joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002d620
Capabilities:
Print debug messages

Disassembly:
jmp 0x14002d620
push rbx
sub rsp, 0x540
mov rax, qword [0x14004b150]
xor rax, rsp
mov qword [rsp + 0x530], rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x14002d69d
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
jmp 0x14002d6bd
mov rax, qword [rsp + 0x548]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x548]
mov qword [rsp + 0xf8], rax
lea rcx, str.Invalid_parameter_passed_to_C_runtime_function._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.14002d5f0
add rsp, 0x540
pop rbx
ret

Function at 0x14002d91c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14002d968
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14002d960
cmp dword [rcx + 0x3c], edx
jl 0x14002d960
cmp dword [rcx + 0x3c], 0x10000000
jae 0x14002d960
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x14002d968
mov rax, rdx
add rsp, 0x18
ret
Function at 0x140587058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1405871df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140587089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14058706f
add dl, dl
jne 0x140587096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405870f6
xor eax, eax
add dl, dl
jne 0x1405870a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405871ad
add dl, dl
jne 0x1405870b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405870c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405870d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405870dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1405870ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14058707e
mov eax, 1
add dl, dl
jne 0x140587106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140587113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405870fb
sub eax, ebx
mov ebx, 1
jne 0x14058714c
mov ecx, 1
add dl, dl
jne 0x14058712e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14058713b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140587123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14058707e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140587168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140587175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14058715d
cmp eax, 0x7d00
jae 0x14058719b
cmp eax, 0x500
jb 0x140587196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14058707e
cmp eax, 0x7f
ja 0x14058719e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14058707e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1405871d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14058707e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1400c6190]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x1400c61a0]
mov dword [rax], 1
mov rax, qword [0x1400c61b0]
mov dword [rax], 1
mov rax, qword [0x1400c6130]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x1400c6180]
mov dword [0x1400e8020], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x1400c6270]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x1400c6250]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x1400c5780]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a

Function at 0x140001cc0
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x240
lea rsi, method.fmt::v8::basic_memory_buffer_char__500ull__std::allocator_char___.grow_unsigned_long_long_
movq xmm0, rsi
lea rbx, [rsp + 0x40]
mov r9, rcx
lea rcx, [rsp + 0x20]
movq xmm1, rbx
punpcklqdq xmm0, xmm1
movups xmmword [rsp + 0x20], xmm0
movdqu xmm0, xmmword [0x1400c0150]
movups xmmword [rsp + 0x30], xmm0
call r9
mov ecx, 2
mov rdi, qword [dbg.__acrt_iob_func]
call rdi
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
mov r8d, 1
mov r9, rax
call sym.fwrite
test rax, rax
jne 0x140001d58
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x20], rsi
cmp rcx, rbx
je 0x140001d46
mov rdx, qword [rsp + 0x38]
call sym.operator_delete_void__unsigned_long_long_
nop
add rsp, 0x240
pop rbx
pop rsi
pop rdi
ret
mov ecx, 2
call rdi
mov ecx, 0xa
mov rdx, rax
call sym.fputc
jmp 0x140001d2c

Function at 0x140003bb0
Capabilities:
Write file on windows

Disassembly:
mov r8, rdx
mov edx, ecx
lea rcx, [method.fmt::v8.format_system_error_fmt::v8::detail::buffer_char___int__char_const_]
jmp method.fmt::v8::detail.report_error_void____fmt::v8::detail::buffer_char___int__char_const___int__char_const_
Function at 0x140006320
Capabilities:
Write file on windows

Disassembly:
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x478
mov r13, qword [rdx]
mov rsi, qword [rdx + 8]
mov rbx, rcx
call qword [sym.imp.msvcrt.dll__fileno]
mov r12d, eax
mov ecx, eax
call qword [sym.imp.msvcrt.dll__isatty]
test eax, eax
je 0x1400063d8
lea rcx, [rsp + 0x60]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], rsi
call method.fmt::v8::detail::utf8_to_utf16.utf8_to_utf16_fmt::v8::basic_string_view_char__
mov rax, qword [rsp + 0x70]
mov r14, qword [rsp + 0x68]
mov ecx, r12d
mov dword [rsp + 0x5c], 0
lea rdi, [rax - 1]
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov rcx, rax
lea r9, [rsp + 0x5c]
mov r8d, edi
mov rdx, r14
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
test eax, eax
lea rax, method.fmt::v8::basic_memory_buffer_wchar_t__500ull__std::allocator_wchar_t___.grow_unsigned_long_long_
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x80]
jne 0x140006408
cmp rcx, rax
je 0x1400063d8
mov rax, qword [rsp + 0x78]
lea rdx, [rax + rax]
call sym.operator_delete_void__unsigned_long_long_
mov r9, rbx
mov r8, rsi
mov edx, 1
mov rcx, r13
call sym.fwrite
cmp rsi, rax
ja 0x14000641d
add rsp, 0x478
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
ret
cmp rcx, rax
je 0x1400063f0
mov rax, qword [rsp + 0x78]
lea rdx, [rax + rax]
call sym.operator_delete_void__unsigned_long_long_
jmp 0x1400063f0
mov ecx, 0x20
call sym.__cxa_allocate_exception
mov r12, rax
call qword [sym.imp.msvcrt.dll__errno]
mov edx, dword [rax]
lea r9, [rsp + 0x30]
lea rax, [rsp + 0x60]
mov rcx, r12
lea rdi, [0x1400c00e0]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], 0x14
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], rax
call method.fmt::v8.vsystem_error_int__fmt::v8::basic_string_view_char___fmt::v8::basic_format_args_fmt::v8::basic_format_context_fmt::v8::appender__char____
lea r8, [method.std::system_error.system_error__]
lea rdx, [0x1400c8560]
mov rcx, r12
call sym.__cxa_throw
mov r12, rax
mov rcx, qword [rsp + 0x68]
lea rax, method.fmt::v8::basic_memory_buffer_wchar_t__500ull__std::allocator_wchar_t___.grow_unsigned_long_long_
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x80]
cmp rcx, rax
je 0x1400064c2
mov rdx, qword [rsp + 0x78]
add rdx, rdx
call sym.operator_delete_void__unsigned_long_long_
mov rcx, r12
call sym._Unwind_Resume
mov r13, rax
mov rcx, r12
call sym.__cxa_free_exception
mov rcx, r13
call sym._Unwind_Resume
nop
nop
Function at 0x140006630
Capabilities:
Write file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x270
lea rdi, method.fmt::v8::basic_memory_buffer_char__500ull__std::allocator_char___.grow_unsigned_long_long_
xor r9d, r9d
movq xmm0, rdi
mov r10, qword [rdx]
mov r11, qword [rdx + 8]
mov rdx, qword [r8 + 8]
mov rax, qword [r8]
lea rsi, [rsp + 0x70]
lea r13, [rsp + 0x20]
mov qword [rsp + 0x28], rdx
mov rbx, rcx
movq xmm1, rsi
lea r12, [rsp + 0x30]
lea rcx, [rsp + 0x50]
mov r8, r13
punpcklqdq xmm0, xmm1
mov rdx, r12
mov qword [rsp + 0x30], r10
movups xmmword [rsp + 0x50], xmm0
movdqu xmm0, xmmword [0x1400c0150]
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x20], rax
movups xmmword [rsp + 0x60], xmm0
call sym._ZN3fmt2v86detail10vformat_toIcEEvRNS1_6bufferIT_EENS0_17basic_string_viewIS4_EENS0_17basic_format_argsINS0_20basic_format_con
mov rbp, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
mov r9, rbx
mov edx, 1
mov r8, rbp
call sym.fwrite
cmp rbp, rax
ja 0x14000671e
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x50], rdi
cmp rcx, rsi
je 0x1400066e8
mov rdx, qword [rsp + 0x68]
call sym.operator_delete_void__unsigned_long_long_
nop
add rsp, 0x270
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x50], rdi
cmp rcx, rsi
je 0x140006716
mov rdx, qword [rsp + 0x68]
call sym.operator_delete_void__unsigned_long_long_
mov rcx, r12
call sym._Unwind_Resume
mov ecx, 0x20
call sym.__cxa_allocate_exception
mov r14, rax
call qword [sym.imp.msvcrt.dll__errno]
mov edx, dword [rax]
lea rbx, [0x1400c00e0]
mov r9, r13
mov r8, r12
lea rax, [rsp + 0x40]
mov rcx, r14
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], 0x14
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], rax
call method.fmt::v8.vsystem_error_int__fmt::v8::basic_string_view_char___fmt::v8::basic_format_args_fmt::v8::basic_format_context_fmt::v8::appender__char____
lea r8, [method.std::system_error.system_error__]
lea rdx, [0x1400c8560]
mov rcx, r14
call sym.__cxa_throw
mov rcx, r14
mov r12, rax
call sym.__cxa_free_exception
jmp 0x1400066fd

Function at 0x140007030
Capabilities:
Write file on windows

Disassembly:
mov r8, rdx
mov edx, ecx
lea rcx, [method.fmt::v8::detail.format_windows_error_fmt::v8::detail::buffer_char___int__char_const_]
jmp method.fmt::v8::detail.report_error_void____fmt::v8::detail::buffer_char___int__char_const___int__char_const_

Function at 0x140007050
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx]
test rcx, rcx
je 0x140007065
call sym.fclose
test eax, eax
jne 0x140007070
add rsp, 0x28
ret
call qword [sym.imp.msvcrt.dll__errno]
lea rdx, str.cannot_close_file
mov ecx, dword [rax]
add rsp, 0x28
jmp method.fmt::v8.report_system_error_int__char_const_
Function at 0x140007380
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
mov ecx, dword [rcx]
cmp ecx, 0xffffffff
jne 0x140007390
add rsp, 0x28
ret
call qword [sym.imp.msvcrt.dll__close]
test eax, eax
je 0x14000738b
call qword [sym.imp.msvcrt.dll__errno]
lea rdx, str.cannot_close_file
mov ecx, dword [rax]
add rsp, 0x28
jmp method.fmt::v8.report_system_error_int__char_const_

Function at 0x140007480
Capabilities:
Read file on windows

Disassembly:
push r13
push r12
sub rsp, 0x58
mov eax, 0xffffffff
mov ecx, dword [rcx]
cmp r8, rax
cmova r8, rax
call qword [sym.imp.msvcrt.dll__read]
test eax, eax
js 0x1400074ab
cdqe
add rsp, 0x58
pop r12
pop r13
ret
mov ecx, 0x20
call sym.__cxa_allocate_exception
mov r12, rax
call qword [sym.imp.msvcrt.dll__errno]
mov edx, dword [rax]
lea r9, [rsp + 0x20]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x40], 0
lea rcx, str.cannot_read_from_file
lea r8, [rsp + 0x30]
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x30], rcx
mov rcx, r12
mov qword [rsp + 0x38], 0x15
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], rax
call method.fmt::v8.vsystem_error_int__fmt::v8::basic_string_view_char___fmt::v8::basic_format_args_fmt::v8::basic_format_context_fmt::v8::appender__char____
lea r8, [method.std::system_error.system_error__]
lea rdx, [0x1400c8560]
mov rcx, r12
call sym.__cxa_throw
mov r13, rax
mov rcx, r12
call sym.__cxa_free_exception
mov rcx, r13
call sym._Unwind_Resume
nop
nop word cs:[rax + rax]

Function at 0x1400083c0
Capabilities:
Get file size

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x68
mov ecx, dword [rcx]
mov dword [rsp + 0x4c], 0
call qword [sym.imp.msvcrt.dll__get_osfhandle]
lea rdx, [rsp + 0x4c]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp eax, 0xffffffff
je 0x140008410
mov eax, dword [rsp + 0x4c]
shl rax, 0x20
mov rdx, rax
mov eax, ebx
or rax, rdx
add rsp, 0x68
pop rbx
pop rsi
pop r12
pop r13
ret
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rsi
test eax, eax
je 0x1400083ef
mov ecx, 0x20
call sym.__cxa_allocate_exception
mov r13, rax
call rsi
mov edx, eax
lea r9, [rsp + 0x20]
lea rax, [rsp + 0x50]
mov rcx, r13
lea rsi, str.cannot_get_file_size
lea r8, [rsp + 0x30]
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], 0x14
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], rax
call method.fmt::v8.vwindows_error_int__fmt::v8::basic_string_view_char___fmt::v8::basic_format_args_fmt::v8::basic_format_context_fmt::v8::appender__char____
lea r8, [method.std::system_error.system_error__]
lea rdx, [0x1400c8560]
mov rcx, r13
call sym.__cxa_throw
mov r12, rax
mov rcx, r13
call sym.__cxa_free_exception
mov rcx, r12
call sym._Unwind_Resume
nop
nop word cs:[rax + rax]
nop
Function at 0x14000d260
Capabilities:
Read file on windows

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rcx, qword [rcx + 0x38]
mov r12, rdx
mov rsi, r8
test rcx, rcx
je 0x14000d2d1
call sym.feof
test eax, eax
jne 0x14000d2c8
mov rcx, qword [rbx + 0x38]
mov edx, dword [rbx + 0x40]
xor r8d, r8d
call sym.fseek
test eax, eax
js 0x14000d321
mov r9, qword [rbx + 0x38]
mov r8, rsi
mov edx, 1
mov rcx, r12
call sym.fread
test rax, rax
js 0x14000d303
add qword [rbx + 0x40], rax
add rsp, 0x28
pop rbx
pop rsi
pop r12
pop r13
ret
mov rax, 0xffffffffffffffff
jmp 0x14000d2b9
mov ecx, 0x10
call sym.__cxa_allocate_exception
lea rdx, str.Invalid_file
mov rcx, rax
mov r12, rax
call method.std::runtime_error.runtime_error_char_const_
lea r8, [method.std::runtime_error.runtime_error__]
lea rdx, [0x1400c85b0]
mov rcx, r12
call sym.__cxa_throw
mov ecx, 0x10
call sym.__cxa_allocate_exception
lea rdx, str.Error_reading_file...
mov rcx, rax
mov r12, rax
call method.std::runtime_error.runtime_error_char_const_
jmp 0x14000d2ed
mov ecx, 0x10
call sym.__cxa_allocate_exception
lea rdx, str.Error_seeking_file...
mov rcx, rax
mov r12, rax
call method.std::runtime_error.runtime_error_char_const_
jmp 0x14000d2ed

Function at 0x14000d360
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rcx, qword [rcx + 0x38]
mov r12, rdx
mov rsi, r8
test rcx, rcx
je 0x14000d3b3
mov edx, dword [rbx + 0x48]
xor r8d, r8d
call sym.fseek
test eax, eax
js 0x14000d403
mov r9, qword [rbx + 0x38]
mov r8, rsi
mov edx, 1
mov rcx, r12
call sym.fwrite
test rax, rax
js 0x14000d3e5
add qword [rbx + 0x48], rax
add rsp, 0x28
pop rbx
pop rsi
pop r12
pop r13
ret
mov ecx, 0x10
call sym.__cxa_allocate_exception
lea rdx, str.Invalid_file
mov rcx, rax
mov r12, rax
call method.std::runtime_error.runtime_error_char_const_
lea r8, [method.std::runtime_error.runtime_error__]
lea rdx, [0x1400c85b0]
mov rcx, r12
call sym.__cxa_throw
mov ecx, 0x10
call sym.__cxa_allocate_exception
lea rdx, str.Error_writing_file...
mov rcx, rax
mov r12, rax
call method.std::runtime_error.runtime_error_char_const_
jmp 0x14000d3cf
mov ecx, 0x10
call sym.__cxa_allocate_exception
lea rdx, str.Error_seeking_file...
mov rcx, rax
mov r12, rax
call method.std::runtime_error.runtime_error_char_const_
jmp 0x14000d3cf
Function at 0x140018320
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sym.vfprintf
call sym.abort
nop
nop word [rax + rax]

Function at 0x140018390
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x50
movsxd rbx, dword [0x1400e80d4]
mov r12, rcx
test ebx, ebx
jle 0x1400184c0
mov rax, qword [0x1400e80d8]
xor ecx, ecx
add rax, 0x18
nop word [rax + rax]
mov rdx, qword [rax]
cmp rdx, r12
ja 0x1400183dc
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x140018463
add ecx, 1
add rax, 0x28
cmp ecx, ebx
jne 0x1400183c0
mov rcx, r12
call dbg.__mingw_GetSectionForAddress
mov rsi, rax
test rax, rax
je 0x1400184e2
mov rax, qword [0x1400e80d8]
lea rbx, [rbx + rbx*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rsi
mov dword [rax], 0
call dbg._GetPEImageBase
mov ecx, dword [rsi + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x1400e80d8]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400184c7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x14001845c
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140018470
add dword [0x1400e80d4], 1
add rsp, 0x50
pop rbx
pop rsi
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rbx, qword [0x1400e80d8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14001845c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
nop dword [rax]
xor ebx, ebx
jmp 0x1400183e7
mov rax, qword [0x1400e80d8]
mov edx, dword [rsi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call dbg.__report_error
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call dbg.__report_error
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140018a60
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x1400e8140]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400e8120]
test rbx, rbx
je 0x140018ab4
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x140018aab
test r12, r12
je 0x140018aab
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140018a90
lea rcx, [0x1400e8140]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x140018cd0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140018ce8
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x140018cf0
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140018d00
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
mov r8, rdx
lea rdx, [rax + rcx]
movzx eax, word [rdx + 0x14]
lea rax, [rdx + rax + 0x18]
movzx edx, word [rdx + 6]
test edx, edx
je 0x140018d4c
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov ecx, dword [rax + 0xc]
mov rdx, rcx
cmp rcx, r8
ja 0x140018d43
add edx, dword [rax + 8]
cmp rdx, r8
ja 0x140018d4e
add rax, 0x28
cmp rax, r9
jne 0x140018d30
xor eax, eax
ret

Function at 0x140018d50
Capabilities:
Parse pe header

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
call sym.strlen
cmp rax, 8
ja 0x140018de0
mov rdx, qword [0x1400c6130]
xor r12d, r12d
cmp word [rdx], 0x5a4d
jne 0x140018dce
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x140018dce
cmp word [rax + 0x18], 0x20b
jne 0x140018dce
movzx edx, word [rax + 0x14]
lea r12, [rax + rdx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x140018de0
sub eax, 1
lea rax, [rax + rax*4]
lea rsi, [r12 + rax*8 + 0x28]
jmp 0x140018db9
add r12, 0x28
cmp r12, rsi
je 0x140018de0
mov r8d, 8
mov rdx, rbx
mov rcx, r12
call sym.strncmp
test eax, eax
jne 0x140018db0
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret
xor r12d, r12d
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret

Function at 0x140018df0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1400c6130]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140018e10
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140018e18
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140018e10
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x140018e65
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140018e5c
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140018e10
add rax, 0x28
cmp rax, r9
jne 0x140018e48
xor eax, eax
ret

Function at 0x140018e70
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400c6130]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x140018e90
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140018e98
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x140018e90
movzx r8d, word [rax + 6]
mov eax, r8d
ret