + 0x18]
mov rax, qword [rax]
mov rdx, rax
jmp 0x419c7d
mov edx, 0
mov rax, qword [rbp - 0x10]
cmp rdx, rax
ja 0x419cad
cmp qword [rbp + 0x18], 0
je 0x419c9a
mov rax, qword [rbp + 0x18]
mov rax, qword [rax]
lea rdx, [rax - 1]
jmp 0x419ca1
mov rdx, 0xffffffffffffffff
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.raiseIndexError2
mov rdx, qword [rbp + 0x10]
mov rax, qword [rbp - 0x10]
add rax, rdx
add rax, 0x10
movzx edx, byte [rax]
mov rcx, qword [rbp + 0x18]
mov rax, qword [rbp - 0x10]
add rax, rcx
add rax, 0x10
movzx eax, byte [rax]
cmp dl, al
setne al
mov byte [rbp - 0x11], al
jmp 0x419cdc
nop
movzx eax, byte [rbp - 0x11]
xor eax, 1
test al, al
jne 0x419ced
mov byte [rbp - 1], 0
jmp 0x419d3b
nop
mov qword [rbp - 0x40], 0x66d
lea rax, str._var_lib_snapd_snap_nim_lang_1589_lib_pure_strutils.nim
mov qword [rbp - 0x38], rax
mov edx, 0
mov rax, qword [rbp - 0x10]
add rax, 1
jno 0x419d15
mov edx, 1
mov rcx, rax
lea rax, [rbp - 0x58]
mov qword [rax], rcx
mov rax, rdx
and eax, 1
test al, al
je 0x419d2e
call sym.raiseOverflow
mov rax, qword [rbp - 0x58]
mov qword [rbp - 0x10], rax
jmp 0x419ba5
call sym.popFrame_4
movzx eax, byte [rbp - 1]
sub rsp, 0xffffffffffffff80
pop rbp
ret
Function at 0x45c390
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x004798a4]
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
test esi, esi
jle 0x45c534
mov rax, qword [0x004798a8]
xor ecx, ecx
add rax, 8
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x45c3dc
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x45c469
add ecx, 1
add rax, 0x18
cmp ecx, esi
jne 0x45c3c0
mov rcx, rbx
call sym.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x45c569
mov rax, qword [0x004798a8]
lea rsi, [rsi + rsi*2]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x10], r12
mov dword [rax], 0
call sym._GetPEImageBase
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x004798a8]
mov qword [rax + rsi + 8], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x45c54c
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x45c462
sub eax, 4
and eax, 0xfffffffb
jne 0x45c4e4
add dword [0x004798a4], 1
cmp edi, 8
jae 0x45c4a0
test dil, 4
jne 0x45c520
test edi, edi
je 0x45c48c
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x45c53b
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rbp]
mov qword [rbx], rax
mov eax, edi
mov rdx, qword [rbp + rax - 8]
mov qword [rbx + rax - 8], rdx
lea rax, [rbx + 8]
and rax, 0xfffffffffffffff8
sub rbx, rax
sub rbp, rbx
add ebx, edi
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x45c48c
and ebx, 0xfffffff8
xor edx, edx
mov ecx, edx
add edx, 8
mov r8, qword [rbp + rcx]
cmp edx, ebx
mov qword [rax + rcx], r8
jb 0x45c4d0
jmp 0x45c48c
add rsi, qword [0x004798a8]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x45c462
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x45c48c
xor esi, esi
jmp 0x45c3e7
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x45c48c
mov rax, qword [0x004798a8]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rsi + 8]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call sym.__report_error
nop
nop dword [rax]

Function at 0x45cd10
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00479b80]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x00479b60]
test rbx, rbx
je 0x45cd64
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x45cd5b
test rsi, rsi
je 0x45cd5b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x45cd40
lea rcx, [0x00479b80]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]