joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001990
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x58
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
movdqa xmm0, xmmword [rcx]
movdqa xmm10, xmmword [rcx + 0x10]
movdqa xmm9, xmmword [rcx + 0x20]
movdqa xmm8, xmmword [rcx + 0x30]
movdqa xmm1, xmmword [rdx]
pxor xmm1, xmm0
movdqa xmm3, xmmword [rdx + 0x10]
pxor xmm3, xmm0
movdqa xmm4, xmmword [rdx + 0x20]
pxor xmm4, xmm0
movdqa xmm5, xmmword [rdx + 0x30]
pxor xmm5, xmm0
movdqa xmm2, xmmword [rdx + 0x40]
pxor xmm2, xmm0
movdqa xmm6, xmmword [rdx + 0x50]
pxor xmm6, xmm0
movdqa xmm7, xmmword [rdx + 0x60]
pxor xmm7, xmm0
pxor xmm0, xmmword [rdx + 0x70]
aesenc xmm1, xmm10
aesenc xmm3, xmm10
aesenc xmm4, xmm10
aesenc xmm5, xmm10
aesenc xmm2, xmm10
aesenc xmm6, xmm10
aesenc xmm7, xmm10
aesenc xmm0, xmm10
aesenc xmm1, xmm9
aesenc xmm3, xmm9
aesenc xmm4, xmm9
aesenc xmm5, xmm9
aesenc xmm2, xmm9
aesenc xmm6, xmm9
aesenc xmm7, xmm9
aesenc xmm0, xmm9
aesenc xmm1, xmm8
aesenc xmm3, xmm8
aesenc xmm4, xmm8
aesenc xmm5, xmm8
aesenc xmm2, xmm8
aesenc xmm6, xmm8
aesenc xmm7, xmm8
aesenc xmm0, xmm8
movdqa xmm8, xmmword [rcx + 0x40]
aesenc xmm1, xmm8
aesenc xmm3, xmm8
aesenc xmm4, xmm8
aesenc xmm5, xmm8
aesenc xmm2, xmm8
aesenc xmm6, xmm8
aesenc xmm7, xmm8
aesenc xmm0, xmm8
movdqa xmm8, xmmword [rcx + 0x50]
aesenc xmm1, xmm8
aesenc xmm3, xmm8
aesenc xmm4, xmm8
aesenc xmm5, xmm8
aesenc xmm2, xmm8
aesenc xmm6, xmm8
aesenc xmm7, xmm8
aesenc xmm0, xmm8
movdqa xmm8, xmmword [rcx + 0x60]
aesenc xmm1, xmm8
aesenc xmm3, xmm8
aesenc xmm4, xmm8
aesenc xmm5, xmm8
aesenc xmm2, xmm8
aesenc xmm6, xmm8
aesenc xmm7, xmm8
aesenc xmm0, xmm8
movdqa xmm8, xmmword [rcx + 0x70]
aesenc xmm1, xmm8
aesenc xmm3, xmm8
aesenc xmm4, xmm8
aesenc xmm5, xmm8
aesenc xmm2, xmm8
aesenc xmm6, xmm8
aesenc xmm7, xmm8
aesenc xmm0, xmm8
movdqa xmm8, xmmword [rcx + 0x80]
aesenc xmm1, xmm8
aesenc xmm3, xmm8
aesenc xmm4, xmm8
aesenc xmm5, xmm8
aesenc xmm2, xmm8
aesenc xmm6, xmm8
aesenc xmm7, xmm8
aesenc xmm0, xmm8
movdqa xmm8, xmmword [rcx + 0x90]
aesenc xmm1, xmm8
aesenc xmm3, xmm8
aesenc xmm4, xmm8
aesenc xmm5, xmm8
aesenc xmm2, xmm8
aesenc xmm6, xmm8
aesenc xmm7, xmm8
aesenc xmm0, xmm8
movdqa xmm8, xmmword [rcx + 0xa0]
aesenclast xmm1, xmm8
aesenclast xmm3, xmm8
movdqa xmmword [rdx], xmm1
movdqa xmmword [rdx + 0x10], xmm3
aesenclast xmm4, xmm8
movdqa xmmword [rdx + 0x20], xmm4
aesenclast xmm5, xmm8
movdqa xmmword [rdx + 0x30], xmm5
aesenclast xmm2, xmm8
aesenclast xmm6, xmm8
movdqa xmmword [rdx + 0x40], xmm2
movdqa xmmword [rdx + 0x50], xmm6
aesenclast xmm7, xmm8
movdqa xmmword [rdx + 0x60], xmm7
aesenclast xmm0, xmm8
movdqa xmmword [rdx + 0x70], xmm0
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
add rsp, 0x58
ret

