joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140029820
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r13
push r14
sub rsp, 0x50
mov edi, r8d
mov r13, rdx
mov r14, rcx
call fcn.140020af0
xor ebx, ebx
cmp qword [0x140043e18], rbx
mov rbp, rax
mov dword [rsp + 0x98], ebx
mov dword [rsp + 0x30], ebx
jne 0x14002994c
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rsi, rax
je 0x140029a5f
lea rdx, [0x140034550]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140029a5f
mov rcx, rax
call fcn.140020a20
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x140043e18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.140020a20
lea rdx, [0x140034528]
mov rcx, rsi
mov qword [0x140043e20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.140020a20
lea rcx, [rsp + 0x98]
mov qword [0x140043e28], rax
call fcn.14001c9d0
test eax, eax
je 0x1400298ff
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.14001c460
cmp dword [rsp + 0x98], 2
jne 0x14002994c
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.140020a20
test rax, rax
mov qword [0x140043e38], rax
je 0x14002994c
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.140020a20
mov qword [0x140043e30], rax
mov rcx, qword [0x140043e30]
mov qword [rsp + 0x80], r12
cmp rcx, rbp
je 0x1400299f8
cmp qword [0x140043e38], rbp
je 0x1400299f8
call fcn.140020be0
mov rcx, qword [0x140043e38]
mov rsi, rax
call fcn.140020be0
test rsi, rsi
mov r12, rax
je 0x1400299f8
test rax, rax
je 0x1400299f8
call rsi
test rax, rax
je 0x1400299c3
lea rcx, [rsp + 0x34]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x1400299c3
test byte [rsp + 0x40], 1
jne 0x1400299f8
lea rcx, [rsp + 0x30]
call fcn.14001ca20
test eax, eax
je 0x1400299e5
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.14001c460
cmp dword [rsp + 0x30], 4
jb 0x1400299f2
bts edi, 0x15
jmp 0x140029a36
bts edi, 0x12
jmp 0x140029a36
mov rcx, qword [0x140043e20]
cmp rcx, rbp
je 0x140029a36
call fcn.140020be0
test rax, rax
je 0x140029a36
call rax
test rax, rax
mov rbx, rax
je 0x140029a36
mov rcx, qword [0x140043e28]
cmp rcx, rbp
je 0x140029a36
call fcn.140020be0
test rax, rax
je 0x140029a36
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140043e18]
call fcn.140020be0
mov r12, qword [rsp + 0x80]
test rax, rax
je 0x140029a5f
mov r9d, edi
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x140029a61
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop r14
pop r13
pop rdi
pop rsi
pop rbp
ret
Function at 0x14002c470
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x38
mov rax, qword [0x14003dc18]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x20]
mov r9d, 6
mov edx, 0x1004
mov byte [rsp + 0x26], 0
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x14002c4b7
or eax, 0xffffffff
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14001c740
add rsp, 0x38
ret
lea rcx, [rsp + 0x20]
call fcn.14001ed30
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14001c740
add rsp, 0x38
ret

Function at 0x14002fd5c
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x14003dc18]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x28]
add rcx, r8
call fcn.14001e4d0
and qword [rbx + 0x50], 0
and dword [rbx + 0x58], 0
and dword [rbx + 0x5c], 0
lea rax, [0x14000b000]
mov esi, 0x94
lea rcx, [rsp + 0x20]
mov r8, rsi
xor edx, edx
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rax
mov dword [rbx], 0x60
mov byte [rbx + 0x18], 0
call fcn.14001e4d0
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x30], 2
mov esi, 1
jne 0x14002fdef
cmp dword [rsp + 0x24], 5
jb 0x14002fe09
jmp 0x14002fe05
cmp dword [rsp + 0x30], esi
jne 0x14002fe09
cmp dword [rsp + 0x24], 4
ja 0x14002fe05
jne 0x14002fe09
cmp dword [rsp + 0x28], 0
jbe 0x14002fe09
mov byte [rbx + 0x18], sil
lea rax, [0x140035928]
lea rcx, [rbx + 0x28]
mov dword [rbx + 0x1c], 0x800
mov qword [rbx + 0x20], rax
call fcn.14002fc1c
movzx ecx, byte [0x140045260]
test eax, eax
mov rax, rbx
cmovs ecx, esi
mov byte [0x140045260], cl
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14001c740
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x141253000
Capabilities:
Decompress data using aplib

Disassembly:
jmp 0x14125300a
jmp 0x14125500f
jmp fcn.140bc9058
Function at 0x140041c50
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x140041c5d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x140041c6d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140041c55
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x140041c85
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140041c72
sub eax, 3
jb 0x140041c9f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140041cd6
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x140041cc6
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140041cc4
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140041cb3
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.140041c12
jmp 0x140041c5d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x7400
mov dl, 5
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140041d22
cmp rsi, rcx
jae 0x140041d2a
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140041d09
cmp al, 0x8f
ja 0x140041d09
cmp byte [rsi - 2], 0xf
je 0x140041d0f
sub al, 0xe8
cmp al, 1
ja 0x140041cf3
cmp rsi, rcx
jae 0x140041d2a
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140041cf9
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x140041d2a
lodsb al, byte [rsi]
jmp 0x140041d09
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x3f000]
mov eax, dword [rdi]
or eax, eax
je 0x140041d87
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x414ec]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140041d37
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140041d81
mov qword [rbx], rax
add rbx, 8
jmp 0x140041d57
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140041dc1
cmp al, 0xef
ja 0x140041db3
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140041d93
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x140041da2
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.140041e40], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.140041e40
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140041e30
sub rsp, 0xffffffffffffff80
jmp 0x1400013f0
Function at 0x180026660
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x1800881a0]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x10], 0
jne 0x1800266a1
xor eax, eax
jmp 0x180026826
mov dword [rsp + 0x24], 0
mov rcx, qword [rsp + 0x88]
call fcn.180024e70
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x80]
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov edx, 1
lea rcx, [rsp + 0x50]
call fcn.180005f00
lea rcx, [rsp + 0x50]
call fcn.18001b3b0
nop
xor eax, eax
cmp eax, 1
je 0x180026810
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x28]
call fcn.180024ef0
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x1800267b7
mov r8, 0xffffffffffffffff
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x50]
call fcn.180020e30
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x90]
call fcn.180023610
mov dword [rsp + 0x38], 1
mov eax, dword [rsp + 0x38]
cdq
sub eax, edx
sar eax, 1
cmp eax, 0x32
jle 0x18002676a
xor r9d, r9d
lea r8, [0x18006ed7c]
lea rdx, [0x18006ed84]
xor ecx, ecx
call qword [0x18006a508]
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
mov eax, 8
mov word [rsp + 0x20], ax
movsx rax, word [rsp + 0x20]
lea rcx, [0x180087a10]
cmp dword [rcx + rax*4], 1
jne 0x1800267b3
movsx rax, word [rsp + 0x20]
lea rcx, [0x180087a10]
mov eax, dword [rcx + rax*4]
inc eax
movsx rcx, word [rsp + 0x20]
lea rdx, [0x180087a10]
mov dword [rdx + rcx*4], eax
jmp 0x180026810
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov r8, rax
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x50]
call fcn.180020e30
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x90]
call fcn.180023610
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
lea rax, [rax + rcx*2]
mov qword [rsp + 0x28], rax
jmp 0x1800266e5
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x3c], eax
lea rcx, [rsp + 0x50]
call fcn.180010e70
mov eax, dword [rsp + 0x3c]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.18004d860
add rsp, 0x78
ret
Function at 0x1800444d0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x98
xor r9d, r9d
mov r8, qword [rsp + 0xa8]
mov edx, 1
lea rcx, [rsp + 0x30]
call fcn.18004be20
mov dword [rsp + 0x20], 0xffffffff
lea rcx, [rsp + 0x30]
call fcn.18004c350
test rax, rax
je 0x18004459e
mov dword [rsp + 0x28], 1
mov eax, dword [rsp + 0x28]
cdq
sub eax, edx
sar eax, 1
cmp eax, 0x32
jle 0x180044545
xor r9d, r9d
lea r8, [0x180077558]
lea rdx, [0x180077560]
xor ecx, ecx
call qword [0x18006a508]
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.180044f30
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x24], 8
jmp 0x180044571
mov eax, dword [rsp + 0x24]
dec eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
je 0x180044599
mov eax, dword [rsp + 0x20]
shr eax, 1
mov ecx, dword [rsp + 0x20]
and ecx, 1
xor edx, edx
sub edx, ecx
mov ecx, edx
and ecx, 0xedb88320
xor eax, ecx
mov dword [rsp + 0x20], eax
jmp 0x180044567
jmp 0x180044503
mov eax, dword [rsp + 0x20]
not eax
mov rcx, qword [rsp + 0xa0]
mov dword [rcx], eax
xor eax, eax
add rsp, 0x98
ret
Function at 0x140001480
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x14006e7d0]
mov dword [rax], 1
mov rax, qword [0x14006e7e0]
mov dword [rax], 1
mov rax, qword [0x14006e7f0]
mov dword [rax], 1
mov rax, qword [0x14006e7c0]
mov dword [rax], 1
mov rax, qword [0x14006e650]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400014de
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x14000150a
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x140001530
cmp eax, 0x20b
je 0x140001557
jmp 0x140001586
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x140001543
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x14000158b
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x140001572
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x14000158b
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140006504
Capabilities:
Read file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
call sym.nimErrorFlag_4
mov qword [rbp - 8], rax
mov qword [rbp - 0x10], 0
mov rdx, qword [rbp + 0x20]
mov rax, qword [rbp + 0x18]
mov r9, qword [rbp + 0x10]
mov r8, rdx
mov edx, 1
mov rcx, rax
call sym.fread
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
cmp rax, qword [rbp + 0x20]
je 0x140006572
mov rcx, qword [rbp + 0x10]
call sym.checkErr__stdZsyncio_u165
mov rax, qword [rbp - 8]
movzx eax, byte [rax]
movzx eax, al
test eax, eax
jmp 0x140006573
nop
mov rax, qword [rbp - 0x18]
add rsp, 0x40
pop rbp
ret

Function at 0x140007df1
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
call sym.nimErrorFlag_4
mov qword [rbp - 8], rax
mov qword [rbp - 0x10], 0
mov rdx, qword [rbp + 0x20]
mov rax, qword [rbp + 0x18]
mov r9, qword [rbp + 0x10]
mov r8, rdx
mov edx, 1
mov rcx, rax
call sym.fwrite
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov qword [rbp - 0x18], rax
mov rcx, qword [rbp + 0x10]
call sym.checkErr__stdZsyncio_u165
mov rax, qword [rbp - 8]
movzx eax, byte [rax]
movzx eax, al
test eax, eax
nop
mov rax, qword [rbp - 0x18]
add rsp, 0x40
pop rbp
ret
Function at 0x1400094d5
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp - 8], 0
cmp qword [rbp + 0x18], 0
je 0x140009505
mov rax, qword [rbp + 0x18]
mov rcx, rax
call sym.nimCStrLen_1
mov rdx, rax
jmp 0x14000950a
mov edx, 0
mov rax, qword [rbp + 0x18]
mov r9, qword [rbp + 0x10]
mov r8, rdx
mov edx, 1
mov rcx, rax
call sym.fwrite
mov qword [rbp - 8], rax
mov dword [rbp - 0xc], 0
mov rcx, qword [rbp + 0x10]
call sym.fflush
mov dword [rbp - 0xc], eax
nop
add rsp, 0x30
pop rbp
ret
Function at 0x140013ca7
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xa0
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
lea rax, str.echoBinSafe
mov qword [rbp - 0x58], rax
lea rax, [0x1400672c8]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], 0
mov word [rbp - 0x40], 0
lea rax, [rbp - 0x60]
mov rcx, rax
call sym.nimFrame_6
call sym.nimErrorFlag_5
mov qword [rbp - 0x10], rax
mov qword [rbp - 0x50], 0xac5
lea rax, [0x14007a120]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov qword [rbp - 0x18], 0
mov qword [rbp - 0x50], 0xd
lea rax, [0x140067a10]
mov qword [rbp - 0x48], rax
mov qword [rbp - 8], 0
mov qword [rbp - 0x50], 0xe
mov rax, qword [rbp - 8]
cmp rax, qword [rbp + 0x18]
jge 0x140013e34
mov qword [rbp - 0x50], 0xac6
lea rax, [0x1400672c8]
mov qword [rbp - 0x48], rax
cmp qword [rbp - 8], 0
js 0x140013d6b
mov rax, qword [rbp - 8]
cmp rax, qword [rbp + 0x18]
jl 0x140013d84
mov rax, qword [rbp + 0x18]
lea rdx, [rax - 1]
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.raiseIndexError2
jmp 0x140013ec5
mov rax, qword [rbp - 8]
shl rax, 4
mov rdx, rax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov ecx, 1
mov rax, qword [sym.__acrt_iob_func]
call rax
mov rcx, rax
mov rax, qword [rbp - 0x18]
mov rdx, qword [rax + 8]
mov rax, qword [rax]
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rdx
lea rax, [rbp - 0x80]
mov r8d, 0
mov rdx, rax
call sym.writeWindows__system_u9111
mov rax, qword [rbp - 0x10]
movzx eax, byte [rax]
movzx eax, al
test eax, eax
jne 0x140013ec4
mov qword [rbp - 0x50], 0x10
lea rax, [0x140067a10]
mov qword [rbp - 0x48], rax
mov edx, 0
mov rax, qword [rbp - 8]
add rax, 1
jno 0x140013e09
mov edx, 1
mov rcx, rax
lea rax, [rbp - 0x68]
mov qword [rax], rcx
mov rax, rdx
and eax, 1
test al, al
je 0x140013e27
call sym.raiseOverflow
jmp 0x140013ec5
mov rax, qword [rbp - 0x68]
mov qword [rbp - 8], rax
jmp 0x140013d39
nop
mov qword [rbp - 0x50], 0xae1
lea rax, [0x1400672c8]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x20], 0
mov ecx, 1
mov rax, qword [sym.__acrt_iob_func]
call rax
mov r9, rax
mov r8d, 1
mov edx, 1
lea rax, [0x1400679a9]
mov rcx, rax
call sym.fwrite
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x50], 0xae2
mov dword [rbp - 0x24], 0
mov ecx, 1
mov rax, qword [sym.__acrt_iob_func]
call rax
mov rcx, rax
call sym.fflush
mov dword [rbp - 0x24], eax
mov qword [rbp - 0x50], 0xae6
lea rax, [0x14007a120]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x140013ec5
nop
call sym.popFrame_6
nop
add rsp, 0xa0
pop rbp
ret
Function at 0x1400205bb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push rbx
sub rsp, 0xb8
lea rbp, [rsp + 0xb0]
mov rbx, rcx
mov rcx, qword [rbx]
mov rbx, qword [rbx + 8]
mov qword [rbp - 0x80], rcx
mov qword [rbp - 0x78], rbx
mov rbx, rdx
mov rax, qword [rbx]
mov rdx, qword [rbx + 8]
mov qword [rbp - 0x90], rax
mov qword [rbp - 0x88], rdx
lea rax, str.startsWith
mov qword [rbp - 0x58], rax
lea rax, [0x1400681b8]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], 0
mov word [rbp - 0x40], 0
lea rax, [rbp - 0x60]
mov rcx, rax
call sym.nimFrame_11
mov byte [rbp - 1], 0
mov qword [rbp - 0x50], 0x38
lea rax, str.C:Program_Files_nim_2.0.2lib_stdprivate_strimpl.nim
mov qword [rbp - 0x48], rax
mov rax, qword [rbp - 0x90]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x50], 0x39
mov rax, qword [rbp - 0x80]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x50], 0x3a
mov qword [rbp - 0x10], 0
mov qword [rbp - 0x50], 0x658
lea rax, [0x1400681b8]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], 0x3c
lea rax, str.C:Program_Files_nim_2.0.2lib_stdprivate_strimpl.nim
mov qword [rbp - 0x48], rax
mov rax, qword [rbp - 0x20]
cmp rax, qword [rbp - 0x10]
jg 0x1400206c7
mov qword [rbp - 0x50], 0x64b
lea rax, [0x1400681b8]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], 0x3c
lea rax, str.C:Program_Files_nim_2.0.2lib_stdprivate_strimpl.nim
mov qword [rbp - 0x48], rax
mov byte [rbp - 1], 1
jmp 0x1400207f4
nop
mov qword [rbp - 0x50], 0x3d
mov byte [rbp - 0x11], 0
mov rax, qword [rbp - 0x28]
cmp rax, qword [rbp - 0x10]
setle al
mov byte [rbp - 0x11], al
cmp byte [rbp - 0x11], 0
jne 0x140020777
cmp qword [rbp - 0x10], 0
js 0x1400206fd
mov rax, qword [rbp - 0x80]
cmp qword [rbp - 0x10], rax
jl 0x140020716
mov rax, qword [rbp - 0x80]
lea rdx, [rax - 1]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.raiseIndexError2
jmp 0x1400207f4
cmp qword [rbp - 0x10], 0
js 0x14002072a
mov rax, qword [rbp - 0x90]
cmp qword [rbp - 0x10], rax
jl 0x140020746
mov rax, qword [rbp - 0x90]
lea rdx, [rax - 1]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.raiseIndexError2
jmp 0x1400207f4
mov rdx, qword [rbp - 0x78]
mov rax, qword [rbp - 0x10]
add rax, rdx
add rax, 8
movzx edx, byte [rax]
mov rcx, qword [rbp - 0x88]
mov rax, qword [rbp - 0x10]
add rax, rcx
add rax, 8
movzx eax, byte [rax]
cmp dl, al
setne al
mov byte [rbp - 0x11], al
jmp 0x140020778
nop
movzx eax, byte [rbp - 0x11]
xor eax, 1
test al, al
jne 0x1400207af
mov qword [rbp - 0x50], 0x64b
lea rax, [0x1400681b8]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], 0x3d
lea rax, str.C:Program_Files_nim_2.0.2lib_stdprivate_strimpl.nim
mov qword [rbp - 0x48], rax
mov byte [rbp - 1], 0
jmp 0x1400207f4
nop
mov qword [rbp - 0x50], 0x3e
mov edx, 0
mov rax, qword [rbp - 0x10]
add rax, 1
jno 0x1400207cc
mov edx, 1
mov rcx, rax
lea rax, [rbp - 0x68]
mov qword [rax], rcx
mov rax, rdx
and eax, 1
test al, al
je 0x1400207e7
call sym.raiseOverflow
jmp 0x1400207f4
mov rax, qword [rbp - 0x68]
mov qword [rbp - 0x10], rax
jmp 0x14002067b
call sym.popFrame_11
movzx eax, byte [rbp - 1]
add rsp, 0xb8
pop rbx
pop rbp
ret
Function at 0x140051920
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov r8, rbx
mov rdx, qword [rbp + 0x20]
mov rcx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x140052552
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x14007a8c8]
test eax, eax
je 0x1400525ea
lea rax, [0x14007a8a0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x14007a8d0]
mov qword [rbp - 8], rax
jmp 0x1400525ce
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x1400525c2
cmp qword [rbp - 0x10], 0
je 0x1400525c2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140052588
lea rax, [0x14007a8a0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x1400525eb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x1400526f0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x140052718
mov eax, 0
jmp 0x140052766
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140052741
mov eax, 0
jmp 0x140052766
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x140052761
mov eax, 0
jmp 0x140052766
mov eax, 1
add rsp, 0x20
pop rbp
ret