joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401a02e8
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.140191b5c
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.140191b5c
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1401a0438
cmp rax, 0xffffffffffffffff
je 0x1401a0438
xor edi, edi
test rbp, rbp
jle 0x1401a03e3
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14018e1f4
mov rbx, rax
test rax, rax
jne 0x1401a0370
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1401a03d9
mov edx, 0x8000
mov ecx, r14d
call fcn.14017b194
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14018ed4c
cmp eax, 0xffffffff
je 0x1401a03b9
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1401a0380
mov edx, r15d
mov ecx, r14d
call fcn.14017b194
jmp 0x1401a03d9
cmp byte [rsi + 0x38], dil
je 0x1401a03d0
cmp dword [rsi + 0x34], 5
jne 0x1401a03d0
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x1401a03d9
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14018f054
jmp 0x1401a044c
jns 0x1401a044c
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.140191b5c
cmp rax, 0xffffffffffffffff
jne 0x1401a0404
cmp byte [rsi + 0x30], dil
je 0x1401a044c
mov edi, dword [rsi + 0x2c]
jmp 0x1401a044c
mov ecx, r14d
call fcn.140194ab0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1401a044c
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1401a044c
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1401a0445
mov eax, dword [rsi + 0x2c]
jmp 0x1401a044a
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.140191b5c
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x1401a0d88
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov qword [rcx], rdx
lea rbx, [rcx + 8]
xor eax, eax
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov rdi, rcx
movups xmmword [rbx + 0x10], xmm0
mov qword [rbx + 0x20], rax
and qword [rbx + 0x18], rax
mov qword [rbx + 8], rax
mov dword [rbx + 0x10], 1
mov dword [rbx + 0x20], eax
mov dword [rbx + 0x24], eax
test dword [0x140254874], 0x80000000
je 0x1401a0ddd
mov ecx, dword [0x140273390]
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
jne 0x1401a0de2
call fcn.1401a33a4
mov qword [rbx], rax
mov r8b, 1
mov rcx, qword [rdi]
mov rdx, rbx
call fcn.1401a0fb4
mov rbx, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x20
pop rdi
ret
Function at 0x1401a0e18
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov edi, edx
mov rbx, rcx
call fcn.1401ad5a0
mov r8d, dword [rbx + 0x10]
mov ecx, eax
shr r8d, 2
test r8b, 1
jne 0x1401a0eba
mov r8d, dword [rbx + 0x10]
shr r8d, 1
test r8b, 1
je 0x1401a0e56
mov eax, dword [rbx + 0x10]
shr eax, 3
shr edi, 3
sub eax, edi
jmp 0x1401a0e5b
mov eax, 1
lea r8d, [rcx + 2]
cmp eax, r8d
ja 0x1401a0eba
dec eax
mov qword [rsp + 0x20], 0
imul eax, dword [0x14025486c]
lea rcx, [0x1401a1958]
xor edx, edx
mov qword [rsp + 0x30], rcx
div r8d
add eax, dword [0x14025486c]
jne 0x1401a0e99
mov dword [rsp + 0x28], 4
jmp 0x1401a0ea5
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], 1
mov eax, dword [rbx + 0x10]
test al, 1
je 0x1401a0eba
lea rcx, [rsp + 0x20]
call fcn.1401a1144
test al, al
jne 0x1401a0ea5
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
jmp fcn.1401a0b14

Function at 0x1401a750c
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r15
sub rsp, 0x20
mov bpl, r8b
mov rsi, rdx
mov rbx, rcx
xor r15d, r15d
mov qword [rcx], r15
or dword [rcx + 8], 0xfffffff
mov qword [rcx + 0x10], r15
mov qword [rcx + 0x18], r15
mov dword [rcx + 0x20], r15d
mov dword [rcx + 0x24], 0x80000000
mov qword [rcx + 0x28], r15
mov dword [rcx + 0x58], r15d
add rcx, 0x60
call fcn.1401b5de4
nop
mov rax, qword [rsi + 0xa8]
mov qword [rbx + 0xa8], rax
mov qword [rbx + 0xb8], r15
mov dword [rbx + 0xc8], r15d
mov dword [rbx + 0xd4], r15d
mov qword [rbx + 0xd8], r15
test dword [0x140254874], 0x80000000
je 0x1401a75a4
mov ecx, dword [0x140273390]
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
jne 0x1401a75a9
call fcn.1401a33a4
mov qword [rbx + 0x18], rax
mov rax, qword [rax + 0x60]
mov qword [rbx], rax
mov rax, qword [rsi + 0x10]
mov qword [rbx + 0x10], rax
test rax, 0xfffffffffffffffd
je 0x1401a75c8
lock inc dword [rax + 8]
mov dword [rbx + 0x50], r15d
mov dword [rbx + 0x54], r15d
mov dword [rbx + 0xcc], r15d
mov qword [rbx + 0x30], r15
lea rcx, [rbx + 0x38]
call fcn.1401a0d04
lea rcx, [rbx + 0x60]
call fcn.1401b640c
test bpl, bpl
je 0x1401a7633
mov rcx, qword [rbx + 0xa8]
mov rax, qword [rcx + 0xb0]
mov qword [rbx + 0xb0], rax
lock cmpxchg qword [rcx + 0xb0], rbx
je 0x1401a7649
mov rdx, rax
mov qword [rbx + 0xb0], rax
mov rcx, qword [rbx + 0xa8]
lock cmpxchg qword [rcx + 0xb0], rbx
cmp rax, rdx
jne 0x1401a7612
jmp 0x1401a7649
mov eax, dword [rbx + 0xc8]
or eax, 1
mov dword [rbx + 0xc8], eax
mov qword [rbx + 0xb0], r15
call fcn.1401a3604
mov rdi, rax
cmp qword [rax + 0x40], r15
jne 0x1401a765f
mov rcx, rax
call fcn.1401a95a4
mov rax, qword [rdi + 0x40]
mov ecx, dword [rax + 0xa0]
mov dword [rbx + 0xd0], ecx
and dword [rbx + 8], 0xfffffff
mov rax, rbx
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop rdi
pop rsi
ret
Function at 0x1401a94f0
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x140273390]
xor edx, edx
jmp fcn.1401ab13c

Function at 0x1401aa868
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
and qword [rcx], 0
and qword [rcx + 8], 0
and qword [rcx + 0x10], 0
and qword [rcx + 0x18], 0
and qword [rcx + 0x20], 0
and qword [rcx + 0x28], 0
xor edx, edx
mov r8d, 0x800
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rax, rax
jne 0x1401aa8d7
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x57
jne 0x1401aa97e
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
test rax, rax
je 0x1401aa97e
lea rdx, str.RegisterTraceGuidsW
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov rcx, rax
call fcn.1401a1568
mov qword [rbx], rax
lea rdx, str.UnregisterTraceGuids
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov rcx, rax
call fcn.1401a1568
mov qword [rbx + 8], rax
lea rdx, str.TraceEvent
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov rcx, rax
call fcn.1401a1568
mov qword [rbx + 0x10], rax
lea rdx, str.GetTraceLoggerHandle
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov rcx, rax
call fcn.1401a1568
mov qword [rbx + 0x18], rax
lea rdx, str.GetTraceEnableLevel
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov rcx, rax
call fcn.1401a1568
mov qword [rbx + 0x20], rax
lea rdx, str.GetTraceEnableFlags
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov rcx, rax
call fcn.1401a1568
mov qword [rbx + 0x28], rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1401ab13c
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1401ab14f
add rsp, 0x48
ret
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.1401ab36c
lea rdx, [0x140249430]
lea rcx, [rsp + 0x20]
call fcn.14017168c
int3

Function at 0x1401bcaa0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401bcac8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1401bcac8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x14000ab30
Capabilities:
Persist via run registry key

Disassembly:
sub rsp, 0x68
lea rdx, [rsp + 0x30]
lea rcx, [0x14005d480]
call fcn.14000ae40
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x14000ac8f
mov edx, 0xfffe
mov ecx, 0x40
call qword [0x140063768]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x14000ac84
lea rax, str.9E848D89_13F3_4FA9_81DC_A5EC19DB5C39
mov qword [rsp + 0x28], rax
lea rax, str.Appdata
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x38]
lea r8, str._s_s__s
mov edx, 0x7fff
mov rcx, qword [rsp + 0x40]
call qword [0x140063e90]
mov dword [rsp + 0x50], eax
cmp dword [0x14005f130], 1
jne 0x14000ac14
lea r8, [rsp + 0x48]
lea rdx, [0x1400345d0]
mov rcx, 0xffffffff80000001
call qword [0x140063cf8]
test eax, eax
jne 0x14000ac14
mov eax, dword [rsp + 0x50]
inc eax
cdqe
shl rax, 1
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [0x14005f2b4]
mov rcx, qword [rsp + 0x48]
call qword [0x140063cf0]
mov rcx, qword [rsp + 0x48]
call qword [0x140063d00]
cmp dword [0x14005f12c], 1
jne 0x14000ac79
lea r8, [rsp + 0x48]
lea rdx, [0x140034630]
mov rcx, 0xffffffff80000002
call qword [0x140063cf8]
test eax, eax
jne 0x14000ac79
mov eax, dword [rsp + 0x50]
inc eax
cdqe
shl rax, 1
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.AB1F3E47_AEF1_400E_A108_233A046C3A34
mov rcx, qword [rsp + 0x48]
call qword [0x140063cf0]
mov rcx, qword [rsp + 0x48]
call qword [0x140063d00]
mov rcx, qword [rsp + 0x40]
call qword [0x140063780]
mov rcx, qword [rsp + 0x38]
call qword [0x140063780]
mov eax, 1
add rsp, 0x68
ret

Function at 0x14000aca0
Capabilities:
Persist via run registry key

Disassembly:
sub rsp, 0x38
cmp dword [0x14005f130], 1
jne 0x14000ace7
lea r8, [rsp + 0x20]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [0x140063cf8]
test eax, eax
jne 0x14000ace7
lea rdx, [0x14005f2b4]
mov rcx, qword [rsp + 0x20]
call qword [0x140063d48]
mov rcx, qword [rsp + 0x20]
call qword [0x140063d00]
cmp dword [0x14005f12c], 1
jne 0x14000ad2a
lea r8, [rsp + 0x20]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000002
call qword [0x140063cf8]
test eax, eax
jne 0x14000ad2a
lea rdx, str.AB1F3E47_AEF1_400E_A108_233A046C3A34
mov rcx, qword [rsp + 0x20]
call qword [0x140063d48]
mov rcx, qword [rsp + 0x20]
call qword [0x140063d00]
mov eax, 1
add rsp, 0x38
ret
Function at 0x14001dc00
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x3f0
lea rcx, str.UNLOAD.TXT
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x14001dc90
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call qword [0x140063788]
mov qword [0x1400634e0], rax
cmp qword [0x1400634e0], 0
je 0x14001dc90
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140005660]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1400634e8], rax
cmp qword [0x1400634e8], 0
je 0x14001dc78
jmp 0x14001dc90
mov rcx, qword [0x1400634e0]
call qword [0x140063780]
mov qword [0x1400634e0], 0
cmp dword [0x14005f140], 1
jne 0x14001dd7c
call fcn.1400197b0
cmp eax, 1
jne 0x14001dd7c
mov qword [rsp + 0x1d8], 0
mov dword [rsp + 0x1d0], 0
lea rdx, [rsp + 0x1d0]
lea rcx, [0x14005d480]
call fcn.14000ae40
mov qword [rsp + 0x1d8], rax
cmp qword [rsp + 0x1d8], 0
je 0x14001dd7c
xor eax, eax
mov word [rsp + 0x1e0], ax
lea rax, [rsp + 0x1e2]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
lea rax, str.Appdata
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x1d8]
lea r8, str.__s_s_
mov edx, 0x104
lea rcx, [rsp + 0x1e0]
call fcn.140023d1c
mov eax, dword [0x14005f1e4]
mov dword [rsp + 0x28], eax
mov eax, dword [0x14005f1e0]
mov dword [rsp + 0x20], eax
lea r9, [0x14005f192]
lea r8, [0x14005f144]
lea rdx, str.9E848D89_13F3_4FA9_81DC_A5EC19DB5C39
lea rcx, [rsp + 0x1e0]
call fcn.140002e90
mov rcx, qword [rsp + 0x1d8]
call qword [0x140063780]
cmp dword [0x14005f134], 0
jne 0x14001dd8a
call fcn.14000ab30
cmp dword [0x14005f138], 1
jne 0x14001dd98
call fcn.14000a7b0
cmp dword [0x14005f134], 1
jne 0x14001dda6
call fcn.140014b60
mov ecx, 0x15
call fcn.140010fc0
cmp dword [0x14005da70], 1
jne 0x14001de22
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x1400634f8], rax
cmp qword [0x1400634f8], 0
je 0x14001de22
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1400095d0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x140063500], rax
cmp qword [0x140063500], 0
je 0x14001de15
jmp 0x14001de22
mov rcx, qword [0x1400634f8]
call qword [0x140063758]
lea rdx, [rsp + 0x30]
mov cx, 2
call qword [0x140064020]
test eax, eax
jne 0x14001dead
cmp dword [0x14005d33c], 1
jne 0x14001de6a
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140018cb0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1400643f0], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140021700]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1400648e0], rax
cmp qword [0x1400648e0], 0
je 0x14001dea7
mov eax, 1
jmp 0x14001deb2
call qword [0x140064028]
mov eax, 1
add rsp, 0x3f0
pop rdi
ret
Function at 0x6db7db00
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x6db9e5e4]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x6db7dc88
mov rax, qword [0x6db9e5e8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x6db7db4c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x6db7dbd5
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x6db7db30
mov rcx, rbx
call sym.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x6db7dcbd
mov rax, qword [0x6db9e5e8]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call sym._GetPEImageBase
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x6db9e5e8]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x6db7dca0
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x6db7dbce
sub eax, 0x40
and eax, 0xffffffbf
jne 0x6db7dc30
add dword [0x6db9e5e4], 1
cmp edi, 8
jae 0x6db7dc03
test dil, 4
jne 0x6db7dc74
test edi, edi
je 0x6db7dbf8
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x6db7dc8f
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x6db7dbf8
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x6db7dc1c
jmp 0x6db7dbf8
add rsi, qword [0x6db9e5e8]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x6db7dbce
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x6db7dbf8
xor esi, esi
jmp 0x6db7db57
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x6db7dbf8
mov rax, qword [0x6db9e5e8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call sym.__report_error
nop
nop dword [rax]

Function at 0x6db7e410
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x6db9e8c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x6db9e8a0]
test rbx, rbx
je 0x6db7e464
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x6db7e45b
test rsi, rsi
je 0x6db7e45b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x6db7e440
lea rcx, [0x6db9e8c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x6db7e6a0
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x6db7e6b0
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x6db7e6c0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x6db7e701
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x6db7e6f8
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x6db7e703
add rax, 0x28
cmp rax, r9
jne 0x6db7e6e4
xor eax, eax
ret

Function at 0x6db7e7a0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6db9b1f0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x6db7e80d
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6db7e80d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6db7e80d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6db7e804
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6db7e80f
add rax, 0x28
cmp rax, r9
jne 0x6db7e7f0
xor eax, eax
add rsp, 0x28
ret

Function at 0x6db7e910
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6db9b1f0]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
je 0x6db7e930
add rsp, 0x28
ret
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6db7e928
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6db7e98d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6db7e984
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6db7e994
add rax, 0x28
cmp rax, r9
jne 0x6db7e970
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret

Function at 0x6db7e9b0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x6db9b1f0]
cmp word [r11], 0x5a4d
mov r9d, ecx
jne 0x6db7ea1e
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6db7ea1e
movsxd rax, dword [r11 + 0x3c]
add rax, r11
mov edx, dword [rax + 0x90]
test edx, edx
je 0x6db7ea1e
movzx ecx, word [rax + 0x14]
lea rcx, [rax + rcx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x6db7ea1e
sub eax, 1
lea rax, [rax + rax*4]
lea rax, [rcx + rax*8 + 0x28]
mov r10d, dword [rcx + 0xc]
cmp rdx, r10
mov r8, r10
jb 0x6db7ea15
add r8d, dword [rcx + 8]
cmp rdx, r8
jb 0x6db7ea25
add rcx, 0x28
cmp rcx, rax
jne 0x6db7ea00
xor eax, eax
add rsp, 0x28
ret
add rdx, r11
jne 0x6db7ea38
jmp 0x6db7ea1e
sub r9d, 1
add rdx, 0x14
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x6db7ea46
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x6db7ea1e
test r9d, r9d
jg 0x6db7ea30
mov eax, dword [rdx + 0xc]
add rax, r11
add rsp, 0x28
ret
Function at 0x6db7ed80
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x14002a0b8
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
movabs rax, 0xcbf29ce484222325
xor r9d, r9d
movabs r10, 0x100000001b3
cmp r8, r9
je 0x14002a0ee
cmp rdx, r9
je 0x14002a0f3
movzx r11d, byte [rcx + r9]
xor rax, r11
imul rax, r10
inc r9
jmp 0x14002a0d3
add rsp, 0x28
ret
cmp r8, rdx
cmovae r8, rdx
mov rcx, r8
call fcn.14002e170
ud2

Function at 0x14002a104
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x120
mov rdi, rdx
mov rsi, rcx
mov eax, 0x30
mov rax, qword gs:[eax]
mov rax, qword [rax + 0x60]
mov r12, qword [rax + 0x18]
mov r15, qword [r12 + 0x10]
add r12, 0x10
lea rbx, [rsp + 0x20]
cmp r12, r15
je 0x14002a19f
mov r13, qword [r15 + 0x60]
movzx r14d, word [r15 + 0x58]
mov r8d, 0x100
mov rcx, rbx
xor edx, edx
call fcn.14002e0f1
lea rax, [r14 + r13]
xor ecx, ecx
cmp r13, rax
je 0x14002a182
mov dl, byte [r13]
inc r13
test dl, dl
je 0x14002a160
cmp rcx, 0x100
je 0x14002a1c4
mov byte [rsp + rcx + 0x20], dl
inc rcx
jmp 0x14002a160
shr r14, 1
mov edx, 0x100
mov rcx, rbx
mov r8, r14
call fcn.14002a0b8
cmp rax, rdi
je 0x14002a1a6
mov r15, qword [r15]
jmp 0x14002a13c
mov word [rsi], 1
jmp 0x14002a1b1
mov rax, qword [r15 + 0x30]
mov qword [rsi + 8], rax
mov byte [rsi], 0
add rsp, 0x120
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 0x100
mov edx, 0x100
call fcn.14002e170
ud2
Function at 0x140002370
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x180
mov qword [rbp - 0x160], rbx
mov qword [rbp - 0x158], rsi
mov qword [rbp - 0x150], rdi
mov rdi, rcx
mov rdx, qword [rdi + 8]
mov rax, qword [rdi]
mov qword [rbp - 0x140], rax
mov qword [rbp - 0x138], rdx
lea rdx, [rbp - 0x140]
lea rcx, [rbp - 0x110]
call fcn.140002510
lea r8, [rbp - 0x110]
mov r9, qword [rbp - 0x110]
mov r10, 0xffffffffffffffff
cmp r9, r10
jne 0x1400023de
lea rdx, [rbp - 0x100]
jmp 0x1400023e1
mov rdx, r9
mov rcx, rdx
sub rsp, 0x20
call sub.KERNEL32.dll_GetFileAttributesW
add rsp, 0x20
mov esi, eax
sub rsp, 8
cmp esi, 0xffffffff
setne r8b
push r8
mov rdx, qword [rdi + 8]
mov rax, qword [rdi]
mov qword [rbp - 0x130], rax
mov qword [rbp - 0x128], rdx
lea r9, [rbp - 0x130]
lea r10, [rbp - 0x110]
mov rcx, qword [rbp - 0x110]
cmp rcx, 0xffffffffffffffff
jne 0x140002439
lea r8, [rbp - 0x100]
jmp 0x14000243c
mov r8, rcx
lea rdx, str.C:Ddmd2windows_bin...._srcphobos_std_file.d
mov qword [rbp - 0x118], rdx
mov qword [rbp - 0x120], 0x31
lea rdx, [rbp - 0x120]
mov ecx, 0x7f2
sub rsp, 0x20
call fcn.140003180
add rsp, 0x30
mov eax, esi
mov qword [rbp - 0x148], rax
sub rsp, 8
call fcn.1400024b4
add rsp, 8
mov rax, qword [rbp - 0x148]
mov rbx, qword [rbp - 0x160]
mov rsi, qword [rbp - 0x158]
mov rdi, qword [rbp - 0x150]
mov rsp, rbp
pop rbp
ret