Function at 0x140001e10
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aeskeygenassist xmm0, xmmword [rdx], 2
movdqa xmmword [rcx], xmm0
ret
Function at 0x1400083f0
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor edi, edi
xor ebx, ebx
xor r12d, r12d
cmp r8, 0x201
jae 0x140008480
jmp 0x14000846f
jae 0x140008540
cmp r8, 0x201
jae 0x140008480
mov esi, 0x200
lea r13, [rbp - 0x58]
mov r15, r8
jmp 0x1400084d8
sub r8, r12
sub rbx, r12
cmp rbx, r8
jae 0x1400084af
lea rcx, [rbp + 0x3c8]
mov rdx, r12
call fcn.14001e030
mov rax, qword [rbp + 0x3c8]
mov qword [rbp + 0x3e8], rax
mov rdi, qword [rbp + 0x3d0]
mov eax, 0xffffffff
cmp rdi, rax
mov r12d, 0xffffffff
cmovb r12, rdi
mov qword [rbp + 0x3d8], r12
mov rbx, rdi
mov rsi, r12
mov r13, qword [rbp + 0x3e8]
mov r15, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r15d
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x140008501
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400085a8
mov r8d, r14d
cmp r15, r8
jne 0x140008460
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400085cb
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x14000846f
jmp 0x140008480
cmp rsi, r8
jb 0x1400085e5
lea rcx, [rbp + 0x3a8]
mov rdx, r13
call fcn.140009e40
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rdi, rdi
je 0x140008591
add rdi, rdi
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rdi
call fcn.140003380
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi], rax
mov byte [rsi + 0x18], 2
test rdi, rdi
jne 0x140008579
jmp 0x140008591
lea rcx, str.internal_error:_entered_unreachable_code_rustc_cc66ad468955717ab92600c770da8c1601a4ff33library_alloc_src_vecmod.rs
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.14001eac0
jmp 0x1400085fa
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.14001eeb0
ud2
Function at 0x14000ecf0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0xe0]
movups xmm0, xmmword [0x1400224c8]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
test rcx, rcx
je 0x14000ed34
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rdx
test rcx, rcx
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x80]
cmove rdx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x14000ed9a
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x14000edd1
test eax, eax
js 0x14000edab
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x14000edc4
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov byte [rsp + 0x5c], 0
mov dword [rsp + 0x58], 0
mov qword [rsp + 0x20], 0
lea rdx, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
lea rsi, [rsp + 0x78]
lea r9, [rsp + 0x50]
mov r8d, 1
mov rcx, rsi
call fcn.140005ee0
lea rcx, [rsp + 0x58]
mov rdx, rsi
call fcn.140009c40
mov rcx, rax
call fcn.140006310
mov ecx, 7
int 0x29
ud2
Function at 0x14001bed0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x14001bf4a
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x14001bf40
cmp r11, r10
ja 0x14001bfe3
cmp r10, rdx
ja 0x14001bff7
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x14001bf42
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x14001bf20
jmp 0x14001bfb7
ja 0x14001bf4a
mov r11, r10
cmp rax, r8
jne 0x14001bef2
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x14001bfbb
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x14001bf90
mov r8, r10
sub ecx, r9d
jns 0x14001bfae
jmp 0x14001bfbd
cmp r10, rdx
je 0x14001bfc9
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x14001bfbd
xor al, 1
cmp r8, rdx
jne 0x14001bf70
jmp 0x14001bfbd
xor eax, eax
jmp 0x14001bfbd
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, str.called__Option::unwrap____on_a__None__valuelibrarycore_src_nummod.rsfrom_str_radix_int:_must_lie_in_the_range___2__36_____found
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.14001eac0
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.14001ef20
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.14001eeb0
ud2

Function at 0x14001d9f4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001da3e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001da3e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001da3e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001da3e
cmp dword [rcx + 0x84], 0xe
jbe 0x14001da3e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001da40
xor al, al
add rsp, 0x28
ret
Function at 0x140005b48
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140005974

Function at 0x140009934
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x140009911
call fcn.140006be0
mov dword [rax], 0x16
call fcn.140006ac0
or eax, 0xffffffff
jmp 0x14000992e
sub dword [rcx + 0x10], 1
jns 0x140009920
add rsp, 0x28
jmp 0x14000efe4
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x1400098f0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rdi, rcx
test rcx, rcx
jne 0x14000f016
call fcn.140006be0
mov dword [rax], 0x16
call fcn.140006ac0
jmp 0x14000f133
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x14000f133
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x14000f133
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x14000f045
lock or dword [rcx + 0x14], 0x10
jmp 0x14000f133
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x14000f059
call fcn.140011fac
mov rbx, qword [rdi + 8]
mov rcx, rdi
mov qword [rdi], rbx
call fcn.140007a40
mov r8d, dword [rdi + 0x20]
mov ecx, eax
mov rdx, rbx
call fcn.140010db0
mov dword [rdi + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 1
jbe 0x14000f121
mov eax, dword [rdi + 0x14]
or esi, 0xffffffff
test al, 6
jne 0x14000f0ec
mov rcx, rdi
call fcn.140007a40
cmp eax, esi
je 0x14000f0d7
mov rcx, rdi
call fcn.140007a40
cmp eax, 0xfffffffe
je 0x14000f0d7
mov rcx, rdi
call fcn.140007a40
movsxd rbx, eax
lea r14, [0x140020600]
mov rcx, rdi
sar rbx, 6
call fcn.140007a40
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rbx*8]
lea rdx, [rax + rcx*8]
jmp 0x14000f0de
lea rdx, [0x14001f160]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14000f0ec
lock or dword [rdi + 0x14], 0x20
cmp dword [rdi + 0x20], 0x200
jne 0x14000f110
mov eax, dword [rdi + 0x14]
shr eax, 6
test al, 1
je 0x14000f110
mov eax, dword [rdi + 0x14]
shr eax, 8
test al, 1
jne 0x14000f110
mov dword [rdi + 0x20], 0x1000
mov rax, qword [rdi]
add dword [rdi + 0x10], esi
movzx esi, byte [rax]
inc rax
mov qword [rdi], rax
jmp 0x14000f136
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rdi + 0x14], eax
and dword [rdi + 0x10], 0
or esi, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov eax, esi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x6d8b3e70
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x6d8d55e4]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x6d8b3ff8
mov rax, qword [0x6d8d55e8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x6d8b3ebc
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x6d8b3f45
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x6d8b3ea0
mov rcx, rbx
call sym.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x6d8b402d
mov rax, qword [0x6d8d55e8]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call sym._GetPEImageBase
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x6d8d55e8]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x6d8b4010
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x6d8b3f3e
sub eax, 0x40
and eax, 0xffffffbf
jne 0x6d8b3fa0
add dword [0x6d8d55e4], 1
cmp edi, 8
jae 0x6d8b3f73
test dil, 4
jne 0x6d8b3fe4
test edi, edi
je 0x6d8b3f68
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x6d8b3fff
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x6d8b3f68
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x6d8b3f8c
jmp 0x6d8b3f68
add rsi, qword [0x6d8d55e8]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x6d8b3f3e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x6d8b3f68
xor esi, esi
jmp 0x6d8b3ec7
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x6d8b3f68
mov rax, qword [0x6d8d55e8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call sym.__report_error
nop
nop dword [rax]

Function at 0x6d8b4780
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x6d8d58c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x6d8d58a0]
test rbx, rbx
je 0x6d8b47d4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x6d8b47cb
test rsi, rsi
je 0x6d8b47cb
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x6d8b47b0
lea rcx, [0x6d8d58c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x6d8b4a10
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x6d8b4a20
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x6d8b4a30
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x6d8b4a71
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x6d8b4a68
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x6d8b4a73
add rax, 0x28
cmp rax, r9
jne 0x6d8b4a54
xor eax, eax
ret

Function at 0x6d8b4b10
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6d8d21f0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x6d8b4b7d
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d8b4b7d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6d8b4b7d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6d8b4b74
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6d8b4b7f
add rax, 0x28
cmp rax, r9
jne 0x6d8b4b60
xor eax, eax
add rsp, 0x28
ret

Function at 0x6d8b4c80
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6d8d21f0]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
je 0x6d8b4ca0
add rsp, 0x28
ret
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d8b4c98
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6d8b4cfd
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6d8b4cf4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6d8b4d04
add rax, 0x28
cmp rax, r9
jne 0x6d8b4ce0
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret

Function at 0x6d8b4d20
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x6d8d21f0]
cmp word [r11], 0x5a4d
mov r9d, ecx
jne 0x6d8b4d8e
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d8b4d8e
movsxd rax, dword [r11 + 0x3c]
add rax, r11
mov edx, dword [rax + 0x90]
test edx, edx
je 0x6d8b4d8e
movzx ecx, word [rax + 0x14]
lea rcx, [rax + rcx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x6d8b4d8e
sub eax, 1
lea rax, [rax + rax*4]
lea rax, [rcx + rax*8 + 0x28]
mov r10d, dword [rcx + 0xc]
cmp rdx, r10
mov r8, r10
jb 0x6d8b4d85
add r8d, dword [rcx + 8]
cmp rdx, r8
jb 0x6d8b4d95
add rcx, 0x28
cmp rcx, rax
jne 0x6d8b4d70
xor eax, eax
add rsp, 0x28
ret
add rdx, r11
jne 0x6d8b4da8
jmp 0x6d8b4d8e
sub r9d, 1
add rdx, 0x14
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x6d8b4db6
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x6d8b4d8e
test r9d, r9d
jg 0x6d8b4da0
mov eax, dword [rdx + 0xc]
add rax, r11
add rsp, 0x28
ret
Function at 0x6d8b5120
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x140003040
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140003064
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
mov rax, qword [rcx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x1400030a7
mov rdx, qword [rbx + 0x58]
movsxd r8, dword [rdx]
lea rax, [rcx + r8]
cmp rcx, rax
jae 0x1400030a7
lea eax, [r8 - 1]
mov dword [rdx], eax
mov rcx, qword [rbx + 0x40]
mov rdx, qword [rcx]
lea rax, [rdx + 1]
mov qword [rcx], rax
mov eax, edi
mov byte [rdx], dil
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0x80], rsi
je 0x1400031d8
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400030ea
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140003115
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400031dd
lea rax, [rsp + 0x90]
mov byte [rsp + 0x40], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14000318a
sub eax, 1
je 0x14000318a
cmp eax, 2
jne 0x1400031d8
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400031dd
mov rsi, qword [rsp + 0x90]
lea rax, [rsp + 0x48]
sub rsi, rax
je 0x1400031bb
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x48]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1400031d8
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x98], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x1400031dd
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
Function at 0x1400035c0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140003689
cmp byte [rcx + 0x71], 0
je 0x140003689
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x68], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000367c
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140003638
sub eax, 1
je 0x14000363c
cmp eax, 2
jne 0x14000367c
mov rdi, qword [rsp + 0x68]
mov al, 1
mov byte [rbx + 0x71], 0
add rsp, 0x50
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x14000366a
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000367c
cmp byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x68]
sete al
add rsp, 0x50
pop rbx
ret
mov rdi, qword [rsp + 0x68]
xor al, al
add rsp, 0x50
pop rbx
ret
mov al, 1
add rsp, 0x50
pop rbx
ret

Function at 0x140004210
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000425a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000425a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000425a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000425a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000425a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000425c
xor al, al
add rsp, 0x28
ret