joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140012a80
Capabilities:
Get file attributes
Write file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov r13, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov r9d, r8d
mov rdi, rcx
mov rbp, rdx
mov ecx, 0xfde9
mov qword [rsp + 0x38], 0
mov r12d, r8d
mov r8, rdx
xor edx, edx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call r13
movsxd rsi, eax
lea ecx, [rsi + 1]
movsxd rcx, ecx
call sym.malloc_noscan
mov rbx, rax
test rax, rax
je 0x140012b39
mov r9d, r12d
mov r8, rbp
xor edx, edx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x38], 0
mov ecx, 0xfde9
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rax
call r13
mov byte [rbx + rsi], 0
mov rcx, rbx
call sym.strlen
mov dword [rdi + 0xc], 0
mov dword [rdi + 8], eax
mov rax, rdi
mov qword [rdi], rbx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov edx, 0x10
lea rcx, str.tos2:_nil_string
call sym._v_panic.isra.0
nop
nop dword [rax + rax]
Function at 0x140012b50
Capabilities:
Get file attributes
Write file on windows

Disassembly:
push r14
mov eax, 0x4060
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.140023c00
sub rsp, rax
movaps xmmword [rsp + 0x4050], xmm6
xor r12d, r12d
mov r8d, 0x200
mov rax, r12
mov rbx, rcx
lea rdi, [rsp + 0x60]
mov ecx, 0x3fe
mov qword [rsp + 0x50], 0
rep stosq qword [rdi], rax
lea rsi, [rsp + 0x50]
mov qword [rsp + 0x58], 0
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rcx, rsi
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test ah, 4
je 0x140012c88
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov r8d, 1
mov rcx, rsi
mov dword [rsp + 0x28], pe_nt_image_headers64
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x140012c88
lea rdi, [rsp + 0x2060]
mov ecx, 0x3fe
mov rax, r12
xor r9d, r9d
rep stosq qword [rdi], rax
mov r8d, 0x2000
mov rcx, r13
lea rdi, [rsp + 0x2050]
mov qword [rsp + 0x2050], 0
mov rdx, rdi
mov qword [rsp + 0x2058], 0
call qword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
cmp eax, 0x1fff
jbe 0x140012cd0
mov edx, 0x3e
lea rcx, str.os.executable___saw_that_the_executable_file_path_was_too_long
call sym.eprintln.isra.0
lea rcx, [rsp + 0x40]
mov rdx, rsi
mov r8d, ebp
call sym.string_from_wide2
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140012ca2
mov rdx, rsi
lea rcx, [rsp + 0x40]
mov r8d, ebp
call sym.string_from_wide2
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov qword [rbx], rdi
mov qword [rbx + 8], rsi
movaps xmm6, xmmword [rsp + 0x4050]
mov rax, rbx
add rsp, 0x4060
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
lea rsi, [rsp + 0x40]
mov r8d, eax
mov rdx, rdi
mov rcx, rsi
lea rdi, [0x1400284a3]
call sym.string_from_wide2
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rcx, rsi
mov r9d, 4
mov dword [rsp + 0x20], r8d
mov rbp, r8
sar rbp, 0x20
call sym.string_substr.isra.0
mov rsi, qword [rsp + 0x48]
mov r12, qword [rsp + 0x40]
mov eax, 1
test esi, esi
jne 0x140012d50
movd xmm6, esi
movd xmm0, eax
punpckldq xmm6, xmm0
cmp ebp, 0xfa1d05ee
je 0x140012d80
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx], rdi
movq qword [rbx + 8], xmm6
jmp 0x140012ca9
lea ecx, [rsi + 1]
movsxd r14, esi
movsxd rcx, ecx
call sym.malloc_noscan
mov r8, r14
mov rdx, r12
mov rdi, rax
mov rcx, rax
call sym.memcpy
mov byte [rdi + r14], 0
xor eax, eax
jmp 0x140012d21
mov ecx, 1
lea r14, [0x140028308]
mov ebp, 0x1e
call qword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov r12, rax
nop word [rax + rax]
mov r8, rbp
mov rcx, r14
mov r9, r12
mov edx, 1
call sym.fwrite
sub rbp, rax
add r14, rax
test rbp, rbp
jg 0x140012da0
jmp 0x140012d35
Function at 0x14001dde0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, qword [0x14002c600]
mov rsi, qword [rbx + 0x78]
mov rax, qword [rbx + 0x88]
sub rax, rsi
cmp rax, 0x7fff
ja 0x14001deb4
mov rax, qword [0x14002c790]
mov rdx, qword [0x14002c7f0]
cmp dword [rax], 1
mov r8d, dword [rdx]
mov rdx, qword [0x14002c800]
sbb eax, eax
and eax, 0xffffffc4
cmp qword [rdx], 1
mov edx, 0x10000
lea r9d, [rax + 0x40]
adc rdx, 0
or r8d, 0x3000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test eax, 0xfff
je 0x14001ded0
lea rcx, str.Bad_VirtualAlloc_result
call sym.GC_default_on_abort.lto_priv.0
mov rdi, qword [sym.imp.KERNEL32.dll_DebugBreak]
call rdi
mov rax, qword [rbx + 0xf0]
cmp rax, 0x3ff
jbe 0x14001de8b
lea rcx, str.Too_many_heap_sections
call sym.GC_default_on_abort.lto_priv.0
call rdi
mov rax, qword [rbx + 0xf0]
lea rdx, [rax + 1]
mov qword [rbx + rax*8 + 0x163d0], rsi
lea rax, [rsi + 0x10000]
add qword [rbx + 0x38], 0x10000
mov qword [rbx + 0xf0], rdx
mov qword [rbx + 0x88], rax
lea rax, [rsi + 0x8000]
mov qword [rbx + 0x78], rax
mov rax, rsi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
cmp qword [rbx + 0xf0], 0x3ff
jbe 0x14001deef
lea rcx, str.Too_many_heap_sections
call sym.GC_default_on_abort.lto_priv.0
call qword [sym.imp.KERNEL32.dll_DebugBreak]
test rsi, rsi
jne 0x14001df30
mov edx, 0x8000
lea rcx, str.GC_Warning:_Out_of_memory___trying_to_allocate_requested_amount___ld_bytes_..._n
call sym.GC_default_warn_proc.lto_priv.0
mov ecx, 0x8000
call sym.GC_win32_get_mem
mov rsi, rax
test rax, rax
je 0x14001debf
add qword [rbx + 0x38], 0x8000
mov rax, rsi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov rax, qword [rbx + 0xf0]
jmp 0x14001de8b
Function at 0x14001df40
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, qword [0x14002c600]
mov rsi, qword [rbx + 0x78]
mov rax, qword [rbx + 0x88]
sub rax, rsi
cmp rax, 0x201f
ja 0x14001e014
mov rax, qword [0x14002c790]
mov rdx, qword [0x14002c7f0]
cmp dword [rax], 1
mov r8d, dword [rdx]
mov rdx, qword [0x14002c800]
sbb eax, eax
and eax, 0xffffffc4
cmp qword [rdx], 1
mov edx, 0x10000
lea r9d, [rax + 0x40]
adc rdx, 0
or r8d, 0x3000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test eax, 0xfff
je 0x14001e030
lea rcx, str.Bad_VirtualAlloc_result
call sym.GC_default_on_abort.lto_priv.0
mov rdi, qword [sym.imp.KERNEL32.dll_DebugBreak]
call rdi
mov rax, qword [rbx + 0xf0]
cmp rax, 0x3ff
jbe 0x14001dfeb
lea rcx, str.Too_many_heap_sections
call sym.GC_default_on_abort.lto_priv.0
call rdi
mov rax, qword [rbx + 0xf0]
lea rdx, [rax + 1]
mov qword [rbx + rax*8 + 0x163d0], rsi
lea rax, [rsi + 0x10000]
add qword [rbx + 0x38], 0x10000
mov qword [rbx + 0xf0], rdx
mov qword [rbx + 0x88], rax
lea rax, [rsi + 0x2020]
mov qword [rbx + 0x78], rax
mov rax, rsi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
cmp qword [rbx + 0xf0], 0x3ff
jbe 0x14001e04f
lea rcx, str.Too_many_heap_sections
call sym.GC_default_on_abort.lto_priv.0
call qword [sym.imp.KERNEL32.dll_DebugBreak]
test rsi, rsi
jne 0x14001e090
mov edx, 0x2020
lea rcx, str.GC_Warning:_Out_of_memory___trying_to_allocate_requested_amount___ld_bytes_..._n
call sym.GC_default_warn_proc.lto_priv.0
mov ecx, 0x2020
call sym.GC_win32_get_mem
mov rsi, rax
test rax, rax
je 0x14001e01f
add qword [rbx + 0x38], 0x2020
mov rax, rsi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov rax, qword [rbx + 0xf0]
jmp 0x14001dfeb
Function at 0x140020000
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov eax, dword [rsp + 0xa0]
lea r13d, [rax + 1]
mov eax, dword [rsp + 0xa8]
mov r14, rcx
mov rcx, rdx
lea esi, [rax + 1]
mov dword [rsp + 0x2c], r9d
mov rbx, rdx
mov r12d, r8d
mov r15d, esi
call sym.strconv__dec_digits
mov edi, eax
sub r15d, eax
xor eax, eax
cmp esi, edi
cmovle r15d, eax
lea ecx, [rdi + r15 + 8]
test ecx, ecx
cmovs ecx, eax
xor ebp, ebp
movsxd rcx, ecx
call sym.vcalloc_noscan
mov r9d, dword [rsp + 0x2c]
mov rsi, rax
test r9b, r9b
je 0x140020074
mov byte [rax], 0x2d
mov ebp, 1
xor r9d, r9d
cmp edi, 1
setle r9b
cmp r13d, edi
jge 0x140020270
mov rax, qword [0x14002ca30]
mov rdx, qword [rax + 8]
mov eax, edi
sub eax, r13d
cdqe
mov rcx, qword [rdx + rax*8 - 8]
lea r10, [rcx + rcx*4]
mov rcx, qword [rdx + rax*8]
mov rax, rbx
xor edx, edx
add r10, rbx
div rcx
xor edx, edx
mov r11, rax
mov rax, r10
div rcx
mov rbx, rax
cmp r11, rax
jb 0x140020280
mov r10d, r13d
lea r11d, [r13 + rbp]
sub r10d, r9d
cmp r10d, 1
jle 0x140020298
movabs r8, 0xcccccccccccccccd
movsxd rax, r11d
lea r9, [rsi + rax - 1]
lea rcx, [rsi + rax]
lea eax, [r10 - 2]
sub r9, rax
nop word [rax + rax]
mov rax, rbx
sub rcx, 1
mul r8
shr rdx, 3
lea rax, [rdx + rdx*4]
add rax, rax
sub rbx, rax
add ebx, 0x30
mov byte [rcx + 1], bl
mov rbx, rdx
cmp rcx, r9
jne 0x140020100
mov edx, dword [rsp + 0xa0]
lea ebp, [rbp + r10 - 1]
sub r10d, 1
test edx, edx
je 0x140020237
mov eax, r11d
add ebp, 1
sub eax, r10d
add r10d, 1
cdqe
mov byte [rsi + rax], 0x2e
sub r11d, r10d
js 0x14002017e
movabs rax, 0xcccccccccccccccd
movsxd r11, r11d
add ebp, 1
mul rbx
shr rdx, 3
lea rax, [rdx + rdx*4]
add rax, rax
sub rbx, rax
add ebx, 0x30
mov byte [rsi + r11], bl
test r15d, r15d
je 0x140020199
movsxd rcx, ebp
movsxd r8, r15d
mov edx, 0x30
add ebp, r15d
add rcx, rsi
call sym.memset
add edi, r12d
lea eax, [rbp + 1]
movsxd rdx, ebp
mov r9d, 0x2b
cdqe
mov r8d, edi
lea ecx, [rbp + 2]
add rdx, rsi
add rax, rsi
sub r8d, 1
jns 0x1400201cb
mov r8d, 1
mov r9d, 0x2d
sub r8d, edi
mov r10d, 0xcccccccd
mov byte [rdx], 0x65
mov byte [rax], r9b
mov eax, r8d
imul rax, r10
shr rax, 0x23
lea edx, [rax + rax*4]
mov r9d, eax
mov eax, r8d
add edx, edx
sub eax, edx
mov edx, r9d
imul rdx, r10
shr rdx, 0x23
lea r11d, [rdx + rdx*4]
mov r10d, edx
mov edx, r9d
add r11d, r11d
sub edx, r11d
cmp r8d, 0x63
jle 0x14002021e
movsxd rcx, ecx
add r10d, 0x30
mov byte [rsi + rcx], r10b
lea ecx, [rbp + 3]
add edx, 0x30
movsxd r8, ecx
lea ebp, [rcx + 2]
add eax, 0x30
mov byte [rsi + r8], dl
lea edx, [rcx + 1]
movsxd rdx, edx
mov byte [rsi + rdx], al
movsxd rax, ebp
mov byte [rsi + rax], 0
test rsi, rsi
je 0x1400202b4
mov rax, r14
mov dword [r14 + 0xc], 0
mov qword [r14], rsi
mov dword [r14 + 8], ebp
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r13d, edi
jmp 0x1400200c8
mov eax, dword [rsp + 0xa0]
add r12d, 1
lea r13d, [rax + 2]
jmp 0x1400200c8
mov eax, dword [rsp + 0xa0]
test eax, eax
je 0x140020237
xor r10d, r10d
test r13d, r13d
jle 0x140020151
jmp 0x14002013e
call sym.tos.part.0
nop
nop word [rax + rax]
Function at 0x140020d80
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
mov rdi, rcx
lea ecx, [r8 + 1]
mov rsi, rdx
mov ebx, r8d
movsxd rcx, ecx
call sym.malloc_noscan
mov rdx, rax
test ebx, ebx
jle 0x140020f80
lea eax, [rbx - 1]
cmp eax, 0xe
jbe 0x140020fa9
mov ecx, ebx
movdqa xmm6, xmmword [0x14002c270]
xor eax, eax
pxor xmm3, xmm3
shr ecx, 4
movdqa xmm5, xmmword [0x14002c280]
movdqa xmm4, xmmword [0x14002c290]
shl rcx, 4
nop
movdqu xmm2, xmmword [rsi + rax]
movdqa xmm0, xmm2
movdqa xmm1, xmm2
paddb xmm0, xmm6
paddb xmm1, xmm4
psubusb xmm0, xmm5
pcmpeqb xmm0, xmm3
pand xmm1, xmm0
pandn xmm0, xmm2
por xmm0, xmm1
movups xmmword [rdx + rax], xmm0
add rax, 0x10
cmp rcx, rax
jne 0x140020de0
mov eax, ebx
and eax, 0xfffffff0
mov ecx, eax
cmp ebx, eax
je 0x140020fb2
mov r8d, ebx
sub r8d, ecx
lea r9d, [r8 - 1]
cmp r9d, 6
jbe 0x140020e89
movq xmm0, qword [0x14002c270]
movq xmm2, qword [rsi + rcx]
movq xmm3, qword [0x14002c280]
movq xmm1, qword [0x14002c290]
paddb xmm0, xmm2
paddb xmm1, xmm2
psubusb xmm0, xmm3
pxor xmm3, xmm3
pcmpeqb xmm0, xmm3
pand xmm1, xmm0
pandn xmm0, xmm2
por xmm0, xmm1
movq qword [rdx + rcx], xmm0
mov ecx, r8d
and ecx, 0xfffffff8
add eax, ecx
and r8d, 7
je 0x140020f80
movsxd r8, eax
movzx ecx, byte [rsi + r8]
lea r10d, [rcx - 0x61]
lea r9d, [rcx - 0x20]
cmp r10b, 0x1a
cmovb ecx, r9d
mov byte [rdx + r8], cl
lea ecx, [rax + 1]
cmp ebx, ecx
jle 0x140020f80
movsxd rcx, ecx
movzx r8d, byte [rsi + rcx]
lea r10d, [r8 - 0x61]
lea r9d, [r8 - 0x20]
cmp r10b, 0x1a
cmovb r8d, r9d
mov byte [rdx + rcx], r8b
lea ecx, [rax + 2]
cmp ebx, ecx
jle 0x140020f80
movsxd rcx, ecx
movzx r8d, byte [rsi + rcx]
lea r10d, [r8 - 0x61]
lea r9d, [r8 - 0x20]
cmp r10b, 0x1a
cmovb r8d, r9d
mov byte [rdx + rcx], r8b
lea ecx, [rax + 3]
cmp ecx, ebx
jge 0x140020f80
movsxd rcx, ecx
movzx r8d, byte [rsi + rcx]
lea r10d, [r8 - 0x61]
lea r9d, [r8 - 0x20]
cmp r10b, 0x1a
cmovb r8d, r9d
mov byte [rdx + rcx], r8b
lea ecx, [rax + 4]
cmp ecx, ebx
jge 0x140020f80
movsxd rcx, ecx
movzx r8d, byte [rsi + rcx]
lea r10d, [r8 - 0x61]
lea r9d, [r8 - 0x20]
cmp r10b, 0x1a
cmovb r8d, r9d
mov byte [rdx + rcx], r8b
lea ecx, [rax + 5]
cmp ebx, ecx
jle 0x140020f80
movsxd rcx, ecx
movzx r8d, byte [rsi + rcx]
lea r10d, [r8 - 0x61]
lea r9d, [r8 - 0x20]
cmp r10b, 0x1a
cmovb r8d, r9d
add eax, 6
mov byte [rdx + rcx], r8b
cmp ebx, eax
jle 0x140020f80
cdqe
movzx ecx, byte [rsi + rax]
lea r9d, [rcx - 0x61]
lea r8d, [rcx - 0x20]
cmp r9b, 0x1a
cmovb ecx, r8d
mov byte [rdx + rax], cl
movsxd rax, ebx
mov byte [rdx + rax], 0
test rdx, rdx
je 0x140020fbb
mov dword [rdi + 0xc], 0
mov rax, rdi
mov qword [rdi], rdx
mov dword [rdi + 8], ebx
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
xor ecx, ecx
xor eax, eax
jmp 0x140020e25
movsxd rax, ebx
mov byte [rdx + rax], 0
jmp 0x140020f8c
call sym.tos.part.0
nop
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x140020fd0
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbp, qword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov r12, rcx
movsxd rdi, edx
mov ecx, 1
test r12, r12
je 0x140021090
call rbp
lea r13d, [rdi + 1]
mov rcx, rax
movsxd rbx, r13d
call sub.ucrtbase.dll_fflush
mov ecx, 2
call rbp
mov rcx, rax
call sub.ucrtbase.dll_fflush
mov rcx, rbx
call sym._v_malloc
mov r8, rdi
mov rdx, r12
mov rsi, rax
mov rcx, rax
call sym.memcpy
mov byte [rsi + rdi], 0xa
test r13d, r13d
jg 0x140021058
mov ecx, 2
call rbp
mov rcx, rax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sub.ucrtbase.dll_fflush
mov ecx, 1
call rbp
mov ecx, 2
call rbp
mov rdi, rax
nop dword [rax]
mov r8, rbx
mov rcx, rsi
mov r9, rdi
mov edx, 1
call sym.fwrite
sub rbx, rax
add rsi, rax
test rbx, rbx
jg 0x140021070
jmp 0x140021039
call rbp
mov ebx, 0xe
mov rcx, rax
call sub.ucrtbase.dll_fflush
mov ecx, 2
call rbp
mov rcx, rax
call sub.ucrtbase.dll_fflush
mov ecx, 0xe
call sym._v_malloc
mov ecx, 1
mov rsi, rax
movabs rax, 0x6e6c746e69727065
mov qword [rsi], rax
movabs rax, 0x294c494e286e6c74
mov qword [rsi + 5], rax
mov byte [rsi + 0xd], 0xa
call rbp
mov ecx, 2
call rbp
mov rdi, rax
jmp 0x140021070

Function at 0x1400210f0
Capabilities:
Terminate process
Write file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
mov rbp, qword [sym.imp.ucrtbase.dll___acrt_iob_func]
lea rsi, str.V_panic:
mov ebx, 9
mov r13d, edx
mov r12, rcx
mov ecx, 1
call rbp
mov rcx, rax
call sub.ucrtbase.dll_fflush
mov ecx, 2
call rbp
mov rcx, rax
call sub.ucrtbase.dll_fflush
mov ecx, 1
call rbp
mov ecx, 2
call rbp
mov rdi, rax
mov r8, rbx
mov rcx, rsi
mov r9, rdi
mov edx, 1
call sym.fwrite
sub rbx, rax
add rsi, rax
test rbx, rbx
jg 0x140021147
mov ecx, 2
call rbp
mov rcx, rax
call sub.ucrtbase.dll_fflush
mov edx, r13d
mov rcx, r12
call sym.eprintln.isra.0
lea rax, str.v_hash:
pxor xmm0, xmm0
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov rax, qword [0x14002c2a0]
lea rdx, [rsp + 0x30]
movups xmmword [rsp + 0x44], xmm0
mov qword [rsp + 0x38], rax
lea rax, str.e863191
mov qword [rsp + 0x48], rax
lea rax, [0x14002bed8]
movups xmmword [rsp + 0x64], xmm0
movups xmmword [rsp + 0x54], xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x40], 0xfe10
mov dword [rsp + 0x50], 7
mov dword [rsp + 0x64], 1
call sym.str_intp.constprop.0
mov edx, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call sym.eprintln.isra.0
lea rcx, str.print_backtrace_skipping_top_frames_is_not_implemented
mov edx, 0x36
call sym.eprintln.isra.0
mov ecx, 1
call sym.exit
nop
nop dword [rax + rax]
Function at 0x1400228e0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.ucrtbase.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.ucrtbase.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x1400235b2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x140060968]
test eax, eax
je 0x14002364a
lea rax, [0x140060940]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x140060970]
mov qword [rbp - 8], rax
jmp 0x14002362e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x140023622
cmp qword [rbp - 0x10], 0
je 0x140023622
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x1400235e8
lea rax, [0x140060940]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x14002364b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x140023750
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x140023778
mov eax, 0
jmp 0x1400237c6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400237a1
mov eax, 0
jmp 0x1400237c6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x1400237c1
mov eax, 0
jmp 0x1400237c6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x1400014ab
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x140033fa0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x10
mov qword [rsp], 0
jmp 0x140033fc9
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
mov rax, qword [rsp + 0x30]
cmp qword [rsp], rax
jae 0x140034013
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x20]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
movabs rax, 0x100000001b3
mov rcx, qword [rsp + 0x20]
imul rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x140033fbe
mov rax, qword [rsp + 0x20]
add rsp, 0x10
pop rdi
ret
Function at 0x140001f32
Capabilities:
Read clipboard data

Disassembly:
jmp 0x1400080a0
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x80
lea rdi, [rsp + 0x20]
mov ecx, 0x18
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x90]
mov rax, qword [0x140090040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x70], 0
mov ecx, 1
call qword [sym.imp.USER32.dll_GetClipboardData]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140008135
mov rdx, qword [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.140001cb2
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x90]
call fcn.1400023f6
mov eax, dword [rsp + 0x70]
or eax, 1
mov dword [rsp + 0x70], eax
lea rcx, [rsp + 0x38]
call fcn.1400014e7
mov rax, qword [rsp + 0x90]
jmp 0x14000815c
movzx edx, byte [0x1400831e7]
mov rcx, qword [rsp + 0x90]
call fcn.140001f64
mov eax, dword [rsp + 0x70]
or eax, 1
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x90]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x14007d8d0]
call fcn.14000274d
mov rax, rdi
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140001d89
add rsp, 0x80
pop rdi
ret

Function at 0x140001faf
Capabilities:
Terminate process

Disassembly:
jmp 0x140072810
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x140002202
Capabilities:
Get geographical location

Disassembly:
jmp 0x14006bc40
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov r9d, 2
lea r8, [rsp + 0x40]
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x14006bc7d
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x40]
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x48]
mov edx, eax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax]
call fcn.140002c5c
add rsp, 0x58
ret
Function at 0x140002342
Capabilities:
Parse pe header

Disassembly:
jmp 0x140071ba0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140071bc0
xor al, al
jmp 0x140071c41
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140071bd3
xor al, al
jmp 0x140071c41
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140071bfd
xor al, al
jmp 0x140071c41
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140071c11
xor al, al
jmp 0x140071c41
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140071c23
xor al, al
jmp 0x140071c41
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140071c3f
xor al, al
jmp 0x140071c41
mov al, 1
add rsp, 0x38
ret
Function at 0x1400080a0
Capabilities:
Read clipboard data

Disassembly:
jmp 0x1400080a0
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x80
lea rdi, [rsp + 0x20]
mov ecx, 0x18
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x90]
mov rax, qword [0x140090040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x70], 0
mov ecx, 1
call qword [sym.imp.USER32.dll_GetClipboardData]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140008135
mov rdx, qword [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.140001cb2
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x90]
call fcn.1400023f6
mov eax, dword [rsp + 0x70]
or eax, 1
mov dword [rsp + 0x70], eax
lea rcx, [rsp + 0x38]
call fcn.1400014e7
mov rax, qword [rsp + 0x90]
jmp 0x14000815c
movzx edx, byte [0x1400831e7]
mov rcx, qword [rsp + 0x90]
call fcn.140001f64
mov eax, dword [rsp + 0x70]
or eax, 1
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x90]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x14007d8d0]
call fcn.14000274d
mov rax, rdi
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140001d89
add rsp, 0x80
pop rdi
ret
Function at 0x140033fa0
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x140033fa0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x10
mov qword [rsp], 0
jmp 0x140033fc9
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
mov rax, qword [rsp + 0x30]
cmp qword [rsp], rax
jae 0x140034013
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x20]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
movabs rax, 0x100000001b3
mov rcx, qword [rsp + 0x20]
imul rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x140033fbe
mov rax, qword [rsp + 0x20]
add rsp, 0x10
pop rdi
ret