joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180279160
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x1803df868]
xor rax, rsp
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
mov ebp, r8d
mov rdi, rcx
mov rbx, rdx
lea rcx, [rdx + 0xc88]
mov r8d, 0x264
xor edx, edx
xor esi, esi
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
call fcn.1802991c0
cmp ebp, 0x132
mov dword [rbx], ebp
mov eax, 7
mov ecx, 0xa
cmove eax, ecx
mov dword [rbx + 0x84], eax
test ebp, ebp
jle 0x1802791f4
mov rcx, rdi
mov edx, ebp
nop word [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
and eax, 0xf
inc dword [rsp + rax*4 + 0x20]
sub rdx, 1
jne 0x1802791e0
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], esi
sub r8, rbx
mov dword [rbx + 0x44], esi
lea r9, [rsp + 0x24]
mov dword [rbx + 4], esi
sub r9, rbx
lea rdx, [rbx + 8]
mov ecx, 0xf
nop word [rax + rax]
add esi, dword [r9 + rdx - 8]
lea rdx, [rdx + 4]
mov eax, esi
add esi, esi
shl eax, cl
dec ecx
mov dword [rdx - 4], eax
mov eax, dword [r8 + rdx - 0xc]
add eax, dword [rdx + 0x38]
mov dword [rdx + 0x3c], eax
test ecx, ecx
jg 0x180279220
movups xmm0, xmmword [rbx + 0x44]
xor r8d, r8d
movups xmm1, xmmword [rbx + 0x54]
movaps xmmword [rsp + 0x20], xmm0
movaps xmmword [rsp + 0x30], xmm1
movups xmm0, xmmword [rbx + 0x64]
movups xmm1, xmmword [rbx + 0x74]
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x50], xmm1
test ebp, ebp
jle 0x1802792a0
nop
movzx eax, byte [rdi]
and al, 0xf
jbe 0x180279295
movzx eax, al
lea rdx, [rsp + 0x20]
movsxd rcx, dword [rdx + rax*4]
lea rdx, [rdx + rax*4]
lea eax, [rcx + 1]
mov word [rbx + rcx*2 + 0xc88], r8w
mov dword [rdx], eax
inc r8d
inc rdi
cmp r8d, ebp
jl 0x180279270
mov ecx, dword [rbx + 0x84]
mov eax, 1
mov r11d, eax
xor r8d, r8d
shl r11, cl
test r11, r11
jle 0x18027934a
mov r9d, 0x488
lea r10, [rbx + 0x88]
nop word [rax + rax]
mov ecx, 0x10
mov edx, r8d
sub ecx, dword [rbx + 0x84]
shl edx, cl
cmp rax, 0x10
jge 0x180279301
lea rcx, [rbx + 4]
lea rcx, [rcx + rax*4]
nop
cmp edx, dword [rcx]
jl 0x180279301
inc rax
add rcx, 4
cmp rax, 0x10
jl 0x1802792f0
mov ecx, 0x10
mov byte [r10], al
sub edx, dword [rbx + rax*4]
sub cl, al
sar edx, cl
mov rcx, rax
and ecx, 0xf
add edx, dword [rbx + rcx*4 + 0x44]
cmp rax, 0x10
jge 0x180279331
cmp edx, ebp
jge 0x180279331
movsxd rcx, edx
movzx edx, word [rbx + rcx*2 + 0xc88]
jmp 0x180279333
xor edx, edx
inc r8d
mov word [rbx + r9], dx
movsxd rcx, r8d
add r9, 2
inc r10
cmp rcx, r11
jl 0x1802792d0
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.180296ce0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x180280d70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
movzx r8d, byte [rcx]
mov r9, rcx
test r8b, r8b
jns 0x180280e2b
movzx r11d, r8b
and r11b, 0x40
movzx eax, r11b
movzx ecx, r11b
neg al
sbb rax, rax
neg cl
movzx ecx, r8b
sbb r10b, r10b
or r8b, 0x80
and cl, 0x7f
movzx r8d, r8b
test r11b, r11b
movzx ecx, cl
cmove r8d, ecx
cmp rdx, 8
jbe 0x180280dd6
nop dword [rax]
dec rdx
cmp r8b, r10b
jne 0x180280e15
movzx r8d, byte [r9 + 1]
inc r9
cmp rdx, 8
ja 0x180280dc0
xor r10b, r8b
jl 0x180280e15
sub rdx, 1
je 0x180280e09
nop dword [rax]
nop word [rax + rax]
shl rax, 8
lea r9, [r9 + 1]
movzx ecx, r8b
movzx r8d, byte [r9]
or rax, rcx
sub rdx, 1
jne 0x180280df0
shl rax, 8
movzx ecx, r8b
or rax, rcx
ret
xor eax, eax
movabs rcx, 0x7fffffffffffffff
test r11b, r11b
setne al
add rax, rcx
ret
mov r8d, 8
jmp fcn.180280e40
Function at 0x180285e30
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rsp + 0x50]
