joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400cc644
Capabilities:
Connect to http server

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x50
mov qword [r11 - 0x28], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov r14d, r9d
mov rbx, r8
mov rbp, rdx
mov rdi, rcx
mov rax, qword [rsp + 0xa8]
mov qword [r11 - 0x48], rax
movzx r9d, word [rsp + 0x90]
call fcn.1400cc81c
nop
lea rax, vtable.CHttpConnection.0
mov qword [rdi], rax
call fcn.1400c82b4
mov rcx, rax
test rax, rax
je 0x1400cc787
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x1400dc302.0]
add rax, 0x18
mov qword [rdi + 0x30], rax
test rbx, rbx
jne 0x1400cc6c3
xor eax, eax
jmp 0x1400cc6cb
mov rcx, rbx
call fcn.1400e9024
mov r8d, eax
mov rdx, rbx
lea rcx, [rdi + 0x30]
call fcn.140004960
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], 3
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x98]
movzx r8d, word [rsp + 0x90]
mov rdx, rbx
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.WININET.dll_InternetConnectW]
mov rsi, rax
mov qword [rdi + 8], rax
test rax, rax
je 0x1400cc77b
mov rbx, qword [rdi + 0x18]
lea rcx, [0x1401a6b78]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rdx, rsi
lea rcx, [0x1401a6b30]
call fcn.1400d7014
mov qword [rax], rbx
mov rax, qword [0x1401a6b68]
lea rcx, [0x1401a6b68]
mov rax, qword [rax + 0x28]
call qword [case.0x1400dc302.0]
nop
mov rax, rdi
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
xor edx, edx
mov rcx, qword [rdi + 0x10]
call fcn.1400cd198
nop
mov ecx, 0x80004005
call fcn.140004d90
int3

Function at 0x1400cca10
Capabilities:
Create http request

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
and dword [rcx + 0x20], 0
lea rax, vtable.CInternetSession.0
and qword [rcx + 0x18], 0
mov edi, r9d
mov qword [rcx], rax
mov r10, rdx
mov qword [rcx + 8], r8
mov rbx, rcx
test rdx, rdx
jne 0x1400cca48
call fcn.1400c8854
mov r10, qword [rax + 0x20]
mov eax, dword [rsp + 0x70]
mov edx, edi
mov r9, qword [rsp + 0x68]
mov rcx, r10
mov r8, qword [rsp + 0x60]
mov dword [rsp + 0x20], eax
call qword [sym.imp.WININET.dll_InternetOpenW]
mov qword [rbx + 0x10], rax
mov rdi, rax
test rax, rax
je 0x1400ccab6
lea rcx, [0x1401a6b78]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rdx, rdi
lea rcx, [0x1401a6b30]
call fcn.1400d7014
lea rcx, [0x1401a6b68]
mov qword [rax], rbx
mov rax, qword [0x1401a6b68]
mov rax, qword [rax + 0x28]
call qword [case.0x1400dc302.0]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rbx + 8]
xor edx, edx
call fcn.1400cd198
int3
Function at 0x1400d2198
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rbx, r8
mov rcx, qword [rcx + 0x40]
call fcn.1400d8a38
mov rdi, rax
test rax, rax
je 0x1400d2214
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov esi, eax
test rbx, rbx
je 0x1400d220f
cmp dword [rbx], 0x40
jb 0x1400d220f
mov rcx, qword [rbp + 0x40]
xor r9d, r9d
or dword [rbx + 4], 1
xor r8d, r8d
or qword [rbx + 0x30], 0xffffffffffffffff
mov edx, 0x87
mov qword [rbx + 8], rcx
mov rcx, rdi
mov qword [rbx + 0x10], rdi
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 0xd
jb 0x1400d220f
or dword [rbx + 4], 0x80000002
mov rax, rsi
jmp 0x1400d2218
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400d91b0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x230
mov rax, qword [0x14019cfa0]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x1400d8a2f
test rdx, rdx
je 0x1400d8a2f
mov rcx, rdx
call fcn.1400e9024
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x200
mov rsi, rax
call fcn.1400e17c0
mov eax, 0x100
cmp rsi, rax
ja 0x1400d89fe
mov r8d, eax
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowTextW]
cmp eax, esi
jne 0x1400d89fe
mov rdx, rbx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x1400d8a0a
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.1400dbfd0
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.1400c8068
int3
sub rsp, 0x78
test rdx, rdx
je 0x1400d9218
mov r10, qword [rcx + 0x10]
test r10, r10
je 0x1400d9202
cmp qword [rcx + 0x18], 0
jne 0x1400d91fd
mov eax, dword [rcx + 0xc]
cmp eax, dword [rcx + 0x30]
jae 0x1400d921e
mov qword [rsp + 0x58], rdx
lea r9, [rsp + 0x20]
mov dword [rsp + 0x20], 0x50
mov edx, eax
mov dword [rsp + 0x24], 0x40
mov r8d, 1
mov rcx, qword [r10 + 8]
call qword [sym.imp.USER32.dll_SetMenuItemInfoW]
add rsp, 0x78
ret
mov rcx, qword [rcx + 0x20]
test rcx, rcx
je 0x1400d9218
mov rcx, qword [rcx + 0x40]
add rsp, 0x78
jmp 0x1400d8978
call fcn.1400c8068
int3
call fcn.1400c8068
int3

Function at 0x1400fc3d4
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400fc138

Function at 0x1401067bc
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x140106799
call fcn.1400e4174
mov dword [rax], socket
call fcn.1400e4024
or eax, 0xffffffff
jmp 0x1401067b6
sub dword [rcx + 0x10], 1
jns 0x1401067a8
add rsp, 0x28
jmp fcn.140107960
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x140106778
Function at 0x140107960
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x14010761c
call fcn.1400e4174
mov dword [rax], socket
call fcn.1400e4024
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140107604
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x140107604
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x14010764e
lock or dword [rax + 0x14], 0x10
jmp 0x140107604
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x14010766b
mov rcx, qword [rbp + 0x10]
call fcn.14010ca7c
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.1400fa678
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.140107054
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x1401076c2
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x140107604
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x14010772e
mov rcx, qword [rbp + 0x10]
call fcn.1400fa678
cmp eax, 0xffffffff
je 0x140107715
mov rcx, qword [rbp + 0x10]
call fcn.1400fa678
cmp eax, 0xfffffffe
je 0x140107715
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.1400fa678
movsxd rdi, eax
lea rsi, [0x1401abd60]
mov rcx, rbx
sar rdi, 6
call fcn.1400fa678
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x14010771c
lea rax, [0x14019d260]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14010772e
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x140107764
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x140107760
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x140107760
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x140107607
jmp 0x1401075d4
Function at 0x140107968
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x1401077ce
call fcn.1400e4174
mov dword [rax], socket
call fcn.1400e4024
mov eax, 0xffff
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1401077b0
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x1401077b0
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x20]
shr ecx, 1
test cl, 1
je 0x140107800
lock or dword [rax + 0x14], 0x10
jmp 0x1401077b0
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x14010781d
mov rcx, qword [rbp + 0x20]
call fcn.14010ca7c
mov rax, qword [rbp + 0x20]
cmp dword [rax + 0x10], 1
jne 0x140107832
mov rcx, qword [rax]
mov sil, 1
mov r14b, byte [rcx]
jmp 0x140107838
xor sil, sil
xor r14b, r14b
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x20]
mov rcx, rbx
call fcn.1400fa678
mov rdx, qword [rbp + 0x20]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.140107054
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x20]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 2
ja 0x14010788b
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x20]
and dword [rax + 0x10], 0
jmp 0x1401077b0
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x1401078f7
mov rcx, qword [rbp + 0x20]
call fcn.1400fa678
cmp eax, 0xffffffff
je 0x1401078de
mov rcx, qword [rbp + 0x20]
call fcn.1400fa678
cmp eax, 0xfffffffe
je 0x1401078de
mov rbx, qword [rbp + 0x20]
mov rcx, rbx
call fcn.1400fa678
movsxd rdi, eax
lea r15, [0x1401abd60]
mov rcx, rbx
sar rdi, 6
call fcn.1400fa678
and eax, 0x3f
shl rax, 6
add rax, qword [r15 + rdi*8]
jmp 0x1401078e5
lea rax, [0x14019d260]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1401078f7
mov rax, qword [rbp + 0x20]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x20]
cmp dword [rax + 0x20], 0x200
jne 0x14010792d
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x140107929
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x140107929
mov rax, qword [rbp + 0x20]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax]
test sil, sil
je 0x14010794b
movzx edx, byte [rcx]
dec dword [rax + 0x10]
shl dx, 8
movzx ecx, r14b
or dx, cx
inc qword [rax]
jmp 0x140107956
movzx edx, word [rcx]
add dword [rax + 0x10], 0xfffffffe
add qword [rax], 2
movzx eax, dx
jmp 0x1401077b5
jmp 0x14010777c
Function at 0x140110850
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x140110863
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.140110e70
lea rdx, [0x140197680]
lea rcx, [rsp + 0x20]
call fcn.1400e1a38
int3

