joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008a070
Capabilities:
Create directory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x60
mov rsi, qword [0x1400f5f70]
mov rcx, qword [rcx]
mov rax, qword [rsi]
mov qword [rsp + 0x58], rax
xor eax, eax
mov rbx, rdx
lea rdx, [rsp + 0x20]
call qword [sym.imp.msvcrt.dll__wstat64]
test eax, eax
je 0x140089f20
call fcn.1400be9d0
mov rdi, rax
call qword [sym.imp.msvcrt.dll__errno]
mov eax, dword [rax]
mov qword [rbx + 8], rdi
mov dword [rbx], eax
movabs rax, 0x8000000000000000
mov rdx, qword [rsp + 0x58]
sub rdx, qword [rsi]
jne 0x140089f76
add rsp, 0x60
pop rbx
pop rsi
pop rdi
ret
call fcn.1400be9c0
mov dword [rbx], 0
movabs rdx, 0x225c17d03
mov qword [rbx + 8], rax
mov rax, qword [rsp + 0x48]
cmp rax, rdx
jle 0x140089f60
call fcn.1400be9d0
mov dword [rbx], 0x84
mov qword [rbx + 8], rax
movabs rax, 0x8000000000000000
jmp 0x140089f0d
imul rax, rax, 0x3b9aca00
movabs rdx, 0xa6a8d2b340ae0000
add rax, rdx
jmp 0x140089f0d
call fcn.14000fcb0
nop
nop
nop
nop
nop
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov rsi, qword [0x1400f5f70]
mov rax, qword [rsi]
mov qword [rsp + 0x68], rax
xor eax, eax
mov rbx, rcx
mov dword [rsp + 0x30], 0
call fcn.1400be9c0
lea rdx, [rsp + 0x30]
mov rcx, rbx
mov qword [rsp + 0x38], rax
call fcn.14001fb40
mov edx, dword [rsp + 0x30]
test edx, edx
jne 0x140089fd6
mov rdx, qword [rsp + 0x68]
sub rdx, qword [rsi]
jne 0x14008a027
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov ecx, 0x30
lea rbp, [rsp + 0x40]
call fcn.1400ea580
lea rdx, str.cannot_create_directory
mov rcx, rbp
mov rdi, rax
call fcn.1400c9140
movdqu xmm0, xmmword [rsp + 0x30]
mov r8, rbx
mov rdx, rbp
mov rcx, rdi
lea r9, [rsp + 0x20]
movups xmmword [rsp + 0x20], xmm0
call fcn.14008e990
mov rcx, rbp
call fcn.1400c5990
mov rax, qword [rsp + 0x68]
sub rax, qword [rsi]
je 0x14008a031
call fcn.14000fcb0
mov rbx, rax
jmp 0x14008a052
lea r8, [0x14008ee40]
lea rdx, [0x1400f7320]
mov rcx, rdi
call fcn.1400eac40
mov rcx, rbp
mov rbx, rax
call fcn.1400c5990
mov rcx, rdi
call fcn.1400ea8e0
mov rax, qword [rsp + 0x68]
sub rax, qword [rsi]
jne 0x14008a027
mov rcx, rbx
call fcn.14000ee20
nop
nop
nop
nop
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rbx, rdx
mov rcx, qword [rcx]
call qword [sym.imp.msvcrt.dll__wmkdir]
test eax, eax
jne 0x14008a0b0
call fcn.1400be9c0
mov dword [rbx], 0
mov qword [rbx + 8], rax
mov eax, 1
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call qword [sym.imp.msvcrt.dll__errno]
mov edi, dword [rax]
cmp edi, 0x11
je 0x14008a0d8
call fcn.1400be9d0
mov dword [rbx], edi
mov qword [rbx + 8], rax
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov rdx, rbx
mov rcx, rsi
call fcn.14008df10
cmp al, 2
jne 0x14008a0bd
xor eax, eax
jmp 0x14008a0ca
Function at 0x14008db80
Capabilities:
Delete directory
Delete file

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rbx, rdx
call fcn.140089670
test al, al
je 0x14008dbce
cmp al, 0xff
je 0x14008dbe0
mov rdx, rbx
mov rcx, rsi
call fcn.14008df10
cmp al, 2
je 0x14008dbf8
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14008dc05
mov eax, dword [rbx]
test eax, eax
jne 0x14008dbce
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.1400be9c0
mov dword [rbx], esi
mov qword [rbx + 8], rax
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
call fcn.1400be9c0
mov dword [rbx], 0
mov qword [rbx + 8], rax
jmp 0x14008dbce
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x14008dba8
call fcn.1400be9c0
mov dword [rbx], 0
mov qword [rbx + 8], rax
mov eax, 1
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x14008dd20
Capabilities:
Move file

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rsi, rdx
mov rbp, rcx
mov rdx, r8
mov rbx, r8
mov rcx, rsi
call fcn.14008df10
mov rdi, rax
cmp al, 0xff
je 0x14008dd80
mov ecx, dword [rbx]
test ecx, ecx
jne 0x14008dd73
test al, al
jne 0x14008dd98
mov rdx, qword [rsi]
mov rcx, qword [rbp]
mov r8d, 3
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x14008dde0
call fcn.1400be9c0
mov dword [rbx], 0
mov qword [rbx + 8], rax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
call fcn.1400be9c0
mov dword [rbx], 0
mov qword [rbx + 8], rax
jmp 0x14008dd4d
mov rdx, rbx
mov rcx, rbp
call fcn.14008df10
mov edx, dword [rbx]
test edx, edx
jne 0x14008dd73
cmp dil, 2
je 0x14008ddc8
cmp al, 2
jne 0x14008dd4d
call fcn.1400be9d0
mov dword [rbx], 0x14
mov qword [rbx + 8], rax
jmp 0x14008dd73
cmp al, 2
je 0x14008dd4d
call fcn.1400be9d0
mov dword [rbx], 0x15
mov qword [rbx + 8], rax
jmp 0x14008dd73
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [sym.imp.msvcrt.dll__errno]
cmp eax, 5
je 0x14008de15
call rdi
mov dword [rax], 5
call fcn.1400be9d0
mov rsi, rax
call rdi
mov eax, dword [rax]
mov qword [rbx + 8], rsi
mov dword [rbx], eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
call rdi
mov dword [rax], 0xd
jmp 0x14008ddfa
Function at 0x14009cea0
Capabilities:
Read file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbp, qword [sym.imp.msvcrt.dll__read]
mov r12, qword [sym.imp.msvcrt.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
mov rcx, rdi
call fcn.14009ccb0
mov r8d, ebx
mov rdx, rsi
mov ecx, eax
call rbp
movsxd r13, eax
cmp eax, 0xffffffff
je 0x14009cef0
mov rax, r13
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
call r12
cmp dword [rax], 4
je 0x14009cec3
mov rax, r13
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x1400e23d0
Capabilities:
Encode data using xor

Disassembly:
mov r11, rdx
mov rax, rcx
mov r10, rdx
and r11, 0xfffffffffffffff8
add r11, rcx
movabs rcx, 0xc6a4a7935bd1e995
imul r10, rcx
xor r10, r8
cmp rax, r11
je 0x1400e2428
nop word cs:[rax + rax]
mov r9, qword [rax]
add rax, 8
imul r9, rcx
mov r8, r9
shr r8, 0x2f
xor r8, r9
imul r8, rcx
xor r8, r10
mov r10, r8
imul r10, rcx
cmp r11, rax
jne 0x1400e2400
and edx, 7
je 0x1400e245d
sub edx, 1
movsxd rax, edx
xor edx, edx
nop dword [rax]
movzx ecx, byte [r11 + rax]
shl rdx, 8
sub rax, 1
add rdx, rcx
test eax, eax
jns 0x1400e2438
xor rdx, r10
movabs r10, 0xc6a4a7935bd1e995
imul r10, rdx
movabs rax, 0xc6a4a7935bd1e995
mov rdx, r10
shr rdx, 0x2f
xor rdx, r10
imul rdx, rax
mov rax, rdx
shr rax, 0x2f
xor rax, rdx
ret

Function at 0x140001000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
lea rcx, str._JAVA_LAUNCHER_DEBUG
call qword [sym.imp.MSVCR100.dll_getenv]
test rax, rax
je 0x140001066
lea rcx, str.Windows_original_main_args:_n
call qword [sym.imp.MSVCR100.dll_printf]
mov rax, qword [sym.imp.MSVCR100.dll___argc]
xor ebx, ebx
cmp dword [rax], ebx
jle 0x140001066
xor edi, edi
mov rax, qword [sym.imp.MSVCR100.dll___argv]
lea rcx, str.wwwd_args__d____s_n
mov edx, ebx
mov r8, qword [rax]
mov r8, qword [r8 + rdi]
call qword [sym.imp.MSVCR100.dll_printf]
mov rax, qword [sym.imp.MSVCR100.dll___argc]
inc ebx
add rdi, 8
cmp ebx, dword [rax]
jl 0x140001038
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
call sub.jli.dll_JLI_CmdToArgs
call sub.jli.dll_JLI_GetStdArgc
movsxd rdi, eax
lea ecx, [rdi + 1]
movsxd rcx, ecx
shl rcx, 3
call sub.jli.dll_JLI_MemAlloc
mov rbx, rax
call sub.jli.dll_JLI_GetStdArgs
xor r9d, r9d
xor edx, edx
test edi, edi
jle 0x1400010b2
mov r9d, edi
mov rcx, qword [rax]
add rax, 0x10
mov qword [rbx + rdx*8], rcx
inc rdx
cmp rdx, rdi
jl 0x14000109f
mov rcx, qword [str.java]
movsxd rax, r9d
and qword [rbx + rax*8], 0
test rcx, rcx
jne 0x1400010c9
mov rcx, qword [rbx]
mov rax, qword [str.java]
test rax, rax
jne 0x1400010d8
mov rax, qword [rbx]
and dword [rsp + 0x68], 0
mov byte [rsp + 0x60], 0
mov byte [rsp + 0x58], 0
mov byte [rsp + 0x50], 1
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
lea rax, [0x140002250]
mov r8d, 2
lea r9, str._J_ms8m
mov qword [rsp + 0x38], rax
lea rax, [0x140002240]
mov rdx, rbx
mov qword [rsp + 0x30], rax
lea rax, str._lib_tools.jar
mov ecx, edi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r8d
call sub.jli.dll_JLI_Launch
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x1412c1058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1412c11df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1412c1089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1412c106f
add dl, dl
jne 0x1412c1096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1412c10f6
xor eax, eax
add dl, dl
jne 0x1412c10a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1412c11ad
add dl, dl
jne 0x1412c10b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1412c10c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1412c10d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1412c10dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1412c10ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1412c107e
mov eax, 1
add dl, dl
jne 0x1412c1106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1412c1113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1412c10fb
sub eax, ebx
mov ebx, 1
jne 0x1412c114c
mov ecx, 1
add dl, dl
jne 0x1412c112e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1412c113b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1412c1123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1412c107e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1412c1168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1412c1175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1412c115d
cmp eax, 0x7d00
jae 0x1412c119b
cmp eax, 0x500
jb 0x1412c1196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1412c107e
cmp eax, 0x7f
ja 0x1412c119e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1412c107e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1412c11d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1412c107e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14000147f
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x14001e4e0]
mov dword [rax], 1
mov rax, qword [0x14001e4f0]
mov dword [rax], 1
mov rax, qword [0x14001e500]
mov dword [rax], 1
mov rax, qword [0x14001e4a0]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400014d0
mov eax, 0
jmp 0x14000157d
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400014fc
mov eax, 0
jmp 0x14000157d
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x140001522
cmp eax, 0x20b
je 0x140001549
jmp 0x140001578
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x140001535
mov eax, 0
jmp 0x14000157d
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x14000157d
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x140001564
mov eax, 0
jmp 0x14000157d
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x14000157d
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140002134
Capabilities:
Write file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rbp, qword [sym.imp.ucrtbase.dll___acrt_iob_func]
xor ebx, ebx
mov rsi, rcx
mov rdi, rdx
lea r12, [rsp + 0x20]
mov ecx, 1
cmp rbx, rdi
jl 0x140002191
call rbp
mov r8d, 1
mov edx, 1
lea rcx, [0x14001d1bc]
mov r9, rax
call sub.ucrtbase.dll_fwrite
mov ecx, 1
call rbp
mov rcx, rax
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp 0x14001b398
call rbp
xor r8d, r8d
mov rdx, r12
mov rcx, rax
mov rax, rbx
shl rax, 4
movups xmm0, xmmword [rsi + rax]
movaps xmmword [rsp + 0x20], xmm0
call fcn.14000200e
mov rax, qword [0x14001e610]
cmp byte [rax], 0
jne 0x1400021c2
inc rbx
jmp 0x140002152
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x1400022d0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
xor r8d, r8d
mov rsi, rcx
mov rbx, rdx
test rdx, rdx
je 0x1400022ef
mov rcx, rdx
call sub.ucrtbase.dll_strlen
mov r8, rax
mov rcx, rbx
mov r9, rsi
mov edx, 1
call sub.ucrtbase.dll_fwrite
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp 0x14001b398

Function at 0x14000343b
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov qword [rsp + 0x28], rdx
mov rsi, rcx
mov ecx, 2
call qword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov r8, qword [rsp + 0x28]
mov rcx, rsi
mov edx, 1
mov rbx, rax
mov r9, rax
call sub.ucrtbase.dll_fwrite
mov rcx, rbx
add rsp, 0x38
pop rbx
pop rsi
jmp 0x14001b398
jmp qword [sym.imp.ucrtbase.dll_fflush]
Function at 0x14000347a
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
cmp qword [0x1400230e8], 0
jne 0x140003490
add rsp, 0x40
pop rbx
jmp fcn.14000343b
lea rbx, [rsp + 0x30]
mov rdx, rcx
mov rcx, rbx
call fcn.1400033b4
movaps xmm0, xmmword [rsp + 0x30]
lea rcx, [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm0
call qword [0x1400230e8]
mov rcx, rbx
call fcn.140002333
cmp byte [0x1400230c0], 0
je 0x1400034e9
mov rax, qword [0x1400230f0]
lea rcx, [0x1400230f0]
mov byte [0x1400230c0], 0
mov rdx, qword [rax + 0x38]
add rsp, 0x40
pop rbx
jmp fcn.140002705
add rsp, 0x40
pop rbx
ret

Function at 0x1400035c8
Capabilities:
Terminate process

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [sym.imp.ucrtbase.dll___acrt_iob_func]
lea rsi, [0x14001d39f]
mov rbp, qword [rcx]
mov rdi, qword [rcx + 8]
mov ecx, 2
call rbx
lea rdx, str.could_not_load:
mov rcx, rax
call fcn.1400022d0
test rbp, rbp
je 0x140003604
lea rsi, [rdi + 8]
mov ecx, 2
call rbx
mov rdx, rsi
mov rcx, rax
call fcn.1400022d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xc1
jne 0x140003639
mov ecx, 2
call rbx
lea rdx, str._n_bad_format__library_may_be_wrong_architecture_
mov rcx, rax
call fcn.1400022d0
mov ecx, 2
call rbx
lea rdx, [0x14001d3e2]
mov rcx, rax
call fcn.1400022d0
mov ecx, 1
call sub.ucrtbase.dll_exit
nop

Function at 0x14000365a
Capabilities:
Terminate process

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov rsi, rcx
mov ecx, 2
call rbx
lea rdx, str.could_not_import:
mov rcx, rax
call fcn.1400022d0
mov ecx, 2
call rbx
mov rdx, rsi
mov rcx, rax
call fcn.1400022d0
mov ecx, 2
call rbx
lea rdx, [0x14001d3e2]
mov rcx, rax
call fcn.1400022d0
mov ecx, 1
call sub.ucrtbase.dll_exit
nop
Function at 0x140005aa8
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
xor esi, esi
lea rdi, str.ntdll.dll
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rbx, qword [rax + 0x10]
xor eax, eax
mov rbp, qword [rbx + 0x30]
test rbp, rbp
je 0x140005b39
movsxd rax, dword [rbp + 0x3c]
add rax, rbp
jo 0x140005af6
movsxd rax, dword [rax + 0x88]
test eax, eax
je 0x140005b19
add rax, rbp
jno 0x140005b0b
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.1400023a0
movsxd rcx, dword [rax + 0xc]
mov rsi, rax
add rcx, rbp
jno 0x140005b21
jmp 0x140005af6
mov rbx, qword [rbx]
mov rax, rbp
jmp 0x140005ad4
cmp rcx, rdi
je 0x140005b3c
test rcx, rcx
je 0x140005b1c
mov rdx, rdi
call sub.ucrtbase.dll_strcmp
test eax, eax
jne 0x140005b1c
jmp 0x140005b3c
mov rbp, rax
movsxd rdi, dword [rsi + 0x1c]
mov r14d, dword [rsi + 0x18]
add rdi, rbp
jo 0x140005af6
movsxd rax, dword [rsi + 0x20]
add rax, rbp
jo 0x140005af6
movsxd rsi, dword [rsi + 0x24]
mov ebx, dword [rax]
add rsi, rbp
jo 0x140005af6
mov r13, qword [0x14001e610]
xor r12d, r12d
mov r15d, 0x80000000
cmp r12d, r14d
jle 0x140005bb6
xor eax, eax
mov r9d, 1
lea r8, [rsp + 0x50]
mov rdx, qword [0x14002afb0]
mov qword [rsp + 0x68], rax
lea rax, [0x1400059c0]
mov qword [rsp + 0x60], rax
mov rax, qword [0x14002afb8]
movaps xmm1, xmmword [rsp + 0x60]
lea rcx, [rax + 8]
movaps xmmword [rsp + 0x50], xmm1
call fcn.14000457b
jmp 0x140005c8a
movsxd rdx, ebx
mov rax, rbp
add rax, rdx
mov qword [rsp + 0x28], rax
jo 0x140005af6
mov bx, word [rsi]
cmp byte [r13], 0
mov word [rsp + 0x36], bx
jne 0x140005c8a
test rax, rax
je 0x140005bf4
mov rcx, rax
mov qword [rsp + 0x38], rdx
call sub.ucrtbase.dll_strlen
mov rdx, qword [rsp + 0x38]
lea rbx, [rax + 1]
mov ecx, 0xffffffff
movsxd rbx, ebx
add rbx, rdx
lea rax, [rbx + r15]
cmp rcx, rax
jb 0x140005af6
mov rcx, qword [rsp + 0x28]
lea rdx, [0x14001daaa]
add rsi, 2
call fcn.140004200
cmp byte [r13], 0
jne 0x140005c8a
test al, al
je 0x140005c75
mov rcx, qword [rsp + 0x28]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x60], xmm0
call fcn.140005a63
cmp byte [r13], 0
jne 0x140005c8a
movzx edx, word [rsp + 0x36]
mov qword [rsp + 0x60], rax
lea rcx, [0x14002afb0]
mov edx, dword [rdi + rdx*4]
mov dword [rsp + 0x68], edx
movaps xmm2, xmmword [rsp + 0x60]
lea rdx, [rsp + 0x40]
movaps xmmword [rsp + 0x40], xmm2
call fcn.14000383a
cmp r12d, 0x7fffffff
je 0x140005af6
inc r12d
jmp 0x140005b6d
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140005cab
Capabilities:
Terminate process

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
xor edx, edx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x50], rdx
lea rdi, [rsp + 0x50]
mov qword [rsp + 0x58], rdx
call fcn.140005916
mov rax, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [0x14001e610]
cmp byte [rbx], 0
jne 0x140005da6
mov qword [rsp + 0x50], rax
dec rax
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x58], rsi
jle 0x140005d47
cmp qword [rsi + 8], 5
jne 0x140005d47
mov rax, qword [rsi + 0x10]
mov r8d, 5
lea rdx, [0x14001dcf8]
lea rcx, [rax + 8]
call sub.ucrtbase.dll_memcmp
test eax, eax
jne 0x140005d47
movups xmm2, xmmword [rsi + 0x18]
mov rcx, rbp
movaps xmmword [rsp + 0x20], xmm2
call fcn.1400049e2
cmp byte [rbx], 0
mov rsi, rax
jne 0x140005da6
mov rcx, rdi
call fcn.1400039c7
jmp 0x140005e0f
movsd xmm1, qword [0x14001dd00]
xorps xmm0, xmm0
xor eax, eax
mov rcx, rbp
mov qword [rsp + 0x60], rax
divsd xmm1, xmm0
mov qword [rsp + 0x68], rax
call fcn.140001c85
cmp byte [rbx], 0
mov rdx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x28]
jne 0x140005d9c
mov qword [rsp + 0x60], rdx
lea rcx, [rsp + 0x40]
mov edx, 1
mov qword [rsp + 0x68], rax
movaps xmm3, xmmword [rsp + 0x60]
movaps xmmword [rsp + 0x40], xmm3
call fcn.140002134
lea rcx, [rsp + 0x60]
call fcn.140002333
mov rcx, rdi
xor esi, esi
call fcn.1400039c7
cmp byte [rbx], 0
je 0x140005e0f
mov rax, qword [0x14001e600]
mov rax, qword [rax]
mov rax, qword [rax]
mov rdi, qword [rax + 0x18]
test rdi, rdi
je 0x140005e0f
mov rcx, rdi
call sub.ucrtbase.dll_strlen
cmp rax, 0x2c
jbe 0x140005e0f
lea rcx, [rdi + rax - 0x2d]
mov r8d, 0x2d
lea rdx, str.ValueErrorCatchableErrorExceptionRootObj
call sub.ucrtbase.dll_memcmp
test eax, eax
jne 0x140005e0f
lea rcx, [0x14001dca0]
mov edx, 1
mov byte [rbx], 0
call fcn.140002134
xor ecx, ecx
call sub.ucrtbase.dll_exit
mov rax, rsi
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x140005e1b
Capabilities:
Execute syscall

Disassembly:
push rcx
push rdx
push r8
push r9
sub rsp, 0x20
mov rcx, 0xdc07230
call fcn.1400059d2
add rsp, 0x20
pop r9
pop r8
pop rdx
pop rcx
mov r10, rcx
syscall
ret

Function at 0x140005e43
Capabilities:
Execute syscall

Disassembly:
push rcx
push rdx
push r8
push r9
sub rsp, 0x20
mov rcx, 0x2421bd37
call fcn.1400059d2
add rsp, 0x20
pop r9
pop r8
pop rdx
pop rcx
mov r10, rcx
syscall
ret

Function at 0x140005e6b
Capabilities:
Execute syscall

Disassembly:
push rcx
push rdx
push r8
push r9
sub rsp, 0x20
mov rcx, 0xd0d9f24
call fcn.1400059d2
add rsp, 0x20
pop r9
pop r8
pop rdx
pop rcx
mov r10, rcx
syscall
ret

Function at 0x140005e93
Capabilities:
Execute syscall

Disassembly:
push rcx
push rdx
push r8
push r9
sub rsp, 0x20
movabs rcx, 0xdb05a7f6
call fcn.1400059d2
add rsp, 0x20
pop r9
pop r8
pop rdx
pop rcx
mov r10, rcx
syscall
ret
Function at 0x1400141c0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.ucrtbase.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.ucrtbase.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.ucrtbase.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.14001af80
call sub.ucrtbase.dll_abort
nop

Function at 0x140014e92
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x14002b088]
test eax, eax
je 0x140014f2a
lea rax, [0x14002b060]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x14002b090]
mov qword [rbp - 8], rax
jmp 0x140014f0e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x140014f02
cmp qword [rbp - 0x10], 0
je 0x140014f02
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140014ec8
lea rax, [0x14002b060]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x140014f2b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x140015030
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x140015058
mov eax, 0
jmp 0x1400150a6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140015081
mov eax, 0
jmp 0x1400150a6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x1400150a1
mov eax, 0
jmp 0x1400150a6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x1400150ac
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x14001512a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x140015121
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x140015121
mov rax, qword [rbp - 8]
jmp 0x14001513f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x1400150f4
mov eax, 0
add rsp, 0x20
pop rbp
ret