joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400033d4
Capabilities:
Attach user process memory
Find process by pid
Print debug messages

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x58], rax
and qword [rsp + 0x20], 0
lea rax, [rdx - 0x10001]
xorps xmm0, xmm0
mov rbx, rcx
movabs rcx, 0x7ffffffefffe
mov r14, r9
mov rdi, rdx
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
cmp rax, rcx
ja 0x140003545
mov edx, r8d
xor ecx, ecx
mov ebp, r8d
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rsi, rax
test rax, rax
jne 0x14000344b
lea rcx, [0x140003de0]
jmp 0x14000354c
mov r8, rbp
mov rdx, r14
mov rcx, rsi
call fcn.140003800
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test eax, eax
jns 0x140003489
lea rcx, [0x140003db0]
call sub.ntoskrnl.exe_DbgPrint
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x140003551
lfence
mov rcx, qword [rsp + 0x20]
lea rdx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
jne 0x1400034b9
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
jmp 0x140003551
lfence
mov r8, rbp
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_MmCreateMdl]
mov rdi, rax
test rax, rax
je 0x140003520
lfence
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_MmBuildMdlForNonPagedPool]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmMapLockedPages]
mov rbx, rax
test rax, rax
je 0x140003512
lfence
mov r8, rbp
mov rdx, rsi
mov rcx, rax
call fcn.140003800
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmUnmapLockedPages]
xor ebx, ebx
jmp 0x140003517
mov ebx, 0xc0000001
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, ebx
jmp 0x140003556
lea rcx, [0x140003e00]
call sub.ntoskrnl.exe_DbgPrint
mov eax, 0xc0000001
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140003580
add rsp, 0x60
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x141026878
Capabilities:
Encode data using xor

Disassembly:
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x1410268a1
pop rbp
sub rbp, 0x29
sub rbp, 0x1026878
jmp 0x141026901
sub rsp, 0x20
jmp 0x141026911
mov rax, 0x1026878
add rax, rbp
add rax, 0xcb
mov rcx, 0x64a
mov rdx, 0xffffffffe97a1fd7
invalid
xor byte [rax], dl
inc rax
dec rcx
jne 0x141026930
jmp 0x141026947
lahf
pop rsi
pop rsp
pop rsi
jmp 0x141026925
Function at 0x40a860
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
test ecx, ecx
mov ebx, ecx
je 0x40a8a9
lea rsi, [0x0047bf80]
mov rdi, qword [fcn.00455bf0]
lea rbp, [0x0046bbe8]
jmp 0x40a88d
sub rsi, 8
shr ebx, 1
je 0x40a8a9
test bl, 1
je 0x40a885
mov ecx, 1
call rdi
mov rcx, qword [rsi]
mov rdx, rax
call sub.msvcrt.dll_fputs
cmp ebx, 1
jne 0x40a8b2
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov ecx, 1
call rdi
mov r8d, 2
mov edx, 1
mov rcx, rbp
mov r9, rax
call sub.msvcrt.dll_fwrite
jmp 0x40a885

Function at 0x40c610
Capabilities:
Read file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rsi, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x98]
mov rbp, qword [rsp + 0xa0]
mov rdi, rsi
mov r14, rcx
mov r13, rdx
imul rdi, rbx
test rsi, rsi
je 0x40c733
test rbx, rbx
je 0x40c733
cmp rbx, rdi
jbe 0x40c6a1
test rbp, rbp
je 0x40c733
lea rcx, [0x0046c88f]
mov rdx, rsi
xor r12d, r12d
call fcn.00408a20
lea rcx, [0x0046c88f]
mov rdx, rbx
mov rsi, rax
call fcn.00408a20
mov r9, rbp
mov r8, rsi
lea rcx, str.Size_overflow_prevents_reading__s_elements_of_size__s_for__s_n
mov rdx, rax
call fcn.00448cd0
jmp 0x40c736
mov rax, qword [r8]
cmp rdi, rax
ja 0x40c750
mov edx, dword [0x00492388]
add edx, r9d
mov ecx, edx
add rcx, rdi
cmp rax, rcx
jb 0x40c750
mov rcx, qword [r13]
xor r8d, r8d
mov dword [rsp + 0x2c], r9d
call sub.msvcrt.dll_fseek
test eax, eax
jne 0x40c780
test r14, r14
mov r12, r14
je 0x40c7b0
mov r9, qword [r13]
mov r8, rbx
mov rdx, rsi
mov rcx, r12
call sub.msvcrt.dll_fread
cmp rbx, rax
je 0x40c736
test rbp, rbp
je 0x40c726
lea rcx, [0x0046c88f]
mov rdx, rdi
call fcn.00408a20
lea rcx, str.Unable_to_read_in__s_bytes_of__s_n
mov r8, rbp
mov rdx, rax
call fcn.00448cd0
cmp r14, r12
je 0x40c733
mov rcx, r12
call fcn.00455b00
xor r12d, r12d
mov rax, r12
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
test rbp, rbp
je 0x40c733
lea rcx, [0x0046c88f]
mov rdx, rdi
xor r12d, r12d
call fcn.00408a20
lea rcx, str.Reading__s_bytes_extends_past_end_of_file_for__s_n
mov r8, rbp
mov rdx, rax
call fcn.00448cd0
jmp 0x40c736
test rbp, rbp
je 0x40c733
mov r9d, dword [rsp + 0x2c]
mov r8, rbp
xor r12d, r12d
mov edx, dword [0x00492388]
lea rcx, str.Unable_to_seek_to_0x_lx_for__s_n
add edx, r9d
call fcn.00448cd0
jmp 0x40c736
xor edx, edx
mov rax, 0xfffffffffffffffe
div rsi
cmp rbx, rax
jb 0x40c7f3
test rbp, rbp
je 0x40c733
lea rcx, [0x0046c88f]
mov rdx, rdi
xor r12d, r12d
call fcn.00408a20
lea rcx, str.Out_of_memory_allocating__s_bytes_for__s_n
mov r8, rbp
mov rdx, rax
call fcn.00448cd0
jmp 0x40c736
lea rcx, [rdi + 1]
call sub.msvcrt.dll_malloc
test rax, rax
mov r12, rax
je 0x40c7c1
mov byte [rax + rdi], 0
jmp 0x40c6e9
Function at 0x417830
Capabilities:
Read file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov edi, r9d
mov rbp, rcx
mov rsi, r8
mov rbx, rdi
mov r12, rdi
imul rbx, r8
cmp rbx, rdx
ja 0x417920
mov rdx, rdi
mov rcx, r8
call fcn.004484c0
test rax, rax
mov r13, rax
je 0x417942
mov r9, qword [rbp]
mov r8, rsi
mov rdx, rdi
mov rcx, rax
call sub.msvcrt.dll_fread
cmp rsi, rax
jne 0x4178f5
mov edx, 8
mov rcx, rsi
call fcn.004484c0
test rax, rax
mov rbp, rax
je 0x417967
lea rbx, [rsi - 1]
test rsi, rsi
je 0x4178db
mov rsi, rdi
mov r14, qword [0x0048c400]
imul rsi, rbx
add rsi, r13
nop dword [rax + rax]
mov rcx, rsi
mov edx, r12d
sub rsi, rdi
call qword [r14]
mov qword [rbp + rbx*8], rax
sub rbx, 1
cmp rbx, 0xffffffffffffffff
jne 0x4178c0
mov rcx, r13
call fcn.00455b00
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
lea rcx, [0x0046c88f]
mov rdx, rbx
xor ebp, ebp
call fcn.00408a20
lea rcx, str.Unable_to_read_in__s_bytes_of_dynamic_data_n
mov rdx, rax
call fcn.00448cd0
mov rcx, r13
call fcn.00455b00
jmp 0x4178e3
lea rcx, [0x0046c88f]
mov rdx, r8
xor ebp, ebp
call fcn.00408a20
lea rcx, str.Invalid_number_of_dynamic_entries:__s_n
mov rdx, rax
call fcn.00448cd0
jmp 0x4178e3
lea rcx, [0x0046c88f]
mov rdx, rsi
xor ebp, ebp
call fcn.00408a20
lea rcx, str.Out_of_memory_reading__s_dynamic_entries_n
mov rdx, rax
call fcn.00448cd0
jmp 0x4178e3
lea rcx, [0x0046c88f]
mov rdx, rsi
call fcn.00408a20
lea rcx, str.Out_of_memory_allocating_space_for__s_dynamic_entries_n
mov rdx, rax
call fcn.00448cd0
mov rcx, r13
call fcn.00455b00
jmp 0x4178e3
Function at 0x41a890
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x68
mov r10, qword [rdx + 0x28]
movzx ecx, word [rcx + 0x4a]
test r9w, r9w
mov r11, r8
mov rax, rdx
cmovne r11, qword [rsp + 0xa0]
lea rsi, [rsp + 0x58]
mov rbx, r8
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 0x18]
mov qword [rsp + 0x40], rsi
lea rsi, [rsp + 0x50]
mov qword [rsp + 0x30], r11
mov word [rsp + 0x28], r9w
mov r9, r10
mov qword [rsp + 0x38], rsi
mov eax, dword [rax + 0x30]
mov dword [rsp + 0x20], eax
call fcn.0040bf90
mov edx, 4
mov rcx, rbx
call fcn.0040a010
mov rax, qword [rsp + 0x50]
test rax, rax
je 0x41a960
mov ecx, 1
mov rbx, qword [fcn.00455bf0]
call rbx
mov r8d, 2
mov edx, 1
lea rcx, [0x00475261]
mov r9, rax
call sub.msvcrt.dll_fwrite
mov ecx, 1
call rbx
mov rcx, qword [rsp + 0x50]
mov rdx, rax
call sub.msvcrt.dll_fputs
mov rdx, qword [rsp + 0x58]
test rdx, rdx
jne 0x41a970
mov ecx, 1
call rbx
mov ecx, 0x3e
mov rdx, rax
call sub.msvcrt.dll_fputc
mov rax, qword [rsp + 0x50]
add rsp, 0x68
pop rbx
pop rsi
ret
lea rcx, str.0x_lx
call sub.msvcrt.dll_printf
jmp 0x41a947
Function at 0x41bfd0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
test ecx, ecx
je 0x41c0d0
mov edi, ecx
mov esi, ecx
mov ebx, ecx
mov ebp, ecx
and edi, 2
and esi, 4
and ebx, 8
and ebp, 0x10
and ecx, 1
jne 0x41c070
test edi, edi
je 0x41c0f0
lea rdx, [0x0046bd82]
lea rcx, str._sUFLO
call sub.msvcrt.dll_printf
test esi, esi
je 0x41c0b8
lea rdx, [0x0047561b]
lea rcx, str._sOFLO
call sub.msvcrt.dll_printf
test ebx, ebx
je 0x41c104
lea rdx, [0x0047561b]
lea rcx, str._sDIV0
call sub.msvcrt.dll_printf
test ebp, ebp
je 0x41c0c4
lea rdx, [0x0047561b]
lea rcx, str._sINVAL
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp sub.msvcrt.dll_printf
mov ecx, 1
call qword [fcn.00455bf0]
mov r8d, 4
mov edx, 1
lea rcx, str.INEX
mov r9, rax
call sub.msvcrt.dll_fwrite
test edi, edi
je 0x41c120
lea rdx, [0x0047561b]
lea rcx, str._sUFLO
call sub.msvcrt.dll_printf
test esi, esi
jne 0x41c01c
test ebx, ebx
jne 0x41c037
test ebp, ebp
jne 0x41c04e
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov ecx, 1
call qword [fcn.00455bf0]
mov ecx, 0x30
mov rdx, rax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp sub.msvcrt.dll_fputc
test esi, esi
jne 0x41c110
test ebx, ebx
je 0x41c130
lea rdx, [0x0046bd82]
jmp 0x41c03e
test ebp, ebp
jne 0x41c04e
jmp 0x41c0c4
lea rdx, [0x0046bd82]
jmp 0x41c023
test esi, esi
je 0x41c02f
jmp 0x41c01c
test ebp, ebp
je 0x41c0c4
lea rdx, [0x0046bd82]
jmp 0x41c055
Function at 0x4495d0
Capabilities:
Read file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, rdx
mov r12, r8
mov ebp, r9d
mov r13, rdx
call sub.msvcrt.dll__strdup
mov dword [rbx + 0x44], ebp
xor r8d, r8d
mov edx, 8
mov qword [rbx], rax
mov rcx, r12
mov qword [rbx + 8], r12
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0
mov qword [rbx + 0x20], 0
mov dword [rbx + 0x28], 0
mov dword [rbx + 0x48], 0
mov qword [rbx + 0x30], 0
mov qword [rbx + 0x38], 0
mov dword [rbx + 0x40], 8
call sub.msvcrt.dll_fseek
test eax, eax
mov ebp, eax
jne 0x449690
lea r14, [rbx + 0x4c]
mov r9, r12
mov r8d, 0x3c
mov edx, 1
mov rcx, r14
call sub.msvcrt.dll_fread
cmp rax, 0x3c
je 0x4496b0
test rax, rax
jne 0x4497a0
mov eax, ebp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
lea rcx, str._s:_failed_to_seek_to_first_archive_header_n
mov rdx, r13
mov ebp, 1
call fcn.00448cd0
jmp 0x449678
lea rdi, str._
mov ecx, 0x10
mov rsi, r14
repe cmpsb byte [rsi], byte [rdi]
je 0x4497c0
lea rdi, str._SYM64_
mov ecx, 0x10
mov rsi, r14
repe cmpsb byte [rsi], byte [rdi]
je 0x449810
mov eax, dword [rsp + 0x80]
test eax, eax
jne 0x449840
lea rdi, [0x004855b6]
mov ecx, 0x10
mov rsi, r14
repe cmpsb byte [rsi], byte [rdi]
jne 0x449678
movzx esi, byte [rbx + 0x86]
xor edx, edx
mov byte [rbx + 0x86], 0
mov r8d, 0xa
lea rcx, [rbx + 0x7c]
call sub.msvcrt.dll_strtoul
cmp eax, 7
mov edi, eax
mov dword [rbx + 0x38], eax
mov byte [rbx + 0x86], sil
jbe 0x4497f0
test eax, eax
js 0x449854
mov eax, dword [rbx + 0x40]
lea ecx, [rdi + 1]
lea eax, [rdi + rax + 0x3c]
mov dword [rbx + 0x40], eax
call sub.msvcrt.dll_malloc
test rax, rax
mov qword [rbx + 0x30], rax
je 0x44989a
mov edx, edi
mov r9, r12
mov r8d, 1
mov rcx, rax
call sub.msvcrt.dll_fread
cmp rax, 1
jne 0x449870
mov eax, dword [rbx + 0x38]
test al, 1
jne 0x4498ab
mov rdx, qword [rbx + 0x30]
xor ebp, ebp
mov byte [rdx + rax], 0
jmp 0x449678
lea rcx, str._s:_failed_to_read_archive_header_n
mov rdx, r13
mov ebp, 1
call fcn.00448cd0
jmp 0x449678
mov r8d, dword [rsp + 0x80]
mov edx, 4
mov rcx, rbx
call fcn.00448e50
test eax, eax
jne 0x4496ed
mov ebp, 1
jmp 0x449678
mov r8d, eax
mov rdx, r13
mov ebp, 1
lea rcx, str._s:_long_name_table_is_too_small___size___ld__n
call fcn.00448cd0
jmp 0x449678
mov r8d, dword [rsp + 0x80]
mov dword [rbx + 0x48], 1
mov edx, 8
mov rcx, rbx
call fcn.00448e50
test eax, eax
jne 0x4496ed
jmp 0x4497dd
lea rcx, str._s_has_no_archive_index_n
mov rdx, r13
call sub.msvcrt.dll_printf
jmp 0x4496ed
mov r8d, eax
mov rdx, r13
mov ebp, 1
lea rcx, str._s:_long_name_table_is_too_big___size__0x_lx__n
call fcn.00448cd0
jmp 0x449678
mov rcx, qword [rbx + 0x30]
mov ebp, 1
call fcn.00455b00
mov qword [rbx + 0x30], 0
mov rdx, r13
lea rcx, str._s:_failed_to_read_long_symbol_name_string_table_n
call fcn.00448cd0
jmp 0x449678
lea rcx, str.Out_of_memory_reading_long_symbol_names_in_archive_n
call fcn.00448cd0
jmp 0x4497dd
mov rcx, r12
call sub.msvcrt.dll_getc
mov eax, dword [rbx + 0x38]
jmp 0x449787
Function at 0x449980
Capabilities:
Read file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rcx, qword [rcx + 8]
mov rsi, r8
xor r8d, r8d
call sub.msvcrt.dll_fseek
test eax, eax
jne 0x4499d3
mov r9, qword [rbx + 8]
lea rcx, [rbx + 0x4c]
mov r8d, 0x3c
mov edx, 1
call sub.msvcrt.dll_fread
cmp rax, 0x3c
jne 0x4499f0
cmp word [rbx + 0x86], 0xa60
jne 0x449a01
mov rdx, rsi
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.00449a20
mov rdx, qword [rbx]
lea rcx, str._s:_failed_to_seek_to_next_file_name_n
call fcn.00448cd0
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov rdx, qword [rbx]
lea rcx, str._s:_failed_to_read_archive_header_n
call fcn.00448cd0
jmp 0x4499e2
mov rdx, qword [rbx]
lea rcx, str._s:_did_not_find_a_valid_archive_header_n
call fcn.00448cd0
jmp 0x4499e2
Function at 0x4538a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x004951e4]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x453a28
mov rax, qword [0x004951e8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x4538ec
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x453975
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x4538d0
mov rcx, rbx
call fcn.00454540
test rax, rax
mov r12, rax
je 0x453a5d
mov rax, qword [0x004951e8]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call fcn.00454670
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x004951e8]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x453a40
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x45396e
sub eax, 0x40
and eax, 0xffffffbf
jne 0x4539d0
add dword [0x004951e4], 1
cmp edi, 8
jae 0x4539a3
test dil, 4
jne 0x453a14
test edi, edi
je 0x453998
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x453a2f
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x453998
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x4539bc
jmp 0x453998
add rsi, qword [0x004951e8]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x45396e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.004568d0
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x453998
xor esi, esi
jmp 0x4538f7
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x453998
mov rax, qword [0x004951e8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call fcn.004568d0
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.004568d0
nop
nop dword [rax]

Function at 0x4541b0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x004954c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004954a0]
test rbx, rbx
je 0x454204
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x4541fb
test rsi, rsi
je 0x4541fb
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x4541e0
lea rcx, [0x004954c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x454540
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x0048c2e0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x4545ad
mov rcx, r8
call fcn.00454420
test eax, eax
je 0x4545ad
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x4545ad
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x4545a4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x4545af
add rax, 0x28
cmp rax, r9
jne 0x454590
xor eax, eax
add rsp, 0x28
ret
Function at 0x4568d0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.00455bf0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.00455bf0
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
push rbp
mov rbp, rsp
pop rbp
jmp fcn.00401530
Function at 0x1400154d0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x140020690], rbx
je 0x14001551c
cmp rax, rbx
jne 0x14001550f
mov ebx, 1
mov esi, ebx
jmp 0x140015521
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400154f4
mov ebx, 1
mov eax, dword [0x140020698]
cmp eax, ebx
jne 0x140015537
mov ecx, 0x1f
call fcn.1400b0000
jmp 0x14001559c
mov eax, dword [0x140020698]
test eax, eax
jne 0x140015596
mov dword [0x140020698], ebx
lea r15, [0x140017850]
lea rdi, [0x140017838]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x140015588
test eax, eax
jne 0x14001558c
cmp qword [rdi], 0
je 0x14001557d
mov rax, qword [rdi]
mov rcx, qword [vtable.H_MA8HI.0]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x14001555e
test eax, eax
je 0x14001559c
mov eax, 0xff
jmp 0x140015678
mov dword [0x1400200a4], ebx
mov eax, dword [0x140020698]
cmp eax, ebx
jne 0x1400155c3
lea rdx, [0x140017830]
lea rcx, [0x140017820]
call sub.msvcrt.dll__initterm
mov dword [0x140020698], 2
test esi, esi
jne 0x1400155d0
xor eax, eax
xchg qword [0x140020690], rax
cmp qword [0x1400206a0], 0
je 0x140015604
lea rcx, [0x1400206a0]
call fcn.140015d50
test eax, eax
je 0x140015604
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x1400206a0]
mov r9, qword [vtable.H_MA8HI.0]
call r9
mov r8, qword [0x1400200b8]
mov rdx, qword [0x1400200b0]
mov ecx, dword [0x1400200a8]
call fcn.140001724
mov dword [0x1400200a0], eax
cmp dword [0x1400200c0], 0
jne 0x140015634
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1400200a4], 0
jne 0x140015649
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1400200a0]
jmp 0x140015678
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.140015de4
add rsp, 0x28
jmp 0x1400154d0

Function at 0x140015c3c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140015c88
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140015c80
cmp dword [rcx + 0x3c], edx
jl 0x140015c80
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140015c80
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140015c88
mov rax, rdx
add rsp, 0x18
ret
Function at 0x140018a94
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x1400258e0], eax
call fcn.140019344
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x1400258e0], 0
jne case.default.0x140018aea
mov ecx, 1
call fcn.140019344
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
call qword [rsi + rbp*4]
jnp 0x14003f686
push qword [rcx + riz*2 - 0x1a]
invalid
je 0x14003f6ea
out 0xde, al
invalid
movabs al, byte [0x745c237bf0d78f7f]
sub ah, byte [rdi + 0x7f]
push rdx
xlatb
invalid
xor eax, 0xd77311e8
invalid
jl 0x14003f685
mov bl, 0xf0
jnp 0x14003f6ad
cwde
jg 0x14003f6e0
scasd eax, dword [rdi]
invalid
Function at 0x2513000
Capabilities:
Decompress data using aplib

Disassembly:
jmp 0x251300a
jmp 0x251500f
jmp fcn.01bb1058