joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005bf90
Capabilities:
Read file via mapping

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x90
lea rbp, [rsp + 0x80]
mov rax, r8
mov rdi, rcx
mov dword [rbp - 0x48], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x30], 7
mov qword [rbp - 0x2c], 0
mov word [rbp - 0x24], 0
mov byte [rbp - 0x28], 1
lea r8, [rbp - 0x48]
mov rcx, rdx
mov rdx, rax
call sym.std::sys::pal::windows::fs::File::open::hc5f4d9ae76270501
mov rsi, rdx
test rax, rax
je 0x1005c046
mov eax, esi
and eax, 3
cmp eax, 1
jne 0x1005c03a
mov rax, rsi
dec rsi
mov rbx, qword [rax - 1]
mov r14, qword [rax + 7]
mov rax, qword [r14]
test rax, rax
je 0x1005c012
mov rcx, rbx
call rax
mov rdx, qword [r14 + 8]
test rdx, rdx
je 0x1005c027
mov r8, qword [r14 + 0x10]
mov rcx, rbx
call sym.__rust_dealloc
mov edx, 0x18
mov r8d, 8
mov rcx, rsi
call sym.__rust_dealloc
mov qword [rdi], 0
jmp 0x1005c1a5
lea rcx, [rbp - 0x48]
mov rdx, rsi
call sym.std::sys::pal::windows::fs::File::file_attr::he46f30c366c74b09
cmp dword [rbp - 0x48], 2
jne 0x1005c0c7
mov rax, qword [rbp - 0x40]
mov ecx, eax
and ecx, 3
cmp ecx, 1
jne 0x1005c0a7
lea rbx, [rax - 1]
mov r14, qword [rax - 1]
mov r15, qword [rax + 7]
mov rax, qword [r15]
test rax, rax
je 0x1005c07f
mov rcx, r14
call rax
mov rdx, qword [r15 + 8]
test rdx, rdx
je 0x1005c094
mov r8, qword [r15 + 0x10]
mov rcx, r14
call sym.__rust_dealloc
mov edx, 0x18
mov r8d, 8
mov rcx, rbx
call sym.__rust_dealloc
mov qword [rdi], 0
mov rcx, rsi
add rsp, 0x90
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
jmp sub.kernel32.dll_CloseHandle
mov r12, qword [rbp - 0x10]
test rsi, rsi
je 0x1005c115
mov qword [rbp - 0x48], 0
call sub.kernel32.dll_GetCurrentProcess
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rbp - 0x48]
mov rcx, rax
mov rdx, rsi
mov r8, rax
call sub.kernel32.dll_DuplicateHandle
test eax, eax
je 0x1005c191
mov rbx, qword [rbp - 0x48]
jmp 0x1005c117
xor ebx, ebx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rbx
xor edx, edx
mov r8d, 2
xor r9d, r9d
call sub.kernel32.dll_CreateFileMappingA
test rax, rax
je 0x1005c180
mov r14, rax
mov qword [rsp + 0x20], r12
mov rcx, rax
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call sub.kernel32.dll_MapViewOfFile
mov r15, rax
mov rcx, r14
call sub.kernel32.dll_CloseHandle
test r15, r15
je 0x1005c180
mov qword [rdi + 8], rbx
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], r12
mov qword [rdi], 1
jmp 0x1005c19d
mov qword [rdi], 0
mov rcx, rbx
call sub.kernel32.dll_CloseHandle
jmp 0x1005c19d
call sub.kernel32.dll_GetLastError
mov qword [rdi], 0
mov rcx, rsi
call sub.kernel32.dll_CloseHandle
nop
add rsp, 0x90
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
Function at 0x10061110
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rdi, rcx
mov esi, dword [0x100a4070]
test esi, esi
je 0x100611d9
dec esi
mov ecx, esi
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x100611ce
je 0x1006116b
xor ebx, ebx
test rdi, rdi
je 0x1006116f
test byte [rdi], 1
mov qword [rdi], 0
mov eax, dword [rdi + 0x10]
cmove eax, ebx
mov r14d, 0
cmovne r14, qword [rdi + 8]
mov ebx, eax
jmp 0x10061172
xor eax, eax
jmp 0x100611ce
xor r14d, r14d
mov rax, qword [0x10160108]
movzx eax, byte [rax]
mov ecx, 0x18
mov edx, 8
call sym.__rust_alloc
test rax, rax
je 0x100611fa
mov qword [rax], r14
mov byte [rax + 8], bl
mov dword [rax + 0x10], esi
mov ecx, esi
mov rbx, rax
call sub.kernel32.dll_TlsGetValue
mov rdi, rax
mov ecx, esi
mov rsi, rbx
mov rdx, rbx
call fcn.100a210c
test rdi, rdi
je 0x100611cb
mov edx, 0x18
mov r8d, 8
mov rcx, rdi
call sym.__rust_dealloc
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
lea rcx, sym.std::sys::thread_local::os::destroy_value::he060cb21e8ba39dd
call sym.std::sys::thread_local::key::windows::LazyKey::init::h9918f0af148d1982
mov esi, eax
mov ecx, esi
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x10061143
jmp 0x100611ce
mov ecx, 8
mov edx, 0x18
call sym.alloc::alloc::handle_alloc_error::hcd217d9ce9262906
int3

Function at 0x10061210
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov rdi, rcx
mov esi, dword [0x100a4090]
test esi, esi
je 0x10061246
dec esi
mov ecx, esi
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x10061261
add rax, 4
jmp 0x100612da
lea rcx, sym.std::sys::thread_local::os::destroy_value::h38cc77a9443c8689
call sym.std::sys::thread_local::key::windows::LazyKey::init::h9918f0af148d1982
mov esi, eax
mov ecx, esi
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x1006123d
je 0x100612d8
xor r14d, r14d
test rdi, rdi
je 0x10061279
cmp byte [rdi], 0
mov byte [rdi], 0
movzx eax, byte [rdi + 1]
cmovne r14d, eax
mov rax, qword [0x10160108]
movzx eax, byte [rax]
mov ecx, 8
mov edx, 4
call sym.__rust_alloc
test rax, rax
je 0x100612e7
mov rbx, rax
mov dword [rax], esi
add rax, 4
mov r15, rax
mov byte [rbx + 4], r14b
mov ecx, esi
call sub.kernel32.dll_TlsGetValue
mov rdi, rax
mov ecx, esi
mov rdx, rbx
call fcn.100a210c
test rdi, rdi
je 0x100612d3
mov edx, 8
mov r8d, 4
mov rcx, rdi
call sym.__rust_dealloc
mov rax, r15
jmp 0x100612da
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov ecx, 4
mov edx, 8
call sym.alloc::alloc::handle_alloc_error::hcd217d9ce9262906
int3
Function at 0x10061300
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov rdi, rcx
mov esi, dword [0x100a40d0]
test esi, esi
je 0x100613d2
dec esi
mov ecx, esi
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x100613c9
je 0x1006134d
test rdi, rdi
je 0x10061351
mov rbx, qword [rdi]
mov qword [rdi], 0
test rbx, rbx
je 0x10061353
mov rbx, qword [rdi + 8]
jmp 0x10061353
xor eax, eax
jmp 0x100613c9
xor ebx, ebx
mov qword [rbp - 8], rbx
mov dword [rbp], esi
mov rax, qword [0x10160108]
movzx eax, byte [rax]
mov ecx, 0x10
mov edx, 8
call sym.__rust_alloc
test rax, rax
je 0x100613f3
mov qword [rax], rbx
mov dword [rax + 8], esi
mov ecx, esi
mov rbx, rax
call sub.kernel32.dll_TlsGetValue
mov rdi, rax
mov ecx, esi
mov rsi, rbx
mov rdx, rbx
call fcn.100a210c
test rdi, rdi
je 0x100613c6
mov rax, qword [rdi]
test rax, rax
je 0x100613b3
lock dec qword [rax]
jne 0x100613b3
mov rcx, rdi
call sym.alloc::sync::Arc_T_A_::drop_slow::h399726f51cadc466
mov edx, 0x10
mov r8d, 8
mov rcx, rdi
call sym.__rust_dealloc
mov rax, rsi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea rcx, sym.std::sys::thread_local::os::destroy_value::hbe2e8671453ea6f0
call sym.std::sys::thread_local::key::windows::LazyKey::init::h9918f0af148d1982
mov esi, eax
mov ecx, esi
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x10061331
jmp 0x100613c9
mov ecx, 8
mov edx, 0x10
call sym.alloc::alloc::handle_alloc_error::hcd217d9ce9262906
ud2

Function at 0x10061430
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov rdi, rcx
mov esi, dword [0x100a4110]
test esi, esi
je 0x100614e1
dec esi
mov ecx, esi
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x100614d8
je 0x10061479
test rdi, rdi
je 0x1006147d
mov rbx, qword [rdi]
mov qword [rdi], 0
test rbx, rbx
je 0x1006147f
mov rbx, qword [rdi + 8]
jmp 0x1006147f
xor eax, eax
jmp 0x100614d8
xor ebx, ebx
mov rax, qword [0x10160108]
movzx eax, byte [rax]
mov ecx, 0x10
mov edx, 8
call sym.__rust_alloc
test rax, rax
je 0x10061502
mov qword [rax], rbx
mov dword [rax + 8], esi
mov ecx, esi
mov rbx, rax
call sub.kernel32.dll_TlsGetValue
mov rdi, rax
mov ecx, esi
mov rsi, rbx
mov rdx, rbx
call fcn.100a210c
test rdi, rdi
je 0x100614d5
mov edx, 0x10
mov r8d, 8
mov rcx, rdi
call sym.__rust_dealloc
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea rcx, sym.std::sys::thread_local::os::destroy_value::he14709d783b266f9
call sym.std::sys::thread_local::key::windows::LazyKey::init::h9918f0af148d1982
mov esi, eax
mov ecx, esi
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x1006145d
jmp 0x100614d8
mov ecx, 8
mov edx, 0x10
call sym.alloc::alloc::handle_alloc_error::hcd217d9ce9262906
int3
Function at 0x10061520
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov rdi, rcx
mov esi, dword [0x100a4130]
test esi, esi
je 0x100615f2
dec esi
mov ecx, esi
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x100615e9
je 0x1006156d
test rdi, rdi
je 0x10061571
mov rbx, qword [rdi]
mov qword [rdi], 0
test rbx, rbx
je 0x10061573
mov rbx, qword [rdi + 8]
jmp 0x10061573
xor eax, eax
jmp 0x100615e9
xor ebx, ebx
mov qword [rbp - 8], rbx
mov dword [rbp], esi
mov rax, qword [0x10160108]
movzx eax, byte [rax]
mov ecx, 0x10
mov edx, 8
call sym.__rust_alloc
test rax, rax
je 0x10061613
mov qword [rax], rbx
mov dword [rax + 8], esi
mov ecx, esi
mov rbx, rax
call sub.kernel32.dll_TlsGetValue
mov rdi, rax
mov ecx, esi
mov rsi, rbx
mov rdx, rbx
call fcn.100a210c
test rdi, rdi
je 0x100615e6
mov rax, qword [rdi]
test rax, rax
je 0x100615d3
lock dec qword [rax]
jne 0x100615d3
mov rcx, rdi
call sym.alloc::sync::Arc_T_A_::drop_slow::h4b81d876d0713add
mov edx, 0x10
mov r8d, 8
mov rcx, rdi
call sym.__rust_dealloc
mov rax, rsi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea rcx, sym.std::sys::thread_local::os::destroy_value::he6f17d5f203081bc
call sym.std::sys::thread_local::key::windows::LazyKey::init::h9918f0af148d1982
mov esi, eax
mov ecx, esi
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x10061551
jmp 0x100615e9
mov ecx, 8
mov edx, 0x10
call sym.alloc::alloc::handle_alloc_error::hcd217d9ce9262906
ud2

Function at 0x10064ab0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
test rdx, rdx
je 0x10064aca
mov r8d, edx
and r8d, 3
cmp rdx, 4
jae 0x10064ace
xor eax, eax
jmp 0x10064b45
xor eax, eax
pop rbp
ret
and rdx, 0xfffffffffffffffc
xor eax, eax
nop word cs:[rax + rax]
shl eax, 4
movzx r9d, byte [rcx]
add r9d, eax
mov eax, r9d
shr eax, 0x18
and eax, 0xfffffff0
xor eax, r9d
shl eax, 4
movzx r9d, byte [rcx + 1]
add r9d, eax
mov eax, r9d
shr eax, 0x18
and eax, 0xfffffff0
xor eax, r9d
shl eax, 4
movzx r9d, byte [rcx + 2]
add r9d, eax
mov eax, r9d
shr eax, 0x18
and eax, 0xfffffff0
xor eax, r9d
shl eax, 4
movzx r9d, byte [rcx + 3]
add rcx, 4
add r9d, eax
mov eax, r9d
shr eax, 0x18
and eax, 0xfffffff0
xor eax, r9d
add rdx, 0xfffffffffffffffc
jne 0x10064ae0
test r8, r8
je 0x10064b6f
xor edx, edx
nop dword [rax]
shl eax, 4
movzx r9d, byte [rcx + rdx]
add r9d, eax
mov eax, r9d
shr eax, 0x18
and eax, 0xfffffff0
xor eax, r9d
inc rdx
cmp r8, rdx
jne 0x10064b50
and eax, 0xfffffff
pop rbp
ret
Function at 0x10064b80
Capabilities:
Hash data using djb2

Disassembly:
push rbp
mov rbp, rsp
test rdx, rdx
je 0x10064ba0
mov r8d, edx
and r8d, 7
cmp rdx, 8
jae 0x10064ba7
mov eax, 0x1505
jmp 0x10064c2d
mov eax, 0x1505
pop rbp
ret
and rdx, 0xfffffffffffffff8
mov eax, 0x1505
mov r9d, eax
shl r9d, 5
add r9d, eax
movzx eax, byte [rcx]
add eax, r9d
movzx r9d, byte [rcx + 1]
add r9d, eax
shl eax, 5
add r9d, eax
movzx eax, byte [rcx + 2]
add eax, r9d
shl r9d, 5
add eax, r9d
movzx r9d, byte [rcx + 3]
add r9d, eax
shl eax, 5
add r9d, eax
movzx eax, byte [rcx + 4]
add eax, r9d
shl r9d, 5
add eax, r9d
movzx r9d, byte [rcx + 5]
add r9d, eax
shl eax, 5
add r9d, eax
movzx r10d, byte [rcx + 6]
add r10d, r9d
shl r9d, 5
add r10d, r9d
movzx eax, byte [rcx + 7]
add eax, r10d
shl r10d, 5
add rcx, 8
add eax, r10d
add rdx, 0xfffffffffffffff8
jne 0x10064bb0
test r8, r8
je 0x10064c59
xor edx, edx
nop word cs:[rax + rax]
mov r9d, eax
shl r9d, 5
add r9d, eax
movzx eax, byte [rcx + rdx]
add eax, r9d
inc rdx
cmp r8, rdx
jne 0x10064c40
pop rbp
ret
Function at 0x1009ba40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push rsi
sub rsp, 0xb8
lea rbp, [rsp + 0x80]
movzx eax, byte [rcx]
mov ecx, dword [rdx + 0x34]
test cl, 0x10
jne 0x1009baa2
test cl, 0x20
jne 0x1009bae4
mov r8d, eax
sar r8b, 7
mov ecx, eax
xor cl, r8b
sub cl, r8b
cmp cl, 0x64
jb 0x1009bb55
add cl, cl
add cl, 0x38
movzx ecx, cl
lea r8, [0x1015456e]
movzx ecx, word [rcx + r8]
mov word [rbp - 0x23], cx
mov r8d, 0x24
mov cl, 1
jmp 0x1009bb60
lea r9, [rbp + 0x38]
xor r8d, r8d
mov ecx, eax
nop dword [rax + rax]
mov r10d, eax
and r10b, 0xf
shr cl, 4
lea r11d, [r10 + 0x30]
lea esi, [r10 + 0x57]
cmp r10b, 0xa
movzx r10d, r11b
movzx r11d, sil
cmovb r11d, r10d
mov byte [r9 - 1], r11b
dec r9
inc r8
cmp al, 0x10
mov eax, ecx
jae 0x1009bab0
jmp 0x1009bb22
lea r9, [rbp + 0x38]
xor r8d, r8d
mov ecx, eax
nop dword [rax]
mov r10d, eax
and r10b, 0xf
shr cl, 4
lea r11d, [r10 + 0x30]
lea esi, [r10 + 0x37]
cmp r10b, 0xa
movzx r10d, r11b
movzx r11d, sil
cmovb r11d, r10d
mov byte [r9 - 1], r11b
dec r9
inc r8
cmp al, 0x10
mov eax, ecx
jae 0x1009baf0
mov ecx, pe_nt_image_headers64
sub rcx, r8
cmp rcx, 0x81
jae 0x1009bbc1
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], r9
lea r8, str.0x0o0b00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899assertion_failed:_curr___19
mov r9d, 2
mov rcx, rdx
mov dl, 1
jmp 0x1009bbb1
mov r8d, 0x26
cmp cl, 0xa
jae 0x1009bb6a
or cl, 0x30
mov byte [rbp + r8 - 0x48], cl
jmp 0x1009bb83
movzx ecx, cl
lea r8, [0x1015456e]
movzx ecx, word [r8 + rcx*2]
mov word [rbp - 0x23], cx
mov r8d, 0x25
lea rcx, [r8 + rbp]
add rcx, 0xffffffffffffffb8
mov r9d, 0x27
sub r9, r8
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x20], rcx
not al
shr al, 7
mov r8d, 1
mov rcx, rdx
mov edx, eax
xor r9d, r9d
call sym.core::fmt::Formatter::pad_integral::hcd991e4585082cf6
nop
add rsp, 0xb8
pop rsi
pop rbp
ret
lea r8, str.core_src_fmt_num.rs
mov edx, pe_nt_image_headers64
call sym.core::slice::index::slice_start_index_len_fail::h419d9fe760474afb
int3
Function at 0x100a2bc0
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sym.vfprintf
call sym.abort
nop
nop word [rax + rax]

Function at 0x100a2c30
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x50
movsxd rbx, dword [0x101731a4]
mov r12, rcx
test ebx, ebx
jle 0x100a2d60
mov rax, qword [0x101731a8]
xor ecx, ecx
add rax, 0x18
nop word [rax + rax]
mov rdx, qword [rax]
cmp rdx, r12
ja 0x100a2c7c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x100a2d03
add ecx, 1
add rax, 0x28
cmp ecx, ebx
jne 0x100a2c60
mov rcx, r12
call sym.__mingw_GetSectionForAddress
mov rsi, rax
test rax, rax
je 0x100a2d82
mov rax, qword [0x101731a8]
lea rbx, [rbx + rbx*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rsi
mov dword [rax], 0
call sym._GetPEImageBase
mov ecx, dword [rsi + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x101731a8]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x100a2d67
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x100a2cfc
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x100a2d10
add dword [0x101731a4], 1
add rsp, 0x50
pop rbx
pop rsi
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rbx, qword [0x101731a8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x100a2cfc
call qword [sym.imp.kernel32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
nop dword [rax]
xor ebx, ebx
jmp 0x100a2c87
mov rax, qword [0x101731a8]
mov edx, dword [rsi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call sym.__report_error
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call sym.__report_error
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x100a3030
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x101731e0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x101731c0]
test rbx, rbx
je 0x100a3084
mov rdi, qword [sym.imp.kernel32.dll_TlsGetValue]
mov rsi, qword [sym.imp.kernel32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x100a307b
test r12, r12
je 0x100a307b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x100a3060
lea rcx, [0x101731e0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x100a32a0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x100a32b8
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x100a32c0
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x100a32d0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
mov r8, rdx
lea rdx, [rax + rcx]
movzx eax, word [rdx + 0x14]
lea rax, [rdx + rax + 0x18]
movzx edx, word [rdx + 6]
test edx, edx
je 0x100a331c
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov ecx, dword [rax + 0xc]
mov rdx, rcx
cmp rcx, r8
ja 0x100a3313
add edx, dword [rax + 8]
cmp rdx, r8
ja 0x100a331e
add rax, 0x28
cmp rax, r9
jne 0x100a3300
xor eax, eax
ret

