joyce8/EMBER2024-capa huggingface dataset:
Function at 0x737340
Capabilities:
Get geographical location

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov r13, rdx
mov r14d, ecx
mov r8, qword [r13 + 8]
xor r12d, r12d
mov edx, 0xe
xor r9d, r9d
call fcn.007661e8
inc eax
movsxd rdi, eax
mov rcx, rdi
call fcn.00729500
mov qword [r13 + 8], rax
mov edx, 0xe
mov ecx, r14d
mov r8, rax
mov r9d, edi
call fcn.007661e8
xor ebx, ebx
test eax, eax
setne bl
mov r8, qword [r13]
mov edx, 0xf
xor r9d, r9d
mov ecx, r14d
call fcn.007661e8
mov edi, eax
inc edi
movsxd rcx, edi
call fcn.00729500
mov qword [r13], rax
test r13, r13
je 0x7373e1
mov edx, 0xf
mov ecx, r14d
mov r8, rax
mov r9d, edi
call fcn.007661e8
xor r12d, r12d
test eax, eax
setne r12b
jmp 0x7373eb
mov ecx, 0xe
call fcn.007664a0
and r12d, ebx
mov r8, qword [r13 + 0x10]
xor r15d, r15d
mov edx, 0x10
xor r9d, r9d
mov ecx, r14d
call fcn.007661e8
inc eax
movsxd rdi, eax
mov rcx, rdi
call fcn.00729500
mov qword [r13 + 0x10], rax
mov edx, 0x10
mov ecx, r14d
mov r8, rax
mov r9d, edi
call fcn.007661e8
xor ebx, ebx
test eax, eax
setne bl
mov r8, qword [r13 + 0x18]
mov edx, 0x50
xor r9d, r9d
mov ecx, r14d
call fcn.007661e8
inc eax
movsxd rdi, eax
mov rcx, rdi
call fcn.00729500
mov qword [r13 + 0x18], rax
mov edx, 0x50
mov ecx, r14d
mov r8, rax
mov r9d, edi
call fcn.007661e8
xor esi, esi
test eax, eax
setne sil
and esi, ebx
and esi, r12d
mov r8, qword [r13 + 0x20]
mov edx, 0x51
xor r9d, r9d
mov ecx, r14d
call fcn.007661e8
inc eax
movsxd rdi, eax
mov rcx, rdi
call fcn.00729500
mov qword [r13 + 0x20], rax
mov edx, 0x51
mov ecx, r14d
mov r8, rax
mov r9d, edi
call fcn.007661e8
xor ebx, ebx
test eax, eax
setne bl
and ebx, esi
mov ecx, 4
call fcn.00729500
mov rdi, rax
test rdi, rdi
je 0x7374ff
mov edx, 0x11
mov r9d, 4
mov ecx, r14d
mov r8, rdi
call fcn.007661e8
test eax, eax
je 0x73750b
mov rcx, rdi
call fcn.00738ca0
mov word [r13 + 0x28], ax
mov rcx, rdi
call fcn.00729510
mov r15d, 1
jmp 0x737516
mov ecx, 0xe
call fcn.007664a0
jmp 0x737516
mov rcx, rdi
call fcn.00729510
xor r15d, r15d
and ebx, r15d
mov eax, ebx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x73ccc0
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov r15, rdx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call fcn.00766010
mov rdi, rax
test rdi, rdi
je 0x73cdaa
lea rcx, [rbp - 8]
call fcn.007661e0
movzx r8d, word [rbp - 6]
movzx r9d, word [rbp - 2]
movzx eax, word [rbp - 8]
movzx ecx, word [rbp]
movzx edx, word [rbp + 2]
movzx ebx, word [rbp + 4]
movzx esi, word [rbp + 6]
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], eax
lea rbx, [0x0109af60]
lea rdx, [0x00954e40]
mov rcx, rbx
call fcn.00767150
mov rcx, rbx
call fcn.0072ab10
mov qword [rsp + 0x20], 0
lea r14, [rbp - 8]
mov rcx, rdi
mov rdx, rbx
mov r8d, eax
mov r9, r14
call fcn.00766570
mov rcx, r15
call fcn.0072ab10
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, r15
mov r8d, eax
mov r9, r14
call fcn.00766570
mov rcx, rdi
call fcn.00765fd8
nop
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret

Function at 0x73ce00
Capabilities:
Write file on windows

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0xc0
lea rbp, [rsp + 0x80]
mov rsi, rcx
mov rcx, qword [0x0109af88]
test rcx, rcx
mov rax, qword [0x0109af80]
jne 0x73ced5
test rax, rax
jne 0x73ced5
cmp dword [0x0098a1e0], 0
je 0x73cf1f
lea rdi, [rbp - 0x50]
xor ecx, ecx
mov r8d, 0x80
mov rdx, rdi
call fcn.00766200
mov edx, 0x5c
mov rcx, rdi
call fcn.0073c270
test rax, rax
jne 0x73ce7d
mov edx, 0x3a
mov rcx, rdi
call fcn.0073c270
test rax, rax
je 0x73ce83
inc rax
mov rdi, rax
mov dword [rbp + 0x3c], 0
call fcn.007662d0
mov r9d, 0x12010
test eax, eax
jns 0x73cec3
call fcn.00766168
lea rdx, [0x0073cfe0]
lea r8, [rbp + 0x3c]
mov ecx, eax
call fcn.00766c80
cmp dword [rbp + 0x3c], 0
mov eax, 0x11010
mov r9d, 0x12010
cmove r9d, eax
xor ecx, ecx
mov rdx, rsi
mov r8, rdi
call sub.USER32_MessageBoxA
jmp 0x73cf93
test rax, rax
je 0x73ceef
cmp eax, 0xffffffff
je 0x73cf93
mov rcx, rsi
call rax
mov rcx, qword [0x0109af88]
test rcx, rcx
je 0x73cf93
cmp ecx, 0xffffffff
je 0x73cf93
cmp byte [rcx], 0
je 0x73cf93
mov rdx, rsi
add rsp, 0xc0
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
jmp fcn.0073ccc0
mov ecx, 0xfffffff4
call fcn.00766258
mov rdi, rax
mov qword [rsp + 0x20], 0
lea r14, [0x00954e70]
lea rbx, [rbp - 0x50]
mov r8d, 2
mov rcx, rdi
mov rdx, r14
mov r9, rbx
call fcn.00766570
mov rcx, rsi
call fcn.0072ab10
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, rsi
mov r8d, eax
mov r9, rbx
call fcn.00766570
mov qword [rsp + 0x20], 0
mov r8d, 2
mov rcx, rdi
mov rdx, r14
mov r9, rbx
call fcn.00766570
nop
add rsp, 0xc0
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
Function at 0x73e960
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov rax, qword [0x010ab038]
test rax, rax
je 0x73e9a9
mov rcx, qword [rax]
test rcx, rcx
je 0x73ea20
add rax, 8
xor esi, esi
nop
cmp byte [rcx], 1
sbb esi, 0
inc esi
mov rcx, qword [rax]
add rax, 8
test rcx, rcx
jne 0x73e990
jmp 0x73ea51
mov r14, qword [0x010ab0e0]
test r14, r14
jne 0x73e9dc
call fcn.00766188
mov r14, rax
mov qword [0x010ab0e0], r14
test r14, r14
jne 0x73e9dc
lea rcx, [0x00954fc0]
call fcn.0073cfc0
mov r14, qword [0x010ab0e0]
mov rcx, r14
call fcn.0072ab10
xor r15d, r15d
test eax, eax
je 0x73ea24
xor edi, edi
xor esi, esi
mov rbx, r14
nop word cs:[rax + rax]
lea edi, [rax + rdi + 1]
inc esi
cdqe
lea rbx, [rbx + rax + 1]
mov rcx, rbx
call fcn.0072ab10
test eax, eax
jne 0x73ea00
inc edi
movsxd rbx, edi
jmp 0x73ea2b
xor esi, esi
jmp 0x73ea51
mov ebx, 1
xor esi, esi
mov rcx, rbx
call fcn.00729500
mov qword [0x010ab030], rax
test rax, rax
je 0x73eb2b
mov rcx, rax
mov rdx, r14
mov r8, rbx
call fcn.0072a100
lea eax, [rsi + 4]
mov dword [0x010ab040], eax
add esi, 5
movsxd rcx, esi
mov edx, 8
call fcn.007294f0
mov rdi, rax
test rdi, rdi
je 0x73eac2
mov r14, qword [0x010ab038]
test r14, r14
je 0x73eac7
mov rdx, qword [r14]
test rdx, rdx
je 0x73eb16
lea rax, [r14 + 8]
xor ecx, ecx
cmp byte [rdx], 0
je 0x73eab0
mov rdx, qword [rax - 8]
movsxd rbx, ecx
mov qword [rdi + rbx*8], rdx
jmp 0x73eab2
dec ecx
inc ecx
mov rdx, qword [rax]
add rax, 8
test rdx, rdx
jne 0x73ea90
jmp 0x73eb11
xor r15d, r15d
jmp 0x73eb2b
mov rbx, qword [0x010ab030]
mov rcx, rbx
call fcn.0072ab10
test eax, eax
je 0x73eb1e
movabs r15, 0x100000000
mov rsi, rdi
nop word [rax + rax]
mov qword [rsi], rbx
shl rax, 0x20
add rax, r15
sar rax, 0x20
add rbx, rax
mov rcx, rbx
call fcn.0072ab10
add rsi, 8
test eax, eax
jne 0x73eaf0
test r14, r14
je 0x73eb1e
mov rcx, r14
call fcn.00729510
mov qword [0x010ab038], rdi
mov r15d, 1
mov eax, r15d
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
Function at 0x73ec40
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov rax, qword [0x010ab068]
test rax, rax
je 0x73ec8a
mov rcx, qword [rax]
test rcx, rcx
je 0x73ed03
add rax, 8
xor esi, esi
nop
cmp word [rcx], 1
sbb esi, 0
inc esi
mov rcx, qword [rax]
add rax, 8
test rcx, rcx
jne 0x73ec70
jmp 0x73ed34
mov r14, qword [0x010ab0e8]
test r14, r14
jne 0x73ecbd
call fcn.00766190
mov r14, rax
mov qword [0x010ab0e8], r14
test r14, r14
jne 0x73ecbd
lea rcx, [0x00955030]
call fcn.0073cfc0
mov r14, qword [0x010ab0e8]
mov rcx, r14
call fcn.0072a0e0
xor r15d, r15d
test eax, eax
je 0x73ed07
xor edi, edi
xor esi, esi
mov rbx, r14
nop word cs:[rax + rax]
lea edi, [rax + rdi + 1]
inc esi
cdqe
lea rbx, [rbx + rax*2 + 2]
mov rcx, rbx
call fcn.0072a0e0
test eax, eax
jne 0x73ece0
inc edi
movsxd rbx, edi
add rbx, rbx
jmp 0x73ed0e
xor esi, esi
jmp 0x73ed34
mov ebx, 2
xor esi, esi
mov rcx, rbx
call fcn.00729500
mov qword [0x010ab060], rax
test rax, rax
je 0x73ee1b
mov rcx, rax
mov rdx, r14
mov r8, rbx
call fcn.0072a100
lea eax, [rsi + 4]
mov dword [0x010ab070], eax
add esi, 5
movsxd rcx, esi
mov edx, 8
call fcn.007294f0
mov rdi, rax
test rdi, rdi
je 0x73edb2
mov r14, qword [0x010ab068]
test r14, r14
je 0x73edb7
mov rdx, qword [r14]
test rdx, rdx
je 0x73ee06
lea rax, [r14 + 8]
xor ecx, ecx
nop word cs:[rax + rax]
cmp word [rdx], 0
je 0x73eda0
mov rdx, qword [rax - 8]
movsxd rbx, ecx
mov qword [rdi + rbx*8], rdx
jmp 0x73eda2
dec ecx
inc ecx
mov rdx, qword [rax]
add rax, 8
test rdx, rdx
jne 0x73ed80
jmp 0x73ee01
xor r15d, r15d
jmp 0x73ee1b
mov rbx, qword [0x010ab060]
mov rcx, rbx
call fcn.0072a0e0
test eax, eax
je 0x73ee0e
movabs r15, 0x100000000
mov rsi, rdi
nop word [rax + rax]
mov qword [rsi], rbx
shl rax, 0x20
add rax, r15
sar rax, 0x1f
add rbx, rax
mov rcx, rbx
call fcn.0072a0e0
add rsi, 8
test eax, eax
jne 0x73ede0
test r14, r14
je 0x73ee0e
mov rcx, r14
call fcn.00729510
mov qword [0x010ab068], rdi
mov r15d, 1
mov eax, r15d
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
Function at 0x73f630
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
sub rsp, 0x28
xor rcx, rcx
call fcn.00766218
mov qword [0x009570a0], rax
call fcn.00729940
call fcn.00729830
call fcn.00729a50
lea rax, [section..data]
lea rcx, [0x00436ad0]
mov qword [rax + 0x30], rcx
lea rcx, section..text
mov qword [rax], rcx
lea rcx, [0x00404840]
mov qword [rax + 8], rcx
lea rcx, [0x00404840]
mov qword [rax + 0x10], rcx
lea rcx, [0x0040799c]
mov qword [rax + 0x18], rcx
lea rcx, [0x0073dc20]
mov qword [rax + 0x68], rcx
lea rcx, [0x0073e020]
mov qword [rax + 0x70], rcx
lea rcx, [0x0073e050]
mov qword [rax + 0x78], rcx
lea rcx, [0x0073e600]
mov qword [rax + 0x80], rcx
lea rcx, [0x00989510]
mov qword [rax + 0x50], rcx
mov dword [rax + 0x20], 1
mov rcx, rax
push 0
jmp 0x73f630
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rsi, r9
mov r14d, r8d
mov ebx, edx
mov edi, ecx
call fcn.0073f5d0
test edi, edi
je 0x73d9c5
test ebx, ebx
jne 0x73d9dc
test edi, edi
jne 0x73d9b6
call qword [0x0098a188]
call qword [0x0098a190]
call fcn.0073f5f0
mov ecx, r14d
call fcn.0073f380
jmp 0x73d9dc
mov rcx, rsi
call fcn.0073d770
call fcn.0073f4a0
call qword [0x0098a180]
test ebx, ebx
je 0x73d9a6
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
jmp fcn.0073f5f0
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0x80]
mov rsi, rcx
mov eax, dword [rsi + 0x20]
and eax, 1
mov dword [0x0098a1e0], eax
mov rcx, qword [rsi + 0x50]
call fcn.0072c1b0
mov rcx, qword [rsi + 0x88]
call fcn.0072c1c0
mov dword [0x010ab140], 1
lea rdi, [0x010ab140]
mov qword [0x010ab148], rsi
call fcn.00766190
mov qword [0x010ab0e8], rax
call fcn.00766148
mov qword [0x010ab0f8], rax
mov rcx, qword [rsi + 0x68]
mov rdx, qword [rsi + 0x70]
mov r8, qword [rsi + 0x78]
mov r9, qword [rsi + 0x80]
call fcn.0073dbf0
xor edx, edx
mov rcx, rdi
call fcn.0073f3a0
test byte [rsi + 0x20], 1
jne 0x73f6f4
mov ecx, dword [0x010ab10c]
mov rdx, qword [0x010ab120]
mov r8, qword [0x010ab128]
call qword [rsi + 0x30]
xor ecx, ecx
xor edx, edx
mov r9, 0xffffffffffffffff
mov r8d, eax
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop rbp
jmp 0x73d980
mov rax, qword [0x010ab0f8]
nop dword [rax + rax]
add rax, 2
movzx ecx, word [rax - 2]
cmp ecx, 9
je 0x73f700
movzx edx, cx
cmp edx, 0x20
je 0x73f700
cmp edx, 0x22
jne 0x73f724
mov cx, word [rax]
mov edx, 0x22
jmp 0x73f72d
add rax, 0xfffffffffffffffe
mov edx, 0x20
movzx edi, cx
cmp edx, edi
je 0x73f759
nop word cs:[rax + rax]
test cx, cx
je 0x73f759
movzx edi, cx
cmp edi, 9
je 0x73f759
movzx ecx, word [rax + 2]
add rax, 2
cmp edx, ecx
jne 0x73f740
movzx ecx, cx
lea rdi, [rax + 2]
cmp ecx, 0x22
cmovne rdi, rax
jmp 0x73f774
add rdi, 2
movzx eax, word [rdi]
cmp eax, 0x20
je 0x73f770
movzx eax, ax
cmp eax, 9
je 0x73f770
mov rbx, qword [rsi + 0x30]
xor ecx, ecx
call fcn.00766218
mov rsi, rax
lea rcx, [rbp - 0x60]
call fcn.00766250
mov eax, dword [rbp - 0x24]
test al, 1
movzx eax, word [rbp - 0x20]
mov r9d, 0xa
cmovne r9d, eax
xor edx, edx
mov rcx, rsi
mov r8, rdi
call rbx
xor ecx, ecx
xor edx, edx
mov r9, 0xffffffffffffffff
mov r8d, eax
call 0x73d980
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop rbp
ret
Function at 0x73fa30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov esi, ecx
cmp byte [0x009570b4], 0
je 0x73fa92
mov ecx, dword [0x010ab170]
call fcn.00766500
test rax, rax
jne 0x73fa9e
call fcn.0073f880
mov edi, eax
test edi, edi
je 0x73fa85
call fcn.00766240
movsxd r8, edi
mov edx, 8
mov rcx, rax
call fcn.00766320
mov ecx, dword [0x010ab170]
mov rdx, rax
call fcn.00766508
mov ecx, dword [0x010ab170]
call fcn.00766500
jmp 0x73fa9e
mov rax, qword gs:[0x58]
mov rax, qword [rax]
movsxd rcx, esi
add rcx, rax
mov rax, rcx
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret

Function at 0x73ff30
Capabilities:
Create thread

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov r14, r9
mov r15, r8
mov ebx, edx
mov rsi, rcx
cmp ebx, 0xf
jg 0x73ff6c
test ebx, ebx
je 0x73ff6c
call fcn.0073cdc0
mov dword [rax], 0x13
mov rax, 0xffffffffffffffff
jmp 0x73fffc
call fcn.0073fbe0
mov rdi, rax
test rdi, rdi
je 0x73ffc9
mov eax, dword [rbp + 0x70]
mov ecx, dword [rbp + 0x60]
mov qword [rdi + 8], r15
mov qword [rdi + 0x20], rsi
mov dword [rdi + 0x94], eax
mov edx, ebx
lea rax, [rbp + 4]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
lea r8, [0x00740110]
mov rcx, r14
mov r9, rdi
call fcn.00766050
test rax, rax
je 0x73ffdd
mov rcx, qword [rbp + 0x68]
mov qword [rdi + 0x10], rax
test rcx, rcx
je 0x73ffc5
mov edx, dword [rbp + 4]
mov dword [rcx], edx
cdqe
jmp 0x73fffc
call fcn.0073cdc0
mov dword [rax], 8
mov rax, 0xffffffffffffffff
jmp 0x73fffc
call fcn.007661d8
cmp eax, 0x718
jne 0x73fff5
mov ecx, 0x59
call fcn.0072d6b0
jmp 0x73fffa
call fcn.0072d770
cdqe
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret

Function at 0x7454f0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov ecx, dword [0x010b5570]
call fcn.00766500
mov rsi, rax
test rsi, rsi
je 0x745569
xor r14d, r14d
lea rbx, [0x010b5580]
nop dword [rax]
cmp r14d, 3
ja 0x745569
inc r14d
xor edi, edi
xor eax, eax
nop dword [rax]
cmp byte [rbx + rdi*2], 0
je 0x745558
mov rdx, qword [rbx + rdi*2 + 8]
test rdx, rdx
je 0x745558
mov rcx, qword [rsi + rdi]
test rcx, rcx
je 0x745558
mov qword [rsi + rdi], 0
call rdx
mov eax, 1
add rdi, 8
cmp rdi, 0x190
jne 0x745530
test eax, eax
jne 0x745520
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
Function at 0x746c10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov r14d, r9d
mov ebx, r8d
mov rsi, rdx
mov r15, rcx
mov edi, ebx
sar edi, 0x1f
shr edi, 0x1c
add edi, ebx
mov eax, edi
shr eax, 4
inc eax
movzx edx, ax
mov r8d, 6
mov rcx, rsi
call fcn.007660f0
mov r12, rax
test r12, r12
je 0x746d6e
mov rcx, rsi
mov rdx, r12
call fcn.00766398
test rax, rax
je 0x746d6e
mov rcx, rax
call fcn.007663c0
test rax, rax
je 0x746d66
mov rcx, rax
and edi, 0xfffffff0
add rax, 2
sub ebx, edi
movzx ecx, word [rcx]
je 0x746d25
lea edx, [rbx - 1]
mov edi, ebx
and edi, 7
je 0x746cc5
neg edi
mov rsi, rax
nop word cs:[rax + rax]
dec ebx
movzx ecx, cx
lea rax, [rsi + rcx*2 + 2]
movzx ecx, word [rsi + rcx*2]
inc edi
mov rsi, rax
jne 0x746cb0
cmp edx, 7
jb 0x746d25
nop word [rax + rax]
movzx ecx, cx
lea rdx, [rax + rcx*2]
movzx eax, word [rax + rcx*2]
lea rcx, [rdx + rax*2]
movzx eax, word [rdx + rax*2 + 2]
lea rdx, [rcx + rax*2 + 2]
movzx eax, word [rcx + rax*2 + 4]
lea rcx, [rdx + rax*2 + 2]
movzx eax, word [rdx + rax*2 + 4]
lea rdx, [rcx + rax*2 + 2]
movzx eax, word [rcx + rax*2 + 4]
lea rcx, [rdx + rax*2 + 2]
movzx eax, word [rdx + rax*2 + 4]
lea rdx, [rcx + rax*2 + 2]
add ebx, 0xfffffff8
movzx ecx, word [rcx + rax*2 + 4]
lea rax, [rdx + rcx*2 + 6]
movzx ecx, word [rdx + rcx*2 + 4]
jne 0x746cd0
test cx, cx
je 0x746d66
movzx r8d, cx
mov qword [rbp - 8], 0
xor r9d, r9d
cmp r14d, 0xffff
cmovne r9w, r14w
lea rcx, [rbp - 8]
mov rdx, rax
call fcn.00462f80
mov rdx, qword [rbp - 8]
mov rcx, r15
call fcn.00463170
lea rcx, [rbp - 8]
call fcn.004629f0
mov rcx, r12
call fcn.00766128
mov rax, r15
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
Function at 0x748cc0
Capabilities:
Hash data using fnv

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov r15, rdx
mov r14, rcx
movzx eax, byte [r15]
movabs rcx, 0xcbf29ce484222325
xor rcx, rax
movabs rax, 0x100000001b3
imul rcx, rax
movzx edx, byte [r15 + 1]
xor rdx, rcx
imul rdx, rax
movzx ecx, byte [r15 + 2]
xor rcx, rdx
imul rcx, rax
movzx edx, byte [r15 + 3]
xor rdx, rcx
imul rdx, rax
movzx ecx, byte [r15 + 4]
xor rcx, rdx
imul rcx, rax
movzx edx, byte [r15 + 5]
xor rdx, rcx
imul rdx, rax
movzx ecx, byte [r15 + 6]
xor rcx, rdx
imul rcx, rax
movzx esi, byte [r15 + 7]
xor rsi, rcx
imul rsi, rax
and rsi, qword [r14 + 0x58]
mov rdi, qword [r14 + 0x10]
mov rax, qword [r14 + 0x40]
lea rcx, [rsi + rsi*2]
shl rcx, 4
mov rdx, qword [rax + rcx + 0x10]
mov rbx, qword [r15]
lea rcx, [rsi + rsi + 1]
lea rcx, [rcx + rcx*2]
lea rsi, [rax + rcx*8 + 0x10]
mov rax, rdx
jmp 0x748d83
mov rax, qword [rax]
cmp rdx, rdi
mov rcx, rdi
je 0x748d91
mov rcx, qword [rsi]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x748da7
cmp qword [rax + 0x10], rbx
jne 0x748d80
cmp rax, rdi
jne 0x748e2c
jmp 0x748daf
mov rax, rdi
cmp rax, rdi
jne 0x748e2c
mov rbx, qword [rdi]
mov rsi, qword [rbx + 8]
mov ecx, 0x20
call fcn.00705b70
test rbx, rbx
cmove rsi, rax
mov rcx, rbx
cmove rcx, rax
mov qword [rax], rcx
mov qword [rax + 8], rsi
mov rcx, qword [r15]
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], 0
mov rcx, qword [r14 + 0x18]
movabs rdx, 0x7fffffffffffffe
cmp rcx, rdx
je 0x748e3d
inc rcx
mov qword [r14 + 0x18], rcx
mov qword [rbx + 8], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rax
mov rax, qword [r14 + 0x10]
mov r8, qword [rax]
mov qword [rbp], r8
add r8, 0x10
lea rdx, [rbp - 0x30]
lea r9, [rbp - 0x10]
mov rcx, r14
call fcn.00749870
mov rax, qword [rbp - 0x20]
add rax, 0x18
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
lea rcx, [0x0095594d]
call fcn.007277a0
ud2
Function at 0x749c20
Capabilities:
Hash data using fnv

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov r14, rdx
mov rax, qword [r8 + 0x10]
movzx edx, byte [rax + 0x10]
movabs rbx, 0xcbf29ce484222325
xor rbx, rdx
movabs rdx, 0x100000001b3
imul rbx, rdx
movzx edi, byte [rax + 0x11]
xor rdi, rbx
imul rdi, rdx
movzx ebx, byte [rax + 0x12]
xor rbx, rdi
imul rbx, rdx
movzx edi, byte [rax + 0x13]
xor rdi, rbx
imul rdi, rdx
movzx ebx, byte [rax + 0x14]
xor rbx, rdi
imul rbx, rdx
movzx edi, byte [rax + 0x15]
xor rdi, rbx
imul rdi, rdx
movzx ebx, byte [rax + 0x16]
xor rbx, rdi
imul rbx, rdx
movzx edi, byte [rax + 0x17]
xor rdi, rbx
imul rdi, rdx
and rdi, qword [rcx + 0x58]
lea rdx, [rdi + rdi + 1]
mov rsi, qword [rcx + 0x40]
lea r11, [rdx + rdx*2]
lea rbx, [rdi + rdi*2]
shl rbx, 4
cmp qword [rsi + r11*8 + 0x10], rax
lea r10, [rsi + rbx + 0x10]
mov rdx, qword [rsi + rbx + 0x10]
je 0x749cdc
cmp rdx, rax
je 0x749cf7
test r9b, r9b
je 0x749d22
mov rsi, qword [r8 + 0x10]
jmp 0x749d47
cmp rdx, rax
je 0x749d06
lea rdx, [rsi + r11*8]
lea r10, [rsi + r11*8 + 0x10]
mov rax, qword [rax + 8]
movups xmm0, xmmword [rbp - 0x10]
movups xmmword [rdx], xmm0
jmp 0x749d1a
add rsi, rbx
mov rax, qword [rax]
movups xmm0, xmmword [rbp - 0x10]
movups xmmword [rsi], xmm0
jmp 0x749d1a
mov rax, qword [rcx + 0x10]
mov qword [r10], rax
mov rax, qword [rcx + 0x10]
mov rdx, qword [rcx + 0x40]
lea r10, [rdx + r11*8 + 0x10]
mov qword [r10], rax
test r9b, r9b
jne 0x749cd6
mov rax, qword [r8 + 0x10]
mov rsi, qword [rax]
mov rdx, qword [rax + 8]
mov qword [rdx], rsi
mov rdx, qword [rax]
mov rbx, qword [rax + 8]
mov qword [rdx + 8], rbx
dec qword [rcx + 0x18]
mov rcx, rax
call fcn.006f8470
mov qword [r14 + 0x10], rsi
mov rax, r14
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
Function at 0x754dc0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov ebx, r8d
mov rdi, rdx
mov r14, rcx
mov esi, ebx
sar esi, 0x1f
shr esi, 0x1c
add esi, ebx
mov eax, esi
shr eax, 4
inc eax
movzx edx, ax
mov r8d, 6
mov rcx, rdi
call fcn.007660f0
mov r15, rax
test r15, r15
je 0x755007
mov rcx, rdi
mov rdx, r15
call fcn.00766398
test rax, rax
je 0x755007
mov rcx, rax
call fcn.007663c0
mov r13, rax
test r13, r13
je 0x754fff
mov rax, r13
and esi, 0xfffffff0
add r13, 2
sub ebx, esi
movzx eax, word [rax]
je 0x754ed8
lea ecx, [rbx - 1]
mov edx, ebx
and edx, 7
je 0x754e75
neg edx
mov rdi, r13
nop dword [rax + rax]
dec ebx
movzx eax, ax
lea r13, [rdi + rax*2 + 2]
movzx eax, word [rdi + rax*2]
inc edx
mov rdi, r13
jne 0x754e60
cmp ecx, 7
jb 0x754ed8
nop word [rax + rax]
movzx eax, ax
lea rcx, [r13 + rax*2]
movzx eax, word [r13 + rax*2]
lea rdx, [rcx + rax*2]
movzx eax, word [rcx + rax*2 + 2]
lea rcx, [rdx + rax*2 + 2]
movzx eax, word [rdx + rax*2 + 4]
lea rdx, [rcx + rax*2 + 2]
movzx eax, word [rcx + rax*2 + 4]
lea rcx, [rdx + rax*2 + 2]
movzx eax, word [rdx + rax*2 + 4]
lea rdx, [rcx + rax*2 + 2]
movzx eax, word [rcx + rax*2 + 4]
lea rcx, [rdx + rax*2 + 2]
add ebx, 0xfffffff8
movzx eax, word [rdx + rax*2 + 4]
lea r13, [rcx + rax*2 + 6]
movzx eax, word [rcx + rax*2 + 4]
jne 0x754e80
test ax, ax
je 0x754fff
movzx r12d, ax
mov rcx, r14
mov edx, r12d
call fcn.005920a0
mov r8, qword [r14]
lea ecx, [r12 - 1]
lea rax, [rcx + 1]
cmp rax, 0x10
jb 0x754f1e
lea rdx, [r13 + rcx*2 + 2]
cmp r8, rdx
jae 0x754fad
lea rcx, [r8 + rcx*2 + 2]
cmp r13, rcx
jae 0x754fad
mov ecx, r12d
mov rdx, r8
mov rsi, r13
lea eax, [rcx - 1]
mov edi, ecx
and edi, 7
je 0x754f54
neg edi
nop word cs:[rax + rax]
dec ecx
movzx ebx, word [rsi]
add rsi, 2
mov word [rdx], bx
add rdx, 2
inc edi
jne 0x754f40
cmp eax, 7
jb 0x754ff8
nop dword [rax]
movzx eax, word [rsi]
mov word [rdx], ax
movzx eax, word [rsi + 2]
mov word [rdx + 2], ax
movzx eax, word [rsi + 4]
mov word [rdx + 4], ax
movzx eax, word [rsi + 6]
mov word [rdx + 6], ax
movzx eax, word [rsi + 8]
mov word [rdx + 8], ax
movzx eax, word [rsi + 0xa]
mov word [rdx + 0xa], ax
movzx eax, word [rsi + 0xc]
mov word [rdx + 0xc], ax
add ecx, 0xfffffff8
movzx eax, word [rsi + 0xe]
lea rsi, [rsi + 0x10]
mov word [rdx + 0xe], ax
lea rdx, [rdx + 0x10]
jne 0x754f60
jmp 0x754ff8
mov r9d, r12d
and r9d, 0xf
sub rax, r9
mov ecx, r12d
sub ecx, eax
lea rdx, [r8 + rax*2]
lea rsi, [r13 + rax*2]
add r13, 0x10
lea rbx, [r8 + 0x10]
nop dword [rax]
movups xmm0, xmmword [r13 - 0x10]
movups xmm1, xmmword [r13]
movups xmmword [rbx - 0x10], xmm0
movups xmmword [rbx], xmm1
add r13, 0x20
add rbx, 0x20
add rax, 0xfffffffffffffff0
jne 0x754fd0
test r9d, r9d
jne 0x754f27
mov word [r8 + r12*2], 0
mov rcx, r15
call fcn.00766128
mov rax, r14
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x75a305
Capabilities:
Query environment variable

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x828
mov rbp, rsp
mov rbx, rcx
mov rsi, rdx
mov rcx, rbx
call fcn.004629a0
mov rcx, rsi
call fcn.00464460
mov rdi, rax
mov rcx, rdi
lea rdx, [rbp + 0x20]
mov r8d, 0x400
call fcn.00766198
mov esi, eax
cmp esi, 0x400
jge 0x487aa4
mov rcx, rbx
lea rdx, [rbp + 0x20]
mov r8d, esi
call fcn.00462ca0
jmp 0x487ac7
mov rcx, rbx
mov edx, esi
sub edx, 1
call fcn.004646e0
mov rcx, qword [rbx]
call fcn.00464460
mov rcx, rdi
mov rdx, rax
mov r8d, esi
call fcn.00766198
mov rax, rbx
lea rsp, [rbp + 0x828]
pop rbx
pop rsi
pop rdi
pop rbp
ret
jmp 0x487a50

Function at 0x75a510
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
mov rbp, rsp
mov rax, rcx
mov rcx, qword [0x010b5e58]
test rcx, rcx
je 0x75a531
test rax, rax
je 0x75a535
mov rdx, rax
pop rbp
jmp fcn.0075a880
xor eax, eax
jmp 0x75a53c
mov rax, qword [0x010b5e20]
pop rbp
ret