joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140013940
Capabilities:
Get thread local storage value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov esi, ecx
mov r12, rdx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x140018368]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140013a40
lea r13, [rbx + 0x68]
mov rcx, r13
call sym.pthread_spin_lock
cmp esi, dword [rbx + 0x48]
jae 0x1400139c0
mov rdi, qword [rbx + 0x50]
mov qword [rdi + rsi*8], r12
mov rax, qword [rbx + 0x58]
mov rcx, r13
mov byte [rax + rsi], 1
call sym.pthread_spin_unlock
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea r15d, [rsi + 1]
mov rcx, qword [rbx + 0x50]
movsxd r14, r15d
lea rdx, [r14*8]
call sym.realloc
mov rdi, rax
test rax, rax
je 0x140013a4d
mov rcx, qword [rbx + 0x58]
mov rdx, r14
call sym.realloc
mov r14, rax
test rax, rax
je 0x140013a4d
mov eax, dword [rbx + 0x48]
mov edx, r15d
sub edx, eax
lea rcx, [rdi + rax*8]
lea r8, [rdx*8]
xor edx, edx
call sym.memset
mov ecx, dword [rbx + 0x48]
mov r8d, r15d
xor edx, edx
mov rax, rcx
add rcx, r14
sub r8d, eax
call sym.memset
mov qword [rbx + 0x50], rdi
mov qword [rbx + 0x58], r14
mov dword [rbx + 0x48], r15d
jmp 0x14001398f
call sym.__pthread_self_lite.part.0
mov rbx, rax
jmp 0x14001397a
mov rcx, r13
call sym.pthread_spin_unlock
mov eax, 0xc
jmp 0x1400139ad

Function at 0x140013a80
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x140018368]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140013ab0
mov rdx, qword [rax + 0x1d8]
mov rax, rdx
add rsp, 0x28
ret
call sym.__pthread_self_lite.part.0
xor edx, edx
test rax, rax
jne 0x140013a9a
mov rax, rdx
add rsp, 0x28
ret

Function at 0x140013ad0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x140018368]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140013af8
mov rax, qword [rax + 0x30]
add rsp, 0x28
ret
call sym.__pthread_self_lite.part.0
test rax, rax
jne 0x140013aea
add rsp, 0x28
ret

Function at 0x140013b60
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x140018368]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140013b88
add rax, 0x18
add rsp, 0x28
ret
call sym.__pthread_self_lite.part.0
test rax, rax
jne 0x140013b7a
jmp 0x140013b7e
Function at 0x140013ca0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x140020e28]
test eax, eax
jne 0x140013cb8
xor eax, eax
add rsp, 0x28
ret
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x140018368]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140013ce8
mov edx, dword [rax + 0x20]
test edx, edx
jg 0x140013cae
test byte [rax + 0x40], 3
je 0x140013cae
mov eax, dword [rax + 0x44]
and eax, 1
jmp 0x140013cb0
call sym.__pthread_self_lite.part.0
test rax, rax
jne 0x140013cce
jmp 0x140013cae

Function at 0x140013d00
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x140018368]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140013d40
test ebx, ebx
jle 0x140013d30
lock add dword [rax + 0x20], 1
add rsp, 0x20
pop rbx
ret
lock sub dword [rax + 0x20], 1
add rsp, 0x20
pop rbx
ret
call sym.__pthread_self_lite.part.0
test rax, rax
jne 0x140013d1d
add rsp, 0x20
pop rbx
ret

Function at 0x140013e30
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x140018368]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140013ea8
test byte [rbx + 0x40], 0xc
jne 0x140013e5f
mov eax, dword [0x140020e28]
test eax, eax
jne 0x140013e70
add rsp, 0x28
pop rbx
pop rsi
ret
lea rsi, [rbx + 0x38]
mov rcx, rsi
call sym.pthread_mutex_lock
movzx eax, byte [rbx + 0x40]
test al, 3
je 0x140013e93
mov edx, dword [rbx + 0x44]
test dl, 1
je 0x140013e93
mov ecx, dword [rbx + 0x20]
test ecx, ecx
jle 0x140013ebc
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp sym.pthread_mutex_unlock
call sym.__pthread_self_lite.part.0
mov rbx, rax
test rax, rax
jne 0x140013e4f
add rsp, 0x28
pop rbx
pop rsi
ret
and eax, 0xfffffff3
mov rcx, qword [rbx + 0x30]
and edx, 0xfffffffe
or eax, 4
mov dword [rbx + 0x44], edx
mov byte [rbx + 0x40], al
test rcx, rcx
je 0x140013eda
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, rsi
call sym.pthread_mutex_unlock
call sym._pthread_invoke_cancel
nop
nop dword [rax + rax]
Function at 0x140013ef0
Capabilities:
Get thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
test rcx, rcx
je 0x140013f60
call sym._pthread_time_in_ms_from_timespec
mov rsi, rax
mov eax, 0xfffffffe
cmp rax, rsi
jb 0x140013f98
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x140018368]
mov edi, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140013ff0
test esi, esi
je 0x140013f76
call sym.pthread_testcancel
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140013fd0
mov edx, edi
call sym._pthread_wait_for_single_object
call sym.pthread_testcancel
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x140018368]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140013fe0
call sym.pthread_testcancel
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call sym.pthread_testcancel
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x140018368]
mov edi, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
jne 0x140013f35
call sym.__pthread_self_lite.part.0
mov rbx, rax
jmp 0x140013f35
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140013f4e
call sym.__pthread_self_lite.part.0
jmp 0x140013f76
call sym.__pthread_self_lite.part.0
mov rbx, rax
jmp 0x140013f31

Function at 0x140014000
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov esi, ecx
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x140018368]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140014070
test esi, esi
je 0x140014050
call sym.pthread_testcancel
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140014080
mov edx, esi
call sym._pthread_wait_for_single_object
call sym.pthread_testcancel
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
call sym.pthread_testcancel
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call sym.pthread_testcancel
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
call sym.__pthread_self_lite.part.0
mov rbx, rax
jmp 0x140014021
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14001403a
Function at 0x140014090
Capabilities:
Get thread local storage value
Hijack thread execution

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x4f8
mov rsi, rcx
test rcx, rcx
je 0x140014180
lea rdi, [0x140018358]
mov rcx, rdi
call sym.pthread_mutex_lock
mov rcx, rsi
call sym.__pthread_get_pointer
mov rcx, rdi
mov rbx, rax
call sym.pthread_mutex_unlock
test rbx, rbx
je 0x140014180
mov rcx, qword [rbx + 0x28]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140014180
lea rdi, [rsp + 0x20]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x140014180
lea rbp, [rbx + 0x38]
mov rcx, rbp
call sym.pthread_mutex_lock
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x140018368]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140014290
movzx edx, byte [rbx + 0x40]
cmp rsi, qword [rax + 0x1d8]
je 0x140014198
mov eax, dword [rbx + 0x44]
and eax, 3
cmp eax, 3
je 0x1400141f0
test dl, 3
jne 0x140014170
and edx, 0xfffffffc
or edx, 1
mov byte [rbx + 0x40], dl
lock add dword [0x140020e28], 1
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140014161
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rbp
call sym.pthread_mutex_unlock
xor eax, eax
jmp 0x140014185
mov rcx, rbp
call sym.pthread_mutex_unlock
test byte [rbx + 0x40], 0xc
je 0x140014169
nop
mov eax, 3
add rsp, 0x4f8
pop rbx
pop rsi
pop rdi
pop rbp
ret
test dl, 3
jne 0x140014170
and edx, 0xfffffffc
or edx, 1
mov byte [rbx + 0x40], dl
lock add dword [0x140020e28], 1
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x1400141bd
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [rbx + 0x44]
mov edx, eax
and edx, 3
cmp edx, 3
jne 0x140014161
and eax, 0xfffffffe
mov rcx, rbp
mov dword [rbx + 0x44], eax
movzx eax, byte [rbx + 0x40]
and eax, 0xfffffff3
or eax, 4
mov byte [rbx + 0x40], al
call sym.pthread_mutex_unlock
call sym._pthread_invoke_cancel
nop word [rax + rax]
test dl, 0xc
jne 0x140014170
and edx, 0xf
jne 0x140014180
mov rcx, qword [rbx + 0x28]
mov dword [rsp + 0x50], 0x100001
call qword [sym.imp.KERNEL32.dll_SuspendThread]
xor edx, edx
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140014161
mov rcx, qword [rbx + 0x28]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
lea rax, [sym._pthread_invoke_cancel]
mov rcx, qword [rbx + 0x28]
mov rdx, rdi
mov qword [rsp + 0x118], rax
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
movzx eax, byte [rbx + 0x40]
and dword [rbx + 0x44], 0xfffffffe
and eax, 0xfffffff0
or eax, 5
mov byte [rbx + 0x40], al
lock add dword [0x140020e28], 1
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140014278
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rbp
call sym.pthread_mutex_unlock
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x140014161
call sym.__pthread_self_lite.part.0
test rax, rax
jne 0x140014120
movzx edx, byte [rbx + 0x40]
jmp 0x14001412d
Function at 0x1400142b0
Capabilities:
Get thread local storage value
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rdi, [0x140018358]
mov rbx, rcx
mov rcx, rdi
mov esi, edx
call sym.pthread_mutex_lock
mov rcx, rbx
call sym.__pthread_get_pointer
test rax, rax
je 0x140014328
cmp qword [rax + 0x1d8], rbx
jne 0x140014328
test byte [rax + 0x40], 0xc
jne 0x140014328
mov edx, dword [rax + 0xbc]
test edx, edx
jne 0x140014328
mov rax, qword [rax + 0x28]
sub rax, 1
cmp rax, 0xfffffffffffffffd
ja 0x140014328
mov rcx, rdi
call sym.pthread_mutex_unlock
test esi, esi
je 0x140014340
lea edx, [rsi - 2]
cmp edx, 0x15
ja 0x140014348
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp sym.pthread_cancel
mov rcx, rdi
call sym.pthread_mutex_unlock
mov eax, 3
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor eax, eax
jmp 0x140014335
mov eax, 0x16
jmp 0x140014335

Function at 0x1400144e0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov esi, ecx
mov rdi, rdx
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x140018368]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140014550
cmp esi, 1
ja 0x14001455d
lea rbp, [rbx + 0x38]
mov rcx, rbp
call sym.pthread_mutex_lock
test rdi, rdi
je 0x140014524
mov eax, dword [rbx + 0x44]
and eax, 1
mov dword [rdi], eax
mov eax, dword [rbx + 0x44]
mov rcx, qword [rbx + 0x1d8]
and eax, 0xfffffffe
or eax, esi
mov dword [rbx + 0x44], eax
call sym.test_cancel_locked
mov rcx, rbp
call sym.pthread_mutex_unlock
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
call sym.__pthread_self_lite.part.0
mov rbx, rax
test rax, rax
jne 0x140014506
mov eax, 0x16
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x140014570
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov esi, ecx
mov rdi, rdx
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x140018368]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x1400145e8
mov ebp, esi
and ebp, 0xfffffffd
jne 0x1400145f5
lea r12, [rbx + 0x38]
mov rcx, r12
call sym.pthread_mutex_lock
test rdi, rdi
je 0x1400145b8
mov eax, dword [rbx + 0x44]
and eax, 2
mov dword [rdi], eax
mov eax, dword [rbx + 0x44]
mov rcx, qword [rbx + 0x1d8]
and eax, 0xfffffffd
or eax, esi
mov dword [rbx + 0x44], eax
call sym.test_cancel_locked
mov rcx, r12
call sym.pthread_mutex_unlock
mov eax, ebp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call sym.__pthread_self_lite.part.0
mov rbx, rax
test rax, rax
jne 0x140014598
mov ebp, 0x16
mov eax, ebp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x1400148a0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rsi, rcx
mov rbp, rdx
test rcx, rcx
je 0x1400149c0
lea rdi, [0x140018358]
mov rcx, rdi
call sym.pthread_mutex_lock
mov rcx, rsi
call sym.__pthread_get_pointer
mov rcx, rdi
mov rbx, rax
call sym.pthread_mutex_unlock
test rbx, rbx
je 0x1400149c0
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x1400149c0
lea rdx, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x1400149c0
test byte [rbx + 0x44], 4
jne 0x1400149d0
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x140018368]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400149f0
cmp rsi, qword [rax + 0x1d8]
je 0x140014a18
mov eax, dword [rbx + 0xbc]
mov rcx, qword [rbx + 0x28]
test eax, eax
je 0x14001494b
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14001495a
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x28]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14001496e
call rsi
mov qword [rbx + 0x30], 0
lea rcx, [rbx + 0x38]
test rbp, rbp
je 0x140014a08
mov rax, qword [rbx + 8]
mov qword [rbp], rax
call sym.pthread_mutex_destroy
lea rcx, [rbx + 0x68]
call sym.pthread_spin_destroy
cmp eax, 1
je 0x140014a1f
cmp qword [rbx + 0x1d0], 0
mov qword [rbx + 0x68], 0xffffffffffffffff
je 0x1400149e0
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov eax, 3
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov eax, 0x16
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, rbx
call sym.push_pthread_mem.part.0
xor eax, eax
jmp 0x1400149b6
call sym.__pthread_self_lite.part.0
test rax, rax
jne 0x140014926
jmp 0x140014933
call sym.pthread_mutex_destroy
jmp 0x140014990
mov eax, 0x24
jmp 0x1400149c5
call sym.replace_spin_keys.part.0
nop
nop word cs:[rax + rax]
Function at 0x140014a30
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
lea rbp, [0x140018358]
mov rsi, rcx
mov rcx, rbp
mov rdi, rdx
call sym.pthread_mutex_lock
mov rcx, rsi
call sym.__pthread_get_pointer
mov rbx, rax
test rax, rax
je 0x140014b50
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x140014b50
lea rdx, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x140014b50
test byte [rbx + 0x44], 4
jne 0x140014b70
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x140018368]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140014bb0
mov rdx, qword [rax + 0x1d8]
cmp rsi, rdx
je 0x140014be8
mov edx, dword [rbx + 0xbc]
mov rcx, qword [rbx + 0x28]
test edx, edx
jne 0x140014ad7
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140014b90
mov rcx, qword [rbx + 0x28]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140014aeb
call rsi
mov qword [rbx + 0x30], 0
lea rcx, [rbx + 0x38]
test rdi, rdi
je 0x140014bc8
mov rax, qword [rbx + 8]
mov qword [rdi], rax
call sym.pthread_mutex_destroy
lea rcx, [rbx + 0x68]
call sym.pthread_spin_destroy
cmp eax, 1
je 0x140014bfa
cmp qword [rbx + 0x1d0], 0
mov qword [rbx + 0x68], 0xffffffffffffffff
je 0x140014bd8
mov rcx, rbp
call sym.pthread_mutex_unlock
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, rbp
call sym.pthread_mutex_unlock
mov eax, 3
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, rbp
call sym.pthread_mutex_unlock
mov eax, 0x16
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov eax, dword [rbx + 0xbc]
test eax, eax
jne 0x140014ad3
mov rcx, rbp
call sym.pthread_mutex_unlock
mov eax, 0x10
jmp 0x140014b3e
call sym.__pthread_self_lite.part.0
xor edx, edx
test rax, rax
jne 0x140014aa5
jmp 0x140014aac
call sym.pthread_mutex_destroy
jmp 0x140014b0c
mov rcx, rbx
call sym.push_pthread_mem.part.0
jmp 0x140014b34
mov rcx, rbp
call sym.pthread_mutex_unlock
mov eax, 0x24
jmp 0x140014b3e
call sym.replace_spin_keys.part.0
nop
Function at 0x14004a7d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x40
xor ebx, ebx
mov dword [rsp + 0x58], 4
cmp dword [0x14009b400], ebx
mov dword [rsp + 0x50], ebx
jne 0x14004a84e
lea rax, [r11 + 0x10]
mov r9d, 0x20000010
mov qword [r11 - 0x18], rax
lea r8, str.CacheDisable
lea rax, [r11 + 8]
mov rcx, 0xffffffff80000002
mov qword [r11 - 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionFveDetect
mov qword [r11 - 0x28], rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, 0xfffffffc
jne 0x14004a84e
cmp eax, 1
je 0x14004a84e
mov eax, dword [0x14009a71c]
cmp dword [rsp + 0x50], ebx
mov dword [0x14009b400], 1
cmovne eax, ebx
mov dword [0x14009a71c], eax
jmp 0x14004a854
mov eax, dword [0x14009a71c]
add rsp, 0x40
pop rbx
ret
Function at 0x14004b700
Capabilities:
Access peb ldr_data

Disassembly:
push rcx
push r11
push r13
sub rcx, rcx
add rcx, 0x60
mov r11, qword gs:[rcx]
push r10
mov rcx, r11
add rcx, 0x10
adc byte [rbx + rcx*4 + 0x11], cl
add r11, 0x18
mov r13, qword [r11]
mov rcx, r13
add rcx, 0x10
mov r11, qword [rcx]
push r12
mov r13, r11
add r13, 0x30
mov rcx, qword [r13]
cmp rcx, 0
je 0x14004b773
mov r13, qword [r11 + 0x60]
mov r12, qword [r13]
and r12d, 0xdf00df
mov r13, qword [r13 + 0xc]
shl r13d, 8
add r13d, r12d
shl r13d, 2
sub r13d, 0xc914cd2c
cmp r13, 0
je 0x14004b77b
mov r13, qword [r11]
mov r11, r13
jmp 0x14004b765
invalid
mov r11d, dword [rcx + 0x3c]
add r11, rcx
add r11, 0x10
mov r13d, dword [r11 + 0x78]
add r13, rcx
push rbx
mov r12d, dword [r13 + 0x20]
add r12, rcx
mov ebx, dword [r12]
add rbx, rcx
mov r11d, dword [rbx + 0xb]
sub r11d, 0x746365
test r11d, r11d
jne 0x14004b7b1
jmp 0x14004b7bf
inc r12
inc r12
inc r12
inc r12
jmp 0x14004b795
mov r11d, dword [r13 + 0x20]
sub r12, r11
sub r12, rcx
shr r12d, 1
mov r11d, dword [r13 + 0x24]
add r11, r12
add r11, rcx
mov r12d, dword [r11]
mov r11d, dword [r13 + 0x1c]
and r12d, 0xffff
shl r12d, 2
add r11, rcx
add r11, r12
mov r12d, dword [r11]
mov r11d, 0x104000
add r12, rcx
push rcx
add r11, r10
push r10
push r11
push rbx
push rbx
push r12
mov rcx, r11
mov r9, rsp
sub r8, r8
add r8, 0x40
mov edx, 0x55000
call r12
pop r13
pop rbx
pop rbx
pop r11
pop r10
mov ecx, 0x3921
movabs r13, 0x3a4c0
push r12
mov r12d, 0x2d
imul ecx, r12d
movabs r12, 0x137c
add rcx, r12
add rcx, r10
call 0x14004b87c
mov r11d, 0x144000
movabs rcx, 0xdd449
add rcx, r10
add r11, r10
mov r13d, 0x3aa0
call 0x14004b87c
pop r12
cmp rcx, r11
jne 0x14004b8b4
mov r12d, dword [rcx]
xor r12d, 0x6a9d350d
dec r12
mov dword [r11], r12d
dec r13
dec r13
dec r13
inc rcx
inc rcx
inc rcx
inc rcx
add r11, 4
dec r13
test r13d, r13d
je 0x14004b8b2
jmp 0x14004b87c
nop
ret
mov ecx, 0x8000000
movabs r11, 0x104000
mov r13d, 0x48a
mov r12d, 3
imul r13d, r12d
add r11, r10
add r13d, 0x262
sub r11, r13
mov r13, r11
sub r13, rcx
movabs rcx, 0xe2049
add rcx, r10
mov r12d, dword [rcx]
xor r12d, 0x6a9d350d
dec r12
test r12d, r12d
je 0x14004b919
add r12, r11
mov rbx, qword [r12]
add rbx, r13
mov qword [r12], rbx
add rcx, 4
jmp 0x14004b8f3
mov r11d, 0xc77
movabs rcx, 0x4348
sub rsp, 0x28
add rcx, 0x10f50b
add rcx, r10
add ecx, edx
add rcx, r11
push rcx
mov rcx, r11
dec r11
jmp 0x14004b8b2

Function at 0x14004bbbc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14004bc08
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14004bc00
cmp dword [rcx + 0x3c], edx
jl 0x14004bc00
cmp dword [rcx + 0x3c], 0x10000000
jae 0x14004bc00
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x14004bc08
mov rax, rdx
add rsp, 0x18
ret
Function at 0x140002be0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd rax, dword [rcx + 0x3c]
mov r10, rcx
mov ecx, 0x5a4d
mov ebx, edx
cmp word [r10], cx
jne 0x140002c74
cmp dword [rax + r10], 0x4550
jne 0x140002c74
cmp dword [rax + r10 + 0x8c], 0
je 0x140002c74
mov eax, dword [rax + r10 + 0x88]
xor r8d, r8d
add rax, r10
mov r9d, dword [rax + 0x20]
mov edi, dword [rax + 0x1c]
add r9, r10
mov esi, dword [rax + 0x24]
add rdi, r10
mov r11d, dword [rax + 0x18]
add rsi, r10
test r11d, r11d
je 0x140002c74
mov edx, dword [r9]
xor eax, eax
add rdx, r10
movzx ecx, byte [rdx]
test cl, cl
je 0x140002c64
ror eax, 0xd
lea rdx, [rdx + 1]
movsx ecx, cl
add eax, ecx
movzx ecx, byte [rdx]
test cl, cl
jne 0x140002c51
cmp ebx, eax
je 0x140002c86
inc r8d
add r9, 4
cmp r8d, r11d
jb 0x140002c42
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov rbx, qword [rsp + 8]
movsxd rax, r8d
movzx ecx, word [rsi + rax*2]
mov rsi, qword [rsp + 0x10]
mov eax, dword [rdi + rcx*4]
mov rdi, qword [rsp + 0x18]
add rax, r10
ret

Function at 0x140002cb0
Capabilities:
Parse pe header

Disassembly:
push rbp
push r14
sub rsp, 0x48
mov rax, qword [0x140006008]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov eax, 0x5a4d
mov r14, r8
mov rbp, rdx
cmp word [rdx], ax
jne 0x140002db6
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x140002db6
mov qword [rsp + 0x40], rsi
movzx esi, word [rax + 0x14]
add rsi, rax
mov dword [rsp + 0x20], 0
cmp dword [rsi + 0x24], 0
je 0x140002db1
mov qword [rsp + 0x30], r15
add rsi, 0x28
mov qword [rsp + 0x60], rbx
lea r15, str..text
mov qword [rsp + 0x38], rdi
nop word [rax + rax]
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rsi + rax - 0x10]
inc rax
cmp cl, byte [r15 + rax - 1]
jne 0x140002d98
cmp rax, 6
jne 0x140002d40
mov edi, dword [rsi - 4]
lea r9, [rsp + 0x20]
mov ebx, dword [rsi + 4]
lea r8d, [rax + 0x3a]
mov edx, dword [rsi]
add rdi, rbp
mov rcx, rdi
add rbx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, dword [rsi]
mov rdx, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov edx, dword [rsi]
lea r9, [rsp + 0x20]
mov r8d, dword [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
add rsi, 0x28
cmp dword [rsi - 4], 0
jne 0x140002d30
mov r15, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140002de0
add rsp, 0x48
pop r14
pop rbp
ret

Function at 0x140003770
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400037ba
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400037ba
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400037ba
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400037ba
cmp dword [rcx + 0x84], 0xe
jbe 0x1400037ba
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400037bc
xor al, al
add rsp, 0x28
ret