joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1031f74
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x50
mov ebx, r8d
mov r12, rdx
mov r13, rcx
call fcn.0102bc18
xor ebp, ebp
and dword [rsp + 0x88], ebp
and dword [rsp + 0x30], ebp
mov rdi, rax
cmp qword [0x010449e0], rbp
jne 0x10320ac
lea rcx, [0x01001e48]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
test rax, rax
jne 0x1031fd8
xor eax, eax
jmp 0x103218c
lea rdx, [0x01001e38]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1031fd1
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x01001e28]
mov rcx, rsi
mov qword [0x010449e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x01001e10]
mov rcx, rsi
mov qword [0x010449e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rcx, [rsp + 0x88]
mov qword [0x010449f0], rax
call fcn.0102ac20
test eax, eax
je 0x103205f
and qword [rsp + 0x20], rbp
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.0102c778
cmp dword [rsp + 0x88], 2
jne 0x10320ac
lea rdx, [0x01001df0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x01044a00], rax
test rax, rax
je 0x10320ac
lea rdx, [0x01001dd8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x010449f8], rax
mov rcx, qword [0x010449f8]
cmp rcx, rdi
je 0x103213e
cmp qword [0x01044a00], rdi
je 0x103213e
call sub.KERNEL32.dll_DecodePointer
call rax
mov rsi, rax
test rax, rax
je 0x1032109
mov rcx, qword [0x01044a00]
call sub.KERNEL32.dll_DecodePointer
lea rcx, [rsp + 0x34]
mov r9d, 0xc
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
lea r8, [rsp + 0x38]
mov rcx, rsi
call rax
test eax, eax
je 0x1032109
test byte [rsp + 0x40], 1
jne 0x103213e
lea rcx, [rsp + 0x30]
call fcn.0102ac6c
test eax, eax
je 0x103212b
and qword [rsp + 0x20], rbp
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.0102c778
cmp dword [rsp + 0x30], 4
jb 0x1032138
bts ebx, 0x15
jmp 0x1032172
bts ebx, 0x12
jmp 0x1032172
mov rcx, qword [0x010449e8]
cmp rcx, rdi
je 0x1032172
call sub.KERNEL32.dll_DecodePointer
call rax
mov rbp, rax
test rax, rax
je 0x1032172
mov rcx, qword [0x010449f0]
cmp rcx, rdi
je 0x1032172
call sub.KERNEL32.dll_DecodePointer
mov rcx, rbp
call rax
mov rbp, rax
mov rcx, qword [0x010449e0]
call sub.KERNEL32.dll_DecodePointer
mov r9d, ebx
mov r8, r12
mov rdx, r13
mov rcx, rbp
call rax
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x1033474
Capabilities:
Get system information on windows

Disassembly:
push rbp
push r12
push r13
sub rsp, 0x90
lea rbp, [rsp + 0x20]
mov qword [rbp + 0x90], rbx
mov qword [rbp + 0x98], rsi
mov qword [rbp + 0xa0], rdi
mov rax, qword [0x01042480]
xor rax, rbp
mov qword [rbp + 0x68], rax
mov eax, dword [rsp]
sub rsp, 0x10
lea r12, [rsp + 0x20]
mov eax, dword [r12]
lea rdx, [rbp + 8]
mov r8d, 0x30
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x103357a
mov r13, qword [rbp + 0x10]
lea rcx, [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [rbp + 0x3c]
lea rcx, [rbp]
xor ebx, ebx
and dword [rbp], ebx
call qword [sym.imp.KERNEL32.dll_SetThreadStackGuarantee]
cmp eax, 1
jne 0x1033502
mov eax, dword [rbp]
test eax, eax
cmovne ebx, eax
lea edx, [rdi - 1]
lea ecx, [rdx + rbx]
cmp ecx, ebx
jb 0x103357a
mov eax, edx
not eax
and ecx, eax
je 0x103351d
lea eax, [rcx + rdi]
cmp eax, ecx
jb 0x103357a
mov ecx, eax
lea eax, [rdi + rdi*2]
mov ebx, edx
cmp ecx, eax
not rbx
cmovb ecx, eax
and rbx, r12
lea rax, [r13 + rdi]
mov esi, ecx
sub rbx, rsi
cmp rbx, rax
jb 0x103357a
mov r9d, 4
mov r8d, 0x1000
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x103357a
lea r9, [rbp + 4]
mov r8d, 0x104
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x103357a
mov eax, 1
jmp 0x103357c
xor eax, eax
mov rcx, qword [rbp + 0x68]
xor rcx, rbp
call fcn.01026f20
mov rbx, qword [rbp + 0x90]
mov rsi, qword [rbp + 0x98]
mov rdi, qword [rbp + 0xa0]
lea rsp, [rbp + 0x70]
pop r13
pop r12
pop rbp
ret
Function at 0x140003a80
Capabilities:
Create thread
Inject thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0xa0
mov rax, qword [0x14000b008]
xor rax, rsp
mov qword [rsp + 0x90], rax
cmp qword [rdx + 0x18], 8
mov rbx, rdx
mov r14, rcx
mov rdi, rdx
jb 0x140003ab8
mov rdi, qword [rdx]
xor ebp, ebp
mov qword [rsp + 0x58], rbp
xor sil, sil
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x58]
mov r15d, 1
mov qword [rsp + 0x38], rax
lea r8d, [rbp + 4]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov edx, r15d
mov qword [rsp + 0x20], rbp
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_GetNamedSecurityInfoW]
test eax, eax
jne 0x140003bb5
lea rdx, [rsp + 0x48]
lea rcx, str.S_1_15_2_1
call qword [sym.imp.ADVAPI32.dll_ConvertStringSidToSidW]
test eax, eax
je 0x140003bb5
mov rax, qword [rsp + 0x48]
lea r9, [rsp + 0x40]
mov r8, qword [rsp + 0x50]
lea rdx, [rsp + 0x60]
xorps xmm0, xmm0
mov qword [rsp + 0x88], rax
mov ecx, r15d
mov qword [rsp + 0x80], 5
movdqu xmmword [rsp + 0x6c], xmm0
mov dword [rsp + 0x60], 0xe0000000
mov dword [rsp + 0x64], 2
mov dword [rsp + 0x68], 3
mov dword [rsp + 0x7c], ebp
call qword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
test eax, eax
jne 0x140003bb5
mov rax, qword [rsp + 0x40]
lea r8d, [rbp + 4]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov edx, r15d
mov rcx, rdi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
test eax, eax
movzx esi, sil
cmove esi, r15d
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140003bc5
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140003bd5
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140003be5
call qword [sym.imp.KERNEL32.dll_LocalFree]
test sil, sil
je 0x140003c8f
mov rdi, qword [rbx + 0x18]
mov r9d, 0x1000
mov rcx, qword [r14]
add rdi, rdi
mov r8, rdi
mov dword [rsp + 0x20], 4
xor edx, edx
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rsi, rax
test rax, rax
je 0x140003c8f
cmp qword [rbx + 0x18], 8
jb 0x140003c23
mov rbx, qword [rbx]
mov rcx, qword [r14]
mov r9, rdi
mov r8, rbx
mov qword [rsp + 0x20], rbp
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140003c8f
mov r9, qword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor r8d, r8d
mov rcx, qword [r14]
xor edx, edx
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
je 0x140003c8f
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [r14]
mov r9d, 0x2000
mov r8, rdi
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
movzx eax, r15b
jmp 0x140003c91
xor al, al
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140005f90
mov rbx, qword [rsp + 0xe0]
add rsp, 0xa0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140003cc0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, 5
nop dword [rax + rax]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov edx, ebx
lea rcx, str._i_Seconds_Until_Loader_Closes.
call fcn.140001010
lea r8, [0x140008593]
mov edx, 0x28
lea rcx, str._s_r
call fcn.140001010
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
test ebx, ebx
je 0x140003d3d
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
sub ebx, 1
jns 0x140003cd0
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, 0x3e8
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_Sleep]
Function at 0x1400010e0
Capabilities:
Execute command
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x30], rax
xor edx, edx
lea rcx, str.LWJGL
call qword [sym.imp.USER32.dll_FindWindowA]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov rbx, rax
test rax, rax
jne 0x14000112f
lea rdx, str.____Minecraft_nie_zosta__znaleziony_
call fcn.140001320
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140001301
lea rdx, str.___Minecraft_zosta__znaleziony__n
call fcn.140001320
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140001730
nop dword [rax + rax]
mov ecx, 0x26
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
jne 0x1400012ef
mov ecx, 0x73
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140001180
cmp byte [0x140005080], 0
sete byte [0x140005080]
mov ecx, 0x2d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140001203
cmp dword [0x140005078], 1
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
jne 0x1400011c6
mov dword [0x140005078], 4
lea rdx, str.___Aktualny_tryb_klikania:_12_13_n
mov dword [0x140005074], 0x14
mov dword [0x14000507c], 0x19
jmp 0x1400011eb
mov dword [0x140005078], 1
lea rdx, str.___Aktualny_tryb_klikania:_14_15_n
mov dword [0x140005074], 0xf
mov dword [0x14000507c], 0x16
call fcn.140001320
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], 0xc8
call fcn.1400014f0
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
cmp byte [0x140005080], 0
je 0x1400012d7
test al, al
jne 0x1400012d7
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140001150
lea rcx, [rsp + 0x28]
call qword [sym.imp.USER32.dll_GetCursorPos]
movsxd rax, dword [0x140005078]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
call fcn.1400014f0
movzx r9d, word [rsp + 0x2c]
mov edx, 0x201
movzx eax, word [rsp + 0x28]
mov r8d, 1
shl r9d, 0x10
mov rcx, rbx
or r9, rax
call qword [sym.imp.USER32.dll_SendMessageW]
movsxd rax, dword [0x140005074]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
call fcn.1400014f0
movzx r9d, word [rsp + 0x2c]
xor r8d, r8d
movzx eax, word [rsp + 0x28]
mov edx, 0x202
shl r9d, 0x10
mov rcx, rbx
or r9, rax
call qword [sym.imp.USER32.dll_SendMessageW]
movsxd rax, dword [0x14000507c]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
call fcn.1400014f0
jmp 0x140001150
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], 0x64
call fcn.1400014f0
jmp 0x140001150
lea rcx, [0x1400033b4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call main
xor eax, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140001990
add rsp, 0x40
pop rbx
ret
Function at 0x140002258
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400022a2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400022a2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400022a2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400022a2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400022a2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400022a4
xor al, al
add rsp, 0x28
ret
Function at 0x40107d
Capabilities:
Terminate process

Disassembly:
call section..text
mov rax, rsp
shr rax, 4
jae 0x40108d
push 0
sub rsp, 0x80
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.DLL_ExitProcess]

Function at 0x4010c9
Capabilities:
Create thread

Disassembly:
call section..text
push 0
mov rbx, rsp
mov rax, rsp
shr rax, 4
jae 0x4010de
push 0
sub rsp, 0x80
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], 0
mov r9, qword [rbp + 0x18]
mov r8, qword [rbp + 0x10]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rax, qword [rbx]
call fcn.00401018
ret 0x10

Function at 0x4011bb
Capabilities:
Allocate or change rwx memory

Disassembly:
call section..text
mov rax, rsp
shr rax, 4
jae 0x4011cb
push 0
sub rsp, 0x80
mov rax, qword [rbp + 0x10]
mov r9, 0x40
mov r8, 0x1000
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_VirtualAlloc]
call fcn.00401018
ret 8

Function at 0x4052f6
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
call fcn.00401037
mov rdi, rax
xor ecx, ecx
dec rcx
xor eax, eax
repne scasb al, byte [rdi]
add rcx, 2
jb 0x405340
mov ax, word [rdi - 3]
push 0
push fcn.0040107d
cmp ax, 0x692d
je 0x4066db
cmp ax, 0x752d
je 0x4068b0
cmp ax, 0x732d
je 0x4068b8
add rsp, 0x10
cmp ax, 0x622d
je 0x405349
call fcn.00406afd
test eax, eax
jne 0x40534f
call fcn.00405356
ret
push 0
call fcn.0040107d
call section..text
sub rsp, 0x120
mov rbx, rsp
mov rax, rsp
shr rax, 4
jae 0x4066f5
push 0
sub rsp, 0x80
call fcn.0040680f
inc rbx
mov r8, 0x104
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
dec rbx
mov rdi, rbx
mov byte [rdi], 0x22
add rdi, 0x104
xor ecx, ecx
dec rcx
xor eax, eax
std
repe scasb al, byte [rdi]
cld
mov byte [rdi + 2], 0x22
mov r8, 2
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.DLL_OpenSCManagerA]
test rax, rax
je 0x406809
mov rsi, rax
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0x406653
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 2
mov qword [rsp + 0x20], 0x10
mov r9, 0xf003f
mov r8, 0x40661f
mov rdx, 0x40661f
mov rcx, rsi
call qword [sym.imp.ADVAPI32.DLL_CreateServiceA]
test rax, rax
je 0x406800
mov rbx, rax
mov r8, 0x40668b
mov rdx, 1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.DLL_ChangeServiceConfig2A]
mov r8, 0x4066ab
mov rdx, 2
mov rcx, rbx
call qword [sym.imp.ADVAPI32.DLL_ChangeServiceConfig2A]
xor eax, eax
inc eax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.DLL_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.DLL_CloseServiceHandle]
call fcn.00401018
ret
push 1
call fcn.004068c0
ret
push 0
call fcn.004068c0
ret
Function at 0x4068c0
Capabilities:
Delete service
Stop service

Disassembly:
call section..text
mov rax, rsp
shr rax, 4
jae 0x4068d0
push 0
sub rsp, 0x80
mov r8, 0x10020
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.DLL_OpenSCManagerA]
test rax, rax
je 0x406964
mov rsi, rax
mov r8, 0x10020
mov rdx, 0x40661f
mov rcx, rax
call qword [sym.imp.ADVAPI32.DLL_OpenServiceA]
test rax, rax
je 0x406957
mov rbx, rax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov rcx, rsp
sub rsp, 0x28
mov r8, rcx
mov rdx, 1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.DLL_ControlService]
test qword [rbp + 0x10], 1
je 0x40694a
mov rcx, rbx
call qword [sym.imp.ADVAPI32.DLL_DeleteService]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.DLL_CloseServiceHandle]
xor eax, eax
inc eax
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.DLL_CloseServiceHandle]
mov eax, ebx
call fcn.00401018
ret 8
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x14005bd40]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x14005bd50]
mov dword [rax], 1
mov rax, qword [0x14005bd60]
mov dword [rax], 1
mov rax, qword [0x14005bce0]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x14005bd30]
mov dword [0x140063020], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x14005be10]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x14005bdf0]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x14005bc90]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a
Function at 0x140046cd0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140046ce8
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x140046cf0
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140046d00
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
mov r8, rdx
lea rdx, [rax + rcx]
movzx eax, word [rdx + 0x14]
lea rax, [rdx + rax + 0x18]
movzx edx, word [rdx + 6]
test edx, edx
je 0x140046d4c
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov ecx, dword [rax + 0xc]
mov rdx, rcx
cmp rcx, r8
ja 0x140046d43
add edx, dword [rax + 8]
cmp rdx, r8
ja 0x140046d4e
add rax, 0x28
cmp rax, r9
jne 0x140046d30
xor eax, eax
ret

Function at 0x140046d50
Capabilities:
Parse pe header

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
call sym.strlen
cmp rax, 8
ja 0x140046de0
mov rdx, qword [0x14005bce0]
xor r12d, r12d
cmp word [rdx], 0x5a4d
jne 0x140046dce
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x140046dce
cmp word [rax + 0x18], 0x20b
jne 0x140046dce
movzx edx, word [rax + 0x14]
lea r12, [rax + rdx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x140046de0
sub eax, 1
lea rax, [rax + rax*4]
lea rsi, [r12 + rax*8 + 0x28]
jmp 0x140046db9
add r12, 0x28
cmp r12, rsi
je 0x140046de0
mov r8d, 8
mov rdx, rbx
mov rcx, r12
call sym.strncmp
test eax, eax
jne 0x140046db0
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret
xor r12d, r12d
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret

Function at 0x140046df0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14005bce0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140046e10
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140046e18
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140046e10
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x140046e65
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140046e5c
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140046e10
add rax, 0x28
cmp rax, r9
jne 0x140046e48
xor eax, eax
ret

Function at 0x140046e70
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14005bce0]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x140046e90
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140046e98
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x140046e90
movzx r8d, word [rax + 6]
mov eax, r8d
ret
Function at 0x140046eb0
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x14005bce0]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x140046ed0
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x140046ed8
ret
cmp word [rdx + 0x18], 0x20b
jne 0x140046ed0
movzx eax, word [rdx + 0x14]
lea rax, [rdx + rax + 0x18]
movzx edx, word [rdx + 6]
test edx, edx
je 0x140046f18
sub edx, 1
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x140046f0f
test rcx, rcx
je 0x140046ed0
sub rcx, 1
add rax, 0x28
cmp rax, rdx
jne 0x140046f00
xor eax, eax
ret

Function at 0x140046f20
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14005bce0]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x140046f40
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x140046f48
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret

Function at 0x140046f60
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rax, qword [0x14005bce0]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x140046f80
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x140046f88
mov eax, r8d
ret
cmp word [rdx + 0x18], 0x20b
jne 0x140046f80
sub rcx, rax
movzx eax, word [rdx + 0x14]
lea rax, [rdx + rax + 0x18]
movzx edx, word [rdx + 6]
test edx, edx
je 0x140046f80
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140046fc4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140046fd8
add rax, 0x28
cmp r9, rax
jne 0x140046fb0
xor r8d, r8d
mov eax, r8d
ret
mov r8d, dword [rax + 0x24]
not r8d
shr r8d, 0x1f
mov eax, r8d
ret

Function at 0x140046ff0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x14005bce0]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x140047012
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x140047020
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140047012
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x140047012
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
movzx r8d, word [r8 + 6]
test r8d, r8d
je 0x140047012
sub r8d, 1
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop dword [rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x14004706d
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x140047080
add rdx, 0x28
cmp r10, rdx
jne 0x140047058
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x14004708f
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x14004709f
mov edx, dword [rax + 0xc]
test edx, edx
je 0x140047076
test ecx, ecx
jg 0x140047088
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret