joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000b2c0
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push r14
sub rsp, 0x30
mov rdi, r8
mov rsi, rdx
mov r14, rcx
and dword [rax - 0x18], 0
and qword [rax + 0x20], 0
xor ebx, ebx
mov eax, dword [0x1800a17b0]
test eax, eax
je 0x18000b30a
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1800a17b0]
test eax, eax
jne 0x18000b313
call fcn.1800021d0
test eax, eax
je 0x18000b32f
lea rdx, [rsp + 0x58]
mov rcx, qword [section..data]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x18000b337
xor eax, eax
jmp 0x18000b37e
mov r8, rdi
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.USER32.dll_GetClassInfoExW]
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x18000b361
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x18000b363
xor esi, esi
mov rdx, qword [rsp + 0x58]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x18000b37c
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret

Function at 0x18000b394
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x1800a4ba8]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x1800a17b0]
test eax, eax
je 0x18000b3df
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1800a17b0]
test eax, eax
jne 0x18000b3e8
call fcn.1800021d0
test eax, eax
je 0x18000b404
lea rdx, [rsp + 0x48]
mov rcx, qword [section..data]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x18000b40c
xor eax, eax
jmp 0x18000b471
test rbx, rbx
jne 0x18000b42c
lea rcx, str.InitCommonControlsEx
call fcn.18000b0e0
mov rbx, rax
test rax, rax
je 0x18000b43f
mov qword [0x1800a4ba8], rax
mov rcx, rbx
call fcn.1800147a4
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x18000b454
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x18000b456
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x18000b46f
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x18000b5c8
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov rdi, rcx
xor r14d, r14d
mov word [rax - 0x18], r14w
mov qword [rax + 0x10], r14
mov ebx, r14d
mov eax, dword [0x1800a17b0]
test eax, eax
je 0x18000b610
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1800a17b0]
test eax, eax
jne 0x18000b619
call fcn.1800021d0
test eax, eax
je 0x18000b635
lea rdx, [rsp + 0x48]
mov rcx, qword [section..data]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x18000b63f
movzx eax, r14w
jmp 0x18000b687
mov rcx, rdi
call qword [sym.imp.USER32.dll_RegisterClassW]
movzx ebx, ax
mov word [rsp + 0x20], ax
mov edi, r14d
test bx, bx
sete dil
test edi, edi
je 0x18000b668
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x18000b66b
mov esi, r14d
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test edi, edi
je 0x18000b684
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
movzx eax, bx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x401570
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x4c0
lea rsi, [rsp + 0xc0]
mov rbp, rdx
mov rbx, rcx
lea rdx, section..rdata
xor ecx, ecx
call sub.msvcrt.dll_setlocale
mov ecx, 0x18
call sub.msvcrt.dll_malloc
mov edx, 0x400
mov rcx, rsi
mov qword [rbp], rax
call qword [sym.imp.msvcrt.dll__getcwd]
mov rdx, rsi
test rax, rax
je 0x401740
mov ecx, dword [rdx]
add rdx, 4
lea eax, [rcx - 0x1010101]
not ecx
and eax, ecx
and eax, 0x80808080
je 0x4015c1
mov ecx, eax
shr ecx, 0x10
test eax, 0x8080
cmove eax, ecx
lea rcx, [rdx + 2]
mov edi, eax
cmove rdx, rcx
add dil, al
sbb rdx, 3
sub rdx, rsi
mov byte [rsi + rdx], 0x5c
lea rcx, [rsi + rdx + 1]
mov rdx, rbx
mov rbx, rsi
call sub.msvcrt.dll_strcpy
mov edx, dword [rbx]
add rbx, 4
lea eax, [rdx - 0x1010101]
not edx
and eax, edx
and eax, 0x80808080
je 0x40160d
mov edx, eax
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea rdx, [rbx + 2]
mov edi, eax
cmove rbx, rdx
add dil, al
sbb rbx, 3
sub rbx, rsi
lea rcx, [rbx + rbx + 2]
call sub.msvcrt.dll_malloc
lea r8, [rbx + rbx]
mov rdx, rsi
lea rbx, [rsp + 0x50]
mov rcx, rax
mov r12, rax
call sub.msvcrt.dll_mbstowcs
lea rdx, [rsp + 0x54]
xor eax, eax
mov ecx, 0xc
mov rdi, rdx
mov dword [rsp + 0x50], 0x68
mov rdx, r12
rep stosq qword [rdi], rax
mov rax, qword [rbp]
lea rcx, str.Unicode_string:___ls__n
mov dword [rdi], 0
mov qword [rax], 0
mov qword [rax + 8], 0
mov qword [rax + 0x10], 0
call sub.msvcrt.dll_wprintf
mov rax, qword [rbp]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x40], rbx
mov rcx, r12
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x401711
lea rcx, str.Empty_process_start_over
call sub.msvcrt.dll_puts
xor eax, eax
add rsp, 0x4c0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CreateProcess_failed___d_._n
mov edx, eax
call sub.msvcrt.dll_printf
mov eax, 1
add rsp, 0x4c0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
lea rcx, str.getcwd___error
call sub.msvcrt.dll_perror
mov eax, 1
add rsp, 0x4c0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x401760
Capabilities:
Resume thread

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x4017a0
lea rcx, str.Process_resume_over
call sub.msvcrt.dll_puts
mov rcx, qword [rbx]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rbx + 8]
call rsi
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ResumeThread_failed___d_._n
mov edx, eax
call sub.msvcrt.dll_printf
mov eax, 1
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x401ff0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x004a6624]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x402178
mov rax, qword [0x004a6628]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x40203c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x4020c5
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x402020
mov rcx, rbx
call fcn.00402c90
test rax, rax
mov r12, rax
je 0x4021ad
mov rax, qword [0x004a6628]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call fcn.00402dc0
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x004a6628]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x402190
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x4020be
sub eax, 0x40
and eax, 0xffffffbf
jne 0x402120
add dword [0x004a6624], 1
cmp edi, 8
jae 0x4020f3
test dil, 4
jne 0x402164
test edi, edi
je 0x4020e8
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x40217f
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x4020e8
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x40210c
jmp 0x4020e8
add rsi, qword [0x004a6628]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x4020be
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.004034c0
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x4020e8
xor esi, esi
jmp 0x402047
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x4020e8
mov rax, qword [0x004a6628]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call fcn.004034c0
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.004034c0
nop
nop dword [rax]

Function at 0x402900
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x004a6900]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004a68e0]
test rbx, rbx
je 0x402954
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x40294b
test rsi, rsi
je 0x40294b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x402930
lea rcx, [0x004a6900]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x402c90
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x004a3280]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x402cfd
mov rcx, r8
call fcn.00402b70
test eax, eax
je 0x402cfd
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x402cfd
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x402cf4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x402cff
add rax, 0x28
cmp rax, r9
jne 0x402ce0
xor eax, eax
add rsp, 0x28
ret
Function at 0x403220
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push r14
mov eax, 0x9de50
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.00402f50
sub rsp, rax
call fcn.00401b80
lea rdi, [rsp + 0x40]
call sub.umppc16510.dll_function1
lea rsi, [rsp + 0x2a40]
call sub.umppc16510.dll_function2
lea rbp, [rsp + 0xb0]
call sub.umppc16510.dll_function3
xor eax, eax
mov ecx, 0xc
mov r8d, 0x2801
rep stosq qword [rdi], rax
lea rdx, [0x004051c0]
movabs rax, 0x414357071e050206
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x31], rax
lea r12, [rsp + 0x40]
mov eax, 0x1903
mov dword [rsp + 0x39], 0x174b4244
mov word [rsp + 0x3d], ax
mov byte [rsp + 0x3f], 0
mov dword [rdi], 0
lea rdi, [rsp + 0x230]
mov rcx, rdi
call sub.msvcrt.dll_memcpy
mov r8d, 0x9b401
mov rcx, rsi
lea rdx, [0x004079c8]
call sub.msvcrt.dll_memcpy
mov r8d, 0x17e
mov rcx, rbp
lea rdx, [0x004a2dd0]
call sub.msvcrt.dll_memcpy
lea rcx, str.Key:
call sub.msvcrt.dll_printf
lea rcx, [0x00405193]
mov rdx, r12
call sub.msvcrt.dll_scanf
mov r8, rdi
xor ecx, ecx
nop dword [rax + rax]
mov rbx, r12
mov edx, dword [rbx]
add rbx, 4
lea eax, [rdx - 0x1010101]
not edx
and eax, edx
and eax, 0x80808080
je 0x403313
mov edx, eax
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea rdx, [rbx + 2]
cmove rbx, rdx
mov edx, eax
add dl, al
mov rax, rcx
sbb rbx, 3
xor edx, edx
add rcx, 1
sub rbx, r12
div rbx
movzx eax, byte [rsp + rdx + 0x40]
xor byte [r8], al
add r8, 1
cmp rcx, 0x2800
jne 0x403310
lea r12, [rsp + 0x31]
xor r13d, r13d
mov r14, r12
jmp 0x403398
mov rax, r13
xor edx, edx
add r13, 1
div rbx
movzx eax, byte [rsp + rdx + 0x40]
xor byte [r14], al
add r14, 1
mov rcx, r12
call sub.msvcrt.dll_strlen
cmp rax, r13
ja 0x403380
movzx eax, byte [rsp + 0x40]
mov r8d, 1
mov rcx, rsi
xor byte [rsp + 0x2a40], al
lea r9, [rsi + 0x9b3ff]
sub r8, rsi
xor edx, edx
lea rax, [r8 + rcx]
div rbx
movzx eax, byte [rsp + rdx + 0x40]
xor byte [rcx + 1], al
add rcx, 1
cmp rcx, r9
jne 0x4033c4
mov r8, rbp
xor ecx, ecx
mov rax, rcx
xor edx, edx
add rcx, 1
div rbx
movzx eax, byte [rsp + rdx + 0x40]
xor byte [r8], al
add r8, 1
cmp rcx, 0x17e
jne 0x4033e3
lea rdx, [0x00405196]
mov rcx, r12
call sub.msvcrt.dll_fopen
lea rdx, [0x00405196]
lea rcx, str.HelloWorld.exe
mov r12, rax
call sub.msvcrt.dll_fopen
mov r9, r12
mov edx, 0x2800
mov rcx, rdi
mov r8d, 1
mov rbx, rax
call sub.msvcrt.dll_fwrite
mov rcx, r12
call sub.msvcrt.dll_fclose
mov r9, rbx
mov edx, 0x9b400
mov rcx, rsi
mov r8d, 1
call sub.msvcrt.dll_fwrite
mov rcx, rbx
call sub.msvcrt.dll_fclose
lea rcx, str.File_extracts_success
call sub.msvcrt.dll_puts
lea rdx, [rsp + 0x28]
lea rcx, str.HelloWorld.exe
call fcn.00401570
mov rcx, qword [rsp + 0x28]
mov r8d, 0x17d
mov rdx, rbp
call fcn.004017c0
mov rcx, qword [rsp + 0x28]
call fcn.00401760
xor eax, eax
add rsp, 0x9de50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x4034c0
Capabilities:
Write file on windows

Disassembly:
lea rcx, [0x00401540]
jmp 0x401510
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.00403090
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.00403090
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
jmp 0x401530
Function at 0x14012ad88
Capabilities:
Execute syscall

Disassembly:
test rdi, rbp
test r12, rcx
bswap rbp
pop r12
cmp ecx, 0xf1710941
rcr r9d, 0x50
jmp 0x14012af0d
add bl, dh
nop
lea ebp, [rbx - 0x41e6]
stosd dword [rdi], eax
sbb bh, byte [rsi - 0x3d3e0001]
add al, 0xff
ror byte [rbp + 0xd18b7], 1
add bh, bh
invalid
stosd dword [rdi], eax
sbb bh, byte [rsi - 0x3d3e0001]
add al, 0xff
ror byte [rbp + 0xd18b7], 1
add bh, bh
loopne 0x14012ad84
add dword [rax], eax
add byte [rax + 0x39], cl
std
rcl r11d, 0xcf
pushfq
jne 0x14012adaf
je 0x14012adaf
syscall
movabs r13, 0x472e40000002fee9
ret
jmp 0x14012b0b2
dec r12
push r10
ret
dec rsi
xor ecx, 0xf5f83128
lea r14d, [rbx + 0x4f0f]
call rcx
lea r10d, [rdi - 0xe3d3]
and edi, 0xbecdfaed
jmp 0x14012ad6b
Function at 0x140003180
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword gs:[0x30]
mov r14, r8
mov rbp, qword [rcx + 0x88]
mov esi, edx
mov rdi, rcx
xor edx, edx
mov r8d, 0x4478
add rcx, 0x818
mov r9, qword [rax + 0x60]
lea rax, [0x1400c1910]
sub rbp, qword [r9 + 0x10]
add rbp, rax
mov qword [rsp + 0x60], 0
call sym.VBoxNetDHCP.exe_nocrt_memset
mov rcx, qword [rdi]
lea rax, [rsp + 0x60]
mov r9d, 0x4478
mov qword [rsp + 0x20], rax
lea r8, [rdi + 0x818]
mov rdx, rbp
call qword [0x1400bf250]
test eax, eax
js 0x1400032e3
mov edx, dword [rdi + 0x830]
cmp edx, esi
je 0x1400032d0
mov byte [rdi + 0x4c8b], 0
lea rbx, [rdi + 0x88c]
mov byte [rdi + 0x88b], 0
lea rbp, [rdi + 0x83c]
mov r9d, dword [rdi + 0x838]
lea rcx, str.supR3HardenedWinCheckChild:_enmRequest_d_rc_d_enmWhat_d__s:__s_n
mov r8d, dword [rdi + 0x834]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbp
call fcn.14000cf70
mov eax, dword [rdi + 0x830]
cmp eax, 2
jne 0x140003306
mov rcx, qword [rdi + 0x18]
xor edx, edx
call qword [0x1400bf2a0]
test eax, eax
js 0x140003330
mov rcx, qword [rdi]
lea r8, [rsp + 0x78]
xor edx, edx
mov qword [rsp + 0x78], 0xfffffffffd050f80
call fcn.140001cff
test eax, eax
je 0x1400032ad
mov edx, eax
lea rcx, str.supR3HardNtChildProcessRequest:_Child_is_taking_too_long_to_quit__rcWait_x___killing_it..._n
call fcn.14000cf70
mov rcx, qword [rdi]
mov edx, 0x40010004
call qword [0x1400bf320]
mov edx, dword [rdi + 0x838]
lea r9, [0x14007f900]
mov r8d, dword [rdi + 0x834]
mov qword [rsp + 0x20], rbx
test edx, edx
jne 0x140003360
jmp 0x14000334e
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
mov dword [rsp + 0x28], eax
lea r9, str.NtReadVirtualMemory___p___failed_reading_child_process_status:__x_n
mov r8d, eax
mov qword [rsp + 0x20], rbp
lea rdx, str.supR3HardNtChildProcessRequest
mov rcx, rdi
call fcn.140007f30
int3
mov qword [rsp + 0x30], r14
lea r9, str.Unexpected_child_request__d._Was_expecting__d___s_._n
mov dword [rsp + 0x28], esi
lea rdx, str.supR3HardenedWinCheckChild
mov r8d, 0xfffffffe
mov dword [rsp + 0x20], eax
mov rcx, rdi
call fcn.140007f30
int3
lea r9, str.NtSetEvent_failed:__x_n
mov dword [rsp + 0x20], eax
mov r8d, eax
lea rdx, str.supR3HardNtChildProcessRequest
mov rcx, rdi
call fcn.140007f30
int3
mov edx, 5
lea rcx, str.supR3HardenedWinCheckChild
call fcn.14000cd00
int3
mov rcx, rbp
call fcn.14000cd00
int3
Function at 0x140004120
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140003f4c
Function at 0x140010580
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x30
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x140010602
mov qword [rsp + 0x40], rdi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword gs:[0x58]
mov edi, eax
mov eax, 4
mov rdx, qword [rcx]
mov ecx, dword [rax + rdx]
cmp dword [0x14008ce04], ecx
jle 0x1400105e9
lea rcx, [0x14008ce04]
call fcn.140034740
cmp dword [0x14008ce04], 0xffffffff
jne 0x1400105e9
lea rcx, [0x140067d10]
call fcn.140034ac4
lea rcx, [0x14008ce04]
call fcn.1400346e0
lea rax, [0x140089e40]
mov dword [rsp + 0x20], edi
test edi, edi
mov qword [rsp + 0x28], rax
mov rdi, qword [rsp + 0x40]
jne 0x14001060a
mov eax, ebx
add rsp, 0x30
pop rbx
ret
lea rdx, [0x1400782b8]
lea rcx, [rsp + 0x20]
call fcn.1400103c0
int3

Function at 0x140010620
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [0x14008ce6c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140010659
mov rdx, qword [rax + 8]
mov r8, rbx
add rsp, 0x20
pop rbx
jmp fcn.140014f90
xor edx, edx
mov r8, rbx
add rsp, 0x20
pop rbx
jmp fcn.140014f90

Function at 0x140010670
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
sub rsp, 0x28
mov rbx, rcx
mov rdi, rdx
mov ecx, dword [0x14008ce6c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor r8d, r8d
test rax, rax
je 0x1400106a0
mov r9, qword [rax + 8]
jmp 0x1400106a3
mov r9, r8
cmp rdi, 0x3fc
ja 0x1400106c7
test r9, r9
je 0x1400106c7
mov rax, r8
cmp qword [r9 + rax*8], 0
je 0x1400106d5
inc r8d
inc rax
cmp rax, 2
jl 0x1400106b4
mov rcx, rbx
add rsp, 0x28
pop rdi
pop rbx
jmp fcn.140034adc
movzx eax, byte [rbx + rdi]
mov byte [rbx], al
movsxd rax, r8d
mov qword [r9 + rax*8], rbx
add rsp, 0x28
pop rdi
pop rbx
ret
Function at 0x140010840
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x30
mov rax, qword [rcx]
xor r14d, r14d
mov rbx, rcx
mov qword [rdx], r14
mov rsi, rdx
mov qword [rdx + 8], r14
mov rbp, r8
mov edx, r14d
mov rcx, qword [rax]
mov r9d, r14d
test rcx, rcx
je 0x140010898
mov rax, qword [rcx]
lea rdx, [rsp + 0x20]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r9, qword [rax]
mov rdx, qword [rax + 8]
mov rax, qword [rbx]
mov qword [rsi], r9
mov qword [rsi + 8], rdx
mov qword [rax], r14
cmp rbp, rdx
jbe 0x1400109b4
mov ebx, 6
test r9, r9
je 0x1400108f9
mov ecx, dword [0x14008ce6c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400108c2
mov rdx, qword [rax + 8]
jmp 0x1400108c5
mov rdx, r14
mov r9, qword [rsi + 8]
mov r8, qword [rsi]
cmp r9, 0x3fc
ja 0x1400108f1
test rdx, rdx
je 0x1400108f1
mov ecx, ebx
mov rax, rbx
nop
cmp qword [rdx + rax*8], r14
je 0x14001095a
inc ecx
inc rax
cmp rax, 8
jl 0x1400108e0
mov rcx, r8
call fcn.140034adc
mov ecx, dword [0x14008ce6c]
mov qword [rsp + 0x40], rdi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
lea rdi, [rbp + 3]
shr rdi, 2
test rax, rax
je 0x140010986
mov r9, qword [rax + 8]
test r9, r9
je 0x140010986
mov ecx, ebx
lea r8, [r9 + 0x30]
mov rdx, qword [r8]
test rdx, rdx
je 0x140010936
movzx eax, byte [rdx]
cmp rax, rdi
jae 0x14001096b
inc ecx
add r8, 8
cmp ecx, 8
jl 0x140010926
mov rax, rbx
mov rcx, qword [r9 + rax*8]
test rcx, rcx
jne 0x14001097a
inc ebx
inc rax
cmp rax, 8
jl 0x140010944
jmp 0x140010986
movzx eax, byte [r8 + r9]
mov byte [r8], al
movsxd rax, ecx
mov qword [rdx + rax*8], r8
jmp 0x1400108f9
movsxd rax, ecx
mov qword [r9 + rax*8], r14
movzx eax, byte [rdx]
mov byte [rdx + rbp], al
jmp 0x1400109a8
movsxd rax, ebx
mov qword [r9 + rax*8], r14
call fcn.140034adc
lea rcx, [rdi*4 + 1]
call fcn.140034850
cmp rdi, 0xff
movzx ecx, dil
mov rdx, rax
cmova ecx, r14d
mov byte [rax + rbp], cl
mov rdi, qword [rsp + 0x40]
mov qword [rsi], rdx
mov qword [rsi + 8], rbp
mov rbx, qword [rsp + 0x48]
mov rax, rsi
mov rsi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret