joyce8/EMBER2024-capa huggingface dataset:
Function at 0x12db3e0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x12db3ed
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x12db3fd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x12db3e5
lea eax, [rcx + 1]
jmp 0x12db40b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x12db41e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x12db404
sub eax, 3
jb 0x12db43e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x12db48d
sar eax, 1
movsxd rbp, eax
jb 0x12db474
jmp 0x12db44c
add ebx, ebx
jne 0x12db44a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x12db474
inc ecx
add ebx, ebx
jne 0x12db45a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x12db474
call r11
adc ecx, ecx
add ebx, ebx
jne 0x12db46d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x12db45c
add ecx, 2
jmp 0x12db479
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.012db3a2
jmp 0x12db3ed
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0xecc000]
mov eax, dword [rdi]
or eax, eax
je 0x12db4e9
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xedb000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x12db499
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x12db4e3
mov qword [rbx], rax
add rbx, 8
jmp 0x12db4b9
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x12db52d
cmp al, 0xef
ja 0x12db515
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x12db4f5
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x12db504
mov eax, dword [rdi]
add rdi, 4
jmp 0x12db504
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x12db581
sub rsp, 0xffffffffffffff80
jmp 0x459ee0
Function at 0x1400110ff
Capabilities:
Write file on windows

Disassembly:
jmp 0x14001e7a0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1400390f3]
call fcn.140011997
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x14001e7f7
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x14001e903
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x14001e89c
cmp qword [rbp + 0x28], 0
jle 0x14001e89c
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x14001e83c
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.14001190b
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rbp + 0x130], 0
jle 0x14001e8f2
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x14001e8f2
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x14001153c
Capabilities:
Terminate process

Disassembly:
jmp 0x140022550
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140011690
Capabilities:
Parse pe header

Disassembly:
jmp 0x140021910
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140021930
xor al, al
jmp 0x1400219b1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140021943
xor al, al
jmp 0x1400219b1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14002196d
xor al, al
jmp 0x1400219b1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140021981
xor al, al
jmp 0x1400219b1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140021993
xor al, al
jmp 0x1400219b1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400219af
xor al, al
jmp 0x1400219b1
mov al, 1
add rsp, 0x38
ret
Function at 0x14001197e
Capabilities:
Write file on windows

Disassembly:
jmp 0x14001a5c0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x2e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1c8]
mov rax, qword [0x140031040]
xor rax, rbp
mov qword [rbp + 0x168], rax
lea rcx, [0x1400390f3]
call fcn.140011997
mov rax, qword [rbp + 0x190]
cmp qword [rax + 0x68], 0
je 0x14001a626
mov rax, qword [rbp + 0x190]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14001a62d
mov al, 1
jmp 0x14001a77d
call fcn.1400112b2
mov rcx, qword [rbp + 0x190]
mov rcx, qword [rcx]
mov qword [rbp + 0x158], rcx
mov edx, eax
mov rcx, qword [rbp + 0x190]
mov rax, qword [rbp + 0x158]
call qword [rax + 0x18]
mov dword [rbp + 0x160], eax
call fcn.1400112b2
mov ecx, dword [rbp + 0x160]
mov edx, ecx
mov ecx, eax
call fcn.140011771
movzx eax, al
test eax, eax
je 0x14001a67e
xor al, al
jmp 0x14001a77d
mov qword [rbp + 8], 0x20
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x190]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rax, qword [rbp + 0x190]
mov rcx, qword [rax + 0x68]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x154], eax
cmp dword [rbp + 0x154], 0
je 0x14001a6e3
cmp dword [rbp + 0x154], 1
je 0x14001a6ee
cmp dword [rbp + 0x154], 3
je 0x14001a76c
jmp 0x14001a77b
mov rax, qword [rbp + 0x190]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x14001a73e
mov rax, qword [rbp + 0x190]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x14001a73e
xor al, al
jmp 0x14001a77d
mov rax, qword [rbp + 0x190]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14001a759
mov dword [rbp + 0x154], 1
jmp 0x14001a763
mov dword [rbp + 0x154], 0
movzx eax, byte [rbp + 0x154]
jmp 0x14001a77d
mov rax, qword [rbp + 0x190]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x14001a77d
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14002ab00]
call fcn.1400117df
mov rax, rdi
mov rcx, qword [rbp + 0x168]
xor rcx, rbp
call fcn.140011488
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x1404d5a80]
mov dword [rax], 1
mov rax, qword [0x1404d5a90]
mov dword [rax], 1
mov rax, qword [0x1404d5aa0]
mov dword [rax], 1
mov rax, qword [0x1404d5a00]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140440180
Capabilities:
Query environment variable

Disassembly:
push r14
mov eax, 0x10080
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.1404ab640
sub rsp, rax
xor eax, eax
xor edx, edx
xor esi, esi
mov r14d, 0x28
movzx edi, byte [rcx]
mov word [rsp + 0x80], ax
mov r12, rcx
lea rbp, [rsp + 0x30]
lea r13, [rsp + 0x2e]
mov word [rsp + 0x30], dx
test dil, dil
je 0x140440229
nop dword [rax]
mov rax, r14
lea rbx, [rbp + rsi*2]
sub rax, rsi
cmp word [rbp + rsi*2], 0
je 0x1404401ee
nop dword [rax + rax]
add rbx, 2
sub rax, 1
cmp word [rbx], 0
jne 0x1404401e0
test rax, rax
je 0x1404bc54e
mov rcx, rbx
add rsi, 1
call sub.msvcrt.dll_wcslen
mov r8d, 2
mov rdx, r13
mov byte [rsp + 0x2e], dil
lea rcx, [rbx + rax*2]
mov byte [rsp + 0x2f], 0
call sub.msvcrt.dll_mbstowcs
movzx edi, byte [r12 + rsi]
test dil, dil
jne 0x1404401c8
lea rbx, [rsp + 0x80]
mov r8d, 0x10000
mov rcx, rbp
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea edx, [rax - 1]
xor eax, eax
cmp edx, 0xffff
ja 0x140440258
mov rcx, rbx
call sub.msvcrt.dll__wcsdup
add rsp, 0x10080
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret

Function at 0x140440270
Capabilities:
Set environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
xor eax, eax
xor esi, esi
mov r13d, 0x28
movzx edi, byte [rcx]
mov word [rsp + 0x30], ax
mov rbp, rcx
mov r14, rdx
lea r15, [rsp + 0x30]
lea r12, [rsp + 0x2e]
test dil, dil
je 0x140440311
nop word [rax + rax]
mov rax, r13
lea rbx, [r15 + rsi*2]
sub rax, rsi
cmp word [r15 + rsi*2], 0
je 0x1404402d6
nop word [rax + rax]
add rbx, 2
sub rax, 1
cmp word [rbx], 0
jne 0x1404402c8
test rax, rax
je 0x1404bc554
mov rcx, rbx
add rsi, 1
call sub.msvcrt.dll_wcslen
mov r8d, 2
mov rdx, r12
mov byte [rsp + 0x2e], dil
lea rcx, [rbx + rax*2]
mov byte [rsp + 0x2f], 0
call sub.msvcrt.dll_mbstowcs
movzx edi, byte [rbp + rsi]
test dil, dil
jne 0x1404402b0
mov rdx, r14
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
nop
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140468da0
Capabilities:
Set environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
lea rsi, str.NUITKA_ONEFILE_BINARY
mov ebx, ecx
mov rcx, rsi
call fcn.140440180
test rax, rax
je 0x140468ee0
mov rdx, 0xffffffffffffffff
mov rcx, rax
lea r14, [rsp + 0x40]
mov r15d, 0x4e
call qword [sym.imp.python311.dll_PyUnicode_FromWideChar]
mov rdi, r14
lea r12, [rsi + 0x28]
lea rbp, [rsp + 0x3e]
mov r13, rax
xor eax, eax
mov word [rsp + 0x40], ax
nop
mov rax, r12
mov rbx, rdi
sub rax, rsi
cmp word [rdi], 0
je 0x140468e1e
nop
add rbx, 2
sub rax, 1
cmp word [rbx], 0
jne 0x140468e10
test rax, rax
je 0x1404bc5ee
mov rcx, rbx
add rsi, 1
add rdi, 2
call sub.msvcrt.dll_wcslen
mov r8d, 2
mov rdx, rbp
mov byte [rsp + 0x3e], r15b
lea rcx, [rbx + rax*2]
mov byte [rsp + 0x3f], 0
call sub.msvcrt.dll_mbstowcs
movzx r15d, byte [rsi]
test r15b, r15b
jne 0x140468e00
mov rcx, r14
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rax, qword [sym.imp.python311.dll__PyRuntime]
mov rcx, qword [0x14050dfd8]
mov rsi, qword [rax + 0x1f8]
mov rax, qword [0x1404d5bd0]
mov rbx, qword [rax + 0x1b8]
test rcx, rcx
je 0x140468f38
mov rdx, rbx
call fcn.140426230
mov r8, r13
mov rcx, rsi
mov rbx, rax
mov rdx, rax
call fcn.14045d3b0
sub qword [rbx], 1
jne 0x140468ec6
mov rdx, qword [rbx + 8]
mov qword [rsp + 0x28], rax
mov rcx, rbx
call qword [rdx + 0x30]
mov rax, qword [rsp + 0x28]
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [0x14050d8a0]
lea rsi, [0x14050d8a0]
test bl, bl
je 0x140468f00
mov rax, qword [0x14050d8a8]
lea rsi, [0x14050d8a8]
test rax, rax
jne 0x140468ec6
cmp byte [0x14050dac2], 0
jne 0x140468f16
movzx ecx, bl
call fcn.140428240
mov rdx, 0xffffffffffffffff
lea rcx, [0x14050d8c0]
call qword [sym.imp.python311.dll_PyUnicode_FromWideChar]
mov qword [rsi], rax
test rax, rax
je 0x140468f62
add qword [rax], 1
jmp 0x140468ec6
mov rcx, qword [0x14050df50]
mov rdi, qword [rax + 0x1a8]
test rcx, rcx
je 0x140468f6d
mov rdx, rdi
call fcn.140426230
mov qword [0x14050dfd8], rax
mov rcx, rax
jmp 0x140468e93
call qword [sym.imp.python311.dll_PyErr_Print]
call sub.msvcrt.dll_abort
lea rcx, [0x1404cded3]
call qword [sym.imp.python311.dll_PyImport_ImportModule]
mov qword [0x14050df50], rax
mov rcx, rax
test rax, rax
je 0x1404bc5ee
jmp 0x140468f4b
Function at 0x1404a0a00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
cmp byte [0x14050d889], 0
mov rbp, rcx
mov r12, rdx
mov rdi, r8
je 0x1404a0a88
lea rdx, [0x1404d1952]
mov rcx, rdi
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x1404a0af0
mov rbx, qword [0x14050d740]
jmp 0x1404a0a45
lea rbx, [rdx + rax + 4]
mov rdx, rbx
mov rcx, rdi
call sub.msvcrt.dll_strcmp
mov rcx, rbx
mov esi, eax
call sub.msvcrt.dll_strlen
lea rdx, [rbx + rax + 1]
mov eax, dword [rdx]
test esi, esi
jne 0x1404a0a40
movzx r9d, word [rdx + 4]
lea r8, [rdx + 6]
mov rcx, rbp
mov rdx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.14048fbb0
mov r8d, 0xa
xor ecx, ecx
mov edx, 3
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
xor ecx, ecx
lea rdx, [rax + 4]
mov qword [0x14050d740], rax
mov ebx, dword [rax]
mov qword [0x14050d740], rdx
mov r8d, dword [rax + 4]
lea rdx, [rax + 8]
mov qword [0x14050d740], rdx
call fcn.14049fb30
cmp eax, ebx
jne 0x1404a0b58
mov byte [0x14050d889], 1
jmp 0x1404a0a1c
cmp byte [0x14050d888], 0
jne 0x1404a0a33
mov rbx, qword [sym.imp.python311.dll_PyDict_New]
call rbx
mov qword [0x14050e1e8], rax
call rbx
mov qword [0x14050e1e0], rax
call rbx
mov qword [0x14050e1d8], rax
call rbx
mov qword [0x14050e1d0], rax
call rbx
mov qword [0x14050e1c8], rax
call rbx
mov qword [0x14050e1c0], rax
call rbx
mov qword [0x14050e1b8], rax
call rbx
mov byte [0x14050d888], 1
mov qword [0x14050e1b0], rax
jmp 0x1404a0a33
lea rcx, str.Error__corrupted_constants_object
call sub.msvcrt.dll_puts
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]

Function at 0x1404aa320
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call fcn.1404bbab0
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call fcn.1404bbab0
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
Function at 0x1404aaff2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x14050e6a8]
test eax, eax
je 0x1404ab08a
lea rax, [0x14050e680]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x14050e6b0]
mov qword [rbp - 8], rax
jmp 0x1404ab06e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x1404ab062
cmp qword [rbp - 0x10], 0
je 0x1404ab062
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x1404ab028
lea rax, [0x14050e680]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x1404ab08b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x1404ab190
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1404ab1b8
mov eax, 0
jmp 0x1404ab206
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1404ab1e1
mov eax, 0
jmp 0x1404ab206
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x1404ab201
mov eax, 0
jmp 0x1404ab206
mov eax, 1
add rsp, 0x20
pop rbp
ret

Function at 0x1404ab20c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x1404ab28a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x1404ab281
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x1404ab281
mov rax, qword [rbp - 8]
jmp 0x1404ab29f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x1404ab254
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x15190
Capabilities:
Complete processing asynchronous io request

Disassembly:
sub rsp, 0x28
mov r9, qword [rcx + 0x40]
mov r8, qword [rdx + 0xb8]
mov r10, rdx
cmp dword [r9 + 0xc], 6
jne 0x151c2
mov dword [rdx + 0x30], 0xc0000056
mov rcx, r10
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, 0xc0000056
jmp 0x151d5
cmp byte [r9 + 8], 0
je 0x151d0
call fcn.0001a3aa
jmp 0x151d5
call 0x1aded
add rsp, 0x28
ret

Function at 0x15251
Capabilities:
Complete processing asynchronous io request

Disassembly:
in al, dx
push rax
mov r13, rcx
mov rcx, r9
mov rsi, r9
mov rdi, r8
mov rbp, rdx
call fcn.000155e8
movzx r11d, byte [rdi + 1]
xor r12d, r12d
cmp r11d, r12d
je 0x155a5
lea ebx, [r12 + 1]
sub r11d, ebx
je 0x15575
sub r11d, ebx
je 0x1547e
sub r11d, ebx
je 0x15478
sub r11d, ebx
je 0x1543f
sub r11d, ebx
je 0x15430
add byte [rax], al
sub r11d, ebx
je 0x1541b
sub r11d, ebx
je 0x152cd
cmp r11d, 0x10
jne 0x15586
mov eax, dword [rsi + 0xc]
mov rcx, rsi
mov dword [rsi + 0xc], 5
mov dword [rsi + 0x10], eax
call fcn.0001a904
lea rcx, [rsi + 0x48]
call qword [sym.imp.ntoskrnl.exe_ExAcquireFastMutex]
lea r11, [rsi + 0x30]
mov r9, qword [r11]
mov r10, qword [r9]
jmp 0x152b9
mov rax, qword [r9 + 8]
mov rdx, qword [r9]
mov qword [rax], rdx
mov qword [rdx + 8], rax
mov qword [r9 + 8], r9
mov qword [r9], r9
mov qword [r9 - 0x18], r12
mov byte [r9 + 0x11], bl
mov r9, r10
mov r10, qword [r10]
cmp r9, r11
jne 0x15296
lea rcx, [rsi + 0x48]
call qword [sym.imp.ntoskrnl.exe_ExReleaseFastMutex]
jmp 0x15582
cmp dword [rdi + 8], r12d
jne 0x15586
mov rax, qword [r13 + 0x40]
cmp dword [rax + 0xc8], r12d
jle 0x152f4
lock add dword [rax + 0xc8], 0xffffffff
mov rcx, r13
call 0x1f1a8
lea rcx, [rsi + 0x48]
call qword [sym.imp.ntoskrnl.exe_ExAcquireFastMutex]
mov r14, qword [rbp + 0x38]
cmp r14, r12
je 0x1531f
mov r13d, dword [r14]
cmp dword [rsi + 0x40], r12d
jne 0x15322
lea rcx, [rsi + 0x48]
call qword [sym.imp.ntoskrnl.exe_ExReleaseFastMutex]
jmp 0x15586
mov r13d, r12d
mov ecx, r12d
lea r12, [rsi + 0x30]
mov rax, qword [r12]
invalid

Function at 0x1535d
Capabilities:
Complete processing asynchronous io request

Disassembly:
add byte [rax], al
add byte [rax - 0x7b], cl
sal byte [rbp + 0x2a], 0x48
lea ecx, [rsi + 0x48]
call qword [sym.imp.ntoskrnl.exe_ExReleaseFastMutex]
mov ebx, 0xc000009a
xor edx, edx
mov rcx, rbp
mov dword [rbp + 0x30], ebx
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov rcx, rsi
call 0x15792
jmp 0x1556e
mov eax, ebx
jmp 0x15664
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140142ac0]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x140142ad0]
mov dword [rax], 1
mov rax, qword [0x140142ae0]
mov dword [rax], 1
mov rax, qword [0x140142a70]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x140142ab0]
mov dword [0x14015a00c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x140142b90]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x140142b70]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x140142a20]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a
Function at 0x14001f720
Capabilities:
Parse credit card information

Disassembly:
sub rsp, 0x28
call sym.engine::chess::movegen::tables::init::h0ecc5befa3e1fdc9
nop
add rsp, 0x28
jmp sym.engine::chess::zobrist::init::hc0319edf13fd2191