joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140347250
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rbx, rcx
test rcx, rcx
jne 0x14034726f
call fcn.140350c7c
jmp 0x140347324
and qword [rbp - 0x30], 0
lea rcx, [rbp - 0x50]
and qword [rbp - 0x28], 0
xor edx, edx
and qword [rbp - 0x20], 0
and qword [rbp - 0x18], 0
and qword [rbp - 0x10], 0
mov byte [rbp - 8], 0
call fcn.1403434e0
mov rax, qword [rbp - 0x48]
mov r9d, 0xfde9
cmp dword [rax + 0xc], r9d
jne 0x1403472ba
cmp byte [rbp - 0x38], 0
je 0x1403472ef
mov rax, qword [rbp - 0x50]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x1403472ef
call fcn.140358c90
test eax, eax
jne 0x1403472db
cmp byte [rbp - 0x38], al
je 0x1403472d3
mov rax, qword [rbp - 0x50]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x1403472ef
cmp byte [rbp - 0x38], 0
je 0x1403472ec
mov rax, qword [rbp - 0x50]
and dword [rax + 0x3a8], 0xfffffffd
xor r9d, r9d
lea r8, [rbp + 0x10]
mov rcx, rbx
lea rdx, [rbp - 0x30]
call fcn.1403470d4
test eax, eax
je 0x140347308
or ebx, 0xffffffff
jmp 0x140347313
mov rcx, qword [rbp - 0x20]
call fcn.140350c7c
mov ebx, eax
cmp byte [rbp - 8], 0
je 0x140347322
mov rcx, qword [rbp - 0x20]
call fcn.140358834
mov eax, ebx
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rbp
ret
Function at 0x140002c94
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x3df2cf03
mov cl, byte [rsp + 0x1d]
and cl, 3
mov edx, dword [rsp + 0x15c]
mov byte [rsp + 0x17b], cl
sub eax, edx
mov dword [rsp + 0xa4], eax
jmp fcn.1400022ec
pop rsp
mov al, 0x57
loopne 0x140002cea
jmp 0x19a5c8d64
cmp eax, edx
jne 0x140002694
jmp 0x140003f7f
mov eax, dword [rsp + 0x28]
add eax, 0x6c443576
mov dword [rsp + 0x17c], eax
jmp 0x140004c1f
invalid
invalid
invalid
push 0xffffffffffffffc4

Function at 0x140004480
Capabilities:
Query environment variable

Disassembly:
mov al, byte [rsp + 0x1d]
xor al, 0xff
mov byte [rsp + 0x17b], al
mov rcx, qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
call rcx
rcl byte [rax + 0x6e], cl
invalid
test byte [rsp + riz*8], ah
add byte [rax], al
add byte [rdx + rcx*4 + 0x4c], al
and al, 0x1d
xor r9b, 0xff
mov byte [rsp + 0x17b], r9b
cmp r8d, ecx
jne 0x140004f5c
jmp sym.DUI70.dll_public:_void___cdecl_DirectUI::TouchScrollViewer::GetVisibleRect_struct_tagRECT____ptr64____ptr64
jmp 0x1400020ec

Function at 0x140005130
Capabilities:
Query environment variable

Disassembly:
mov ax, word [rsp + 0x1e]
and ax, 0x78ba
mov ecx, dword [rsp + 0x15c]
add ecx, 0xc20d30f8
mov word [rsp + 0x16c], ax
mov dword [rsp + 0xa4], ecx
mov rdx, qword [rsp + 0x20]
and byte [rax - 0x77], cl
xchg esp, eax
and al, 0x70
add dword [rax], eax
add cl, ch
out 0xff, al
invalid
jmp 0x1400020ec
mov rdx, qword [rsp + 0x20]
or rdx, 0x5bf573ed
in eax, dx
jae 0x140005128
pop rbx
in eax, dx
jae 0x140005128
pop rbx
mov qword [rsp + 0x170], rdx
cmp r9d, eax
jne 0x140003c67
jmp 0x1400049df

Function at 0x140005f28
Capabilities:
Encode data using xor

Disassembly:
adc al, 0xb3
or esp, dword [rcx + 0x4c]
cld
invalid
ret 0xf7e2
test dword [rcx - 0x3a], 0x6f9e68ca
imul edx, dword [rbx - 0x77285815], 0xffffff9d
out dx, eax
int3
xor byte [r10 + 0x6c013784], 0xa0
shl edx, 0xdf
test byte [rdi], dh
add dword [rax + riz*4 - 0x3f], ebp
loop 0x140005e9e
jne 0x140005e65
mov word [rax], ss
add ch, byte [rbx]
push rdx
xlatb
js 0x140005eb4
jo 0x140005eb7
jp 0x140005e9c
retf 0x8fd8
jg 0x140005eb7
pop rcx
cmp al, 0x5f
and dword [rdi - 0x40bcf03d], ebp
stosb byte [rdi], al
mov edi, dword [rbp + 0x7437e3f8]
pop rsp
sub al, 0xd
invalid
Function at 0x1400087ac
Capabilities:
Encode data using xor

Disassembly:
adc ecx, dword [rcx - 0x4b]
mov edx, 0xbb4d80d0
xchg esi, eax
xchg esi, eax
add eax, 0x822bc1a2
jne 0x140008798
xchg edx, eax
adc byte [rsi - 0x5fbd7da], dh
cmpsd dword [rsi], dword [rdi]
ror esi, 1
in eax, dx
fst dword [rax + 0x4b106f70]
imul edi, edx, 0xe029344c
loope 0x1400087bd
pop rcx
ror byte [rdx - 0x35d47dd6], cl
sar eax, 0xa8
xchg ebx, eax
imul ecx, dword [rdi + 0x3ac01f70], 0xffffffc1
pop rsp
invalid
cmpsd dword [rsi], dword [rdi]
scasd eax, dword [rdi]
stosq qword [rdi], rax
jne 0x1400087e1
mov eax, 0xc3de10e9
movabs eax, dword [0xf912eedff7eb494d]
sahf
sbb eax, dword [rax - 0x6e]
jmp 0x140008759
xor byte [r10 + 0x15be968c], 0x9f
shr dword [rbx], 0x84
insd dword [rdi], dx
xchg ebx, eax
adc byte [rsi - 0x11983f76], dh
pop rdi
jg 0x1400087bd
cld
out dx, al
mov gs, word [rdi + 0x45]
invalid
scasb al, byte [rdi]
add edi, esi
out 0x4e, eax
sbb edi, edi
invalid

Function at 0x1400498cc
Capabilities:
Encode data using xor

Disassembly:
mov al, 0x2a
mov dh, 0xa2
push 0xffffffff92d4d38f
sti
js 0x1400498ed
sbb dword [rax - 0x5a4483f1], 0x19
in eax, dx
invalid
test dword [rbx + 0x1e923061], ebx
jg 0x14004996b
loopne 0x14004992b
jo 0x1400498c5
int3
invalid
xchg ebx, eax
scasd eax, dword [rdi]
movabs eax, dword [0x8fabfe37609b93dd]
in al, 0xcc
test al, 0x1e
jno 0x140049980
xor ebp, edi
loope 0x1400498f8
jnp 0x1400499a0
sub bh, ch
sub bh, byte [rsp + rcx*8 + 0x1a]
rcr dword [rax + 0x39], 0x9f
add ebx, dword [eip - 0x5618f36f]
jbe 0x1400499c8
int3
cmp ebx, ebp
sti
wait
scasb al, byte [rdi]
jp 0x140049948
movabs al, byte [0xa5e16ee146ca245]
mov ch, byte [rdi + rcx*4]
jmp 0x1400499f1
popfq
and eax, dword [rax - 0x1c965601]
imul esp, ebp, 0xffffffd9
in eax, 0xd9
cmpsb byte [rsi], byte [rdi]
in al, dx
cdq
and dh, byte [rsi - 0x1185975e]
call 0xcfb0a668
mov ch, 0x4d
call qword [rdi + 1]
sub byte [rbx - 0x1c7f8a67], dh
mov bl, 0x99
jne 0x140049960
jrcxz 0x140049a13
xor al, 0xe8
mov cl, 0x44
insb byte [rdi], dx
mov esp, ebp

Function at 0x1400504e0
Capabilities:
Encode data using xor

Disassembly:
test al, 0xe6
outsb dx, byte [rsi]
xor esi, dword [rcx + 0x28]
adc ebp, edx
push rbp
inc byte [rdx]
cmp byte [rcx + rax], dil
out 0xd3, al
xor r15b, byte [rbx - 0x5f5fbd1b]
cmp eax, 0xaf2010ce
invalid

Function at 0x140059a40
Capabilities:
Encode data using xor

Disassembly:
ja 0x140059a4a
in eax, dx
mov edx, 0xfb4db8cc
scasd eax, dword [rdi]
jp 0x140059a60
out 0x4c, eax
cmp al, 0x37
invalid
jo 0x140059a71
adc eax, 0xb48045b2
out dx, eax
rcr dl, cl
std
int 0xb3
xor byte [rdi + rbp*8 - 0x3202252e], 0xb3
loope 0x140059a66
invalid
xor ebp, ecx
xor al, 0x1e
out dx, al
jrcxz 0x140059a88
mov edi, 0xcf88fc13
retf 0x586e
out dx, eax
invalid
Function at 0x14005b654
Capabilities:
Encode data using xor

Disassembly:
xor ecx, dword [rdx - 0x5ffdbae4]
adc edi, dword [rdi]
push 0xffffffffb0bc8110
invalid
xor al, 0xe0
rcr byte [rcx + 0x509cf34f], 1
adc ebp, eax
pop rax
add al, 0xef
xchg edx, eax
out 0xbb, eax
add al, al
insd dword [rdi], dx
xor eax, 0x96174b0f
mov bl, 0x43
fbstp tbyte [rdi + 0x224765b1]
jge 0x14005b67e
loopne 0x14005b621
mov dword [rax], edx
sub ecx, ebx
mov al, 0x12
cmpsd dword [rsi], dword [rdi]
or dword [rbp + rdi*8 + 0x79], 0xffffffcf
retf 0x8de2
retf

Function at 0x14006c748
Capabilities:
Encode data using xor

Disassembly:
mov ch, 0xa5
invalid
sal byte [rcx + 0x52], cl
sub qword [r11 - 0x61eca252], r11
enter 0xfffffffffffff7fd, 0xffffffffffffffdf
cmpsb byte [rsi], byte [rdi]
insd dword [rdi], dx
lgs ebp, [rcx + 0x5feb8f83]
xor ebx, edi
js 0x14006c739
invalid

Function at 0x140071858
Capabilities:
Encode data using xor

Disassembly:
sub byte [rdi + 0x4c], bl
add eax, 0x75dccf53
xchg bh, al
rcr bl, 0xdf
xor al, 0x31
enter 0x7aae, 0x1d
scasb al, byte [rdi]
jp 0x140071854
pop rcx
shl edx, 0xff
in al, dx
cmpsb byte [rsi], byte [rdi]
mov dword [rax], ebx
movabs byte [0xcf73054c5f389768], al
fidiv dword [rbp + 0x72]
mov eax, 0x3443c5db
xor dword [rsi + 0x621c8fae], ebp
scasb al, byte [rdi]
invalid
sal ebp, 0xfe
add ah, byte [rsi - 0x5dd6e777]
push 0x4c5f1e97
add eax, 0x75dbcf3f
jp 0x140071834
rcr bl, 0xd5
xor al, 0x31
mov esi, 0x451d7aae
scasb al, byte [rdi]
jp sym.DUI70.dll_public_virtual:_long_int___cdecl_DirectUI::Element::GetElementProviderImpl_class_DirectUI::InvokeHelper____ptr64__class_DirectUI::ElementProvider____ptr64____ptr64____ptr64
shl r10d, 0xff
loop 0x140071823
mov dword [rax], ebx
cmp dword [rdx + 0x5f2e9768], esp
add rax, 0x75dacf5f
jbe 0x140071854
rcr bl, 0xcd
xor al, 0x31
mov dh, 0xae
scasb al, byte [rdi]

Function at 0x140071c14
Capabilities:
Encode data using xor

Disassembly:
scasb al, byte [rdi]
mov bl, byte [rcx + riz*4]
ret 0xfef5
add eax, 0x75dacf64
ja 0x140071be2
rcr bl, 0xcf
xor al, 0x31
mov eax, 0x3a1d7aae
sal esi, 0xfe
xor ah, byte [rsi - 0x5dcce777]
push 0x4c5f2897
sub byte [rdi + 0x4c], bl
add eax, 0x75dccf54
xchg bh, al
rcr bl, 0xdf
xor al, 0x31
enter 0x7aae, 0x1d
scasb al, byte [rdi]
jp 0x140071c62
pop rdx
shl edx, 0xff
in al, dx
cmpsb byte [rsi], byte [rdi]
mov dword [rax], ebx
movabs byte [0xcf74054c5f389768], al
fidiv dword [rbp + 0x72]
mov eax, 0x3443c5db
xor dword [rsi + 0x621c8fae], ebp
sal ebp, 0xfe
add ah, byte [rsi - 0x5dd6e777]
push 0x4c5f1e97
add eax, 0x75dbcf40
jp 0x140071c42
scasb al, byte [rdi]
invalid
rcr bl, 0xd5
xor al, 0x31
mov esi, 0x461d7aae
shl edx, 0xff
loop 0x140071c31
mov dword [rax], ebx
cmp dword [rdx + 0x5f2e9768], esp
add rax, 0x75dacf60
jbe 0x140071c62
rcr bl, 0xcd
xor al, 0x31
mov dh, 0xae
jp 0x140071cc2
sal esi, 0xfe
and ah, byte [rsi - 0x5dcee777]
push 0x4c5f2697
add eax, 0x75dccf50
invalid
scasb al, byte [rdi]
jp 0x140071ce2
push rsi
shl edx, 0xff
invalid
scasb al, byte [rdi]
mov edx, 0xf5c19f1c
invalid
Function at 0x140072820
Capabilities:
Encode data using xor

Disassembly:
shl dword [rcx + rsi*2], 0xa3
mov esp, 0x77966e2a
mov r9b, 0xe2
call 0x119ab87cd
mov edi, 0xda56696b
movabs rdi, 0xbb1b51f6d112600b
lodsb al, byte [rsi]
mov spl, 0xb6
mov edi, 0xd112600b
not byte [rcx + 0x1b]
mov ebx, 0xb6b440ac
loop 0x14007276e
movabs dword [0xbcb4aae6f3e09975], eax
call qword [rdi - 0x3d83fe01]
mov ebx, 0xc33e964
stosb byte [rdi], al
sti
invalid
loopne 0x14007272a
leave
stosd dword [rdi], eax
wait
mov cl, 0x4c
jnp 0x140072783
and al, byte [rbp + 0x502ffdcd]
invalid
jnp 0x140072742
mov bh, 0xf5
mov dh, 0x36
mov dh, 0x36
outsb dx, byte [rsi]
jp 0x14007274a
xchg edi, eax
xlatb
jmp 0x1400727e3
adc eax, dword [rdi + 0x7b]
xor edi, esi
sbb al, 0x72
sbb eax, 0x18075fb4
fiadd dword [rax - 0x686e2cfe]
clc
jns 0x17151eabe
test al, 0x2b
wait
jbe 0x140072874
cmp eax, 0x1f5f6b86
sbb al, 0x2e
clc
sbb dh, byte [rdx]
invalid
and edx, ebx
sbb eax, 0x2f99a463
jge 0x1400727be
adc esp, esp
cld
sub eax, 0x1ce16a0c
mov dword [rcx - 0x2dc793cc], 0xff291eed
call 0x114a1cf20
invalid
fst dword [rcx]
sbb al, 0x62
or byte [rbx], dh
or eax, 0x8a78c36f
sub dh, byte [rdi - 0x25]
cmp edi, dword [rax]
and dword [0x127b351b1], eax
add eax, 0xe7ac2926
cld
push 0x7592e2c5
xor al, 0xa1
imul ecx, dword [rax - 0x29e5edfc], 0xd5271b60
movsd dword [rdi], dword [rsi]
cwde
jb 0x140072886
adc byte [0x1575e132a], al
outsb dx, byte [rsi]
mov bh, 0xd7
stc
mov edx, 0xa34af4f0
scasd eax, dword [edi]
and dword [rdx + 0x37], edi
and byte [rdx - 0x60deae59], dh
xchg edx, eax
sahf
mov edx, 0x2b070116
wait
sbb dword [r14], edx
mov dl, cl
add ecx, dword [rbx + rcx - 0x2b3d0121]
pop rdx
mov ebp, 0x2e262bb9
mov qword [rax + r13*4 + 0x23694477], rsp
and bh, al
nop
push rbx
mov ecx, 0xaa3ea412
sbb ecx, dword [rsp + rsi*8 - 0x65764b17]
Function at 0x33e1513e3
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp + 0x10], rcx
mov dword [rbp + 0x18], edx
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], r9
lea rax, [rbp - 8]
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 0x18
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
call rax
test eax, eax
sete al
test al, al
je 0x33e151436
mov eax, 0xffffffff
jmp 0x33e151561
mov rax, qword [rbp - 8]
lea rdx, [rbp - 0x10]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
mov edx, 0x800c
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
call rax
test eax, eax
sete al
test al, al
je 0x33e151473
mov eax, 0xffffffff
jmp 0x33e151561
mov rax, qword [rbp + 0x28]
mov ecx, eax
mov rax, qword [rbp - 0x10]
mov rdx, qword [rbp + 0x20]
mov r9d, 0
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptHashData]
call rax
test eax, eax
sete al
test al, al
je 0x33e1514a9
mov eax, 0xffffffff
jmp 0x33e151561
mov rcx, qword [rbp - 0x10]
mov rax, qword [rbp - 8]
lea rdx, [rbp - 0x18]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8, rcx
mov edx, 0x6610
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
call rax
test eax, eax
sete al
test al, al
je 0x33e1514e4
mov eax, 0xffffffff
jmp 0x33e151561
mov rax, qword [rbp - 0x18]
lea rdx, [rbp + 0x18]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rbp + 0x10]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
call rax
test eax, eax
sete al
test al, al
je 0x33e151527
mov eax, 0xffffffff
jmp 0x33e151561
mov rax, qword [rbp - 8]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
call rax
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
call rax
mov rax, qword [rbp - 0x18]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
call rax
mov eax, 0
add rsp, 0x50
pop rbp
ret
Function at 0x33e151567
Capabilities:
Enumerate processes

Disassembly:
push rbp
sub rsp, 0x160
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xf0], rcx
mov dword [rbp + 0xdc], 0
mov edx, 0
mov ecx, 2
call sym.CreateToolhelp32Snapshot
mov qword [rbp + 0xd0], rax
cmp qword [rbp + 0xd0], 0xffffffffffffffff
jne 0x33e1515b2
mov eax, 0
jmp 0x33e151653
mov dword [rbp - 0x60], 0x130
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd0]
mov rcx, rax
call sym.Process32First
test eax, eax
sete al
test al, al
je 0x33e15161e
mov rax, qword [rbp + 0xd0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
jmp 0x33e151653
lea rax, [rbp - 0x60]
lea rdx, [rax + 0x2c]
mov rax, qword [rbp + 0xf0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_lstrcmpiA]
call rax
test eax, eax
sete al
test al, al
je 0x33e15161e
mov eax, dword [rbp - 0x58]
mov dword [rbp + 0xdc], eax
jmp 0x33e15163a
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd0]
mov rcx, rax
call sym.Process32Next
test eax, eax
setne al
test al, al
jne 0x33e1515ef
mov rax, qword [rbp + 0xd0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, dword [rbp + 0xdc]
add rsp, 0x160
pop rbp
ret

Function at 0x33e15165c
Capabilities:
Create thread

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov dword [rbp + 0x20], r8d
mov qword [rbp - 8], 0
mov qword [rbp - 0x10], 0
mov edx, dword [rbp + 0x20]
mov rax, qword [rbp + 0x10]
mov dword [rsp + 0x20], 0x20
mov r9d, 0x1000
mov r8, rdx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp - 8], rax
mov r8d, dword [rbp + 0x20]
mov rcx, qword [rbp + 0x18]
mov rdx, qword [rbp - 8]
mov rax, qword [rbp + 0x10]
mov qword [rsp + 0x20], 0
mov r9, r8
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
mov rdx, qword [rbp - 8]
mov rax, qword [rbp + 0x10]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, rdx
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
call rax
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
je 0x33e15174b
mov rax, qword [rbp - 0x10]
mov edx, 0x1f4
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
jmp 0x33e151750
mov eax, 0xffffffff
add rsp, 0x50
pop rbp
ret

Function at 0x33e151c90
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop dword [rax]
Function at 0x33e151d00
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x33e16f084]
mov rbx, rcx
test esi, esi
jle 0x33e151e30
mov rax, qword [0x33e16f088]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x33e151d4b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x33e151dd5
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x33e151d30
mov rcx, rbx
call dbg.__mingw_GetSectionForAddress
mov rdi, rax
test rax, rax
je 0x33e151e52
mov rax, qword [0x33e16f088]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call dbg._GetPEImageBase
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x33e16f088]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x33e151e37
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x33e151dce
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x33e151de0
add dword [0x33e16f084], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x33e16f088]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x33e151dce
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
nop dword [rax]
xor esi, esi
jmp 0x33e151d58
mov rax, qword [0x33e16f088]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call dbg.__report_error
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call dbg.__report_error
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x33e1521d0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x33e16f0c0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x33e16f0a0]
test rbx, rbx
je 0x33e15222c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x33e152223
test rsi, rsi
je 0x33e152223
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x33e152208
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x33e152440
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x33e152458
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x33e152460
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret
Function at 0x33e152470
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r8d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
test r8w, r8w
je 0x33e1524bd
lea ecx, [r8 - 1]
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp rdx, r8
jb 0x33e1524b4
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x33e1524bf
add rax, 0x28
cmp rax, r9
jne 0x33e1524a0
xor eax, eax
ret

Function at 0x33e1524c0
Capabilities:
Parse pe header

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
call sym.strlen
cmp rax, 8
ja 0x33e152550
mov rdx, qword [0x33e16be70]
xor ebx, ebx
cmp word [rdx], 0x5a4d
jne 0x33e15253e
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x33e15253e
cmp word [rax + 0x18], 0x20b
jne 0x33e15253e
movzx edx, word [rax + 0x14]
lea rbx, [rax + rdx + 0x18]
movzx edx, word [rax + 6]
test dx, dx
je 0x33e152550
lea eax, [rdx - 1]
lea rax, [rax + rax*4]
lea rdi, [rbx + rax*8 + 0x28]
jmp 0x33e152529
add rbx, 0x28
cmp rbx, rdi
je 0x33e152550
mov r8d, 8
mov rdx, rsi
mov rcx, rbx
call sym.strncmp
test eax, eax
jne 0x33e152520
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor ebx, ebx
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x33e152560
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x33e16be70]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x33e152580
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x33e152588
ret
cmp word [r8 + 0x18], 0x20b
jne 0x33e152580
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x33e1525dd
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x33e1525d4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x33e152580
add rax, 0x28
cmp rax, r9
jne 0x33e1525c0
xor eax, eax
ret

Function at 0x33e1525e0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x33e16be70]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x33e1525ff
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x33e152608
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x33e1525ff
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x33e152620
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x33e16be70]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x33e152640
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x33e152648
ret
cmp word [rdx + 0x18], 0x20b
jne 0x33e152640
movzx eax, word [rdx + 0x14]
movzx r8d, word [rdx + 6]
lea rax, [rdx + rax + 0x18]
test r8w, r8w
je 0x33e152690
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x33e152687
test rcx, rcx
je 0x33e152640
sub rcx, 1
add rax, 0x28
cmp rax, rdx
jne 0x33e152678
xor eax, eax
ret
Function at 0x33e1526a0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x33e16be70]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x33e1526bf
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x33e1526c8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x33e1526e0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x33e16be70]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x33e152700
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x33e152708
ret
cmp word [r8 + 0x18], 0x20b
jne 0x33e152700
sub rcx, rdx
movzx r9d, word [r8 + 6]
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
test r9w, r9w
je 0x33e152700
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
mov rax, r8
cmp rcx, r8
jb 0x33e152754
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x33e152760
add rdx, 0x28
cmp r9, rdx
jne 0x33e152740
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x33e152770
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x33e16be70]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x33e152792
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x33e1527a0
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x33e152792
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x33e152792
movzx edx, word [r8 + 0x14]
movzx r10d, word [r8 + 6]
lea rdx, [r8 + rdx + 0x18]
test r10w, r10w
je 0x33e152792
lea r8d, [r10 - 1]
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop word cs:[rax + rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x33e1527f5
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x33e152808
add rdx, 0x28
cmp rdx, r10
jne 0x33e1527e0
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x33e152817
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x33e152827
mov edx, dword [rax + 0xc]
test edx, edx
je 0x33e1527fe
test ecx, ecx
jg 0x33e152810
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret