joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14021f6c0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rbp
xor r8d, r8d
xor eax, eax
mov rbp, rsp
push r15
push r14
mov r14d, edx
push r13
shl r14, 2
mov r13, rcx
push r12
lea r12, [rcx + r14]
push rdi
push rsi
push rbx
lea rbx, [r12 + r14]
and rsp, 0xfffffffffffffff0
sub rsp, 0x820
lea rsi, [rsp + 0x20]
lea r11, [rsp + 0x420]
mov edx, dword [r13]
mov ecx, 0x100
mov rdi, rsi
mov r9, r13
rep stosq qword [rdi], rax
mov ecx, r8d
xor edi, edi
not edx
shr edx, cl
nop dword [rax]
mov r10d, edx
mov edx, dword [r9]
mov ecx, r8d
add r9, 4
not edx
shr edx, cl
movzx ecx, dl
xor r10d, edx
add dword [rsp + rcx*4 + 0x20], 1
movzx ecx, dh
or edi, r10d
mov ecx, ecx
add dword [rsp + rcx*4 + 0x420], 1
cmp r12, r9
jne 0x14021f720
mov rdx, rsi
xor r9d, r9d
xor ecx, ecx
nop dword [rax]
mov r10d, dword [rdx]
mov dword [rdx], ecx
add rdx, 4
add ecx, r10d
mov r10d, dword [rdx + 0x3fc]
mov dword [rdx + 0x3fc], r9d
add r9d, r10d
cmp r11, rdx
jne 0x14021f760
mov r9, r13
nop dword [rax]
mov r10d, dword [r9]
mov ecx, r8d
add r9, 4
mov edx, r10d
not edx
shr edx, cl
movzx edx, dl
mov ecx, dword [rsp + rdx*4 + 0x20]
lea r15d, [rcx + 1]
mov dword [r12 + rcx*4], r10d
mov dword [rsp + rdx*4 + 0x20], r15d
cmp r12, r9
jne 0x14021f788
cmp edi, 0xff
jbe 0x14021f817
mov r9, r12
nop dword [rax]
mov r10d, dword [r9]
mov ecx, r8d
add r9, 4
mov edx, r10d
not edx
shr edx, cl
movzx edx, dh
mov edx, edx
add rdx, 0x100
mov ecx, dword [rsp + rdx*4 + 0x20]
lea r15d, [rcx + 1]
mov dword [r13 + rcx*4], r10d
mov dword [rsp + rdx*4 + 0x20], r15d
cmp rbx, r9
jne 0x14021f7c0
add r8d, 0x10
shr edi, 0x10
jne 0x14021f6fe
lea rsp, [rbp - 0x38]
mov eax, 1
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov r8, r14
mov rdx, r12
mov rcx, r13
call sub.msvcrt.dll_memcpy
jmp 0x14021f801

Function at 0x14021f950
Capabilities:
Resume thread

Disassembly:
push r13
push r12
xor r12d, r12d
push rdi
push rsi
mov rsi, rcx
push rbx
xor ebx, ebx
sub rsp, 0x30
cmp dword [rsi + 4], ebx
jbe 0x14021f9b4
mov eax, ebx
mov r13, qword [rsi + rax*8 + 8]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ResumeThread]
inc eax
jne 0x14021f9a7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 5
je 0x14021f9a7
lea rdx, [rsp + 0x2c]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x14021f9a7
cmp dword [rsp + 0x2c], 0x103
cmove r12d, edi
mov rcx, r13
inc ebx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14021f963
add rsp, 0x30
mov eax, r12d
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
Function at 0x14021fa50
Capabilities:
Enumerate threads

Disassembly:
push r14
push r13
push r12
push rbp
mov rbp, rcx
push rdi
push rsi
mov rsi, rdx
push rbx
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, eax
mov rax, qword [rbp + 0x40]
test rax, rax
je 0x14021fb1a
mov r14d, dword [rax + 0xc0]
lea rbx, [rax + 0x100]
xor r13d, r13d
shl r14, 5
mov rax, qword [rbp + 0xb0]
add r14, rbx
test rax, rax
je 0x14021fab2
mov r13, qword [rax + 0x70]
jmp 0x14021fab2
mov eax, dword [rbx + 0x10]
cmp eax, dword [rbp + 0x94]
je 0x14021fab9
add rbx, 0x20
cmp rbx, r14
jb 0x14021faa3
jmp 0x14021faf4
mov rax, qword [rbx + 8]
test rax, rax
je 0x14021faae
mov rax, qword [rbx + 8]
cmp rax, rdi
je 0x14021faae
mov rax, qword [rbx + 8]
cmp rax, r13
je 0x14021faae
mov rdx, qword [rbx + 8]
mov rcx, rsi
call fcn.14021f440
mov r12d, eax
test eax, eax
je 0x14021faae
mov rcx, qword [rsi]
call fcn.14021f950
jmp 0x14021fbcb
test r13, r13
je 0x14021fafe
cmp r13, rdi
jne 0x14021fb06
xor r12d, r12d
jmp 0x14021fbcb
mov edx, r13d
mov rcx, rsi
call fcn.14021f440
mov r12d, eax
test eax, eax
je 0x14021fafe
jmp 0x14021fae7
xor edx, edx
mov ecx, 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r13, rax
cmp rax, 0xffffffffffffffff
jne 0x14021fb43
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
lea r14, [rsp + 0x24]
mov rcx, rax
mov dword [rsp + 0x24], 0x1c
mov rdx, r14
call sub.KERNEL32.dll_Thread32First
test eax, eax
jne 0x14021fb97
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, r13
mov r12d, ebx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsi]
call fcn.14021f950
jmp 0x14021fbcb
mov edx, dword [rsp + 0x2c]
cmp edi, edx
jne 0x14021fba5
mov rdx, r14
mov rcx, r13
call sub.KERNEL32.dll_Thread32Next
mov r12d, eax
test eax, eax
je 0x14021fbb5
mov eax, dword [rbp + 0x94]
cmp dword [rsp + 0x30], eax
je 0x14021fb7d
jmp 0x14021fb85
mov rcx, rsi
call fcn.14021f440
mov ebx, eax
test eax, eax
je 0x14021fb85
jmp 0x14021fb67
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0x12
jne 0x14021fb67
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x40
mov eax, r12d
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x14021fd60
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push rbp
xor eax, eax
mov rbp, rsp
push r14
push r13
push r12
push rdi
push rsi
push rbx
mov rbx, rcx
mov ecx, 8
mov rdi, rbx
sub rsp, 0x30
rep stosd dword [rdi], eax
mov eax, 0x57
test rdx, rdx
je 0x14021ff54
mov rsi, r8
mov r8d, 0x7fffffff
mov r12, rdx
mov r13d, r9d
call sub.msvcrt.dll_mbstowcs
mov rdi, rax
lea rax, [rax - 1]
cmp rax, 0x7ffe
jbe 0x14021fdbb
mov eax, 0x7b
jmp 0x14021ff54
lea r8, [rdi + 1]
lea rax, [r8 + r8]
add rax, 0xf
shr rax, 4
shl rax, 4
call fcn.140035990
sub rsp, rax
mov rdx, r12
lea r14, [rsp + 0x30]
mov rcx, r14
call sub.msvcrt.dll_mbstowcs
cmp rax, rdi
jne 0x14021fdb1
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14021fe46
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rdi
cmp eax, 2
jne 0x14021ff54
test r13w, r13w
je 0x14021ff54
mov edx, dword [rsi]
bt edx, 0x11
jb 0x14021ff54
bt edx, 0xe
jb 0x14021fe58
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14021fe58
call rdi
cmp eax, 0xb7
jne 0x14021ff54
jmp 0x14021fe58
mov edx, dword [rsi]
or dh, 0x40
test al, 0x10
lea ecx, [rdx - 0x4000]
cmovne edx, ecx
mov dword [rsi], edx
mov rcx, r12
call sub.msvcrt.dll_strlen
mov edi, dword [rsi]
mov qword [rbx + 0x18], rax
bt edi, 0xe
jae 0x14021fe9c
cmp rax, 8
jbe 0x14021fe9c
lea r13, [rax - 9]
mov r8d, 9
lea rcx, str._mdbx.dat
lea rdx, [r12 + r13]
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x14021fe9c
sub edi, 0x4000
mov dword [rsi], edi
mov qword [rbx + 0x18], r13
mov esi, dword [rsi]
mov r13, qword [rbx + 0x18]
and esi, 0x4000
lea rdx, [r13 + r13]
cmp esi, 1
sbb rax, rax
and eax, 0xe
lea rcx, [rax + rdx + 6]
call sub.msvcrt.dll_malloc
mov rcx, rax
mov qword [rbx], rax
mov eax, 0xe
test rcx, rcx
je 0x14021ff54
mov qword [rbx + 8], rcx
test esi, esi
je 0x14021ff09
lea rax, [rcx + r13 + 5]
lea r9, str._lck
mov r8, r12
mov qword [rbx + 0x10], rax
lea rdx, [0x1402b552c]
call fcn.14021fd30
mov rcx, qword [rbx + 0x10]
mov rdx, r12
call sub.msvcrt.dll_strcpy
jmp 0x14021ff52
lea rax, [rcx + r13 + 0xa]
mov r8d, r13d
lea r13, [0x1402b5531]
mov r9, r12
mov qword [rbx + 0x10], rax
lea rax, str._mdbx.lck
mov rdx, r13
mov qword [rsp + 0x20], rax
call fcn.14021fd30
mov rcx, qword [rbx + 0x10]
mov r8d, dword [rbx + 0x18]
mov r9, r12
lea rax, str._mdbx.dat
mov rdx, r13
mov qword [rsp + 0x20], rax
call fcn.14021fd30
xor eax, eax
lea rsp, [rbp - 0x30]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop rbp
ret
Function at 0x14021ff70
Capabilities:
Set file attributes

Disassembly:
push rbp
mov rbp, rsp
push r15
mov r15, r8
mov r8d, 0x7fffffff
push r14
push r13
push r12
push rdi
mov rdi, rdx
mov rdx, r15
push rsi
mov rsi, r9
push rbx
mov ebx, ecx
xor ecx, ecx
sub rsp, 0x88
mov r12d, dword [rbp + 0x30]
mov qword [r9], 0xffffffffffffffff
call sub.msvcrt.dll_mbstowcs
mov r13, rax
dec rax
cmp rax, 0x7ffe
jbe 0x14021ffc5
mov r12d, 0x7b
jmp 0x14022011e
lea r8, [r13 + 1]
lea rax, [r8 + r8]
add rax, 0xf
shr rax, 4
shl rax, 4
call fcn.140035990
sub rsp, rax
mov rdx, r15
lea r14, [rsp + 0x40]
mov rcx, r14
call sub.msvcrt.dll_mbstowcs
cmp rax, r13
jne 0x14021ffba
mov edx, dword [rdi + 4]
cmp r12w, 1
sbb eax, eax
and edx, 0x400000
add eax, 4
cmp edx, 1
sbb r8d, r8d
dec ebx
and r8d, 3
cmp ebx, 4
ja case.default.0x140220028
lea rcx, [0x1402b5538]
movsxd rdx, dword [rcx + rbx*4]
add rdx, rcx
jmp rdx
mov edx, 0xc0000080
mov ebx, 0x1002000
jmp 0x1402200a6
or r8d, 1
mov edx, 0x80000080
mov ebx, 0x1002000
mov eax, 3
jmp 0x1402200a6
mov edx, 0x40000080
mov ebx, 0x81002000
mov eax, 3
jmp 0x1402200a6
mov eax, dword [rdi + 0x88]
xor ebx, ebx
cmp dword [rdi + 0x78], eax
mov edx, 0x40000080
setae bl
mov eax, 1
xor r8d, r8d
shl ebx, 0x1d
or ebx, 0x1002000
jmp 0x1402200a6
or r8d, 4
mov edx, 0x110180
mov ebx, 0x1002000
mov eax, 3
jmp 0x1402200a6
mov edx, 0xc0000080
mov ebx, 0x1002102
mov eax, 4
mov rcx, r14
mov dword [rsp + 0x28], ebx
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsi], rax
mov rcx, rax
cmp rax, 0xffffffffffffffff
jne 0x1402200da
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
jmp 0x14022011e
lea rdx, [rbp - 0x74]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x140220103
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsi]
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi], 0xffffffffffffffff
jmp 0x14022011e
mov edx, dword [rbp - 0x74]
xor r12d, r12d
xor ebx, edx
and ebx, 0x2902
je 0x14022011e
xor edx, ebx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rsp, [rbp - 0x38]
mov eax, r12d
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x140220140
Capabilities:
Get disk information

Disassembly:
push r14
mov r14, rcx
push r13
push r12
push rsi
push rbx
mov ebx, edx
sub rsp, 0x1e0
cmp qword [0x1403ef488], 0
jne 0x14022016e
bt edx, 0x16
mov r12d, 0x307
jae 0x1402203ee
mov rcx, r14
mov r12d, 0x10fe
call qword [sym.imp.KERNEL32.dll_GetFileType]
dec eax
jne 0x1402203ee
mov rax, qword [0x1403ef4c0]
test rax, rax
je 0x1402201d5
mov r9d, 0x74
lea r8, [rsp + 0x60]
mov edx, 0xd
mov rcx, r14
call rax
test eax, eax
je 0x1402201d5
mov eax, dword [rsp + 0x70]
test al, 2
je 0x1402201bc
bt ebx, 0x11
jae 0x1402203ee
mov edx, ebx
and eax, 1
mov r12d, 0x1100
and edx, 0x400000
or edx, eax
je 0x1402203ee
mov rax, qword [0x1403ef4a0]
test rax, rax
je 0x140220267
lea rdx, [rsp + 0x60]
mov rcx, r14
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], rdx
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rdx
xor edx, edx
mov dword [rsp + 0x48], 0x180
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x90310
call rax
mov ecx, eax
test eax, eax
js 0x14022023e
bt ebx, 0x16
mov r12d, 0x1100
jb 0x140220267
jmp 0x1402203ee
cmp eax, 0xc000046d
setne dl
cmp eax, 0xc0000010
setne al
test dl, al
je 0x140220267
cmp ecx, 0xc00000bb
je 0x140220267
call fcn.14021f890
mov r12d, eax
jmp 0x1402203ee
mov rsi, qword [0x1403ef4b8]
xor r12d, r12d
test rsi, rsi
je 0x1402203ee
cmp qword [0x1403ef4b0], 0
je 0x1402203ee
mov ecx, 0xfffe
mov r12d, 0xe
call sub.msvcrt.dll_malloc
mov r13, rax
test rax, rax
je 0x1402203ee
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x50]
mov rdx, r13
mov rcx, r14
mov dword [rsp + 0x38], 0
mov r8d, 0x7fff
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
call rsi
test eax, eax
je 0x14022030f
mov esi, ebx
and esi, 0x20000
jne 0x1402202f3
test dword [rsp + 0x60], 0x188000
jne 0x140220345
mov r9d, 2
mov r8d, 0x7fff
mov rdx, r13
mov rcx, r14
call qword [0x1403ef4b0]
test eax, eax
jne 0x14022031d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
jmp 0x1402203e6
mov r12, qword [sym.imp.msvcrt.dll__wcsnicmp]
mov r8d, 0xc
lea rdx, str.DeviceMup_
mov rcx, r13
call r12
test eax, eax
jne 0x140220350
bt ebx, 0x16
jb 0x1402203cb
mov r12d, 0x1100
jmp 0x1402203e6
xor r9d, r9d
mov r8d, 0x7fff
mov rdx, r13
mov rcx, r14
call qword [0x1403ef4b0]
test eax, eax
je 0x1402203cb
mov r14, qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov rcx, r13
call r14
cmp eax, 1
jne 0x1402203b8
mov r8d, 4
lea rdx, [0x1402b5566]
mov rcx, r13
call r12
test eax, eax
jne 0x14022033b
lea rcx, [r13 + 0xa]
mov r8d, 2
lea rdx, [0x1402b5570]
call r12
test eax, eax
jne 0x14022033b
mov word [r13 + 0xe], 0
lea rcx, [r13 + 8]
call r14
cmp eax, 5
je 0x1402203dd
ja 0x1402203d0
sub eax, 2
cmp eax, 1
ja 0x14022033b
xor r12d, r12d
jmp 0x1402203e6
xor r12d, r12d
cmp eax, 6
je 0x1402203e6
jmp 0x14022033b
test esi, esi
jne 0x1402203cb
jmp 0x14022033b
mov rcx, r13
call sub.msvcrt.dll_free
add rsp, 0x1e0
mov eax, r12d
pop rbx
pop rsi
pop r12
pop r13
pop r14
ret
Function at 0x140220650
Capabilities:
Clear file content

Disassembly:
push r12
mov r12, rcx
sub rsp, 0x30
mov rax, qword [0x1403ef4a8]
test rax, rax
je 0x14022068e
mov qword [rsp + 0x28], rdx
lea r8, [rsp + 0x28]
mov r9d, 8
mov edx, 6
call rax
mov r8d, eax
xor eax, eax
test r8d, r8d
jne 0x1402206b9
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1402206b9
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x1402206aa
add rsp, 0x30
pop r12
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x14022069e
xor eax, eax
add rsp, 0x30
pop r12
ret
Function at 0x140220bd0
Capabilities:
Map section object

Disassembly:
push rbp
xorps xmm0, xmm0
mov rbp, rsp
push r14
mov r14, r9
push r13
push r12
push rdi
mov rdi, r8
push rsi
mov esi, ecx
push rbx
mov rbx, rdx
and rsp, 0xfffffffffffffff0
sub rsp, 0x60
mov qword [rdx], 0
mov rcx, qword [rdx + 8]
mov qword [rdx + 0x20], 0
mov qword [rdx + 0x28], 0
movups xmmword [rdx + 0x10], xmm0
mov edx, esi
call fcn.140220140
mov r12d, eax
test eax, eax
jne 0x140220d67
mov r13d, esi
mov rcx, qword [rbx + 8]
and r13d, 0x20000
jne 0x140220c50
test byte [rbp + 0x30], 1
je 0x140220c50
mov rdx, rdi
call fcn.140220650
test eax, eax
jne 0x140220d64
mov qword [rbx + 0x20], rdi
jmp 0x140220c61
lea rdx, [rbx + 0x20]
call fcn.14021f8e0
test eax, eax
jne 0x140220d64
cmp r13d, 1
mov r8, qword [rbx + 8]
lea rcx, [rbx + 0x28]
mov dword [rsp + 0x28], 0x4000000
sbb eax, eax
and esi, 0x80000
lea r9, [rsp + 0x50]
mov qword [rsp + 0x50], rdi
and eax, 2
mov qword [rsp + 0x30], r8
add eax, 2
cmp esi, 1
sbb edx, edx
mov dword [rsp + 0x20], eax
xor r8d, r8d
and edx, 0xfffffffe
add edx, 0x17
call sub.ntdll.dll_NtCreateSection
mov ecx, eax
test eax, eax
js 0x140220d49
test r13d, r13d
jne 0x140220cc6
cmp qword [0x1403ef488], 0
cmovne rdi, r14
jmp 0x140220cc8
xor edi, edi
cmp esi, 1
mov qword [rsp + 0x58], rdi
sbb esi, esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
and esi, 0xfffffffe
mov rcx, qword [rbx + 0x28]
mov r8, rbx
add esi, 4
mov rdx, rax
xor eax, eax
test r13d, r13d
sete al
mov dword [rsp + 0x48], esi
xor r9d, r9d
shl eax, 0xd
mov dword [rsp + 0x38], 2
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call sub.ntdll.dll_NtMapViewOfSection
mov r13d, eax
test eax, eax
jns 0x140220d53
mov rcx, qword [rbx + 0x28]
call sub.ntdll.dll_NtClose
mov qword [rbx + 0x28], 0
mov ecx, r13d
mov qword [rbx], 0
call fcn.14021f890
mov r12d, eax
jmp 0x140220d67
movq xmm0, qword [rsp + 0x58]
movhps xmm0, qword [rsp + 0x50]
movups xmmword [rbx + 0x10], xmm0
jmp 0x140220d67
mov r12d, eax
lea rsp, [rbp - 0x30]
mov eax, r12d
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop rbp
ret

Function at 0x140220e90
Capabilities:
Read file on windows

Disassembly:
push rbx
mov rbx, r8
sub rsp, 0x60
lea rax, [rsp + 0x40]
mov dword [rsp + 0x50], r9d
lea r9, [rsp + 0x3c]
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x54], 0
mov dword [rsp + 0x3c], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140220ee0
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140220ef4
mov eax, 0x1e
jmp 0x140220ef4
mov eax, dword [rsp + 0x3c]
mov edx, 0x26
cmp rax, rbx
mov eax, 0
cmovne eax, edx
add rsp, 0x60
pop rbx
ret
Function at 0x140220f00
Capabilities:
Query or enumerate registry value

Disassembly:
push r14
mov r14, rdx
push r13
mov r13, rcx
push r12
push rsi
mov rsi, r9
push rbx
mov rbx, r8
sub rsp, 0x50
mov rax, qword [0x1403ef480]
test rax, rax
jne 0x140220f75
mov rdx, rcx
lea r8, [rsp + 0x48]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov r12d, eax
test eax, eax
jne 0x140221008
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x28], rsi
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x48]
mov r12d, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140221008
mov qword [rsp + 0x30], r9
mov r9d, 0xffff
mov qword [rsp + 0x28], r8
mov r8, rdx
mov rdx, rcx
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], 0
call rax
mov r12d, eax
cmp eax, 2
jne 0x140221008
mov qword [rsp + 0x30], rsi
mov r9d, 0x1ffff
mov r8, r14
mov rdx, r13
mov qword [rsp + 0x28], rbx
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], 0
call qword [0x1403ef480]
mov r12d, eax
cmp eax, 2
jne 0x140221008
mov qword [rsp + 0x30], rsi
mov r9d, 0x2ffff
mov r8, r14
mov rdx, r13
mov qword [rsp + 0x28], rbx
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], 0
call qword [0x1403ef480]
mov r12d, eax
add rsp, 0x50
mov eax, r12d
pop rbx
pop rsi
pop r12
pop r13
pop r14
ret
Function at 0x140221590
Capabilities:
Print debug messages

Disassembly:
push r13
mov r13, r9
push r12
mov r12, rdx
push rsi
push rbx
mov ebx, r8d
sub rsp, 0x38
mov rax, qword [0x1403eea20]
mov rsi, qword [rsp + 0x80]
test rax, rax
je 0x1402215c3
add rsp, 0x38
pop rbx
pop rsi
pop r12
pop r13
jmp rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140221690
mov qword [rsp + 0x20], 0
test r12, r12
je 0x140221617
test ebx, ebx
jle 0x1402215fc
lea rcx, [rsp + 0x20]
mov r9d, ebx
mov r8, r12
lea rdx, str._s:_d
call fcn.140221560
jmp 0x14022162f
test r12, r12
je 0x140221617
lea rcx, [rsp + 0x20]
mov r8, r12
lea rdx, [0x1402b55aa]
call fcn.140221560
jmp 0x14022162f
test ebx, ebx
jle 0x14022164e
lea rcx, [rsp + 0x20]
mov r8d, ebx
lea rdx, str._d:
call fcn.140221560
test eax, eax
jle 0x14022164e
mov r12, qword [rsp + 0x20]
test r12, r12
je 0x14022164e
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, r12
call sub.msvcrt.dll_free
lea rcx, [rsp + 0x28]
mov r8, rsi
mov rdx, r13
mov qword [rsp + 0x28], 0
call fcn.14021f280
test eax, eax
jle 0x140221690
mov r12, qword [rsp + 0x28]
test r12, r12
je 0x140221690
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add rsp, 0x38
mov rcx, r12
pop rbx
pop rsi
pop r12
pop r13
jmp sub.msvcrt.dll_free
add rsp, 0x38
pop rbx
pop rsi
pop r12
pop r13
ret

Function at 0x140222670
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x48
cmp qword [0x1403eea20], 0
je 0x140222693
mov qword [rsp + 0x20], rcx
lea r9, str.assert:__s_n
xor ecx, ecx
call fcn.1402216a0
jmp 0x1402226fa
mov qword [rsp + 0x38], 0
test rdx, rdx
jne 0x1402226a8
lea rdx, [0x1402b5d76]
mov dword [rsp + 0x20], r8d
lea r10, [rsp + 0x38]
mov r9, rdx
mov r8, rcx
lea rdx, str._r_nMDBX_ASSERTION:__s___s:_u
mov rcx, r10
call fcn.140221560
test eax, eax
jle 0x1402226d3
cmp qword [rsp + 0x38], 0
jne 0x1402226df
lea rax, str._troubles_with_assertion_message_preparation_
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1402226fa
call qword [sym.imp.KERNEL32.dll_DebugBreak]
or ecx, 0xffffffff
add rsp, 0x48
jmp qword [sym.imp.KERNEL32.dll_FatalExit]

Function at 0x140222710
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsFree]
test eax, eax
jne 0x14022273b
mov r8d, 0x124e
lea rdx, str.thread_key_delete
lea rcx, str.TlsFree_key_
add rsp, 0x28
jmp fcn.140222670
add rsp, 0x28
ret

Function at 0x140222970
Capabilities:
Print debug messages

Disassembly:
mov r8d, 0x125f
lea rdx, str.thread_rthc_set
lea rcx, str.TlsSetValue_key___void__value_
jmp fcn.140222670
Function at 0x140223640
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rax, rcx
mov rbp, rsp
push r13
push r12
push rdi
push rsi
mov esi, r9d
push rbx
mov ebx, r8d
and rsp, 0xfffffffffffffff0
sub rsp, 0x430
mov r12, qword [rcx + 0x40]
mov rax, qword [rax + 0x30]
movzx ecx, byte [r12 + 0x80]
cmp qword [rdx], rax
jb 0x1402236bc
mov r8d, r9d
mov al, 0xff
mov rdi, rdx
shl r8, cl
mov rcx, r8
rep stosb byte [rdi], al
mov dword [rdx + 0x10], ebx
test byte [r12 + 6], 8
jne 0x140223768
movzx ecx, byte [r12 + 0x80]
mov r10, qword [r12 + 0x10]
mov r9d, ebx
lea rsp, [rbp - 0x28]
pop rbx
pop rsi
shl r9, cl
pop rdi
mov rcx, r10
pop r12
pop r13
pop rbp
jmp fcn.14021f310
mov eax, dword [r12 + 0x78]
shl rbx, cl
mov r8d, 1
lea r13, [rsp + 0x30]
mov edi, 0x40
mov qword [rsp + 0x38], rax
add rax, qword [r12 + 0xa8]
mov qword [rsp + 0x30], rax
dec esi
mov eax, r8d
je 0x140223742
movaps xmm0, xmmword [rsp + 0x30]
shl rax, 4
inc r8d
movaps xmmword [rsp + rax + 0x30], xmm0
cmp r8d, 0x40
jne 0x1402236e6
mov rax, rdi
mov r10, qword [r12 + 0x10]
mov r9, rbx
mov rdx, r13
movzx ecx, byte [r12 + 0x80]
shl rax, cl
mov rcx, r10
mov qword [rsp + 0x20], rax
call fcn.140140640
mov rax, rdi
xor r8d, r8d
movzx ecx, byte [r12 + 0x80]
shl rax, cl
add rbx, rax
jmp 0x1402236e6
mov r10, qword [r12 + 0x10]
lea rdx, [rsp + 0x30]
mov r9, rbx
movzx ecx, byte [r12 + 0x80]
shl rax, cl
mov rcx, r10
mov qword [rsp + 0x20], rax
call fcn.140140640
lea rsp, [rbp - 0x28]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop rbp
ret
Function at 0x140224b90
Capabilities:
Allocate thread local storage

Disassembly:
push r15
push r14
mov r14, rcx
push r13
push r12
mov r12, rdx
push rbp
mov rbp, r8
push rdi
push rsi
push rbx
sub rsp, 0x38
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [r14], eax
inc eax
je 0x140224be0
lea r13, [0x1403ef440]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x1403ef3ec]
mov r10d, dword [0x1403ef3e8]
mov r9d, dword [r14]
mov r15, rbx
cmp ebx, r10d
jne 0x140224c49
jmp 0x140224bf0
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140224c90
jmp 0x140224bb6
mov rsi, qword [0x1403ef3e0]
xor ecx, ecx
imul rdx, rbx, 0x30
mov dword [rsp + 0x2c], r9d
lea rdi, [0x1403ef260]
mov dword [rsp + 0x28], r10d
cmp rsi, rdi
cmovne rcx, rsi
call sub.msvcrt.dll_realloc
test rax, rax
je 0x140224c7a
cmp rsi, rdi
mov r10d, dword [rsp + 0x28]
mov r9d, dword [rsp + 0x2c]
jne 0x140224c38
mov ecx, 0x60
mov rdi, rax
rep movsd dword [rdi], dword [rsi]
add r10d, r10d
mov qword [0x1403ef3e0], rax
mov dword [0x1403ef3e8], r10d
imul rax, rbx, 0x18
inc r15d
add rax, qword [0x1403ef3e0]
mov rcx, r13
mov byte [rax + 0x14], 1
mov dword [rax + 0x10], r9d
mov qword [rax], r12
mov qword [rax + 8], rbp
mov dword [0x1403ef3ec], r15d
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
jmp 0x140224c90
mov ecx, dword [r14]
call fcn.140222710
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 0xe
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140225e50
Capabilities:
Print debug messages

Disassembly:
push r12
mov r10, rcx
lea r12, str._troubles_with_panic_message_preparation_
push rbx
sub rsp, 0x38
mov qword [rsp + 0x58], rdx
lea rcx, [rsp + 0x28]
mov rdx, r10
mov qword [rsp + 0x60], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x28], 0
call fcn.14021f280
test eax, eax
jle 0x140225ea5
mov r12, qword [rsp + 0x28]
test r12, r12
jne 0x140225ea5
lea r12, str._troubles_with_panic_message_preparation_
lea rcx, str._r_nMDBX_PANIC:
mov rbx, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rbx
mov rcx, r12
call rbx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140225eca
call qword [sym.imp.KERNEL32.dll_DebugBreak]
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_FatalExit]