joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45e0e0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push rbp
mov rbp, rsp
pushfq
cld
sub rsp, 0xe0
mov qword [rsp], rdi
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r15
movups xmmword [rsp + 0x40], xmm6
movups xmmword [rsp + 0x50], xmm7
movups xmmword [rsp + 0x60], xmm8
movups xmmword [rsp + 0x70], xmm9
movups xmmword [rsp + 0x80], xmm10
movups xmmword [rsp + 0x90], xmm11
movups xmmword [rsp + 0xa0], xmm12
movups xmmword [rsp + 0xb0], xmm13
movups xmmword [rsp + 0xc0], xmm14
movups xmmword [rsp + 0xd0], xmm15
xorps xmm15, xmm15
xor r14, r14
mov rax, qword [0x005739a8]
mov rax, qword gs:[rax]
cmp rax, 0
je 0x45e17b
mov r14, qword [rax]
sub rsp, 0x10
mov rax, rcx
mov rbx, rdx
call sym.runtime.sigtrampgo
add rsp, 0x10
mov rdi, qword [rsp]
mov rsi, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov r12, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov r14, qword [rsp + 0x30]
mov r15, qword [rsp + 0x38]
movups xmm6, xmmword [rsp + 0x40]
movups xmm7, xmmword [rsp + 0x50]
movups xmm8, xmmword [rsp + 0x60]
movups xmm9, xmmword [rsp + 0x70]
movups xmm10, xmmword [rsp + 0x80]
movups xmm11, xmmword [rsp + 0x90]
movups xmm12, xmmword [rsp + 0xa0]
movups xmm13, xmmword [rsp + 0xb0]
movups xmm14, xmmword [rsp + 0xc0]
movups xmm15, xmmword [rsp + 0xd0]
add rsp, 0xe0
popfq
pop rbp
ret

Function at 0x45e3a0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x28
pushfq
cld
sub rsp, 0xe0
mov qword [rsp], rdi
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r15
movups xmmword [rsp + 0x40], xmm6
movups xmmword [rsp + 0x50], xmm7
movups xmmword [rsp + 0x60], xmm8
movups xmmword [rsp + 0x70], xmm9
movups xmmword [rsp + 0x80], xmm10
movups xmmword [rsp + 0x90], xmm11
movups xmmword [rsp + 0xa0], xmm12
movups xmmword [rsp + 0xb0], xmm13
movups xmmword [rsp + 0xc0], xmm14
movups xmmword [rsp + 0xd0], xmm15
mov rax, qword [0x005739a8]
mov rax, qword gs:[rax]
cmp rax, 0
jne 0x45e437
int 3
mov r14, qword [rax]
sub rsp, 0x28
mov qword [rsp], rcx
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], r9
call sym.runtime.sehhandler.abi0
mov eax, dword [rsp + 0x20]
add rsp, 0x28
mov rdi, qword [rsp]
mov rsi, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov r12, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov r14, qword [rsp + 0x30]
mov r15, qword [rsp + 0x38]
movups xmm6, xmmword [rsp + 0x40]
movups xmm7, xmmword [rsp + 0x50]
movups xmm8, xmmword [rsp + 0x60]
movups xmm9, xmmword [rsp + 0x70]
movups xmm10, xmmword [rsp + 0x80]
movups xmm11, xmmword [rsp + 0x90]
movups xmm12, xmmword [rsp + 0xa0]
movups xmm13, xmmword [rsp + 0xb0]
movups xmm14, xmmword [rsp + 0xc0]
movups xmm15, xmmword [rsp + 0xd0]
add rsp, 0xe0
popfq
add rsp, 0x28
pop rbp
ret
Function at 0x45e800
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x45e834
mov rcx, 0x28
jmp 0x45e83f
shl rcx, 3
add rcx, 0x1480
mov qword [0x005739a8], rcx
pop rbp
ret

Function at 0x465780
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46584a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x005739a8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x46582f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x0046c4c0]
xor ebx, ebx
mov rcx, rdx
call sym.runtime.makeslice
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call sym.syscall.encodeWTF16
inc rbx
cmp rcx, rbx
jae 0x46581e
mov edi, 1
lea rsi, [0x0046c4c0]
call sym.runtime.growslice
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x00494ff8]
lea rsi, [0x00494d40]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.syscall.UTF16FromString
Function at 0x1429e0058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1429e01df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1429e0089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1429e006f
add dl, dl
jne 0x1429e0096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1429e00f6
xor eax, eax
add dl, dl
jne 0x1429e00a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1429e01ad
add dl, dl
jne 0x1429e00b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1429e00c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1429e00d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1429e00dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1429e00ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1429e007e
mov eax, 1
add dl, dl
jne 0x1429e0106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1429e0113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1429e00fb
sub eax, ebx
mov ebx, 1
jne 0x1429e014c
mov ecx, 1
add dl, dl
jne 0x1429e012e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1429e013b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1429e0123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1429e007e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1429e0168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1429e0175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1429e015d
cmp eax, 0x7d00
jae 0x1429e019b
cmp eax, 0x500
jb 0x1429e0196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1429e007e
cmp eax, 0x7f
ja 0x1429e019e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1429e007e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1429e01d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1429e007e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14000ba80
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
movaps xmmword [rsp + 0x90], xmm6
mov rdi, rdx
mov qword [rsp + 0x78], rcx
mov dword [rsp + 0x4c], 0
call sub.KERNEL32.dll_GetCommandLineW
lea rdx, [rsp + 0x4c]
mov rcx, rax
call sub.SHELL32.dll_CommandLineToArgvW
mov rbx, rax
movsxd rcx, dword [rsp + 0x4c]
xorps xmm6, xmm6
movaps xmmword [rsp + 0x60], xmm6
mov qword [rsp + 0x20], rdi
lea r8, str.c:_programs_odin_core_os_os_windows.odin
lea r9, [rsp + 0x60]
mov rdx, rdi
call fcn.1400589b0
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x88], rsi
test rsi, rsi
jle 0x14000bbbd
add rbp, 8
nop dword [rax]
mov r12, qword [rbx]
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov ecx, 0xfde9
xor edx, edx
mov r8, r12
mov r9d, 0xffffffff
call sub.KERNEL32.dll_WideCharToMultiByte
movsxd r13, eax
movaps xmmword [rsp + 0x50], xmm6
mov qword [rsp + 0x20], rdi
mov rcx, r13
mov rdx, rdi
lea r8, str.c:_programs_odin_core_os_os_windows.odin
lea r9, [rsp + 0x50]
call fcn.140057510
mov r15, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r15
mov ecx, 0xfde9
xor edx, edx
mov r8, r12
mov r9d, 0xffffffff
call sub.KERNEL32.dll_WideCharToMultiByte
xor ecx, ecx
test eax, eax
setg cl
sub eax, ecx
cdqe
test eax, eax
js 0x14000bbf5
cmp r14, rax
jl 0x14000bbf5
mov qword [rbp - 8], r15
mov qword [rbp], rax
add rbx, 8
add rbp, 0x10
dec rsi
jne 0x14000bb10
mov rcx, qword [rsp + 0x80]
mov rax, qword [rsp + 0x78]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x88]
mov qword [rax + 8], rcx
movaps xmm6, xmmword [rsp + 0x90]
add rsp, 0xa8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
lea rcx, str.c:_programs_odin_core_os_os_windows.odin
mov edx, 0xa0
mov r8d, 0x1b
xor r9d, r9d
call fcn.14000e260
int3

Function at 0x14000bc20
Capabilities:
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
add rax, rdx
movzx edx, byte [rcx]
xor rdx, rax
movabs rax, 0x100000001b3
imul rdx, rax
movzx r8d, byte [rcx + 1]
xor r8, rdx
imul r8, rax
movzx edx, byte [rcx + 2]
xor rdx, r8
imul rdx, rax
movzx r8d, byte [rcx + 3]
xor r8, rdx
imul r8, rax
movzx edx, byte [rcx + 4]
xor rdx, r8
imul rdx, rax
movzx r8d, byte [rcx + 5]
xor r8, rdx
imul r8, rax
movzx edx, byte [rcx + 6]
xor rdx, r8
imul rdx, rax
movzx ecx, byte [rcx + 7]
xor rcx, rdx
imul rcx, rax
movabs rdx, 0x7fffffffffffffff
xor eax, eax
and rdx, rcx
sete al
or rax, rdx
ret
Function at 0x14000bce0
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rbx, r9
mov rdi, r8
mov r14, rdx
mov rsi, rcx
mov rax, qword [rcx]
mov r8, qword [rcx + 8]
test r8, r8
je 0x14000bda2
mov ecx, eax
and ecx, 0x3f
mov edx, 1
shl rdx, cl
test rax, rax
cmove rdx, rax
lea r11, [rdx - 1]
mov r10, r11
and r10, r14
and rax, 0xffffffffffffffc0
lea r9, [rax + rdx*8]
lea r15, [r9 + rdx*8]
mov rbp, qword [r15 + r10*8]
test rbp, rbp
je 0x14000bdaf
mov qword [rsp + 0x30], rbx
mov r12, qword [rdi]
sub rdx, r10
mov r13, 0xffffffffffffffff
jmp 0x14000bd6f
inc r10
and r10, r11
mov rbp, qword [r15 + r10*8]
test rbp, rbp
je 0x14000bdaa
lea rbx, [rdx + r10]
and rbx, r11
inc r13
cmp r13, rbx
ja 0x14000bdaa
cmp rbp, r14
jne 0x14000bd60
cmp qword [rax + r10*8], r12
jne 0x14000bd60
shl r10, 3
add r9, r10
mov rbx, qword [rsp + 0x30]
je 0x14000bdaf
mov rax, qword [rbx]
mov qword [r9], rax
jmp 0x14000bf33
and eax, 0x3f
mov rcx, rax
jmp 0x14000bdaf
mov rbx, qword [rsp + 0x30]
mov eax, 0x4b
shl rax, cl
shr rax, 2
movabs rdx, 0x28f5c28f5c28f5c3
mul rdx
shr rdx, 2
cmp r8, rdx
jae 0x14000bddf
mov word [rsp + 0x2e], 0
lea rax, [rsp + 0x2e]
jmp 0x14000be2c
mov rax, qword [rsp + 0xa8]
mov r9, qword [rsp + 0xa0]
cmp rcx, 3
mov edx, 2
cmovb rcx, rdx
shl rdx, cl
xor r8d, r8d
cmp rcx, 0x3f
cmovne r8, rdx
mov qword [rsp + 0x20], rax
lea rdx, [0x140088960]
mov rcx, rsi
call fcn.14000dc90
mov byte [rsp + 0x2c], al
mov byte [rsp + 0x2d], 1
lea rax, [rsp + 0x2c]
movzx eax, word [rax]
test al, al
jne 0x14000bf33
test eax, 0x100
je 0x14000bf15
mov rax, qword [rsi]
and rax, 0xffffffffffffffc0
movabs rcx, 0x9e3779b97f4a7c15
add rcx, rax
mov rax, rcx
shr rax, 0x1e
xor rax, rcx
movabs rcx, 0xbf58476d1ce4e5b9
imul rcx, rax
mov rax, rcx
shr rax, 0x1b
xor rax, rcx
movabs rcx, 0x94d049bb133111eb
imul rcx, rax
mov rax, rcx
shr rax, 0x1f
xor rax, rcx
movabs rcx, 0xcbf29ce484222325
add rcx, rax
movzx edx, byte [rdi]
xor rdx, rcx
movabs rax, 0x100000001b3
imul rdx, rax
movzx ecx, byte [rdi + 1]
xor rcx, rdx
imul rcx, rax
movzx edx, byte [rdi + 2]
xor rdx, rcx
imul rdx, rax
movzx ecx, byte [rdi + 3]
xor rcx, rdx
imul rcx, rax
movzx edx, byte [rdi + 4]
xor rdx, rcx
imul rdx, rax
movzx ecx, byte [rdi + 5]
xor rcx, rdx
imul rcx, rax
movzx edx, byte [rdi + 6]
xor rdx, rcx
imul rdx, rax
movzx ecx, byte [rdi + 7]
xor rcx, rdx
imul rcx, rax
movabs rax, 0x7fffffffffffffff
xor r14d, r14d
and rax, rcx
sete r14b
or r14, rax
mov qword [rsp + 0x20], rbx
lea rdx, [0x140088960]
mov rcx, rsi
mov r8, r14
mov r9, rdi
call fcn.14000bf50
inc qword [rsi + 8]
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14000cca0
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rbx, r9
mov rdi, r8
mov r14, rdx
mov rsi, rcx
mov rax, qword [rcx]
mov r8, qword [rcx + 8]
test r8, r8
je 0x14000cd61
mov ecx, eax
and ecx, 0x3f
mov edx, 1
shl rdx, cl
test rax, rax
cmove rdx, rax
lea r11, [rdx - 1]
mov r10, r11
and r10, r14
and rax, 0xffffffffffffffc0
lea r9, [rax + rdx*8]
lea r15, [r9 + rdx*4]
mov rbp, qword [r15 + r10*8]
test rbp, rbp
je 0x14000cd6e
mov qword [rsp + 0x30], rbx
mov r12, qword [rdi]
sub rdx, r10
mov r13, 0xffffffffffffffff
jmp 0x14000cd2f
inc r10
and r10, r11
mov rbp, qword [r15 + r10*8]
test rbp, rbp
je 0x14000cd69
lea rbx, [rdx + r10]
and rbx, r11
inc r13
cmp r13, rbx
ja 0x14000cd69
cmp rbp, r14
jne 0x14000cd20
cmp qword [rax + r10*8], r12
jne 0x14000cd20
shl r10, 2
add r9, r10
mov rbx, qword [rsp + 0x30]
je 0x14000cd6e
mov eax, dword [rbx]
mov dword [r9], eax
jmp 0x14000cef2
and eax, 0x3f
mov rcx, rax
jmp 0x14000cd6e
mov rbx, qword [rsp + 0x30]
mov eax, 0x4b
shl rax, cl
shr rax, 2
movabs rdx, 0x28f5c28f5c28f5c3
mul rdx
shr rdx, 2
cmp r8, rdx
jae 0x14000cd9e
mov word [rsp + 0x2e], 0
lea rax, [rsp + 0x2e]
jmp 0x14000cdeb
mov rax, qword [rsp + 0xa8]
mov r9, qword [rsp + 0xa0]
cmp rcx, 3
mov edx, 2
cmovb rcx, rdx
shl rdx, cl
xor r8d, r8d
cmp rcx, 0x3f
cmovne r8, rdx
mov qword [rsp + 0x20], rax
lea rdx, [0x140088bf0]
mov rcx, rsi
call fcn.14000dc90
mov byte [rsp + 0x2c], al
mov byte [rsp + 0x2d], 1
lea rax, [rsp + 0x2c]
movzx eax, word [rax]
test al, al
jne 0x14000cef2
test eax, 0x100
je 0x14000ced4
mov rax, qword [rsi]
and rax, 0xffffffffffffffc0
movabs rcx, 0x9e3779b97f4a7c15
add rcx, rax
mov rax, rcx
shr rax, 0x1e
xor rax, rcx
movabs rcx, 0xbf58476d1ce4e5b9
imul rcx, rax
mov rax, rcx
shr rax, 0x1b
xor rax, rcx
movabs rcx, 0x94d049bb133111eb
imul rcx, rax
mov rax, rcx
shr rax, 0x1f
xor rax, rcx
movabs rcx, 0xcbf29ce484222325
add rcx, rax
movzx edx, byte [rdi]
xor rdx, rcx
movabs rax, 0x100000001b3
imul rdx, rax
movzx ecx, byte [rdi + 1]
xor rcx, rdx
imul rcx, rax
movzx edx, byte [rdi + 2]
xor rdx, rcx
imul rdx, rax
movzx ecx, byte [rdi + 3]
xor rcx, rdx
imul rcx, rax
movzx edx, byte [rdi + 4]
xor rdx, rcx
imul rdx, rax
movzx ecx, byte [rdi + 5]
xor rcx, rdx
imul rcx, rax
movzx edx, byte [rdi + 6]
xor rdx, rcx
imul rdx, rax
movzx ecx, byte [rdi + 7]
xor rcx, rdx
imul rcx, rax
movabs rax, 0x7fffffffffffffff
xor r14d, r14d
and rax, rcx
sete r14b
or r14, rax
mov qword [rsp + 0x20], rbx
lea rdx, [0x140088bf0]
mov rcx, rsi
mov r8, r14
mov r9, rdi
call fcn.14000bf50
inc qword [rsi + 8]
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14000ec70
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
cmp qword [rcx + 8], 0
je 0x14000ed17
mov rsi, rcx
mov ecx, 0xfffffff4
call fcn.14005f988
mov rdi, rax
mov rcx, rax
mov edx, 1
xor r8d, r8d
call sub.KERNEL32.dll_SetHandleInformation
mov dword [rsp + 0x34], 0
mov r14, qword [rsi + 8]
test r14, r14
jle 0x14000ed17
xor r15d, r15d
mov ebp, 0x40000000
lea rbx, [rsp + 0x34]
nop word cs:[rax + rax]
mov r8d, r14d
sub r8d, r15d
cmp r8d, 0x40000000
cmovge r8d, ebp
mov rdx, qword [rsi]
add rdx, r15
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov r9, rbx
call sub.KERNEL32.dll_WriteFile
mov ecx, dword [rsp + 0x34]
test rcx, rcx
je 0x14000ed12
test eax, eax
je 0x14000ed12
add r15, rcx
cmp r15, r14
jl 0x14000ecd0
jmp 0x14000ed17
call sub.KERNEL32.dll_GetLastError
nop
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x14000ed50
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0x40
mov byte [rsp + 0x30], cl
mov ecx, 0xfffffff4
call fcn.14005f988
mov rsi, rax
mov rcx, rax
mov edx, 1
xor r8d, r8d
call sub.KERNEL32.dll_SetHandleInformation
mov dword [rsp + 0x3c], 0
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x30]
lea r9, [rsp + 0x3c]
mov rcx, rsi
mov r8d, 1
call sub.KERNEL32.dll_WriteFile
cmp dword [rsp + 0x3c], 0
je 0x14000edaa
test eax, eax
jne 0x14000edaf
call sub.KERNEL32.dll_GetLastError
nop
add rsp, 0x40
pop rsi
ret
Function at 0x14000f1a0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
mov rdx, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0xb0], 0
cmp rcx, 0xa
jb 0x14000f261
mov rbx, 0xffffffffffffffff
lea r8, str.0123456789abcdefghijklmnopqrstuvwxyz
movabs r9, 0xcccccccccccccccd
nop dword [rax]
mov rcx, rdx
mov rax, rdx
mul r9
shr rdx, 3
lea rax, [rdx + rdx]
lea rax, [rax + rax*4]
mov r10, rcx
sub r10, rax
movzx eax, byte [r8 + r10]
mov byte [rsp + rbx + 0xb1], al
dec rbx
cmp rcx, 0x63
ja 0x14000f210
movzx eax, byte [rdx + r8]
mov byte [rsp + rbx + 0xb1], al
test rbx, rbx
je 0x14000f305
lea rdi, [rbx + 0x81]
neg rbx
jmp 0x14000f27d
lea rax, str.0123456789abcdefghijklmnopqrstuvwxyz
movzx eax, byte [rdx + rax]
mov byte [rsp + 0xb0], al
mov edi, 0x80
mov ebx, 1
mov ecx, 0xfffffff4
call fcn.14005f988
mov rsi, rax
mov rcx, rax
mov edx, 1
xor r8d, r8d
call sub.KERNEL32.dll_SetHandleInformation
mov dword [rsp + 0x2c], 0
test rbx, rbx
jle 0x14000f305
lea r14, [rsp + rdi]
add r14, 0x30
xor r15d, r15d
mov ebp, 0x40000000
lea rdi, [rsp + 0x2c]
nop dword [rax]
mov r8d, ebx
sub r8d, r15d
cmp r8d, 0x40000000
cmovge r8d, ebp
lea rdx, [r14 + r15]
mov qword [rsp + 0x20], 0
mov rcx, rsi
mov r9, rdi
call sub.KERNEL32.dll_WriteFile
mov ecx, dword [rsp + 0x2c]
test rcx, rcx
je 0x14000f300
test eax, eax
je 0x14000f300
add r15, rcx
cmp r15, rbx
jl 0x14000f2c0
jmp 0x14000f305
call sub.KERNEL32.dll_GetLastError
nop
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14000f380
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
mov r8, rcx
neg r8
cmovs r8, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0xb0], 0
mov edi, 0x81
lea r10, str.0123456789abcdefghijklmnopqrstuvwxyz
cmp r8, 0xa
jl 0x14000f432
movabs r11, 0xcccccccccccccccd
nop word cs:[rax + rax]
mov rax, r8
mul r11
mov r9, rdx
shr r9, 3
lea rax, [r9 + r9]
lea rax, [rax + rax*4]
mov rdx, r8
sub rdx, rax
movzx eax, byte [r10 + rdx]
mov byte [rsp + rdi + 0x2f], al
dec rdi
cmp r8, 0x63
mov r8, r9
ja 0x14000f400
jmp 0x14000f435
mov r9, r8
movabs rdx, 0x6666666666666667
mov rax, r9
imul rdx
mov rax, rdx
shr rax, 0x3f
sar rdx, 2
add rdx, rax
add rdx, rdx
lea rax, [rdx + rdx*4]
sub r9, rax
movzx eax, byte [r10 + r9]
mov byte [rsp + rdi + 0x2f], al
test rcx, rcx
js 0x14000f470
dec rdi
jmp 0x14000f479
mov byte [rsp + rdi + 0x2e], 0x2d
add rdi, 0xfffffffffffffffe
mov rbx, rdi
sub rbx, 0x81
je 0x14000f515
neg rbx
mov ecx, 0xfffffff4
call fcn.14005f988
mov rsi, rax
mov rcx, rax
mov edx, 1
xor r8d, r8d
call sub.KERNEL32.dll_SetHandleInformation
mov dword [rsp + 0x2c], 0
test rbx, rbx
jle 0x14000f515
lea r14, [rsp + rdi]
add r14, 0x30
xor r15d, r15d
mov ebp, 0x40000000
lea rdi, [rsp + 0x2c]
nop dword [rax + rax]
mov r8d, ebx
sub r8d, r15d
cmp r8d, 0x40000000
cmovge r8d, ebp
lea rdx, [r14 + r15]
mov qword [rsp + 0x20], 0
mov rcx, rsi
mov r9, rdi
call sub.KERNEL32.dll_WriteFile
mov ecx, dword [rsp + 0x2c]
test rcx, rcx
je 0x14000f510
test eax, eax
je 0x14000f510
add r15, rcx
cmp r15, rbx
jl 0x14000f4d0
jmp 0x14000f515
call sub.KERNEL32.dll_GetLastError
nop
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14000f530
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x68
mov rsi, rcx
call fcn.14000ec70
mov byte [rsp + 0x30], 0x28
mov ecx, 0xfffffff4
call fcn.14005f988
mov rdi, rax
mov rcx, rax
mov edx, 1
xor r8d, r8d
call sub.KERNEL32.dll_SetHandleInformation
mov dword [rsp + 0x5c], 0
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x30]
lea r9, [rsp + 0x5c]
mov rcx, rdi
mov r8d, 1
call sub.KERNEL32.dll_WriteFile
cmp dword [rsp + 0x5c], 0
je 0x14000f594
test eax, eax
jne 0x14000f599
call sub.KERNEL32.dll_GetLastError
movsxd rcx, dword [rsi + 0x10]
call fcn.14000f1a0
mov byte [rsp + 0x40], 0x3a
mov ecx, 0xfffffff4
call fcn.14005f988
mov rdi, rax
mov rcx, rax
mov edx, 1
xor r8d, r8d
call sub.KERNEL32.dll_SetHandleInformation
mov dword [rsp + 0x60], 0
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x40]
lea r9, [rsp + 0x60]
mov rcx, rdi
mov r8d, 1
call sub.KERNEL32.dll_WriteFile
cmp dword [rsp + 0x60], 0
je 0x14000f5f8
test eax, eax
jne 0x14000f5fd
call sub.KERNEL32.dll_GetLastError
movsxd rcx, dword [rsi + 0x14]
call fcn.14000f1a0
mov byte [rsp + 0x50], 0x29
mov ecx, 0xfffffff4
call fcn.14005f988
mov rsi, rax
mov rcx, rax
mov edx, 1
xor r8d, r8d
call sub.KERNEL32.dll_SetHandleInformation
mov dword [rsp + 0x64], 0
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x50]
lea r9, [rsp + 0x64]
mov rcx, rsi
mov r8d, 1
call sub.KERNEL32.dll_WriteFile
cmp dword [rsp + 0x64], 0
je 0x14000f65c
test eax, eax
jne 0x14000f661
call sub.KERNEL32.dll_GetLastError
nop
add rsp, 0x68
pop rdi
pop rsi
ret
Function at 0x140010e40
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
mov eax, 0x10070
call fcn.140063b10
sub rsp, rax
movaps xmmword [rsp + 0x10060], xmm6
mov rbx, r9
mov rsi, r8
mov rdi, rdx
mov r15, rcx
lea r14, [rsp + 0x62]
mov r8d, 0xfffe
mov rcx, r14
xor edx, edx
call fcn.14007da20
mov dword [rsp + 0x3c], 0xfffe
lea r8, [rbx + 0x10]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
lea rdx, str.PATH
lea rcx, [rsp + 0x40]
mov r9, rbx
call fcn.1400350a0
mov r8, qword [rsp + 0x40]
test r8, r8
je 0x140010ebb
cmp qword [rsp + 0x48], 0
je 0x140010f6c
mov eax, 0x80000001
lea rcx, [rax + 1]
test r15, r15
lea r9, str.Environment
lea rdx, str.SYSTEMCurrentControlSetControlSession_ManagerEnvironment
cmove rdx, r9
cmove rcx, rax
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], 0
mov r9d, 0x10000004
call sub.ADVAPI32.dll_RegGetValueW
test eax, eax
je 0x140010f19
mov ecx, eax
xor eax, eax
cmp ecx, 2
sete al
inc rax
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
jmp 0x140010f55
xorps xmm6, xmm6
movaps xmmword [rsp + 0x50], xmm6
mov qword [rsp + 0x20], rbx
lea rcx, [rsp + 0x62]
lea r9, [rsp + 0x50]
mov edx, 0x7fff
mov r8, rdi
call fcn.1400352a0
test al, al
je 0x140010f4b
movups xmmword [rsi], xmm6
mov eax, 3
jmp 0x140010f55
movaps xmm0, xmmword [rsp + 0x50]
movups xmmword [rsi], xmm0
xor eax, eax
movaps xmm6, xmmword [rsp + 0x10060]
add rsp, 0x10070
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov qword [rsp + 0x20], 0
lea rcx, str.c:_programs_odin_core_sys_windows_util.odin
mov edx, 0x39
mov r8d, 0xf
xor r9d, r9d
call fcn.14005d190
int3