mov rdi, r9
cmp r8, rax
mov rsi, rdx
mov rbx, rcx
cmovb eax, r8d
test eax, eax
je 0x180285ed5
mov qword [rsp + 0x30], rbp
sub rsi, r9
mov ebp, eax
mov eax, dword [rbx + 8]
lea rdx, [rsp + 0x50]
or eax, 2
mov r8d, 1
mov ecx, eax
xor ecx, 1
imul ecx, eax
shr ecx, 8
xor cl, byte [rsi + rdi]
mov byte [rdi], cl
mov byte [rsp + 0x50], cl
mov ecx, dword [rbx]
not ecx
call fcn.18012cce0
not eax
lea rdx, [rsp + 0x40]
mov dword [rbx], eax
mov r8d, 1
movzx eax, al
add eax, dword [rbx + 4]
imul ecx, eax, 0x8088405
inc ecx
mov dword [rbx + 4], ecx
shr ecx, 0x18
mov byte [rsp + 0x40], cl
mov ecx, dword [rbx + 8]
not ecx
call fcn.18012cce0
lea rdi, [rdi + 1]
not eax
mov dword [rbx + 8], eax
sub rbp, 1
jne 0x180285e62
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x180288590
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, qword [rcx + 0x58]
mov rsi, rcx
mov edx, dword [rbx + 0x4c]
call fcn.180288490
mov r8d, eax
mov edx, eax
test eax, eax
js 0x180288673
lea r14, [0x1804030b0]
xor ebp, ebp
nop
mov ecx, dword [0x1804040b0]
mov dword [r14 + rcx*4], r8d
inc ecx
cmp ecx, 0x400
cmovae ecx, ebp
mov dword [0x1804040b0], ecx
cmp r8d, 0x100
jne 0x180288691
cmp dword [rbx + 0x38], ebp
je 0x180288691
movsxd r8, dword [rbx + 0x4c]
xor edx, edx
mov rax, qword [rbx + 0x20]
div r8
mov eax, r8d
mov dword [rbx + 0x1c], ebp
sub eax, edx
cdq
idiv r8d
mov edi, edx
test edx, edx
jle 0x180288637
mov edx, 8
mov rcx, rsi
dec edi
call fcn.180288490
test eax, eax
js 0x180288676
test edi, edi
jg 0x180288620
mov qword [rbx + 0x20], rbp
mov rcx, rsi
mov dword [rbx + 0x4c], 9
mov dword [rbx + 0x48], 0x1ff
mov dword [rbx + 0x58], 0x101
mov dword [rbx + 0x50], 0xffffffff
mov rbx, qword [rsi + 0x58]
mov edx, dword [rbx + 0x4c]
call fcn.180288490
mov r8d, eax
mov edx, eax
test eax, eax
jns 0x1802885d0
mov eax, r8d
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov eax, dword [rbx + 0x58]
cmp r8d, eax
jg 0x180288785
jne 0x1802886ab
cmp dword [rbx + 0x50], ebp
jl 0x180288785
cmp r8d, eax
jl 0x1802886c4
mov rcx, qword [rbx + 0x30060]
movzx eax, byte [rbx + 0x54]
mov byte [rcx], al
inc qword [rbx + 0x30060]
mov edx, dword [rbx + 0x50]
mov rax, qword [rbx + 0x30060]
cmp edx, 0x100
jl 0x180288712
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [rbx + 0x30060]
movsxd rdx, edx
movzx eax, byte [rdx + rbx + 0x5c]
mov byte [rcx], al
mov rax, qword [rbx + 0x30060]
inc rax
mov qword [rbx + 0x30060], rax
movzx edx, word [rbx + rdx*2 + 0x1005c]
cmp edx, 0x100
jae 0x1802886e0
mov dword [rbx + 0x54], edx
mov byte [rax], dl
movsxd rax, dword [rbx + 0x58]
inc qword [rbx + 0x30060]
mov ecx, eax
cmp eax, dword [rbx + 0x40]
jge 0x180288749
mov edx, dword [rbx + 0x50]
test edx, edx
js 0x180288749
mov word [rbx + rax*2 + 0x1005c], dx
mov rcx, rax
movzx eax, byte [rbx + 0x54]
mov byte [rcx + rbx + 0x5c], al
inc dword [rbx + 0x58]
mov ecx, dword [rbx + 0x58]
cmp ecx, dword [rbx + 0x48]
jle 0x18028877a
inc dword [rbx + 0x4c]
mov ecx, dword [rbx + 0x4c]
mov qword [rbx + 0x20], rbp
cmp ecx, dword [rbx + 0x44]
jne 0x18028876e
mov eax, dword [rbx + 0x40]
mov dword [rbx + 0x48], eax
xor eax, eax
mov dword [rbx + 0x50], r8d
jmp 0x180288676
mov eax, 1
shl eax, cl
dec eax
mov dword [rbx + 0x48], eax
mov dword [rbx + 0x50], r8d
xor eax, eax
jmp 0x180288676
mov rcx, qword [rsi + 0x18]
lea r8, str.Invalid_compressed_data
mov edx, 0xffffffff
call fcn.180253290
mov eax, 0xffffffe2
jmp 0x180288676
Function at 0x180293f70
Capabilities:
Hash data using sha256

Disassembly:
mov r8, rcx
xor eax, eax
xorps xmm0, xmm0
movups xmmword [rcx + 0x20], xmm0
movups xmmword [rcx + 0x30], xmm0
movups xmmword [rcx + 0x40], xmm0
movups xmmword [rcx + 0x50], xmm0
movups xmmword [rcx + 0x60], xmm0
movups xmmword [rcx + 0x70], xmm0
mov qword [rcx + 0x80], rax
mov dword [rcx], 0x6a09e667
mov dword [rcx + 4], 0xbb67ae85
mov dword [rcx + 8], 0x3c6ef372
mov dword [rcx + 0xc], 0xa54ff53a
mov dword [rcx + 0x10], 0x510e527f
mov dword [rcx + 0x14], 0x9b05688c
mov dword [rcx + 0x18], 0x1f83d9ab
mov dword [rcx + 0x1c], 0x5be0cd19
movzx eax, byte [rdx + 2]
movzx ecx, byte [rdx + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx]
shl ecx, 8
or ecx, eax
xor ecx, 0x6a09e667
mov dword [r8], ecx
movzx eax, byte [rdx + 6]
movzx ecx, byte [rdx + 7]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 4]
shl ecx, 8
or ecx, eax
xor ecx, 0xbb67ae85
mov dword [r8 + 4], ecx
movzx eax, byte [rdx + 0xa]
movzx ecx, byte [rdx + 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 8]
shl ecx, 8
or ecx, eax
xor ecx, 0x3c6ef372
mov dword [r8 + 8], ecx
movzx eax, byte [rdx + 0xe]
movzx ecx, byte [rdx + 0xf]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xd]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xc]
shl ecx, 8
or ecx, eax
xor ecx, 0xa54ff53a
mov dword [r8 + 0xc], ecx
movzx eax, byte [rdx + 0x12]
movzx ecx, byte [rdx + 0x13]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x11]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x10]
shl ecx, 8
or ecx, eax
xor ecx, 0x510e527f
mov dword [r8 + 0x10], ecx
movzx ecx, byte [rdx + 0x17]
movzx eax, byte [rdx + 0x16]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x15]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x14]
shl ecx, 8
or ecx, eax
xor ecx, 0x9b05688c
mov dword [r8 + 0x14], ecx
movzx eax, byte [rdx + 0x1a]
movzx ecx, byte [rdx + 0x1b]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x19]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x18]
shl ecx, 8
or ecx, eax
xor ecx, 0x1f83d9ab
mov dword [r8 + 0x18], ecx
movzx eax, byte [rdx + 0x1e]
movzx ecx, byte [rdx + 0x1f]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x1d]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x1c]
shl ecx, 8
or ecx, eax
xor ecx, 0x5be0cd19
mov dword [r8 + 0x1c], ecx
movzx eax, byte [rdx]
mov qword [r8 + 0x78], rax
xor eax, eax
ret
Function at 0x180294c98
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x18000003c]
lea rsi, [0x180000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x180294d10
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x180294d10
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x180294d10
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x180294d04
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x180294d22
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x180294cf2
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x180294d12

Function at 0x1802aac5c
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1802aab0f
xor ecx, ecx
call qword [0x1802fe3a0]
test rax, rax
je 0x1802aab0f
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1802aab0f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1802aab0f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1802aab0f
cmp dword [rcx + 0x84], 0xe
jbe 0x1802aab0f
cmp dword [rcx + 0xf8], 0
je 0x1802aab0f
mov ecx, ebx
call fcn.1802aabc0
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1802aa99c
nop
cmp dword [rbp + 0x20], 0
je 0x1802aab5d
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1802aab68
int3
xor r8d, r8d
xor edx, edx
jmp 0x1802aaaa0
Function at 0x1802ca810
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
lea rsi, [0x18031b1d0]
mov rbx, rdx
mov r11, rcx
not r8d
cmp rdx, 8
jbe 0x1802ca916
mov qword [rsp + 0x10], rdi
test cl, 7
je 0x1802ca864
nop word [rax + rax]
movzx eax, byte [r11]
dec rbx
movzx ecx, r8b
inc r11
xor rcx, rax
mov eax, r8d
shr eax, 8
mov r8d, dword [rsi + rcx*4]
xor r8d, eax
test r11b, 7
jne 0x1802ca840
mov rdi, rbx
and ebx, 7
and rdi, 0xfffffffffffffff8
add rdi, r11
cmp r11, rdi
jae 0x1802ca911
nop word [rax + rax]
xor r8d, dword [r11]
mov r10d, dword [r11 + 4]
add r11, 8
mov r9d, r8d
mov eax, r8d
shr rax, 0x10
movzx edx, al
mov eax, r8d
shr rax, 8
movzx ecx, al
mov eax, r10d
mov r8d, dword [rsi + rdx*4 + 0x1400]
shr rax, 0x10
xor r8d, dword [rsi + rcx*4 + 0x1800]
movzx ecx, al
mov eax, r10d
shr rax, 8
xor r8d, dword [rsi + rcx*4 + 0x400]
movzx ecx, al
mov eax, r9d
shr rax, 0x18
xor r8d, dword [rsi + rcx*4 + 0x800]
xor r8d, dword [rsi + rax*4 + 0x1000]
mov eax, r10d
shr rax, 0x18
xor r8d, dword [rsi + rax*4]
movzx eax, r9b
xor r8d, dword [rsi + rax*4 + 0x1c00]
movzx eax, r10b
xor r8d, dword [rsi + rax*4 + 0xc00]
cmp r11, rdi
jb 0x1802ca880
mov rdi, qword [rsp + 0x10]
test rbx, rbx
je 0x1802ca942
nop dword [rax + rax]
movzx eax, byte [r11]
lea r11, [r11 + 1]
movzx ecx, r8b
xor rcx, rax
mov eax, r8d
shr eax, 8
mov r8d, dword [rsi + rcx*4]
xor r8d, eax
sub rbx, 1
jne 0x1802ca920
mov rbx, qword [rsp + 0x18]
not r8d
mov eax, r8d
pop rsi
ret

Function at 0x1802d2240
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
lea rsi, [0x18031d2f0]
mov rbx, rdx
mov r11, rcx
not r8
cmp rdx, 4
jbe 0x1802d230f
mov qword [rsp + 0x10], rdi
test cl, 3
je 0x1802d2295
nop word [rax + rax]
movzx eax, byte [r11]
dec rbx
movzx ecx, r8b
inc r11
xor rcx, rax
mov rax, r8
shr rax, 8
mov r8, qword [rsi + rcx*8]
xor r8, rax
test r11b, 3
jne 0x1802d2270
mov rdi, rbx
and ebx, 3
and rdi, 0xfffffffffffffffc
add rdi, r11
cmp r11, rdi
jae 0x1802d230a
nop word [rax + rax]
mov r10d, dword [r11]
add r11, 4
mov eax, r8d
xor r10, rax
mov rax, r10
shr rax, 0x10
movzx edx, al
mov rax, r10
shr rax, 8
movzx ecx, al
mov rax, r10
shr rax, 0x18
mov r9, qword [rsi + rdx*8 + 0x800]
xor r9, qword [rsi + rcx*8 + 0x1000]
xor r9, qword [rsi + rax*8]
movzx eax, r10b
xor r9, qword [rsi + rax*8 + 0x1800]
mov rax, r8
shr rax, 0x20
mov r8, r9
xor r8, rax
cmp r11, rdi
jb 0x1802d22b0
mov rdi, qword [rsp + 0x10]
test rbx, rbx
je 0x1802d2343
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r11]
lea r11, [r11 + 1]
movzx ecx, r8b
xor rcx, rax
mov rax, r8
shr rax, 8
mov r8, qword [rsi + rcx*8]
xor r8, rax
sub rbx, 1
jne 0x1802d2320
mov rbx, qword [rsp + 0x18]
not r8
mov rax, r8
pop rsi
ret
Function at 0x14000147a
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x1400d9f30]
mov dword [rax], 1
mov rax, qword [0x1400d9f40]
mov dword [rax], 1
mov rax, qword [0x1400d9f50]
mov dword [rax], 1
mov rax, qword [0x1400d9f20]
mov dword [rax], 1
mov rax, qword [0x1400d9dd0]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400014d8
mov eax, 0
jmp 0x140001585
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140001504
mov eax, 0
jmp 0x140001585
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000152a
cmp eax, 0x20b
je 0x140001551
jmp 0x140001580
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000153d
mov eax, 0
jmp 0x140001585
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001585
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000156c
mov eax, 0
jmp 0x140001585
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001585
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x1400016eb
Capabilities:
Enumerate processes

Disassembly:
push rbp
sub rsp, 0x160
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xf0], rcx
mov dword [rbp + 0xdc], 0
mov dword [rbp - 0x60], 0x130
mov edx, 0
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp + 0xd0], rax
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd0]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
setne al
test al, al
je 0x140001787
lea rax, [rbp - 0x60]
add rax, 0x2c
mov rdx, qword [rbp + 0xf0]
mov rcx, rax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x14000176b
mov eax, dword [rbp - 0x58]
mov dword [rbp + 0xdc], eax
jmp 0x140001787
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd0]
mov rcx, rax
call sub.KERNEL32.dll_Process32Next
test eax, eax
setne al
test al, al
jne 0x140001745
mov rax, qword [rbp + 0xd0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, dword [rbp + 0xdc]
add rsp, 0x160
pop rbp
ret
Function at 0x14000186f
Capabilities:
Create process on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xe0
mov qword [rbp + 0x10], rcx
lea rax, [rbp - 0x70]
mov r8d, 0x68
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
mov dword [rbp - 0x70], 0x68
lea rax, [rbp - 0x90]
mov r8d, 0x18
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
mov rcx, qword [rbp + 0x10]
call fcn.140034480
mov rdx, rax
lea rax, [rbp - 0x90]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
test eax, eax
setne al
test al, al
je 0x140001949
mov rax, qword [rbp - 0x90]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x88]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 1
jmp 0x140001979
lea rax, str.Failed_to_start_the_game.
mov rdx, rax
mov rax, qword [0x1400d97c0]
mov rcx, rax
call fcn.1400cbe60
mov rcx, rax
mov rax, qword [0x1400d97d0]
mov rdx, rax
call fcn.14007a530
mov eax, 0
add rsp, 0xe0
pop rbp
ret
Function at 0x14000c490
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call fcn.14001ac40
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call fcn.14001ac40
mov r8, rbx
mov rdx, qword [rbp + 0x20]
mov rcx, rax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop

Function at 0x14000d0c2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x140104128]
test eax, eax
je 0x14000d15a
lea rax, [0x140104100]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x140104130]
mov qword [rbp - 8], rax
jmp 0x14000d13e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x14000d132
cmp qword [rbp - 0x10], 0
je 0x14000d132
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x14000d0f8
lea rax, [0x140104100]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x14000d15b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x14000d260
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x14000d288
mov eax, 0
jmp 0x14000d2d6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x14000d2b1
mov eax, 0
jmp 0x14000d2d6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x14000d2d1
mov eax, 0
jmp 0x14000d2d6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x14000d2dc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x14000d35a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x14000d351
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x14000d351
mov rax, qword [rbp - 8]
jmp 0x14000d36f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x14000d324
mov eax, 0
add rsp, 0x20
pop rbp
ret