joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5b3e80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
mov rbp, r8
mov edx, dword [rsp + 0x80]
test byte [rdi + 0xe], 0x40
mov r12, r9
jne 0x5b3eb7
movzx eax, word [rdi + 0xa]
movzx ecx, word [rdi + 0xc]
sub eax, ecx
sub dword [rbx + 0x1e0], eax
movzx eax, word [rbx + 0x23c]
test ax, ax
je 0x5b3f2b
cmp ax, dx
jne 0x5b3f2b
movzx eax, word [rbx + 0x238]
movzx r8d, word [rdi + 0xa]
mov edx, eax
cmp eax, r8d
jl 0x5b40bc
movzx ecx, word [rbx + 0x23a]
mov word [rbx + 0x238], dx
cmp ecx, eax
jge 0x5b3efa
mov word [rbx + 0x23a], dx
mov ecx, eax
mov rdx, qword [rbx + 0x110]
add eax, ecx
sar eax, 1
mov word [rbx + 0x236], ax
cdqe
sar rdx, 0x10
cmp rdx, rax
jge 0x5b3f22
shl rax, 0x10
mov qword [rbx + 0x110], rax
xor eax, eax
mov word [rbx + 0x23c], ax
movzx eax, word [rbx + 0x22e]
add eax, 1
cmp word [rbx + 0x22c], ax
movzx edx, ax
je 0x5b3f70
lea r13, [rbx + 0xe0]
xor r14d, r14d
nop dword [rax + rax]
mov rcx, r13
call fcn.0063c060
test rax, rax
je 0x5b4043
test r14b, r14b
jne 0x5b40c7
nop word [rax + rax]
mov rcx, qword [rbp]
sub rcx, qword [rdi]
call fcn.00591c60
mov rdx, qword [rdi]
cmp qword [rbp], rdx
jb 0x5b4034
mov edx, 0x10624dd3
mov ecx, eax
mul edx
mov eax, edx
and eax, 0x1fffffc0
mov r8d, dword [rbx + 0x220]
mov r9d, dword [rbx + 0x218]
test r8d, r8d
jle 0x5b4011
mov esi, r9d
sub esi, eax
mov r10d, esi
sar r10d, 0x1f
xor esi, r10d
sub esi, r10d
cmp r8d, 0xf
jle 0x5b4011
sub eax, r9d
cdq
idiv r8d
add eax, r9d
mov dword [rbx + 0x218], eax
mov r9d, dword [rbx + 0x21c]
mov eax, esi
sub r8d, 1
sub eax, r9d
cdq
idiv r8d
add eax, r9d
mov dword [rbx + 0x21c], eax
cmp dword [r12], ecx
jbe 0x5b3ffb
mov dword [r12], ecx
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp fcn.0068bd18
sub eax, r9d
add r8d, 1
cdq
mov dword [rbx + 0x220], r8d
idiv r8d
add eax, r9d
cmp r8d, 1
mov dword [rbx + 0x218], eax
jg 0x5b3fd4
jmp 0x5b3ff1
mov eax, 0x1900
mov ecx, 0x186a0
jmp 0x5b3f99
movzx eax, word [rbx + 0x230]
movzx ecx, word [rbx + 0x22e]
cmp ax, cx
je 0x5b40b0
add ecx, 1
movzx eax, cx
mov word [rbx + 0x22e], cx
add eax, 1
cmp word [rbx + 0x22c], ax
movzx edx, ax
jne 0x5b40a0
movzx eax, word [rbx + 0x234]
mov r11d, ecx
mov edx, eax
sub r11d, eax
sub edx, ecx
cmp dx, r11w
jbe 0x5b4090
mov word [rbx + 0x234], cx
mov byte [rbx + 0x23e], 0
jmp 0x5b3f70
mov r14d, 1
jmp 0x5b3f50
lea ecx, [rax + 1]
mov word [rbx + 0x230], cx
jmp 0x5b4059
mov eax, r8d
mov edx, r8d
jmp 0x5b3edf
movzx ecx, word [rbx + 0x22e]
jmp 0x5b4072
Function at 0x5c3af0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rbx
sub rsp, 0x58
lea rbx, [rsp + 0x40]
mov rsi, rdx
mov rdx, rcx
mov rcx, rbx
call fcn.00503e30
mov rcx, rbx
call fcn.005041b0
mov rdx, rsi
mov rcx, rbx
mov dword [rsp + 0x20], eax
call fcn.00503e30
mov rcx, rbx
call fcn.005041b0
movzx ecx, byte [rsp + 0x20]
mov dword [rsp + 0x30], eax
mov edx, eax
cmp al, cl
jne 0x5c3b70
movzx ecx, byte [rsp + 0x21]
movzx edx, byte [rsp + 0x31]
cmp dl, cl
jne 0x5c3ba0
movzx ecx, byte [rsp + 0x22]
movzx edx, byte [rsp + 0x32]
cmp dl, cl
jne 0x5c3bb0
movzx ecx, byte [rsp + 0x23]
xor eax, eax
movzx edx, byte [rsp + 0x33]
cmp cl, dl
jne 0x5c3bc0
add rsp, 0x58
pop rbx
pop rsi
ret
xor eax, eax
lea r8d, [rax*8 + 8]
mov eax, edx
xor eax, ecx
cmp dl, cl
movzx eax, al
je 0x5c3b8d
sub r8d, 1
sar eax, 1
jne 0x5c3b85
mov eax, 0x20
sub eax, r8d
add rsp, 0x58
pop rbx
pop rsi
ret
mov eax, 1
jmp 0x5c3b72
mov eax, 2
jmp 0x5c3b72
mov eax, 3
jmp 0x5c3b72
Function at 0x5f3c10
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
mov eax, dword [0x008de6c0]
test eax, eax
je 0x5f3c23
add rsp, 0x58
ret
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x24]
test eax, eax
jle 0x5f3c41
mov dword [0x008de6c0], eax
add rsp, 0x58
ret
mov dword [0x008de6c0], 0x1000
mov eax, 0x1000
add rsp, 0x58
ret

Function at 0x5f3c60
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x50
movsxd rdx, dword [0x008de6c0]
test edx, edx
mov rbx, rcx
je 0x5f3c81
mov rcx, rbx
call fcn.0067e2c0
add rsp, 0x50
pop rbx
ret
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movsxd rdx, dword [rsp + 0x24]
test edx, edx
jle 0x5f3cb0
mov rcx, rbx
mov dword [0x008de6c0], edx
call fcn.0067e2c0
add rsp, 0x50
pop rbx
ret
mov dword [0x008de6c0], 0x1000
mov edx, 0x1000
jmp 0x5f3c73
Function at 0x651a30
Capabilities:
Hash data using sha1

Disassembly:
mov dword [rcx], 0x67452301
mov dword [rcx + 4], 0xefcdab89
mov dword [rcx + 8], 0x98badcfe
mov dword [rcx + 0xc], 0x10325476
mov dword [rcx + 0x10], 0xc3d2e1f0
mov dword [rcx + 0x18], 0
mov dword [rcx + 0x14], 0
ret

Function at 0x656d80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push r12
push rbp
push rdi
push rsi
push rbx
movzx ebx, byte [r8 + 4]
lea rsi, [r8 + 8]
mov eax, edx
mov edx, dword [r8]
lea r12d, [rax - 1]
test eax, eax
mov r9d, edx
je 0x656df0
mov r9d, r12d
mov edi, edx
lea rbp, [rcx + r9 + 1]
nop dword [rax + rax]
add edi, 1
add rcx, 1
movzx r10d, dil
add r10, rsi
movzx r9d, byte [r10]
add ebx, r9d
movzx r11d, bl
add r11, rsi
movzx r14d, byte [r11]
mov byte [r10], r14b
mov byte [r11], r9b
add r9b, byte [r10]
movzx r9d, r9b
movzx r9d, byte [rsi + r9]
xor byte [rcx - 1], r9b
cmp rcx, rbp
jne 0x656db0
lea r9d, [rdx + r12 + 1]
movzx r9d, r9b
movzx ebx, bl
mov dword [r8], r9d
mov dword [r8 + 4], ebx
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r14
ret
Function at 0x660640
Capabilities:
Hash data using sha512

Disassembly:
test rcx, rcx
je 0x6606d0
movabs rax, 0x6a09e667f3bcc908
mov qword [rcx + 0x48], 0
mov qword [rcx + 8], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rcx + 0x10], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x18], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x20], rax
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x28], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x30], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x38], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rcx + 0x40], rax
xor eax, eax
mov qword [rcx], 0
ret
mov eax, 1
ret
Function at 0x671510
Capabilities:
Get common file path

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x278
lea rax, str.getaddrinfo
mov qword [rsp + 0x20], rax
mov rax, qword [0x00826d40]
mov ebx, ecx
mov qword [rsp + 0x28], rax
lea rax, str.getnameinfo
mov qword [rsp + 0x30], rax
mov rax, qword [0x00826d50]
mov qword [rsp + 0x38], rax
lea rax, str.freeaddrinfo
mov qword [rsp + 0x40], rax
mov rax, qword [fcn.00671760]
mov qword [rsp + 0x48], rax
mov eax, dword [0x008deb50]
test eax, eax
je 0x6715a0
lea rax, str.getaddrinfo
movzx ebx, bx
shl rbx, 4
mov rax, qword [rax + rbx + 8]
add rsp, 0x278
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
lea rsi, [rsp + 0x50]
mov edx, 0x104
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x6715c3
mov dword [0x008deb50], 1
jmp 0x671573
lea r12, [rsp + 0x160]
mov rdx, rsi
mov rcx, r12
call sub.msvcrt.dll_strcpy
mov rdx, r12
mov ecx, dword [rdx]
add rdx, 4
lea eax, [rcx - 0x1010101]
not ecx
and eax, ecx
and eax, 0x80808080
je 0x6715d9
mov ecx, eax
mov r13, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
shr ecx, 0x10
test eax, 0x8080
cmove eax, ecx
lea rcx, [rdx + 2]
cmove rdx, rcx
add al, al
mov rcx, r12
movabs rax, 0x32335f3273775c
sbb rdx, 3
mov qword [rdx], rax
call r13
test rax, rax
mov rdi, rax
je 0x6716d2
lea rdx, str.getaddrinfo
mov rcx, rax
mov rbp, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rbp
test rax, rax
je 0x6716c9
lea rdx, str.getaddrinfo
mov rcx, rdi
call rbp
lea rsi, [rsp + 0x20]
lea r12, [rsi + 0x30]
test rax, rax
mov qword [rsi + 8], rax
je 0x67168a
nop dword [rax + rax]
add rsi, 0x10
cmp rsi, r12
je 0x6716a0
mov rdx, qword [rsi]
mov rcx, rdi
call rbp
test rax, rax
mov qword [rsi + 8], rax
jne 0x671670
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x6715b7
mov rax, qword [rsp + 0x28]
mov qword [0x007f21e8], rax
mov rax, qword [rsp + 0x38]
mov qword [0x007f21f8], rax
mov rax, qword [rsp + 0x48]
mov qword [fcn.00671760], rax
jmp 0x6715b7
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rdx, rsi
mov rcx, r12
call sub.msvcrt.dll_strcpy
mov rdx, r12
mov ecx, dword [rdx]
add rdx, 4
lea eax, [rcx - 0x1010101]
not ecx
and eax, ecx
and eax, 0x80808080
je 0x6716e0
mov ecx, eax
shr ecx, 0x10
test eax, 0x8080
cmove eax, ecx
lea rcx, [rdx + 2]
cmove rdx, rcx
add al, al
mov rcx, r12
movabs rax, 0x3670696873775c
sbb rdx, 3
mov qword [rdx], rax
call r13
test rax, rax
mov rdi, rax
je 0x6715b7
lea rdx, str.getaddrinfo
mov rcx, rdi
mov rbp, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rbp
test rax, rax
jne 0x67164d
jmp 0x67168a
Function at 0x672010
Capabilities:
Resolve dns

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r13, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
mov edi, edx
mov ebp, r8d
mov esi, r9d
mov qword [rbx], 0
mov byte [r13], 0
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
mov r12, rax
je 0x6720e0
cmp dword [rax + 0x10], 0x40002
jne 0x6720b0
mov r14, qword [rax + 0x18]
mov r10, qword [r14]
test r10, r10
je 0x6720b0
movzx esi, si
jmp 0x672081
mov r10, qword [r14 + 8]
lea rbx, [rax + 0x28]
add r14, 8
test r10, r10
je 0x6720b0
mov r9d, dword [r10]
mov r8d, esi
mov edx, ebp
mov ecx, edi
call fcn.00671dd0
test rax, rax
mov qword [rbx], rax
jne 0x672070
mov eax, 8
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rdx, qword [r12]
mov r8d, 0x400
mov rcx, r13
call sub.msvcrt.dll_strncpy
mov byte [r13 + 0x400], 0
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
call qword [sym.imp.WSOCK32.dll_WSAGetLastError]
lea edx, [rax - 0x2afa]
cmp edx, 3
mov edx, 0x2af9
cmovae eax, edx
jmp 0x6720cc

Function at 0x67bef0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
movsxd rbp, dword [0x008df184]
test ebp, ebp
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
jle 0x67c00a
mov rax, qword [0x008df188]
xor r9d, r9d
add rax, 8
mov r10, qword [rax]
cmp rbx, r10
jb 0x67bf3e
mov rdx, qword [rax + 8]
mov r11d, dword [rdx + 8]
add r10, r11
cmp rbx, r10
jb 0x67bff0
add r9d, 1
add rax, 0x18
cmp r9d, ebp
jne 0x67bf22
mov rcx, rbx
call fcn.0067cb60
test rax, rax
mov r12, rax
je 0x67c042
lea rbp, [rbp + rbp*2]
shl rbp, 3
mov r13, rbp
add r13, qword [0x008df188]
mov qword [r13 + 0x10], rax
mov dword [r13], 0
call fcn.0067cc80
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
mov qword [r13 + 8], rax
mov rax, qword [0x008df188]
lea rdx, [rsp + 0x20]
mov rcx, qword [rax + rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x67c025
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x67bfe9
sub eax, 0x40
and eax, 0xffffffbf
je 0x67bfe9
mov r9, rbp
mov r8d, 0x40
add r9, qword [0x008df188]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x67c011
add dword [0x008df184], 1
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sub.msvcrt.dll_memcpy
xor ebp, ebp
jmp 0x67bf4b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.0067be80
mov rax, qword [0x008df188]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rbp + 8]
call fcn.0067be80
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.0067be80
nop
nop word cs:[rax + rax]
Function at 0x67c7c0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x008df4a0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x008df480]
test rbx, rbx
je 0x67c814
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x67c80b
test rsi, rsi
je 0x67c80b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x67c7f0
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x008df4a0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax

Function at 0x67ca70
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x67cab1
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x67caa8
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x67cab3
add rax, 0x28
cmp rax, r9
jne 0x67ca94
xor eax, eax
ret

Function at 0x67cb60
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [0x008288b0]
cmp word [rbx], 0x5a4d
je 0x67cb80
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov rsi, rcx
mov rcx, rbx
call fcn.0067ca30
test eax, eax
je 0x67cb74
sub rsi, rbx
mov rcx, rbx
mov rdx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.0067ca70
Function at 0x686280
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
test rdx, rdx
mov rsi, rcx
mov r12, rdx
mov edi, r8d
je 0x6862a2
mov qword [r12], rcx
cmp edi, 0x24
ja 0x686383
cmp edi, 1
jne 0x6862b9
jmp 0x686383
add rsi, 1
movsx ecx, byte [rsi]
mov ebx, ecx
call sub.msvcrt.dll_isspace
test eax, eax
jne 0x6862b5
lea edx, [rbx - 0x2b]
mov rcx, rsi
mov eax, ebx
and edx, 0xfd
jne 0x6862df
movzx eax, byte [rcx + 1]
add rsi, 1
test edi, edi
jne 0x686415
cmp al, 0x30
mov dil, 0xa
je 0x686470
movsx r15d, al
lea edx, [r15 - 0x30]
cmp edx, 9
ja 0x6863f0
movsx r15d, al
sub r15d, 0x30
cmp edi, r15d
jle 0x686495
mov eax, r15d
shr eax, 0x1f
test al, al
jne 0x686495
lea r14, [rsi + 1]
movsxd r15, r15d
xor r13d, r13d
movsxd rsi, edi
nop
movsx ebp, byte [r14]
lea r9d, [rbp - 0x30]
cmp r9d, 9
mov ecx, r9d
jbe 0x6863a4
mov ecx, ebp
call sub.msvcrt.dll_isupper
lea ecx, [rbp - 0x37]
test eax, eax
jne 0x6863a4
mov ecx, ebp
call sub.msvcrt.dll_islower
test eax, eax
jne 0x6863a1
test r12, r12
je 0x686363
mov qword [r12], r14
test r13d, r13d
jne 0x686440
xor edx, edx
cmp bl, 0x2d
sete dl
mov rax, rdx
neg rax
xor r15, rax
lea rax, [r15 + rdx]
jmp 0x686390
call sub.msvcrt.dll__errno
mov dword [rax], 0x21
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea ecx, [rbp - 0x57]
cmp edi, ecx
jle 0x68635a
test ecx, ecx
js 0x68635a
xor edx, edx
mov rax, 0xffffffffffffffff
div rsi
add rax, 1
cmp r15, rax
ja 0x6863e0
mov rax, r15
movsxd rcx, ecx
imul rax, rsi
add rcx, rax
cmp r15, rcx
ja 0x6863e0
mov r15, rcx
add r14, 1
jmp 0x686330
mov r13d, 1
jmp 0x6863d6
mov ecx, r15d
call sub.msvcrt.dll_isupper
test eax, eax
jne 0x686460
mov ecx, r15d
call sub.msvcrt.dll_islower
mov edx, eax
xor eax, eax
test edx, edx
je 0x686390
sub r15d, 0x57
jmp 0x68630b
cmp edi, 0x10
jne 0x6862f2
cmp al, 0x30
jne 0x6862f2
movzx eax, byte [rsi + 1]
and eax, 0xffffffdf
cmp al, 0x58
je 0x686483
mov eax, 0x30
jmp 0x686303
call sub.msvcrt.dll__errno
mov dword [rax], 0x22
mov rax, 0xffffffffffffffff
jmp 0x686390
sub r15d, 0x37
jmp 0x68630b
movzx edx, byte [rsi + 1]
mov dil, 8
and edx, 0xffffffdf
cmp dl, 0x58
jne 0x6862f2
movzx eax, byte [rsi + 2]
mov edi, 0x10
add rsi, 2
jmp 0x6862f2
xor eax, eax
jmp 0x686390
Function at 0x687130
Capabilities:
Query environment variable

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12d, 1
mov edi, ecx
mov rbp, rdx
mov rbx, r9
lea ecx, [r8 - 1]
mov r8d, 0x66666667
mov eax, ecx
movsxd rsi, ecx
sar ecx, 0x1f
imul r8d
sar edx, 2
mov r8d, edx
sub r8d, ecx
je 0x687188
mov ecx, 0x66666667
nop dword [rax]
mov eax, r8d
sar r8d, 0x1f
add r12d, 1
imul ecx
sar edx, 2
sub edx, r8d
mov r8d, edx
jne 0x687170
mov eax, dword [rbx + 0x2c]
cmp eax, 0xffffffff
je 0x687210
cmp eax, r12d
cmovge r12d, eax
mov eax, dword [rbx + 0xc]
lea edx, [r12 + 2]
cmp eax, edx
jg 0x687200
mov dword [rbx + 0xc], 0xffffffff
mov r9, rbx
mov r8d, 1
mov rdx, rbp
mov ecx, edi
add r12d, 1
call fcn.00686a10
mov ecx, dword [rbx + 8]
mov rdx, rbx
mov eax, dword [rbx + 0x2c]
mov dword [rbx + 0x10], eax
mov eax, ecx
and ecx, 0x20
or eax, 0x1c0
or ecx, 0x45
mov dword [rbx + 8], eax
call fcn.006865a0
mov rdx, rbx
mov rcx, rsi
add dword [rbx + 0xc], r12d
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.00686e60
sub eax, edx
mov dword [rbx + 0xc], eax
jmp 0x6871ae
mov edx, dword [0x007f22e0]
cmp edx, 0xffffffff
je 0x687239
test edx, edx
mov eax, 2
jne 0x687231
call fcn.0068bff0
and eax, 1
neg eax
add eax, 3
mov dword [rbx + 0x2c], eax
jmp 0x687194
lea rcx, str.PRINTF_EXPONENT_DIGITS
call sub.msvcrt.dll_getenv
test rax, rax
je 0x687260
movsx eax, byte [rax]
xor edx, edx
sub eax, 0x30
cmp eax, 2
setbe dl
mov dword [0x007f22e0], edx
jmp 0x68721b
xor edx, edx
jmp 0x687258

Function at 0x68da10
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x007f2368], eax
je 0x68da2a
add rsp, 0x28
ret
call sub.msvcrt.dll_abort
nop

Function at 0x68de60
Capabilities:
Print debug messages

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x90
test rcx, rcx
je 0x68de83
mov rbx, rcx
call fcn.0068d7e0
cmp eax, 1
je 0x68de8e
mov qword [rbx], 0xffffffffffffffff
add rsp, 0x90
pop rbx
pop rsi
pop rdi
ret
lea rdi, [rsp + 0x20]
mov ecx, 0xa
xor eax, eax
lea rsi, str.Error_cleaning_up_spin_keys_for_thread
rep movsd dword [rdi], dword [rsi]
lea rdi, [rsp + 0x48]
lea rbx, [rsp + 0x20]
mov cl, 0x43
rep stosb byte [rdi], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [rbx + 0x27]
mov r8d, 0xa
mov ecx, eax
call qword [sym.imp.msvcrt.dll__ultoa]
cmp byte [rsp + 0x47], 0
je 0x68df16
lea rdx, [rbx + 0x28]
mov eax, 0x27
jmp 0x68dee9
add rdx, 1
cmp eax, 0x6a
je 0x68df08
add eax, 1
cmp byte [rdx], 0
jne 0x68dee0
cmp eax, 0x6a
je 0x68df08
movsxd rdx, eax
add eax, 1
cdqe
mov byte [rsp + rdx + 0x20], 0xa
mov byte [rsp + rax + 0x20], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call sub.msvcrt.dll_abort
mov eax, 0x27
jmp 0x68def6
Function at 0x68dfb0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
cmp dword [0x008e0010], 1
je 0x68dfc6
call fcn.0068df20
mov ecx, dword [0x007f2368]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x68dfe0
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
call fcn.0068dda0
test rax, rax
mov rbx, rax
je 0x68e0d1
cmp qword [0x008e9050], 0
je 0x68e0d1
mov dword [rax + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
mov dword [rbx + 0x70], eax
call qword [sym.imp.KERNEL32.dll_CreateEventA]
lea rcx, [rbx + 0x68]
mov qword [rbx + 0x38], 0xffffffffffffffff
mov qword [rbx + 0x30], rax
call fcn.0068de60
mov rsi, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rbx + 0xb8], 0
mov qword [rbx + 0x28], 0
call rsi
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rdi, rax
call rsi
mov dword [rsp + 0x30], 2
mov r8, rbp
mov rdx, rdi
mov dword [rsp + 0x28], 0
lea r9, [rbx + 0x28]
mov rcx, rax
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x68e0d8
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov rdx, rbx
mov ecx, dword [0x007f2368]
mov dword [rbx + 0xbc], 0
mov dword [rbx + 0xc0], eax
movzx eax, byte [rbx + 0x40]
and eax, 0xffffffcf
or eax, 0x10
mov byte [rbx + 0x40], al
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x68e0d8
mov rax, rbx
jmp 0x68dfd7
xor eax, eax
jmp 0x68dfd7
call sub.msvcrt.dll_abort
nop
nop
mov eax, 0x80070057
lea r9, [rdx - 1]
add rdx, rcx
cmp r9, 0x7ffffffe
jbe 0x68e103
ret
mov rcx, rax
movzx r9d, byte [r8]
test r9b, r9b
je 0x68e125
lea rax, [rcx + 1]
add r8, 1
mov byte [rcx], r9b
cmp rax, rdx
jne 0x68e100
mov eax, 0x8007007a
mov byte [rcx], 0
ret
xor eax, eax
jmp 0x68e121
Function at 0x6bea10
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [0x007f4530]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x6bea4e
cmp rbx, qword [rax]
jne 0x6bea35
jmp 0x6bea44
cmp qword [rax], rbx
je 0x6bea44
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x6bea30
add rsp, 0x20
pop rbx
ret
mov rax, qword [rax + 8]
add rsp, 0x20
pop rbx
ret
xor eax, eax
jmp 0x6bea3e

Function at 0x6d8c50
Capabilities:
Get thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rbx, rcx
mov rsi, rdx
mov ecx, dword [0x007f4530]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x6d8c79
jmp 0x6d8cb0
mov rax, qword [rax + 0x10]
test rax, rax
je 0x6d8cb0
cmp rbx, qword [rax]
jne 0x6d8c70
cmp qword [rax + 8], 0
je 0x6d8cb0
lfence
mov rax, qword [rsi]
lea rdx, [rsi + 0x20]
mov rcx, qword [rsi + 0x10]
add rcx, qword [rsi + 8]
test al, 1
je 0x6d8ca3
mov r8, qword [rcx]
mov rax, qword [r8 + rax - 1]
call rax
sfence
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
mov rdx, rsi
mov ecx, 0xe8
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rsi
call fcn.004fc980
test rax, rax
mov rdi, rax
mov qword [rsp + 0x28], rax
je 0x6d8d68
mov qword [rax + 0x20], 0
lea rax, [0x006ca580]
mov qword [rdi + 0x28], rax
lea rcx, [rdi + 0x58]
mov qword [rdi], 0
mov qword [rdi + 8], 0
mov dword [rdi + 0x10], 0
mov dword [rdi + 0x14], 0
mov qword [rdi + 0x18], 0
mov dword [rdi + 0x30], 0
mov rax, qword [rsi]
mov rdx, qword [rsi + 8]
mov qword [rdi + 0x38], rax
mov qword [rdi + 0x40], rdx
mov rax, qword [rsi + 0x10]
lea rdx, [rsi + 0x20]
mov qword [rdi + 0x50], 0
mov qword [rdi + 0x48], rax
mov rax, qword [rsi + 0x18]
mov qword [rsi + 0x18], 0
mov qword [rdi + 0x50], rax
mov qword [rsi + 0x10], 0
call fcn.006a0ea0
mov qword [rsp + 0x30], rdi
lock add dword [rbx + 0x30], 1
mov rdx, rdi
mov rcx, rbx
call fcn.005018a0
nop
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
Function at 0x6d8dd0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x48
mov rbx, rcx
mov rsi, rdx
mov ecx, dword [0x007f4530]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x6d8df9
jmp 0x6d8e32
mov rax, qword [rax + 0x10]
test rax, rax
je 0x6d8e32
cmp rbx, qword [rax]
jne 0x6d8df0
cmp qword [rax + 8], 0
je 0x6d8e32
lfence
mov rax, qword [rsi]
lea r8, [rsi + 0x28]
mov rcx, qword [rsi + 0x10]
add rcx, qword [rsi + 8]
mov edx, dword [rsi + 0x20]
test al, 1
je 0x6d8e26
mov r9, qword [rcx]
mov rax, qword [r9 + rax - 1]
call rax
sfence
add rsp, 0x48
pop rbx
pop rsi
ret
mov rdx, rsi
mov ecx, pe_nt_image_headers64
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rsi
call fcn.004fc980
test rax, rax
mov qword [rsp + 0x28], rax
je 0x6d8f19
lea rdx, [0x006ca940]
mov qword [rax + 0x20], 0
mov qword [rax + 0x28], rdx
mov qword [rax], 0
mov qword [rax + 8], 0
mov dword [rax + 0x10], 0
mov dword [rax + 0x14], 0
mov qword [rax + 0x18], 0
mov dword [rax + 0x30], 0
mov r9, qword [rsi]
mov r10, qword [rsi + 8]
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r10
mov rdx, qword [rsi + 0x10]
mov qword [rax + 0x50], 0
mov qword [rax + 0x48], rdx
mov rdx, qword [rsi + 0x18]
mov qword [rsi + 0x18], 0
mov qword [rax + 0x50], rdx
mov edx, dword [rsi + 0x20]
mov qword [rsi + 0x10], 0
mov dword [rax + 0x58], edx
lea rdx, [rax + 0x70]
mov qword [rax + 0x60], rdx
mov rcx, qword [rsi + 0x28]
lea rdx, [rsi + 0x38]
cmp rcx, rdx
je 0x6d8f36
mov qword [rax + 0x60], rcx
mov rcx, qword [rsi + 0x38]
mov qword [rax + 0x70], rcx
mov rcx, qword [rsi + 0x30]
mov qword [rax + 0x68], rcx
mov qword [rsi + 0x28], rdx
mov qword [rsi + 0x30], 0
mov byte [rsi + 0x38], 0
mov qword [rsp + 0x30], rax
lock add dword [rbx + 0x30], 1
mov rdx, rax
mov rcx, rbx
call fcn.005018a0
nop
add rsp, 0x48
pop rbx
pop rsi
ret
mov r9, qword [rsi + 0x38]
mov r10, qword [rsi + 0x40]
mov qword [rax + 0x70], r9
mov qword [rax + 0x78], r10
jmp 0x6d8f01