joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ffd51cb5910
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x1151
syscall
ret

Function at 0x7ffd51cb5920
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x12f4
syscall
ret

Function at 0x7ffd51cba720
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x1125
syscall
ret

Function at 0x7ffd51cba7a0
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x1124
syscall
ret

Function at 0x7ffd51cba7b0
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x1142
syscall
ret

Function at 0x7ffd51cba9f0
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x1141
syscall
ret

Function at 0x7ffd51cbab70
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x1149
syscall
ret

Function at 0x7ffd51cbab80
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x1137
syscall
ret

Function at 0x7ffd51cc05b0
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x1123
syscall
ret

Function at 0x7ffd51cc4a40
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x1146
syscall
ret

Function at 0x7ffd51cc8560
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x113c
syscall
ret

Function at 0x7ffd51cd1e80
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x1147
syscall
ret

Function at 0x7ffd51cd31c0
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x1159
syscall
ret

Function at 0x7ffd51cd3490
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x1152
syscall
ret

Function at 0x7ffd51cd36b0
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x1153
syscall
ret

Function at 0x7ffd51cd3730
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x1154
syscall
ret

Function at 0x7ffd51cd3780
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x1158
syscall
ret

Function at 0x7ffd51cd37d0
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x1157
syscall
ret

Function at 0x7ffd51cd3870
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x1156
syscall
ret

Function at 0x7ffd51cd38c0
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x1155
syscall
ret
Function at 0x7ffd51cd3a40
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc0
mov rax, qword [0x7ffd51cfa088]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rsi, r8
mov qword [rsp + 0x40], r9
mov r14b, dl
xor ebx, ebx
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x38]
and qword [rsp + 0x38], rbx
and qword [rsp + 0x30], rbx
mov rdx, rsi
mov r13, rcx
xor r12d, r12d
call fcn.7ffd51cd3be8
mov rbp, qword [rsp + 0x38]
mov edi, eax
test eax, eax
js 0x7ffd51ce91a4
mov rcx, qword [rsp + 0x30]
lea edx, [rbx + 6]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.api_ms_win_core_memory_l1_1_2.dll_MapViewOfFile]
mov rcx, qword [rsp + 0x30]
mov r15, rax
mov eax, 0x8007000e
test r15, r15
cmove edi, eax
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test edi, edi
js 0x7ffd51ce918c
test r14b, r14b
je 0x7ffd51cd3b3d
lea r14d, [rbx + 0x60]
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, r14d
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x50]
lea ecx, [rbx + 1]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], rbx
mov r9, rsi
mov r8, rsi
mov rdx, r15
mov dword [rsp + 0x50], r14d
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x90], rsi
call qword [sym.imp.ntdll.dll_RtlCreateHeap]
test rax, rax
mov r12, rax
mov eax, 0x8007000e
cmove edi, eax
test edi, edi
js 0x7ffd51ce918c
mov rbx, qword [0x7ffd51cfa038]
lea rax, [fcn.7ffd51cb2bb0]
mov rdx, qword [rbx]
mov r14, qword [rdx + 0x10]
cmp r14, rax
jne 0x7ffd51ce915a
mov edx, 0x48
mov rcx, rbx
call fcn.7ffd51cb2bb0
mov rbx, rax
test rbx, rbx
je 0x7ffd51cd3b8c
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], r13
mov qword [rax + 0x20], r15
mov qword [rax + 0x28], r12
mov qword [rax + 0x30], rsi
test rbx, rbx
mov eax, 0x8007000e
cmove edi, eax
test edi, edi
js 0x7ffd51ce918c
test byte [0x7ffd51cfa080], 0x10
jne 0x7ffd51ce9174
mov rax, qword [rsp + 0x40]
mov qword [rax], rbx
mov eax, edi
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.7ffd51cb1560
mov rbx, qword [rsp + 0x108]
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, r14
call qword [0x7ffd51d072d8]
mov edx, 0x48
mov rcx, rbx
call r14
nop
jmp 0x7ffd51cd3b70
lea rdx, [0x7ffd51ce91d0]
mov r9d, esi
mov r8, rbx
call fcn.7ffd51ced3c8
nop
jmp 0x7ffd51cd3bac
test r15, r15
je 0x7ffd51ce91a4
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetCurrentProcess]
mov rdx, qword [rbx + 0x20]
mov rcx, rax
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
test rbp, rbp
je 0x7ffd51ce91b1
mov rcx, rbp
call fcn.7ffd51cbcdd0
test rbx, rbx
je 0x7ffd51cd3bb4
mov edx, 1
mov rcx, rbx
call fcn.7ffd51cd4468
nop
jmp 0x7ffd51cd3bb4

Function at 0x7ffd51cd3cb0
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x112a
syscall
ret

Function at 0x7ffd51cd4240
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x113f
syscall
ret

Function at 0x7ffd51cd4bf0
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x112b
syscall
ret

Function at 0x7ffd51cd4cd0
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x1145
syscall
ret
Function at 0x7ffd51cd4db0
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x113b
syscall
ret

Function at 0x7ffd51cd59e0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_2_1.dll_GetNativeSystemInfo]
mov eax, dword [rsp + 0x24]
mov qword [0x7ffd51cfa048], rax
add rax, 0xffffffffffffffe0
shr rax, 4
mov qword [0x7ffd51cfa040], rax
add rsp, 0x58
ret

Function at 0x7ffd51cd5c94
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x7ffd51cfa088]
and qword [rbp + 0x18], 0
movabs rbx, 0x2b992ddfa232
cmp rax, rbx
je 0x7ffd51ce059c
mov rbx, qword [rsp + 0x48]
not rax
mov qword [0x7ffd51cfa018], rax
add rsp, 0x20
pop rbp
ret
lea rcx, [rbp + 0x18]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_2_1.dll_GetSystemTimeAsFileTime]
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x10], rax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetCurrentProcessId]
mov eax, eax
xor qword [rbp + 0x10], rax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetCurrentThreadId]
mov eax, eax
xor qword [rbp + 0x10], rax
call qword [sym.imp.api_ms_win_core_sysinfo_l1_2_1.dll_GetTickCount]
mov eax, eax
shl rax, 0x18
xor qword [rbp + 0x10], rax
call qword [sym.imp.api_ms_win_core_sysinfo_l1_2_1.dll_GetTickCount]
lea rcx, [rbp + 0x10]
mov eax, eax
xor rax, qword [rbp + 0x10]
xor rax, rcx
lea rcx, [rbp + 0x20]
mov qword [rbp + 0x10], rax
call qword [sym.imp.api_ms_win_core_profile_l1_1_0.dll_QueryPerformanceCounter]
mov eax, dword [rbp + 0x20]
shl rax, 0x20
movabs rcx, 0xffffffffffff
xor rax, qword [rbp + 0x20]
xor rax, qword [rbp + 0x10]
and rax, rcx
movabs rcx, 0x2b992ddfa233
cmp rax, rbx
cmove rax, rcx
mov qword [0x7ffd51cfa088], rax
jmp 0x7ffd51cd5cc0

Function at 0x7ffd51cda0e0
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x114b
syscall
ret

Function at 0x7ffd51ce3ff4
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_UnhandledExceptionFilter]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_TerminateProcess]
Function at 0x7ffd51cf0c80
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov r11d, ecx
mov ecx, r9d
mov r10d, r9d
call fcn.7ffd51cf0c20
mov r9b, al
test r11b, 0x10
je 0x7ffd51cf0c9f
test al, al
jne 0x7ffd51cf0ceb
test r11b, 2
je 0x7ffd51cf0cd5
xor r8d, r8d
xor edx, edx
call fcn.7ffd51cf0bfc
test al, al
jne 0x7ffd51cf0ceb
test r11b, 4
je 0x7ffd51cf0cd0
test r9b, r9b
je 0x7ffd51cf0cd0
mov r8d, dword [rsp + 0x50]
mov edx, r10d
mov ecx, 1
call fcn.7ffd51cf0a8c
add rsp, 0x28
ret
lea rdx, [0x7ffd51cf0d00]
mov r8d, 0xa
call fcn.7ffd51cf0bfc
test al, al
jne 0x7ffd51cf0cb3
mov r9d, dword [rsp + 0x50]
mov r8d, r11d
mov edx, r10d
add rsp, 0x28
jmp 0x7ffd51cf0d30
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, r8d
mov edi, edx
test r8b, 4
je 0x7ffd51cf0d52
mov r8d, r9d
mov ecx, 2
call fcn.7ffd51cf0a8c
test bl, 0x10
je 0x7ffd51cf0d75
mov ecx, edi
call fcn.7ffd51cf0c20
test al, al
je 0x7ffd51cf0d75
call qword [sym.imp.api_ms_win_core_debug_l1_1_1.dll_IsDebuggerPresent]
test eax, eax
jne 0x7ffd51cf0d75
mov ecx, edi
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_ExitProcess]
test bl, 1
je 0x7ffd51cf0d81
mov ecx, ebx
call fcn.7ffd51cf0d94
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x7ffd51cf0f08
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x10], rdx
push rdi
sub rsp, 0x30
xor ebx, ebx
mov rdi, r8
mov dword [rsp + 0x48], 4
test rcx, rcx
je 0x7ffd51cf0f60
lea rax, [r11 + 0x10]
lea r9, [r11 + 8]
lea rdx, [0x7ffd51cf0f70]
mov qword [r11 - 0x10], rax
lea rax, [r11 + 0x20]
xor r8d, r8d
mov qword [r11 - 0x18], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x7ffd51cf0f60
cmp dword [rsp + 0x40], 4
mov ecx, dword [rsp + 0x58]
sete bl
mov dword [rdi], ecx
mov al, bl
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x7ffd51cf1080
Capabilities:
Terminate process
Terminate thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 0x10], rdx
push rdi
push r13
push r14
sub rsp, 0x60
mov r14d, dword [rsp + 0xa0]
mov rbp, r9
mov rdi, r8
mov rsi, rcx
mov r13d, 0x67
call fcn.7ffd51cf1450
mov word [rsp + 0x88], 0x3f
mov ebx, eax
test eax, eax
jne 0x7ffd51cf10e3
call qword [sym.imp.api_ms_win_core_debug_l1_1_1.dll_IsDebuggerPresent]
movzx ecx, byte [rsp + 0x88]
test eax, eax
cmovne ecx, r13d
mov byte [rsp + 0x88], cl
mov dword [rsp + 0x50], r14d
lea r8, [0x7ffd51cf1910]
mov qword [rsp + 0x48], rbp
test rdi, rdi
lea r9, [0x7ffd51cf13f8]
mov rcx, r8
cmovne rcx, rdi
lea rdx, [0x7ffd51cf1288]
lea rax, [0x7ffd51cf1290]
cmove rdx, r9
cmove rax, r9
mov r9, r8
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], r8
test rsi, rsi
cmovne r9, rsi
xor edx, edx
lea r8, [0x7ffd51cf12a0]
lea ecx, [rdx + 0x65]
call qword [sym.imp.ntdll.dll_DbgPrintEx]
test ebx, ebx
je 0x7ffd51cf1171
lea rdx, [rsp + 0x88]
lea rcx, [0x7ffd51cf1240]
mov r8d, 2
call qword [sym.imp.ntdll.dll_DbgPrompt]
jmp 0x7ffd51cf1199
xor edx, edx
lea rax, [rsp + 0x88]
lea r9, [rsp + 0x88]
lea ecx, [rdx + 0x65]
lea r8, [0x7ffd51cf12f0]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_DbgPrintEx]
int3
movsx eax, byte [rsp + 0x88]
cmp eax, 0x62
jg 0x7ffd51cf11c3
je 0x7ffd51cf1221
cmp eax, 0x42
je 0x7ffd51cf1221
cmp eax, 0x47
je 0x7ffd51cf1222
cmp eax, 0x49
je 0x7ffd51cf120a
cmp eax, 0x50
je 0x7ffd51cf11ed
cmp eax, 0x54
je 0x7ffd51cf11d7
jmp 0x7ffd51cf1201
cmp eax, r13d
je 0x7ffd51cf1222
cmp eax, 0x69
je 0x7ffd51cf120a
cmp eax, 0x70
je 0x7ffd51cf11ed
cmp eax, 0x74
jne 0x7ffd51cf1201
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetCurrentThread]
mov edx, 0xc0000001
mov rcx, rax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_TerminateThread]
jmp 0x7ffd51cf1201
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetCurrentProcess]
mov edx, 0xc0000001
mov rcx, rax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_TerminateProcess]
lea r8, [0x7ffd51cf13e0]
jmp 0x7ffd51cf1211
lea r8, [0x7ffd51cf13b0]
xor edx, edx
lea ecx, [rdx + 0x65]
call qword [sym.imp.ntdll.dll_DbgPrintEx]
jmp 0x7ffd51cf10b3
int3
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop rdi
ret

Function at 0x7ffd51cf1400
Capabilities:
Check systemkerneldebuggerinformation
Get system information on windows

Disassembly:
sub rsp, 0x28
cmp byte [0x7ffd51cfd6e6], 0
jne 0x7ffd51cf143c
xor r9d, r9d
lea rdx, [0x7ffd51cfd6e4]
lea r8d, [r9 + 2]
lea ecx, [r9 + 0x23]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
movzx ecx, byte [0x7ffd51cfd6e6]
mov edx, 1
test eax, eax
cmovns ecx, edx
mov byte [0x7ffd51cfd6e6], cl
movzx eax, byte [0x7ffd51cfd6e4]
add rsp, 0x28
ret
Function at 0x7ffd51cf1450
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x20
mov al, byte [0x7ffd51cfaecc]
test al, al
je 0x7ffd51cf14ad
mov cl, byte [0x7ffd51cfaecd]
mov ebx, 1
test cl, cl
je 0x7ffd51cf14a5
lea r8d, [rbx + 1]
lea rdx, [0x7ffd51cfaecc]
lea ecx, [rbx + 0x22]
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jns 0x7ffd51cf1499
mov al, bl
mov word [0x7ffd51cfaecc], 0x101
mov cl, bl
jmp 0x7ffd51cf14a5
mov cl, byte [0x7ffd51cfaecd]
mov al, byte [0x7ffd51cfaecc]
test al, al
je 0x7ffd51cf14ad
test cl, cl
je 0x7ffd51cf14af
xor ebx, ebx
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
xor rdx, rdx
push rcx
mov rdx, qword gs:[rdx + 0x60]
mov rdx, qword [rdx + 0x18]
push rsi
mov rdx, qword [rdx + 0x20]
xor r9, r9
mov rsi, qword [rdx + 0x50]
movzx rcx, word [rdx + 0x4a]
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
mov rdx, qword [rdx + 0x20]
mov eax, dword [rdx + 0x3c]
push r9
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
push rax
mov r8d, dword [rax + 0x20]
add r8, rdx
mov ecx, dword [rax + 0x18]
jrcxz 0x1400040ca
dec rcx
mov esi, dword [r8 + rcx*4]
xor r9, r9
add rsi, rdx
xor rax, rax
ror r9d, 0xd
lodsb al, byte [rsi]
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
pop r8
add rax, rdx
pop r8
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021
Function at 0x140001480
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x14000f2c0]
mov dword [rax], 1
mov rax, qword [0x14000f2d0]
mov dword [rax], 1
mov rax, qword [0x14000f2e0]
mov dword [rax], 1
mov rax, qword [0x14000f2b0]
mov dword [rax], 1
mov rax, qword [0x14000f170]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400014de
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x14000150a
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x140001530
cmp eax, 0x20b
je 0x140001557
jmp 0x140001586
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x140001543
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x14000158b
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x140001572
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x14000158b
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140002f60
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov r8, rbx
mov rdx, qword [rbp + 0x20]
mov rcx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x140003b92
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x14001a188]
test eax, eax
je 0x140003c2a
lea rax, [0x14001a160]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x14001a190]
mov qword [rbp - 8], rax
jmp 0x140003c0e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x140003c02
cmp qword [rbp - 0x10], 0
je 0x140003c02
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140003bc8
lea rax, [0x14001a160]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x140003c2b
nop
add rsp, 0x30
pop rbp
ret
Function at 0x140003d30
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x140003d58
mov eax, 0
jmp 0x140003da6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140003d81
mov eax, 0
jmp 0x140003da6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x140003da1
mov eax, 0
jmp 0x140003da6
mov eax, 1
add rsp, 0x20
pop rbp
ret

Function at 0x140003dac
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x140003e2a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x140003e21
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x140003e21
mov rax, qword [rbp - 8]
jmp 0x140003e3f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x140003df4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140af5630
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140af57b7
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140af5661
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140af5647
add dl, dl
jne 0x140af566e
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140af56ce
xor eax, eax
add dl, dl
jne 0x140af567d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140af5785
add dl, dl
jne 0x140af568e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140af569b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140af56a8
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140af56b5
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140af56c2
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140af5656
mov eax, 1
add dl, dl
jne 0x140af56de
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140af56eb
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140af56d3
sub eax, ebx
mov ebx, 1
jne 0x140af5724
mov ecx, 1
add dl, dl
jne 0x140af5706
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140af5713
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140af56fb
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140af5656
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140af5740
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140af574d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140af5735
cmp eax, 0x7d00
jae 0x140af5773
cmp eax, 0x500
jb 0x140af576e
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140af5656
cmp eax, 0x7f
ja 0x140af5776
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140af5656
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140af57aa
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140af5656
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20