joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140013330
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.14000ce5c
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x1400133ba
cmp byte [rbp - 0x21], r15b
je 0x1400133b5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x1400133f0
call fcn.1400099e4
test eax, eax
jne 0x1400133dc
cmp byte [rbp - 0x21], r15b
je 0x1400133d4
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x1400133f0
cmp byte [rbp - 0x21], r15b
je 0x1400133ed
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14000c43c
test eax, eax
jne 0x140013490
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.14000ce5c
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14001342f
cmp byte [rbp - 0x21], r15b
je 0x140013464
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140013464
call fcn.1400099e4
test eax, eax
jne 0x140013450
cmp byte [rbp - 0x21], r15b
je 0x140013449
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x140013464
cmp byte [rbp - 0x21], r15b
je 0x140013461
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14000c43c
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x140013490
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x140013493
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x1400134a1
mov rcx, rdi
call fcn.140009794
cmp byte [rbp + 0x3f], r15b
je 0x1400134b0
mov rcx, qword [rbp + 0x27]
call fcn.140009794
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x140015a30
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140015a58
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140015a58
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x18003ae30
Capabilities:
Encode data using xor

Disassembly:
xor dword [rcx], ecx
or ebp, dword [0x1b1c73aca]
sub esp, esi
rol byte [rcx + 0xa], 1
invalid

Function at 0x18004e3f0
Capabilities:
Encode data using xor

Disassembly:
out 0x4d, eax
xchg edx, eax
fimul dword [rax + 0x54]
add al, 0x36
xor dl, byte [rbp - 0x451eba6b]
adc dl, dl
xchg dword [rcx], esp
cmc
sbb ebx, dword [rax + rsi*8 + 0x30]
mov ebp, 0x378dc9d5
adc dword [rdi], 0xacb04f93
pop rbp
invalid

Function at 0x1800a6b60
Capabilities:
Encode data using xor

Disassembly:
and eax, 0x27842863
fsub qword [rcx + rdi*2 - 0x8c5ffd2]
xchg esi, eax
invalid
test dword [rbp - 0x1b0e8454], ebx
sbb ebp, dword [rcx - 0x40]
xor esp, dword [rdx + 0xb6bb76]
mov cl, 0x26
mov dl, 0x51
sub dword [0x174ad368b], esp
and eax, 0x5985d99a
xchg edx, eax
jb 0x1800a6af3
sti
mov ch, 0x51
rcl dword [rsi - 0x2c2fa61b], cl
loope 0x1800a6b51
lahf
push rbx
invalid

Function at 0x1800b21f0
Capabilities:
Encode data using xor

Disassembly:
xchg ecx, eax
xchg ebx, eax
movabs dword [0x210c0f50d5173299], eax
popfq
push rbp
xor eax, edi
invalid

Function at 0x1800baa60
Capabilities:
Encode data using xor

Disassembly:
in al, dx
adc esi, dword [rdx - 0x29ad001f]
insb byte [rdi], dx
test eax, 0x3ff8b8db
adc al, 0x4e
and dl, 0x4d
mov dh, 0xcc
retf 0x1d40
invalid
invalid
jns 0x1800baa1b
div byte [rdx]
sbb al, 0x13
in al, dx
and edx, dword [rdx - 0x5ac79423]
stc
xor al, 0xf9
push 0xdd9b
jnp 0x1800baa59
add al, 0x58
Function at 0x180813058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1808131df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x180813089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18081306f
add dl, dl
jne 0x180813096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1808130f6
xor eax, eax
add dl, dl
jne 0x1808130a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1808131ad
add dl, dl
jne 0x1808130b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1808130c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1808130d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1808130dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1808130ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x18081307e
mov eax, 1
add dl, dl
jne 0x180813106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180813113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1808130fb
sub eax, ebx
mov ebx, 1
jne 0x18081314c
mov ecx, 1
add dl, dl
jne 0x18081312e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x18081313b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180813123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18081307e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x180813168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180813175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18081315d
cmp eax, 0x7d00
jae 0x18081319b
cmp eax, 0x500
jb 0x180813196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18081307e
cmp eax, 0x7f
ja 0x18081319e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18081307e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1808131d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x18081307e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x11c990058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.11c9901df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x11c990089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x11c99006f
add dl, dl
jne 0x11c990096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x11c9900f6
xor eax, eax
add dl, dl
jne 0x11c9900a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x11c9901ad
add dl, dl
jne 0x11c9900b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11c9900c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11c9900d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11c9900dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x11c9900ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x11c99007e
mov eax, 1
add dl, dl
jne 0x11c990106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11c990113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x11c9900fb
sub eax, ebx
mov ebx, 1
jne 0x11c99014c
mov ecx, 1
add dl, dl
jne 0x11c99012e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x11c99013b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x11c990123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x11c99007e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x11c990168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x11c990175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x11c99015d
cmp eax, 0x7d00
jae 0x11c99019b
cmp eax, 0x500
jb 0x11c990196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x11c99007e
cmp eax, 0x7f
ja 0x11c99019e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x11c99007e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x11c9901d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x11c99007e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14061d058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.14061d1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14061d089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14061d06f
add dl, dl
jne 0x14061d096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14061d0f6
xor eax, eax
add dl, dl
jne 0x14061d0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14061d1ad
add dl, dl
jne 0x14061d0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14061d0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14061d0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14061d0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14061d0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14061d07e
mov eax, 1
add dl, dl
jne 0x14061d106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14061d113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14061d0fb
sub eax, ebx
mov ebx, 1
jne 0x14061d14c
mov ecx, 1
add dl, dl
jne 0x14061d12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14061d13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14061d123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14061d07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14061d168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14061d175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14061d15d
cmp eax, 0x7d00
jae 0x14061d19b
cmp eax, 0x500
jb 0x14061d196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14061d07e
cmp eax, 0x7f
ja 0x14061d19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14061d07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14061d1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14061d07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1075d058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1075d1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1075d089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1075d06f
add dl, dl
jne 0x1075d096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1075d0f6
xor eax, eax
add dl, dl
jne 0x1075d0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1075d1ad
add dl, dl
jne 0x1075d0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1075d0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1075d0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1075d0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1075d0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1075d07e
mov eax, 1
add dl, dl
jne 0x1075d106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1075d113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1075d0fb
sub eax, ebx
mov ebx, 1
jne 0x1075d14c
mov ecx, 1
add dl, dl
jne 0x1075d12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1075d13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1075d123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1075d07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1075d168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1075d175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1075d15d
cmp eax, 0x7d00
jae 0x1075d19b
cmp eax, 0x500
jb 0x1075d196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1075d07e
cmp eax, 0x7f
ja 0x1075d19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1075d07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1075d1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1075d07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1406911c8
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.14069134f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1406911f9
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406911df
add dl, dl
jne 0x140691206
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140691266
xor eax, eax
add dl, dl
jne 0x140691215
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14069131d
add dl, dl
jne 0x140691226
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140691233
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140691240
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14069124d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14069125a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1406911ee
mov eax, 1
add dl, dl
jne 0x140691276
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140691283
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14069126b
sub eax, ebx
mov ebx, 1
jne 0x1406912bc
mov ecx, 1
add dl, dl
jne 0x14069129e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406912ab
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140691293
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406911ee
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1406912d8
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406912e5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406912cd
cmp eax, 0x7d00
jae 0x14069130b
cmp eax, 0x500
jb 0x140691306
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406911ee
cmp eax, 0x7f
ja 0x14069130e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406911ee
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140691342
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1406911ee
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x211d413c0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
je 0x211d413d8
mov eax, 1
add rsp, 0x38
ret
mov rax, qword [0x211d4f280]
xor r9d, r9d
lea r8, [sym.RunInjectorThreadProxy_void_]
xor edx, edx
mov qword [rax], rcx
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x38
ret

Function at 0x211d41900
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sym.vfprintf
call sym.abort
nop
nop word [rax + rax]
Function at 0x211d41970
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x211d52064]
mov r12, rcx
mov rsi, rdx
mov rbx, r8
test edi, edi
jle 0x211d41b20
mov rax, qword [0x211d52068]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp r12, rdx
jb 0x211d419bc
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x211d41a47
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x211d419a0
mov rcx, r12
call dbg.__mingw_GetSectionForAddress
mov rbp, rax
test rax, rax
je 0x211d41b7d
mov rax, qword [0x211d52068]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call dbg._GetPEImageBase
mov ecx, dword [rbp + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x211d52068]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x211d41b62
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x211d41a40
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x211d41ad0
add dword [0x211d52064], 1
cmp ebx, 8
jae 0x211d41a78
test bl, 4
jne 0x211d41b30
test ebx, ebx
je 0x211d41a69
movzx eax, byte [rsi]
mov byte [r12], al
test bl, 2
jne 0x211d41b50
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi]
lea rcx, [r12 + 8]
and rcx, 0xfffffffffffffff8
mov qword [r12], rax
mov eax, ebx
mov rdx, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], rdx
sub r12, rcx
add ebx, r12d
sub rsi, r12
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x211d41a69
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x211d41aaa
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rdi, qword [0x211d52068]
mov qword [rdi + 8], rcx
mov r9, rdi
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x211d41a40
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
xor edi, edi
jmp 0x211d419c7
mov eax, dword [rsi]
mov ebx, ebx
mov dword [r12], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r12 + rbx - 4], eax
jmp 0x211d41a69
mov ebx, ebx
movzx eax, word [rsi + rbx - 2]
mov word [r12 + rbx - 2], ax
jmp 0x211d41a69
mov rax, qword [0x211d52068]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call dbg.__report_error
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call dbg.__report_error
nop
nop dword [rax]
Function at 0x211d41e80
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x211d520a0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x211d52080]
test rbx, rbx
je 0x211d41ed4
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x211d41ecb
test r12, r12
je 0x211d41ecb
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x211d41eb0
lea rcx, [0x211d520a0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x211d42100
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
jne 0x211d42110
jmp sym._ValidateImageBase.part.0
xor eax, eax
ret

Function at 0x211d42120
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x211d42165
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp r8, rdx
ja 0x211d4215c
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x211d42167
add rax, 0x28
cmp rax, r9
jne 0x211d42148
xor eax, eax
ret

Function at 0x211d42210
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x211d4f200]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x211d42289
mov rcx, r10
call sym._ValidateImageBase.part.0
test eax, eax
je 0x211d42289
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x211d42286
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x211d4227d
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x211d42289
add r8, 0x28
cmp r8, r9
jne 0x211d42268
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret

Function at 0x211d42370
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x211d4f200]
xor eax, eax
cmp word [r9], 0x5a4d
mov r8, rcx
jne 0x211d423df
mov rcx, r9
call sym._ValidateImageBase.part.0
test eax, eax
je 0x211d423df
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add r9, rax
movzx eax, word [r9 + 0x14]
movzx edx, word [r9 + 6]
lea rax, [r9 + rax + 0x18]
test edx, edx
je 0x211d423dd
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x211d423d4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x211d423e8
add rax, 0x28
cmp rax, r9
jne 0x211d423c0
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret
Function at 0x211d42400
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x211d4f200]
xor r9d, r9d
cmp word [r11], 0x5a4d
mov r8d, ecx
jne 0x211d42478
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x211d42478
movsxd rcx, dword [r11 + 0x3c]
add rcx, r11
mov eax, dword [rcx + 0x90]
test eax, eax
je 0x211d42478
movzx edx, word [rcx + 0x14]
lea rdx, [rcx + rdx + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x211d42478
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r10, [rdx + rcx*8 + 0x28]
nop dword [rax + rax]
mov r9d, dword [rdx + 0xc]
mov rcx, r9
cmp rax, r9
jb 0x211d4246c
add ecx, dword [rdx + 8]
cmp rax, rcx
jb 0x211d42480
add rdx, 0x28
cmp rdx, r10
jne 0x211d42458
xor r9d, r9d
mov rax, r9
add rsp, 0x28
ret
add rax, r11
jmp 0x211d42490
sub r8d, 1
add rax, 0x14
mov ecx, dword [rax + 4]
test ecx, ecx
jne 0x211d4249e
mov edx, dword [rax + 0xc]
test edx, edx
je 0x211d42475
test r8d, r8d
jg 0x211d42488
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
add rsp, 0x28
ret