joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140007700
Capabilities:
Get file size

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x68
mov rbx, rdx
mov edx, 1
call fcn.140006d10
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x1400077b0
mov qword [rsp + 0x50], 0
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x58], 0
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r13d, eax
mov dword [rbx], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, r13d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x40], 0
mov r13, rax
mov eax, dword [rbx]
mov rcx, r12
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
call fcn.14000802f
mov rcx, r12
mov esi, eax
call fcn.14000804d
test esi, esi
js 0x1400077c8
mov rax, r13
add rsp, 0x68
pop rbx
pop rsi
pop r12
pop r13
ret
xor r13d, r13d
mov rax, r13
add rsp, 0x68
pop rbx
pop rsi
pop r12
pop r13
ret
xor r13d, r13d
mov dword [rbx], 0
mov rax, r13
add rsp, 0x68
pop rbx
pop rsi
pop r12
pop r13
ret

Function at 0x140007aa0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x58], rdx
mov rbx, r8
xor edx, edx
test rcx, rcx
je 0x140007ad4
cmp word [rcx], 0x5a4d
jne 0x140007ad4
movsxd rax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x140007ad4
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140007ad4
mov edx, dword [rcx + 0x28]
add rdx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.1400079e0
test eax, eax
jne 0x140007af0
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov rcx, rbx
call fcn.140007a50
test rax, rax
je 0x140007ae5
lea rdx, [rax + 0x10]
lea rax, [rsp + 0x38]
mov rcx, qword [rbx]
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x58]
mov qword [rsp + 0x38], 0
call fcn.1400080c5
not eax
shr eax, 0x1f
add rsp, 0x40
pop rbx
ret
Function at 0x140007bc0
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rdi
push rbx
sub rsp, 0x4a8
xor eax, eax
mov r14, rcx
mov ecx, 0x41
mov r12d, r8d
mov r13, rdx
lea rdi, [rsp + 0x80]
lea r15, [rsp + 0x80]
mov rbx, r9
rep stosq qword [rdi], rax
lea rdi, [rsp + 0x290]
mov ecx, 0x41
rep stosq qword [rdi], rax
lea rdi, [rsp + 0x290]
mov ecx, 0x104
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov r9, r15
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov r8d, r12d
mov rdx, r13
mov rcx, r15
call fcn.140007870
mov r12, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
jbe 0x140007c68
mov rax, 0xffffffffffffffff
add rsp, 0x4a8
pop rbx
pop rdi
pop r12
pop r13
pop r14
pop r15
ret
lea rdi, [rsp + 0x60]
mov rdx, r14
mov r9d, 0x800000c
mov r8, rbx
mov rcx, rdi
call fcn.140005b30
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xffffffffffffffff
je 0x140007c49
lea rax, [rsp + 0x50]
xor r9d, r9d
lea r8, [rsp + 0x58]
mov rcx, r12
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
call fcn.14000805c
test eax, eax
je 0x140007cf1
cmp eax, 0x40000003
jne 0x140007c49
mov rdx, qword [rsp + 0x58]
test rdx, rdx
je 0x140007c49
mov r8, rdi
mov rcx, r13
call fcn.140007aa0
test al, al
je 0x140007c49
mov rcx, qword [rsp + 0x68]
xor edx, edx
call fcn.140008098
mov rax, qword [rsp + 0x60]
jmp 0x140007c50
Function at 0x140007d30
Capabilities:
Access peb ldr_data
Get ntdll base address
Populate syswhispers2 syscall list
Resolve function by parsing pe exports

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov r8, qword [rax + 0x10]
mov rcx, qword [r8 + 0x30]
test rcx, rcx
je 0x140007f01
xor r10d, r10d
nop dword [rax]
mov rdx, rcx
movsxd rcx, dword [rcx + 0x3c]
mov eax, dword [rdx + rcx + 0x88]
test eax, eax
je 0x140007d9f
lea r10, [rdx + rax]
mov ecx, dword [r10 + 0xc]
add rcx, rdx
mov r9d, dword [rcx]
or r9d, 0x20202020
cmp r9d, 0x6c64746e
jne 0x140007d9f
mov eax, dword [rcx + 4]
or eax, 0x20202020
cmp eax, 0x6c642e6c
je 0x140007db4
mov r8, qword [r8]
mov rcx, qword [r8 + 0x30]
test rcx, rcx
jne 0x140007d60
test r10, r10
je 0x140007f01
mov eax, dword [r10 + 0x18]
mov edi, dword [r10 + 0x24]
xor esi, esi
lea r12, [0x1403ed584]
mov ebp, dword [r10 + 0x1c]
lea ecx, [rax - 1]
mov eax, dword [r10 + 0x20]
add rdi, rdx
add rbp, rdx
lea r11, [rdi + rcx*2]
add rax, rdx
lea rbx, [rax + rcx*4]
jmp 0x140007dfc
sub rbx, 4
lea rax, [r11 - 2]
cmp rdi, r11
je 0x140007e80
mov r11, rax
mov eax, dword [rbx]
add rax, rdx
cmp word [rax], 0x775a
jne 0x140007de8
mov ecx, esi
cmp byte [rax], 0
lea r13, [r12 + rcx*8]
je 0x140007ef6
cmp byte [rax + 1], 0
mov r8d, 0x415c7c7f
je 0x140007e4e
mov r9d, 1
mov ecx, 1
nop
mov r10d, r8d
movzx ecx, word [rax + rcx]
add r9d, 1
ror r10d, 8
add ecx, r10d
xor r8d, ecx
mov ecx, r9d
cmp byte [rax + rcx], 0
jne 0x140007e30
movzx eax, word [r11]
mov dword [r13], r8d
add esi, 1
mov eax, dword [rbp + rax*4]
mov dword [r13 + 4], eax
cmp esi, 0x1f4
jne 0x140007de8
mov dword [0x1403ed580], 0x1f4
mov ebx, 0x1f3
jmp 0x140007e8d
mov dword [0x1403ed580], esi
sub esi, 1
mov ebx, esi
je 0x140007ee8
xor r11d, r11d
lea edi, [rbx - 1]
lea rsi, [0x1403ed58c]
nop word [rax + rax]
cmp ebx, r11d
je 0x140007edf
mov edx, edi
lea rax, [0x1403ed584]
sub edx, r11d
lea r8, [rsi + rdx*8]
nop dword [rax]
mov edx, dword [rax + 4]
mov ecx, dword [rax + 0xc]
cmp edx, ecx
jbe 0x140007ed6
mov r9d, dword [rax]
mov r10d, dword [rax + 8]
mov dword [rax + 4], ecx
mov dword [rax + 0xc], edx
mov dword [rax], r10d
mov dword [rax + 8], r9d
add rax, 8
cmp r8, rax
jne 0x140007eb8
add r11d, 1
cmp ebx, r11d
ja 0x140007ea0
mov eax, 1
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov r8d, 0xfba06bba
jmp 0x140007e4e
xor eax, eax
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret

Function at 0x140007fc0
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, dword [0x1403ee540]
call fcn.140007f60
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret
Function at 0x140011990
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140025090
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.140025090
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]

Function at 0x140011a00
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x50
movsxd rbx, dword [0x1403fd0f4]
mov r12, rcx
test ebx, ebx
jle 0x140011b30
mov rax, qword [0x1403fd0f8]
xor ecx, ecx
add rax, 0x18
nop word [rax + rax]
mov rdx, qword [rax]
cmp rdx, r12
ja 0x140011a4c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x140011ad3
add ecx, 1
add rax, 0x28
cmp ecx, ebx
jne 0x140011a30
mov rcx, r12
call fcn.140012700
mov rsi, rax
test rax, rax
je 0x140011b52
mov rax, qword [0x1403fd0f8]
lea rbx, [rbx + rbx*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rsi
mov dword [rax], 0
call fcn.140012830
mov ecx, dword [rsi + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x1403fd0f8]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140011b37
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140011acc
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140011ae0
add dword [0x1403fd0f4], 1
add rsp, 0x50
pop rbx
pop rsi
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rbx, qword [0x1403fd0f8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140011acc
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140011990
nop dword [rax]
xor ebx, ebx
jmp 0x140011a57
mov rax, qword [0x1403fd0f8]
mov edx, dword [rsi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140011990
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.140011990
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140012010
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x1403fd160]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1403fd140]
test rbx, rbx
je 0x140012064
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x14001205b
test r12, r12
je 0x14001205b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140012040
lea rcx, [0x1403fd160]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x140012700
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1403f2bd0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140012720
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140012728
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140012720
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x140012775
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x14001276c
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140012720
add rax, 0x28
cmp rax, r9
jne 0x140012758
xor eax, eax
ret

Function at 0x140012780
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1403f2bd0]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x1400127a0
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400127a8
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x1400127a0
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x140012830
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1403f2bd0]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x140012850
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x140012858
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret

Function at 0x140012a00
Capabilities:
Print debug messages

Disassembly:
push r12
push rbx
sub rsp, 0x58
mov r12, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140012a20
add rsp, 0x58
pop rbx
pop r12
ret
lea rdx, [rsp + 0x48]
mov r9d, 0x400
mov r8d, eax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rdx
mov ecx, 0x1100
xor edx, edx
mov dword [rsp + 0x28], 0
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
jne 0x140012a68
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140012a14
int3
mov rcx, qword [rsp + 0x48]
mov rbx, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rbx
mov rcx, r12
call rbx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140012a55
Function at 0x140012b80
Capabilities:
Check mutex on windows

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x30
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [0x1403fd2d0]
mov dword [rsp + 0x2c], eax
lea rcx, [rsp + 0x2c]
lea r9, [rsp + 0x30]
movzx eax, byte [rcx]
add rcx, 1
add rdx, 2
mov r8d, eax
and eax, 0xf
shr r8b, 4
add eax, 0x61
add r8d, 0x41
mov byte [rdx - 1], al
mov byte [rdx - 2], r8b
cmp rcx, r9
jne 0x140012ba3
lea rax, [0x1403fd2d8]
mov ecx, 0x5f
lea rdx, str.__eh_shmem3_gcc_tdm_
lea r8, [rax + 0x15]
jmp 0x140012beb
movzx ecx, byte [rdx]
add rax, 1
add rdx, 1
mov byte [rax - 1], cl
cmp rax, r8
jne 0x140012be8
lea rax, [0x1403fd300]
mov ecx, 0x5f
lea rdx, str.__eh_shmem3_gcc_tdm_
lea r8, [rax + 0x14]
jmp 0x140012c1b
movzx ecx, byte [rdx]
add rax, 1
add rdx, 1
mov byte [rax - 1], cl
cmp rax, r8
jne 0x140012c18
xor ecx, ecx
mov byte [0x1403fd314], 0x2d
movabs rax, 0x6161616161616161
movabs rdx, 0x6161616161616161
mov qword [0x1403fd31d], rdx
lea r8, [0x1403fd2d0]
lea rbx, [0x1403fd315]
mov qword [0x1403fd32d], rdx
mov qword [0x1403fd33d], rdx
mov qword [0x1403fd34d], rdx
xor edx, edx
mov qword [0x1403fd315], rax
mov qword [0x1403fd325], rax
mov qword [0x1403fd335], rax
mov qword [0x1403fd345], rax
mov byte [0x1403fd355], 0
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edx, 0xffffffff
mov r12, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140012df6
lea rcx, [0x1403fd300]
call qword [sym.imp.KERNEL32.dll_FindAtomA]
test ax, ax
jne 0x140012d41
lea rsi, [0x1403fd240]
lea r8, [0x1403fd355]
mov rax, rbx
lea ecx, [rbx + 0x40]
nop dword [rax]
mov edx, ecx
sub edx, eax
bt rsi, rdx
jae 0x140012ced
mov byte [rax], 0x41
add rax, 1
cmp r8, rax
jne 0x140012ce0
lea rcx, [0x1403fd300]
call qword [sym.imp.KERNEL32.dll_AddAtomA]
test ax, ax
je 0x140012de3
lea rcx, [0x140012a90]
mov qword [0x1403fd240], rsi
call sub.msvcrt.dll__onexit
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x1403fd240]
add rsp, 0x30
pop rbx
pop rsi
pop r12
ret
mov r8d, 0x56
lea rdx, [0x1403fd300]
movzx ecx, ax
call qword [sym.imp.KERNEL32.dll_GetAtomNameA]
lea r8, [0x1403fd355]
xor edx, edx
lea r10d, [rbx + 0x40]
mov r11d, eax
mov r9d, 1
mov rax, rbx
test r11d, r11d
je 0x140012e16
nop dword [rax]
cmp byte [rax], 0x41
jne 0x140012d93
mov ecx, r10d
mov rbx, r9
sub ecx, eax
shl rbx, cl
or rdx, rbx
add rax, 1
cmp r8, rax
jne 0x140012d80
mov rax, rdx
mov qword [0x1403fd240], rax
lea rsi, [0x1403fd240]
jmp 0x140012db9
cmp rdx, rsi
je 0x140012d1f
mov rdx, rax
mov rax, qword [rax + 8]
test rax, rax
jne 0x140012db0
cmp rdx, rsi
je 0x140012d1f
mov qword [rdx + 8], rsi
lea rcx, [0x140012a90]
call sub.msvcrt.dll__onexit
jmp 0x140012d1f
lea rcx, [0x1403f2130]
call fcn.140012a00
xor eax, eax
jmp 0x140012d38
lea rcx, [0x1403f2108]
call fcn.140012a00
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop r12
ret
lea rcx, [0x1403f2158]
call fcn.140012a00
xor eax, eax
jmp 0x140012d9f
Function at 0x1400154a0
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, qword [0x1403f2c60]
mov rax, qword [rsi]
test rax, rax
je 0x140015530
cmp qword [rax + 0x30], 0
jne 0x140015550
lea rbx, [0x1403ee5d8]
mov qword [rax + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [rbx], eax
mov rax, qword [rsi]
test rax, rax
je 0x140015500
cmp qword [rax + 0x30], 0
jne 0x140015520
lea rdx, [0x1403ee5d8]
mov qword [rax + 0x30], rdx
mov rax, rdx
cmp dword [rax], 0xffffffff
je 0x140035c50
add rsp, 0x28
pop rbx
pop rsi
ret
call fcn.14001a3a0
mov r8, rax
mov rax, qword [rsi]
cmp qword [r8 + 0x30], 0
je 0x1400154e2
test rax, rax
jne 0x140015520
call fcn.14001a3a0
nop dword [rax]
mov rax, qword [rax + 0x30]
jmp 0x1400154f0
call fcn.14001a3a0
cmp qword [rax + 0x30], 0
mov rax, qword [rsi]
je 0x1400154c0
test rax, rax
jne 0x140015550
call fcn.14001a3a0
nop dword [rax]
mov rbx, qword [rax + 0x30]
jmp 0x1400154cb
call sub.msvcrt.dll_abort
nop

Function at 0x140015560
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x98
movabs rax, 0x6c6320726f727245
movabs rdx, 0x7520676e696e6165
mov qword [rsp + 0x20], rax
movabs rax, 0x6b5f6e6970732070
mov qword [rsp + 0x28], rdx
movabs rdx, 0x20726f6620737965
mov qword [rsp + 0x30], rax
movabs rax, 0x20646165726874
mov qword [rsp + 0x38], rdx
xor edx, edx
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0
mov word [rsp + 0x88], ax
mov byte [rsp + 0x8a], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [rsp + 0x47]
mov r8d, 0xa
mov ecx, eax
call qword [sym.imp.msvcrt.dll__ultoa]
cmp byte [rsp + 0x47], 0
je 0x140015672
mov eax, 0x28
lea rcx, [rsp + 0x20]
jmp 0x14001564a
add rax, 1
cmp rax, 0x6b
je 0x140015667
cmp byte [rcx + rax], 0
movsxd rdx, eax
jne 0x140015640
cmp edx, 0x6a
je 0x140015667
lea eax, [rdx + 1]
cdqe
mov byte [rsp + rdx + 0x20], 0xa
mov byte [rsp + rax + 0x20], 0
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call sub.msvcrt.dll_abort
mov eax, 0x28
mov edx, 0x27
lea rcx, [rsp + 0x20]
jmp 0x14001565b
Function at 0x14001a220
Capabilities:
Print debug messages

Disassembly:
push r12
push rbx
sub rsp, 0x58
mov r12, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14001a240
add rsp, 0x58
pop rbx
pop r12
ret
lea rdx, [rsp + 0x48]
mov r9d, 0x400
mov r8d, eax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rdx
mov ecx, 0x1100
xor edx, edx
mov dword [rsp + 0x28], 0
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
jne 0x14001a288
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14001a234
int3
mov rcx, qword [rsp + 0x48]
mov rbx, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rbx
mov rcx, r12
call rbx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x14001a275
Function at 0x14001a3a0
Capabilities:
Check mutex on windows

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x30
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [0x1403fd4c0]
mov dword [rsp + 0x2c], eax
lea rcx, [rsp + 0x2c]
lea r9, [rsp + 0x30]
movzx eax, byte [rcx]
add rcx, 1
add rdx, 2
mov r8d, eax
and eax, 0xf
shr r8b, 4
add eax, 0x61
add r8d, 0x41
mov byte [rdx - 1], al
mov byte [rdx - 2], r8b
cmp rcx, r9
jne 0x14001a3c3
lea rax, [0x1403fd4c8]
mov ecx, 0x5f
lea rdx, str.__shmem3_winpthreads_tdm_
lea r8, [rax + 0x1a]
jmp 0x14001a40b
movzx ecx, byte [rdx]
add rax, 1
add rdx, 1
mov byte [rax - 1], cl
cmp rax, r8
jne 0x14001a408
lea rax, [0x1403fd500]
mov ecx, 0x5f
lea rdx, str.__shmem3_winpthreads_tdm_
lea r8, [rax + 0x19]
jmp 0x14001a43b
movzx ecx, byte [rdx]
add rax, 1
add rdx, 1
mov byte [rax - 1], cl
cmp rax, r8
jne 0x14001a438
xor ecx, ecx
mov byte [0x1403fd519], 0x2d
movabs rax, 0x6161616161616161
movabs rdx, 0x6161616161616161
mov qword [0x1403fd522], rdx
lea r8, [0x1403fd4c0]
lea rbx, [0x1403fd51a]
mov qword [0x1403fd532], rdx
mov qword [0x1403fd542], rdx
mov qword [0x1403fd552], rdx
xor edx, edx
mov qword [0x1403fd51a], rax
mov qword [0x1403fd52a], rax
mov qword [0x1403fd53a], rax
mov qword [0x1403fd54a], rax
mov byte [0x1403fd55a], 0
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edx, 0xffffffff
mov r12, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14001a616
lea rcx, [0x1403fd500]
call qword [sym.imp.KERNEL32.dll_FindAtomA]
test ax, ax
jne 0x14001a561
lea rsi, [0x1403fd400]
lea r8, [0x1403fd55a]
mov rax, rbx
lea ecx, [rbx + 0x40]
nop dword [rax]
mov edx, ecx
sub edx, eax
bt rsi, rdx
jae 0x14001a50d
mov byte [rax], 0x41
add rax, 1
cmp r8, rax
jne 0x14001a500
lea rcx, [0x1403fd500]
call qword [sym.imp.KERNEL32.dll_AddAtomA]
test ax, ax
je 0x14001a603
lea rcx, [0x14001a2b0]
mov qword [0x1403fd400], rsi
call sub.msvcrt.dll__onexit
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x1403fd400]
add rsp, 0x30
pop rbx
pop rsi
pop r12
ret
mov r8d, 0x5b
lea rdx, [0x1403fd500]
movzx ecx, ax
call qword [sym.imp.KERNEL32.dll_GetAtomNameA]
lea r8, [0x1403fd55a]
xor edx, edx
lea r10d, [rbx + 0x40]
mov r11d, eax
mov r9d, 1
mov rax, rbx
test r11d, r11d
je 0x14001a636
nop dword [rax]
cmp byte [rax], 0x41
jne 0x14001a5b3
mov ecx, r10d
mov rbx, r9
sub ecx, eax
shl rbx, cl
or rdx, rbx
add rax, 1
cmp r8, rax
jne 0x14001a5a0
mov rax, rdx
mov qword [0x1403fd400], rax
lea rsi, [0x1403fd400]
jmp 0x14001a5d9
cmp rdx, rsi
je 0x14001a53f
mov rdx, rax
mov rax, qword [rax + 8]
test rax, rax
jne 0x14001a5d0
cmp rdx, rsi
je 0x14001a53f
mov qword [rdx + 8], rsi
lea rcx, [0x14001a2b0]
call sub.msvcrt.dll__onexit
jmp 0x14001a53f
lea rcx, str.failed_to_add_string_to_atom_table_n
call fcn.14001a220
xor eax, eax
jmp 0x14001a558
lea rcx, str.failed_to_to_lock_creation_mutex_n
call fcn.14001a220
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop r12
ret
lea rcx, str.failed_to_get_string_from_atom_n
call fcn.14001a220
xor eax, eax
jmp 0x14001a5bf
Function at 0x4166c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41684b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00434260
xorps xmm15, xmm15
mov r14, qword [0x007d3f68]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x416725
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x416734
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x416753
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x416763
cmp rbx, 0x1000
jae 0x41672b
jmp 0x4167cd
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x416775
xor edx, edx
jmp 0x4167c4
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00434260
xorps xmm15, xmm15
mov r14, qword [0x007d3f68]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x416759
jmp 0x416748
call fcn.00467b00
xorps xmm15, xmm15
mov r14, qword [0x007d3f68]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.004388c0
lea rax, [0x005502e4]
mov ebx, 0x18
nop dword [rax]
call fcn.00439140
mov rax, qword [rsp + 0x38]
call fcn.00438e80
lea rax, [0x0055089c]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00439140
mov rax, qword [rsp + 0x30]
call fcn.00438e80
call fcn.00438b00
call fcn.00438920
lea rax, [0x00553083]
mov ebx, 0x21
call fcn.00436f20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00464400
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004166c0