joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140026a58
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x1400268eb
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400268eb
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400268eb
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400268eb
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400268eb
cmp dword [rcx + 0x84], 0xe
jbe 0x1400268eb
cmp dword [rcx + 0xf8], 0
je 0x1400268eb
mov ecx, ebx
call fcn.14002698c
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.14002677c
cmp dword [rbp + 0x20], 0
je 0x140026938
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140026940
int3
xor r8d, r8d
xor edx, edx
jmp 0x140026884

Function at 0x1400272d8
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400272f8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140026d58
or eax, 0xffffffff
jmp 0x1400272fa
xor eax, eax
add rsp, 0x28
ret

Function at 0x14005b9a0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x140004000
Capabilities:
Encode data using xor

Disassembly:
wait
std
sahf
lahf
xchg edx, eax
clc
lahf
nop
stc
clc
cwde
wait
clc
cwde
xchg ecx, eax
cdq
nop
std
clc
std
clc
cwde
cld
sahf
clc
xchg ecx, eax
sahf
cwde
nop
clc
clc
cwde
xchg ecx, eax
nop
xchg ebx, eax
nop
wait
sahf
xchg ebx, eax
cwde
xchg ebx, eax
clc
sahf
stc
nop
sahf
nop
cld
stc
lahf
xchg edx, eax
xchg ebx, eax
wait
clc
cdq
nop
std
clc
cdq
xchg ecx, eax
wait
sahf
stc
xchg ebx, eax
clc
sahf
sahf
cld
cwde
lahf
clc
xchg ebx, eax
nop
nop
wait
wait
xchg ecx, eax
xchg edx, eax
lahf
sahf
xchg edx, eax
xchg ebx, eax
xchg ebx, eax
lahf
cwde
cwde
cwde
clc
xchg edx, eax
stc
cdq
sahf
xchg ecx, eax
nop
cwde
cdq
sahf
std
xchg ebx, eax
nop
std
cdq
cwde
std
clc
xchg ecx, eax
sahf
wait
lahf
xchg ecx, eax
sahf
stc
wait
sahf
xchg edx, eax
xchg ecx, eax
cdq
clc
cld
sahf
xchg ecx, eax
cld
cdq
nop
cwde
sahf
cdq
clc
cld
wait
xchg edx, eax
xchg edx, eax
cwde
xchg ecx, eax
sahf
cdq
stc
lahf
xchg edx, eax
cwde
std
lahf
clc
xchg edx, eax
xchg ebx, eax
cdq
sahf
lahf
cld
xchg ecx, eax
std
lahf
nop
wait
cdq
xchg ebx, eax
clc
clc
xchg ebx, eax
lahf
xchg edx, eax
std
cdq
xchg ebx, eax
sahf
stc
cwde
clc
cdq
stc
xchg ebx, eax
sahf
cwde
sahf
stc
std
xchg ecx, eax
wait
cdq
std
lahf
lahf
wait
wait
xchg ecx, eax
stc
lahf
cld
clc
sahf
clc
clc
xchg edx, eax
nop
wait
std
lahf
nop
xchg edx, eax
xchg edx, eax
xor rdi, rdi
mov r11, rsp
fcmovu st(0), st(3)
mov dil, 0x7a
and r11w, 0xfb50
movabs r8, 0x23379a82f4feee4
fxsave64 [r11]
mov rcx, qword [r11 + 8]
dec rdi
xor qword [rcx + rdi*8 + 0x2a], r8
test rdi, rdi
jne 0x1400040eb
test eax, 0x6bf5b9df
cmp byte [rbp - 0x5598538a], al
sub qword [r11 + rdx - 0x1e1e530b], rbx
push 0xffffffffffffffa8
xor dword [rcx + 0x5d67fbe2], ecx
leave
invalid
Function at 0x18007eab0
Capabilities:
Inspect section memory permissions

Disassembly:
mov r8d, ecx
mov r9d, ecx
xor ecx, ecx
and r8d, 0xe0000000
cmp r8d, 0xe0000000
mov eax, 0x40
cmovne eax, ecx
mov edx, eax
bts edx, 7
cmp r8d, 0xa0000000
cmovne edx, eax
mov eax, edx
or eax, 0x20
cmp r8d, 0x60000000
cmovne eax, edx
mov ecx, eax
or ecx, 0x10
cmp r8d, 0x20000000
cmovne ecx, eax
mov eax, ecx
or eax, 4
cmp r8d, 0xc0000000
cmovne eax, ecx
mov ecx, eax
or ecx, 8
cmp r8d, 0x80000000
cmovne ecx, eax
mov eax, ecx
or eax, 2
cmp r8d, 0x40000000
cmovne eax, ecx
mov ecx, eax
or ecx, 1
test r8d, r8d
cmovne ecx, eax
mov eax, ecx
bts eax, 9
bt r9d, 0x1a
cmovae eax, ecx
ret
Function at 0x14004879d
Capabilities:
Execute anti-debugging instructions

Disassembly:
call 0x140048787
mov dword [rsp + 0x12], r10d
lea rsp, [rsp + 2]
mov qword [rsp + 0x28], r13
pushfq
jmp 0x1400487d0
mov dword [rsp], r12d
pop word [rsp + 1]
jmp 0x14004880d
push qword [rsp + 4]
jp 0x1400487ba
mov dword [rsp], r12d
pop word [rsp + 1]
mov dword [rsp + 8], ecx
jmp 0x1400487f7
lea rsp, [rsp + 1]
lea rsp, [rsp + 5]
jmp 0x14004881b
mov dword [rsp + 8], ecx
lea rsp, [rsp + 1]
lea rsp, [rsp + 5]
mov qword [rsp + 0x28], r14
call fcn.1400494ec
push rsp
mov r8b, r12b
mov r13d, eax
cpuid
push r15
shl r8d, cl
jmp 0x140048872
xchg r13, rdi
jmp 0x140048894
mov r10d, ecx
jmp 0x1400488d9
ja 0x1400488ce
btr r10w, r9w
xchg r10, r15
jmp 0x14004885b
jmp 0x1400488ae
lea rsi, [rsp]
push r10
xchg byte [rsp + 3], al
sub rsp, 2
jl 0x14004887e
cmc
jmp 0x140048937
cmc
lea rsp, [rsp + 2]
sub rsp, 0x238
jmp 0x140048980
btr r10w, r9w
xchg r10, r15
mov r10d, ecx
mov r12d, dword [rsp + 0x90]
mov r8b, r9b
mov r8, qword [rsp]
mov ecx, dword [rsp]
jmp 0x140048845
lea rsp, [rsp + 2]
call fcn.140048906
xchg esp, eax
invalid
mov r10, rsp
mov dl, 0x12
bswap r14d
mov dl, byte [rsp]
sub rsp, 0x11
jmp 0x1400489a2
jp 0x1400489b8
lea rsp, [rsp + 1]
jmp fcn.1400489bd
lea rsp, [rsp + 1]

Function at 0x1400489e5
Capabilities:
Execute anti-debugging instructions

Disassembly:
cpuid
bswap ebp
rdtsc
mov r14, 0x29c9fdde
jmp 0x140048a11
rdtsc
xchg qword [rsp], rdi
mov r13, r9
rcl bp, cl
bswap r14d
sub rsp, 0x1f
jmp 0x140048a41

Function at 0x1400489fb
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap r9
mov ax, 0xe113
mov r9, rsp
jmp 0x140048ac0
Function at 0x1400494ec
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x140048826
movabs r15, 0xffffffffc0033c8c
jmp 0x140048843
mov qword [rsp + 0x28], r15
lea rsp, [rsp + 0x28]
pushfq
jmp 0x1400489d6
mov dword [rsp + 5], ecx
mov word [rsp + 6], r8w
pop word [rsp + 4]
jmp 0x140048b59
jmp 0x140049157
push r9w
je 0x140049437
mov dword [rsp + 5], ecx
mov word [rsp + 6], r8w
pop word [rsp + 4]
mov qword [rsp + 0x28], r15
lea rsp, [rsp + 0x28]
jmp 0x140048b63

Function at 0x14004c540
Capabilities:
Encode data using xor

Disassembly:
pop word [rsp + 3]
call fcn.14004c52a
lea eax, [rdx]
invalid
nop
test dword [rdx], reloc.KERNEL32.dll_FindNextFileW
xor al, cl
jnp 0x14004c54c
js 0x14004c547
mov dword [rax - 0x34], edi
invalid

Function at 0x140175bee
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [rsp + 9], edx
rdtsc
mov r9b, byte [rsp + 6]
xchg word [rsp], r9w
jmp 0x140175c06
jmp 0x140175bd8
mov dword [rsp + 0xd], ebp

Function at 0x140175e89
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ax, word [rsp + 9]
mov qword [rsp], r11
jmp 0x140175f89
xchg qword [rsp], rdx
push r8
mov dword [rsp + 5], ecx
mov eax, r13d
bt ax, bp
stc
jmp 0x140175eb6
pop r14
mov rcx, r8
mov cx, word [rsp + 1]
sub rsp, 0xc
clc
mov r8w, word [rsp + 0xd]
jmp 0x140175ecc

Function at 0x140177e58
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov r8b, r14b
mov byte [rsp + 4], spl
jmp 0x140177e66
pop r8w
mov r9d, edx
mov ecx, 0x5a9e676b
mov rdx, r10
jmp 0x140177e8c

Function at 0x14017818e
Capabilities:
Execute anti-debugging instructions

Disassembly:
sete sil
xchg r14w, r10w
rol r10b, cl
jmp 0x14017819f
rdtsc
xchg cx, si
pop qword [rsp]
push word [rsp]
jmp 0x14017825a
mov r8b, 0x57
pop qword [rsp + 0xb]
add rsp, 0x33
mov dword [rsp], edx
mov r9d, 0xbde8e8e4
bswap eax
jmp 0x1401781c1
lea rax, [r11*8]
sub rsp, 0x16
bswap r9
mov word [rsp], di
pop r9
xchg r14d, edx
jmp 0x1401781e0
mov edx, 0x4836cd70
mov al, r8b
sub rsp, 0x15
pop cx
sub rsp, 0x11
inc r10b
jmp 0x14017821e
Function at 0x14017868b
Capabilities:
Execute anti-debugging instructions

Disassembly:
std
dec ax
setae r9b
xchg rsi, r8
mov r8b, r15b
bt cx, r15w
jmp 0x140178666
push r13w
mov r14, 0x5f3cc1de
add rsp, 0
pop r14w
mov esi, 0x8d68f0b6
mov r8d, 0xc9dd7b2f
jmp 0x1401785eb
bswap r8d
lea r10, [rbx + r15]
xchg word [rsp + 1], r8w
mov rax, qword [rsp]
not r10d
add rsp, 3
jmp 0x140178605
bts r14w, dx
mov al, 0x2e
std
mov byte [rsp], r11b
not dx
jmp 0x140178718
mov r10b, byte [rsp]
mov edx, dword [rsp]
mov rdx, r12
mov rax, r9
shr r8d, 0xd
lea r9, [rbx + riz]
jmp 0x140178650
mov r9b, r12b
bswap r9d
mov r9d, dword [rsp + 4]
pop r9
lea rsp, [rsp]
jmp 0x140178636
shl r10w, 0
mov r8b, spl
mov ax, cx
pop ax
jmp 0x140178701
rdtsc
mov rcx, qword [rsp]
mov byte [rsp + 1], spl
mov r14w, word [rsp + 2]
jmp 0x14017869e
not r14
neg dl
mov esi, 0xe79dbfb9
rcl rsi, 0x37
lea rax, [r10 + riz + 0x8403]
xchg word [rsp], cx
jmp 0x1401786b4
lea rsp, [rsp + 0x1a]
xchg byte [rsp], cl
mov r8, qword [rsp]
bswap esi
jmp 0x140178850
sub rsp, 0x1b
mov byte [rsp + 0xa], r14b
mov r10b, r13b
setge r14b
jmp 0x1401786eb
push ax
mov r9b, byte [rsp + 1]
lea r10, [0x37e95655]
not ax
lea rdx, [r15*8]
xchg esi, eax
jmp 0x1401786cf
mov qword [rsp], rcx
lea r8, [rax + r15]
lea rax, [r12 - 0x640d]
call fcn.140178737
btc r9w, ax
mov esi, ecx
mov qword [rsp + 3], r12
not r8
mov dx, r9w
jmp 0x1401787f0
lea rsp, [rsp]
sub rsp, 0x12
mov byte [rsp + 9], r9b
pop r10w
dec sil
sub rsp, 6
jmp 0x140178762
mov r9w, dx
not cl
push word [rsp + 0x18]
bsf r9, rdi
jmp 0x140178824
mov cl, 0xa2
mov qword [rsp + 0xb], rsp
mov qword [rsp + 7], r12
xchg qword [rsp + 0x10], r10
dec dx
lea r8, [r8 + r11]
jmp 0x1401787da
mov r10, r14
rdtsc
bswap rdx
mov r9, qword [rsp]
add rsp, 4
mov cl, 0xc6
jmp 0x1401787c0
mov r14b, 0x1d
pop qword [rsp + 0xc]
xchg byte [rsp], r14b
mov word [rsp + 6], r12w
mov r8b, 0xb9
pop word [rsp + 7]
jmp 0x14017886b
lea r14, [rsi + r14]
xchg byte [rsp], r14b
dec r14
sub rsp, 1
mov r9w, word [rsp]
push word [rsp + 2]
jmp 0x140178810
rdtsc
mov byte [rsp + 9], r13b
lea r8, [rbx + r12]
xchg word [rsp + 0xb], r8w
inc cl
cld
jmp 0x14017930c
push word [rsp + 6]
mov esi, 0x8d28341e
bswap ecx
call fcn.140178ab7
Function at 0x6dadae40
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x6dafc5e4]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x6dadafc8
mov rax, qword [0x6dafc5e8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x6dadae8c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x6dadaf15
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x6dadae70
mov rcx, rbx
call sym.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x6dadaffd
mov rax, qword [0x6dafc5e8]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call sym._GetPEImageBase
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x6dafc5e8]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x6dadafe0
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x6dadaf0e
sub eax, 0x40
and eax, 0xffffffbf
jne 0x6dadaf70
add dword [0x6dafc5e4], 1
cmp edi, 8
jae 0x6dadaf43
test dil, 4
jne 0x6dadafb4
test edi, edi
je 0x6dadaf38
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x6dadafcf
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x6dadaf38
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x6dadaf5c
jmp 0x6dadaf38
add rsi, qword [0x6dafc5e8]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x6dadaf0e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x6dadaf38
xor esi, esi
jmp 0x6dadae97
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x6dadaf38
mov rax, qword [0x6dafc5e8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call sym.__report_error
nop
nop dword [rax]

Function at 0x6dadb750
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x6dafc8c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x6dafc8a0]
test rbx, rbx
je 0x6dadb7a4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x6dadb79b
test rsi, rsi
je 0x6dadb79b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x6dadb780
lea rcx, [0x6dafc8c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x6dadb9e0
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x6dadb9f0
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x6dadba00
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x6dadba41
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x6dadba38
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x6dadba43
add rax, 0x28
cmp rax, r9
jne 0x6dadba24
xor eax, eax
ret

Function at 0x6dadbae0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6daf91f0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x6dadbb4d
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6dadbb4d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6dadbb4d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6dadbb44
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6dadbb4f
add rax, 0x28
cmp rax, r9
jne 0x6dadbb30
xor eax, eax
add rsp, 0x28
ret

Function at 0x6dadbc50
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6daf91f0]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
je 0x6dadbc70
add rsp, 0x28
ret
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6dadbc68
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6dadbccd
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6dadbcc4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6dadbcd4
add rax, 0x28
cmp rax, r9
jne 0x6dadbcb0
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret

Function at 0x6dadbcf0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x6daf91f0]
cmp word [r11], 0x5a4d
mov r9d, ecx
jne 0x6dadbd5e
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6dadbd5e
movsxd rax, dword [r11 + 0x3c]
add rax, r11
mov edx, dword [rax + 0x90]
test edx, edx
je 0x6dadbd5e
movzx ecx, word [rax + 0x14]
lea rcx, [rax + rcx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x6dadbd5e
sub eax, 1
lea rax, [rax + rax*4]
lea rax, [rcx + rax*8 + 0x28]
mov r10d, dword [rcx + 0xc]
cmp rdx, r10
mov r8, r10
jb 0x6dadbd55
add r8d, dword [rcx + 8]
cmp rdx, r8
jb 0x6dadbd65
add rcx, 0x28
cmp rcx, rax
jne 0x6dadbd40
xor eax, eax
add rsp, 0x28
ret
add rdx, r11
jne 0x6dadbd78
jmp 0x6dadbd5e
sub r9d, 1
add rdx, 0x14
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x6dadbd86
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x6dadbd5e
test r9d, r9d
jg 0x6dadbd70
mov eax, dword [rdx + 0xc]
add rax, r11
add rsp, 0x28
ret
Function at 0x6dadc0c0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x140002b60
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
xor r8, r8
push r8
push rax
pushfq
push r8
push rdx
sub rsp, 0xa8
push r8
push r15
push r14
push r13
push r12
push rbx
push r8
push rsi
push rdi
push rbp
push rax
push rdx
sub rsp, 0x290
movdqa xmmword [rsp + 0x2f0], xmm6
movdqa xmmword [rsp + 0x300], xmm7
movdqa xmmword [rsp + 0x310], xmm8
movdqa xmmword [rsp + 0x320], xmm9
movdqa xmmword [rsp + 0x330], xmm10
movdqa xmmword [rsp + 0x340], xmm11
movdqa xmmword [rsp + 0x350], xmm12
movdqa xmmword [rsp + 0x360], xmm13
movdqa xmmword [rsp + 0x370], xmm14
movdqa xmmword [rsp + 0x380], xmm15
mov eax, dword [0x1402221d8]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x10
add rax, rbx
lea rdx, [rsp + 0x20]
xor r8, r8
mov qword [rdx + 0x10], r8
mov byte [rdx + 0x19], 1
mov dword [rdx + 0x1c], 0xffffffff
mov byte [rdx + 0x18], 2
mov r8, qword [rax + 0x80]
mov qword [rdx], r8
mov qword [rax + 0x80], rdx
lea r8, [rsp + 0x290]
mov qword [rdx + 8], r8
call fcn.1400a24c0
int3
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xd8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x120], rcx
mov qword [rsp + 0x128], rdx
mov qword [rsp + 0x130], r8
mov qword [rsp + 0x138], r9
mov eax, dword [0x1402221d8]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x10
add rax, rbx
mov qword [rsp + 0xc0], rax
cmp rcx, qword [rax + 0x88]
sete byte [rsp + 0xd0]
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [r8 + 0x18]
mov rbx, qword [rax]
mov rax, qword [r8 + 0x20]
mov rbp, qword [rax]
mov rax, qword [r8 + 0x28]
mov rsi, qword [rax]
mov rax, qword [r8 + 0x30]
mov rdi, qword [rax]
mov rax, qword [r8 + 0x58]
mov r12, qword [rax]
mov rax, qword [r8 + 0x60]
mov r13, qword [rax]
mov rax, qword [r8 + 0x68]
mov r14, qword [rax]
mov rax, qword [r8 + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [r8 + 0x90]
movdqa xmm7, xmmword [r8 + 0xa0]
movdqa xmm8, xmmword [r8 + 0xb0]
movdqa xmm9, xmmword [r8 + 0xc0]
movdqa xmm10, xmmword [r8 + 0xd0]
movdqa xmm11, xmmword [r8 + 0xe0]
movdqa xmm12, xmmword [r8 + 0xf0]
movdqa xmm13, xmmword [r8 + 0x100]
movdqa xmm14, xmmword [r8 + 0x110]
movdqa xmm15, xmmword [r8 + 0x120]
mov rcx, qword [r8 + 0x78]
mov rdx, qword [rsp + 0x120]
call qword [rsp + 0x128]
mov r8, qword [rsp + 0x130]
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rdx + 0x70]
cmp rcx, 0
je 0x140002cf0
mov r9, qword [rdx + 0x68]
mov qword [r9], rcx
mov qword [rdx + 0x68], 0
mov qword [rdx + 0x70], 0
mov rcx, qword [rsp + 0x138]
mov r8, qword [r8 + 0x78]
xor r9d, r9d
mov rcx, qword [rcx]
cmp rcx, r9
je 0x140002d0c
cmp rcx, r8
jl 0x140002cff
mov qword [rdx + 0x80], rcx
test dword [0x14021b760], 1
je 0x140002d3b
cmp byte [rsp + 0xd0], 0
je 0x140002d3b
mov rcx, 0x43
mov rdx, rax
mov rsp, r8
jmp 0x140002860
mov rsp, r8
jmp rax
Function at 0x140002d40
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xc8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x110], rcx
mov qword [rsp + 0x118], rdx
mov eax, dword [0x1402221d8]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x10
add rax, rbx
mov qword [rsp + 0xc0], rax
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [rdx + 0x18]
mov rbx, qword [rax]
mov rax, qword [rdx + 0x20]
mov rbp, qword [rax]
mov rax, qword [rdx + 0x28]
mov rsi, qword [rax]
mov rax, qword [rdx + 0x30]
mov rdi, qword [rax]
mov rax, qword [rdx + 0x58]
mov r12, qword [rax]
mov rax, qword [rdx + 0x60]
mov r13, qword [rax]
mov rax, qword [rdx + 0x68]
mov r14, qword [rax]
mov rax, qword [rdx + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [rdx + 0x90]
movdqa xmm7, xmmword [rdx + 0xa0]
movdqa xmm8, xmmword [rdx + 0xb0]
movdqa xmm9, xmmword [rdx + 0xc0]
movdqa xmm10, xmmword [rdx + 0xd0]
movdqa xmm11, xmmword [rdx + 0xe0]
movdqa xmm12, xmmword [rdx + 0xf0]
movdqa xmm13, xmmword [rdx + 0x100]
movdqa xmm14, xmmword [rdx + 0x110]
movdqa xmm15, xmmword [rdx + 0x120]
mov rcx, qword [rdx + 0x78]
call qword [rsp + 0x110]
mov rdx, qword [rsp + 0x118]
mov rax, qword [rdx + 0x18]
mov qword [rax], rbx
mov rax, qword [rdx + 0x20]
mov qword [rax], rbp
mov rax, qword [rdx + 0x28]
mov qword [rax], rsi
mov rax, qword [rdx + 0x30]
mov qword [rax], rdi
mov rax, qword [rdx + 0x58]
mov qword [rax], r12
mov rax, qword [rdx + 0x60]
mov qword [rax], r13
mov rax, qword [rdx + 0x68]
mov qword [rax], r14
mov rax, qword [rdx + 0x70]
mov qword [rax], r15
movdqa xmmword [rdx + 0x90], xmm6
movdqa xmmword [rdx + 0xa0], xmm7
movdqa xmmword [rdx + 0xb0], xmm8
movdqa xmmword [rdx + 0xc0], xmm9
movdqa xmmword [rdx + 0xd0], xmm10
movdqa xmmword [rdx + 0xe0], xmm11
movdqa xmmword [rdx + 0xf0], xmm12
movdqa xmmword [rdx + 0x100], xmm13
movdqa xmmword [rdx + 0x110], xmm14
movdqa xmmword [rdx + 0x120], xmm15
mov rax, qword [rsp + 0xc0]
lock or dword [rax + 0x38], 0x10
movdqa xmm6, xmmword [rsp + 0x20]
movdqa xmm7, xmmword [rsp + 0x30]
movdqa xmm8, xmmword [rsp + 0x40]
movdqa xmm9, xmmword [rsp + 0x50]
movdqa xmm10, xmmword [rsp + 0x60]
movdqa xmm11, xmmword [rsp + 0x70]
movdqa xmm12, xmmword [rsp + 0x80]
movdqa xmm13, xmmword [rsp + 0x90]
movdqa xmm14, xmmword [rsp + 0xa0]
movdqa xmm15, xmmword [rsp + 0xb0]
add rsp, 0xc8
pop rbp
pop rdi
pop rsi
pop rbx
pop r12
pop r13
pop r14
pop r15
ret