joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006dbe0
Capabilities:
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
call fcn.14006b5d0
mov rbx, rax
mov qword [rsp + 0x30], rax
lea rdx, [0x14006cdc0]
lea rcx, [0x14011eec8]
call fcn.14006c9b0
mov ecx, dword [0x140118718]
cmp ecx, 0xffffffff
je 0x14006dc1b
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
add rsp, 0x20
pop rbx
ret

Function at 0x14006e430
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
jne 0x14006e458
mov qword [rdi], 0
mov rax, rdi
add rsp, 0x20
pop rdi
ret
cmp qword [rsp + 0x40], 0
jle 0x14006e448
mov qword [rsp + 0x30], rbx
lea rcx, [rsp + 0x38]
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x14006e48c
inc ebx
cmp ebx, 3
ja 0x14006e4c2
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x14006e476
mov rbx, qword [rsp + 0x30]
xorps xmm1, xmm1
cvtsi2sd xmm1, qword [rsp + 0x38]
xorps xmm0, xmm0
mulsd xmm1, qword [0x1400cc8f8]
cvtsi2sd xmm0, qword [rsp + 0x40]
divsd xmm1, xmm0
cvttsd2si rax, xmm1
mov qword [rdi], rax
mov rax, rdi
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov qword [rdi], 0
add rsp, 0x20
pop rdi
ret
Function at 0x14006e7d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ecx, dword [0x140118718]
cmp ecx, 0xffffffff
jne 0x14006e7ee
xor esi, esi
jmp 0x14006e7f7
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
mov qword [rsp + 0x30], rsi
test rsi, rsi
je 0x14006e8ed
mov rax, qword [rsi + 0x30]
nop dword [rax]
test rax, rax
jne 0x14006e826
cmp qword [rsi + 0x18], 0
je 0x14006e8c6
mov rbx, qword [rsi + 0x18]
jmp 0x14006e830
mov rbx, qword [rsi + 0x18]
test rbx, rbx
je 0x14006e888
nop
mov rax, qword [rbx + 8]
mov qword [rsi + 0x18], rax
mov rcx, qword [rbx]
test rcx, rcx
je 0x14006e867
mov rax, qword [rcx]
call qword [rax + 8]
mov rdi, qword [rbx]
mov rax, qword [rdi]
xor edx, edx
mov rcx, rdi
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsi + 0x18]
test rbx, rbx
jne 0x14006e830
mov rax, qword [rsi + 0x30]
test rax, rax
je 0x14006e815
nop dword [rax]
mov rbx, qword [rsi + 0x28]
mov rbx, qword [rbx]
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14006e8ac
mov rdx, qword [rbx + 0x38]
test rdx, rdx
je 0x14006e8ac
call qword [rbx + 0x28]
mov rdx, rbx
lea rcx, [rsi + 0x28]
call fcn.14006c330
cmp qword [rsi + 0x30], 0
jne 0x14006e890
xor eax, eax
jmp 0x14006e810
lea rdx, [0x14006cdc0]
lea rcx, [0x14011eec8]
call fcn.14006c9b0
mov ecx, dword [0x140118718]
cmp ecx, 0xffffffff
je 0x14006e8ed
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
test rsi, rsi
je 0x14006e920
mov eax, 0xffffffff
lock xadd dword [rsi + 8], eax
cmp eax, 1
jne 0x14006e920
mov rax, qword [rsi]
xor edx, edx
mov rcx, rsi
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14006e930
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x70
mov rsi, r9
mov rbp, r8
mov r14, rdx
mov rdi, rcx
call fcn.14006d1c0
mov rbx, rax
test rax, rax
je 0x14006e9fe
cmp byte [rsp + 0xa0], 0
je 0x14006e985
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x14006e985
mov rdx, qword [rax + 0x10]
test rdx, rdx
je 0x14006e985
call qword [rax]
test rbp, rbp
jne 0x14006e9ee
test rsi, rsi
jne 0x14006e9ee
mov qword [rsp + 0x20], rdi
mov ecx, dword [0x140118718]
cmp ecx, 0xffffffff
je 0x14006e9ad
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
jne 0x14006e9db
call fcn.14006dbe0
mov ecx, dword [0x140118718]
cmp ecx, 0xffffffff
jne 0x14006e9d2
xor ebx, ebx
lea rcx, [rbx + 0x28]
lea rdx, [rsp + 0x20]
call fcn.14006cf20
jmp 0x14006eb0b
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
lea rcx, [rbx + 0x28]
lea rdx, [rsp + 0x20]
call fcn.14006cf20
jmp 0x14006eb0b
mov qword [rbx], r14
mov qword [rbx + 8], rbp
mov qword [rbx + 0x10], rsi
jmp 0x14006eb0b
test rbp, rbp
jne 0x14006ea0c
test rsi, rsi
je 0x14006eb0b
xor ebx, ebx
mov ecx, dword [0x140118718]
cmp ecx, 0xffffffff
je 0x14006ea24
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x14006ea3f
call fcn.14006dbe0
mov ecx, dword [0x140118718]
cmp ecx, 0xffffffff
jne 0x14006ea39
mov rax, rbx
jmp 0x14006ea3f
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
lea rsi, [rax + 0x28]
mov rbp, qword [rsi]
mov rax, qword [rbp + 8]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], ebx
mov rcx, rbp
cmp byte [rax + 0x19], bl
jne 0x14006ea98
nop word [rax + rax]
mov qword [rsp + 0x30], rax
cmp qword [rax + 0x20], rdi
jae 0x14006ea85
mov dword [rsp + 0x38], ebx
mov rax, qword [rax + 0x10]
jmp 0x14006ea93
mov dword [rsp + 0x38], 1
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], bl
je 0x14006ea70
cmp byte [rcx + 0x19], bl
jne 0x14006eaa3
cmp rdi, qword [rcx + 0x20]
jae 0x14006eb0b
movabs rax, 0x3ffffffffffffff
cmp qword [rsi + 8], rax
je 0x14006eb26
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rbx
mov ecx, 0x40
call fcn.14006edd4
nop
mov qword [rax + 0x20], rdi
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rax + 0x28], xmm0
movsd xmm1, qword [rsp + 0x60]
movsd qword [rax + 0x38], xmm1
mov qword [rax], rbp
mov qword [rax + 8], rbp
mov qword [rax + 0x10], rbp
mov word [rax + 0x18], 0
movups xmm0, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x20], xmm0
mov r8, rax
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140053660
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
call fcn.1400538e0
int3
Function at 0x14008bd84
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x14008bb8b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14008bb8b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14008bb8b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14008bb8b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14008bb8b
cmp dword [rcx + 0x84], 0xe
jbe 0x14008bb8b
cmp dword [rcx + 0xf8], 0
je 0x14008bb8b
mov ecx, ebx
call fcn.14008bcb0
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.14008b984
cmp dword [rbp + 0x20], 0
je 0x14008bbd8
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14008bbe0
int3
xor r8d, r8d
xor edx, edx
jmp 0x14008bb24
Function at 0x2fc4c9f10
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4ca912
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4ef108]
test eax, eax
je 0x2fc4ca9aa
lea rax, [0x2fc4ef0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4ef110]
mov qword [rbp - 8], rax
jmp 0x2fc4ca98e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4ca982
cmp qword [rbp - 0x10], 0
je 0x2fc4ca982
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4ca948
lea rax, [0x2fc4ef0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4ca9ab
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4caab0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4caad8
mov eax, 0
jmp 0x2fc4cab26
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4cab01
mov eax, 0
jmp 0x2fc4cab26
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4cab21
mov eax, 0
jmp 0x2fc4cab26
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4cab2c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4cabaa
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4caba1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4caba1
mov rax, qword [rbp - 8]
jmp 0x2fc4cabbf
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4cab74
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x18064e058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x18064e1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x18064e089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18064e06f
add dl, dl
jne 0x18064e096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18064e0f6
xor eax, eax
add dl, dl
jne 0x18064e0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18064e1ad
add dl, dl
jne 0x18064e0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18064e0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18064e0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18064e0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x18064e0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x18064e07e
mov eax, 1
add dl, dl
jne 0x18064e106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18064e113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18064e0fb
sub eax, ebx
mov ebx, 1
jne 0x18064e14c
mov ecx, 1
add dl, dl
jne 0x18064e12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x18064e13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18064e123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18064e07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x18064e168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x18064e175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18064e15d
cmp eax, 0x7d00
jae 0x18064e19b
cmp eax, 0x500
jb 0x18064e196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18064e07e
cmp eax, 0x7f
ja 0x18064e19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18064e07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x18064e1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x18064e07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140011375
Capabilities:
Terminate process

Disassembly:
jmp 0x140017de0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x140011474
Capabilities:
Parse pe header

Disassembly:
jmp 0x140019130
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140019150
xor al, al
jmp 0x1400191d1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140019163
xor al, al
jmp 0x1400191d1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001918d
xor al, al
jmp 0x1400191d1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400191a1
xor al, al
jmp 0x1400191d1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400191b3
xor al, al
jmp 0x1400191d1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400191cf
xor al, al
jmp 0x1400191d1
mov al, 1
add rsp, 0x38
ret
Function at 0x140016f30
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.140011672
movzx eax, al
test eax, eax
jne 0x140016f50
mov ecx, 7
call fcn.140011569
nop
mov byte [rsp + 0x20], 0
call fcn.14001159b
mov byte [rsp + 0x21], al
cmp dword [0x140024b78], 1
jne 0x140016f74
mov ecx, 7
call fcn.140011569
nop
jmp 0x140016fcc
cmp dword [0x140024b78], 0
jne 0x140016fc7
mov dword [0x140024b78], 1
lea rdx, [0x14001f660]
lea rcx, [0x14001f330]
call fcn.140011302
test eax, eax
je 0x140016fa8
mov eax, 0xff
jmp 0x1400170d1
lea rdx, [0x14001f220]
lea rcx, [section..rdata]
call fcn.140011582
mov dword [0x140024b78], 2
jmp 0x140016fcc
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.140011550
call fcn.1400114a1
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140017029
mov rcx, qword [rsp + 0x30]
call fcn.140011285
movzx eax, al
test eax, eax
je 0x140017029
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x14002b020]
nop
call fcn.1400114ec
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x14001705d
mov rcx, qword [rsp + 0x38]
call fcn.140011285
movzx eax, al
test eax, eax
je 0x14001705d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.140011618
nop
call fcn.140017180
mov dword [rsp + 0x28], eax
call fcn.140011474
movzx eax, al
test eax, eax
jne 0x14001707c
mov ecx, dword [rsp + 0x28]
call fcn.140011096
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14001708b
call fcn.14001162c
nop
xor edx, edx
mov cl, 1
call fcn.140011258
mov eax, dword [rsp + 0x28]
jmp 0x1400170d1
add rsp, 0x68
ret
Function at 0x14000147a
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x140013d90]
mov dword [rax], 1
mov rax, qword [0x140013da0]
mov dword [rax], 1
mov rax, qword [0x140013db0]
mov dword [rax], 1
mov rax, qword [0x140013d80]
mov dword [rax], 1
mov rax, qword [0x140013c30]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400014d8
mov eax, 0
jmp 0x140001585
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140001504
mov eax, 0
jmp 0x140001585
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000152a
cmp eax, 0x20b
je 0x140001551
jmp 0x140001580
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000153d
mov eax, 0
jmp 0x140001585
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001585
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000156c
mov eax, 0
jmp 0x140001585
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001585
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140001782
Capabilities:
Execute command

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xb0
call sym.__main
lea rax, str.chcp_65001___nul
mov rcx, rax
call sym.system
mov r8d, 0xa
mov edx, 5
lea rax, str.Palabra_secreta__entre__d_y__d_caracteres_:
mov rcx, rax
call dbg.printf
mov ecx, 0
mov rax, qword [sym.__acrt_iob_func]
call rax
mov rcx, rax
call sym.fflush
lea rax, [rbp - 0x80]
mov rcx, rax
call sym.gets
lea rax, [rbp - 0x80]
mov rcx, rax
call sym.strlen
mov dword [rbp - 0x10], eax
jmp 0x140001853
mov r8d, 0xa
mov edx, 5
lea rax, str.Error:_La_palabra_secreta_debe_contener_entre__d_y__d_caracteres_n
mov rcx, rax
call dbg.printf
mov r8d, 0xa
mov edx, 5
lea rax, str.Palabra_secreta__entre__d_y__d_caracteres_:
mov rcx, rax
call dbg.printf
mov ecx, 0
mov rax, qword [sym.__acrt_iob_func]
call rax
mov rcx, rax
call sym.fflush
lea rax, [rbp - 0x80]
mov rcx, rax
call sym.gets
lea rax, [rbp - 0x80]
mov rcx, rax
call sym.strlen
mov dword [rbp - 0x10], eax
cmp dword [rbp - 0x10], 4
jle 0x1400017ee
cmp dword [rbp - 0x10], 0xa
jg 0x1400017ee
lea rax, [0x14001308a]
mov rcx, rax
call sym.system
lea rax, str.ADIVINA_LA_PALABRA_n
mov rcx, rax
call dbg.printf
mov dword [rbp - 0x14], 0
jmp 0x140001897
mov eax, dword [rbp - 0x14]
cdqe
mov byte [rbp + rax - 0x8b], 0x2e
add dword [rbp - 0x14], 1
mov eax, dword [rbp - 0x10]
cmp eax, dword [rbp - 0x14]
jg 0x140001886
mov eax, dword [rbp - 0x10]
cdqe
mov byte [rbp + rax - 0x8b], 0
mov dword [rbp - 8], 6
lea rax, [rbp - 0x8b]
mov rdx, rax
lea rax, [0x1400130a2]
mov rcx, rax
call dbg.printf
mov eax, dword [rbp - 8]
mov edx, eax
lea rax, str.Vidas:__d_n
mov rcx, rax
call dbg.printf
lea rax, str.Letra:
mov rcx, rax
call dbg.printf
lea rax, [rbp - 0x8c]
mov rdx, rax
lea rax, [0x1400130b9]
mov rcx, rax
call dbg.scanf
mov dword [rbp - 0xc], 0
mov dword [rbp - 4], 0
jmp 0x14000194b
mov eax, dword [rbp - 4]
cdqe
movzx edx, byte [rbp + rax - 0x80]
movzx eax, byte [rbp - 0x8c]
cmp dl, al
jne 0x140001947
mov dword [rbp - 0xc], 1
movzx edx, byte [rbp - 0x8c]
mov eax, dword [rbp - 4]
cdqe
mov byte [rbp + rax - 0x8b], dl
add dword [rbp - 4], 1
mov eax, dword [rbp - 0x10]
cmp eax, dword [rbp - 4]
jg 0x140001918
cmp dword [rbp - 0xc], 0
jne 0x14000195d
sub dword [rbp - 8], 1
lea rax, [0x1400130bd]
mov rcx, rax
call dbg.printf
lea rdx, [rbp - 0x8b]
lea rax, [rbp - 0x80]
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x14000198d
cmp dword [rbp - 8], 0
jg 0x1400018b3
lea rdx, [rbp - 0x8b]
lea rax, [rbp - 0x80]
mov rcx, rax
call sym.strcmp
test eax, eax
jne 0x1400019b5
lea rax, str.ENHORABUENA___HAS_GANADO_n
mov rcx, rax
call dbg.printf
jmp 0x1400019c4
lea rax, str.LO_SIENTO__HAS_PERDIDO_n
mov rcx, rax
call dbg.printf
lea rax, [rbp - 0x80]
mov rdx, rax
lea rax, str.SOLUCIN:__s_n
mov rcx, rax
call dbg.printf
mov ecx, 0
mov rax, qword [sym.__acrt_iob_func]
call rax
mov rcx, rax
call sym.fflush
call sym.getchar
mov eax, 0
add rsp, 0xb0
pop rbp
ret
Function at 0x140001d80
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov r8, rbx
mov rdx, qword [rbp + 0x20]
mov rcx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x1400029b2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x140017128]
test eax, eax
je 0x140002a4a
lea rax, [0x140017100]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x140017130]
mov qword [rbp - 8], rax
jmp 0x140002a2e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x140002a22
cmp qword [rbp - 0x10], 0
je 0x140002a22
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x1400029e8
lea rax, [0x140017100]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x140002a4b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x140002b50
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x140002b78
mov eax, 0
jmp 0x140002bc6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140002ba1
mov eax, 0
jmp 0x140002bc6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x140002bc1
mov eax, 0
jmp 0x140002bc6
mov eax, 1
add rsp, 0x20
pop rbp
ret