joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400096d4
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x14000f008]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.140006320
xor ebx, ebx
cmp qword [0x1400113c0], rbx
mov rdi, rax
jne 0x1400097e7
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x1400098be
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400098be
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x1400113c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x1400113c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x1400113d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x1400113e0], rax
test rax, rax
je 0x1400097de
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x1400113d8], rax
jmp 0x1400097ee
mov rax, qword [0x1400113d8]
jmp 0x1400097f5
mov rax, qword [0x1400113d8]
mov r11, qword [0x1400113e0]
cmp rax, rdi
je 0x14000985c
cmp r11, rdi
je 0x14000985c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x1400113e0]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x14000985c
test rax, rax
je 0x14000985c
call rsi
test rax, rax
je 0x140009856
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140009856
test byte [rsp + 0x40], 1
jne 0x14000985c
bts ebp, 0x15
jmp 0x14000989c
mov rcx, qword [0x1400113c8]
cmp rcx, rdi
je 0x14000989c
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14000989c
call rax
mov rbx, rax
test rax, rax
je 0x14000989c
mov rcx, qword [0x1400113d0]
cmp rcx, rdi
je 0x14000989c
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14000989c
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1400113c0]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1400098be
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x1400098c0
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140001270
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x62b49880
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
call fcn.62b56c90
test rax, rax
je 0x62b498e7
mov r9, qword [rax]
test r9, r9
jle 0x62b498e7
mov r8, rax
add r9, rbx
sub r8, rbx
nop dword [rax]
nop word cs:[rax + rax]
mov rcx, rbx
mov rdx, rbx
sar rcx, 8
sar rdx, 0x10
xor ecx, ebx
and edx, 0xffffffee
and ecx, 0xffffffee
xor cl, byte [r8 + rbx + 0x10]
xor ecx, edx
mov rdx, rbx
sar rdx, 0x18
and edx, 0xffffffee
xor ecx, edx
mov byte [r8 + rbx + 0x10], cl
add rbx, 1
cmp rbx, r9
jne 0x62b498b0
add rsp, 0x20
pop rbx
ret
Function at 0x62b4af00
Capabilities:
Parse credit card information

Disassembly:
cmp cx, 0x16
je 0x62b4b1a0
jbe 0x62b4af60
cmp cx, 0x25
je 0x62b4b390
jbe 0x62b4b0a0
cmp cx, 0x44
je 0x62b4b380
ja 0x62b4b070
cmp cx, 0x41
je 0x62b4b370
jbe 0x62b4afb0
cmp cx, 0x42
je 0x62b4b360
cmp cx, 0x43
jne 0x62b4b350
lea rcx, [0x62fceb80]
jmp fcn.62b56c90
cmp cx, 0xa
je 0x62b4b340
ja 0x62b4b030
cmp cx, 4
je 0x62b4b330
jbe 0x62b4aff0
cmp cx, 7
je 0x62b4b320
jbe 0x62b4afd0
cmp cx, 8
je 0x62b4b310
cmp cx, 9
jne 0x62b4b350
lea rcx, [0x62fcef00]
jmp fcn.62b56c90
cmp cx, 0x26
je 0x62b4b300
cmp cx, 0x40
jne 0x62b4b350
lea rcx, [0x62fcebe0]
jmp fcn.62b56c90
cmp cx, 5
je 0x62b4b2f0
cmp cx, 6
jne 0x62b4b350
lea rcx, [0x62fcef60]
jmp fcn.62b56c90
cmp cx, 1
je 0x62b4b2e0
test cx, cx
je 0x62b4b2d0
cmp cx, 2
je 0x62b4b2c0
cmp cx, 3
jne 0x62b4b350
lea rcx, [0x62fcefc0]
jmp fcn.62b56c90
cmp cx, 0x10
je 0x62b4b2b0
jbe 0x62b4b170
cmp cx, 0x13
je 0x62b4b2a0
jbe 0x62b4b150
cmp cx, 0x14
je 0x62b4b290
cmp cx, 0x15
jne 0x62b4b350
lea rcx, [0x62fceda0]
jmp fcn.62b56c90
cmp cx, 0x47
je 0x62b4b280
jbe 0x62b4b0e0
cmp cx, 0x48
je 0x62b4b270
cmp cx, 0xfff
jne 0x62b4b350
lea rcx, [0x62fcea80]
jmp fcn.62b56c90
cmp cx, 0x1b
je 0x62b4b260
jbe 0x62b4b120
cmp cx, 0x1e
je 0x62b4b250
jbe 0x62b4b100
cmp cx, 0x1f
je 0x62b4b240
cmp cx, 0x24
jne 0x62b4b350
lea rcx, [0x62fcec40]
jmp fcn.62b56c90
cmp cx, 0x45
je 0x62b4b230
cmp cx, 0x46
jne 0x62b4b350
lea rcx, [0x62fceae0]
jmp fcn.62b56c90
cmp cx, 0x1c
je 0x62b4b220
cmp cx, 0x1d
jne 0x62b4b350
lea rcx, [0x62fceca0]
jmp fcn.62b56c90
cmp cx, 0x18
je 0x62b4b210
jb 0x62b4b200
cmp cx, 0x19
je 0x62b4b1f0
cmp cx, 0x1a
jne 0x62b4b350
lea rcx, [0x62fced00]
jmp fcn.62b56c90
cmp cx, 0x11
je 0x62b4b1e0
cmp cx, 0x12
jne 0x62b4b350
lea rcx, [0x62fcee00]
jmp fcn.62b56c90
cmp cx, 0xc
je 0x62b4b1d0
jb 0x62b4b1c0
cmp cx, 0xd
je 0x62b4b1b0
cmp cx, 0xe
jne 0x62b4b350
lea rcx, [0x62fcee60]
jmp fcn.62b56c90
lea rcx, [0x62fced80]
jmp fcn.62b56c90
lea rcx, [0x62fcee80]
jmp fcn.62b56c90
lea rcx, [0x62fceec0]
jmp fcn.62b56c90
lea rcx, [0x62fceea0]
jmp fcn.62b56c90
lea rcx, [0x62fcee20]
jmp fcn.62b56c90
lea rcx, [0x62fced20]
jmp fcn.62b56c90
lea rcx, [0x62fced60]
jmp fcn.62b56c90
lea rcx, [0x62fced40]
jmp fcn.62b56c90
lea rcx, [0x62fcecc0]
jmp fcn.62b56c90
lea rcx, [0x62fceb00]
jmp fcn.62b56c90
lea rcx, [0x62fcec60]
jmp fcn.62b56c90
lea rcx, [0x62fcec80]
jmp fcn.62b56c90
lea rcx, [0x62fcece0]
jmp fcn.62b56c90
lea rcx, [0x62fceaa0]
jmp fcn.62b56c90
lea rcx, [0x62fceac0]
jmp fcn.62b56c90
lea rcx, [0x62fcedc0]
jmp fcn.62b56c90
lea rcx, [0x62fcede0]
jmp fcn.62b56c90
lea rcx, [0x62fcee40]
jmp fcn.62b56c90
lea rcx, [0x62fcefe0]
jmp fcn.62b56c90
lea rcx, [0x62fcf020]
jmp fcn.62b56c90
lea rcx, [0x62fcf000]
jmp fcn.62b56c90
lea rcx, [0x62fcef80]
jmp fcn.62b56c90
lea rcx, [0x62fcec00]
jmp fcn.62b56c90
lea rcx, [0x62fcef20]
jmp fcn.62b56c90
lea rcx, [0x62fcef40]
jmp fcn.62b56c90
lea rcx, [0x62fcefa0]
jmp fcn.62b56c90
lea rcx, [0x62fceee0]
jmp fcn.62b56c90
lea rcx, [0x62fcf0e0]
jmp fcn.62b56c90
lea rcx, [0x62fceba0]
jmp fcn.62b56c90
lea rcx, [0x62fcebc0]
jmp fcn.62b56c90
lea rcx, [0x62fceb40]
jmp fcn.62b56c90
lea rcx, [0x62fcec20]
jmp fcn.62b56c90
Function at 0x62b506a0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
xor r8d, r8d
test rdx, rdx
mov rsi, rcx
mov rbx, rdx
je 0x62b506bf
mov rcx, rdx
call sub.msvcrt.dll_strlen
mov r8, rax
mov rcx, rbx
mov r9, rsi
mov edx, 1
call sub.msvcrt.dll_fwrite
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp sub.msvcrt.dll_fflush

Function at 0x62b51580
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, 2
call qword [fcn.62b5c430]
mov r8d, 0x3f
mov edx, 1
lea rcx, str._GC__cannot_register_global_variable__too_many_global_variables
mov rbx, rax
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rcx, rbx
call sub.msvcrt.dll_fflush
mov ecx, 1
call sub.msvcrt.dll_exit
nop

Function at 0x62b515c0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, 2
call qword [fcn.62b5c430]
mov r8d, 0x4b
mov edx, 1
lea rcx, str._GC__cannot_register_thread_local_variable__too_many_thread_local_variables
mov rbx, rax
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rcx, rbx
call sub.msvcrt.dll_fflush
mov ecx, 1
call sub.msvcrt.dll_exit
nop

Function at 0x62b5a330
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [0x62fd2900]
mov rcx, qword [rax]
test rcx, rcx
je 0x62b5a350
add rsp, 0x38
pop rbx
pop rsi
jmp 0x62b598a0
lea rcx, [0x62feca30]
mov edx, 0x30
call fcn.62b57010
lea rcx, [0x62fd1fe0]
mov rbx, rax
mov rsi, qword [rbx + 0x18]
lea rax, [0x62feca80]
mov qword [rbx], rax
lea rax, str.ReraiseDefect
mov qword [rbx + 0x10], rax
call fcn.62b56a00
test rsi, rsi
mov qword [rbx + 0x18], rax
je 0x62b5a3b8
mov rax, qword [rsi - 0x10]
lea rdx, [rsi - 0x10]
sub rax, 8
cmp rax, 7
mov qword [rsi - 0x10], rax
ja 0x62b5a3b8
mov rcx, qword [0x62fd2920]
add rcx, 0x18
call fcn.62b55b10
mov qword [rsp + 0x20], 0x35
lea r9, str.fatal.nim
mov rcx, rbx
lea r8, str.sysFatal
lea rdx, str.ReraiseDefect
call fcn.62b599c0
nop
nop
Function at 0x62b5a3e0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rbx
mov rbp, rsp
sub rsp, 0x150
cmp qword [0x62feca70], 0
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov byte [rbp - 0x111], 1
je 0x62b5a4dd
mov rax, qword [0x62fd2910]
lea rcx, [rbp - 0x110]
mov rdx, qword [rax]
mov qword [rax], rcx
add rcx, 0x10
mov qword [rbp - 0x110], rdx
mov rdx, rbp
call sub.msvcrt.dll__setjmp
cdqe
test rax, rax
mov qword [rbp - 0x108], rax
jne 0x62b5a500
xor ebx, ebx
cmp qword [rbp + 0x20], 0
je 0x62b5a4af
mov rcx, qword [rbp + 0x20]
call sub.msvcrt.dll_strlen
mov edx, 0x18
mov qword [rbp - 0x128], 7
cmp rax, 6
mov rsi, rax
jbe 0x62b5a479
lea rdx, [rax + 0x11]
mov qword [rbp - 0x128], rax
mov r8, qword [0x62fd2920]
mov rcx, qword [0x62fd2980]
call fcn.62b56a90
mov rdx, qword [rbp + 0x20]
movq xmm0, rsi
lea rcx, [rax + 0x10]
movhps xmm0, qword [rbp - 0x128]
mov rbx, rax
movups xmmword [rax], xmm0
lea r8, [rsi + 1]
call sub.msvcrt.dll_memcpy
mov rcx, rbx
call qword [0x62feca70]
mov rax, qword [0x62fd2910]
mov byte [rbp - 0x111], 0
cmp qword [rbp - 0x108], 0
mov rdx, qword [rax]
mov rdx, qword [rdx]
mov qword [rax], rdx
jne 0x62b5a579
movzx eax, byte [rbp - 0x111]
test al, al
jne 0x62b5a590
add rsp, 0x150
pop rbx
pop rsi
pop rbp
ret
mov rax, qword [0x62fd2910]
mov rdx, qword [rax]
mov rdx, qword [rdx]
mov qword [rbp - 0x108], 0
mov qword [rax], rdx
mov rdx, qword [0x62fd2900]
mov rax, qword [rdx]
mov rbx, qword [rax + 0x28]
test rbx, rbx
je 0x62b5a53b
add qword [rbx - 0x10], 8
mov rax, qword [rdx]
test rax, rax
je 0x62b5a561
mov rsi, qword [rax - 0x10]
lea rdx, [rax - 0x10]
lea rcx, [rsi - 8]
cmp rcx, 7
mov qword [rax - 0x10], rcx
ja 0x62b5a561
mov rcx, qword [0x62fd2920]
add rcx, 0x18
call fcn.62b55b10
mov rax, qword [0x62fd2900]
cmp qword [rbp - 0x108], 0
mov qword [rax], rbx
je 0x62b5a4dd
call fcn.62b5a330
jmp 0x62b5a4dd
mov ecx, 2
call qword [fcn.62b5c430]
mov rcx, qword [rbp + 0x20]
mov edx, 1
mov r8, qword [rbp + 0x28]
mov rbx, rax
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rcx, rbx
call sub.msvcrt.dll_fflush
jmp 0x62b5a4ec
Function at 0x62b5b270
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x62fd9bc4]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x62b5b3f8
mov rax, qword [0x62fd9bc8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x62b5b2bc
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x62b5b345
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x62b5b2a0
mov rcx, rbx
call fcn.62b5bf10
test rax, rax
mov r12, rax
je 0x62b5b42d
mov rax, qword [0x62fd9bc8]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call fcn.62b5c040
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x62fd9bc8]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x62b5b410
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x62b5b33e
sub eax, 0x40
and eax, 0xffffffbf
jne 0x62b5b3a0
add dword [0x62fd9bc4], 1
cmp edi, 8
jae 0x62b5b373
test dil, 4
jne 0x62b5b3e4
test edi, edi
je 0x62b5b368
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x62b5b3ff
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x62b5b368
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x62b5b38c
jmp 0x62b5b368
add rsi, qword [0x62fd9bc8]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x62b5b33e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.62b5c590
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x62b5b368
xor esi, esi
jmp 0x62b5b2c7
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x62b5b368
mov rax, qword [0x62fd9bc8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call fcn.62b5c590
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.62b5c590
nop
nop dword [rax]

Function at 0x62b5bb80
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x62fd9ea0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x62fd9e80]
test rbx, rbx
je 0x62b5bbd4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x62b5bbcb
test rsi, rsi
je 0x62b5bbcb
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x62b5bbb0
lea rcx, [0x62fd9ea0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x62b5bf10
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x62fd2880]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x62b5bf7d
mov rcx, r8
call fcn.62b5bdf0
test eax, eax
je 0x62b5bf7d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x62b5bf7d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x62b5bf74
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x62b5bf7f
add rax, 0x28
cmp rax, r9
jne 0x62b5bf60
xor eax, eax
add rsp, 0x28
ret

Function at 0x62b5c590
Capabilities:
Write file on windows

Disassembly:
lea rcx, [0x62b413a0]
jmp 0x62b41380
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.62b5c430
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.62b5c430
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
jmp 0x62b41390
Function at 0x6d8ac070
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x6d8cd5e4]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x6d8ac1f8
mov rax, qword [0x6d8cd5e8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x6d8ac0bc
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x6d8ac145
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x6d8ac0a0
mov rcx, rbx
call sym.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x6d8ac22d
mov rax, qword [0x6d8cd5e8]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call sym._GetPEImageBase
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x6d8cd5e8]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x6d8ac210
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x6d8ac13e
sub eax, 0x40
and eax, 0xffffffbf
jne 0x6d8ac1a0
add dword [0x6d8cd5e4], 1
cmp edi, 8
jae 0x6d8ac173
test dil, 4
jne 0x6d8ac1e4
test edi, edi
je 0x6d8ac168
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x6d8ac1ff
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x6d8ac168
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x6d8ac18c
jmp 0x6d8ac168
add rsi, qword [0x6d8cd5e8]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x6d8ac13e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x6d8ac168
xor esi, esi
jmp 0x6d8ac0c7
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x6d8ac168
mov rax, qword [0x6d8cd5e8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call sym.__report_error
nop
nop dword [rax]

Function at 0x6d8ac980
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x6d8cd8c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x6d8cd8a0]
test rbx, rbx
je 0x6d8ac9d4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x6d8ac9cb
test rsi, rsi
je 0x6d8ac9cb
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x6d8ac9b0
lea rcx, [0x6d8cd8c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x6d8acc10
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x6d8acc20
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x6d8acc30
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x6d8acc71
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x6d8acc68
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x6d8acc73
add rax, 0x28
cmp rax, r9
jne 0x6d8acc54
xor eax, eax
ret

Function at 0x6d8acd10
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6d8ca1f0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x6d8acd7d
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d8acd7d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6d8acd7d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6d8acd74
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6d8acd7f
add rax, 0x28
cmp rax, r9
jne 0x6d8acd60
xor eax, eax
add rsp, 0x28
ret

Function at 0x6d8ace80
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6d8ca1f0]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
je 0x6d8acea0
add rsp, 0x28
ret
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d8ace98
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6d8acefd
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6d8acef4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6d8acf04
add rax, 0x28
cmp rax, r9
jne 0x6d8acee0
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret

Function at 0x6d8acf20
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x6d8ca1f0]
cmp word [r11], 0x5a4d
mov r9d, ecx
jne 0x6d8acf8e
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d8acf8e
movsxd rax, dword [r11 + 0x3c]
add rax, r11
mov edx, dword [rax + 0x90]
test edx, edx
je 0x6d8acf8e
movzx ecx, word [rax + 0x14]
lea rcx, [rax + rcx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x6d8acf8e
sub eax, 1
lea rax, [rax + rax*4]
lea rax, [rcx + rax*8 + 0x28]
mov r10d, dword [rcx + 0xc]
cmp rdx, r10
mov r8, r10
jb 0x6d8acf85
add r8d, dword [rcx + 8]
cmp rdx, r8
jb 0x6d8acf95
add rcx, 0x28
cmp rcx, rax
jne 0x6d8acf70
xor eax, eax
add rsp, 0x28
ret
add rdx, r11
jne 0x6d8acfa8
jmp 0x6d8acf8e
sub r9d, 1
add rdx, 0x14
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x6d8acfb6
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x6d8acf8e
test r9d, r9d
jg 0x6d8acfa0
mov eax, dword [rdx + 0xc]
add rax, r11
add rsp, 0x28
ret
Function at 0x6d8ad320
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x1400025bc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002606
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002606
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002606
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002606
cmp dword [rcx + 0x84], 0xe
jbe 0x140002606
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002608
xor al, al
add rsp, 0x28
ret