joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140013da0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov r10, qword [rcx]
test r10, r10
je 0x140013e24
mov r11, qword [rcx + 8]
mov r8, qword [rcx + 0x10]
cmp r8, r11
jae 0x140013e24
movzx eax, byte [r10 + r8]
cmp eax, 0x49
push rcx
pop rbx
nop
je 0x140013e3d
cmp eax, 0x42
jne 0x140013e24
lea rsi, [r8 + 1]
mov qword [rcx + 0x10], rsi
mov r9b, 1
cmp rsi, r11
jae 0x140013f6d
cmp byte [r10 + rsi], 0x5f
jne 0x140013efc
lea rax, [r8 + 2]
mov qword [rcx + 0x10], rax
xor eax, eax
cmp rax, r8
jae 0x140013f6d
mov edx, dword [rcx + 0x18]
inc edx
cmp edx, 0x1f4
jbe 0x140013fc7
mov dil, 1
xor r9d, r9d
jmp 0x140013f6f
sub edx, edx
call fcn.14000f8b0
mov esi, eax
add sil, sil
mov eax, esi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
inc r8
mov qword [rcx + 0x10], r8
sub edx, edx
call fcn.14000f8b0
test al, al
jne 0x140013fad
nop
push rbx
pop rdx
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x140013e7c
lea rdx, [0x14007052b]
mov r8d, 1
call fcn.1400043f0
mov rdx, rbx
test al, al
jne 0x140013fad
mov rax, qword [rdx]
mov sil, 1
test rax, rax
je 0x140013e30
xor r14d, r14d
lea rdi, [0x140070881]
nop word cs:[rax + rax]
mov rcx, qword [rdx + 0x10]
cmp rcx, qword [rdx + 8]
jae 0x140013eb4
cmp byte [rax + rcx], 0x45
je 0x140014000
sub r14, 1
jb 0x140013edc
mov rcx, qword [rdx + 0x20]
test rcx, rcx
je 0x140013edc
mov r8d, 2
nop
push rdi
pop rdx
call fcn.1400043f0
mov rdx, rbx
test al, al
jne 0x140013fad
push rdx
pop rcx
nop
call fcn.140011140
test al, al
jne 0x140013fad
push rbx
nop
pop rdx
mov rax, qword [rbx]
or rax, rax
jne 0x140013ea0
jmp 0x140013e30
sub eax, eax
mov r14d, 0x3e
nop word cs:[rax + rax]
movzx edx, byte [r10 + rsi]
cmp dl, 0x5f
je 0x140013f5d
lea edi, [rdx - 0x30]
cmp dil, 0xa
jb 0x140013f3f
lea edi, [rdx - 0x61]
cmp dil, 0x1a
jae 0x140013f31
add dl, 0xa9
jmp 0x140013f3d
lea edi, [rdx - 0x41]
cmp dil, 0x1a
jae 0x140013f6d
add dl, 0xe3
mov edi, edx
inc rsi
mov qword [rcx + 0x10], rsi
mul r14
jo 0x140013f6d
movzx edx, dil
xor edi, edi
add rax, rdx
jb 0x140013f6f
cmp rsi, r11
jb 0x140013f10
jmp 0x140013f6f
inc rsi
mov qword [rcx + 0x10], rsi
inc rax
jne 0x140013dff
xor edi, edi
mov rax, qword [rcx + 0x20]
or rax, rax
je 0x140013fb5
mov ecx, r9d
xor cl, 1
movzx ecx, cl
lea r8, [rcx + rcx*8]
add r8, 0x10
lea rcx, str.invalid_syntaxrecursion_limit_reached_for_______::closureshim_as__mut_const___dyn___unsafe_extern__
lea rdx, [0x140070860]
or r9b, r9b
cmovne rdx, rcx
push rax
nop
pop rcx
call fcn.1400043f0
mov rcx, rbx
test al, al
je 0x140013fb5
mov sil, 2
jmp 0x140013e30
mov qword [rcx], 0
mov byte [rcx + 8], dil
xor esi, esi
jmp 0x140013e30
cmp qword [rcx + 0x20], 0
je 0x140013fc0
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
movaps xmmword [rbp - 0x10], xmm1
movaps xmmword [rbp - 0x20], xmm0
mov qword [rcx + 0x10], rax
mov dword [rcx + 0x18], edx
push rcx
pop rsi
nop
call fcn.140013da0
movaps xmm0, xmmword [rbp - 0x20]
movaps xmm1, xmmword [rbp - 0x10]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
jmp 0x140013e32
inc rcx
mov qword [rdx + 0x10], rcx
jmp 0x140013e30
Function at 0x140015e80
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
nop
push rcx
pop rsi
cmp qword [rcx], 0
je 0x140015f15
mov rax, qword [0x14007f040]
mov dword [rbp], 0
lea rbx, [rsi + 0x10]
mov r8, rbp
nop
push rbx
pop rcx
sub edx, edx
sub r9d, r9d
call sub.KERNEL32.dll_InitOnceBeginInitialize
mov dword [rbp - 4], eax
cmp eax, 1
jne 0x140015f54
cmp dword [rbp], 0
je 0x140015f38
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x140015f69
mov edi, eax
mov rax, qword [0x14007c0e8]
nop word cs:[rax + rax]
mov qword [rsi + 8], rax
lock cmpxchg qword [0x14007c0e8], rsi
jne 0x140015ef0
mov eax, edi
inc eax
mov dword [rsi + 0x18], eax
nop
push rbx
pop rcx
xor edx, edx
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
jmp 0x140015f49
call sub.KERNEL32.dll_TlsAlloc
mov dword [rbp + 4], eax
cmp eax, 0xffffffff
je 0x140015fab
mov ecx, eax
inc ecx
xor eax, eax
lock cmpxchg dword [rsi + 0x18], ecx
jne 0x140015f3d
mov edi, dword [rbp + 4]
jmp 0x140015f49
mov edi, dword [rsi + 0x18]
jmp 0x140015f47
mov edi, eax
mov ecx, dword [rbp + 4]
call sub.KERNEL32.dll_TlsFree
dec edi
mov eax, edi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov qword [rbp - 0x38], 0
lea rcx, [rbp - 4]
lea rdx, [rbp - 0x38]
call fcn.140016c10
nop
push rbx
pop rcx
mov edx, 4
sub r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
lea rax, str.out_of_TLS_indexes
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
mov qword [rbp - 0x28], 8
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rdx, str.library_std_src_syspalwindows_thread_local_key.rs
lea rcx, [rbp - 0x38]
call fcn.140003a00
lea rax, str.out_of_TLS_indexes
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
mov qword [rbp - 0x28], 8
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 4]
lea rdx, [rbp - 0x38]
call fcn.140016c60
int3
Function at 0x140017cc0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov ecx, dword [0x1400460e8]
test ecx, ecx
je 0x140017d91
dec ecx
call fcn.140044404
cmp rax, 1
jbe 0x140017cf1
add rax, 8
jmp 0x140017d88
je 0x140017d86
movzx eax, byte [0x14007c0f8]
mov edx, 0x10
sub ecx, ecx
call fcn.140034ce0
test rax, rax
je 0x140017dc4
mov rbx, rax
nop
push rax
pop rsi
lea rax, [0x1400460d0]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x1400460e8]
or ecx, ecx
je 0x140017da4
dec ecx
call fcn.140044404
push rax
pop rdi
nop
mov ecx, dword [0x1400460e8]
test ecx, ecx
je 0x140017db4
dec ecx
add rbx, 8
nop
push rsi
pop rdx
call fcn.1400443fc
test rdi, rdi
je 0x140017d81
mov rax, qword [rdi + 8]
or rax, rax
je 0x140017d74
lock dec qword [rax]
jne 0x140017d74
mov rcx, qword [rdi + 8]
call fcn.140017510
mov edx, 8
mov rcx, rdi
call fcn.1400038d0
mov rax, rbx
jmp 0x140017d88
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea rcx, [0x1400460d0]
call fcn.140015e80
mov ecx, eax
jmp 0x140017cdd
lea rcx, [0x1400460d0]
call fcn.140015e80
mov ecx, eax
jmp 0x140017d37
lea rcx, [0x1400460d0]
call fcn.140015e80
mov ecx, eax
jmp 0x140017d4b
mov ecx, 8
mov edx, 0x10
call fcn.140002ec0
int3

Function at 0x140018240
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov ecx, dword [0x1400460a8]
or ecx, ecx
je 0x1400182ee
dec ecx
call fcn.140044404
cmp rax, 1
jbe 0x14001826e
add rax, 8
jmp 0x1400182e5
je 0x1400182e3
movzx eax, byte [0x14007c0f8]
mov edx, 0x10
xor ecx, ecx
call fcn.140034ce0
test rax, rax
je 0x140018321
mov rbx, rax
push rax
pop rsi
nop
lea rax, [0x140046090]
mov qword [rsi], rax
mov byte [rsi + 8], 0
mov ecx, dword [0x1400460a8]
or ecx, ecx
je 0x140018301
dec ecx
call fcn.140044404
mov rdi, rax
mov ecx, dword [0x1400460a8]
or ecx, ecx
je 0x140018311
dec ecx
add rbx, 8
push rsi
pop rdx
nop
call fcn.1400443fc
or rdi, rdi
je 0x1400182de
mov edx, 8
push rdi
nop
pop rcx
call fcn.1400038d0
push rbx
nop
pop rax
jmp 0x1400182e5
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea rcx, [0x140046090]
call fcn.140015e80
mov ecx, eax
jmp 0x14001825d
lea rcx, [0x140046090]
call fcn.140015e80
mov ecx, eax
jmp 0x1400182ac
lea rcx, [0x140046090]
call fcn.140015e80
mov ecx, eax
jmp 0x1400182c0
mov ecx, 8
mov edx, 0x10
call fcn.140002ec0
int3
Function at 0x140018740
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov ecx, dword [0x140046088]
or ecx, ecx
je 0x1400187f6
dec ecx
call fcn.140044404
cmp rax, 1
jbe 0x14001876e
add rax, 8
jmp 0x1400187ed
je 0x1400187eb
movzx eax, byte [0x14007c0f8]
mov edx, 0x18
sub ecx, ecx
call fcn.140034ce0
or rax, rax
je 0x140018829
push rax
nop
pop rbx
nop
push rax
pop rsi
lea rax, [0x140046070]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov byte [rsi + 0x10], 0
mov ecx, dword [0x140046088]
test ecx, ecx
je 0x140018809
dec ecx
call fcn.140044404
mov rdi, rax
mov ecx, dword [0x140046088]
test ecx, ecx
je 0x140018819
dec ecx
add rbx, 8
push rsi
nop
pop rdx
call fcn.1400443fc
or rdi, rdi
je 0x1400187e6
mov edx, 8
mov rcx, rdi
call fcn.1400038d0
mov rax, rbx
jmp 0x1400187ed
sub eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea rcx, [0x140046070]
call fcn.140015e80
mov ecx, eax
jmp 0x14001875d
lea rcx, [0x140046070]
call fcn.140015e80
mov ecx, eax
jmp 0x1400187b4
lea rcx, [0x140046070]
call fcn.140015e80
mov ecx, eax
jmp 0x1400187c8
mov ecx, 8
mov edx, 0x18
call fcn.140002ec0
int3
Function at 0x140034190
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov ecx, dword [0x1400460c8]
test ecx, ecx
je 0x140034261
dec ecx
call fcn.140044404
cmp rax, 1
jbe 0x1400341c1
add rax, 8
jmp 0x140034258
je 0x140034256
movzx eax, byte [0x14007c0f8]
mov edx, 0x10
sub ecx, ecx
call fcn.140034ce0
test rax, rax
je 0x140034294
mov rbx, rax
nop
push rax
pop rsi
lea rax, [0x1400460b0]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x1400460c8]
or ecx, ecx
je 0x140034274
dec ecx
call fcn.140044404
mov rdi, rax
mov ecx, dword [0x1400460c8]
test ecx, ecx
je 0x140034284
dec ecx
add rbx, 8
mov rdx, rsi
call fcn.1400443fc
test rdi, rdi
je 0x140034251
mov rax, qword [rdi + 8]
test rax, rax
je 0x140034244
lock dec qword [rax]
jne 0x140034244
mov rcx, qword [rdi + 8]
call fcn.1400342b0
mov edx, 8
mov rcx, rdi
call fcn.1400038d0
nop
push rbx
pop rax
jmp 0x140034258
sub eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea rcx, [0x1400460b0]
call fcn.140015e80
mov ecx, eax
jmp 0x1400341ad
lea rcx, [0x1400460b0]
call fcn.140015e80
mov ecx, eax
jmp 0x140034207
lea rcx, [0x1400460b0]
call fcn.140015e80
mov ecx, eax
jmp 0x14003421b
mov ecx, 8
mov edx, 0x10
call fcn.140002ec0
int3

Function at 0x14003a3c6
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x60
nop
push rdx
pop rax
push rcx
nop
pop rsi
lea rdx, [rsp + 0x2c]
push rax
nop
pop rcx
call sub.SHELL32.dll_CommandLineToArgvW
or rax, rax
je 0x14003a462
push rax
pop rdi
nop
lea rbx, [rsp + 0x30]
and qword [rbx], 0
mov qword [rbx + 8], 8
and qword [rbx + 0x10], 0
movsxd r12, dword [rsp + 0x2c]
shl r12, 3
xor r13d, r13d
lea r14, [rsp + 0x48]
cmp r12, r13
je 0x14003a447
mov r15, qword [rdi + r13]
mov rcx, r15
call sub.msvcrt.dll_wcslen
mov rcx, r14
mov rdx, r15
mov r8, rax
call fcn.140039cd1
mov rcx, rbx
mov rdx, r14
call fcn.14003a6e2
add r13, 8
jmp 0x14003a417
push rdi
nop
pop rcx
call sub.KERNEL32.dll_LocalFree
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
mov rax, qword [rsp + 0x40]
mov qword [rsi + 0x10], rax
jmp 0x14003a473
and qword [rsi], 0
mov qword [rsi + 8], 8
and qword [rsi + 0x10], 0
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140043a86
Capabilities:
Reference wmi statements

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
and qword [rsp + 0x38], 0
push rdx
nop
pop rsi
mov rdi, rcx
cmp qword [rdx + 0x10], 0
je 0x140043b4a
lea rcx, [0x140073852]
call sub.OLEAUT32.dll_SysAllocString
mov rbx, rax
lea rcx, str.SELECT__FROM_MSAcpi_ThermalZoneTemperature
call sub.OLEAUT32.dll_SysAllocString
mov r14, rax
mov rcx, qword [rsi + 0x18]
mov rax, qword [rcx]
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x28], rdx
and qword [rsp + 0x20], 0
push rbx
nop
pop rdx
mov r8, r14
mov r9d, 0x30
call qword [rax + 0xa0]
mov ebp, eax
push rbx
pop rcx
nop
call sub.OLEAUT32.dll_SysFreeString
mov rcx, r14
call sub.OLEAUT32.dll_SysFreeString
or ebp, ebp
js 0x140043b4a
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsi + 0x20]
mov rdx, qword [rsi + 0x28]
call fcn.14003ebda
mov qword [rsi + 0x20], 1
mov qword [rsi + 0x28], rbx
mov rax, qword [rsi + 0x30]
mov qword [rdi + 0x30], rax
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [rdi + 0x10], xmm1
movups xmmword [rdi], xmm0
mov rax, qword [rsi + 0x20]
mov qword [rdi + 0x20], rax
mov rax, qword [rsi + 0x28]
mov qword [rdi + 0x28], rax
jmp 0x140043b59
mov qword [rdi], 2
push rsi
nop
pop rcx
call fcn.14003eb5e
nop
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x1400441fc
Capabilities:
Set thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
call fcn.140008a29
cmp rax, 1
jbe 0x14004421c
push rax
pop rsi
nop
add rsi, 8
jmp 0x14004429f
je 0x14004429d
xorps xmm0, xmm0
lea rsi, [rsp + 0x20]
movaps xmmword [rsi], xmm0
mov edx, 0x10
push rsi
nop
pop rcx
call sub.bcryptprimitives.dll_ProcessPrng
mov rdi, qword [rsi]
mov r14, qword [rsi + 8]
mov ecx, 8
mov edx, 0x18
call fcn.1400089ff
test rax, rax
je 0x1400442bc
mov rsi, rax
mov rbx, rax
lea rax, [0x140046130]
mov qword [rsi], rax
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], r14
call fcn.140008a29
mov rdi, rax
mov ecx, dword [0x140046148]
or ecx, ecx
je 0x1400442ac
dec ecx
add rsi, 8
mov rdx, rbx
call fcn.1400443fc
or rdi, rdi
je 0x14004429f
mov edx, 8
push rdi
pop rcx
nop
call fcn.1400038d0
jmp 0x14004429f
sub esi, esi
nop
push rsi
pop rax
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x140046130]
call fcn.140015e80
mov ecx, eax
jmp 0x14004427d
mov ecx, 8
mov edx, 0x18
call fcn.140002ec0
int3

Function at 0x1400450e0
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140045ef0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.140045ef0
mov rdx, r12
push rax
pop rcx
nop
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]
Function at 0x140045150
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x14007c184]
mov r12, rcx
nop
push rdx
pop rsi
mov rbx, r8
or edi, edi
jle 0x140045300
mov rax, qword [0x14007c188]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp r12, rdx
jb 0x14004519c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x140045227
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x140045180
mov rcx, r12
call fcn.140045c00
push rax
pop rbp
nop
test rax, rax
je 0x14004535d
mov rax, qword [0x14007c188]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call fcn.140045d30
mov ecx, dword [rbp + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x14007c188]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140045342
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140045220
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x1400452b0
add dword [0x14007c184], 1
cmp ebx, 8
jae 0x140045258
test bl, 4
jne 0x140045310
or ebx, ebx
je 0x140045249
movzx eax, byte [rsi]
mov byte [r12], al
test bl, 2
jne 0x140045330
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi]
lea rcx, [r12 + 8]
and rcx, 0xfffffffffffffff8
mov qword [r12], rax
mov eax, ebx
mov rdx, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], rdx
sub r12, rcx
add ebx, r12d
sub rsi, r12
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x140045249
and ebx, 0xfffffff8
sub eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x14004528a
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rdi, qword [0x14007c188]
mov qword [rdi + 8], rcx
mov r9, rdi
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140045220
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.1400450e0
xor edi, edi
jmp 0x1400451a7
mov eax, dword [rsi]
mov ebx, ebx
mov dword [r12], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r12 + rbx - 4], eax
jmp 0x140045249
mov ebx, ebx
movzx eax, word [rsi + rbx - 2]
mov word [r12 + rbx - 2], ax
jmp 0x140045249
mov rax, qword [0x14007c188]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call fcn.1400450e0
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.1400450e0
nop
nop dword [rax]
Function at 0x140045870
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x14007c1e0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14007c1c0]
test rbx, rbx
je 0x1400458c4
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
or eax, eax
jne 0x1400458bb
test r12, r12
je 0x1400458bb
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
or rbx, rbx
jne 0x1400458a0
lea rcx, [0x14007c1e0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140045c00
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x140074480]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x140045c79
mov rcx, r10
call fcn.140045ad0
or eax, eax
je 0x140045c79
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
or eax, eax
je 0x140045c76
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
push rdx
nop
pop rax
cmp rcx, rdx
jb 0x140045c6d
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x140045c79
add r8, 0x28
cmp r8, r9
jne 0x140045c58
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret
Function at 0x140005790
Capabilities:
Parse pe header

Disassembly:
test rcx, rcx
je 0x1400057c0
mov eax, 0
cmp word [rcx], 0x5a4d
jne 0x1400057bf
mov eax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x1400057c5
cdqe
add rax, rcx
cmp dword [rax], 0x4550
mov edx, 0
cmovne rax, rdx
ret
mov rax, rcx
jmp 0x1400057bf
mov eax, 0
jmp 0x1400057bf

Function at 0x140005e40
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov rcx, r10
call fcn.140005df0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140010020
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x1409be5f0]
xor edx, edx
cmp word [r9], 0x5a4d
mov r8, rcx
jne 0x14001008f
mov rcx, r9
call fcn.14000fef0
test eax, eax
je 0x14001008f
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add r9, rax
movzx eax, word [r9 + 0x14]
lea rdx, [r9 + rax + 0x18]
movzx eax, word [r9 + 6]
test eax, eax
je 0x14001008d
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x140010084
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x14001008f
add rdx, 0x28
cmp rdx, r9
jne 0x140010070
xor edx, edx
mov rax, rdx
add rsp, 0x28
ret
Function at 0x140001480
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x14009dd10]
mov dword [rax], 1
mov rax, qword [0x14009dd20]
mov dword [rax], 1
mov rax, qword [0x14009dd30]
mov dword [rax], 1
mov rax, qword [0x14009dd00]
mov dword [rax], 1
mov rax, qword [0x14009dba0]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400014de
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x14000150a
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x140001530
cmp eax, 0x20b
je 0x140001557
jmp 0x140001586
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x140001543
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x14000158b
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x140001572
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x14000158b
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140007260
Capabilities:
Read file on windows

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x20
mov r13, rcx
mov rcx, rdx
mov edx, 1
mov rbx, r8
mov r9, r13
call sym.fread
mov r12, rax
cmp rbx, rax
je 0x140007293
mov rcx, r13
call sym.ferror
test eax, eax
jne 0x1400072a0
mov rax, r12
add rsp, 0x20
pop rbx
pop r12
pop r13
ret
mov rcx, r13
call sym.checkErr__stdZsyncio_u162.part.0
mov rax, r12
add rsp, 0x20
pop rbx
pop r12
pop r13
ret
Function at 0x1400072f0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rax, [0x1400925a0]
mov r14, rcx
mov r13, rdx
lea rcx, [rsp + 0x20]
mov edx, 0xfa0
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
call sym.mnewString
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x40], rax
mov rbx, rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x48], rax
test rbx, rbx
jle 0x140007468
mov rcx, qword [0x14009db80]
lea rdi, [rsp + 0x30]
movabs r15, 0x7fffffffffffffff
movabs rbp, 0x8000000000000000
call sym.__emutls_get_address
mov rsi, rax
nop dword [rax]
mov rax, qword [rsp + 0x48]
mov r9, r13
mov r8d, 0xfa0
mov edx, 1
lea rcx, [rax + 8]
call sym.fread
mov r12, rax
cmp rax, 0xfa0
je 0x140007400
mov rcx, r13
call sym.ferror
test eax, eax
je 0x1400073c3
mov rcx, r13
call sym.checkErr__stdZsyncio_u162.part.0
cmp byte [rsi], 0
je 0x1400074b0
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400073e0
test byte [rcx + 7], 0x40
je 0x1400074a0
movdqa xmm0, xmmword [rsp + 0x30]
mov rax, r14
movups xmmword [r14], xmm0
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
cmp byte [rsi], 0
jne 0x1400073cc
mov rdx, qword [rsp + 0x40]
mov rcx, rdi
call sym.prepareAdd
mov rbx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
test rbx, rbx
jle 0x140007468
mov r8, rbx
add r8, 1
jo 0x14000747d
test r8, r8
js 0x140007488
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
add rdx, 8
lea rcx, [rcx + rax + 8]
call sym.memcpy
add rbx, qword [rsp + 0x30]
jo 0x14000747d
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsp + 0x40]
test rbx, rbx
jg 0x140007388
nop dword [rax]
xor ecx, ecx
lea rdx, [rbx - 1]
call sym.raiseIndexError2
mov rcx, qword [rsp + 0x48]
jmp 0x1400073d1
call sym.raiseOverflow
jmp 0x140007453
mov r8, r15
xor edx, edx
mov rcx, rbp
call sym.raiseRangeErrorI
jmp 0x140007453
call sym.deallocShared
jmp 0x1400073e0
test r12, r12
js 0x140007528
lea rcx, [rsp + 0x40]
mov rdx, r12
call sym.setLengthStrV2
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x30]
call sym.prepareAdd
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
test rbx, rbx
jle 0x1400073d1
mov r8, rbx
add r8, 1
jo 0x14000756b
test r8, r8
js 0x140007546
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
lea r9, [rdx + rax + 8]
lea rdx, [rcx + 8]
mov rcx, r9
call sym.memcpy
add rbx, qword [rsp + 0x30]
jo 0x14000756b
mov qword [rsp + 0x30], rbx
mov rcx, qword [rsp + 0x48]
jmp 0x1400073d1
movabs r8, 0x7fffffffffffffff
mov rcx, r12
xor edx, edx
call sym.raiseRangeErrorI
mov rcx, qword [rsp + 0x48]
jmp 0x1400073d1
movabs rcx, 0x8000000000000000
xor edx, edx
movabs r8, 0x7fffffffffffffff
call sym.raiseRangeErrorI
mov rcx, qword [rsp + 0x48]
jmp 0x1400073d1
call sym.raiseOverflow
jmp 0x1400073cc