joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140130150
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov ebp, edx
mov r14, rcx
mov dword [rcx + 0x10], edx
test edx, edx
je 0x14013018b
mov esi, ebp
mov rbx, rsi
shl rbx, 5
mov rdi, qword [0x140dc0558]
test rdi, rdi
je 0x140130197
shl rsi, 4
cmp rbx, rdi
jbe 0x1401301ba
jmp 0x140130240
mov qword [r14], 0
jmp 0x140130288
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [rsp + 0x2c]
mov qword [0x140dc0558], rdi
shl rsi, 4
cmp rbx, rdi
ja 0x140130240
test rdi, rdi
jne 0x1401301d5
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [rsp + 0x2c]
mov qword [0x140dc0558], rdi
cmp rsi, rdi
ja 0x14013029a
mov rax, rdi
or rax, rsi
shr rax, 0x20
je 0x1401301f4
mov rax, rdi
xor edx, edx
div rsi
jmp 0x1401301fa
mov eax, edi
xor edx, edx
div esi
bsr rcx, rax
shl rsi, cl
mov eax, dword [r14 + 0x10]
shl eax, cl
mov dword [r14 + 0x10], eax
shl rax, 4
cmp rsi, rax
jne 0x1401302be
lea r15, [rsi + rsi]
test rdi, rdi
jne 0x140130237
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [rsp + 0x2c]
mov qword [0x140dc0558], rdi
cmp r15, rdi
jbe 0x1401302de
test rdi, rdi
jne 0x14013025b
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [rsp + 0x2c]
mov qword [0x140dc0558], rdi
mov rcx, rsi
mov rdx, rdi
call fcn.1401314f0
mov rdi, rax
xor ecx, ecx
mov rdx, rax
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x1401302fe
mov qword [r14], rax
test ebp, ebp
setne al
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov qword [rsp + 0x20], 0
lea rcx, str....._sanitizer_common_sanitizer_common.h
lea r8, str.__x_______0U__
mov edx, 0x191
xor r9d, r9d
call fcn.1400d9910
mov qword [rsp + 0x20], rax
lea rcx, str....._sanitizer_common_sanitizer_dense_map.h
lea r8, str.__Size______sizeof_BucketT___NumBuckets__
mov edx, 0x2af
mov r9, rsi
call fcn.1400d9910
mov qword [rsp + 0x20], rdi
lea rcx, str....._sanitizer_common_sanitizer_dense_map.h
lea r8, str.__Size__2_______GetPageSizeCached____
mov edx, 0x2b0
mov r9, r15
call fcn.1400d9910
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsp + 0x20], 0
lea rdx, str.DenseMap
lea r8, str.allocate
mov rcx, rdi
mov r9d, eax
call fcn.1401061c0
int3
Function at 0x140130330
Capabilities:
Get system information on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rbx, rcx
mov r14d, dword [rcx + 0x10]
mov rsi, qword [rcx]
cmp edx, 0x41
mov r9d, 0x40
cmovae r9d, edx
lea eax, [r9 - 1]
test r9d, eax
jne 0x14013035e
mov rdx, r9
jmp 0x140130390
bsr rax, r9
xor rax, 0x3f
mov ecx, eax
neg cl
mov edi, 1
mov edx, 1
shl rdx, cl
cmp rdx, r9
jbe 0x14013045f
xor al, 0x3f
mov ecx, eax
shl rdi, cl
cmp rdi, r9
jae 0x14013047c
mov rcx, rbx
call fcn.140130150
mov rax, qword [rbx]
test rax, rax
je 0x14013043b
test rsi, rsi
je 0x1401303f3
shl r14, 4
lea r8, [rsi + r14]
mov rcx, rbx
mov rdx, rsi
call fcn.140129170
mov rdx, qword [0x140dc0558]
test rdx, rdx
jne 0x1401303de
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [rsp + 0x2c]
mov qword [0x140dc0558], rdx
mov rcx, r14
call fcn.1401314f0
mov rcx, rsi
mov rdx, rax
call fcn.1400ef340
jmp 0x140130431
mov qword [rbx + 8], 0
mov ecx, dword [rbx + 0x10]
lea r9d, [rcx - 1]
and r9d, ecx
jne 0x140130499
test rcx, rcx
je 0x140130431
shl rcx, 4
xor edx, edx
nop word cs:[rax + rax]
mov qword [rax + rdx], 0xffffffffffffffff
add rdx, 0x10
cmp rcx, rdx
jne 0x140130420
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
mov qword [rsp + 0x20], 0
lea rcx, str....._sanitizer_common_sanitizer_dense_map.h
lea r8, str.__Buckets______0_
mov edx, 0x289
xor r9d, r9d
call fcn.1400d9910
mov qword [rsp + 0x20], rdx
lea rcx, str....._sanitizer_common_sanitizer_common.h
lea r8, str.__size________1ULL_____up__1____
mov edx, 0x1b9
call fcn.1400d9910
mov qword [rsp + 0x20], rdi
lea rcx, str....._sanitizer_common_sanitizer_common.h
lea r8, str.__size________1ULL____up___
mov edx, 0x1ba
call fcn.1400d9910
mov qword [rsp + 0x20], 0
lea rcx, str....._sanitizer_common_sanitizer_dense_map.h
lea r8, str.___getNumBuckets_____getNumBuckets_____1________0__
mov edx, 0x10f
call fcn.1400d9910
int3
Function at 0x1401314f0
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
lea rax, [rdx - 1]
test rdx, rax
jne 0x140131519
lea rax, [rcx + rdx]
add rax, 0xffffffffffffffff
neg rdx
and rdx, rax
mov rax, rdx
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov rsi, qword [0x140145ce0]
mov al, 1
xchg byte [rsi], al
test al, al
jne 0x1401315af
lea rcx, [0x140145ce0]
call fcn.14010fbf0
mov rcx, qword [0x140145ce8]
cmp rcx, 0xffffffffffffffff
je 0x1401315f6
lea rax, [rcx - 1]
cmp rax, 1
ja 0x14013156f
xor eax, eax
cmp rcx, 1
sete al
or eax, 0xfffffff4
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
test rax, rax
je 0x14013159a
mov qword [rsp + 0x20], 0
lea rdx, str.IsPowerOfTwo_boundary__n
lea r9, [rsp + 0x2c]
mov r8d, 0x17
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1401315a7
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.IsPowerOfTwo_boundary__n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov byte [rsi], 0
call fcn.1400ed650
xor edi, edi
mov rbx, qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x1401315c3
add edi, 1
cmp edi, 0x63
ja 0x1401315e0
pause
cmp byte [rsi], 0
jne 0x1401315c0
jmp 0x1401315e9
xor ecx, ecx
call rbx
cmp byte [rsi], 0
jne 0x1401315c0
mov al, 1
xchg byte [rsi], al
test al, al
jne 0x1401315c0
jmp 0x14013152c
mov qword [rsp + 0x20], 0
lea rcx, str.gotsan.cpp
lea r8, str.__fd_____fd_t__1_______0_
mov edx, 0x24a7
xor r9d, r9d
call fcn.1400d9910
int3

Function at 0x140134a40
Capabilities:
Get system information on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rdi, rdx
mov rsi, rcx
mov al, 1
xchg byte [rcx], al
test al, al
jne 0x140134abe
mov rax, qword [rsi + rdi*8 + 8]
test rax, rax
jne 0x140134ab1
mov rdx, qword [0x140dc0558]
test rdx, rdx
jne 0x140134a83
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [rsp + 0x2c]
mov qword [0x140dc0558], rdx
mov ecx, 0x100000
call fcn.1401314f0
mov rbx, rax
xor ecx, ecx
mov rdx, rax
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x140134aec
mov qword [rsi + rdi*8 + 8], rax
mov byte [rsi], 0
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
xor ebx, ebx
mov r14, qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x140134acc
add ebx, 1
cmp ebx, 0x63
ja 0x140134ad5
pause
jmp 0x140134ada
xor ecx, ecx
call r14
cmp byte [rsi], 0
jne 0x140134ac9
mov al, 1
xchg byte [rsi], al
test al, al
jne 0x140134ac9
jmp 0x140134a57
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsp + 0x20], 0
lea rdx, str.TwoLevelMap
lea r8, str.allocate
mov rcx, rbx
mov r9d, eax
call fcn.1401061c0
int3
Function at 0x140134b20
Capabilities:
Get system information on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rdi, rdx
mov rsi, rcx
mov al, 1
xchg byte [rcx], al
test al, al
jne 0x140134b9e
mov rax, qword [rsi + rdi*8 + 8]
test rax, rax
jne 0x140134b91
mov rdx, qword [0x140dc0558]
test rdx, rdx
jne 0x140134b63
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [rsp + 0x2c]
mov qword [0x140dc0558], rdx
mov ecx, 0x40000
call fcn.1401314f0
mov rbx, rax
xor ecx, ecx
mov rdx, rax
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x140134bcc
mov qword [rsi + rdi*8 + 8], rax
mov byte [rsi], 0
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
xor ebx, ebx
mov r14, qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x140134bac
add ebx, 1
cmp ebx, 0x63
ja 0x140134bb5
pause
jmp 0x140134bba
xor ecx, ecx
call r14
cmp byte [rsi], 0
jne 0x140134ba9
mov al, 1
xchg byte [rsi], al
test al, al
jne 0x140134ba9
jmp 0x140134b37
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsp + 0x20], 0
lea rdx, str.TwoLevelMap
lea r8, str.allocate
mov rcx, rbx
mov r9d, eax
call fcn.1401061c0
int3

Function at 0x140134c00
Capabilities:
Get system information on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rdi, rdx
mov rsi, rcx
mov al, 1
xchg byte [rcx], al
test al, al
jne 0x140134c7e
mov rax, qword [rsi + rdi*8 + 8]
test rax, rax
jne 0x140134c71
mov rdx, qword [0x140dc0558]
test rdx, rdx
jne 0x140134c43
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [rsp + 0x2c]
mov qword [0x140dc0558], rdx
mov ecx, 0x1000
call fcn.1401314f0
mov rbx, rax
xor ecx, ecx
mov rdx, rax
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x140134cac
mov qword [rsi + rdi*8 + 8], rax
mov byte [rsi], 0
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
xor ebx, ebx
mov r14, qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x140134c8c
add ebx, 1
cmp ebx, 0x63
ja 0x140134c95
pause
jmp 0x140134c9a
xor ecx, ecx
call r14
cmp byte [rsi], 0
jne 0x140134c89
mov al, 1
xchg byte [rsi], al
test al, al
jne 0x140134c89
jmp 0x140134c17
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsp + 0x20], 0
lea rdx, str.TwoLevelMap
lea r8, str.allocate
mov rcx, rbx
mov r9d, eax
call fcn.1401061c0
int3
Function at 0x140134ed0
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rdi, rdx
mov r14, rcx
mov eax, dword [rdx + 0x400000]
mov qword [rcx], rax
xor esi, esi
lea r15, [rsp + 0x28]
mov r13, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ebx, ebx
jmp 0x140134f2a
mov ecx, 0x100000
call fcn.1401314f0
add rsi, rax
add rbx, 1
cmp rbx, 0x8000
je 0x140134f56
mov rax, qword [rdi + rbx*8 + 0x400010]
test rax, rax
je 0x140134f1d
mov rdx, qword [0x140dc0558]
test rdx, rdx
jne 0x140134f10
mov rcx, r15
call r13
mov edx, dword [rsp + 0x2c]
mov qword [0x140dc0558], rdx
jmp 0x140134f10
mov r15, qword [0x140e2a8a8]
xor edi, edi
lea rbx, [0x140dea898]
lea r12, [rsp + 0x28]
xor ebp, ebp
jmp 0x140134f8a
mov ecx, 0x40000
call fcn.1401314f0
add rdi, rax
add rbp, 1
cmp rbp, 0x8000
je 0x140134fb3
mov rax, qword [rbx + rbp*8 + 8]
test rax, rax
je 0x140134f7d
mov rdx, qword [0x140dc0558]
test rdx, rdx
jne 0x140134f70
mov rcx, r12
call r13
mov edx, dword [rsp + 0x2c]
mov qword [0x140dc0558], rdx
jmp 0x140134f70
add rsi, r15
lea rax, [rdi + rsi]
add rax, 0x10010
mov qword [r14 + 8], rax
mov rax, r14
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x6d7d8500
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x6d7f95e4]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x6d7d8688
mov rax, qword [0x6d7f95e8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x6d7d854c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x6d7d85d5
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x6d7d8530
mov rcx, rbx
call sym.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x6d7d86bd
mov rax, qword [0x6d7f95e8]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call sym._GetPEImageBase
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x6d7f95e8]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x6d7d86a0
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x6d7d85ce
sub eax, 0x40
and eax, 0xffffffbf
jne 0x6d7d8630
add dword [0x6d7f95e4], 1
cmp edi, 8
jae 0x6d7d8603
test dil, 4
jne 0x6d7d8674
test edi, edi
je 0x6d7d85f8
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x6d7d868f
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x6d7d85f8
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x6d7d861c
jmp 0x6d7d85f8
add rsi, qword [0x6d7f95e8]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x6d7d85ce
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x6d7d85f8
xor esi, esi
jmp 0x6d7d8557
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x6d7d85f8
mov rax, qword [0x6d7f95e8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call sym.__report_error
nop
nop dword [rax]

Function at 0x6d7d8e10
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x6d7f98c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x6d7f98a0]
test rbx, rbx
je 0x6d7d8e64
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x6d7d8e5b
test rsi, rsi
je 0x6d7d8e5b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x6d7d8e40
lea rcx, [0x6d7f98c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x6d7d90a0
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x6d7d90b0
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x6d7d90c0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x6d7d9101
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x6d7d90f8
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x6d7d9103
add rax, 0x28
cmp rax, r9
jne 0x6d7d90e4
xor eax, eax
ret

Function at 0x6d7d91a0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6d7f61f0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x6d7d920d
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d7d920d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6d7d920d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6d7d9204
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6d7d920f
add rax, 0x28
cmp rax, r9
jne 0x6d7d91f0
xor eax, eax
add rsp, 0x28
ret

Function at 0x6d7d9310
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6d7f61f0]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
je 0x6d7d9330
add rsp, 0x28
ret
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d7d9328
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6d7d938d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6d7d9384
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6d7d9394
add rax, 0x28
cmp rax, r9
jne 0x6d7d9370
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret

Function at 0x6d7d93b0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x6d7f61f0]
cmp word [r11], 0x5a4d
mov r9d, ecx
jne 0x6d7d941e
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d7d941e
movsxd rax, dword [r11 + 0x3c]
add rax, r11
mov edx, dword [rax + 0x90]
test edx, edx
je 0x6d7d941e
movzx ecx, word [rax + 0x14]
lea rcx, [rax + rcx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x6d7d941e
sub eax, 1
lea rax, [rax + rax*4]
lea rax, [rcx + rax*8 + 0x28]
mov r10d, dword [rcx + 0xc]
cmp rdx, r10
mov r8, r10
jb 0x6d7d9415
add r8d, dword [rcx + 8]
cmp rdx, r8
jb 0x6d7d9425
add rcx, 0x28
cmp rcx, rax
jne 0x6d7d9400
xor eax, eax
add rsp, 0x28
ret
add rdx, r11
jne 0x6d7d9438
jmp 0x6d7d941e
sub r9d, 1
add rdx, 0x14
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x6d7d9446
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x6d7d941e
test r9d, r9d
jg 0x6d7d9430
mov eax, dword [rdx + 0xc]
add rax, r11
add rsp, 0x28
ret
Function at 0x6d7d9780
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x140013ec0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140013cec

Function at 0x140e06268
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140e063ef
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140e06299
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140e0627f
add dl, dl
jne 0x140e062a6
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140e06306
xor eax, eax
add dl, dl
jne 0x140e062b5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140e063bd
add dl, dl
jne 0x140e062c6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140e062d3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140e062e0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140e062ed
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140e062fa
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140e0628e
mov eax, 1
add dl, dl
jne 0x140e06316
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140e06323
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140e0630b
sub eax, ebx
mov ebx, 1
jne 0x140e0635c
mov ecx, 1
add dl, dl
jne 0x140e0633e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140e0634b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140e06333
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140e0628e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140e06378
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140e06385
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140e0636d
cmp eax, 0x7d00
jae 0x140e063ab
cmp eax, 0x500
jb 0x140e063a6
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140e0628e
cmp eax, 0x7f
ja 0x140e063ae
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140e0628e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140e063e2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140e0628e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14000c43c
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x140014c60], rbx
je 0x14000c4a3
cmp rax, rbx
jne 0x14000c496
mov ebx, 1
mov esi, ebx
jmp 0x14000c4a8
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14000c47b
mov ebx, 1
mov eax, dword [0x140014c68]
cmp eax, ebx
jne 0x14000c4c0
mov edi, 0x1f
mov ecx, edi
call fcn.14013c000
jmp 0x14000c52c
mov eax, dword [0x140014c68]
test eax, eax
jne 0x14000c521
mov dword [0x140014c68], ebx
lea r15, [0x14000eba0]
lea rdi, [0x14000eb88]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x14000c513
test eax, eax
jne 0x14000c517
cmp qword [rdi], r14
je 0x14000c508
mov rax, qword [rdi]
mov rcx, qword [0x14000eb40]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14000c4ea
test eax, eax
je 0x14000c527
mov eax, 0xff
jmp 0x14000c682
mov dword [0x1400143e4], ebx
mov edi, 0x1f
mov eax, dword [0x140014c68]
cmp eax, ebx
jne 0x14000c553
lea rdx, [0x14000eb80]
lea rcx, [0x14000eb48]
call sub.msvcrt.dll__initterm
mov dword [0x140014c68], 2
test esi, esi
jne 0x14000c561
mov rax, r14
xchg qword [0x140014c60], rax
cmp qword [0x140014c80], r14
je 0x14000c594
lea rcx, [0x140014c80]
call fcn.14000ca70
test eax, eax
je 0x14000c594
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140014c80]
mov r9, qword [0x14000eb40]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x14000c5ad
mov eax, 0xff
jmp 0x14000c682
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x14000c633
test ax, ax
je 0x14000c5c8
test edx, edx
jne 0x14000c633
sub ax, bx
cmp ax, di
ja 0x14000c5de
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x14000c5c8
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140001878
mov dword [0x1400143e0], eax
cmp dword [0x140014400], r14d
jne 0x14000c61c
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1400143e4], r14d
jne 0x14000c631
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1400143e0]
jmp 0x14000c682
cmp ax, 0x22
jne 0x14000c647
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14000c5b6
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.14000caf0
add rsp, 0x28
jmp 0x14000c43c