joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140011262
Capabilities:
Terminate process

Disassembly:
jmp 0x140015050
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400112fd
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400163a0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400163c0
xor al, al
jmp 0x140016441
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400163d3
xor al, al
jmp 0x140016441
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400163fd
xor al, al
jmp 0x140016441
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140016411
xor al, al
jmp 0x140016441
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140016423
xor al, al
jmp 0x140016441
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001643f
xor al, al
jmp 0x140016441
mov al, 1
add rsp, 0x38
ret
Function at 0x1800028c0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rbp, rcx
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov ebx, dword [rdx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x180002967
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x180002967
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
mov r8d, 0xb261ec3c
lea rdx, [r11 + r9*4]
mov ecx, dword [rdx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x180002962
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x180002940
cmp r8d, 0x6da6f63a
je 0x18000296c
test r9d, r9d
jne 0x180002920
mov rax, qword [rax]
jmp 0x1800028f0
mov ecx, dword [rbx + 0x24]
mov edx, dword [rbx + 0x1c]
add rcx, r10
add rdx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
mov rcx, rbp
add rax, r10
call rax
mov rcx, 0xffffffffffffffff
lea rsi, [rax + 1]
mov eax, 2
mul rsi
cmovo rax, rcx
mov rcx, rax
call fcn.1800119c0
mov rcx, qword gs:[0x60]
mov rdi, rax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax + rax]
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov r11d, dword [rdx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x180002a35
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x180002a35
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [rbx + r9*4]
mov r8d, dword [rdx + r10]
mov edx, 0x3d67443b
add r8, r10
movzx eax, byte [r8]
inc r8
test al, al
je 0x180002a30
nop
movsx eax, al
lea r8, [r8 + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [r8 - 1]
test al, al
jne 0x180002a10
cmp edx, 0x68f3f20b
je 0x180002a3a
test r9d, r9d
jne 0x1800029f0
mov rcx, qword [rcx]
jmp 0x1800029c0
mov ecx, dword [r11 + 0x24]
mov r8, rsi
add rcx, r10
mov rdx, rbp
movzx r9d, word [rcx + r9*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r10
mov eax, dword [rcx + r9*4]
mov rcx, rdi
add rax, r10
call rax
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180002a80
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov ebx, dword [rdx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x180002b27
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x180002b27
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x1c2c9696
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180002b22
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x180002b00
cmp r8d, 0xda6bcc4a
je 0x180002b2c
test r9d, r9d
jne 0x180002ae0
mov rax, qword [rax]
jmp 0x180002ab0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rcx, [rsp + 0x30]
add rax, r10
call rax
movd xmm0, dword [rsp + 0x30]
mov rax, rsi
movd xmm2, dword [rsp + 0x34]
mov rbx, qword [rsp + 0x38]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm2, xmm2
cvtps2pd xmm1, xmm0
cvtps2pd xmm0, xmm2
movsd qword [rsi], xmm1
movsd qword [rsi + 8], xmm0
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180002f40
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x110
movaps xmmword [rax - 0x18], xmm6
mov r14, r8
movaps xmmword [rax - 0x28], xmm7
mov rsi, rdx
movaps xmmword [rax - 0x38], xmm8
mov rbp, rcx
movaps xmmword [rax - 0x48], xmm9
movaps xmmword [rax - 0x58], xmm10
movaps xmmword [rax - 0x68], xmm11
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd r9, dword [r10 + 0x3c]
mov edi, dword [r9 + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x180003017
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x180003017
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xb99ab604
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180003012
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x180002ff0
cmp r8d, 0x61b68dc2
je 0x18000301c
test r9d, r9d
jne 0x180002fd0
mov rax, qword [rax]
jmp 0x180002fa0
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov rcx, rbp
add rax, r10
call rax
movsd xmm7, qword [rsi]
mov rcx, rbp
movsd xmm8, qword [rsi + 8]
addsd xmm7, qword [0x180014c48]
addsd xmm8, qword [0x180014c48]
movups xmm9, xmmword [0x180014b80]
movups xmm10, xmmword [0x18001b8a8]
movaps xmm11, xmmword [r14]
movaps xmm6, xmmword [rsi]
call fcn.1800028c0
cmp word [rax], 0
je 0x180003096
mov rcx, 0xffffffffffffffff
nop
inc rcx
cmp word [rax + rcx*2], 0
jne 0x180003080
xor edx, edx
add ecx, 1
je 0x18000309a
mov rdx, rax
jmp 0x18000309a
xor edx, edx
mov ecx, edx
mov rax, qword [0x1800178c8]
movaps xmm0, xmmword [0x180014eb0]
mov rbx, qword [0x1800178e0]
mov qword [rsp + 0x20], rax
mov rax, qword [0x18001bd58]
movsd qword [rsp + 0x38], xmm6
unpckhpd xmm6, xmm6
movsd qword [rsp + 0x40], xmm6
movsd qword [rsp + 0x80], xmm7
movsd qword [rsp + 0x88], xmm8
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x34], ecx
mov dword [rsp + 0x68], 0
mov word [rsp + 0x90], 0x100
mov byte [rsp + 0x92], 1
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm11
movups xmmword [rsp + 0x6c], xmm10
movups xmmword [rsp + 0x94], xmm9
test rax, rax
jne 0x180003148
mov rax, qword [0x180017a68]
lea r8, str.Canvas.K2_DrawText
add rax, 0x1216928
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call rax
mov qword [0x18001bd58], rax
mov r9, qword [rbx]
lea r8, [rsp + 0x20]
mov rdx, rax
mov rcx, rbx
call qword [r9 + 0x268]
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
mov rsp, r11
pop r14
ret
Function at 0x1800031a0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x110
movaps xmmword [rax - 0x18], xmm6
mov r14, r8
movaps xmmword [rax - 0x28], xmm7
mov rsi, rdx
movaps xmmword [rax - 0x38], xmm8
mov rbp, rcx
movaps xmmword [rax - 0x48], xmm9
movaps xmmword [rax - 0x58], xmm10
movaps xmmword [rax - 0x68], xmm11
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd r9, dword [r10 + 0x3c]
mov edi, dword [r9 + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x180003277
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x180003277
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xba8deba4
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180003272
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x180003250
cmp r8d, 0x2f310b62
je 0x18000327c
test r9d, r9d
jne 0x180003230
mov rax, qword [rax]
jmp 0x180003200
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov rcx, rbp
add rax, r10
call rax
movsd xmm7, qword [rsi]
mov rcx, rbp
movsd xmm8, qword [rsi + 8]
addsd xmm7, qword [0x180014c48]
addsd xmm8, qword [0x180014c48]
movups xmm9, xmmword [0x180014b80]
movups xmm10, xmmword [0x18001b8a8]
movaps xmm11, xmmword [r14]
movaps xmm6, xmmword [rsi]
call fcn.1800028c0
cmp word [rax], 0
je 0x1800032f6
mov rcx, 0xffffffffffffffff
nop
inc rcx
cmp word [rax + rcx*2], 0
jne 0x1800032e0
xor edx, edx
add ecx, 1
je 0x1800032fa
mov rdx, rax
jmp 0x1800032fa
xor edx, edx
mov ecx, edx
mov rax, qword [0x1800178c8]
movaps xmm0, xmmword [0x180014eb0]
mov rbx, qword [0x1800178e0]
mov qword [rsp + 0x20], rax
mov rax, qword [0x18001bd58]
movsd qword [rsp + 0x38], xmm6
unpckhpd xmm6, xmm6
movsd qword [rsp + 0x40], xmm6
movsd qword [rsp + 0x80], xmm7
movsd qword [rsp + 0x88], xmm8
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x34], ecx
mov dword [rsp + 0x68], 0
mov word [rsp + 0x90], 0x101
mov byte [rsp + 0x92], 1
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm11
movups xmmword [rsp + 0x6c], xmm10
movups xmmword [rsp + 0x94], xmm9
test rax, rax
jne 0x1800033a8
mov rax, qword [0x180017a68]
lea r8, str.Canvas.K2_DrawText
add rax, 0x1216928
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call rax
mov qword [0x18001bd58], rax
mov r9, qword [rbx]
lea r8, [rsp + 0x20]
mov rdx, rax
mov rcx, rbx
call qword [r9 + 0x268]
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
mov rsp, r11
pop r14
ret
Function at 0x180011200
Capabilities:
Encode data using xor

Disassembly:
lea r10, [0x180017a70]
movsxd rax, ecx
lea rcx, [rax + rax*2]
movsx r8d, byte [r10 + rcx*8 + 0x10]
mov rdx, qword [r10 + rcx*8 + 8]
mov r10, qword [r10 + rcx*8]
xor ecx, ecx
movd xmm2, r8d
punpcklbw xmm2, xmm2
punpcklwd xmm2, xmm2
pshufd xmm2, xmm2, 0
test rdx, rdx
je 0x1800112ae
cmp rdx, 0x40
jb 0x18001129a
mov r9, rdx
lea rax, [r10 + 0x20]
and r9, 0xffffffffffffffc0
nop word [rax + rax]
movdqu xmm0, xmmword [rax - 0x20]
lea rax, [rax + 0x40]
add rcx, 0x40
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rax - 0x60], xmm1
movdqu xmm0, xmmword [rax - 0x50]
xorps xmm0, xmm2
movdqu xmmword [rax - 0x50], xmm0
movdqu xmm1, xmmword [rax - 0x40]
xorps xmm1, xmm2
movdqu xmmword [rax - 0x40], xmm1
movdqu xmm0, xmmword [rax - 0x30]
xorps xmm0, xmm2
movdqu xmmword [rax - 0x30], xmm0
cmp rcx, r9
jb 0x180011250
cmp rcx, rdx
jae 0x1800112ae
lea rax, [rcx + r10]
sub rdx, rcx
xor byte [rax], r8b
lea rax, [rax + 1]
sub rdx, 1
jne 0x1800112a1
ret
Function at 0x140003c70
Capabilities:
Access peb ldr_data
Get process filename

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x68], r8
mov qword [rsp + 0x60], rdx
mov dword [rsp + 0x5c], ecx
mov rax, qword gs:[0x60]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x18]
add rax, 0x20
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x60], 0
je 0x140003d03
mov rdx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, 0
jne 0x140003d34
mov edx, dword [rsp + 0x5c]
mov rcx, qword [rsp + 0x20]
call fcn.140003d70
mov qword [rsp + 0x28], rax
cmp rax, 0
je 0x140003d2f
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x70], rax
jmp 0x140003d5a
jmp 0x140003d34
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
cmp rax, qword [rsp + 0x48]
jne 0x140003caf
mov qword [rsp + 0x70], 0
mov rax, qword [rsp + 0x70]
add rsp, 0x78
ret
Function at 0x140003d70
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x98
mov dword [rsp + 0x8c], edx
mov qword [rsp + 0x80], rcx
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x78]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140003db7
mov qword [rsp + 0x90], 0
jmp 0x140003f99
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x78]
movsxd rcx, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
cmp dword [rax], 0x4550
je 0x140003df2
mov qword [rsp + 0x90], 0
jmp 0x140003f99
mov rax, qword [rsp + 0x70]
movzx eax, word [rax + 0x14]
cmp eax, 0x60
jl 0x140003e16
mov rax, qword [rsp + 0x70]
cmp dword [rax + 0x84], 0
jne 0x140003e27
mov qword [rsp + 0x90], 0
jmp 0x140003f99
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0x88]
mov dword [rsp + 0x6c], eax
cmp dword [rsp + 0x6c], 0
jne 0x140003e52
mov qword [rsp + 0x90], 0
jmp 0x140003f99
mov rax, qword [rsp + 0x80]
mov ecx, dword [rsp + 0x6c]
add rax, rcx
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
mov ecx, dword [rcx + 0x24]
add rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
mov ecx, dword [rcx + 0x20]
add rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
mov ecx, dword [rcx + 0x1c]
add rax, rcx
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x44], 0
mov eax, dword [rsp + 0x44]
mov rcx, qword [rsp + 0x60]
cmp eax, dword [rcx + 0x18]
jae 0x140003f8d
mov rax, qword [rsp + 0x50]
mov ecx, dword [rsp + 0x44]
mov eax, dword [rax + rcx*4]
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x80]
mov ecx, dword [rsp + 0x40]
add rax, rcx
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
call fcn.140003fb0
cmp eax, dword [rsp + 0x8c]
je 0x140003f08
jmp 0x140003f7d
mov rax, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x44]
movzx eax, word [rax + rcx*2]
mov rcx, qword [rsp + 0x60]
mov ecx, dword [rcx + 0x10]
movzx ecx, cx
add eax, ecx
mov word [rsp + 0x36], ax
movzx eax, word [rsp + 0x36]
mov rcx, qword [rsp + 0x60]
mov ecx, dword [rcx + 0x10]
movzx ecx, cx
sub eax, ecx
mov word [rsp + 0x34], ax
mov dword [rsp + 0x30], 0
mov rax, qword [rsp + 0x48]
movzx ecx, word [rsp + 0x34]
mov eax, dword [rax + rcx*4]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x80]
mov ecx, dword [rsp + 0x30]
add rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x90], rax
jmp 0x140003f99
mov eax, dword [rsp + 0x44]
add eax, 1
mov dword [rsp + 0x44], eax
jmp 0x140003eb6
mov qword [rsp + 0x90], 0
mov rax, qword [rsp + 0x90]
add rsp, 0x98
ret
Function at 0x140004570
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, dword [0x140007ff0]
call fcn.1400044e0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140004440]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x140004450]
mov dword [rax], 1
mov rax, qword [0x140004460]
mov dword [rax], 1
mov rax, qword [0x1400043f0]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x140004430]
mov dword [0x14000700c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x140004500]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x1400044e0]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x1400043a0]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a

Function at 0x140001450
Capabilities:
Execute command

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
call dbg.__main
lea rax, str.start_chrome_https:__www.youtube.com_watch_vpKskW7wJ0v0__new_window
mov rcx, rax
call sym.system
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140001740
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop dword [rax]
Function at 0x140002130
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r8d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
test r8w, r8w
je 0x14000217d
lea ecx, [r8 - 1]
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp rdx, r8
jb 0x140002174
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x14000217f
add rax, 0x28
cmp rax, r9
jne 0x140002160
xor eax, eax
ret

Function at 0x140002180
Capabilities:
Parse pe header

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
call sym.strlen
cmp rax, 8
ja 0x140002210
mov rdx, qword [0x1400043f0]
xor ebx, ebx
cmp word [rdx], 0x5a4d
jne 0x1400021fe
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x1400021fe
cmp word [rax + 0x18], 0x20b
jne 0x1400021fe
movzx edx, word [rax + 0x14]
lea rbx, [rax + rdx + 0x18]
movzx edx, word [rax + 6]
test dx, dx
je 0x140002210
lea eax, [rdx - 1]
lea rax, [rax + rax*4]
lea rdi, [rbx + rax*8 + 0x28]
jmp 0x1400021e9
add rbx, 0x28
cmp rbx, rdi
je 0x140002210
mov r8d, 8
mov rdx, rsi
mov rcx, rbx
call sym.strncmp
test eax, eax
jne 0x1400021e0
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor ebx, ebx
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x140002220
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1400043f0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140002240
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140002248
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002240
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14000229d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140002294
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140002240
add rax, 0x28
cmp rax, r9
jne 0x140002280
xor eax, eax
ret

Function at 0x1400022a0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400043f0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x1400022bf
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400022c8
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x1400022bf
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x1400022e0
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x1400043f0]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x140002300
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x140002308
ret
cmp word [rdx + 0x18], 0x20b
jne 0x140002300
movzx eax, word [rdx + 0x14]
movzx r8d, word [rdx + 6]
lea rax, [rdx + rax + 0x18]
test r8w, r8w
je 0x140002350
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x140002347
test rcx, rcx
je 0x140002300
sub rcx, 1
add rax, 0x28
cmp rdx, rax
jne 0x140002338
xor eax, eax
ret
Function at 0x140002360
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400043f0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14000237f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140002388
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x1400023a0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1400043f0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400023c0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400023c8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400023c0
sub rcx, rdx
movzx r9d, word [r8 + 6]
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
test r9w, r9w
je 0x1400023c0
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
mov rax, r8
cmp rcx, r8
jb 0x140002414
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x140002420
add rdx, 0x28
cmp rdx, r9
jne 0x140002400
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x140002430
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x1400043f0]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x140002452
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x140002460
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002452
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x140002452
movzx edx, word [r8 + 0x14]
movzx r10d, word [r8 + 6]
lea rdx, [r8 + rdx + 0x18]
test r10w, r10w
je 0x140002452
lea r8d, [r10 - 1]
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop word cs:[rax + rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x1400024b5
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x1400024c8
add rdx, 0x28
cmp r10, rdx
jne 0x1400024a0
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x1400024d7
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x1400024e7
mov edx, dword [rax + 0xc]
test edx, edx
je 0x1400024be
test ecx, ecx
jg 0x1400024d0
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret