joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401536
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x28
xor rbx, rbx
mov r8, qword gs:[rbx + 0x60]
mov r8, qword [r8 + 0x18]
lea r12, [r8 + 0x10]
mov r8, qword [r12]
cld
mov rdi, qword [r8 + 0x60]
mov rsi, rcx
lodsb al, byte [rsi]
test al, al
je 0x401585
mov ah, byte [rdi]
cmp ah, 0x61
jl 0x401569
sub ah, 0x20
cmp ah, al
jne 0x401575
inc rdi
inc rdi
jmp 0x40155a
mov r8, qword [r8]
cmp r8, r12
jne 0x401553
xor rax, rax
jmp 0x40162c
mov rbx, qword [r8 + 0x30]
mov r9d, dword [rbx + 0x3c]
add r9, rbx
add r9, 0x88
mov r13d, dword [r9]
test r13, r13
jne 0x4015a7
xor rax, rax
jmp 0x40162c
lea r8, [rbx + r13]
mov r14d, dword [r9 + 4]
add r14, r13
mov ecx, dword [r8 + 0x18]
mov r10d, dword [r8 + 0x20]
add r10, rbx
dec ecx
lea r9, [r10 + rcx*4]
mov edi, dword [r9]
add rdi, rbx
mov rsi, rdx
cmpsb byte [rsi], byte [rdi]
jne 0x4015d7
mov al, byte [rdi]
test al, al
je 0x4015de
jmp 0x4015cc
loop 0x4015bf
xor rax, rax
jmp 0x40162c
mov r9d, dword [r8 + 0x24]
add r9, rbx
mov cx, word [r9 + rcx*2]
mov r9d, dword [r8 + 0x1c]
add r9, rbx
mov eax, dword [r9 + rcx*4]
cmp rax, r13
jl 0x401629
cmp rax, r14
jae 0x401629
lea rsi, [rax + rbx]
lea rdi, [rsp + 0x30]
mov r12, rdi
movsb byte [rdi], byte [rsi]
cmp byte [rsi], 0x2e
jne 0x40160b
movsb byte [rdi], byte [rsi]
mov dword [rdi], 0x4c4c44
mov rcx, r12
call r15
mov rcx, r12
mov rdx, rsi
jmp 0x40153e
add rax, rbx
add rsp, 0x28
leave
ret
Function at 0x140001810
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000185a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000185a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000185a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000185a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000185a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000185c
xor al, al
add rsp, 0x28
ret

Function at 0x140007c80
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140007a7c
Function at 0x14000cfc8
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14000cff8
xor eax, eax
jmp 0x14000d0bb
mov rbp, rbx
cmp word [rax], si
je 0x14000d01d
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14000d004
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14000d000
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14000cee8
movsxd r14, eax
test eax, eax
jne 0x14000d05b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14000cff1
mov rcx, r14
call fcn.14000977c
mov rdi, rax
test rax, rax
jne 0x14000d074
xor ecx, ecx
call fcn.140008b04
jmp 0x14000d050
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14000cee8
test eax, eax
jne 0x14000d0a5
mov rcx, rdi
call fcn.140008b04
jmp 0x14000d0af
xor ecx, ecx
call fcn.140008b04
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x1400113dc
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x1400113f2
mov al, 1
jmp 0x140011452
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x140011403
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140011450
mov ecx, dword [rcx + 0x18]
nop
call fcn.14000d8e8
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140011450
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140011450
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140011450
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x140011452
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x140012490
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.14000bfb8
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14001251a
cmp byte [rbp - 0x21], r15b
je 0x140012515
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x140012550
call fcn.140008d54
test eax, eax
jne 0x14001253c
cmp byte [rbp - 0x21], r15b
je 0x140012534
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x140012550
cmp byte [rbp - 0x21], r15b
je 0x14001254d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14000b598
test eax, eax
jne 0x1400125f0
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.14000bfb8
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14001258f
cmp byte [rbp - 0x21], r15b
je 0x1400125c4
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x1400125c4
call fcn.140008d54
test eax, eax
jne 0x1400125b0
cmp byte [rbp - 0x21], r15b
je 0x1400125a9
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x1400125c4
cmp byte [rbp - 0x21], r15b
je 0x1400125c1
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14000b598
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x1400125f0
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x1400125f3
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x140012601
mov rcx, rdi
call fcn.140008b04
cmp byte [rbp + 0x3f], r15b
je 0x140012610
mov rcx, qword [rbp + 0x27]
call fcn.140008b04
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x140014b80
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140014ba8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140014ba8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140011208
Capabilities:
Terminate process

Disassembly:
jmp 0x1400133e0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011294
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014730
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014750
xor al, al
jmp 0x1400147d1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014763
xor al, al
jmp 0x1400147d1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001478d
xor al, al
jmp 0x1400147d1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400147a1
xor al, al
jmp 0x1400147d1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400147b3
xor al, al
jmp 0x1400147d1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400147cf
xor al, al
jmp 0x1400147d1
mov al, 1
add rsp, 0x38
ret
Function at 0x1400011a0
Capabilities:
Shutdown system

Disassembly:
sub rsp, 0x68
mov rax, qword [0x14000a298]
xor rax, rsp
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14000122e
lea r8, [rsp + 0x38]
xor ecx, ecx
lea rdx, str.SeShutdownPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x30]
test eax, eax
je 0x140001228
mov rax, qword [rsp + 0x38]
lea r8, [rsp + 0x40]
and qword [rsp + 0x28], 0
xor r9d, r9d
and qword [rsp + 0x20], 0
xor edx, edx
mov qword [rsp + 0x44], rax
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x4c], 2
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x28], 0x80010002
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 1
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownExW]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140006900
add rsp, 0x68
ret

Function at 0x1400016b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rbp, rcx
mov rsi, rdx
mov ecx, 0x2004
call fcn.14000657c
xor r14d, r14d
mov rdi, rax
test rax, rax
je 0x14000178a
mov dword [rsp + 0x60], 0x2000
jmp 0x14000173b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x140001782
cmp dword [rsp + 0x68], 7
jne 0x140001782
mov ebx, dword [rsp + 0x60]
mov rcx, rdi
call fcn.1400065bc
mov ecx, ebx
mov eax, 2
shr rcx, 1
add rcx, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.14000657c
mov rdi, rax
test rax, rax
je 0x14000178a
lea rax, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x68]
mov rdx, rsi
mov qword [rsp + 0x20], rdi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400016eb
mov ecx, dword [rsp + 0x60]
shr ecx, 1
lea eax, [rcx + 1]
mov word [rdi + rcx*2], r14w
mov rcx, rdi
mov word [rdi + rax*2], r14w
call fcn.140001384
test rax, rax
jne 0x14000178c
mov rcx, rdi
call fcn.1400065bc
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x140004f40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x260
mov rax, qword [0x14000a298]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rax, qword [rsp + 0x290]
xor r14d, r14d
mov dword [rsp + 0x30], r14d
mov ebx, 2
test rdx, rdx
jne 0x140005084
cmp r9d, ebx
jl 0x140005084
mov rcx, qword [rax]
cmp word [rcx], r14w
je 0x140005084
mov rsi, qword [rax + 8]
cmp word [rsi], r14w
je 0x140005084
xor r9d, r9d
lea r8, [rsp + 0x40]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
dec eax
cmp eax, 0x102
ja 0x140005080
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140005080
lea rcx, str.newdev.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
test rax, rax
je 0x140005080
lea rdx, str.UpdateDriverForPlugAndPlayDevicesW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbp, rax
test rax, rax
je 0x140005077
lea ecx, [rbx - 1]
call fcn.140006e28
mov rcx, rax
lea r9, [rsp + 0x40]
mov r8, rsi
mov edx, 0xeeae
call fcn.140001090
lea rax, [rsp + 0x30]
mov rdx, rsi
mov qword [rsp + 0x20], rax
lea r9d, [rbx - 1]
mov rax, rbp
lea r8, [rsp + 0x40]
xor ecx, ecx
call qword [vtable._SH_.0]
test eax, eax
je 0x140005077
lea ecx, [rbx - 1]
call fcn.140006e28
mov rcx, rax
mov edx, 0xeeb2
call fcn.140001090
cmp dword [rsp + 0x30], r14d
mov ebx, r14d
setne bl
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
jmp 0x140005089
mov eax, 3
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140006900
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x140006700
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x14000a870], rbx
je 0x14000674c
cmp rax, rbx
jne 0x14000673f
mov ebx, 1
mov esi, ebx
jmp 0x140006751
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140006724
mov ebx, 1
mov eax, dword [0x14000a878]
cmp eax, ebx
jne 0x140006767
mov ecx, 0x1f
call fcn.1400a4000
jmp 0x1400067cc
mov eax, dword [0x14000a878]
test eax, eax
jne 0x1400067c6
mov dword [0x14000a878], ebx
lea r15, [0x140007540]
lea rdi, [0x140007528]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x1400067b8
test eax, eax
jne 0x1400067bc
cmp qword [rdi], 0
je 0x1400067ad
mov rax, qword [rdi]
mov rcx, qword [vtable._SH_.0]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x14000678e
test eax, eax
je 0x1400067cc
mov eax, 0xff
jmp 0x1400068a8
mov dword [0x14000a2b4], ebx
mov eax, dword [0x14000a878]
cmp eax, ebx
jne 0x1400067f3
lea rdx, [0x140007520]
lea rcx, [0x140007510]
call sub.msvcrt.dll__initterm
mov dword [0x14000a878], 2
test esi, esi
jne 0x140006800
xor eax, eax
xchg qword [0x14000a870], rax
cmp qword [0x14000a880], 0
je 0x140006834
lea rcx, [0x14000a880]
call fcn.140006c80
test eax, eax
je 0x140006834
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x14000a880]
mov r9, qword [vtable._SH_.0]
call r9
mov r8, qword [0x14000a2c8]
mov rdx, qword [0x14000a2c0]
mov ecx, dword [0x14000a2b8]
call fcn.140001ec0
mov dword [0x14000a2b0], eax
cmp dword [0x14000a2d0], 0
jne 0x140006864
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14000a2b4], 0
jne 0x140006879
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14000a2b0]
jmp 0x1400068a8
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.140006d14
add rsp, 0x28
jmp 0x140006700

Function at 0x140006b6c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140006bb8
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140006bb0
cmp dword [rcx + 0x3c], edx
jl 0x140006bb0
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140006bb0
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140006bb8
mov rax, rdx
add rsp, 0x18
ret
Function at 0x140001480
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x1400ce350]
mov dword [rax], 1
mov rax, qword [0x1400ce360]
mov dword [rax], 1
mov rax, qword [0x1400ce370]
mov dword [rax], 1
mov rax, qword [0x1400ce340]
mov dword [rax], 1
mov rax, qword [0x1400ce1e0]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400014de
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x14000150a
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x140001530
cmp eax, 0x20b
je 0x140001557
jmp 0x140001586
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x140001543
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x14000158b
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x140001572
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x14000158b
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140007e6e
Capabilities:
Read file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
call sym.nimErrorFlag_6
mov qword [rbp - 8], rax
mov qword [rbp - 0x10], 0
mov rdx, qword [rbp + 0x20]
mov rax, qword [rbp + 0x18]
mov r9, qword [rbp + 0x10]
mov r8, rdx
mov edx, 1
mov rcx, rax
call sym.fread
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
cmp rax, qword [rbp + 0x20]
je 0x140007edc
mov rcx, qword [rbp + 0x10]
call sym.checkErr__stdZsyncio_u165
mov rax, qword [rbp - 8]
movzx eax, byte [rax]
movzx eax, al
test eax, eax
jmp 0x140007edd
nop
mov rax, qword [rbp - 0x18]
add rsp, 0x40
pop rbp
ret

Function at 0x140009376
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp - 8], 0
cmp qword [rbp + 0x18], 0
je 0x1400093a6
mov rax, qword [rbp + 0x18]
mov rcx, rax
call sym.nimCStrLen_1
mov rdx, rax
jmp 0x1400093ab
mov edx, 0
mov rax, qword [rbp + 0x18]
mov r9, qword [rbp + 0x10]
mov r8, rdx
mov edx, 1
mov rcx, rax
call sym.fwrite
mov qword [rbp - 8], rax
mov dword [rbp - 0xc], 0
mov rcx, qword [rbp + 0x10]
call sym.fflush
mov dword [rbp - 0xc], eax
nop
add rsp, 0x30
pop rbp
ret
Function at 0x140013464
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp - 8], 0
mov rdx, qword [rbp + 0x20]
mov rax, qword [rbp + 0x18]
mov r9, qword [rbp + 0x10]
mov r8, rdx
mov edx, 1
mov rcx, rax
call sym.fwrite
mov qword [rbp - 8], rax
mov dword [rbp - 0xc], 0
mov rcx, qword [rbp + 0x10]
call sym.fflush
mov dword [rbp - 0xc], eax
nop
add rsp, 0x30
pop rbp
ret

Function at 0x140016b8a
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x90
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
lea rax, str.echoBinSafe
mov qword [rbp - 0x58], rax
lea rax, [0x1400b4b58]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], 0
mov word [rbp - 0x40], 0
lea rax, [rbp - 0x60]
mov rcx, rax
call sym.nimFrame_7
call sym.nimErrorFlag_7
mov qword [rbp - 0x10], rax
mov qword [rbp - 0x50], 0xb24
lea rax, [0x1400dd180]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov qword [rbp - 0x18], 0
mov qword [rbp - 0x50], 0x12
lea rax, [0x1400b52e8]
mov qword [rbp - 0x48], rax
mov qword [rbp - 8], 0
mov qword [rbp - 0x50], 0x13
mov rax, qword [rbp - 8]
cmp rax, qword [rbp + 0x18]
jge 0x140016ce2
mov qword [rbp - 0x50], 0xb25
lea rax, [0x1400b4b58]
mov qword [rbp - 0x48], rax
cmp qword [rbp - 8], 0
js 0x140016c4e
mov rax, qword [rbp - 8]
cmp rax, qword [rbp + 0x18]
jl 0x140016c67
mov rax, qword [rbp + 0x18]
lea rdx, [rax - 1]
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.raiseIndexError2
jmp 0x140016d73
mov rax, qword [rbp - 8]
shl rax, 4
mov rdx, rax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov ecx, 1
mov rax, qword [sym.__acrt_iob_func]
call rax
mov rcx, rax
mov rax, qword [rbp - 0x18]
mov rdx, qword [rax + 8]
mov rax, qword [rax]
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rdx
lea rax, [rbp - 0x70]
mov r8d, 0
mov rdx, rax
call sym.writeWindows__system_u9016
mov rax, qword [rbp - 0x10]
movzx eax, byte [rax]
movzx eax, al
test eax, eax
jne 0x140016d72
mov qword [rbp - 0x50], 0xd
lea rax, [0x1400b52e8]
mov qword [rbp - 0x48], rax
add qword [rbp - 8], 1
jmp 0x140016c1c
nop
mov qword [rbp - 0x50], 0xb40
lea rax, [0x1400b4b58]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x20], 0
mov ecx, 1
mov rax, qword [sym.__acrt_iob_func]
call rax
mov r9, rax
mov r8d, 1
mov edx, 1
lea rax, [0x1400b4b49]
mov rcx, rax
call sym.fwrite
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x50], 0xb41
mov dword [rbp - 0x24], 0
mov ecx, 1
mov rax, qword [sym.__acrt_iob_func]
call rax
mov rcx, rax
call sym.fflush
mov dword [rbp - 0x24], eax
mov qword [rbp - 0x50], 0xb45
lea rax, [0x1400dd180]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x140016d73
nop
call sym.popFrame_7
nop
add rsp, 0x90
pop rbp
ret
Function at 0x14001d79c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push rbx
sub rsp, 0xb8
lea rbp, [rsp + 0xb0]
mov rbx, rcx
mov rcx, qword [rbx]
mov rbx, qword [rbx + 8]
mov qword [rbp - 0x80], rcx
mov qword [rbp - 0x78], rbx
mov rbx, rdx
mov rax, qword [rbx]
mov rdx, qword [rbx + 8]
mov qword [rbp - 0x90], rax
mov qword [rbp - 0x88], rdx
lea rax, str.startsWith
mov qword [rbp - 0x58], rax
lea rax, [0x1400bd048]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], 0
mov word [rbp - 0x40], 0
lea rax, [rbp - 0x60]
mov rcx, rax
call sym.nimFrame_11
mov byte [rbp - 1], 0
mov qword [rbp - 0x50], 0x38
lea rax, str.D:_a_nightlies_nightlies_nim_2.1.1lib_stdprivate_strimpl.nim
mov qword [rbp - 0x48], rax
mov rax, qword [rbp - 0x90]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x50], 0x39
mov rax, qword [rbp - 0x80]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x50], 0x3a
mov qword [rbp - 0x10], 0
mov qword [rbp - 0x50], 0x66e
lea rax, [0x1400bd048]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], 0x3c
lea rax, str.D:_a_nightlies_nightlies_nim_2.1.1lib_stdprivate_strimpl.nim
mov qword [rbp - 0x48], rax
mov rax, qword [rbp - 0x20]
cmp rax, qword [rbp - 0x10]
jg 0x14001d8a8
mov qword [rbp - 0x50], 0x661
lea rax, [0x1400bd048]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], 0x3c
lea rax, str.D:_a_nightlies_nightlies_nim_2.1.1lib_stdprivate_strimpl.nim
mov qword [rbp - 0x48], rax
mov byte [rbp - 1], 1
jmp 0x14001d9d5
nop
mov qword [rbp - 0x50], 0x3d
mov byte [rbp - 0x11], 0
mov rax, qword [rbp - 0x28]
cmp rax, qword [rbp - 0x10]
setle al
mov byte [rbp - 0x11], al
cmp byte [rbp - 0x11], 0
jne 0x14001d958
cmp qword [rbp - 0x10], 0
js 0x14001d8de
mov rax, qword [rbp - 0x80]
cmp qword [rbp - 0x10], rax
jl 0x14001d8f7
mov rax, qword [rbp - 0x80]
lea rdx, [rax - 1]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.raiseIndexError2
jmp 0x14001d9d5
cmp qword [rbp - 0x10], 0
js 0x14001d90b
mov rax, qword [rbp - 0x90]
cmp qword [rbp - 0x10], rax
jl 0x14001d927
mov rax, qword [rbp - 0x90]
lea rdx, [rax - 1]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.raiseIndexError2
jmp 0x14001d9d5
mov rdx, qword [rbp - 0x78]
mov rax, qword [rbp - 0x10]
add rax, rdx
add rax, 8
movzx edx, byte [rax]
mov rcx, qword [rbp - 0x88]
mov rax, qword [rbp - 0x10]
add rax, rcx
add rax, 8
movzx eax, byte [rax]
cmp dl, al
setne al
mov byte [rbp - 0x11], al
jmp 0x14001d959
nop
movzx eax, byte [rbp - 0x11]
xor eax, 1
test al, al
jne 0x14001d990
mov qword [rbp - 0x50], 0x661
lea rax, [0x1400bd048]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], 0x3d
lea rax, str.D:_a_nightlies_nightlies_nim_2.1.1lib_stdprivate_strimpl.nim
mov qword [rbp - 0x48], rax
mov byte [rbp - 1], 0
jmp 0x14001d9d5
nop
mov qword [rbp - 0x50], 0x3e
mov edx, 0
mov rax, qword [rbp - 0x10]
add rax, 1
jno 0x14001d9ad
mov edx, 1
mov rcx, rax
lea rax, [rbp - 0x68]
mov qword [rax], rcx
mov rax, rdx
and eax, 1
test al, al
je 0x14001d9c8
call sym.raiseOverflow
jmp 0x14001d9d5
mov rax, qword [rbp - 0x68]
mov qword [rbp - 0x10], rax
jmp 0x14001d85c
call sym.popFrame_11
movzx eax, byte [rbp - 1]
add rsp, 0xb8
pop rbx
pop rbp
ret