Function at 0x14011b0ec
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x1401ac390]
xor edx, edx
jmp fcn.140110850

Function at 0x14011ba84
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x1401ac390]
jmp fcn.140110850

Function at 0x1401276fc
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x1401277b8]
mov r9, qword [r9 + 8]
jmp fcn.140118aa4

Function at 0x140127790
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x1401277c8]
mov r9, qword [r9 + 8]
jmp fcn.140118aa4
Function at 0x140004000
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
and r11w, 0xf0a0
xor r9, r9
movabs rbp, 0x54f54f7473069796
fcmovnb st(0), st(6)
fxsave64 [r11]
mov r9b, 0x59
add r11, 8
mov rdx, qword [r11]
dec r9
xor qword [rdx + r9*8 + 0x1d], rbp
test r9, r9
jne 0x140004026
ficomp word [rsi]
loopne 0x140004075
mov r9d, 0x9770d593
xor al, dl
sbb al, 0x2e
mov esi, ebx
cwde
test al, 0x75
cmp al, 0xf0
out dx, al
pop rdx
xchg ebx, eax
test al, 0x36
inc dword [rbx - 0x47]
invalid
mov ecx, 0x4f9ff8df
invalid
invalid
invalid
mov bl, 0xd7
test eax, 0x97068ed2
cmp al, 0x3a
add esi, eax
mov dword [rax + 0x719ae3c4], esi
mov esp, 0xbc88c88
ja 0x140004045
jno 0x140004055
test al, 0xb1
or dl, dl
in eax, 0xb6
sti
out 0x69, al
mov ah, 0xf
jge 0x140004068
movabs eax, dword [0x69e822c719729003]
xchg ebx, eax
sbb dword [rcx + 0x12], ebx
fimul dword [rdx - 0x2fe2a1dc]
in eax, 0x59
int1
xchg edx, eax
and al, 0xae
jnp 0x140004051
cwde
xchg esi, eax
movabs r11, 0x73871b5aa273d424
imul cl
int 0xe2
jns 0x1400040b7
mov cl, 0x77
invalid

Function at 0x140a04000
Capabilities:
Decompress data using aplib

Disassembly:
jmp 0x140a0400a
jmp 0x140a0600f
jmp fcn.1406b1058
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140009830]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x140009840]
mov dword [rax], 1
mov rax, qword [0x140009850]
mov dword [rax], 1
mov rax, qword [0x140009820]
mov dword [rax], 1
mov rax, qword [0x1400096e0]
cmp word [rax], 0x5a4d
jne 0x140001067
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010d0
mov rax, qword [0x140009810]
mov dword [0x14000c020], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010c0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x1400097d0]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x1400097b0]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x140009690]
cmp dword [rax], 1
je 0x140001108
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001084
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001120
cmp dx, 0x20b
jne 0x140001067
cmp dword [rax + 0x84], 0xe
jbe 0x140001067
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x140001067
mov rcx, qword [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x140001067
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x140001067

Function at 0x140001890
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sym.vfprintf
call sym.abort
nop
nop word [rax + rax]
Function at 0x140001900
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x50
movsxd rbx, dword [0x14000c0c4]
mov r12, rcx
test ebx, ebx
jle 0x140001a30
mov rax, qword [0x14000c0c8]
xor r9d, r9d
add rax, 0x18
nop dword [rax + rax]
mov r8, qword [rax]
cmp r8, r12
ja 0x14000194b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp r12, r8
jb 0x1400019d5
add r9d, 1
add rax, 0x28
cmp r9d, ebx
jne 0x140001930
mov rcx, r12
call dbg.__mingw_GetSectionForAddress
mov rsi, rax
test rax, rax
je 0x140001a52
mov rax, qword [0x14000c0c8]
lea rbx, [rbx + rbx*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rsi
mov dword [rax], 0
call dbg._GetPEImageBase
mov edx, dword [rsi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x14000c0c8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140001a37
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x1400019ce
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x1400019e0
add dword [0x14000c0c4], 1
add rsp, 0x50
pop rbx
pop rsi
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rbx, qword [0x14000c0c8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400019ce
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
nop dword [rax]
xor ebx, ebx
jmp 0x140001958
mov rax, qword [0x14000c0c8]
mov edx, dword [rsi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call dbg.__report_error
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call dbg.__report_error
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140001f20
Capabilities:
Get thread local storage value

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r13, [0x14000c120]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14000c100]
test rbx, rbx
je 0x140001f7c
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x140001f73
test r12, r12
je 0x140001f73
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140001f58
mov rcx, r13
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x1400021b0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x1400021c8
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x1400021d0
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret
Function at 0x1400021e0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x140002225
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp r8, rdx
ja 0x14000221c
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x140002227
add rax, 0x28
cmp rax, r9
jne 0x140002208
xor eax, eax
ret

Function at 0x140002230
Capabilities:
Parse pe header

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
call sym.strlen
cmp rax, 8
ja 0x1400022c0
mov rdx, qword [0x1400096e0]
xor r12d, r12d
cmp word [rdx], 0x5a4d
jne 0x1400022ae
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x1400022ae
cmp word [rax + 0x18], 0x20b
jne 0x1400022ae
movzx edx, word [rax + 0x14]
lea r12, [rax + rdx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x1400022c0
sub eax, 1
lea rax, [rax + rax*4]
lea rsi, [r12 + rax*8 + 0x28]
jmp 0x140002299
add r12, 0x28
cmp r12, rsi
je 0x1400022c0
mov r8d, 8
mov rdx, rbx
mov rcx, r12
call sym.strncmp
test eax, eax
jne 0x140002290
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret
xor r12d, r12d
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret

Function at 0x1400022d0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1400096e0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400022f0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400022f8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400022f0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x140002345
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x14000233c
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400022f0
add rax, 0x28
cmp rax, r9
jne 0x140002328
xor eax, eax
ret

Function at 0x140002350
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400096e0]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x140002370
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140002378
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x140002370
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x140002390
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x1400096e0]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x1400023b0
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x1400023b8
ret
cmp word [rdx + 0x18], 0x20b
jne 0x1400023b0
movzx eax, word [rdx + 0x14]
lea rax, [rdx + rax + 0x18]
movzx edx, word [rdx + 6]
test edx, edx
je 0x1400023f8
sub edx, 1
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x1400023ef
test rcx, rcx
je 0x1400023b0
sub rcx, 1
add rax, 0x28
cmp rax, rdx
jne 0x1400023e0
xor eax, eax
ret
Function at 0x140002400
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400096e0]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x140002420
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x140002428
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret

Function at 0x140002440
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1400096e0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140002460
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140002468
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002460
sub rcx, rdx
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
movzx r8d, word [r8 + 6]
test r8d, r8d
je 0x140002460
lea eax, [r8 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop dword [rax]
mov r8d, dword [rdx + 0xc]
mov rax, r8
cmp rcx, r8
jb 0x1400024ac
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x1400024c0
add rdx, 0x28
cmp rdx, r9
jne 0x140002498
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x1400024d0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x1400096e0]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x1400024f2
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x140002500
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400024f2
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x1400024f2
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
movzx r8d, word [r8 + 6]
test r8d, r8d
je 0x1400024f2
sub r8d, 1
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop dword [rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x14000254d
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x140002560
add rdx, 0x28
cmp r10, rdx
jne 0x140002538
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x14000256f
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x14000257f
mov edx, dword [rax + 0xc]
test edx, edx
je 0x140002556
test ecx, ecx
jg 0x140002568
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret