joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45e0a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x402c0f
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
nop
call fcn.00409280
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045bf60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x402be0
cmp byte [0x005da5d4], 0
je 0x45e0b5
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x45b080
jmp 0x402be0

Function at 0x45e0c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x005da880]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x005da5d4], 0
je 0x45e0f5
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x005dab00]
aesenc xmm0, xmmword [0x005dab10]
aesenc xmm0, xmmword [0x005dab20]
movq rax, xmm0
ret
jmp 0x409480

Function at 0x45e100
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x005da880]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x005da5d4], 0
je 0x45e136
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x005dab00]
aesenc xmm0, xmmword [0x005dab10]
aesenc xmm0, xmmword [0x005dab20]
movq rax, xmm0
ret
jmp 0x4094e0

Function at 0x45fa60
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x30
mov rcx, 0xfffffffffffffff4
mov qword [rsp], rcx
mov rax, qword [sym.imp.kernel32.dll_GetStdHandle]
call rax
mov rcx, rax
mov qword [rsp], rcx
lea rdx, [0x005daa80]
mov qword [rsp + 8], rdx
lea r8d, [0x005da5ec]
mov qword [rsp + 0x10], r8
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.kernel32.dll_WriteFile]
call rax
call fcn.0045e000
add rsp, 0x30
ret

Function at 0x460920
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x40], r11
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x50], rax
call fcn.0045a920
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
Function at 0x4609c0
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x40], r11
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x68], rax
call fcn.0045aa60
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret

Function at 0x460a80
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0xa8
mov qword [rsp + 0xa0], rbp
lea rbp, [rsp + 0xa0]
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x40], r11
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rax
call fcn.0045aba0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x98]
mov rbp, qword [rsp + 0xa0]
add rsp, 0xa8
ret

Function at 0x460b80
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0xc0
mov qword [rsp + 0xb8], rbp
lea rbp, [rsp + 0xb8]
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x40], r11
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x108]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0x98], rax
nop
call fcn.0045ace0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0xb0]
mov rbp, qword [rsp + 0xb8]
add rsp, 0xc0
ret
Function at 0x140003c00
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x58], rdx
mov rbx, r8
xor edx, edx
test rcx, rcx
je 0x140003c34
cmp word [rcx], 0x5a4d
jne 0x140003c34
movsxd rax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x140003c34
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003c34
mov edx, dword [rcx + 0x28]
add rdx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.140003b40
test eax, eax
jne 0x140003c50
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov rcx, rbx
call fcn.140003bb0
test rax, rax
je 0x140003c45
lea rdx, [rax + 0x10]
lea rax, [rsp + 0x38]
mov rcx, qword [rbx]
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x58]
mov qword [rsp + 0x38], 0
call fcn.1400043f9
not eax
shr eax, 0x1f
add rsp, 0x40
pop rbx
ret

Function at 0x140004300
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov rcx, r10
call fcn.1400042a0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140004754
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rax, qword [0x140537678]
xor ebx, ebx
add rax, 0x18
mov r12, rcx
mov ecx, dword [0x140537674]
mov rsi, rdx
mov rdi, r8
cmp ebx, ecx
jge 0x1400047a2
mov rdx, qword [rax]
cmp r12, rdx
jb 0x14000479a
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x140004889
inc ebx
add rax, 0x28
jmp 0x14000477a
mov rcx, r12
call fcn.140004f81
mov rbp, rax
test rax, rax
jne 0x1400047c1
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.1400046f0
movsxd rbx, ebx
mov rax, qword [0x140537678]
xor edx, edx
imul rbx, rbx, 0x28
add rax, rbx
mov dword [rax], edx
mov qword [rax + 0x20], rbp
call fcn.14000502f
mov edx, dword [rbp + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x140537678]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x140004823
mov rax, qword [0x140537678]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.1400046f0
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x140004883
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140004883
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x140537678]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140004883
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.1400046f0
inc dword [0x140537674]
mov ecx, edi
mov rdi, r12
rep movsb byte [rdi], byte [rsi]
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x6db09ba0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x6db2a5e4]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x6db09d28
mov rax, qword [0x6db2a5e8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x6db09bec
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x6db09c75
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x6db09bd0
mov rcx, rbx
call sym.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x6db09d5d
mov rax, qword [0x6db2a5e8]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call sym._GetPEImageBase
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x6db2a5e8]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x6db09d40
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x6db09c6e
sub eax, 0x40
and eax, 0xffffffbf
jne 0x6db09cd0
add dword [0x6db2a5e4], 1
cmp edi, 8
jae 0x6db09ca3
test dil, 4
jne 0x6db09d14
test edi, edi
je 0x6db09c98
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x6db09d2f
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x6db09c98
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x6db09cbc
jmp 0x6db09c98
add rsi, qword [0x6db2a5e8]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x6db09c6e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x6db09c98
xor esi, esi
jmp 0x6db09bf7
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x6db09c98
mov rax, qword [0x6db2a5e8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call sym.__report_error
nop
nop dword [rax]

Function at 0x6db0a4b0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x6db2a8c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x6db2a8a0]
test rbx, rbx
je 0x6db0a504
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x6db0a4fb
test rsi, rsi
je 0x6db0a4fb
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x6db0a4e0
lea rcx, [0x6db2a8c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x6db0a740
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x6db0a750
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x6db0a760
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x6db0a7a1
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x6db0a798
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x6db0a7a3
add rax, 0x28
cmp rax, r9
jne 0x6db0a784
xor eax, eax
ret

Function at 0x6db0a840
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6db271f0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x6db0a8ad
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6db0a8ad
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6db0a8ad
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6db0a8a4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6db0a8af
add rax, 0x28
cmp rax, r9
jne 0x6db0a890
xor eax, eax
add rsp, 0x28
ret

Function at 0x6db0a9b0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6db271f0]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
je 0x6db0a9d0
add rsp, 0x28
ret
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6db0a9c8
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6db0aa2d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6db0aa24
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6db0aa34
add rax, 0x28
cmp rax, r9
jne 0x6db0aa10
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret

Function at 0x6db0aa50
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x6db271f0]
cmp word [r11], 0x5a4d
mov r9d, ecx
jne 0x6db0aabe
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6db0aabe
movsxd rax, dword [r11 + 0x3c]
add rax, r11
mov edx, dword [rax + 0x90]
test edx, edx
je 0x6db0aabe
movzx ecx, word [rax + 0x14]
lea rcx, [rax + rcx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x6db0aabe
sub eax, 1
lea rax, [rax + rax*4]
lea rax, [rcx + rax*8 + 0x28]
mov r10d, dword [rcx + 0xc]
cmp rdx, r10
mov r8, r10
jb 0x6db0aab5
add r8d, dword [rcx + 8]
cmp rdx, r8
jb 0x6db0aac5
add rcx, 0x28
cmp rcx, rax
jne 0x6db0aaa0
xor eax, eax
add rsp, 0x28
ret
add rdx, r11
jne 0x6db0aad8
jmp 0x6db0aabe
sub r9d, 1
add rdx, 0x14
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x6db0aae6
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x6db0aabe
test r9d, r9d
jg 0x6db0aad0
mov eax, dword [rdx + 0xc]
add rax, r11
add rsp, 0x28
ret
Function at 0x6db0ae20
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x401a50
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.00402de0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.00402de0
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]

Function at 0x401ac0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x00408614]
mov r12, rcx
mov rsi, rdx
mov rbx, r8
test edi, edi
jle 0x401c68
mov rax, qword [0x00408618]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp r12, rdx
jb 0x401b0c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x401b97
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x401af0
mov rcx, r12
call fcn.00402820
mov rbp, rax
test rax, rax
je 0x401ca2
mov rax, qword [0x00408618]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call fcn.00402950
mov ecx, dword [rbp + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x00408618]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x401cb1
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x401b90
sub eax, 4
and eax, 0xfffffffb
jne 0x401c20
add dword [0x00408614], 1
cmp ebx, 8
jae 0x401bc8
test bl, 4
jne 0x401c70
test ebx, ebx
je 0x401bb9
movzx eax, byte [rsi]
mov byte [r12], al
test bl, 2
jne 0x401c90
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi]
lea rcx, [r12 + 8]
and rcx, 0xfffffffffffffff8
mov qword [r12], rax
mov eax, ebx
mov rdx, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], rdx
sub r12, rcx
add ebx, r12d
sub rsi, r12
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x401bb9
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x401bfa
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
add rdi, qword [0x00408618]
mov qword [rdi + 8], rcx
mov r9, rdi
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x401b90
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.00401a50
nop dword [rax]
xor edi, edi
jmp 0x401b17
mov eax, dword [rsi]
mov ebx, ebx
mov dword [r12], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r12 + rbx - 4], eax
jmp 0x401bb9
mov ebx, ebx
movzx eax, word [rsi + rbx - 2]
mov word [r12 + rbx - 2], ax
jmp 0x401bb9
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.00401a50
mov rax, qword [0x00408618]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call fcn.00401a50
nop
nop dword [rax]
Function at 0x402490
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00408900]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004088e0]
test rbx, rbx
je 0x4024e4
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x4024db
test r12, r12
je 0x4024db
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x4024c0
lea rcx, [0x00408900]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x402820
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x004055f0]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x402899
mov rcx, r10
call fcn.004026f0
test eax, eax
je 0x402899
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x402896
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x40288d
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x402899
add r8, 0x28
cmp r8, r9
jne 0x402878
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret

Function at 0x403047
Capabilities:
Prepare http request

Disassembly:
sub rsp, 0x38
mov r8, rdx
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], 0
lea rdx, [0x00405268]
xor r9d, r9d
call sub.WINHTTP.dll_WinHttpOpenRequest
add rsp, 0x38
ret

Function at 0x403072
Capabilities:
Initialize winhttp library

Disassembly:
sub rsp, 0x28
mov dword [rsp + 0x20], 0
lea rcx, [0x00405240]
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.WINHTTP.dll_WinHttpOpen
add rsp, 0x28
ret

Function at 0x40310c
Capabilities:
Receive http response

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x30
mov r14, rdx
mov r13, rcx
lea r12, [rsp + 0x2c]
mov dword [r12], 0
lea r15, [rsp + 0x28]
mov rdi, rdx
mov dword [rsp + 0x28], 0
mov rcx, r13
mov rdx, r15
call sub.WINHTTP.dll_WinHttpQueryDataAvailable
mov ebx, dword [rsp + 0x28]
lea ecx, [rbx + 1]
mov edx, 1
call sub.msvcrt.dll_calloc
mov rsi, rax
mov eax, ebx
or eax, 0xfffffffe
mov ecx, ebx
xor ecx, 1
mov edx, ebx
and edx, 1
add edx, eax
lea r8d, [rcx + rdx]
add r8d, 2
mov rcx, rsi
xor edx, edx
call sub.msvcrt.dll_memset
mov rcx, r13
mov rdx, rsi
mov r8d, ebx
mov r9, r12
call sub.WINHTTP.dll_WinHttpReadData
mov eax, dword [rsp + 0x28]
cmp rsi, rdi
jbe 0x4031b0
test eax, eax
je 0x4031e2
xor ecx, ecx
mov dl, byte [rsi + rcx]
mov byte [rdi + rcx], dl
inc rcx
cmp rax, rcx
jne 0x4031a0
jmp 0x4031c7
test eax, eax
je 0x4031c7
mov rcx, rax
mov dl, byte [rsi + rax - 1]
mov byte [rdi + rax - 1], dl
dec rcx
mov rax, rcx
jne 0x4031b7
mov ebx, dword [rsp + 0x28]
mov eax, ebx
add rdi, rax
mov rcx, rsi
call sub.msvcrt.dll_free
test ebx, ebx
jne 0x403136
jmp 0x4031e6
xor ebx, ebx
jmp 0x4031cb
mov rax, r14
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret