joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000c310
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov eax, 0x6d
mov dword [rbp - 0x20], 0x3c0006
lea rcx, [rbp - 0x20]
mov word [rbp - 0xc], ax
mov dword [rbp - 0x1c], 0x210031
mov dword [rbp - 0x18], 0x27002a
mov dword [rbp - 0x14], 0x24002b
mov dword [rbp - 0x10], 0x4c0020
call fcn.140004fd0
mov rcx, rax
call 0x14000c310
mov qword [0x1400161b8], rax
lea rcx, [rbp - 0x20]
mov eax, 0x73
mov dword [rbp - 0x20], 0x3c0006
mov word [rbp - 0x10], ax
mov dword [rbp - 0x1c], 0x210031
mov dword [rbp - 0x18], 0x27002a
mov dword [rbp - 0x14], 0x57005a
call fcn.1400022a0
mov rcx, rax
call 0x14000c310
lea rcx, [rbp - 0x20]
mov qword [0x1400161a8], rax
mov dword [rbp - 0x20], 0xd0023
mov dword [rbp - 0x1c], 0x30007
mov dword [rbp - 0x18], 0x6b0003
call fcn.140004e60
mov rcx, rax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
jmp 0x14000c310
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x14000c372
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
mov r8, rax
call fcn.14000cb00
test al, al
jne 0x14000c384
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x14000c340
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14000e840
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
movsxd rax, dword [rcx + 0x3c]
mov r12, rdx
mov rdx, rcx
mov ecx, dword [rax + rcx + 0x88]
xor eax, eax
add rcx, rdx
mov dword [rbp - 0x2c], eax
mov qword [rbp - 0x28], rcx
mov r8d, dword [rcx + 0x1c]
mov r9d, dword [rcx + 0x20]
add r8, rdx
mov r10d, dword [rcx + 0x24]
add r9, rdx
add r10, rdx
mov qword [rbp - 0x20], r8
mov qword [rbp - 0x18], r9
mov qword [rbp - 0x10], r10
cmp dword [rcx + 0x18], eax
jbe 0x14000ea6e
mov word [rbp + 0x50], 0x794d
mov word [rbp + 0x58], 0x794d
nop
mov esi, dword [r9 + rax*4]
lea rcx, [rbp + 0x50]
movzx eax, word [r10 + rax*2]
add rsi, rdx
xor edi, edi
mov r15d, dword [r8 + rax*4]
add r15, rdx
mov qword [rbp - 8], r15
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [rsi], cl
je 0x14000e8f4
nop dword [rax]
lea rcx, [rbp + 0x50]
inc rdi
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [rdi + rsi], cl
jne 0x14000e8e0
lea rcx, [rbp + 0x58]
xor ebx, ebx
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [r12], cl
je 0x14000e925
nop dword [rax + rax]
lea rcx, [rbp + 0x58]
inc rbx
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [rbx + r12], cl
jne 0x14000e910
cmp rdi, rbx
jne 0x14000ea42
mov r13, rsi
mov word [rbp - 0x50], 0x794d
sub r13, r12
mov r14, r12
nop dword [rax]
lea rcx, [rbp - 0x50]
xor ebx, ebx
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [rsi], cl
je 0x14000e966
lea rcx, [rbp - 0x50]
inc rbx
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [rbx + rsi], cl
jne 0x14000e952
mov rax, r14
sub rax, r12
dec rbx
cmp rax, rbx
jae 0x14000ea68
movsx r15d, byte [r14 + r13]
lea rcx, [rbp - 0x4e]
mov dword [rbp - 0x4e], 0x79002c
call fcn.140002490
movzx eax, word [rax]
cmp r15d, eax
jl 0x14000e9d8
lea rcx, [rbp - 0x4a]
mov dword [rbp - 0x4a], 0x790037
call fcn.140002490
movzx ecx, word [rax]
cmp r15d, ecx
jg 0x14000e9d8
lea rcx, [rbp - 0x46]
mov dword [rbp - 0x46], 0x79002c
mov dword [rbp - 0x42], 0x79000c
call fcn.140002490
lea rcx, [rbp - 0x42]
movzx ebx, byte [rax]
call fcn.140002490
movzx ecx, byte [rax]
sub cl, bl
add r15b, cl
movsx edi, byte [r14]
lea rcx, [rbp - 0x3e]
mov dword [rbp - 0x3e], 0x79002c
call fcn.140002490
movzx eax, word [rax]
cmp edi, eax
jl 0x14000ea35
lea rcx, [rbp - 0x3a]
mov dword [rbp - 0x3a], 0x790037
call fcn.140002490
movzx ecx, word [rax]
cmp edi, ecx
jg 0x14000ea35
lea rcx, [rbp - 0x36]
mov dword [rbp - 0x36], 0x79002c
mov dword [rbp - 0x32], 0x79000c
call fcn.140002490
lea rcx, [rbp - 0x32]
movzx ebx, byte [rax]
call fcn.140002490
movzx ecx, byte [rax]
sub cl, bl
add dil, cl
cmp r15b, dil
jne 0x14000ea42
inc r14
jmp 0x14000e940
mov eax, dword [rbp - 0x2c]
mov rcx, qword [rbp - 0x28]
inc eax
mov dword [rbp - 0x2c], eax
cmp eax, dword [rcx + 0x18]
jae 0x14000ea6e
mov rdx, qword [rbp + 0x40]
mov r8, qword [rbp - 0x20]
mov r9, qword [rbp - 0x18]
mov r10, qword [rbp - 0x10]
jmp 0x14000e8b0
mov rax, qword [rbp - 8]
jmp 0x14000ea70
xor eax, eax
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000252b
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
sub rsp, 0x28
xor r8d, r8d
mov r13, rcx
mov r12, rdx
test rdx, rdx
je 0x14000254c
mov rcx, rdx
call sub.msvcrt.dll_strlen
mov r8, rax
mov rcx, r12
mov r9, r13
mov edx, 1
call sub.msvcrt.dll_fwrite
mov rcx, r13
add rsp, 0x28
pop r12
pop r13
jmp fcn.140016110

Function at 0x140005322
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
sub rsp, 0x38
mov qword [rsp + 0x28], rdx
mov r13, rcx
mov ecx, 2
call qword [fcn.1400166d0]
mov r8, qword [rsp + 0x28]
mov rcx, r13
mov edx, 1
mov r12, rax
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rcx, r12
add rsp, 0x38
pop r12
pop r13
jmp fcn.140016110
push r13
push r12
sub rsp, 0x38
cmp qword [0x1402890f0], 0
jne 0x140005381
add rsp, 0x38
pop r12
pop r13
jmp 0x140005322
lea r13, [rsp + 0x20]
mov rdx, rcx
mov rcx, r13
call fcn.140005294
mov r12, qword [rsp + 0x28]
mov rcx, r13
call qword [0x1402890f0]
test r12, r12
je 0x1400053b4
test byte [r12 + 7], 0x40
jne 0x1400053b4
mov rcx, r12
call fcn.140003632
lea rcx, [0x140017300]
call fcn.140011280
cmp byte [rax], 0
je 0x1400053ee
mov byte [rax], 0
lea rcx, [0x140017200]
call fcn.140011280
xor r8d, r8d
mov rcx, rax
mov rax, qword [rax]
mov rdx, qword [rax + 0x38]
add rsp, 0x38
pop r12
pop r13
jmp fcn.140004611
add rsp, 0x38
pop r12
pop r13
ret

Function at 0x140005365
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
sub rsp, 0x38
mov qword [rsp + 0x28], rdx
mov r13, rcx
mov ecx, 2
call qword [fcn.1400166d0]
mov r8, qword [rsp + 0x28]
mov rcx, r13
mov edx, 1
mov r12, rax
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rcx, r12
add rsp, 0x38
pop r12
pop r13
jmp fcn.140016110
push r13
push r12
sub rsp, 0x38
cmp qword [0x1402890f0], 0
jne 0x140005381
add rsp, 0x38
pop r12
pop r13
jmp 0x140005322
lea r13, [rsp + 0x20]
mov rdx, rcx
mov rcx, r13
call fcn.140005294
mov r12, qword [rsp + 0x28]
mov rcx, r13
call qword [0x1402890f0]
test r12, r12
je 0x1400053b4
test byte [r12 + 7], 0x40
jne 0x1400053b4
mov rcx, r12
call fcn.140003632
lea rcx, [0x140017300]
call fcn.140011280
cmp byte [rax], 0
je 0x1400053ee
mov byte [rax], 0
lea rcx, [0x140017200]
call fcn.140011280
xor r8d, r8d
mov rcx, rax
mov rax, qword [rax]
mov rdx, qword [rax + 0x38]
add rsp, 0x38
pop r12
pop r13
jmp fcn.140004611
add rsp, 0x38
pop r12
pop r13
ret
Function at 0x140005a90
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
xor r12d, r12d
lea rbp, [0x140017300]
mov rsi, rcx
mov rbx, rdx
lea rdi, [rsp + 0x20]
lea rcx, [0x1402890c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp r12, rbx
jl 0x140005b14
mov rbx, qword [fcn.1400166d0]
mov ecx, 1
call rbx
mov r8d, 1
mov edx, 1
lea rcx, [0x1400182fb]
mov r9, rax
call sub.msvcrt.dll_fwrite
mov ecx, 1
call rbx
mov rcx, rax
call fcn.140016110
lea rcx, [0x1402890c0]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test r12, r12
jns 0x140005b31
lea rdx, [rbx - 1]
mov rcx, r12
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp fcn.140004d3a
mov r13, r12
mov ecx, 1
call qword [fcn.1400166d0]
shl r13, 4
xor r8d, r8d
mov rdx, rdi
add r13, rsi
mov rcx, rax
movups xmm0, xmmword [r13]
movups xmmword [rsp + 0x20], xmm0
call fcn.14000596e
mov rcx, rbp
call fcn.140011280
cmp byte [rax], 0
jne 0x140005b86
add r12, 1
jno 0x140005abe
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp fcn.14000374a
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x14000d1a8
Capabilities:
Parse pe header

Disassembly:
push r12
sub rsp, 0x20
test rcx, rcx
je 0x14000d1e9
cmp word [rcx], 0x5a4d
jne 0x14000d1e9
movsxd rdx, dword [rcx + 0x3c]
cmp edx, 0x400
jg 0x14000d1e9
call fcn.140006d94
mov rcx, qword [0x140285480]
mov r12, rax
call fcn.140011280
cmp byte [rax], 0
jne 0x14000d1e9
cmp dword [r12], 0x4550
je 0x14000d1ec
xor r12d, r12d
mov rax, r12
add rsp, 0x20
pop r12
ret

Function at 0x140010320
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.1400166d0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.1400166d0
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]
Function at 0x140010390
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x140289a74]
mov r12, rcx
mov rsi, rdx
mov rbx, r8
test edi, edi
jle 0x140010540
mov rax, qword [0x140289a78]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp r12, rdx
jb 0x1400103dc
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x140010467
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x1400103c0
mov rcx, r12
call fcn.140010e40
mov rbp, rax
test rax, rax
je 0x14001059d
mov rax, qword [0x140289a78]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call fcn.140010f70
mov ecx, dword [rbp + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x140289a78]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140010582
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140010460
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x1400104f0
add dword [0x140289a74], 1
cmp ebx, 8
jae 0x140010498
test bl, 4
jne 0x140010550
test ebx, ebx
je 0x140010489
movzx eax, byte [rsi]
mov byte [r12], al
test bl, 2
jne 0x140010570
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi]
lea rcx, [r12 + 8]
and rcx, 0xfffffffffffffff8
mov qword [r12], rax
mov eax, ebx
mov rdx, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], rdx
sub r12, rcx
add ebx, r12d
sub rsi, r12
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x140010489
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x1400104ca
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rdi, qword [0x140289a78]
mov qword [rdi + 8], rcx
mov r9, rdi
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140010460
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140010320
xor edi, edi
jmp 0x1400103e7
mov eax, dword [rsi]
mov ebx, ebx
mov dword [r12], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r12 + rbx - 4], eax
jmp 0x140010489
mov ebx, ebx
movzx eax, word [rsi + rbx - 2]
mov word [r12 + rbx - 2], ax
jmp 0x140010489
mov rax, qword [0x140289a78]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call fcn.140010320
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.140010320
nop
nop dword [rax]
Function at 0x140010ab0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x140289ae0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140289ac0]
test rbx, rbx
je 0x140010b04
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x140010afb
test r12, r12
je 0x140010afb
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140010ae0
lea rcx, [0x140289ae0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140010e40
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x140285490]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x140010eb9
mov rcx, r10
call fcn.140010d10
test eax, eax
je 0x140010eb9
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x140010eb6
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x140010ead
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x140010eb9
add r8, 0x28
cmp r8, r9
jne 0x140010e98
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret

Function at 0x140011220
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
xor ecx, ecx
xor r9d, r9d
mov r8d, 0xffff
mov dword [0x140289b60], 0xffffffff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov qword [0x140289b68], rax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ecx, eax
cmp eax, 0xffffffff
je 0x140011270
lea rdx, [0x140011130]
mov dword [0x140289b58], eax
call fcn.140016910
test eax, eax
jne 0x140011278
add rsp, 0x28
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140011267
call sub.msvcrt.dll_abort
nop
nop
Function at 0x140011280
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
mov r13, qword [0x140285420]
mov r11d, dword [r13]
mov r12, rcx
test r11d, r11d
jne 0x1400112c0
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x140011328
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
ret
mov rsi, qword [rcx + 0x10]
test rsi, rsi
je 0x140011340
mov r13d, dword [0x140289b58]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rdi
mov r14d, eax
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, r14d
mov r13, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test r13, r13
je 0x1400113b8
mov rbx, qword [r13]
cmp rbx, rsi
jb 0x140011400
sub rsi, 1
mov rax, qword [r13 + rsi*8 + 8]
test rax, rax
jne 0x1400112a9
mov rcx, r12
call fcn.140011180
mov qword [r13 + rsi*8 + 8], rax
jmp 0x1400112a9
call fcn.140011180
mov qword [r12 + 0x10], rax
jmp 0x1400112a9
mov r10d, dword [r13]
test r10d, r10d
je 0x140011462
mov r9d, dword [0x1400174d0]
test r9d, r9d
je 0x140011490
lock add dword [0x140289b60], 1
jne 0x1400114c4
mov rsi, qword [r12 + 0x10]
test rsi, rsi
je 0x140011470
mov eax, dword [r13]
test eax, eax
je 0x1400112c9
mov eax, 0xffffffff
lock xadd dword [0x140289b60], eax
sub eax, 1
js 0x1400112c9
mov rcx, qword [0x140289b68]
xor r8d, r8d
mov edx, 1
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
jmp 0x1400112c9
lea rcx, [rsi + 0x21]
mov edx, 8
lea rbx, [rsi + 0x20]
call sub.msvcrt.dll_calloc
mov r13, rax
test rax, rax
je 0x1400114eb
mov qword [rax], rbx
mov ecx, dword [0x140289b58]
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x140011307
call rdi
jmp 0x140011307
lea r14, [rbx + rbx]
lea rax, [rsi + 0x20]
mov rcx, r13
cmp rsi, r14
cmova r14, rax
lea rdx, [r14*8 + 8]
call sub.msvcrt.dll_realloc
mov r13, rax
test rax, rax
je 0x1400114eb
mov qword [rax], r14
sub r14, rbx
lea rcx, [rax + rbx*8 + 8]
xor edx, edx
lea r8, [r14*8]
call sub.msvcrt.dll_memset
jmp 0x1400113d9
call fcn.140011220
mov dword [0x1400174d0], 1
mov edx, dword [r13]
test edx, edx
jne 0x14001135d
mov rsi, qword [r12 + 0x10]
test rsi, rsi
jne 0x1400112c9
mov rax, qword [0x140289b50]
lea rsi, [rax + 1]
mov qword [0x140289b50], rsi
mov qword [r12 + 0x10], rsi
jmp 0x140011379
lock add dword [0x1400174d4], 1
je 0x140011447
mov r8d, dword [0x1400174d0]
mov rsi, qword [sym.imp.KERNEL32.dll_Sleep]
lea rbx, [0x1400174d0]
test r8d, r8d
jne 0x140011456
nop dword [rax]
xor ecx, ecx
call rsi
mov ecx, dword [rbx]
test ecx, ecx
je 0x1400114b8
jmp 0x140011456
mov rcx, qword [0x140289b68]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14001136b
lock sub dword [0x140289b60], 1
jmp 0x14001136b
call sub.msvcrt.dll_abort
nop
nop word cs:[rax + rax]
nop dword [rax]
cmp qword [rcx], rdx
jae 0x140011510
mov qword [rcx], rdx
mov qword [rcx + 0x18], 0
cmp qword [rcx + 8], r8
jae 0x14001151a
mov qword [rcx + 8], r8
test r9, r9
je 0x140011524
cmp qword [rcx], rdx
je 0x140011528
ret
mov qword [rcx + 0x18], r9
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140004450]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x140004460]
mov dword [rax], 1
mov rax, qword [0x140004470]
mov dword [rax], 1
mov rax, qword [0x1400043f0]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x140004440]
mov dword [0x14000700c], ecx
mov eax, dword [rax]
test eax, eax
jne 0x1400010b0
mov ecx, 1
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x140004510]
mov edx, dword [rdx]
mov dword [rax], edx
call sym.__p__commode
mov rdx, qword [0x1400044f0]
mov edx, dword [rdx]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x140004380]
cmp dword [rax], 1
je 0x1400010f1
xor eax, eax
add rsp, 0x28
ret
mov ecx, 2
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001104
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
lea rcx, [sym._matherr]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a

Function at 0x140001b00
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop dword [rax]
Function at 0x140001b70
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x140007094]
test esi, esi
mov rdi, rcx
mov rbp, rdx
mov rbx, r8
jle 0x140001d00
mov rax, qword [0x140007098]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rdi, rdx
jb 0x140001bbc
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rdi, rdx
jb 0x140001c45
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x140001ba0
mov rcx, rdi
call sym.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x140001d52
mov rax, qword [0x140007098]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call sym._GetPEImageBase
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x140007098]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140001d35
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140001c3e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140001cb0
add dword [0x140007094], 1
cmp ebx, 8
jae 0x140001c71
test bl, 4
jne 0x140001d10
test ebx, ebx
je 0x140001c66
movzx eax, byte [rbp]
test bl, 2
mov byte [rdi], al
jne 0x140001d24
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, ebx
sub ebx, 1
mov rdx, qword [rbp + rax - 8]
cmp ebx, 8
mov qword [rdi + rax - 8], rdx
jb 0x140001c66
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, ebx
mov qword [rdi + rdx], rcx
jb 0x140001c8a
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp eax, 2
mov r8d, 4
mov eax, 0x40
mov rcx, qword [rsp + 0x20]
cmovne r8d, eax
mov rdx, qword [rsp + 0x38]
add rsi, qword [0x140007098]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140001c3e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
xor esi, esi
jmp 0x140001bc7
mov eax, dword [rbp]
mov ebx, ebx
mov dword [rdi], eax
mov eax, dword [rbp + rbx - 4]
mov dword [rdi + rbx - 4], eax
jmp 0x140001c66
mov ebx, ebx
movzx eax, word [rbp + rbx - 2]
mov word [rdi + rbx - 2], ax
jmp 0x140001c66
mov rax, qword [0x140007098]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rdi
call sym.__report_error
nop
nop dword [rax]
nop word cs:[rax + rax]