joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d75a0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push rbx
push rdi
nop
mov qword [rsp - 8], r13
sub rsp, 8
sub rsp, 0x30
xor ebx, ebx
mov r13d, r8d
xchg rdi, r10
mov r10, rdx
xchg rdi, r10
test rdx, rdx
jne 0x1400d75cf
mov eax, ebx
jmp 0x1400d75f6
mov eax, 0x5a4d
cmp word [rdx], ax
je 0x1400d75e5
mov rax, rbx
jmp 0x1400d75f6
movsxd rax, dword [rdx + 0x3c]
add rax, rdi
cmp dword [rax], 0x4550
cmovne rax, rbx
mov qword [rsp + 0x50], rbp
mov ecx, 0x20b
mov qword [rsp + 0x58], rsi
xchg r8, r12
mov qword [rsp + 0x60], r8
xchg r8, r12
mov qword [rsp + 0x28], r14
xchg r15, r10
mov qword [rsp + 0x20], r10
xchg r10, r15
cmp word [rax + 0x18], cx
jne 0x1400d7694
mov esi, dword [rax + 0x88]
add rsi, rdi
je 0x1400d7694
mov r14d, dword [rsi + 0x1c]
mov r15d, dword [rsi + 0x24]
add r14, rdi
mov r12d, dword [rsi + 0x20]
add r15, rdi
add r12, rdi
cmp dword [rsi + 0x18], 0
jbe 0x1400d7694
nop dword [rax]
nop dword [rax + rax]
mov eax, ebx
xor edx, edx
mov ecx, dword [r12 + rax*4]
movzx eax, word [r15 + rax*2]
add rcx, rdi
mov ebp, dword [r14 + rax*4]
add rbp, rdi
call fcn.14005d520
cmp eax, r13d
je 0x1400d76e6
inc ebx
cmp ebx, dword [rsi + 0x18]
jb 0x1400d7664
xor eax, eax
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
xchg r12, r8
mov r8, qword [rsp + 0x60]
xchg r12, r8
xchg r9, rsi
mov r9, qword [rsp + 0x58]
xchg r9, rsi
xchg r10, rbp
mov r10, qword [rsp + 0x50]
xchg r10, rbp
add rsp, 0x30
push rdx
push rax
push rcx
push rdx
xchg qword [rsp + 0x20], r13
add rsp, 0x28
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
xchg qword [rsp - 8], rbx
ret
mov rax, rbp
jmp 0x1400d7696
Function at 0x1400d9320
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xchg rbp, rbx
mov qword [rsp + 0x10], rbp
xchg rbp, rbx
mov qword [rsp + 8], rcx
nop
push 0x5e8eb16f
jmp 0x1400d93f0
xor r15b, r15b
xor r14b, r14b
xchg r8, rax
mov r8, rax
jmp 0x1400d93e1
sub rsp, 8
mov qword [rsp], rdi
nop
sub rsp, 8
mov qword [rsp], r12
nop
sub rsp, 8
jmp 0x1400d938a
mov qword [rsp], r13
push r14
nop
sub rsp, 8
mov qword [rsp], r15
jmp 0x1400d939e
lea rbp, [rsp - 0xfd0]
mov eax, 0x10d0
call fcn.140154370
sub rsp, rax
jmp 0x1400d935f
xchg r8, rax
xor edi, edi
mov rsi, r8
mov qword [rsp], rbp
nop
mov qword [rsp - 8], rsi
sub rsp, 8
nop
jmp 0x1400d936f
Function at 0x1400dd380
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r11, rdx
xchg r10, r12
mov r12, rcx
xchg r12, r10
test rdx, rdx
je 0x1400dd3f2
mov qword [rsp], rbx
movzx ebx, byte [rsp + 0x30]
test r9, r9
je 0x1400dd3e5
movzx eax, byte [r10]
test bl, bl
je 0x1400dd3c7
lea rcx, [r9 - 1]
mov rdx, r9
add rcx, r8
nop
xor al, byte [rcx]
lea rcx, [rcx - 1]
mov byte [r10], al
sub rdx, 1
jne 0x1400dd3b6
jmp 0x1400dd3e5
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
xor al, byte [rcx + r8]
inc rcx
mov byte [r10], al
cmp rcx, r9
jb 0x1400dd3d6
inc r10
sub r11, 1
jne 0x1400dd39e
mov rbx, qword [rsp]
add rsp, 8
ret

Function at 0x1400df900
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xchg rdx, rbx
mov qword [rsp + 8], rdx
xchg rbx, rdx
xchg rsi, rdx
mov qword [rsp + 0x10], rdx
xchg rdx, rsi
mov qword [rsp + 0x18], rdi
nop
mov qword [rsp - 8], rbp
sub rsp, 8
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
xchg rdi, rcx
mov rcx, r8
xchg rcx, rdi
mov rbx, rdx
mov rsi, rcx
test r8, r8
je 0x1400dfaae
nop
mov dword [rbp - 0x29], 0xf6f6f6f6
mov dword [rbp + 0x16], 0x3d3c3b3a
mov dword [rbp - 0x25], 0xf6f6f6f6
mov dword [rbp + 0x1a], 0x41403f3e
mov dword [rbp - 0x21], 0xf6f6f6f6
mov dword [rbp + 0x1e], 0x4c4b4342
mov dword [rbp - 0x1d], 0xf6f6f6f6
mov dword [rbp + 0x22], 0x504f4e4d
mov dword [rbp - 0x19], 0xf6f6f6f6
mov dword [rbp + 0x26], 0x54535251
mov dword [rbp - 0x15], 0xf6f6f6f6
mov dword [rbp + 0x2a], 0x58575655
mov dword [rbp - 0x11], 0xf6f6f6f6
mov dword [rbp + 0x2e], 0x5c5b5a59
mov dword [rbp - 0xd], 0xf6f6f6f6
mov dword [rbp + 0x32], 0x605f5e5d
mov dword [rbp - 9], 0xf6f6f6f6
mov dword [rbp + 0x36], 0x64636261
mov dword [rbp - 5], 0xf6f6f6f6
mov dword [rbp + 0x3a], 0x6e6d6c6b
mov dword [rbp - 1], 0xf6f6f6f6
mov dword [rbp + 0x3e], 0x7271706f
mov dword [rbp + 3], 0xf6f6f6f6
mov dword [rbp + 0x42], 0x76757473
mov dword [rbp + 7], 0xf6f6f6f6
mov dword [rbp + 0x46], 0x7a797877
mov dword [rbp + 0xb], 0xf6f6f6f6
mov dword [rbp + 0x4a], 0x7e7d7c7b
mov dword [rbp + 0xf], 0xf6f6f6f6
mov dword [rbp + 0x4e], 0x8281807f
mov word [rbp + 0x13], 0xf6f6
mov word [rbp + 0x52], 0x8483
xor eax, eax
mov byte [rbp + 0x54], al
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rbp + rax + 0x16]
movzx edx, byte [rbp + rax - 0x29]
add dl, cl
mov byte [rbp + rax + 0x16], dl
mov byte [rbp + rax - 0x29], 0
inc rax
cmp rax, 0x3e
jb 0x1400dfa3b
mov edx, 0x3e
xor ecx, ecx
call fcn.1400e0180
movsxd rcx, eax
movzx edx, byte [rbp + rcx + 0x16]
xor eax, eax
nop dword [rax]
nop dword [rax + rax]
mov byte [rbp + rax + 0x16], 0
inc rax
cmp rax, 0x3e
jb 0x1400dfa7f
mov byte [rbx], dl
inc rbx
sub rdi, 1
jne 0x1400df94b
xchg rbx, r15
mov qword [rsi], r15
xchg r15, rbx
jmp 0x1400dfab1
mov qword [rcx], rdx
xchg r15, rax
mov r15, rsi
xchg r15, rax
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
nop
add rsp, 8
xchg qword [rsp - 8], rbp
ret
Function at 0x1400e0180
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
xchg r12, rbp
mov qword [rsp + 0x10], r12
xchg rbp, r12
xchg rsi, r13
mov qword [rsp + 0x20], r13
xchg r13, rsi
nop
sub rsp, 8
mov qword [rsp], rdi
mov eax, 0x13b0
call fcn.140154370
sub rsp, rax
mov ebx, edx
mov edi, ecx
call fcn.140154e8e
mov dword [rsp + 0x24], eax
mov r9d, 1
mov dword [rsp + 0x13a4], 0xffffffff
nop dword [rax + rax]
mov r8d, eax
shr r8d, 0xf
shr r8d, 0xb
shr r8d, 3
shr r8d, 1
xor r8d, eax
imul eax, r8d, 0x6c078965
add eax, r9d
mov dword [rsp + r9*4 + 0x24], eax
inc r9
cmp r9, 0x270
jb 0x1400e01d4
mov ebp, 0x80000000
mov dword [rsp + 0x20], 0x270
cmp edi, ebp
lea rax, [rsp + 0x20]
xchg r13, rax
mov qword [rsp + 0x13d0], r13
xchg r13, rax
lea rcx, [rsp + 0x13d0]
lea eax, [rdi - 0x80000000]
lea esi, [rdi + rbp]
cmovae esi, eax
lea edi, [rbx + rbp]
cmp ebx, ebp
lea eax, [rbx - 0x80000000]
cmovae edi, eax
sub edi, esi
cmp edi, 0xffffffff
jne 0x1400e0261
call fcn.1400e0430
mov ecx, eax
jmp 0x1400e02c6
inc edi
mov ebx, edi
call fcn.1400e0430
mov ecx, eax
imul rcx, rbx
cmp ecx, edi
jae 0x1400e02b1
mov eax, edi
xor edx, edx
neg eax
div edi
mov edi, edx
cmp ecx, edx
jae 0x1400e02b1
nop dword [rax]
nop dword [rax + rax]
lea rcx, [rsp + 0x13d0]
call fcn.1400e0430
mov ecx, eax
imul rcx, rbx
cmp ecx, edi
jb 0x1400e0296
shr rcx, 0x19
shr rcx, 1
shr rcx, 2
shr rcx, 2
shr rcx, 1
shr rcx, 1
lea edx, [rsi + rcx]
lea r11, [rsp + 0x13b0]
cmp edx, ebp
mov rbx, qword [r11 + 0x10]
lea eax, [rdx + rbp]
xchg rdx, rbp
mov rdx, qword [r11 + 0x18]
xchg rbp, rdx
lea ecx, [rdx - 0x80000000]
xchg rbp, rsi
mov rbp, qword [r11 + 0x28]
xchg rsi, rbp
cmovae eax, ecx
mov rsp, r11
push rcx
push rbx
xchg qword [rsp + 0x10], rdi
add rsp, 0x18
ret
Function at 0x1400e0430
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, qword [rcx]
mov r10d, 0x270
mov ecx, dword [r9]
cmp ecx, r10d
jne 0x1400e0499
lea r8, [r9 + 8]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x1400e0454
mov ecx, dword [r9]
jmp 0x1400e0594
cmp ecx, 0x4e0
jb 0x1400e0594
lea r10, [r9 + 0x9c4]
xchg rbx, rbp
mov qword [rsp], rbp
xchg rbx, rbp
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x1400e04be
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x1400e0512
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
xchg rbx, r15
mov r15, qword [rsp]
xchg r15, rbx
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xa
shl eax, 1
shl eax, 2
shl eax, 1
shl eax, 1
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x1400ed970
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rdx
mov qword [rsp + 0x10], rbx
xchg rbx, rdx
mov qword [rsp + 8], rcx
nop
sub rsp, 8
mov qword [rsp], rbp
nop
sub rsp, 8
mov qword [rsp], rbx
nop
sub rsp, 8
mov qword [rsp], rsi
push rdi
push r12
nop
mov qword [rsp - 8], r13
sub rsp, 8
push r14
push r15
lea rbp, [rsp - 0x17]
sub rsp, 0xf8
movzx r12d, r8b
mov r14d, r8d
and r12b, 0xf
xchg rdx, r10
mov r11, r10
xchg r10, rdx
mov r15d, 0x10
mov byte [rbp + 0x6f], r12b
sub r11, rcx
xchg rbx, r12
mov r12, rdx
xchg r12, rbx
xchg r11, rsi
mov r11, rcx
xchg r11, rsi
mov r10d, r15d
nop word [rax + rax]
movzx eax, byte [r11 + rcx]
mov byte [rcx], al
lea rcx, [rcx + 1]
sub r10, 1
jne 0x1400ed9f8
lea r13, [0x140000000]
test r9, r9
je 0x1400edb98
movzx eax, byte [r9]
mov r10d, 4
mov byte [rsp + 0x40], al
movzx eax, byte [r9 + 1]
mov byte [rsp + 0x41], al
movzx eax, byte [r9 + 2]
mov byte [rsp + 0x42], al
movzx eax, byte [r9 + 3]
mov byte [rsp + 0x43], al
movzx eax, byte [r9 + 4]
mov byte [rsp + 0x44], al
movzx eax, byte [r9 + 5]
mov byte [rsp + 0x45], al
movzx eax, byte [r9 + 6]
mov byte [rsp + 0x46], al
movzx eax, byte [r9 + 7]
mov byte [rsp + 0x47], al
movzx eax, byte [r9 + 8]
mov byte [rsp + 0x48], al
movzx eax, byte [r9 + 9]
mov byte [rsp + 0x49], al
movzx eax, byte [r9 + 0xa]
mov byte [rsp + 0x4a], al
movzx eax, byte [r9 + 0xb]
mov byte [rsp + 0x4b], al
movzx eax, byte [r9 + 0xc]
mov byte [rsp + 0x4c], al
movzx eax, byte [r9 + 0xd]
mov byte [rsp + 0x4d], al
movzx eax, byte [r9 + 0xe]
mov byte [rsp + 0x4e], al
movzx eax, byte [r9 + 0xf]
mov byte [rsp + 0x4f], al
nop word [rax + rax]
lea edx, [r10*4 - 4]
movzx r9d, byte [rsp + rdx + 0x40]
lea eax, [rdx + 1]
movzx r8d, byte [rsp + rax + 0x40]
lea eax, [rdx + 2]
movzx r11d, byte [rsp + rax + 0x40]
lea eax, [rdx + 3]
movzx ebx, byte [rsp + rax + 0x40]
movzx edi, r8b
test r10b, 3
jne 0x1400edb36
movzx edi, byte [r11 + r13 + 0x4320]
mov eax, r10d
movzx r11d, byte [rbx + r13 + 0x4320]
xor dil, 0xec
movzx ebx, byte [r9 + r13 + 0x4320]
xor r11b, 0xec
shr eax, 2
xor bl, 0xec
movzx ecx, al
movzx r9d, byte [rcx + r13 + 0x4520]
xor r9b, byte [r8 + r13 + 0x4320]
xor r9b, 0x46
lea edx, [r10*4 - 0x10]
xor r9b, byte [rsp + rdx + 0x40]
lea eax, [rdx + 1]
xor dil, byte [rsp + rax + 0x40]
lea r8d, [r10*4]
lea eax, [r8 + 1]
mov byte [rsp + r8 + 0x40], r9b
mov byte [rsp + rax + 0x40], dil
inc r10d
lea eax, [rdx + 2]
xor r11b, byte [rsp + rax + 0x40]
lea eax, [r8 + 2]
mov byte [rsp + rax + 0x40], r11b
lea eax, [rdx + 3]
xor bl, byte [rsp + rax + 0x40]
lea eax, [r8 + 3]
mov byte [rsp + rax + 0x40], bl
cmp r10d, 0x2c
jb 0x1400edabc
xchg r14, rbx
mov r14, qword [rbp + 0x67]
xchg rbx, r14
xchg r14, rdx
mov r14, qword [rbp + 0x7f]
xchg r14, rdx
test rdx, rdx
je 0x1400edbb7
mov qword [0x14016d2a0], rdx
jmp 0x1400edbbe
mov rdx, qword [0x14016d2a0]
mov edi, 9
mov rax, r14
xchg rdi, r15
mov qword [rsp + 0x30], r15
xchg rdi, r15
test r14d, r14d
je 0x1400ee00d
lea r9, [rsp + 0x50]
sub r9, rsi
dec rax
xchg r15, r9
mov qword [rsp + 0x20], r15
xchg r15, r9
shr rax, 1
shr rax, 1
shr rax, 2
inc rax
xchg r10, rax
mov qword [rsp + 0x28], r10
xchg r10, rax
nop dword [rax]
Function at 0x1401549cc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
push rdx
call 0x1407f7967
test rax, rax
je 0x140154a16
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140154a16
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140154a16
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140154a16
cmp dword [rcx + 0x84], 0xe
jbe 0x140154a16
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140154a18
xor al, al
add rsp, 0x28
ret

Function at 0x140182570
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x14018259d
xor al, al
jmp 0x1401826ff
mov rax, qword [0x1401a16c0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x1401a16c8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x1401a16d0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x1401a16d8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x1401a16e0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x1401a16e8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x1401a16f0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x1401a16f8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x1401a1700]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x1401826f1
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x140182649
mov r11d, 2
jmp 0x14018266d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x140182663
mov r11d, 1
jmp 0x14018266d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x140182715
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x1401826b2
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x1401826ca
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x1401826da
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x1401826e8
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x140182630
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x1401826fa
Function at 0x1401be15d
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
jmp 0x140965a8f
syscall
ret

Function at 0x140c598f5
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
syscall
ret

Function at 0x140dc5e34
Capabilities:
Encode data using xor

Disassembly:
pop rcx
movabs dword [0x4650cca659452eb8], eax
pop rcx
movabs byte [0x45a29ba0594685ca], al
pop rcx
cmpsd dword [rsi], dword [rdi]
invalid
push 0xffffffffd6a67702
call fcn.140e40fbf
jl 0x140dc5e58
cld
jnp 0x140dc5e92
invalid
mov al, 0xe7
invalid
xchg ebx, eax
mov dword [rbx], edx
xlatb
loopne 0x140dc5e04
adc ebx, esi
mov ebp, 0x86138909
or byte [rbp - 0x2941ec77], bh
sti
mov dword [rbx - 0x45], ebx
mov al, 0x9a
loope 0x140dc5efc
mov esi, 0x5b89fbd6
mov ebx, 0x6ce19ab0
xor eax, 0xec71380c
cmp byte [rcx - 0x14], dh
jns 0x140dc5eb8
xchg ebp, eax
jno 0x140dc5e86
test eax, 0xec71ddea
sbb dword [rbx + 0x64], edx
jno 0x140dc5e90
sub eax, eax
hlt
jns 0x140dc5e74
invalid
cmp cl, dh
mov dl, byte [rax + rbx*8 - 0x3c9a1dc6]
cli
invalid
Function at 0x6d8839a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x6d8a45e4]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x6d883b28
mov rax, qword [0x6d8a45e8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x6d8839ec
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x6d883a75
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x6d8839d0
mov rcx, rbx
call sym.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x6d883b5d
mov rax, qword [0x6d8a45e8]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call sym._GetPEImageBase
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x6d8a45e8]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x6d883b40
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x6d883a6e
sub eax, 0x40
and eax, 0xffffffbf
jne 0x6d883ad0
add dword [0x6d8a45e4], 1
cmp edi, 8
jae 0x6d883aa3
test dil, 4
jne 0x6d883b14
test edi, edi
je 0x6d883a98
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x6d883b2f
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x6d883a98
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x6d883abc
jmp 0x6d883a98
add rsi, qword [0x6d8a45e8]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x6d883a6e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x6d883a98
xor esi, esi
jmp 0x6d8839f7
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x6d883a98
mov rax, qword [0x6d8a45e8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call sym.__report_error
nop
nop dword [rax]

Function at 0x6d8842b0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x6d8a48c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x6d8a48a0]
test rbx, rbx
je 0x6d884304
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x6d8842fb
test rsi, rsi
je 0x6d8842fb
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x6d8842e0
lea rcx, [0x6d8a48c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x6d884540
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x6d884550
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x6d884560
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x6d8845a1
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x6d884598
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x6d8845a3
add rax, 0x28
cmp rax, r9
jne 0x6d884584
xor eax, eax
ret

Function at 0x6d884640
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6d8a11f0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x6d8846ad
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d8846ad
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6d8846ad
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6d8846a4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6d8846af
add rax, 0x28
cmp rax, r9
jne 0x6d884690
xor eax, eax
add rsp, 0x28
ret

Function at 0x6d8847b0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6d8a11f0]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
je 0x6d8847d0
add rsp, 0x28
ret
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d8847c8
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6d88482d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6d884824
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6d884834
add rax, 0x28
cmp rax, r9
jne 0x6d884810
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret

Function at 0x6d884850
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x6d8a11f0]
cmp word [r11], 0x5a4d
mov r9d, ecx
jne 0x6d8848be
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d8848be
movsxd rax, dword [r11 + 0x3c]
add rax, r11
mov edx, dword [rax + 0x90]
test edx, edx
je 0x6d8848be
movzx ecx, word [rax + 0x14]
lea rcx, [rax + rcx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x6d8848be
sub eax, 1
lea rax, [rax + rax*4]
lea rax, [rcx + rax*8 + 0x28]
mov r10d, dword [rcx + 0xc]
cmp rdx, r10
mov r8, r10
jb 0x6d8848b5
add r8d, dword [rcx + 8]
cmp rdx, r8
jb 0x6d8848c5
add rcx, 0x28
cmp rcx, rax
jne 0x6d8848a0
xor eax, eax
add rsp, 0x28
ret
add rdx, r11
jne 0x6d8848d8
jmp 0x6d8848be
sub r9d, 1
add rdx, 0x14
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x6d8848e6
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x6d8848be
test r9d, r9d
jg 0x6d8848d0
mov eax, dword [rdx + 0xc]
add rax, r11
add rsp, 0x28
ret
Function at 0x6d884c50
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop