joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18005a460
Capabilities:
Enumerate threads

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1800f0028]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, rcx
xor esi, esi
xor edx, edx
lea ecx, [rsi + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x18005a5af
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x18005a5a6
mov esi, 1
mov qword [rsp + 0x68], rbx
cmp dword [rsp + 0x20], 0x10
jb 0x18005a55c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x2c], eax
jne 0x18005a55c
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x28], eax
je 0x18005a55c
mov rdx, qword [rdi]
test rdx, rdx
jne 0x18005a51d
mov rcx, qword [0x1801dd3c8]
mov r8d, 0x200
mov dword [rdi + 8], 0x80
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rdi], rax
mov rdx, rax
test rax, rax
je 0x18005a585
lea rbx, [rdi + 0xc]
jmp 0x18005a551
mov eax, dword [rdi + 8]
lea rbx, [rdi + 0xc]
cmp dword [rbx], eax
jb 0x18005a551
mov rcx, qword [0x1801dd3c8]
add eax, eax
mov r9d, eax
mov r8, rdx
shl r9, 2
xor edx, edx
mov dword [rdi + 8], eax
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rdx, rax
test rax, rax
je 0x18005a585
mov qword [rdi], rax
mov ecx, dword [rbx]
mov eax, dword [rsp + 0x28]
mov dword [rdx + rcx*4], eax
inc dword [rbx]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x18005a4c3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x18005a5a1
mov r8, qword [rdi]
xor esi, esi
test r8, r8
je 0x18005a5a1
mov rcx, qword [0x1801dd3c8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rdi], rsi
mov rbx, qword [rsp + 0x68]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18007f5c0
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x18005a5d0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov eax, ecx
lea r9, [rsp + 0x30]
imul rbx, rax, 0x38
mov esi, edx
add rbx, qword [0x1801ea840]
mov r8, qword [rbx]
movzx eax, byte [rbx + 0x20]
and al, 1
movzx ecx, al
lea rdi, [r8 - 5]
cmove rdi, r8
mov r8d, 0x40
lea rbp, [rcx*2 + 5]
mov rcx, rdi
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x18005a634
mov eax, 0xa
jmp 0x18005a6c7
test esi, esi
je 0x18005a656
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, edi
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x18005a679
mov rax, qword [rbx]
mov word [rax], 0xf9eb
jmp 0x18005a679
mov eax, dword [rbx + 0x18]
test byte [rbx + 0x20], 1
mov dword [rdi], eax
je 0x18005a672
movzx eax, word [rbx + 0x1c]
mov word [rdi + 4], ax
movzx eax, byte [rbx + 0x1e]
mov byte [rdi + 6], al
jmp 0x18005a679
movzx eax, byte [rbx + 0x1c]
mov byte [rdi + 4], al
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rbp
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movzx ecx, sil
shl sil, 2
add cl, cl
xor cl, byte [rbx + 0x20]
and cl, 2
xor cl, byte [rbx + 0x20]
xor sil, cl
and sil, 4
xor sil, cl
mov byte [rbx + 0x20], sil
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x18005a6e0
Capabilities:
Resume thread
Suspend thread

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
xor edi, edi
mov esi, ecx
mov ecx, dword [0x1801ea84c]
mov ebx, edi
test ecx, ecx
je 0x18005a893
mov rax, qword [0x1801ea840]
add rax, 0x20
nop word [rax + rax]
movzx edx, byte [rax]
shr edx, 1
and edx, 1
cmp edx, esi
jne 0x18005a730
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x18005a710
mov eax, edi
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
cmp ebx, 0xffffffff
je 0x18005a893
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rdi
call fcn.18005a460
test eax, eax
jne 0x18005a75e
mov eax, 9
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], r12
mov r12, qword [rsp + 0x20]
mov qword [rsp + 0x70], r13
mov r13d, dword [rsp + 0x2c]
test r12, r12
je 0x18005a7e3
test r13d, r13d
je 0x18005a7e3
mov qword [rsp + 0x38], r14
mov r14, r12
mov qword [rsp + 0x30], r15
mov r15d, r13d
mov r8d, dword [r14]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbp, rax
test rax, rax
je 0x18005a7cf
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, edi
test esi, esi
mov edx, 0xffffffff
mov rcx, rbp
setne r8b
call fcn.18005a2b0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add r14, 4
sub r15, 1
jne 0x18005a791
mov r15, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
mov r8d, dword [0x1801ea84c]
cmp ebx, r8d
jae 0x18005a828
nop
mov eax, ebx
imul rcx, rax, 0x38
mov rax, qword [0x1801ea840]
movzx edx, byte [rcx + rax + 0x20]
shr edx, 1
and edx, 1
cmp edx, esi
je 0x18005a821
mov edx, esi
mov ecx, ebx
call fcn.18005a5d0
mov edi, eax
test eax, eax
jne 0x18005a828
mov r8d, dword [0x1801ea84c]
inc ebx
cmp ebx, r8d
jb 0x18005a7f0
test r12, r12
je 0x18005a884
test r13d, r13d
je 0x18005a872
mov rsi, r12
mov rbp, r13
nop dword [rax + rax]
mov r8d, dword [rsi]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbx, rax
test rax, rax
je 0x18005a868
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsi, 4
sub rbp, 1
jne 0x18005a840
mov rcx, qword [0x1801dd3c8]
mov r8, r12
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r12, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov r13, qword [rsp + 0x70]
mov eax, edi
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x18005ac00
Capabilities:
Resume thread
Suspend thread

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
sub rsp, 0x30
xor r12d, r12d
mov r13d, edx
mov ebx, r12d
xor eax, eax
mov rdi, rcx
mov esi, 1
lock cmpxchg dword [0x1801dd3c0], esi
je 0x18005ac51
nop dword [rax]
cmp rbx, 0x20
jae 0x18005ac3a
xor ecx, ecx
jmp 0x18005ac3c
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x1801dd3c0], esi
jne 0x18005ac30
cmp qword [0x1801dd3c8], r12
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], r15
je 0x18005adc0
test rdi, rdi
jne 0x18005ac81
mov ecx, r13d
call fcn.18005a6e0
mov esi, eax
jmp 0x18005adc5
mov ecx, dword [0x1801ea84c]
mov ebx, r12d
test ecx, ecx
je 0x18005aca7
mov rdx, qword [0x1801ea840]
mov rax, rdx
cmp rdi, qword [rax]
je 0x18005acb1
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x18005ac98
mov esi, 4
jmp 0x18005adc5
cmp ebx, 0xffffffff
je 0x18005aca7
mov eax, ebx
imul rcx, rax, 0x38
movzx eax, byte [rcx + rdx + 0x20]
shr eax, 1
and eax, esi
cmp eax, r13d
je 0x18005adb6
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x28], r12
call fcn.18005a460
test eax, eax
jne 0x18005acee
lea esi, [rax + 9]
jmp 0x18005adc5
mov r15, qword [rsp + 0x20]
mov r14d, dword [rsp + 0x2c]
test r15, r15
je 0x18005ad52
test r14d, r14d
je 0x18005ad52
mov rdi, r15
mov ebp, r14d
nop dword [rax + rax]
mov r8d, dword [rdi]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x18005ad48
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, 1
mov edx, ebx
mov rcx, rsi
call fcn.18005a2b0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rdi, 4
sub rbp, 1
jne 0x18005ad10
mov edx, r13d
mov ecx, ebx
call fcn.18005a5d0
mov esi, eax
test r15, r15
je 0x18005adc5
test r14d, r14d
je 0x18005ada2
mov rdi, r15
mov rbp, r14
nop
mov r8d, dword [rdi]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbx, rax
test rax, rax
je 0x18005ad98
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rdi, 4
sub rbp, 1
jne 0x18005ad70
mov rcx, qword [0x1801dd3c8]
mov r8, r15
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x18005adc5
neg r13d
sbb esi, esi
add esi, 6
jmp 0x18005adc5
mov esi, 2
xchg dword [0x1801dd3c0], r12d
mov r15, qword [rsp + 0x70]
mov eax, esi
mov r14, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x18005b560
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rax, qword gs:[0x60]
mov r14, rdx
mov r15, rcx
xor esi, esi
mov rdx, qword [rax + 0x18]
mov rax, qword [rdx + 0x10]
mov rbp, qword [rax]
mov rbx, rbp
nop word [rax + rax]
mov r9, qword [rbx + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r11d, dword [rax + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x18005b618
mov r8d, dword [r11 + 0x18]
test r8d, r8d
je 0x18005b618
mov edi, dword [r11 + 0x20]
nop word [rax + rax]
dec r8d
mov edx, 0x7511d803
lea rax, [rdi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x18005b613
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x18005b5f0
cmp edx, 0x5f00ba6
je 0x18005b73f
test r8d, r8d
jne 0x18005b5d0
mov rax, qword [rbx]
mov rbx, rax
cmp rax, rbp
je 0x18005b62d
cmp qword [rax + 0x30], rsi
jne 0x18005b5a0
mov rax, rsi
mov rcx, r15
call rax
mov rbx, rax
test rax, rax
je 0x18005b77a
mov ecx, dword [0x1801dd2e8]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x1801ea7e4], ecx
jle 0x18005b685
lea rcx, [0x1801ea7e4]
call fcn.18007f700
cmp dword [0x1801ea7e4], 0xffffffff
jne 0x18005b685
lea rcx, [0x1801ea7e4]
call fcn.18007f694
cmp qword [r14 + 0x18], 0x10
movsxd rax, dword [rbx + 0x3c]
mov edi, dword [rax + rbx + 0x50]
jb 0x18005b697
mov r14, qword [r14]
mov r8, r14
lea rdx, [rsp + 0x20]
call fcn.18005b7a0
mov r10, qword [rsp + 0x28]
mov r11, qword [rsp + 0x20]
sub r10, r11
sar r10, 2
sub rdi, r10
je 0x18005b706
mov edx, esi
mov r9d, esi
test r10, r10
je 0x18005b700
nop dword [rax]
nop dword [rax + rax]
mov rax, rsi
nop dword [rax]
nop word [rax + rax]
mov r8d, dword [r11 + rax*4]
lea eax, [rdx + r9]
movzx eax, byte [rax + rbx]
cmp eax, r8d
je 0x18005b6f7
cmp r8d, 0xffffffff
jne 0x18005b75d
inc edx
mov eax, edx
cmp rax, r10
jb 0x18005b6e0
mov esi, r9d
add rsi, rbx
test r11, r11
je 0x18005b777
mov rdx, qword [rsp + 0x30]
mov rax, r11
sub rdx, r11
and rdx, 0xfffffffffffffffc
cmp rdx, 0x1000
jb 0x18005b76f
mov r11, qword [r11 - 8]
add rdx, 0x27
sub rax, r11
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18005b76f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov ecx, dword [r11 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x18005b630
inc r9d
mov eax, r9d
cmp rax, rdi
jae 0x18005b706
mov edx, esi
jmp 0x18005b6d0
mov rcx, r11
call fcn.18007f624
mov rax, rsi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x18006ef60
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov ebx, 1
bsr rcx, rax
mov eax, ebx
shl rax, cl
cmp rdx, rax
jbe 0x18006ef91
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x38], rdi
mov rdi, qword [0x1801ea7f8]
or rax, rbx
bsr rcx, rax
mov r8, rdi
inc ecx
shl rbx, cl
lea rcx, [0x1801ea808]
lea rdx, [rbx + rbx]
call fcn.18006eb00
mov rcx, qword [0x1801ea7f8]
lea r9, [rbx - 1]
mov qword [0x1801ea820], r9
mov qword [0x1801ea828], rbx
mov rcx, qword [rcx]
cmp rcx, rdi
je 0x18006f104
mov qword [rsp + 0x30], rsi
mov rax, rcx
movabs rsi, 0xcbf29ce484222325
movabs rbx, 0x100000001b3
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rbx
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rbx
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rbx
xor r11, rdx
imul r11, rbx
and r11, r9
shl r11, 4
add r11, qword [0x1801ea808]
mov r9, qword [r11]
cmp r9, rdi
jne 0x18006f050
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x18006f0c5
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x18006f08d
mov r10, qword [rdx]
cmp r10, rax
je 0x18006f087
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x18006f0c5
cmp r9, rdx
je 0x18006f0a1
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x18006f0d9
cmp r9, rdx
jne 0x18006f092
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rdi
je 0x18006f0ff
mov r9, qword [0x1801ea820]
jmp 0x18006f001
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x18006f0c5
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1400b1f70]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x1400b1f80]
mov dword [rax], 1
mov rax, qword [0x1400b1f90]
mov dword [rax], 1
mov rax, qword [str._P_v_]
mov dword [rax], 1
mov rax, qword [0x1400b1e00]
cmp word [rax], 0x5a4d
jne 0x140001067
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010d0
mov rax, qword [0x1400b1f50]
mov dword [0x1400b5020], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010c0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x1400b1f10]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x1400b1ef0]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x1400b1d90]
cmp dword [rax], 1
je 0x140001108
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001084
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001120
cmp dx, 0x20b
jne 0x140001067
cmp dword [rax + 0x84], 0xe
jbe 0x140001067
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x140001067
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x140001067
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x140001067

Function at 0x140001d30
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sym.vfprintf
call sym.abort
nop
nop word [rax + rax]
Function at 0x140001da0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x50
movsxd rbx, dword [0x1400b50b4]
mov r12, rcx
test ebx, ebx
jle 0x140001ed0
mov rax, qword [0x1400b50b8]
xor ecx, ecx
add rax, 0x18
nop word [rax + rax]
mov rdx, qword [rax]
cmp rdx, r12
ja 0x140001dec
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x140001e73
add ecx, 1
add rax, 0x28
cmp ecx, ebx
jne 0x140001dd0
mov rcx, r12
call dbg.__mingw_GetSectionForAddress
mov rsi, rax
test rax, rax
je 0x140001ef2
mov rax, qword [0x1400b50b8]
lea rbx, [rbx + rbx*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rsi
mov dword [rax], 0
call dbg._GetPEImageBase
mov ecx, dword [rsi + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x1400b50b8]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140001ed7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140001e6c
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140001e80
add dword [0x1400b50b4], 1
add rsp, 0x50
pop rbx
pop rsi
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rbx, qword [0x1400b50b8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140001e6c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
nop dword [rax]
xor ebx, ebx
jmp 0x140001df7
mov rax, qword [0x1400b50b8]
mov edx, dword [rsi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call dbg.__report_error
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call dbg.__report_error
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x1400023b0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x1400b5120]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400b5100]
test rbx, rbx
je 0x140002404
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x1400023fb
test r12, r12
je 0x1400023fb
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1400023e0
lea rcx, [0x1400b5120]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140002620
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140002638
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x140002640
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret
Function at 0x140002650
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
mov r8, rdx
lea rdx, [rax + rcx]
movzx eax, word [rdx + 0x14]
lea rax, [rdx + rax + 0x18]
movzx edx, word [rdx + 6]
test edx, edx
je 0x14000269c
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov ecx, dword [rax + 0xc]
mov rdx, rcx
cmp rcx, r8
ja 0x140002693
add edx, dword [rax + 8]
cmp rdx, r8
ja 0x14000269e
add rax, 0x28
cmp rax, r9
jne 0x140002680
xor eax, eax
ret

Function at 0x1400026a0
Capabilities:
Parse pe header

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
call sym.strlen
cmp rax, 8
ja 0x140002730
mov rdx, qword [0x1400b1e00]
xor r12d, r12d
cmp word [rdx], 0x5a4d
jne 0x14000271e
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x14000271e
cmp word [rax + 0x18], 0x20b
jne 0x14000271e
movzx edx, word [rax + 0x14]
lea r12, [rax + rdx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x140002730
sub eax, 1
lea rax, [rax + rax*4]
lea rsi, [r12 + rax*8 + 0x28]
jmp 0x140002709
add r12, 0x28
cmp r12, rsi
je 0x140002730
mov r8d, 8
mov rdx, rbx
mov rcx, r12
call sym.strncmp
test eax, eax
jne 0x140002700
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret
xor r12d, r12d
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret

Function at 0x140002740
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1400b1e00]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140002760
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140002768
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002760
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x1400027b5
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1400027ac
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140002760
add rax, 0x28
cmp rax, r9
jne 0x140002798
xor eax, eax
ret

Function at 0x1400027c0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400b1e00]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x1400027e0
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400027e8
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x1400027e0
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x140002800
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x1400b1e00]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x140002820
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x140002828
ret
cmp word [rdx + 0x18], 0x20b
jne 0x140002820
movzx eax, word [rdx + 0x14]
lea rax, [rdx + rax + 0x18]
movzx edx, word [rdx + 6]
test edx, edx
je 0x140002868
sub edx, 1
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x14000285f
test rcx, rcx
je 0x140002820
sub rcx, 1
add rax, 0x28
cmp rax, rdx
jne 0x140002850
xor eax, eax
ret