joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180005350
Capabilities:
Read file on windows

Disassembly:
push rsi
sub rsp, 0x70
cmp byte [rcx], 0
mov rsi, rcx
je 0x180005383
cmp byte [rcx + 1], 0
je 0x18000537b
mov rcx, qword [rcx + 8]
mov r9d, 2
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x180005389
xor eax, eax
add rsp, 0x70
pop rsi
ret
mov eax, dword [rcx + 0x20]
mov dword [rcx + 0x24], eax
cmp byte [rsi], 0
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x58], rdi
je 0x1800053c3
cmp byte [rsi + 1], 0
je 0x1800053bf
mov rcx, qword [rsi + 8]
mov r9d, 1
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebp, eax
sub ebp, dword [rsi + 0x14]
jmp 0x1800053c6
xor ebp, ebp
jmp 0x1800053c6
mov ebp, dword [rsi + 0x24]
mov ebx, 0xffff
mov ecx, 0x404
mov dword [rsp + 0x88], ebp
cmp ebp, ebx
cmovb ebx, ebp
mov dword [rsp + 0x98], ebx
call fcn.1800096b8
mov rdi, rax
test rax, rax
je 0x180005589
mov qword [rsp + 0x48], r13
xor r13d, r13d
mov qword [rsp + 0x38], r15
mov r15d, 4
mov dword [rsp + 0x80], r13d
cmp ebx, r15d
jbe 0x180005574
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x40], r14
nop word [rax + rax]
lea eax, [r15 + 0x400]
mov r14d, ebp
mov r12d, ebp
cmp eax, ebx
mov r15d, eax
mov eax, 0x404
cmova r15d, ebx
sub r14d, r15d
sub r12d, r14d
cmp r12d, eax
cmova r12d, eax
cmp byte [rsi], 0
je 0x180005480
cmp byte [rsi + 1], 0
je 0x18000556a
mov eax, dword [rsi + 0x14]
mov rcx, qword [rsi + 8]
xor r9d, r9d
lea edx, [r14 + rax]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x180005484
mov dword [rsi + 0x24], r14d
cmp byte [rsi], 0
mov ebp, r12d
mov r13d, r12d
je 0x1800054c1
mov rcx, qword [rsi + 8]
lea r9, [rsp + 0x90]
mov r8d, ebp
mov rdx, rdi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1800054b8
mov byte [rsi + 0x10], 1
mov eax, dword [rsp + 0x90]
jmp 0x1800054f5
mov ecx, dword [rsi + 0x24]
mov edx, dword [rsi + 0x20]
lea eax, [rcx + r12]
cmp eax, edx
jbe 0x1800054d5
mov r13d, edx
sub r13d, ecx
mov rdx, rcx
mov r8d, r13d
mov rcx, rdi
add rdx, qword [rsi + 0x18]
call fcn.1800123b0
add dword [rsi + 0x24], r13d
mov ebx, dword [rsp + 0x98]
mov eax, r13d
xor edx, edx
div rbp
cmp rax, 1
jne 0x180005562
lea ecx, [r12 - 3]
movsxd rax, ecx
test ecx, ecx
jle 0x180005535
nop dword [rax]
dec rax
dec ecx
cmp byte [rax + rdi], 0x50
jne 0x180005530
cmp byte [rax + rdi + 1], 0x4b
jne 0x180005530
cmp byte [rax + rdi + 2], 5
jne 0x180005530
cmp byte [rax + rdi + 3], 6
je 0x18000554f
test rax, rax
jg 0x180005510
mov r13d, dword [rsp + 0x80]
mov ebp, dword [rsp + 0x88]
cmp r15d, ebx
jb 0x180005430
jmp 0x18000556a
lea r13d, [rcx + r14]
mov dword [rsp + 0x80], r13d
test r13d, r13d
jne 0x18000556a
jmp 0x18000553d
mov r13d, dword [rsp + 0x80]
mov r12, qword [rsp + 0x50]
mov r14, qword [rsp + 0x40]
mov rcx, rdi
call fcn.180009420
mov r15, qword [rsp + 0x38]
mov eax, r13d
mov r13, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x58]
add rsp, 0x70
pop rsi
ret
Function at 0x1800066c0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x20
cmp qword [rcx], 0
mov esi, r8d
mov rbp, rdx
mov rbx, rcx
jne 0x180006757
cmp dword [rcx + 8], 0xffffffff
jne 0x180006757
mov qword [rsp + 0x38], rdi
lea rdi, [rcx + 0x13c]
mov ecx, 0x104
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
mov eax, dword [0x18001a420]
mov dword [rdi - 2], eax
xor edi, edi
lea ecx, [rdi + 0x28]
mov qword [rsp + 0x30], rdi
call fcn.18000a0ac
mov rcx, rax
mov word [rax], 0x100
mov qword [rax + 0x18], rbp
mov dword [rax + 0x20], esi
mov dword [rax + 0x24], edi
mov dword [rax + 0x14], edi
call fcn.1800055a0
mov rdi, qword [rsp + 0x38]
mov qword [rbx], rax
mov eax, dword [0x18001f660]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov eax, 0x1000000
add rsp, 0x20
pop rsi
ret
Function at 0x180007040
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x18001d050]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov esi, dword [0x180052fe0]
mov rbp, qword [0x1800531f8]
mov rdi, rcx
mov ecx, 0x1f4
mov dword [rsp + 0x40], 0x10
call fcn.1800096b8
xor edx, edx
mov r8d, 0x1f4
mov rcx, rax
mov rbx, rax
call fcn.18000c400
lea r8, str.Microsoft_Base_Cryptographic_Provider_v1.0
lea rcx, [rsp + 0x30]
mov r9d, 1
xor edx, edx
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x1800070dd
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CryptAcquireContext_failed:__d_n
mov edx, eax
mov ebx, eax
call fcn.180009460
mov dword [rdi], ebx
xor eax, eax
jmp 0x180007214
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8003
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x18000712d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CryptCreateHash_failed:__d_n
mov edx, eax
mov ebx, eax
call fcn.180009460
mov rcx, qword [rsp + 0x30]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [rdi], ebx
xor eax, eax
jmp 0x180007214
mov rcx, qword [rsp + 0x38]
xor r9d, r9d
mov r8d, esi
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x18000717c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CryptHashData_failed:__d_n
mov edx, eax
mov ebx, eax
call fcn.180009460
mov rcx, qword [rsp + 0x30]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov dword [rdi], ebx
xor eax, eax
jmp 0x180007214
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x48]
mov edx, 2
mov dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
jne 0x1800071b1
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CryptGetHashParam_failed:__d_n
jmp 0x180007152
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x1800071f9
lea r8, [rsp + 0x48]
mov rdx, rbx
mov r9d, eax
lea r10, str.0123456789abcdef
nop dword [rax + rax]
movzx ecx, byte [r8]
add rdx, 2
inc r8
mov eax, ecx
and ecx, 0xf
shr rax, 4
dec r9
movzx eax, byte [rax + r10]
mov byte [rdx - 2], al
movzx eax, byte [rcx + r10]
mov byte [rdx - 1], al
jne 0x1800071d0
mov rcx, qword [rsp + 0x30]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rax, rbx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180009400
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1800092e0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov edx, 0x104
mov ecx, 0x40
mov rbx, r8
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdx, rax
sub rdx, rbx
nop
movzx ecx, word [rbx]
add rbx, 2
mov word [rdx + rbx - 2], cx
test cx, cx
jne 0x180009300
xor ecx, ecx
lea r8, [0x180008ed0]
mov r9, rax
mov qword [rsp + 0x28], rcx
xor edx, edx
mov dword [rsp + 0x20], ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
or edx, 0xffffffff
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp rbx, 0xffffffffffffffff
je 0x18000934c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x30
pop rbx
ret

Function at 0x180009360
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
dec edx
mov rbx, r8
jne 0x1800093dc
test rbx, rbx
je 0x1800093dc
mov edx, 0x104
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdx, rax
sub rdx, rbx
nop dword [rax + rax]
movzx ecx, word [rbx]
add rbx, 2
mov word [rdx + rbx - 2], cx
test cx, cx
jne 0x180009390
xor ecx, ecx
lea r8, [0x180008ed0]
mov r9, rax
mov qword [rsp + 0x28], rcx
xor edx, edx
mov dword [rsp + 0x20], ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
or edx, 0xffffffff
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp rbx, 0xffffffffffffffff
je 0x1800093dc
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x30
pop rbx
ret

Function at 0x18000a9a8
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.18000a818
Function at 0x18000ad4f
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x18001d050]
jne 0x18000941a
rol rcx, 0x10
test cx, 0xffff
jne 0x180009416
repz ret
ror rcx, 0x10
jmp 0x18000aca8
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x18001e5c0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x18001e6b8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x18000ad2d
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x18001e5c0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x18000ad4f
mov rax, qword [rsp + 0x88]
mov qword [0x18001e6b8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x18001e658], rax
mov rax, qword [0x18001e6b8]
mov qword [0x18001e530], rax
mov rax, qword [rsp + 0x90]
mov qword [0x18001e640], rax
mov dword [0x18001e520], 0xc0000409
mov dword [0x18001e524], 1
mov rax, qword [0x18001d050]
mov qword [rsp + 0x68], rax
mov rax, qword [0x18001d058]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x18001e5b8], eax
mov ecx, 1
call fcn.180010904
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x180016438]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x18001e5b8], 0
jne 0x18000add6
mov ecx, 1
call fcn.180010904
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x180011a30
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x18001d050]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.18000d380
xor ebx, ebx
cmp qword [0x18001f568], rbx
mov rdi, rax
jne 0x180011b43
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x180011c1a
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180011c1a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x18001f568], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x18001f570], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x18001f578], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x18001f588], rax
test rax, rax
je 0x180011b3a
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x18001f580], rax
jmp 0x180011b4a
mov rax, qword [0x18001f580]
jmp 0x180011b51
mov rax, qword [0x18001f580]
mov r11, qword [0x18001f588]
cmp rax, rdi
je 0x180011bb8
cmp r11, rdi
je 0x180011bb8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x18001f588]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x180011bb8
test rax, rax
je 0x180011bb8
call rsi
test rax, rax
je 0x180011bb2
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x180011bb2
test byte [rsp + 0x40], 1
jne 0x180011bb8
bts ebp, 0x15
jmp 0x180011bf8
mov rcx, qword [0x18001f570]
cmp rcx, rdi
je 0x180011bf8
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x180011bf8
call rax
mov rbx, rax
test rax, rax
je 0x180011bf8
mov rcx, qword [0x18001f578]
cmp rcx, rdi
je 0x180011bf8
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x180011bf8
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x18001f568]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x180011c1a
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x180011c1c
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180009400
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x402020
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
mov eax, 0x1068
call fcn.00404870
sub rsp, rax
mov rsi, rcx
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x20]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 0
lea r14, [rsp + 0x68]
lea rcx, [0x00425010]
call sub.KERNEL32.dll_AcquireSRWLockExclusive
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], rax
lea rdi, [rsp + 0x40]
mov qword [rsp + 0x48], rdi
lea rax, [fcn.004037b0]
mov qword [rsp + 0x50], rax
xor r12d, r12d
lea r15, str.error:_s_n
lea rbx, [rsp + 0x30]
nop dword [rax]
lea r8, [r15 + r12]
mov r9d, 7
sub r9, r12
mov rcx, rbx
mov rdx, rdi
call fcn.004037b0
cmp word [rsp + 0x38], 0
jne 0x4020e8
add r12, qword [rsp + 0x30]
cmp r12, 7
jne 0x4020a0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
lea r8, [0x004216c8]
lea r9, [rsp + 0x48]
call fcn.00403a90
test ax, ax
je 0x402106
lea rcx, [0x00425010]
call fcn.00420530
nop
add rsp, 0x1068
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xor ebx, ebx
lea rsi, [rsp + 0x30]
lea rdi, [rsp + 0x40]
nop word cs:[rax + rax]
nop dword [rax]
lea r8, [rbx + r15]
add r8, 0xa
mov r9d, 1
sub r9, rbx
mov rcx, rsi
mov rdx, rdi
call fcn.004037b0
cmp word [rsp + 0x38], 0
jne 0x4020e8
add rbx, qword [rsp + 0x30]
cmp rbx, 1
jne 0x402120
mov rbx, qword [rsp + 0x60]
test rbx, rbx
je 0x4021a5
mov rsi, qword [rsp + 0x58]
xor r15d, r15d
mov r12d, 0xffffffff
lea rdi, [rsp + 0x30]
nop dword [rax]
lea rdx, [r14 + r15]
mov r8, rbx
sub r8, r15
cmp r8, r12
cmovae r8, r12
mov qword [rsp + 0x20], 0
mov rcx, rsi
mov r9, rdi
call sub.KERNEL32.dll_WriteFile
test eax, eax
je 0x4021b3
mov eax, dword [rsp + 0x30]
add r15, rax
cmp r15, rbx
jne 0x402170
mov qword [rsp + 0x60], 0
jmp 0x4020e8
call sub.KERNEL32.dll_GetLastError
jmp 0x4020e8
Function at 0x4037b0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rdi, r9
mov rsi, rcx
mov r12, qword [rdx]
mov r13, qword [r12 + 8]
lea rax, [r9 + r13]
cmp rax, 0x1000
jbe 0x4038a9
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x30], rsi
test r13, r13
je 0x403849
lea rbp, [r12 + 0x10]
mov r14, qword [r12]
xor esi, esi
mov ebx, 0xffffffff
lea r15, [rsp + 0x38]
nop word cs:[rax + rax]
nop dword [rax]
lea rdx, [rsi + rbp]
mov r8, r13
sub r8, rsi
cmp r8, rbx
cmovae r8, rbx
mov qword [rsp + 0x20], 0
mov rcx, r14
mov r9, r15
call sub.KERNEL32.dll_WriteFile
test eax, eax
je 0x4038cb
mov eax, dword [rsp + 0x38]
add rsi, rax
cmp rsi, r13
jne 0x403810
mov qword [r12 + 8], 0
cmp rdi, 0x1001
jb 0x40389c
mov rcx, qword [r12]
mov r8d, 0xffffffff
cmp rdi, r8
cmovb r8, rdi
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x3c]
mov rdx, qword [rsp + 0x40]
call sub.KERNEL32.dll_WriteFile
test eax, eax
je 0x403928
mov edi, dword [rsp + 0x3c]
xor eax, eax
mov rsi, qword [rsp + 0x30]
jmp 0x403a5e
xor r13d, r13d
mov rsi, qword [rsp + 0x30]
mov r8, qword [rsp + 0x40]
lea rcx, [r12 + r13]
add rcx, 0x10
add r13, rdi
mov rdx, r8
mov r8, rdi
call fcn.0041cf90
mov qword [r12 + 8], r13
xor eax, eax
jmp 0x403a5e
call sub.KERNEL32.dll_GetLastError
movzx ecx, ax
mov ax, 2
cmp ecx, 0x6c
jg 0x4038fd
cmp ecx, 0x20
mov rsi, qword [rsp + 0x30]
jg 0x40395e
cmp ecx, 6
je 0x4039cb
cmp ecx, 8
je 0x40398d
jmp 0x403a5e
cmp ecx, 0x6f7
mov rsi, qword [rsp + 0x30]
jg 0x403979
cmp ecx, 0x6d
je 0x4039d4
cmp ecx, 0x3e3
jne 0x403a5e
mov ax, 0xc
jmp 0x403a5e
call sub.KERNEL32.dll_GetLastError
movzx ecx, ax
mov ax, 2
cmp ecx, 0x6c
mov rsi, qword [rsp + 0x30]
jg 0x403996
cmp ecx, 0x20
jg 0x4039dd
cmp ecx, 6
je 0x403a21
cmp ecx, 8
je 0x403a0c
jmp 0x403a5e
cmp ecx, 0x21
je 0x403a5a
cmp ecx, 0x40
jne 0x403a5e
mov ax, 0x10
jmp 0x403a5e
cmp ecx, 0x718
je 0x40398d
cmp ecx, 0x6f8
jne 0x403a5e
mov ax, 0xb
jmp 0x403a5e
cmp ecx, 0x6f7
jg 0x4039fc
cmp ecx, 0x6d
je 0x403a36
cmp ecx, 0x3e3
jne 0x403a5e
mov word [rsp + 0x2c], 0
mov dword [rsp + 0x28], 0
mov ax, 0xc
jmp 0x403a5e
mov ax, 0xd
jmp 0x403a5e
mov ax, 0xa
jmp 0x403a5e
cmp ecx, 0x21
je 0x403a4b
cmp ecx, 0x40
jne 0x403a5e
mov word [rsp + 0x2c], 0
mov dword [rsp + 0x28], 0
mov ax, 0x10
jmp 0x403a5e
cmp ecx, 0x6f8
je 0x403a0c
cmp ecx, 0x718
jne 0x403a5e
mov word [rsp + 0x2c], 0
mov dword [rsp + 0x28], 0
mov ax, 0xb
jmp 0x403a5e
mov word [rsp + 0x2c], 0
mov dword [rsp + 0x28], 0
mov ax, 0xd
jmp 0x403a5e
mov word [rsp + 0x2c], 0
mov dword [rsp + 0x28], 0
mov ax, 0xa
jmp 0x403a5e
mov word [rsp + 0x2c], 0
mov dword [rsp + 0x28], 0
mov ax, 0xe
mov qword [rsi], rdi
mov word [rsi + 8], ax
mov eax, dword [rsp + 0x28]
mov dword [rsi + 0xa], eax
movzx eax, word [rsp + 0x2c]
mov word [rsi + 0xe], ax
mov rax, rsi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140131f43
Capabilities:
Execute syscall

Disassembly:
insd dword [rdi], dx
mov cl, 0xc7
clc
mov word [rbp + 0x40], fs
xor eax, 0x8073d648
cmp ebx, dword [rbx]
push rdi
cmp ebx, esp
add byte [rsi - 0x46], dh
mov ch, 0xe1
jae 0x14012fbc2
mov edx, 0xfbda6c11
invalid
in al, 0xe
mov dl, 0xcd
jo 0x14012fbaa
invalid
pop rbx
cmp eax, 0xb230c09f
jnp 0x14012fb64
jns 0x14012fb46
movabs byte [0xb48b406553ff83b1], al
sbb dword [rdi + 0x35899ce], 0x22
add esp, dword [rdx]
invalid
jmp rcx
or esp, dword [rax]
mov bh, 0xdb
invalid
cmp r10, rdx
jns 0x14012fb64
inc r11
mov r15d, 0xfba13fb2
or r8d, 0xe4d6541d
jmp 0x140131a29
push r12
rcl r8d, 0x3e
nop
pause
pop rbx
lea ebp, [rdi - 0x22a1]
push r10
syscall
ret 0x18
jae 0x140131512
popfq
nop
call rax
mov r11d, 0x17650b19
jmp 0x14013209b
popf
rcr r9d, 0x5e
lea r13d, [rbp + 0x3e47]
lea esi, [rcx - 0x8bdf]
lea r9d, [rdi - 0xa7cf]
lea r8d, [rdx - 0x2362]
dec r11
jmp 0x140131e5e
mov edx, 0xffff53e9
push rsp
push rax
sbb byte [rcx - 9], cl
in eax, 0x77
xchg edi, eax
add ebp, 0x98b93624
call fcn.140132ca2
add edi, 0xffedb68b
lea r10d, [rbx - 0x3187]
lea ecx, [rdi - 0x104b]
lea esi, [rbx - 0x47aa]
jne 0x1401315cb
jno 0x140131585
nop
jmp 0x140131e73
jo 0x140130e8b
rol ebx, 0xf3
pop r13
lea r11d, [rbp - 0xd50c]
cpuid
inc r11
je 0x140131dee
jmp 0x140132156
call rcx
lea ebx, [rbp + 0x3aa2]
call rcx
jne 0x14013212f
je 0x14013212f
cmp r14, rbp
rcl r11d, 0x2a
rcr r11d, 0xd0
cmp r12, rcx
ret
jmp 0x14013225a
jne 0x140132326
mul r13
pushfq
rcr r13d, 0x5e
jmp 0x14013210c
ror ebx, 0x7e
call rcx
rcl r14d, 0xa7
rol ebx, 0x3b
rol r12d, 0x52
and r9d, 0x67d4bb88
push r12
jmp 0x140132143
jg 0x14013131c
call rcx
jmp rcx
in al, 0x44
lea ebp, [rdx + 0xc328]
add ebp, 0xcaa4876c
and edi, 0x72be13a
jmp 0x140132aa8
call rcx
ret
rol ebp, 0x8e
popfq
dec rdi
jne 0x140132acb
je 0x140132acb
rcr esi, 0xcc
jmp rax
jmp 0x1401326a2
Function at 0x140003b00
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x140003b5d
lea rbx, [0x1400c9c60]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140003b44
cmp r10, 2
jb 0x140003b44
cmp byte [r9], r8b
jne 0x140003b44
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140003b20
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x140003b9f
lea rbx, [0x1400c9c60]
cmp r8b, 0x23
jne 0x140003b83
cmp byte [r9], r8b
jne 0x140003b83
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140003b70
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140003d60
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, r8
mov rbx, rcx
test rcx, rcx
jne 0x140003d8f
mov r8d, 0x78f
lea rdx, str.C:Users_arcniDesktopSnakey_Free_SourceSnakey_Free_Sourceimgui.cpp
lea rcx, str.filename__mode
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
test rdi, rdi
je 0x140003d9b
mov qword [rdi], 0
lea rdx, [0x1400c9498]
mov rcx, rbx
call fcn.140003bb0
mov rbx, rax
test rax, rax
jne 0x140003dbd
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x140003e96
xor edx, edx
mov r8d, 2
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140003e96
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x140003e96
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140003e96
cmp rsi, 0xffffffffffffffff
je 0x140003e96
mov rax, qword [0x140130040]
test rax, rax
je 0x140003e33
inc dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbp, rax
test rax, rax
je 0x140003e96
mov r9, rbx
mov r8, rsi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rsi
je 0x140003e83
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x140130040]
test rax, rax
je 0x140003e78
dec dword [rax + 0xf4]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140003e9f
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rdi, rdi
je 0x140003e91
mov qword [rdi], rsi
mov rax, rbp
jmp 0x140003ea1
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140007540
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xe8], 0
mov rbx, rcx
movsxd rdi, edx
jg 0x140007577
mov r8d, 0x705
lea rdx, str.C:Users_arcniDesktopSnakey_Free_SourceSnakey_Free_Sourceimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [rbx + 0xf0]
lea rdx, [0x1400c9c60]
movsxd r8, dword [rbx + 0xe8]
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, dil
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x39]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3a]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3b]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [rdx + rcx*4]
mov rcx, qword [0x140130040]
not ebx
cmp dword [rcx + 0x3f18], ebx
jne 0x1400075f6
mov r8, rdi
mov edx, 4
mov ecx, ebx
call fcn.14001d490
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret