joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140093ff0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov r10d, 0xffffffff
lea r8, [0x1400c7a29]
mov ecx, r10d
lea rbx, [0x1400c2290]
movaps xmm5, xmm3
mov r11, rdx
mov r9b, 0x23
nop word [rax + rax]
cmp r9b, 0x23
jne 0x140094033
cmp byte [r8], r9b
jne 0x140094033
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [rbx + rdx*4]
test r9b, r9b
jne 0x140094020
not ecx
call fcn.140012c40
xor edi, edi
test rax, rax
je 0x14009406a
cmp word [rax + 0xba], di
jne 0x140094110
mov rcx, qword [0x140128c20]
test r11, r11
jne 0x140094080
mov rax, qword [rcx + 0x4878]
mov r11, qword [rax]
movss xmm1, dword [r11 + 0xa8]
xorps xmm3, xmm3
movss xmm0, dword [r11 + 0xc]
movaps xmm4, xmm1
addss xmm4, dword [r11 + 4]
movss xmm2, dword [r11 + 0xac]
subss xmm0, xmm1
addss xmm2, dword [r11 + 8]
addss xmm0, dword [r11 + 0xb0]
or dword [rcx + 0x4778], 3
mov qword [rcx + 0x4790], rdi
mov dword [rcx + 0x477c], 1
mov dword [rcx + 0x4780], 1
maxss xmm3, xmm0
movaps xmm0, xmm4
unpcklps xmm0, xmm2
movsd qword [rcx + 0x4788], xmm0
addss xmm3, xmm4
subss xmm3, xmm4
unpcklps xmm3, xmm5
movsd qword [rcx + 0x4798], xmm3
addss xmm5, dword [r11 + 0xac]
movss dword [r11 + 0xac], xmm5
xorps xmm1, xmm1
mov ecx, 3
call fcn.14000afd0
mov rbx, qword [0x140128c20]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 5
movss xmm1, dword [rbx + 0x37f8]
lea rcx, [rbx + 0x47f8]
movss xmm0, dword [rbx + 0x37fc]
movss dword [rsp + 0x24], xmm1
movss dword [rsp + 0x28], xmm0
call fcn.14002e5e0
xor edx, edx
mov qword [rbx + 0x37f8], rdi
mov r8d, 0x50f
lea rcx, str.MainMenuBar
call fcn.140015420
mov ecx, 2
movzx ebx, al
call fcn.14000b0e0
movzx eax, bl
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140096b50
Capabilities:
Hash data with crc32

Disassembly:
push rdi
sub rsp, 0x20
test dword [rcx + 0x10], 0x100000
mov rdi, rdx
je 0x140096bdc
movzx r9d, byte [rdx]
lea r8, [rdx + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x140096bb0
lea r11, [0x1400c2290]
nop
cmp r9b, 0x23
jne 0x140096b93
cmp byte [r8], r9b
jne 0x140096b93
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140096b80
mov rcx, qword [0x140128c20]
not eax
cmp dword [rcx + 0x3f00], eax
jne 0x140096bc7
mov dword [rcx + 0x3f04], eax
cmp dword [rcx + 0x3f30], eax
jne 0x140096c36
mov byte [rcx + 0x3f34], 1
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbx
xor edx, edx
mov rbx, qword [0x140128c20]
mov rcx, rdi
mov qword [rsp + 0x38], rsi
mov r8, qword [rbx + 0x3ea0]
movsxd rax, dword [r8 + 0xe8]
mov r8, qword [r8 + 0xf0]
mov r8d, dword [r8 + rax*4 - 4]
call fcn.140008ee0
cmp dword [rbx + 0x3ee8], eax
mov esi, eax
mov rbx, qword [rsp + 0x30]
jne 0x140096c2f
mov r8, rdi
mov edx, 0xb
mov ecx, eax
call fcn.14002d420
mov eax, esi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400a11e8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400a1232
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400a1232
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400a1232
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400a1232
cmp dword [rcx + 0x84], 0xe
jbe 0x1400a1232
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400a1234
xor al, al
add rsp, 0x28
ret
Function at 0x180001050
Capabilities:
Create process memory minidump
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
lea rcx, [0x1800011b0]
call qword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
xor esi, esi
lea rcx, str.crash.dmp
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x4c], esi
mov qword [rsp + 0x44], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
xor r9d, r9d
mov qword [rsp + 0x20], rcx
mov r8, rdi
mov rcx, rax
mov edx, ebx
call qword [sym.imp.dbghelp.dll_MiniDumpWriteDump]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 0x40010
lea r8, str.Game_crash
lea rdx, str.The_game_has_crashed._ncrash.dmp_was_generated.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0x1337
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x180003680
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
mov r8d, 0x20a
lea rdx, [0x18007eb90]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, 0x20a
je 0x1800036d3
test eax, eax
je 0x1800036e0
call fcn.180001020
lea r8, str.dbdata
mov edx, 7
lea rcx, [rax + 2]
call fcn.18000a630
lea rcx, [0x18007eb90]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1800036ed
add rsp, 0x28
ret
lea rcx, str.Your_game_path_is_too_long__Please_shorten_it.
call fcn.1800034f0
int3
lea rcx, str.Could_not_get_current_file_path_
call fcn.1800034f0
int3
lea rcx, str.Could_not_find_dbdata_license_file_
call fcn.1800034f0
int3
Function at 0x180003700
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, qword [0x18007eb50]
lea rdx, [0x18001ca40]
mov rdi, qword [0x18007eb80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.DeleteFileW
mov rcx, rbx
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18001ca60]
mov rcx, rbx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlAddVectoredExceptionHandler
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ZwSetContextThread
mov rcx, rdi
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ZwGetContextThread
mov rcx, rdi
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtCreateThreadEx
mov rcx, rdi
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test r12, r12
je 0x1800038bd
test rsi, rsi
je 0x1800038bd
test rbx, rbx
je 0x1800038bd
test rbp, rbp
je 0x1800038bd
test r14, r14
je 0x1800038bd
test r15, r15
je 0x1800038bd
test rax, rax
je 0x1800038bd
xor r9d, r9d
lea r8, [0x18007efd8]
lea rdx, [0x180003420]
mov rcx, r12
call fcn.180005040
xor r9d, r9d
lea r8, [0x18007eb88]
lea rdx, [0x180003490]
mov rcx, rsi
call fcn.180005040
xor r9d, r9d
lea r8, [0x18007eb68]
lea rdx, [0x1800033d0]
mov rcx, rbx
call fcn.180005040
xor r9d, r9d
lea r8, [0x18007efd0]
lea rdx, [0x1800033b0]
mov rcx, rbp
call fcn.180005040
xor r9d, r9d
lea r8, [0x18007eb58]
lea rdx, [0x180003370]
mov rcx, r14
call fcn.180005040
xor r9d, r9d
lea r8, [0x18007efb0]
lea rdx, [fcn.1800032c0]
mov rcx, r15
call fcn.180005040
xor r9d, r9d
lea r8, [0x18007efc0]
lea rdx, [0x180003030]
mov rcx, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
jmp fcn.180005040
lea rcx, str.Could_not_find_all_needed_functions_
call fcn.1800034f0
int3
Function at 0x180003960
Capabilities:
Enumerate process modules
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x6b0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x6a0], rax
mov ecx, 0x802
call fcn.18000a6ac
xor edx, edx
mov r8d, 0x802
mov rcx, rax
mov rdi, rax
call fcn.180013af0
mov r8d, 0x802
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1800039ff
mov rcx, rdi
call fcn.18000a698
add ebx, ebx
mov rax, 0xffffffffffffffff
mov ecx, ebx
add ecx, 2
cmovb rcx, rax
call fcn.18000a6ac
add ebx, 2
xor edx, edx
mov r8d, ebx
mov rcx, rax
mov rdi, rax
call fcn.180013af0
mov r8d, ebx
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x234
mov rsi, rax
call fcn.180013af0
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x180003b0c
nop dword [rax]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x28], eax
je 0x180003af6
lea rdx, [rsp + 0x4c]
mov rcx, rdi
call fcn.180001040
test rax, rax
je 0x180003af6
mov edx, dword [rsp + 0x28]
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
xor edx, edx
lea rcx, [rsp + 0x264]
mov r8d, 0x434
mov rbx, rax
call fcn.180013af0
lea rdx, [rsp + 0x260]
mov dword [rsp + 0x260], 0x438
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x180003aed
nop dword [rax]
lea r8, [rsp + 0x490]
mov rax, rdi
sub r8, rdi
nop
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x180003ad4
add rax, 2
test ecx, ecx
jne 0x180003ac0
test edx, edx
je 0x180003b42
lea rdx, [rsp + 0x260]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x180003ab0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180003a40
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call fcn.18000a698
mov rcx, qword [rsp + 0x6a0]
xor rcx, rsp
call fcn.180005dd0
lea r11, [rsp + 0x6b0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
mov ecx, 0x1337
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x180003d30
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rdi, rcx
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rsi, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
cmp rdi, 0x40000000
jbe 0x180003d7a
lea rax, [rdi - 0x40000000]
cmp rsi, rax
cmovb rsi, rax
mov rbx, qword [0x18007f020]
lea rbp, [rdi + 0x40000000]
cmp rcx, rbp
cmovbe rbp, rcx
sub rbp, 0xfff
test rbx, rbx
je 0x180003dbd
nop dword [rax + rax]
cmp rbx, rsi
jb 0x180003db5
cmp rbx, rbp
jae 0x180003db5
cmp qword [rbx + 8], 0
jne 0x180003ebf
mov rbx, qword [rbx]
test rbx, rbx
jne 0x180003da0
mov qword [rsp + 0x88], r14
mov r14d, 0x40
mov qword [rsp + 0x90], r15
mov r15, rdi
cmp rdi, rsi
jb 0x180003e23
nop dword [rax + rax]
mov r8d, dword [rsp + 0x50]
mov rdx, rsi
mov rcx, r15
call fcn.180003be0
mov r15, rax
test rax, rax
je 0x180003e1e
mov r9d, r14d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x180003e6e
cmp r15, rsi
jae 0x180003de0
jmp 0x180003e23
test rbx, rbx
jne 0x180003e6e
cmp rdi, rbp
ja 0x180003eaf
nop dword [rax]
mov r8d, dword [rsp + 0x50]
mov rdx, rbp
mov rcx, rdi
call fcn.180003c80
mov rdi, rax
test rax, rax
je 0x180003eaf
mov r9d, r14d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x180003e6e
cmp rdi, rbp
jbe 0x180003e30
jmp 0x180003eaf
xor edx, edx
lea rcx, [rbx + 0x40]
mov dword [rbx + 0x10], edx
nop word [rax + rax]
mov qword [rcx], rdx
mov rax, rcx
mov qword [rbx + 8], rcx
add r14, 0x40
add rcx, 0x40
mov rdx, rax
cmp r14, 0xfc0
jbe 0x180003e80
mov rax, qword [0x18007f020]
mov qword [rbx], rax
mov qword [0x18007f020], rbx
mov r15, qword [rsp + 0x90]
mov r14, qword [rsp + 0x88]
mov rax, rbx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180005dd0
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x180004a80
Capabilities:
Enumerate threads

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, rcx
xor esi, esi
xor edx, edx
lea ecx, [rsi + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x180004bcf
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x180004bc6
mov esi, 1
mov qword [rsp + 0x68], rbx
cmp dword [rsp + 0x20], 0x10
jb 0x180004b7c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x2c], eax
jne 0x180004b7c
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x28], eax
je 0x180004b7c
mov rdx, qword [rdi]
test rdx, rdx
jne 0x180004b3d
mov rcx, qword [0x18007efe8]
mov r8d, 0x200
mov dword [rdi + 8], 0x80
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rdi], rax
mov rdx, rax
test rax, rax
je 0x180004ba5
lea rbx, [rdi + 0xc]
jmp 0x180004b71
mov eax, dword [rdi + 8]
lea rbx, [rdi + 0xc]
cmp dword [rbx], eax
jb 0x180004b71
mov rcx, qword [0x18007efe8]
add eax, eax
mov r9d, eax
mov r8, rdx
shl r9, 2
xor edx, edx
mov dword [rdi + 8], eax
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rdx, rax
test rax, rax
je 0x180004ba5
mov qword [rdi], rax
mov ecx, dword [rbx]
mov eax, dword [rsp + 0x28]
mov dword [rdx + rcx*4], eax
inc dword [rbx]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x180004ae3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x180004bc1
mov r8, qword [rdi]
xor esi, esi
test r8, r8
je 0x180004bc1
mov rcx, qword [0x18007efe8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rdi], rsi
mov rbx, qword [rsp + 0x68]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180005dd0
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x180004bf0
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov ebp, r8d
mov qword [rcx], 0
mov r14d, edx
mov qword [rcx + 8], 0
mov rdi, rcx
call fcn.180004a80
test eax, eax
jne 0x180004c37
mov eax, 9
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rdi], 0
je 0x180004cae
mov qword [rsp + 0x30], rbx
xor ebx, ebx
cmp dword [rdi + 0xc], ebx
jbe 0x180004c96
mov qword [rsp + 0x38], rsi
nop
mov r8, qword [rdi]
xor edx, edx
mov r8d, dword [r8 + rbx*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x180004c8a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, ebp
mov edx, r14d
mov rcx, rsi
call fcn.180004940
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, dword [rdi + 0xc]
jb 0x180004c50
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rbp, qword [rsp + 0x40]
xor eax, eax
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x180004cd0
Capabilities:
Resume thread

Disassembly:
push rdi
sub rsp, 0x20
cmp qword [rcx], 0
mov rdi, rcx
je 0x180004d3f
mov qword [rsp + 0x30], rbx
xor ebx, ebx
cmp dword [rcx + 0xc], ebx
jbe 0x180004d28
mov qword [rsp + 0x38], rsi
mov r8, qword [rdi]
xor edx, edx
mov r8d, dword [r8 + rbx*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x180004d1c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, dword [rdi + 0xc]
jb 0x180004cf0
mov rsi, qword [rsp + 0x38]
mov r8, qword [rdi]
xor edx, edx
mov rcx, qword [0x18007efe8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18000e528
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x18000e558
xor eax, eax
jmp 0x18000e61b
mov rbp, rbx
cmp word [rax], si
je 0x18000e57d
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x18000e564
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x18000e560
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.18000e448
movsxd r14, eax
test eax, eax
jne 0x18000e5bb
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x18000e551
mov rcx, r14
call fcn.18000c248
mov rdi, rax
test rax, rax
jne 0x18000e5d4
xor ecx, ecx
call fcn.18000c20c
jmp 0x18000e5b0
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.18000e448
test eax, eax
jne 0x18000e605
mov rcx, rdi
call fcn.18000c20c
jmp 0x18000e60f
xor ecx, ecx
call fcn.18000c20c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x180013860
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180013888
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x180013888
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1401400c0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1401400cd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1401400dd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1401400c5
lea eax, [rcx + 1]
jmp 0x1401400eb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1401400fe
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1401400e4
sub eax, 3
jb 0x14014011e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14014016d
sar eax, 1
movsxd rbp, eax
jb 0x140140154
jmp 0x14014012c
add ebx, ebx
jne 0x14014012a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140140154
inc ecx
add ebx, ebx
jne 0x14014013a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140140154
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14014014d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14014013c
add ecx, 2
jmp 0x140140159
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140140082
jmp 0x1401400cd
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0xddc00
mov dl, 0x28
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1401401bd
cmp rsi, rcx
jae 0x1401401c5
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x1401401a4
cmp al, 0x8f
ja 0x1401401a4
cmp byte [rsi - 2], 0xf
je 0x1401401aa
sub al, 0xe8
cmp al, 1
ja 0x14014018e
cmp rsi, rcx
jae 0x1401401c5
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140140194
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1401401c5
lodsb al, byte [rsi]
jmp 0x1401401a4
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x13c000]
mov eax, dword [rdi]
or eax, eax
je 0x140140222
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x1404ec]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1401401d2
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14014021c
mov qword [rbx], rax
add rbx, 8
jmp 0x1401401f2
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14014025c
cmp al, 0xef
ja 0x14014024e
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14014022e
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x14014023d
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.1401402db], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.1401402db
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1401402cb
sub rsp, 0xffffffffffffff80
jmp 0x1400013f0
Function at 0x140004860
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x140004881
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x1400048ae
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x1400048b0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140004909
test ecx, ecx
jle 0x1400048e9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140004909
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140004909
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret