joyce8/EMBER2024-capa huggingface dataset:
Function at 0x33e1522f0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x33e1596d0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x33e15230f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x33e152318
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x33e152330
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x33e1596d0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x33e152350
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x33e152358
ret
cmp word [r8 + 0x18], 0x20b
jne 0x33e152350
sub rcx, rdx
movzx r9d, word [r8 + 6]
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
test r9w, r9w
je 0x33e152350
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
mov rax, r8
cmp rcx, r8
jb 0x33e1523a4
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x33e1523b0
add rdx, 0x28
cmp r9, rdx
jne 0x33e152390
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x33e1523c0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x33e1596d0]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x33e1523e2
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x33e1523f0
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x33e1523e2
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x33e1523e2
movzx edx, word [r8 + 0x14]
movzx r10d, word [r8 + 6]
lea rdx, [r8 + rdx + 0x18]
test r10w, r10w
je 0x33e1523e2
lea r8d, [r10 - 1]
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop word cs:[rax + rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x33e152445
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x33e152458
add rdx, 0x28
cmp rdx, r10
jne 0x33e152430
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x33e152467
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x33e152477
mov edx, dword [rax + 0xc]
test edx, edx
je 0x33e15244e
test ecx, ecx
jg 0x33e152460
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x14000c65c
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x140014cb8], rbx
je 0x14000c6c3
cmp rax, rbx
jne 0x14000c6b6
mov ebx, 1
mov esi, ebx
jmp 0x14000c6c8
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14000c69b
mov ebx, 1
mov eax, dword [0x140014cc0]
cmp eax, ebx
jne 0x14000c6e0
mov edi, 0x1f
mov ecx, edi
call sub.msvcrt.dll__amsg_exit
jmp 0x14000c74c
mov eax, dword [0x140014cc0]
test eax, eax
jne 0x14000c741
mov dword [0x140014cc0], ebx
lea r15, [0x14000eb70]
lea rdi, [0x14000eb58]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x14000c733
test eax, eax
jne 0x14000c737
cmp qword [rdi], r14
je 0x14000c728
mov rax, qword [rdi]
mov rcx, qword [0x14000eb00]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14000c70a
test eax, eax
je 0x14000c747
mov eax, 0xff
jmp 0x14000c8a0
mov dword [0x140014400], ebx
mov edi, 0x1f
mov eax, dword [0x140014cc0]
cmp eax, ebx
jne 0x14000c773
lea rdx, [0x14000eb50]
lea rcx, [0x14000eb18]
call sub.msvcrt.dll__initterm
mov dword [0x140014cc0], 2
test esi, esi
jne 0x14000c781
mov rax, r14
xchg qword [0x140014cb8], rax
cmp qword [0x140014cd8], r14
je 0x14000c7b4
lea rcx, [0x140014cd8]
call fcn.14000cc80
test eax, eax
je 0x14000c7b4
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140014cd8]
mov r9, qword [0x14000eb00]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x14000c7cd
mov eax, 0xff
jmp 0x14000c8a0
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
cmp word [rcx], 0x20
ja 0x14000c851
cmp word [rcx], r14w
je 0x14000c7e6
test edx, edx
jne 0x14000c851
movzx eax, word [rcx]
sub ax, bx
cmp ax, di
ja 0x14000c7fc
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14000c7e6
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.1400018e8
mov dword [0x1400143fc], eax
cmp dword [0x140014420], r14d
jne 0x14000c83a
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140014400], r14d
jne 0x14000c84f
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1400143fc]
jmp 0x14000c8a0
cmp word [rcx], 0x22
jne 0x14000c865
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14000c7d6
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.140197000
add rsp, 0x28
jmp 0x14000c65c
Function at 0x140001454
Capabilities:
Query environment variable

Disassembly:
mov dword [rbp + 0x38244489], 0x3824548b
mov r8d, dword [rsp + 0x5c]
xor r8d, 0x66f50814
mov qword [rsp + 0x78], 0x7d05254b
and edx, r8d
mov dword [rsp + 0x54], 2
and al, 0x54
add al, byte [rax]
add byte [rax], al
cmp edx, eax
je 0x140001810
jmp 0x140001323
mov rax, qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
invalid

Function at 0x140002ca0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov al, 0xc5
mov byte [rsp + 0x27], 0x8c
mov cl, byte [rsp + 0x27]
sub al, cl
mov byte [rsp + 0x1d], al
mov al, byte [rsp + 0x27]
add al, 0xcc
mov dl, byte [rsp + 0x1d]
mov qword [rsp + 0x10], 0
cmp al, dl
mov byte [rsp + 5], cl
ja 0x140002d68
jmp 0x140002d11
mov al, 0x17
mov cl, byte [rsp + 5]
sub al, cl
mov rdx, qword [rsp + 8]
mov byte [rsp + 0x1f], al
and cl, 0x37
mov byte [rsp + 0x1f], cl
add rdx, 0xfffffffffffff000
and rdx, 0xfffffffffffff000
add al, dh
invalid
dec dword [rax - 0x77]
push rsp
and al, 0x10
mov r8d, dword [rsp + 0x20]
imul r8d, dword [rsp + 0x20]
mov dword [rsp + 0x20], r8d
mov rax, qword [rsp + 0x10]
mov qword [rsp + 8], rax
mov cl, byte [rsp + 5]
add cl, 0xee
mov rax, qword [rsp + 8]
mov dx, word [rax]
mov byte [rsp + 0x1f], cl
mov cl, byte [rsp + 0x27]
add cl, 0x60
mov word [rsp + 6], dx
mov byte [rsp + 0x1e], 0xdc
mov r8d, dword [rsp + 0x20]
sub r8d, dword [rsp + 0x20]
mov r9b, byte [rsp + 0x1e]
mov dword [rsp + 0x20], r8d
mov r10b, byte [rsp + 5]
add r10b, 0x90
mov byte [rsp + 0x1f], r10b
cmp cl, r9b
jb 0x140002dab
jmp 0x140002dab
lea rax, [fcn.140002ca0]
mov qword [rsp + 0x10], rax
jmp 0x140002d11
mov rax, qword [rsp + 8]
mov rax, qword [rsp + 8]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 8]
mov dx, word [rsp + 0x24]
or dx, 0xc21c
mov word [rsp + 0x24], dx
cmp dword [rcx + rax], 0x4550
je 0x140002d76
jmp 0x140002cd6
cmp word [rsp + 6], 0x5a4d
je 0x140002d80
jmp 0x140002cd6
Function at 0x44ae40
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbx, rcx
mov ecx, 0x18
mov r12, rdx
call fcn.004587f0
movdqa xmm0, xmmword [0x004968e0]
mov ecx, 0x20
mov word [rax + 0x10], cx
mov rdi, rax
movups xmmword [rax], xmm0
cmp qword [rbx + 8], 0
js 0x44afb0
cmp qword [rbx], 7
mov esi, 7
cmovge rsi, qword [rbx]
lea rcx, [rsi + 0x11]
call fcn.004587f0
lea rdx, [rbx + 0x10]
mov qword [rax], 0
lea rcx, [rax + 0x10]
mov qword [rax + 8], rsi
mov rsi, qword [rbx]
mov qword [rsp + 0x38], rax
mov qword [rax], rsi
lea r8, [rsi + 1]
call sub.msvcrt.dll_memcpy
test rsi, rsi
jle 0x44af93
mov rax, qword [rsp + 0x38]
lea r9, [rdi + 0x10]
lea r13, [rax + 0x10]
lea rax, [rax + rsi + 0x10]
mov qword [rsp + 0x30], rax
mov rax, qword [0x00499380]
mov qword [rsp + 0x28], rax
nop dword [rax + rax]
lea rsi, [0x00496340]
mov rbp, r9
mov rax, qword [rdi]
mov rcx, qword [rsp + 0x28]
mov r14, qword [rsi]
lea r15, [rax + 1]
mov eax, 7
cmp r15, 7
cmovl r15, rax
add rsi, 8
lea rdx, [r15 + 0x11]
call fcn.00453a80
mov rdx, rbp
mov qword [rax + 8], r15
lea r9, [rax + 0x10]
mov rbx, rax
mov qword [rax], 0
mov r8, qword [rdi]
mov rcx, r9
add r8, 1
call sub.msvcrt.dll_memcpy
mov edx, 0x20
mov ecx, r14d
mov r9, rax
mov rax, qword [rdi]
mov rdi, rbx
mov rbp, r9
mov word [rbx + rax + 0x10], dx
add rax, 1
mov qword [rbx], rax
mov rax, r12
sar rax, cl
and eax, 0xffffffee
xor byte [r13], al
lea rax, [0x00496360]
cmp rax, rsi
jne 0x44aefa
add r13, 1
cmp qword [rsp + 0x30], r13
jne 0x44aef0
mov rax, qword [rsp + 0x38]
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rsi, qword [rbx]
mov qword [rsp + 0x38], rbx
jmp 0x44aebf
Function at 0x44c130
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov r14, rcx
mov rcx, qword [0x00498f50]
mov ebp, edx
mov edx, 0x185170e4
lea rbx, [r14 + 2]
call fcn.0044ae40
mov rdi, qword [0x00498f60]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov r13, qword [rax + 0x20]
lea rsi, [rax + 0x20]
nop word cs:[rax + rax]
movzx eax, word [r14]
mov rdx, r14
test ax, ax
je 0x44c1b0
nop dword [rax]
lea ecx, [rax - 0x41]
cmp cx, 0x19
ja 0x44c310
add eax, 0x20
add rdx, 2
mov word [rdx - 2], ax
movzx eax, word [rdx]
test ax, ax
jne 0x44c190
mov rcx, qword [r13 + 0x50]
movzx r12d, word [rcx]
test r12w, r12w
je 0x44c332
mov rax, rcx
nop
nop word cs:[rax + rax]
lea edx, [r12 - 0x41]
cmp dx, 0x19
ja 0x44c340
add r12d, 0x20
add rax, 2
mov word [rax - 2], r12w
movzx r12d, word [rax]
test r12w, r12w
jne 0x44c1d0
movzx r15d, word [r14]
movzx r12d, word [rcx]
test r15w, r15w
je 0x44c265
test r12w, r12w
je 0x44c360
mov r10, rbx
mov eax, r15d
sub r10, rcx
jmp 0x44c226
cmp word [rcx], 0
je 0x44c265
movzx edx, word [rcx]
lea r9d, [rax - 0x41]
lea r8d, [rax + 0x20]
cmp r9w, 0x1a
cmovb eax, r8d
lea r9d, [rdx - 0x41]
lea r8d, [rdx + 0x20]
cmp r9w, 0x1a
cmovb edx, r8d
cmp ax, dx
jne 0x44c360
mov rax, rcx
add rcx, 2
movzx eax, word [r10 + rax]
test ax, ax
jne 0x44c220
mov edx, 0x75c82964
mov rcx, rdi
call fcn.0044ae40
cmp r15w, r12w
je 0x44c376
mov r13, qword [r13]
cmp rsi, r13
jne 0x44c180
test ebp, ebp
je 0x44c38b
mov rcx, qword [0x00498f80]
lea rbx, [rsp + 0x30]
mov edx, 0x5d9aa204
call fcn.0044ae40
mov rax, qword [0x00498cc0]
mov rcx, rbx
mov rdx, r14
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x28], 0
call qword [rax]
mov rax, qword [0x00498c70]
mov r8, rbx
xor edx, edx
lea r9, [rsp + 0x28]
xor ecx, ecx
call qword [rax]
mov rcx, qword [0x00498f90]
mov edx, 0x5e6d0c4c
mov ebx, eax
call fcn.0044ae40
test ebx, ebx
jne 0x44c39c
mov rax, qword [rsp + 0x28]
jmp 0x44c37a
add rdx, 2
movzx eax, word [rdx]
test ax, ax
jne 0x44c190
mov rcx, qword [r13 + 0x50]
movzx r12d, word [rcx]
test r12w, r12w
jne 0x44c1c2
movzx r15d, word [r14]
jmp 0x44c265
add rax, 2
movzx r12d, word [rax]
test r12w, r12w
jne 0x44c1d0
jmp 0x44c1f6
mov rcx, qword [0x00498f60]
mov edx, 0x75c82964
call fcn.0044ae40
jmp 0x44c27c
mov rax, qword [r13 + 0x20]
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [0x00498f70]
mov edx, 0x4e19286c
call fcn.0044ae40
xor eax, eax
jmp 0x44c37a
Function at 0x450e20
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
xor r8d, r8d
test rdx, rdx
mov rsi, rcx
mov rbx, rdx
je 0x450e3f
mov rcx, rdx
call sub.msvcrt.dll_strlen
mov r8, rax
mov rcx, rbx
mov r9, rsi
mov edx, 1
call sub.msvcrt.dll_fwrite
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp sub.msvcrt.dll_fflush

Function at 0x451080
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, 2
call qword [fcn.0045e3a0]
mov r8d, 0x3f
mov edx, 1
lea rcx, str._GC__cannot_register_global_variable__too_many_global_variables
mov rbx, rax
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rcx, rbx
call sub.msvcrt.dll_fflush
mov ecx, 1
call sub.msvcrt.dll_exit
nop

Function at 0x4510c0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, 2
call qword [fcn.0045e3a0]
mov r8d, 0x4b
mov edx, 1
lea rcx, str._GC__cannot_register_thread_local_variable__too_many_thread_local_variables
mov rbx, rax
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rcx, rbx
call sub.msvcrt.dll_fflush
mov ecx, 1
call sub.msvcrt.dll_exit
nop

Function at 0x456cd0
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
test rcx, rcx
mov rbx, rcx
mov rdi, rdx
je 0x456df0
movabs rax, 0x3fffffffffffffff
mov rcx, qword [rcx + 8]
and rax, rcx
cmp rax, qword [rbx]
mov rdx, rax
jg 0x456dd0
test rdx, rdx
mov eax, 4
jle 0x456d2b
movabs r8, 0x3fffffffffff0000
lea rax, [rdx + rdx]
test rcx, r8
je 0x456d2b
add rax, rdx
sar rax, 1
mov rcx, qword [rdi + 0x18]
mov edx, 0x10
mov r8, qword [rcx + 8]
test r8, r8
jne 0x456db0
mov rsi, rax
imul rsi, qword [rcx]
jo 0x456e37
add rdx, rsi
jo 0x456e37
mov rcx, rdi
movq xmm6, rax
call fcn.00453a80
punpcklqdq xmm6, xmm6
mov edx, 0x10
movups xmmword [rax], xmm6
mov r8, qword [rbx]
mov rsi, rax
mov qword [rax], r8
mov r9, qword [rdi + 0x18]
mov rax, qword [r9 + 8]
test rax, rax
jne 0x456dc0
imul r8, qword [r9]
lea rcx, [rsi + rdx]
add rdx, rbx
call sub.msvcrt.dll_memcpy
nop
movaps xmm6, xmmword [rsp + 0x20]
mov rax, rsi
mov qword [rbx], 0
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
lea rdx, [r8 + 0xf]
neg r8
and rdx, r8
jmp 0x456d3d
lea rdx, [rax + 0xf]
neg rax
and rdx, rax
jmp 0x456d82
mov rsi, rbx
movaps xmm6, xmmword [rsp + 0x20]
mov rax, rsi
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
mov rax, qword [rdx + 0x18]
mov edx, 0x10
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x456e0c
lea rdx, [rcx + 0xf]
neg rcx
and rdx, rcx
add rdx, qword [rax]
jo 0x456e37
mov rcx, rdi
call fcn.00453a80
movdqa xmm0, xmmword [0x00496e90]
mov rsi, rax
movups xmmword [rax], xmm0
movaps xmm6, xmmword [rsp + 0x20]
mov rax, rsi
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
call fcn.00456c30
nop
nop dword [rax]
Function at 0x456e40
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rsi, qword [0x004991d0]
mov rbx, qword [rsi]
test rbx, rbx
je 0x456f01
mov rdi, qword [0x00499230]
cmp qword [rdi], 0
je 0x456eef
lea rbp, [rbx - 0x10]
add qword [rbp], 8
mov rax, qword [rbx + 0x28]
test rax, rax
je 0x456ea4
mov rcx, qword [rax - 0x10]
lea rdx, [rax - 0x10]
sub rcx, 8
cmp rcx, 7
mov qword [rax - 0x10], rcx
ja 0x456ea4
mov rcx, qword [0x00499250]
add rcx, 0x18
call fcn.00453f60
mov qword [rbx + 0x28], rbx
add qword [rbp], 8
mov rax, qword [rsi]
test rax, rax
je 0x456edb
mov rcx, qword [rax - 0x10]
lea rdx, [rax - 0x10]
sub rcx, 8
cmp rcx, 7
mov qword [rax - 0x10], rcx
ja 0x456edb
mov rcx, qword [0x00499250]
add rcx, 0x18
call fcn.00453f60
mov rcx, qword [rdi]
mov qword [rsi], rbx
mov edx, 1
add rcx, 0x10
call fcn.0045e2c6
mov rcx, rbx
call fcn.00456470
mov ecx, 1
call sub.msvcrt.dll_exit
mov rcx, qword [0x00498da0]
call fcn.004589f0
lea rcx, [0x00496e40]
mov rbx, rax
mov rax, qword [0x00498dd0]
mov rsi, qword [rbx + 0x18]
mov qword [rbx], rax
lea rax, str.ReraiseDefect
mov qword [rbx + 0x10], rax
call fcn.004539f0
test rsi, rsi
mov qword [rbx + 0x18], rax
je 0x456f64
mov rax, qword [rsi - 0x10]
lea rdx, [rsi - 0x10]
sub rax, 8
cmp rax, 7
mov qword [rsi - 0x10], rax
ja 0x456f64
mov rcx, qword [0x00499250]
add rcx, 0x18
call fcn.00453f60
mov qword [rsp + 0x20], 0x35
lea r9, str.fatal.nim
mov rcx, rbx
lea r8, str.sysFatal
lea rdx, str.ReraiseDefect
call fcn.00456ad0
nop
nop dword [rax + rax]

Function at 0x456f90
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x148
mov byte [rsp + 0x2f], 1
movzx eax, byte [rsp + 0x2f]
mov rbx, rcx
mov qword [rsp + 0x168], rdx
test al, al
jne 0x456fc0
add rsp, 0x148
pop rbx
pop rsi
ret
mov ecx, 2
call qword [fcn.0045e3a0]
mov rdx, qword [rsp + 0x168]
mov rcx, rbx
mov rsi, rax
mov r9, rax
mov r8, rdx
mov edx, 1
call sub.msvcrt.dll_fwrite
mov rcx, rsi
call sub.msvcrt.dll_fflush
jmp 0x456fb2
Function at 0x45bfd0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
lea rsi, [0x004970c0]
mov edx, 0x185170e4
mov r13, rcx
lea rcx, [0x00497100]
call fcn.0044ae40
lea rdi, [r13 + 2]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov r12, qword [rax + 0x20]
lea rbp, [rax + 0x20]
nop dword [rax]
nop word cs:[rax + rax]
movzx eax, word [r13]
mov rdx, r13
test ax, ax
je 0x45c050
nop dword [rax]
lea ecx, [rax - 0x41]
cmp cx, 0x19
ja 0x45c1b0
add eax, 0x20
add rdx, 2
mov word [rdx - 2], ax
movzx eax, word [rdx]
test ax, ax
jne 0x45c030
mov rcx, qword [r12 + 0x50]
movzx ebx, word [rcx]
test bx, bx
je 0x45c1d1
mov rax, rcx
nop
nop word cs:[rax + rax]
lea edx, [rbx - 0x41]
cmp dx, 0x19
ja 0x45c1e0
add ebx, 0x20
add rax, 2
mov word [rax - 2], bx
movzx ebx, word [rax]
test bx, bx
jne 0x45c070
movzx r14d, word [r13]
movzx ebx, word [rcx]
test r14w, r14w
je 0x45c105
test bx, bx
je 0x45c200
mov r10, rdi
mov eax, r14d
sub r10, rcx
jmp 0x45c0c6
cmp word [rcx], 0
je 0x45c105
movzx edx, word [rcx]
lea r9d, [rax - 0x41]
lea r8d, [rax + 0x20]
cmp r9w, 0x1a
cmovb eax, r8d
lea r9d, [rdx - 0x41]
lea r8d, [rdx + 0x20]
cmp r9w, 0x1a
cmovb edx, r8d
cmp ax, dx
jne 0x45c200
mov rax, rcx
add rcx, 2
movzx eax, word [r10 + rax]
test ax, ax
jne 0x45c0c0
mov edx, 0x75c82964
mov rcx, rsi
call fcn.0044ae40
cmp r14w, bx
je 0x45c212
mov r12, qword [r12]
cmp rbp, r12
jne 0x45c020
lea rbx, [rsp + 0x30]
mov edx, 0x5d9aa204
lea rcx, [0x00496fa0]
call fcn.0044ae40
mov rcx, rbx
mov rdx, r13
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x28], 0
call qword [0x0049c2a8]
mov r8, rbx
xor edx, edx
xor ecx, ecx
lea r9, [rsp + 0x28]
call qword [0x0049c2a0]
mov edx, 0x5e6d0c4c
lea rcx, [0x00496f60]
mov ebx, eax
call fcn.0044ae40
xor eax, eax
test ebx, ebx
jne 0x45c217
mov rax, qword [rsp + 0x28]
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
add rdx, 2
movzx eax, word [rdx]
test ax, ax
jne 0x45c030
mov rcx, qword [r12 + 0x50]
movzx ebx, word [rcx]
test bx, bx
jne 0x45c061
movzx r14d, word [r13]
jmp 0x45c105
add rax, 2
movzx ebx, word [rax]
test bx, bx
jne 0x45c070
jmp 0x45c090
mov edx, 0x75c82964
mov rcx, rsi
call fcn.0044ae40
jmp 0x45c11c
mov rax, qword [r12 + 0x20]
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x45d320
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x004b1604]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x45d4a8
mov rax, qword [0x004b1608]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x45d36c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x45d3f5
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x45d350
mov rcx, rbx
call fcn.0045dfc0
test rax, rax
mov r12, rax
je 0x45d4dd
mov rax, qword [0x004b1608]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call fcn.0045e0f0
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x004b1608]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x45d4c0
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x45d3ee
sub eax, 0x40
and eax, 0xffffffbf
jne 0x45d450
add dword [0x004b1604], 1
cmp edi, 8
jae 0x45d423
test dil, 4
jne 0x45d494
test edi, edi
je 0x45d418
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x45d4af
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x45d418
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x45d43c
jmp 0x45d418
add rsi, qword [0x004b1608]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x45d3ee
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.00462aa0
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x45d418
xor esi, esi
jmp 0x45d377
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x45d418
mov rax, qword [0x004b1608]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call fcn.00462aa0
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.00462aa0
nop
nop dword [rax]

Function at 0x45dc30
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x004b18e0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004b18c0]
test rbx, rbx
je 0x45dc84
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x45dc7b
test rsi, rsi
je 0x45dc7b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x45dc60
lea rcx, [0x004b18e0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x45dfc0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x004990c0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x45e02d
mov rcx, r8
call fcn.0045dea0
test eax, eax
je 0x45e02d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x45e02d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x45e024
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x45e02f
add rax, 0x28
cmp rax, r9
jne 0x45e010
xor eax, eax
add rsp, 0x28
ret

Function at 0x462aa0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
call sub.msvcrt.dll__onexit
test rax, rax
sete al
movzx eax, al
neg eax
add rsp, 0x28
ret
lea rcx, [0x00401540]
jmp 0x401510
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.0045e3a0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.0045e3a0
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
jmp 0x401530