joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140f6d058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140f6d1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140f6d089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f6d06f
add dl, dl
jne 0x140f6d096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f6d0f6
xor eax, eax
add dl, dl
jne 0x140f6d0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f6d1ad
add dl, dl
jne 0x140f6d0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f6d0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f6d0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f6d0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140f6d0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140f6d07e
mov eax, 1
add dl, dl
jne 0x140f6d106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f6d113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f6d0fb
sub eax, ebx
mov ebx, 1
jne 0x140f6d14c
mov ecx, 1
add dl, dl
jne 0x140f6d12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140f6d13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f6d123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f6d07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140f6d168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140f6d175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f6d15d
cmp eax, 0x7d00
jae 0x140f6d19b
cmp eax, 0x500
jb 0x140f6d196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f6d07e
cmp eax, 0x7f
ja 0x140f6d19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f6d07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140f6d1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140f6d07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x180006c70
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov esi, dword [rsp + 0xc8]
mov r12, rdx
mov ebx, dword [rsp + 0xc8]
mov r14, rcx
lea ebp, [rsi + 0x1c2]
cmp esi, ebp
jae 0x180006de4
mov r13, qword [rsp + 0xc0]
xor edi, edi
mov r15d, dword [rsp + 0xc8]
cmp esi, 0x116
ja 0x180006dd6
je 0x180006dce
mov eax, esi
sub eax, 0x13
je 0x180006d8c
sub eax, 0x4b
je 0x180006d6d
cmp eax, 0x4b
jne 0x180006e12
test r15d, r15d
je 0x180006e1f
mov rax, qword [rsp + 0xb8]
lea r8, [rsp + 0x48]
mov r9d, 0xa2
mov dword [rsp + 0x50], r15d
lea rdx, [rsp + 0xc8]
lea rcx, [rsp + 0x50]
mov eax, dword [rax]
mov dword [rsp + 0x48], eax
mov eax, dword [0x18011075c]
mov dword [rsp + 0x40], eax
mov rax, qword [r12]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x20], rax
call fcn.180027800
test eax, eax
jne 0x180006e1f
mov eax, 0xffffffff
jmp 0x180006de6
mov r9d, 0x2e
mov qword [rsp + 0x20], r14
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.18007d350
mov r15d, eax
jmp 0x180006e12
movzx ecx, byte [r14 + 0xb]
mov dword [rsp + 0xc8], edi
cmp cl, 0xf
je 0x180006dc7
movzx eax, byte [r14]
cmp al, 0xe5
je 0x180006dc7
cmp al, 0x2e
jne 0x180006dbd
movzx eax, byte [r14 + 1]
cmp al, 0x2e
jne 0x180006db9
cmp byte [r14 + 2], 0x20
je 0x180006dc7
cmp al, 0x20
je 0x180006dc7
test cl, 8
jne 0x180006dc7
test cl, 0x10
jne 0x180006e12
mov eax, 1
jmp 0x180006de6
cmp qword [r13], rdi
jne 0x180006e2a
jmp 0x180006e12
mov eax, esi
sub eax, 0x161
je 0x180006dfe
cmp eax, 0x4b
jne 0x180006e12
mov eax, ebx
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [r12], eax
cmp eax, 0xffffffff
je 0x180006e2a
mov ebx, 1
add esi, 0x4b
cmp esi, ebp
jb 0x180006cc2
jmp 0x180006de4
cmp dword [rsp + 0xc8], edi
sete dil
mov eax, edi
jmp 0x180006de6
Function at 0x180013c40
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov ebx, dword [rsp + 0x98]
mov r12, r8
imul r13d, edx, 0x1d0
mov r15d, edx
mov edi, edx
cmp edx, r13d
ja 0x180013e04
mov r14, qword [rsp + 0x40]
xor edx, edx
mov rsi, qword [rsp + 0x40]
mov ebp, dword [rsp + 0x98]
cmp edi, 0x71cd
ja 0x180013dec
je 0x180013dde
mov eax, edi
sub eax, 0xf9
je 0x180013db7
sub eax, 0x18
je 0x180013d76
sub eax, 0x3852
je 0x180013d34
cmp eax, 0x588
jne 0x180013e20
mov rax, qword [r12]
lea r9, [rsp + 0x40]
mov r8, rsi
mov qword [rsp + 0x40], rax
xor edx, edx
mov dword [rsp + 0x20], 0x111
xor ecx, ecx
call fcn.18002e750
test eax, eax
je 0x180013e31
mov r8, rsi
mov edx, 0x2a
xor ecx, ecx
call fcn.180086090
cmp eax, 0x20
jne 0x180013d0d
mov ebp, dword [rsi + 0x48]
jmp 0x180013d10
mov ebp, dword [rsi + 0x2c]
mov edx, 0xe1
mov rcx, rsi
call fcn.180033d40
mov r9, qword [rsp + 0xa8]
xor edx, edx
mov rcx, qword [rsp + 0x90]
jmp 0x180013e20
mov rax, qword [rcx]
lea r8, [0x180046130]
mov qword [rsp + 0x28], rdx
xor ecx, ecx
mov qword [r14 + 8], r9
mov r9, r14
mov dword [rsp + 0x20], edx
xor edx, edx
mov qword [r14], rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov r9, qword [rsp + 0xa8]
xor edx, edx
mov rcx, qword [rsp + 0x90]
mov qword [r12], rax
jmp 0x180013e20
mov qword [rsp + 0x30], rdx
mov r9d, 0xff
mov qword [rsp + 0x28], rdx
xor r8d, r8d
mov qword [rsp + 0x20], rdx
xor ecx, ecx
xor edx, edx
call fcn.180005550
mov rsi, rax
test rax, rax
je 0x180013e3e
mov r9, qword [rsp + 0xa8]
xor edx, edx
mov rcx, qword [rsp + 0x90]
jmp 0x180013e20
mov ecx, 0x10
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r14, rax
test rax, rax
je 0x180013e45
mov r9, qword [rsp + 0xa8]
xor edx, edx
mov rcx, qword [rsp + 0x90]
jmp 0x180013e20
cmp qword [r12], 0
je 0x180013e4c
mov ebx, 1
jmp 0x180013e20
cmp edi, 0x7cc5
je 0x180013e1e
cmp edi, 0xaa37
je 0x180013e04
cmp edi, 0xba9f
jne 0x180013e20
mov eax, ebx
mov rbx, qword [rsp + 0xa0]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ebx, ebp
imul eax, r15d, 0x3a
add edi, eax
cmp edi, r13d
jbe 0x180013c90
jmp 0x180013e04
mov edx, 0xe1
mov rcx, rsi
call fcn.180033d40
mov eax, 0xff
jmp 0x180013e06
mov eax, 4
jmp 0x180013e06
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor eax, eax
jmp 0x180013e06
Function at 0x180039190
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov ebx, dword [rsp + 0x88]
lea ebp, [rdx - 9]
mov r14, r9
mov r15, r8
mov r13, rcx
cmp edx, ebp
jbe case.0x1800391fe.3
mov esi, dword [rsp + 0x88]
lea edi, [rdx - 0x83]
lea rdx, [0x180000000]
nop dword [rax + rax]
cmp edi, 0x1c
ja case.0x1800391fe.9
movzx eax, byte [rdx + rdi + 0x393fc]
mov ecx, dword [rdx + rax*4 + 0x393d4]
add rcx, rdx
xor r12d, r12d
jmp rcx
movzx eax, word [r14]
lea r8, [rsp + 0x88]
mov word [rsp + 0x88], ax
lea rdx, [rsp + 0x30]
mov rax, qword [r15]
lea rcx, [rsp + 0x40]
mov r9d, 0x8e
mov qword [rsp + 0x30], rax
call fcn.180018ba0
test eax, eax
je 0x1800392e5
lea rdx, [0x180000000]
jmp case.0x1800391fe.9
movzx eax, word [r14]
mov word [r15 + 8], ax
jmp case.0x1800391fe.9
mov byte [0x1800bfc18], 1
jmp case.0x1800391fe.9
mov rax, qword [r15]
lea rdx, [rsp + 0x40]
mov r9, r13
mov qword [rsp + 0x30], rax
mov r8d, 0x9d
lea rcx, [rsp + 0x30]
call fcn.18004de50
mov ebx, eax
lea rdx, [0x180000000]
jmp case.0x1800391fe.9
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1800bfc1c], eax
cmp eax, 0xffffffff
je 0x1800392d4
lea rdx, [0x180000000]
jmp case.0x1800391fe.9
mov esi, dword [r14]
cmp dword [r15 + 0x18], r12d
je 0x1800392ea
dec edi
lea eax, [rdi + 0x83]
cmp eax, ebp
ja 0x1800391e0
mov eax, ebx
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rdx, str._.200s_line__d:_Missing_argument.
mov ecx, 0x10008
call fcn.18003cff0
mov eax, r12d
jmp 0x1800392b6
mov eax, dword [r13]
add eax, esi
jmp 0x1800392b6
mov eax, 1
jmp 0x1800392b6
mov ebp, r12d
cmp dword [r13], r12d
jbe 0x1800393ca
mov ebx, dword [rsp + 0x88]
nop dword [rax]
mov edi, 0x122
mov eax, edi
sub eax, 0x122
je 0x180039376
sub eax, 1
je 0x180039334
cmp eax, 1
jne 0x1800393b0
mov esi, dword [0x181110e70]
jmp 0x1800393b0
mov rax, qword [r15]
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x88]
mov qword [rsp + 0x38], rax
lea rdx, [0x181110e70]
mov dword [rsp + 0x30], ebx
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x88], 1
mov dword [rsp + 0x20], 0x2b
call fcn.18002e750
cmp eax, 0xffffffff
jmp 0x1800393aa
mov rax, qword [r15]
lea rdx, [rsp + 0x38]
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov r8d, 0xfa
mov dword [rsp + 0x88], esi
lea rcx, [rsp + 0x88]
mov qword [rsp + 0x20], r12
call fcn.180088620
mov rbx, rax
test eax, eax
je 0x1800392e5
inc edi
cmp edi, 0x125
jb 0x180039315
inc ebp
cmp ebp, dword [r13]
jb 0x180039310
mov eax, esi
jmp 0x1800392b6
Function at 0x180058660
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov ebx, dword [rsp + 0x80]
lea r15d, [rcx - 9]
mov r12, r9
mov r14, r8
cmp ecx, r15d
jbe case.0x1800586ca.6
mov r13, qword [rsp + 0xa0]
lea ebp, [rcx - 0x116]
mov edi, dword [rsp + 0x80]
lea r8, [0x180000000]
mov esi, dword [rsp + 0x80]
cmp ebp, 0x13
ja case.0x1800586ca.2
mov ecx, dword [r8 + rbp*4 + 0x5884c]
add rcx, r8
jmp rcx
mov rax, qword [r14]
lea rcx, [rsp + 0x30]
xor edx, edx
mov qword [rsp + 0x30], rax
lea r8d, [rdx + 0x51]
call fcn.180015120
mov rdi, rax
jmp 0x1800587de
movzx eax, word [r12]
mov word [r14], ax
movzx eax, word [r13]
mov word [r14 + 2], ax
jmp case.0x1800586ca.2
movzx eax, word [rdx]
or byte [r14 + 0x30], 1
mov word [r14 + 4], ax
jmp case.0x1800586ca.2
mov eax, dword [0x180110798]
test eax, eax
je 0x180058724
cmp eax, edi
jbe 0x180058750
mov rax, qword [r14]
lea r8, [0x180110798]
mov qword [rsp + 0x30], rax
xor r9d, r9d
lea rax, [rsp + 0x30]
mov edx, 0x109
xor ecx, ecx
mov qword [rsp + 0x20], rax
call fcn.180014990
test eax, eax
je 0x1800587a2
mov eax, dword [0x180110798]
lea r9, [rsp + 0x80]
mov dword [rsp + 0x80], eax
mov r8, r13
mov rax, qword [r14]
mov edx, 0xe7
mov qword [rsp + 0x30], rax
mov rcx, r12
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.180004020
mov rsi, rax
jmp 0x1800587de
mov eax, dword [r12]
mov ebx, esi
add eax, dword [r13]
mov dword [0x180110798], eax
jmp case.0x1800586ca.2
test edi, edi
jne case.0x1800586ca.2
xor eax, eax
jmp 0x180058800
mov edx, dword [r13]
xor r8d, r8d
mov ecx, dword [r14]
shl edx, 9
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__lseek]
cmp eax, 0xffffffff
je 0x180058818
mov r8d, dword [r12]
mov rdx, qword [rsp + 0x88]
mov ecx, dword [r14]
shl r8d, 9
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
cmp eax, 0xffffffff
je 0x180058818
xor ebx, ebx
mov rdx, qword [rsp + 0x88]
lea r8, [0x180000000]
dec ebp
lea eax, [rbp + 0x116]
cmp eax, r15d
ja 0x1800586b6
mov eax, ebx
mov rbx, qword [rsp + 0x90]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r9d, 0x2a
mov dword [rsp + 0x80], 1
lea r8, [rsp + 0x80]
mov qword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call fcn.18008b4c0
mov eax, 0xffffffff
jmp 0x180058800
Function at 0x18007ec90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
imul r15d, edx, 0x78
mov r12, r8
mov r14d, edx
mov rdi, rcx
mov ebx, edx
cmp edx, r15d
ja 0x18007ed2b
mov rsi, qword [rsp + 0x98]
mov rbp, qword [rsp + 0x98]
nop word [rax + rax]
cmp ebx, 0x193
ja 0x18007eda5
je 0x18007ee00
cmp ebx, 0x18
je 0x18007ed95
cmp ebx, 0x1f
je 0x18007ed5c
cmp ebx, 0x46
je 0x18007ed49
cmp ebx, 0x62
je 0x18007ed1c
cmp ebx, 0x138
jne 0x18007edeb
xorps xmm0, xmm0
mov qword [rsp + 0x40], rsi
xor eax, eax
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], rax
jmp 0x18007edeb
test byte [rdi + 0xc], 2
jne 0x18007edeb
mov byte [rsp + 0x40], 0
mov rax, qword [rsp + 0x40]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov ecx, 0xb8
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbp, rax
jmp 0x18007edeb
mov rax, qword [rdi]
lea r8, [rsp + 0x38]
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x98]
lea rax, [rsp + 0x88]
mov r9d, 0x67
xor ecx, ecx
mov qword [rsp + 0x20], rax
call fcn.18004ed00
test eax, eax
je 0x18007eebe
jmp 0x18007edeb
mov ecx, 0x18
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
jmp 0x18007edeb
cmp ebx, 0x258
je 0x18007ed2b
cmp ebx, 0x38e
je 0x18007eecb
cmp ebx, 0x4fa
je 0x18007edd3
cmp ebx, 0x992
je 0x18007ed2b
jmp 0x18007edeb
movzx edx, byte [rdi + 0x1c]
movzx ecx, byte [rdi + 0x38]
sub cl, byte [rdi + 0x3c]
lea eax, [rdx - 1]
and cl, al
sub dl, cl
dec dl
mov byte [rsp + 0x40], dl
lea eax, [r14 + r14*2]
lea ebx, [rbx + rax*4]
cmp ebx, r15d
jbe 0x18007ecd0
jmp 0x18007ed2b
mov eax, 0x11e
cmp eax, 0x11e
jne 0x18007eea0
cmp dword [rsp + 0x88], 0
je 0x18007eeb2
mov eax, dword [rsp + 0x98]
lea r9, [rsp + 0x48]
mov dword [rsp + 0x38], eax
lea r8, [rsp + 0x30]
mov eax, dword [r12]
lea rdx, [rsp + 0x38]
mov dword [rsp + 0x30], eax
mov ecx, 0x128
mov rax, qword [rdi]
mov qword [rsp + 0x48], rax
call fcn.180020150
cmp eax, 0xffffffff
je 0x18007eebe
test eax, eax
je 0x18007ee69
cmp eax, 1
jne 0x18007ee9b
mov dword [rsp + 0x40], eax
jmp 0x18007ed2b
mov rax, qword [rdi]
lea r9, [rsp + 0x98]
mov qword [rsp + 0x48], rax
lea r8, [rsp + 0x48]
lea rax, [rsp + 0x88]
xor edx, edx
mov ecx, 0x120
mov qword [rsp + 0x20], rax
call fcn.180058660
test eax, eax
je 0x18007eebe
mov eax, 0x11e
dec eax
cmp eax, 0x11d
ja 0x18007ee05
jmp 0x18007ee00
lea rcx, str.les_fonctions_noyau_ne_peuvent_pas
call fcn.180092d70
mov dword [rsp + 0x40], 0
jmp 0x18007ed2b
xor edx, edx
mov r8d, 0xb8
mov rcx, rbp
call sub.VCRUNTIME140.dll_memset
mov rax, rbp
jmp 0x18007ed30
Function at 0x180080cb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
lea esi, [rcx - 6]
mov r12, r8
mov r14, rdx
mov edi, ecx
cmp ecx, esi
jbe 0x180080e2c
mov rbx, qword [rsp + 0x98]
lea rdx, [0x180000000]
mov ebp, dword [rsp + 0x80]
xor r13d, r13d
mov r15d, dword [rsp + 0x80]
nop dword [rax + rax]
lea eax, [rdi - 0xb5]
cmp eax, 6
ja case.0x180080d19.182
mov ecx, dword [rdx + rax*4 + 0x80ed8]
add rcx, rdx
jmp rcx
test r14, r14
je 0x180080e4b
movzx ecx, byte [r14]
lea r9, [rsp + 0x80]
mov eax, ecx
mov qword [rsp + 0x20], r12
and cl, 0x70
lea rdx, [rsp + 0x98]
mov byte [rsp + 0x80], cl
and eax, 0xf
mov rcx, qword [r14 + 8]
mov r8d, 0xc1
mov dword [rsp + 0x98], eax
call fcn.18007c260
jmp 0x180080e1b
mov rax, qword [r14]
lea r8, [rsp + 0x80]
mov r9d, 0xcf
mov qword [rsp + 0x98], rax
mov rdx, rbx
mov dword [rsp + 0x80], r15d
lea rcx, [rsp + 0x98]
call fcn.180023190
cmp eax, 0xffffffff
je 0x180080dbc
test eax, eax
je 0x180080db0
cmp eax, 1
jne 0x180080dc1
mov ebp, r13d
mov edi, 0xb8
jmp 0x180080e1b
mov ebp, 1
mov edi, 0xb8
jmp 0x180080e1b
mov ebp, 0xffffffff
mov edi, 0xb8
jmp 0x180080e1b
test rbx, rbx
jne case.0x180080d19.182
mov eax, 0xffffffff
jmp 0x180080e33
mov ebp, r13d
jmp case.0x180080d19.182
mov rax, qword [r14]
lea rcx, [rsp + 0x98]
mov edx, 0xa3
mov qword [rsp + 0x98], rax
call fcn.180090c80
mov r15d, eax
test eax, eax
je 0x180080dcd
lea r8, [rsp + 0x80]
mov dword [rsp + 0x80], eax
xor edx, edx
mov ecx, 0xc1
call fcn.1800555b0
mov rbx, rax
lea rdx, [0x180000000]
dec edi
cmp edi, esi
ja 0x180080d00
mov eax, dword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 0x30], r13
xor r9d, r9d
mov dword [rsp + 0x28], 0xcc
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r13
mov rcx, r12
call fcn.1800763b0
jmp 0x180080e2c
mov edi, 0xb4
mov esi, 0x7fff
mov r14d, 0xffff8001
lea r15d, [rdi + 0x3c]
mov eax, edi
sub eax, 0xb2
je 0x180080ea1
cmp eax, 2
jne 0x180080ec5
test rbx, rbx
je 0x180080ec5
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x180080ec5
mov dword [rbx + 0x22], 0x7fff7fff
mov dword [rbx + 0x1c], 0x80018001
mov qword [rbx + 0x10], r13
mov word [rbx + 0x26], si
mov word [rbx + 0x20], r14w
mov dword [rbx + 0x18], r13d
mov word [rbx + 0x3c], r15w
inc edi
cmp edi, 0xb6
jb 0x180080e83
mov eax, ebp
jmp 0x180080e33
Function at 0x1176160
Capabilities:
Decompress data using aplib

Disassembly:
call 0x11762e7
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1176191
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1176177
add dl, dl
jne 0x117619e
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x11761fe
xor eax, eax
add dl, dl
jne 0x11761ad
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x11762b5
add dl, dl
jne 0x11761be
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11761cb
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11761d8
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11761e5
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x11761f2
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1176186
mov eax, 1
add dl, dl
jne 0x117620e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x117621b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1176203
sub eax, ebx
mov ebx, 1
jne 0x1176254
mov ecx, 1
add dl, dl
jne 0x1176236
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1176243
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x117622b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1176186
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1176270
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x117627d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1176265
cmp eax, 0x7d00
jae 0x11762a3
cmp eax, 0x500
jb 0x117629e
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1176186
cmp eax, 0x7f
ja 0x11762a6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1176186
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x11762da
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1176186
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1400f1380]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x1400f1390]
mov dword [rax], 1
mov rax, qword [0x1400f13a0]
mov dword [rax], 1
mov rax, qword [0x1400f1320]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x1400f1370]
mov dword [0x14010300c], ecx
mov eax, dword [rax]
test eax, eax
jne 0x1400010b0
mov ecx, 1
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x1400f1450]
mov edx, dword [rdx]
mov dword [rax], edx
call sym.__p__commode
mov rdx, qword [0x1400f1430]
mov edx, dword [rdx]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x1400f12d0]
cmp dword [rax], 1
je 0x1400010f1
xor eax, eax
add rsp, 0x28
ret
mov ecx, 2
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001104
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
lea rcx, [sym._matherr]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a

Function at 0x140003980
Capabilities:
Initialize winsock library

Disassembly:
push rsi
push rdi
sub rsp, 0x1f8
mov rax, qword [rcx]
mov rdi, qword [rax]
mov qword [rax], 0
test rdi, rdi
je 0x1400039d8
lea rsi, [rsp + 0x60]
mov r8d, 0x198
mov rcx, rsi
xor edx, edx
call sub.msvcrt.dll_memset
mov cx, 0x202
mov rdx, rsi
call sub.WS2_32.dll_WSAStartup
mov dword [rsp + 0x2c], eax
test eax, eax
jne 0x1400039f2
lea rax, [0x1400bdc14]
mov qword [rdi], rax
add rsp, 0x1f8
pop rdi
pop rsi
ret
lea rcx, [0x1400c3d80]
lea r8, str.library_std_src_synconce.rs
mov edx, 0x2b
call dbg.panic
ud2
mov qword [rsp + 0x30], 0
lea rdx, [0x1400c90e0]
lea r9, str.library_std_src_syswindows_net.rs
lea rcx, [rsp + 0x2c]
lea r8, [rsp + 0x30]
call dbg.assert_failed<i32, i32>
ud2

Function at 0x140023970
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
call sub.KERNEL32.dll_GetSystemInfo
mov eax, dword [rsp + 0x40]
test rax, rax
je 0x1400239a5
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x1400239b5
lea rax, str.The_number_of_hardware_threads_is_not_known_for_the_target_platform
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
mov rax, rsi
add rsp, 0x50
pop rsi
ret