Function at 0x100a3320
Capabilities:
Parse pe header

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
call sub.msvcrt.dll_strlen
cmp rax, 8
ja 0x100a33b0
mov rdx, qword [0x101600c0]
xor r12d, r12d
cmp word [rdx], 0x5a4d
jne 0x100a339e
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x100a339e
cmp word [rax + 0x18], 0x20b
jne 0x100a339e
movzx edx, word [rax + 0x14]
lea r12, [rax + rdx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x100a33b0
sub eax, 1
lea rax, [rax + rax*4]
lea rsi, [r12 + rax*8 + 0x28]
jmp 0x100a3389
add r12, 0x28
cmp r12, rsi
je 0x100a33b0
mov r8d, 8
mov rdx, rbx
mov rcx, r12
call sym.strncmp
test eax, eax
jne 0x100a3380
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret
xor r12d, r12d
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret

Function at 0x100a33c0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x101600c0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x100a33e0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x100a33e8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x100a33e0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x100a3435
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x100a342c
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x100a33e0
add rax, 0x28
cmp rax, r9
jne 0x100a3418
xor eax, eax
ret

Function at 0x100a3440
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x101600c0]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x100a3460
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x100a3468
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x100a3460
movzx r8d, word [rax + 6]
mov eax, r8d
ret
Function at 0x100a3480
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x101600c0]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x100a34a0
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x100a34a8
ret
cmp word [rdx + 0x18], 0x20b
jne 0x100a34a0
movzx eax, word [rdx + 0x14]
lea rax, [rdx + rax + 0x18]
movzx edx, word [rdx + 6]
test edx, edx
je 0x100a34e8
sub edx, 1
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x100a34df
test rcx, rcx
je 0x100a34a0
sub rcx, 1
add rax, 0x28
cmp rax, rdx
jne 0x100a34d0
xor eax, eax
ret

Function at 0x100a34f0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x101600c0]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x100a3510
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x100a3518
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret

Function at 0x100a3530
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rax, qword [0x101600c0]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x100a3550
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x100a3558
mov eax, r8d
ret
cmp word [rdx + 0x18], 0x20b
jne 0x100a3550
sub rcx, rax
movzx eax, word [rdx + 0x14]
lea rax, [rdx + rax + 0x18]
movzx edx, word [rdx + 6]
test edx, edx
je 0x100a3550
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x100a3594
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x100a35a8
add rax, 0x28
cmp r9, rax
jne 0x100a3580
xor r8d, r8d
mov eax, r8d
ret
mov r8d, dword [rax + 0x24]
not r8d
shr r8d, 0x1f
mov eax, r8d
ret

Function at 0x100a35c0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x101600c0]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x100a35e2
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x100a35f0
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x100a35e2
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x100a35e2
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
movzx r8d, word [r8 + 6]
test r8d, r8d
je 0x100a35e2
sub r8d, 1
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop dword [rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x100a363d
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x100a3650
add rdx, 0x28
cmp r10, rdx
jne 0x100a3628
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x100a365f
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x100a366f
mov edx, dword [rax + 0xc]
test edx, edx
je 0x100a3646
test ecx, ecx
jg 0x100a3658
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x140086314
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140086090