joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d8b35f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x6d8d45e4]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x6d8b3778
mov rax, qword [0x6d8d45e8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x6d8b363c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x6d8b36c5
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x6d8b3620
mov rcx, rbx
call sym.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x6d8b37ad
mov rax, qword [0x6d8d45e8]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call sym._GetPEImageBase
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x6d8d45e8]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x6d8b3790
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x6d8b36be
sub eax, 0x40
and eax, 0xffffffbf
jne 0x6d8b3720
add dword [0x6d8d45e4], 1
cmp edi, 8
jae 0x6d8b36f3
test dil, 4
jne 0x6d8b3764
test edi, edi
je 0x6d8b36e8
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x6d8b377f
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x6d8b36e8
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x6d8b370c
jmp 0x6d8b36e8
add rsi, qword [0x6d8d45e8]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x6d8b36be
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x6d8b36e8
xor esi, esi
jmp 0x6d8b3647
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x6d8b36e8
mov rax, qword [0x6d8d45e8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call sym.__report_error
nop
nop dword [rax]

Function at 0x6d8b3f00
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x6d8d48c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x6d8d48a0]
test rbx, rbx
je 0x6d8b3f54
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x6d8b3f4b
test rsi, rsi
je 0x6d8b3f4b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x6d8b3f30
lea rcx, [0x6d8d48c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x6d8b4190
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x6d8b41a0
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x6d8b41b0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x6d8b41f1
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x6d8b41e8
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x6d8b41f3
add rax, 0x28
cmp rax, r9
jne 0x6d8b41d4
xor eax, eax
ret

Function at 0x6d8b4290
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6d8d11f0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x6d8b42fd
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d8b42fd
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6d8b42fd
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6d8b42f4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6d8b42ff
add rax, 0x28
cmp rax, r9
jne 0x6d8b42e0
xor eax, eax
add rsp, 0x28
ret

Function at 0x6d8b4400
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6d8d11f0]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
je 0x6d8b4420
add rsp, 0x28
ret
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d8b4418
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6d8b447d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6d8b4474
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6d8b4484
add rax, 0x28
cmp rax, r9
jne 0x6d8b4460
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret

Function at 0x6d8b44a0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x6d8d11f0]
cmp word [r11], 0x5a4d
mov r9d, ecx
jne 0x6d8b450e
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d8b450e
movsxd rax, dword [r11 + 0x3c]
add rax, r11
mov edx, dword [rax + 0x90]
test edx, edx
je 0x6d8b450e
movzx ecx, word [rax + 0x14]
lea rcx, [rax + rcx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x6d8b450e
sub eax, 1
lea rax, [rax + rax*4]
lea rax, [rcx + rax*8 + 0x28]
mov r10d, dword [rcx + 0xc]
cmp rdx, r10
mov r8, r10
jb 0x6d8b4505
add r8d, dword [rcx + 8]
cmp rdx, r8
jb 0x6d8b4515
add rcx, 0x28
cmp rcx, rax
jne 0x6d8b44f0
xor eax, eax
add rsp, 0x28
ret
add rdx, r11
jne 0x6d8b4528
jmp 0x6d8b450e
sub r9d, 1
add rdx, 0x14
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x6d8b4536
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x6d8b450e
test r9d, r9d
jg 0x6d8b4520
mov eax, dword [rdx + 0xc]
add rax, r11
add rsp, 0x28
ret
Function at 0x6d8b48a0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x180002052
Capabilities:
Get system information on windows

Disassembly:
pop rdi
pop rsi
mov edx, 0xac18ce6b
mov ecx, dword [rsi]
sub ecx, ebx
add ecx, 1
cmp edx, ecx
jmp 0x180002087
push rdi
mov ecx, esi
push rax
pop rdi
push rdx
pop rsi
jmp 0x180002094
push rbx
push rsi
push rdi
add ebx, eax
lodsd eax, dword [rsi]
sub eax, ebx
stosd dword [rdi], eax
loop 0x180002060
jmp 0x180002040
mov ecx, 0x24
call qword [sym.imp.NTDLL.dll_ZwQuerySystemInformation]
add eax, dword [rsp + 0x28]
and eax, 0x1ff
mov ecx, dword [rsp + 0x88]
shr eax, 1
jmp 0x18000205b
pop rbx
jne 0x18000209f
add rsp, 0x88
pop rcx
pop rdi
ret
shr ecx, 2
push rcx
sub rsp, 0x88
push 0
pop r9
push 0x60
pop r8
lea edx, [rsp + 0x28]
jmp 0x180002068
Function at 0x1807ac058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1807ac1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1807ac089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1807ac06f
add dl, dl
jne 0x1807ac096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1807ac0f6
xor eax, eax
add dl, dl
jne 0x1807ac0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1807ac1ad
add dl, dl
jne 0x1807ac0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1807ac0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1807ac0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1807ac0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1807ac0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1807ac07e
mov eax, 1
add dl, dl
jne 0x1807ac106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1807ac113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1807ac0fb
sub eax, ebx
mov ebx, 1
jne 0x1807ac14c
mov ecx, 1
add dl, dl
jne 0x1807ac12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1807ac13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1807ac123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1807ac07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1807ac168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1807ac175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1807ac15d
cmp eax, 0x7d00
jae 0x1807ac19b
cmp eax, 0x500
jb 0x1807ac196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1807ac07e
cmp eax, 0x7f
ja 0x1807ac19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1807ac07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1807ac1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1807ac07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x6d882f00
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x6d8a45e4]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x6d883088
mov rax, qword [0x6d8a45e8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x6d882f4c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x6d882fd5
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x6d882f30
mov rcx, rbx
call sym.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x6d8830bd
mov rax, qword [0x6d8a45e8]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call sym._GetPEImageBase
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x6d8a45e8]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x6d8830a0
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x6d882fce
sub eax, 0x40
and eax, 0xffffffbf
jne 0x6d883030
add dword [0x6d8a45e4], 1
cmp edi, 8
jae 0x6d883003
test dil, 4
jne 0x6d883074
test edi, edi
je 0x6d882ff8
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x6d88308f
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x6d882ff8
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x6d88301c
jmp 0x6d882ff8
add rsi, qword [0x6d8a45e8]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x6d882fce
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x6d882ff8
xor esi, esi
jmp 0x6d882f57
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x6d882ff8
mov rax, qword [0x6d8a45e8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call sym.__report_error
nop
nop dword [rax]

Function at 0x6d883810
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x6d8a48c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x6d8a48a0]
test rbx, rbx
je 0x6d883864
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x6d88385b
test rsi, rsi
je 0x6d88385b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x6d883840
lea rcx, [0x6d8a48c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x6d883aa0
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x6d883ab0
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x6d883ac0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x6d883b01
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x6d883af8
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x6d883b03
add rax, 0x28
cmp rax, r9
jne 0x6d883ae4
xor eax, eax
ret

Function at 0x6d883ba0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6d8a11f0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x6d883c0d
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d883c0d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6d883c0d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6d883c04
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6d883c0f
add rax, 0x28
cmp rax, r9
jne 0x6d883bf0
xor eax, eax
add rsp, 0x28
ret

Function at 0x6d883d10
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6d8a11f0]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
je 0x6d883d30
add rsp, 0x28
ret
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d883d28
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6d883d8d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6d883d84
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6d883d94
add rax, 0x28
cmp rax, r9
jne 0x6d883d70
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret

Function at 0x6d883db0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x6d8a11f0]
cmp word [r11], 0x5a4d
mov r9d, ecx
jne 0x6d883e1e
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d883e1e
movsxd rax, dword [r11 + 0x3c]
add rax, r11
mov edx, dword [rax + 0x90]
test edx, edx
je 0x6d883e1e
movzx ecx, word [rax + 0x14]
lea rcx, [rax + rcx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x6d883e1e
sub eax, 1
lea rax, [rax + rax*4]
lea rax, [rcx + rax*8 + 0x28]
mov r10d, dword [rcx + 0xc]
cmp rdx, r10
mov r8, r10
jb 0x6d883e15
add r8d, dword [rcx + 8]
cmp rdx, r8
jb 0x6d883e25
add rcx, 0x28
cmp rcx, rax
jne 0x6d883e00
xor eax, eax
add rsp, 0x28
ret
add rdx, r11
jne 0x6d883e38
jmp 0x6d883e1e
sub r9d, 1
add rdx, 0x14
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x6d883e46
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x6d883e1e
test r9d, r9d
jg 0x6d883e30
mov eax, dword [rdx + 0xc]
add rax, r11
add rsp, 0x28
ret
Function at 0x6d8841b0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x1410e8a54
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1410e8a5e
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x1410e8a87
pop rbp
sub rbp, 0x33
sub rbp, 0x10e8a54
sub rsp, 0x20
jmp 0x1410e8aa6
mov rax, 0x10e8a54
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0x5cf8635a
xor byte [rax], dl
inc rax
dec rcx
jne 0x1410e8ac5
jmp 0x1410e8adc
adc dl, bl
mov bl, 0xd1
shl dword [rsi + 0x5a], cl
pop rdx
pop rdx
adc bl, bl
wait
push rdx
pop rbx
pop rdx
pop rdx
adc bl, byte [rbx - 0x4d]
adc bl, byte [rbp + 0x5a5a5c9a]
pop rdx
adc bl, byte [rbp + 0x5a5a7298]
pop rdx
adc ch, byte [rbp - 0x64a4ed48]
rcr ebx, 1
push rsi
pop rdx
pop rdx
pop rdx
adc bl, byte [rbx - 0x4e]
or cl, byte [rdx]
adc ah, dl
push rdx
invalid
Function at 0x140002860
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400028aa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400028aa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400028aa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400028aa
cmp dword [rcx + 0x84], 0xe
jbe 0x1400028aa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400028ac
xor al, al
add rsp, 0x28
ret
Function at 0x140834058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1408341df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140834089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14083406f
add dl, dl
jne 0x140834096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408340f6
xor eax, eax
add dl, dl
jne 0x1408340a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408341ad
add dl, dl
jne 0x1408340b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408340c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408340d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408340dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1408340ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14083407e
mov eax, 1
add dl, dl
jne 0x140834106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140834113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1408340fb
sub eax, ebx
mov ebx, 1
jne 0x14083414c
mov ecx, 1
add dl, dl
jne 0x14083412e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14083413b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140834123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14083407e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140834168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140834175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14083415d
cmp eax, 0x7d00
jae 0x14083419b
cmp eax, 0x500
jb 0x140834196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14083407e
cmp eax, 0x7f
ja 0x14083419e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14083407e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1408341d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14083407e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140003de0
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x228
cmp dword [rcx + 4], 0
je 0x140003f23
mov rsi, rcx
xor edi, edi
mov edx, 0x3d
xor r8d, r8d
call fcn.140003f60
test eax, eax
jne 0x140003f25
mov eax, dword [rsi + 4]
dec eax
jo 0x140003f3e
js 0x140003e86
cmp byte [rsi + 0xc], 0
je 0x140003e46
xor ecx, ecx
nop word cs:[rax + rax]
nop
cmp eax, ecx
je 0x140003e86
inc ecx
jo 0x140003f3e
movsxd rdx, ecx
cmp byte [rsi + rdx + 0xc], 0
jne 0x140003e30
lea rcx, [0x140060138]
lea rdx, [0x140060128]
lea r8, [0x140060148]
call fcn.1400047a0
lea rcx, [0x1400601d0]
lea r8, [0x1400601f0]
mov rdx, rax
call fcn.1400047a0
mov rcx, rax
call fcn.140003710
mov rcx, rax
call fcn.140003770
mov rcx, rsi
call fcn.140004c00
mov rdi, rcx
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
lea rdx, [rsp + 0x20]
mov rcx, rdi
mov r8d, 0x100
call sub.KERNEL32.dll_GetEnvironmentVariableW
test eax, eax
je 0x140003f13
mov esi, eax
cmp eax, 0x100
jae 0x140003ec3
lea r8, [rsp + 0x20]
mov ecx, esi
xor edx, edx
jmp 0x140003f09
mov r14d, esi
add r14, r14
mov rcx, r14
call fcn.1400217f0
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, r14
call fcn.140043b80
test esi, esi
js 0x140003f3e
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, rdi
mov rdx, rbx
mov r8d, esi
call sub.KERNEL32.dll_GetEnvironmentVariableW
test eax, eax
je 0x140003f13
cmp eax, esi
jae 0x140003f13
mov ecx, eax
xor edx, edx
mov r8, rbx
call fcn.140005510
mov rdi, rax
jmp 0x140003f25
call sub.KERNEL32.dll_GetLastError
test eax, eax
je 0x140003f35
cmp eax, 0xcb
jne 0x140003f43
xor edi, edi
mov rax, rdi
add rsp, 0x228
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rdi, [0x14005ff68]
jmp 0x140003f25
call fcn.140003510
lea rcx, [0x140060230]
mov edx, eax
call fcn.1400058d0
mov rcx, rax
call fcn.140007460
int3

Function at 0x14000bce0
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x230
lea rsi, [rsp + 0x28]
mov ecx, 0x100
mov rdx, rsi
call sub.KERNEL32.dll_GetCurrentDirectoryW
test eax, eax
je 0x14000bd5b
mov edi, eax
cmp eax, 0x100
jb 0x14000bd3e
mov ebx, edi
add rbx, rbx
mov rcx, rbx
call fcn.1400217f0
mov rsi, rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call fcn.140043b80
test edi, edi
js 0x14000bd56
mov ecx, edi
mov rdx, rsi
call sub.KERNEL32.dll_GetCurrentDirectoryW
test eax, eax
je 0x14000bd5b
cmp eax, edi
jae 0x14000bd5b
mov edi, eax
mov ecx, edi
xor edx, edx
mov r8, rsi
call fcn.140005510
nop
add rsp, 0x230
pop rbx
pop rdi
pop rsi
ret
call fcn.140003510
lea rcx, [0x140060670]
lea rdx, [0x1400606a0]
call fcn.1400084c0
mov rcx, rax
call fcn.14000a260
int3