joyce8/EMBER2024-capa huggingface dataset:
Function at 0x455900
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4559bb
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rdx, [0x00455a00]
mov qword [rsp + 0x10], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdi
lea rax, [rsp + 8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.0045c1c0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045c300
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00455900
Function at 0x45e420
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4027af
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
nop
call fcn.00408e40
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045c300
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x402780
cmp byte [0x005993b0], 0
je 0x45e435
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x45b400
jmp 0x402780

Function at 0x45e440
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00599660]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x005993b0], 0
je 0x45e475
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x00599980]
aesenc xmm0, xmmword [0x00599990]
aesenc xmm0, xmmword [0x005999a0]
movq rax, xmm0
ret
jmp 0x409040

Function at 0x45e480
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00599660]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x005993b0], 0
je 0x45e4b6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x00599980]
aesenc xmm0, xmmword [0x00599990]
aesenc xmm0, xmmword [0x005999a0]
movq rax, xmm0
ret
jmp 0x4090a0

Function at 0x45fe20
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x30
mov rcx, 0xfffffffffffffff4
mov qword [rsp], rcx
mov rax, qword [sym.imp.kernel32.dll_GetStdHandle]
call rax
mov rcx, rax
mov qword [rsp], rcx
lea rdx, [0x00599900]
mov qword [rsp + 8], rdx
lea r8d, [0x005993c8]
mov qword [rsp + 0x10], r8
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.kernel32.dll_WriteFile]
call rax
call fcn.0045e360
add rsp, 0x30
ret
Function at 0x1400110eb
Capabilities:
Write file on windows

Disassembly:
jmp 0x14001b370
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x14001b3bb
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x14001b4c7
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x14001b460
cmp qword [rbp + 0x28], 0
jle 0x14001b460
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x14001b400
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.1400117f8
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rbp + 0x130], 0
jle 0x14001b4b6
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x14001b4b6
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x1400114c4
Capabilities:
Terminate process

Disassembly:
jmp 0x14001e030
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400115e6
Capabilities:
Parse pe header

Disassembly:
jmp 0x14001eb60
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14001eb80
xor al, al
jmp 0x14001ec01
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14001eb93
xor al, al
jmp 0x14001ec01
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001ebbd
xor al, al
jmp 0x14001ec01
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14001ebd1
xor al, al
jmp 0x14001ec01
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14001ebe3
xor al, al
jmp 0x14001ec01
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001ebff
xor al, al
jmp 0x14001ec01
mov al, 1
add rsp, 0x38
ret
Function at 0x140011861
Capabilities:
Write file on windows

Disassembly:
jmp 0x1400177f0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x32
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1d8]
mov rax, qword [0x14002c040]
xor rax, rbp
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x1a0]
cmp qword [rax + 0x68], 0
je 0x14001784a
mov rax, qword [rbp + 0x1a0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140017851
mov al, 1
jmp 0x1400179c1
mov rax, qword [rbp + 0x1a0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rbp + 0x158], rax
call fcn.140011267
mov dword [rbp + 0x160], eax
mov edx, dword [rbp + 0x160]
mov rcx, qword [rbp + 0x1a0]
call qword [rbp + 0x158]
mov dword [rbp + 0x164], eax
call fcn.140011267
mov dword [rbp + 0x168], eax
mov edx, dword [rbp + 0x164]
mov ecx, dword [rbp + 0x168]
call fcn.1400116a9
movzx eax, al
test eax, eax
je 0x1400178b4
xor al, al
jmp 0x1400179c1
mov qword [rbp + 8], 0x20
mov rax, qword [rbp + 0x1a0]
mov rax, qword [rax + 0x68]
mov qword [rbp + 0x158], rax
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x1a0]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rcx, qword [rbp + 0x158]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x160], eax
cmp dword [rbp + 0x160], 0
je 0x140017927
cmp dword [rbp + 0x160], 1
je 0x140017932
cmp dword [rbp + 0x160], 3
je 0x1400179b0
jmp 0x1400179bf
mov rax, qword [rbp + 0x1a0]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x140017982
mov rax, qword [rbp + 0x1a0]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x140017982
xor al, al
jmp 0x1400179c1
mov rax, qword [rbp + 0x1a0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14001799d
mov dword [rbp + 0x154], 1
jmp 0x1400179a7
mov dword [rbp + 0x154], 0
movzx eax, byte [rbp + 0x154]
jmp 0x1400179c1
mov rax, qword [rbp + 0x1a0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x1400179c1
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x140026940]
call fcn.1400116fe
mov rax, rdi
mov rcx, qword [rbp + 0x170]
xor rcx, rbp
call fcn.14001140b
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret
Function at 0x140001480
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x1400a3b80]
mov dword [rax], 1
mov rax, qword [0x1400a3b90]
mov dword [rax], 1
mov rax, qword [0x1400a3ba0]
mov dword [rax], 1
mov rax, qword [0x1400a3b70]
mov dword [rax], 1
mov rax, qword [0x1400a3990]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400014de
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x14000150a
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x140001530
cmp eax, 0x20b
je 0x140001557
jmp 0x140001586
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x140001543
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x14000158b
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x140001572
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x14000158b
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140001db0
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
sub rsp, 0x28
mov r12, rcx
mov rcx, rdx
mov r13, rdx
call sub.msvcrt.dll_strlen
mov rcx, r13
mov r9, r12
mov edx, 1
mov r8, rax
call sub.msvcrt.dll_fwrite
mov rcx, r12
add rsp, 0x28
pop r12
pop r13
jmp fcn.14001d018

Function at 0x140001df0
Capabilities:
Write file on windows

Disassembly:
push r12
sub rsp, 0x20
mov ecx, 2
call qword [fcn.14001d730]
mov r8d, 0x4b
mov edx, 1
lea rcx, str._GC__cannot_register_thread_local_variable__too_many_thread_local_variables
mov r12, rax
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rcx, r12
call fcn.14001d018
mov ecx, 1
call sub.msvcrt.dll_exit
nop
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x140001e40
Capabilities:
Write file on windows

Disassembly:
push r12
sub rsp, 0x20
mov ecx, 2
call qword [fcn.14001d730]
mov r8d, 0x3f
mov edx, 1
lea rcx, str._GC__cannot_register_global_variable__too_many_global_variables
mov r12, rax
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rcx, r12
call fcn.14001d018
mov ecx, 1
call sub.msvcrt.dll_exit
nop
nop word cs:[rax + rax]
nop dword [rax]
push rsi
push rbx
mov r10, qword [sym.Snaffler_ruylopez.exe_varTrace__OOZOOZ85sersZnicksZOnimbleZpkgsZwinim4551O57O50ZwinimZcom_79]
movabs rax, 0xe7037ed1a0b428db
movabs rbx, 0xa0761d6478bd642f
mov r9, rcx
mov rcx, qword [r10]
xor rax, r9
mul rbx
movabs rbx, 0xeb44accab455d16d
xor rax, rdx
mul rbx
mov r11, rdx
xor r11, rax
cmp rdx, rax
mov eax, 0x12b9b0a1
cmove r11, rax
test rcx, rcx
je 0x140002010
mov r8, qword [rcx]
test r8, r8
je 0x140002010
sub r8, 1
mov rax, r8
and rax, r11
lea rdx, [rax + rax*2]
mov rdx, qword [rcx + rdx*8 + 0x10]
test rdx, rdx
je 0x140001f35
nop dword [rax + rax]
cmp rdx, r11
jne 0x140001f20
lea rdx, [rax + rax*2]
cmp r9, qword [rcx + rdx*8 + 0x18]
je 0x140001f38
add rax, 1
and rax, r8
lea rdx, [rax + rax*2]
mov rdx, qword [rcx + rdx*8 + 0x10]
test rdx, rdx
jne 0x140001f10
not rax
test rax, rax
js 0x140002010
sub qword [r10 + 8], 1
lea rdx, [rax + rax*2]
shl rdx, 3
mov qword [rcx + rdx + 0x10], 0
mov rcx, qword [r10]
add rcx, rdx
mov qword [rcx + 0x18], 0
add rdx, qword [r10]
mov byte [rdx + 0x20], 0
lea rdx, [rax + 1]
mov r11, qword [r10]
and rdx, r8
lea rcx, [rdx + rdx*2]
mov rcx, qword [r11 + rcx*8 + 0x10]
test rcx, rcx
jne 0x140001faf
jmp 0x140002010
cmp rax, rcx
jl 0x140001f9a
cmp rax, rdx
jle 0x140001fc1
add rdx, 1
and rdx, r8
lea rcx, [rdx + rdx*2]
mov rcx, qword [r11 + rcx*8 + 0x10]
test rcx, rcx
je 0x140002010
and rcx, r8
cmp rcx, rdx
jle 0x140001f90
cmp rax, rcx
jge 0x140001fc1
cmp rax, rdx
jg 0x140001f9a
lea rax, [rax + rax*2]
lea rcx, [r11 + rax*8]
lea rax, [rdx + rdx*2]
shl rax, 3
add r11, rax
movdqu xmm0, xmmword [r11 + 0x10]
movups xmmword [rcx + 0x10], xmm0
mov r11, qword [r11 + 0x20]
mov qword [rcx + 0x20], r11
mov rcx, qword [r10]
lea rax, [rcx + rax + 0x10]
mov qword [rax], 0
mov qword [rax + 8], 0
mov qword [rax + 0x10], 0
mov rax, rdx
mov rcx, qword [r10]
jmp 0x140001f46
mov rcx, r9
pop rbx
pop rsi
jmp qword [0x1400bd088]

Function at 0x1400050a0
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
sub rsp, 0x48
mov byte [rsp + 0x3f], 1
movzx eax, byte [rsp + 0x3f]
mov r12, rcx
mov qword [rsp + 0x28], rdx
test al, al
jne 0x1400050d0
add rsp, 0x48
pop r12
pop r13
ret
mov ecx, 2
call qword [fcn.14001d730]
mov r8, qword [rsp + 0x28]
mov rcx, r12
mov edx, 1
mov r13, rax
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rcx, r13
add rsp, 0x48
pop r12
pop r13
jmp fcn.14001d018
Function at 0x14000c0f0
Capabilities:
Access peb ldr_data

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rbx, sym.Snaffler_ruylopez.exe_TM__N8CdbwZ9cwqgx8RJFxCYHdg_45.lto_priv.0
mov r13, rcx
mov r12d, edx
lea rcx, sym.Snaffler_ruylopez.exe_TM__N8CdbwZ9cwqgx8RJFxCYHdg_43.lto_priv.0
mov edx, 0x2306eac
call sym.Snaffler_ruylopez.exe_thisisStrange__nimstrenc_4
mov edx, 0x613a7484
mov rcx, rax
call sym.Snaffler_ruylopez.exe_calcTheThings__76oader_88
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rdi, qword [rax + 0x20]
lea rsi, [rax + 0x20]
nop dword [rax]
movzx eax, word [r13]
mov rdx, r13
test ax, ax
je 0x14000c170
nop dword [rax]
lea ecx, [rax - 0x41]
cmp cx, 0x19
ja 0x14000c1f0
add eax, 0x20
add rdx, 2
mov word [rdx - 2], ax
movzx eax, word [rdx]
test ax, ax
jne 0x14000c150
mov r8, qword [rdi + 0x50]
movzx eax, word [r8]
test ax, ax
je 0x14000c1a0
mov rdx, r8
lea ecx, [rax - 0x41]
cmp cx, 0x19
ja 0x14000c210
add eax, 0x20
add rdx, 2
mov word [rdx - 2], ax
movzx eax, word [rdx]
test ax, ax
jne 0x14000c180
mov rdx, r8
mov rcx, r13
call sym.Snaffler_ruylopez.exe_lstrcmpiW__76oader_310
mov edx, 0x2c7c182c
mov rcx, rbx
mov rbp, rax
call sym.Snaffler_ruylopez.exe_thisisStrange__nimstrenc_4
mov edx, 0x53ca0104
mov rcx, rax
call sym.Snaffler_ruylopez.exe_calcTheThings__76oader_88
test rbp, rbp
je 0x14000c226
mov rdi, qword [rdi]
cmp rsi, rdi
jne 0x14000c140
mov edx, r12d
mov rcx, r13
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.Snaffler_ruylopez.exe_get_library_address__76oader_334.part.0
movzx eax, word [rdx + 2]
add rdx, 2
test ax, ax
jne 0x14000c150
jmp 0x14000c170
movzx eax, word [rdx + 2]
add rdx, 2
test ax, ax
jne 0x14000c180
jmp 0x14000c1a0
mov rax, qword [rdi + 0x20]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x14000e020
Capabilities:
Access peb ldr_data

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov edx, 0x2306eac
mov r12, rcx
mov rcx, qword [sym.Snaffler_ruylopez.exe_TM__N8CdbwZ9cwqgx8RJFxCYHdg_43.lto_priv.0]
call sym.Snaffler_ruylopez.exe_thisisStrange__nimstrenc_4
mov edx, 0x613a7484
mov rcx, rax
call sym.Snaffler_ruylopez.exe_calcTheThings__76oader_88
mov rbx, qword [sym.Snaffler_ruylopez.exe_TM__N8CdbwZ9cwqgx8RJFxCYHdg_45.lto_priv.0]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rdi, qword [rax + 0x20]
lea rsi, [rax + 0x20]
nop word [rax + rax]
movzx eax, word [r12]
mov rdx, r12
test ax, ax
je 0x14000e0a0
nop dword [rax]
lea ecx, [rax - 0x41]
cmp cx, 0x19
ja 0x14000e120
add eax, 0x20
add rdx, 2
mov word [rdx - 2], ax
movzx eax, word [rdx]
test ax, ax
jne 0x14000e080
mov r8, qword [rdi + 0x50]
movzx eax, word [r8]
test ax, ax
je 0x14000e0d0
mov rdx, r8
lea ecx, [rax - 0x41]
cmp cx, 0x19
ja 0x14000e140
add eax, 0x20
add rdx, 2
mov word [rdx - 2], ax
movzx eax, word [rdx]
test ax, ax
jne 0x14000e0b0
mov rdx, r8
mov rcx, r12
call sym.Snaffler_ruylopez.exe_lstrcmpiW__76oader_310
mov edx, 0x2c7c182c
mov rcx, rbx
mov rbp, rax
call sym.Snaffler_ruylopez.exe_thisisStrange__nimstrenc_4
mov edx, 0x53ca0104
mov rcx, rax
call sym.Snaffler_ruylopez.exe_calcTheThings__76oader_88
test rbp, rbp
je 0x14000e156
mov rdi, qword [rdi]
cmp rsi, rdi
jne 0x14000e070
mov edx, 1
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.Snaffler_ruylopez.exe_get_library_address__76oader_334.part.0
movzx eax, word [rdx + 2]
add rdx, 2
test ax, ax
jne 0x14000e080
jmp 0x14000e0a0
movzx eax, word [rdx + 2]
add rdx, 2
test ax, ax
jne 0x14000e0b0
jmp 0x14000e0d0
mov rax, qword [rdi + 0x20]
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x140012bf0
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x28
mov rbx, qword [fcn.14001d730]
mov r12, qword [rcx]
mov ecx, 1
call rbx
mov rcx, rax
mov rdx, r12
call fcn.140012af0
mov ecx, 1
call rbx
mov r8d, 1
mov edx, 1
lea rcx, [0x14009efb2]
mov r9, rax
call sub.msvcrt.dll_fwrite
mov ecx, 1
call rbx
mov rcx, rax
add rsp, 0x28
pop rbx
pop r12
jmp fcn.14001d018
Function at 0x1400165e0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call fcn.14001d730
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call fcn.14001d730
mov r8, rbx
mov rdx, qword [rbp + 0x20]
mov rcx, rax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop

Function at 0x140017212
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x1400bd3a8]
test eax, eax
je 0x1400172aa
lea rax, [0x1400bd380]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x1400bd3b0]
mov qword [rbp - 8], rax
jmp 0x14001728e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x140017282
cmp qword [rbp - 0x10], 0
je 0x140017282
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140017248
lea rax, [0x1400bd380]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x1400172ab
nop
add rsp, 0x30
pop rbp
ret

Function at 0x1400173b0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400173d8
mov eax, 0
jmp 0x140017426
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140017401
mov eax, 0
jmp 0x140017426
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x140017421
mov eax, 0
jmp 0x140017426
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x14001742c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x1400174aa
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x1400174a1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x1400174a1
mov rax, qword [rbp - 8]
jmp 0x1400174bf
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x140017474
mov eax, 0
add rsp, 0x20
pop rbp
ret