joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140022af0
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov r8, qword [rcx + 0x10]
cmp r8, qword [rcx + 0x18]
je 0x140022b22
mov rax, qword [rdi]
mov qword [r8], rax
add qword [rsi + 0x10], 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rax, qword [rsi]
mov rdx, qword [rsi + 8]
mov rcx, rdx
sub rcx, rax
jbe 0x140022b81
sar rcx, 3
lea rax, [rcx + 1]
shr rax, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r15, rax
neg r15
shl rax, 3
mov rbx, rdx
sub rbx, rax
mov r14, r8
sub r14, rdx
je 0x140022b6d
mov rcx, rbx
mov r8, r14
call fcn.1400bfeb0
mov r8, qword [rsi + 8]
add rbx, r14
mov qword [rsi + 0x10], rbx
lea rax, [r8 + r15*8]
mov qword [rsi + 8], rax
mov r8, rbx
jmp 0x140022b0b
mov rcx, r8
sub rcx, rax
sar rcx, 2
cmp r8, rax
mov ebx, 1
cmovne rbx, rcx
mov rax, rbx
shr rax, 0x3d
jne 0x140022c1e
lea rcx, [rbx*8]
call fcn.140023b10
mov rcx, rbx
and rcx, 0xfffffffffffffffc
lea rdx, [rax + rcx*2]
mov rcx, qword [rsi + 8]
mov r11, qword [rsi + 0x10]
lea r9, [rax + rbx*8]
mov r8, rdx
sub r11, rcx
je 0x140022bf5
mov r10, r11
sar r10, 3
and r11, 0xfffffffffffffff8
mov r8, r11
add r8, rdx
shl r10, 3
xor r11d, r11d
mov rbx, qword [rcx + r11]
mov qword [rdx + r11], rbx
add r11, 8
cmp r10, r11
jne 0x140022be4
mov rcx, qword [rsi]
mov qword [rsi], rax
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], r8
mov qword [rsi + 0x18], r9
test rcx, rcx
je 0x140022b0b
call fcn.14001d060
mov r8, qword [rsi + 0x10]
jmp 0x140022b0b
call fcn.140026df0
int3

Function at 0x140022c30
Capabilities:
Encode data using base64

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rdx, qword [rcx + 8]
cmp rdx, qword [rcx]
je 0x140022c61
mov rbx, rdx
mov rax, qword [rdi]
mov qword [rbx - 8], rax
add qword [rsi + 8], 0xfffffffffffffff8
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov r8, qword [rsi + 0x10]
mov rax, qword [rsi + 0x18]
cmp r8, rax
jae 0x140022cb3
sub rax, r8
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
lea r14, [rax + rcx]
inc r14
sar r14, 1
lea rbx, [r8 + r14*8]
mov rax, r8
sub rax, rdx
sub rbx, rax
sub r8, rdx
je 0x140022ca5
mov rcx, rbx
call fcn.1400bfeb0
mov rdx, qword [rsi + 0x10]
mov qword [rsi + 8], rbx
lea rax, [rdx + r14*8]
mov qword [rsi + 0x10], rax
jmp 0x140022c4b
mov rcx, rax
sub rcx, rdx
sar rcx, 2
cmp rax, rdx
mov r14d, 1
cmovne r14, rcx
mov rax, r14
shr rax, 0x3d
jne 0x140022d59
lea rcx, [r14*8]
call fcn.140023b10
lea rbx, [r14*2 + 6]
and rbx, 0xfffffffffffffff8
add rbx, rax
mov rcx, qword [rsi + 8]
mov r10, qword [rsi + 0x10]
lea rdx, [rax + r14*8]
mov r8, rbx
sub r10, rcx
je 0x140022d30
mov r9, r10
sar r9, 3
and r10, 0xfffffffffffffff8
mov r8, r10
add r8, rbx
shl r9, 3
xor r10d, r10d
mov r11, qword [rcx + r10]
mov qword [rbx + r10], r11
add r10, 8
cmp r9, r10
jne 0x140022d1f
mov rcx, qword [rsi]
mov qword [rsi], rax
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], r8
mov qword [rsi + 0x18], rdx
test rcx, rcx
je 0x140022c4b
call fcn.14001d060
mov rbx, qword [rsi + 8]
jmp 0x140022c4b
call fcn.140026df0
int3
Function at 0x140025790
Capabilities:
Encode data using base64

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rdx, qword [rcx + 8]
cmp rdx, qword [rcx]
je 0x1400257c1
mov rbx, rdx
mov rax, qword [rdi]
mov qword [rbx - 8], rax
add qword [rsi + 8], 0xfffffffffffffff8
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov r8, qword [rsi + 0x10]
mov rax, qword [rsi + 0x18]
cmp r8, rax
jae 0x140025813
sub rax, r8
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
lea r14, [rax + rcx]
inc r14
sar r14, 1
lea rbx, [r8 + r14*8]
mov rax, r8
sub rax, rdx
sub rbx, rax
sub r8, rdx
je 0x140025805
mov rcx, rbx
call fcn.1400bfeb0
mov rdx, qword [rsi + 0x10]
mov qword [rsi + 8], rbx
lea rax, [rdx + r14*8]
mov qword [rsi + 0x10], rax
jmp 0x1400257ab
mov rcx, rax
sub rcx, rdx
sar rcx, 2
cmp rax, rdx
mov r14d, 1
cmovne r14, rcx
mov rax, r14
shr rax, 0x3d
jne 0x1400258b9
lea rcx, [r14*8]
call fcn.140023b10
lea rbx, [r14*2 + 6]
and rbx, 0xfffffffffffffff8
add rbx, rax
mov rcx, qword [rsi + 8]
mov r10, qword [rsi + 0x10]
lea rdx, [rax + r14*8]
mov r8, rbx
sub r10, rcx
je 0x140025890
mov r9, r10
sar r9, 3
and r10, 0xfffffffffffffff8
mov r8, r10
add r8, rbx
shl r9, 3
xor r10d, r10d
mov r11, qword [rcx + r10]
mov qword [rbx + r10], r11
add r10, 8
cmp r9, r10
jne 0x14002587f
mov rcx, qword [rsi]
mov qword [rsi], rax
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], r8
mov qword [rsi + 0x18], rdx
test rcx, rcx
je 0x1400257ab
call fcn.14001d060
mov rbx, qword [rsi + 8]
jmp 0x1400257ab
call fcn.140026df0
int3
Function at 0x140027c20
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov ecx, 0x10
call fcn.140023b10
mov qword [rax], rdi
mov qword [rax + 8], rsi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x140081d90]
xor ecx, ecx
xor edx, edx
mov r9, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x140027c78
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x140027f20
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov rax, qword [0x142230118]
mov rcx, qword [rax]
call fcn.140023bf0
mov rcx, qword [0x142202560]
call fcn.140028010
mov rax, rsi
shl rax, 0xf
movabs rcx, 0x7ffffffffff8000
and rcx, rax
mov qword [0x142202558], rcx
mov rcx, rsi
shl rcx, 0x14
call fcn.140027fd0
mov qword [0x142202560], rax
test rax, rax
je 0x140027f82
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140027720
mov rdi, qword [str._b__B]
lea rdx, str.Failed_to_allocate
mov rcx, rdi
call fcn.140018620
mov rcx, rdi
mov rdx, rsi
call fcn.14001d070
mov rsi, rax
lea rdx, str.MB_for_transposition_table.
mov rcx, rax
call fcn.140018620
mov rcx, rsi
call fcn.140018240
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3

Function at 0x140028010
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
test rcx, rcx
je 0x14002802d
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
je 0x140028034
add rsp, 0x28
pop rdi
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rdi, qword [str._b__B]
lea rdx, str.Failed_to_free_large_page_memory._Error_code:_0x
mov rcx, rdi
call fcn.140018620
mov rax, qword [rdi]
mov rax, qword [rax - 0x18]
mov ecx, dword [rdi + rax + 8]
and ecx, 0xffffffb5
or ecx, 8
mov dword [rdi + rax + 8], ecx
mov rcx, rdi
mov edx, esi
call fcn.1400428c0
mov rcx, qword [rax]
mov rcx, qword [rcx - 0x18]
mov edx, dword [rax + rcx + 8]
and edx, 0xffffffb5
or edx, 2
mov dword [rax + rcx + 8], edx
mov rcx, rax
call fcn.140018240
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3
Function at 0x140030310
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
mov rsi, qword [0x1400c1048]
xor eax, eax
lock cmpxchg qword [rsi], rdi
sete bl
je 0x140030369
cmp rdi, rax
je 0x140030369
mov r14, qword [sym.imp.KERNEL32.dll_Sleep]
nop word [rax + rax]
mov ecx, 0x3e8
call r14
xor eax, eax
lock cmpxchg qword [rsi], rdi
sete bl
je 0x140030369
cmp rdi, rax
jne 0x140030350
mov rdi, qword [0x1400c1050]
mov eax, dword [rdi]
cmp eax, 1
jne 0x140030383
mov ecx, 0x1f
call fcn.140082c30
jmp 0x1400303aa
cmp dword [rdi], 0
je 0x140030391
mov byte [0x1400ec458], 1
jmp 0x1400303aa
mov dword [rdi], 1
mov rcx, qword [str.xE_r_]
mov rdx, qword [0x1400c1070]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
mov eax, dword [rdi]
cmp eax, 1
jne 0x1400303ca
mov rcx, qword [0x1400c1058]
mov rdx, qword [str._E_r_]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
mov dword [rdi], 2
test bl, bl
je 0x1400303d3
xor eax, eax
xchg qword [rsi], rax
mov rax, qword [0x1400c1010]
mov rax, qword [rax]
test rax, rax
je 0x1400303f2
xor ecx, ecx
mov edx, 2
xor r8d, r8d
call qword [0x14225c008]
call fcn.140082160
lea rcx, [0x1400826f0]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [0x1400c1040]
mov qword [rcx], rax
lea rcx, [0x140030540]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__set_invalid_parameter_handler
call fcn.140082150
movsxd rdi, dword [0x1400ec444]
lea rcx, [rdi*8 + 8]
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov rsi, rax
test rdi, rdi
jle 0x140030482
mov ebx, edi
mov r14, qword [0x1400ec448]
xor r15d, r15d
nop word [rax + rax]
mov rcx, qword [r14 + r15*8]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
lea rdi, [rax + 1]
mov rcx, rdi
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov qword [rsi + r15*8], rax
mov rdx, qword [r14 + r15*8]
mov rcx, rax
mov r8, rdi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
inc r15
cmp rbx, r15
jne 0x140030450
jmp 0x140030484
xor ebx, ebx
mov qword [rsi + rbx*8], 0
mov qword [0x1400ec448], rsi
call fcn.140081fa0
mov rax, qword [0x1400ec450]
mov rcx, qword [0x1400c1018]
mov rcx, qword [rcx]
mov qword [rcx], rax
mov ecx, dword [0x1400ec444]
mov rdx, qword [0x1400ec448]
mov r8, qword [0x1400ec450]
call fcn.1400275b0
mov dword [0x1400ec45c], eax
cmp dword [0x1400ec43c], 0
je 0x1400304f4
cmp byte [0x1400ec458], 0
jne 0x1400304e8
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
mov eax, dword [0x1400ec45c]
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3
Function at 0x140030bf0
Capabilities:
Get thread local storage value
Print debug messages
Set thread local storage value

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xb8
mov r15, qword [0x1400c11a0]
mov rax, qword [r15]
xor rax, rsp
mov qword [rsp + 0xb0], rax
call fcn.1400324e0
mov ecx, dword [0x1400ec010]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x140030d37
call fcn.140032a70
mov rsi, rax
xor eax, eax
cmp qword [0x1400d45a8], 0
je 0x140030d37
test rsi, rsi
je 0x140030d37
mov dword [rsi + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsi + 0x70], eax
xor ecx, ecx
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], 0xffffffffffffffff
lea rcx, [rsi + 0x68]
call fcn.1400831d0
cmp eax, 1
je 0x140030d65
mov qword [rsi + 0x68], 0xffffffffffffffff
mov dword [rsi + 0xb8], 0
mov rdi, rsi
add rdi, 0x28
mov qword [rsi + 0x28], 0
mov r12, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call r12
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r14, rax
call r12
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rbx
mov rdx, r14
mov r8, rax
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x140030d60
mov rcx, qword [rsi + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [rsi + 0xc0], eax
mov dword [rsi + 0xbc], 0
mov eax, dword [rsi + 0x40]
and eax, 0xffffffcf
or eax, 0x10
mov dword [rsi + 0x40], eax
mov ecx, dword [0x1400ec010]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, eax
mov rax, rsi
test ecx, ecx
je 0x140030d60
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
mov rdx, qword [r15]
cmp rdx, rcx
jne 0x140030d5b
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.140083230
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
movups xmm0, xmmword [0x1400c118b]
movups xmmword [rsp + 0x9b], xmm0
movaps xmm0, xmmword [0x1400c1180]
movaps xmmword [rsp + 0x90], xmm0
movaps xmm0, xmmword [0x1400c1170]
movaps xmmword [rsp + 0x80], xmm0
movaps xmm0, xmmword [0x1400c1160]
movaps xmmword [rsp + 0x70], xmm0
movaps xmm0, xmmword [0x1400c1150]
movaps xmmword [rsp + 0x60], xmm0
movaps xmm0, xmmword [0x1400c1140]
movaps xmmword [rsp + 0x50], xmm0
movaps xmm0, xmmword [str.Error_cleaning_up_spin_keys_for_thread]
movaps xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [rsp + 0x67]
mov ecx, eax
mov r8d, 0xa
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ultoa]
mov eax, 0x27
mov rcx, rax
inc rax
cmp rcx, 0x69
ja 0x140030df3
cmp byte [rsp + rcx + 0x40], 0
jne 0x140030de0
cmp rcx, 0x69
ja 0x140030e00
mov word [rsp + rax + 0x3f], 0xa
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
int3
Function at 0x140031960
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
call fcn.140030bf0
mov rdi, rax
mov qword [rax + 8], rsi
mov rcx, qword [rax + 0x1d8]
call fcn.140031680
test byte [rdi + 0x40], 0x30
jne 0x14003199c
add rdi, 0xd0
mov rcx, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_longjmp]
mov ecx, dword [0x1400ec010]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140031a37
mov rdi, rax
cmp qword [rax + 0x28], 0
jne 0x1400319de
mov dword [rdi], 0xdeadbeef
mov rcx, qword [rdi + 0x30]
test rcx, rcx
je 0x1400319d0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 0x30], 0
mov rsi, qword [rdi + 8]
jmp 0x140031a21
mov rsi, qword [rdi + 8]
mov rcx, qword [rdi + 0x30]
mov dword [rdi + 0xbc], 1
test rcx, rcx
je 0x1400319fb
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 0x30], 0
test byte [rdi + 0x44], 4
je 0x140031a37
mov dword [rdi], 0xdeadbeef
mov rcx, qword [rdi + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 0x28], 0
mov rcx, rdi
call fcn.140031a40
mov ecx, dword [0x1400ec010]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, esi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__endthreadex]
int3

Function at 0x1400324e0
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
sub rsp, 0x28
cmp dword [0x1400ec48c], 1
jne 0x1400324f6
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x1400ec018]
call fcn.1400831e0
mov rcx, qword [0x1400ec4b0]
test rcx, rcx
je 0x140032533
lea rax, [0x1400ec48c]
nop word cs:[rax + rax]
mov rsi, rcx
cmp qword [rcx], rax
je 0x14003257d
mov rcx, qword [rsi + 0x18]
test rcx, rcx
jne 0x140032520
jmp 0x140032535
xor esi, esi
mov ecx, 1
mov edx, 0x20
call sub.api_ms_win_crt_heap_l1_1_0.dll_calloc
mov rdi, rax
lea rax, [0x1400ec48c]
mov qword [rdi], rax
mov dword [rdi + 0x10], 1
lea rax, [rsi + 0x18]
test rsi, rsi
lea rcx, [0x1400ec4b0]
cmovne rcx, rax
mov qword [rcx], rdi
lea rcx, [rdi + 8]
xor edx, edx
call fcn.140082fb0
mov rsi, rdi
jmp 0x140032580
inc dword [rsi + 0x10]
lea rcx, [0x1400ec018]
call fcn.140083220
lea rdi, [rsi + 8]
mov rcx, rdi
call fcn.140082d30
mov eax, dword [0x1400ec48c]
cmp eax, 1
je 0x1400325ec
test eax, eax
jne 0x1400325c4
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1400ec010], eax
cmp eax, 0xffffffff
je 0x140032602
mov dword [0x1400ec48c], 1
jmp 0x1400325ec
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9d, dword [0x1400ec48c]
lea r8, [0x1400ec48c]
lea rdx, str._once__p_is__d_n
mov rcx, rax
call fcn.1400838a0
mov rcx, rdi
call fcn.140082ea0
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140031210
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
int3
Function at 0x140032b20
Capabilities:
Print debug messages

Disassembly:
push rsi
push rdi
sub rsp, 0x98
mov rdi, qword [0x1400c11a0]
mov rax, qword [rdi]
xor rax, rsp
mov qword [rsp + 0x90], rax
test rcx, rcx
je 0x140032b57
mov rsi, rcx
call fcn.1400831d0
cmp eax, 1
je 0x140032b79
mov qword [rsi], 0xffffffffffffffff
mov rax, qword [rsp + 0x90]
xor rax, rsp
mov rcx, qword [rdi]
cmp rcx, rax
jne 0x140032b74
add rsp, 0x98
pop rdi
pop rsi
ret
call fcn.140083230
movups xmm0, xmmword [0x1400c118b]
movups xmmword [rsp + 0x7b], xmm0
movaps xmm0, xmmword [0x1400c1180]
movaps xmmword [rsp + 0x70], xmm0
movaps xmm0, xmmword [0x1400c1170]
movaps xmmword [rsp + 0x60], xmm0
movaps xmm0, xmmword [0x1400c1160]
movaps xmmword [rsp + 0x50], xmm0
movaps xmm0, xmmword [0x1400c1150]
movaps xmmword [rsp + 0x40], xmm0
movaps xmm0, xmmword [0x1400c1140]
movaps xmmword [rsp + 0x30], xmm0
movaps xmm0, xmmword [str.Error_cleaning_up_spin_keys_for_thread]
movaps xmmword [rsp + 0x20], xmm0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [rsp + 0x47]
mov ecx, eax
mov r8d, 0xa
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ultoa]
mov eax, 0x27
nop dword [rax + rax]
mov rcx, rax
inc rax
cmp rcx, 0x69
ja 0x140032c03
cmp byte [rsp + rcx + 0x20], 0
jne 0x140032bf0
cmp rcx, 0x69
ja 0x140032c10
mov word [rsp + rax + 0x1f], 0xa
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
int3
Function at 0x140032c30
Capabilities:
Print debug messages

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xb0
mov r15, qword [0x1400c11a0]
mov rax, qword [r15]
xor rax, rsp
mov qword [rsp + 0xa8], rax
mov edi, 3
test rcx, rcx
je 0x140032cee
mov rsi, rdx
mov rbx, rcx
lea rcx, section..data
call fcn.140082d30
mov rcx, qword [0x1400ec498]
test rcx, rcx
je 0x140032ce2
cmp rcx, 1
jne 0x140032c97
mov rax, qword [0x1400ec4a0]
cmp qword [rax + 8], rbx
jne 0x140032ce2
jmp 0x140032d19
dec rcx
mov rax, qword [0x1400ec4a0]
xor edx, edx
jmp 0x140032cbb
inc r8
mov rdx, r8
cmp rdx, rcx
ja 0x140032ce2
lea r8, [rdx + rcx]
shr r8, 1
mov r9, r8
shl r9, 4
cmp qword [rax + r9 + 8], rbx
je 0x140032d16
jbe 0x140032cb0
cmp r8, rdx
je 0x140032ce2
dec r8
mov rcx, r8
cmp rdx, rcx
jbe 0x140032cbb
lea rcx, section..data
call fcn.140082ea0
mov rax, qword [rsp + 0xa8]
xor rax, rsp
mov rcx, qword [r15]
cmp rcx, rax
jne 0x140032df2
mov eax, edi
add rsp, 0xb0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
add rax, r9
mov r14, qword [rax]
lea rcx, section..data
call fcn.140082ea0
test r14, r14
je 0x140032cee
mov rcx, qword [r14 + 0x28]
test rcx, rcx
je 0x140032cee
lea rdx, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x140032cee
mov edi, 0x16
test byte [r14 + 0x44], 4
jne 0x140032cee
call fcn.140030bf0
test rax, rax
je 0x140032d64
mov rax, qword [rax + 0x1d8]
jmp 0x140032d66
xor eax, eax
mov edi, 0x24
cmp rax, rbx
je 0x140032cee
cmp dword [r14 + 0xbc], 0
mov rcx, qword [r14 + 0x28]
je 0x140032d8c
lea rax, [rcx + 1]
cmp rax, 2
jb 0x140032d9b
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [r14 + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [r14 + 0x30]
test rcx, rcx
je 0x140032db0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r14 + 0x30], 0
test rsi, rsi
je 0x140032dc4
mov rax, qword [r14 + 8]
mov qword [rsi], rax
lea rcx, [r14 + 0x38]
call fcn.140083040
lea rcx, [r14 + 0x68]
call fcn.1400831d0
cmp eax, 1
je 0x140032df7
mov qword [r14 + 0x68], 0xffffffffffffffff
mov rcx, r14
call fcn.140031a40
xor edi, edi
jmp 0x140032cee
call fcn.140083230
movups xmm0, xmmword [0x1400c118b]
movups xmmword [rsp + 0x8b], xmm0
movaps xmm0, xmmword [0x1400c1180]
movaps xmmword [rsp + 0x80], xmm0
movaps xmm0, xmmword [0x1400c1170]
movaps xmmword [rsp + 0x70], xmm0
movaps xmm0, xmmword [0x1400c1160]
movaps xmmword [rsp + 0x60], xmm0
movaps xmm0, xmmword [0x1400c1150]
movaps xmmword [rsp + 0x50], xmm0
movaps xmm0, xmmword [0x1400c1140]
movaps xmmword [rsp + 0x40], xmm0
movaps xmm0, xmmword [str.Error_cleaning_up_spin_keys_for_thread]
movaps xmmword [rsp + 0x30], xmm0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [rsp + 0x57]
mov ecx, eax
mov r8d, 0xa
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ultoa]
mov eax, 0x27
mov rcx, rax
inc rax
cmp rcx, 0x69
ja 0x140032e82
cmp byte [rsp + rcx + 0x30], 0
jne 0x140032e6f
cmp rcx, 0x69
ja 0x140032e8f
mov word [rsp + rax + 0x2f], 0xa
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
int3
Function at 0x140082620
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
lea rcx, str.Mingw_w64_runtime_failure:_n
mov edx, 0x1b
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r8, qword [rsp + 0x28]
mov rcx, rax
mov rdx, rsi
call fcn.14008c160
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
int3

Function at 0x140083230
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
lea rdx, str._stack_smashing_detected_:_terminated_n
mov ecx, 2
mov r8d, 0x2c
call sub.api_ms_win_crt_stdio_l1_1_0.dll__write
mov ecx, 0x17
call sub.KERNEL32.dll_IsProcessorFeaturePresent
test eax, eax
je 0x140083260
mov ecx, 2
int 0x29
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
int3
Function at 0x140083440
Capabilities:
Check for time delay via gettickcount
Check for time delay via queryperformancecounter

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov ebx, edx
mov rsi, rcx
mov r15, qword [0x1400c11a0]
mov rax, qword [r15]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea eax, [rbx + 1]
cmp eax, 1
ja 0x14008349f
mov rax, qword [rsp + 0x30]
xor rax, rsp
mov rcx, qword [r15]
cmp rcx, rax
jne case.default.0x140083498
mov rcx, rsi
mov edx, ebx
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rax, qword [0x1400ec550]
test rax, rax
je 0x1400834b5
call rax
mov rdi, rax
xor r12d, r12d
jmp 0x140083529
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x14008351a
mov r12, qword [rsp + 0x28]
test r12, r12
jle 0x140083521
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x140083521
mov rcx, qword [rsp + 0x20]
mov rax, r12
shr rax, 3
movabs rdx, 0x20c49ba5e353f7cf
mul rdx
mov r8, rdx
shr r8, 4
mov rax, rcx
or rax, r8
shr rax, 0x20
je 0x140083645
mov rax, rcx
cqo
idiv r8
mov rdi, rax
jmp 0x140083529
mov r12, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov rcx, rsi
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140083624
mov eax, ebx
add rdi, rax
mov rbp, qword [sym.imp.KERNEL32.dll_GetTickCount]
lea r14, [rsp + 0x20]
mov r13, qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rbx, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
mov rax, qword [0x1400ec550]
test rax, rax
je 0x140083580
call rax
jmp 0x140083604
test r12, r12
je 0x1400835ca
test r12, r12
jle 0x140083600
mov rcx, r14
call r13
test eax, eax
je 0x140083600
mov rcx, qword [rsp + 0x20]
mov rax, r12
shr rax, 3
movabs rdx, 0x20c49ba5e353f7cf
mul rdx
mov r8, rdx
shr r8, 4
mov rax, rcx
or rax, r8
shr rax, 0x20
je 0x1400835e5
mov rax, rcx
cqo
idiv r8
jmp 0x140083604
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x1400835ee
mov r12, qword [rsp + 0x28]
test r12, r12
jg 0x14008358a
jmp 0x140083600
mov eax, ecx
xor edx, edx
div r8d
jmp 0x140083604
mov r12, 0xffffffffffffffff
nop word cs:[rax + rax]
call rbp
mov eax, eax
cmp rdi, rax
jbe 0x14008361f
mov edx, edi
sub edx, eax
mov rcx, rsi
call rbx
cmp eax, 0x102
je 0x140083560
jmp 0x140083624
mov eax, 0x102
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
mov rdx, qword [r15]
cmp rdx, rcx
jne case.default.0x140083498
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov eax, ecx
xor edx, edx
div r8d
jmp 0x140083527
call fcn.140083230
int3