joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140018c80
Capabilities:
Get thread local storage value
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rdi, [0x1400b6148]
mov rbx, rcx
mov rcx, rdi
mov esi, edx
call sym.pthread_mutex_lock
mov rcx, rbx
call sym.__pthread_get_pointer
test rax, rax
je 0x140018cf8
cmp qword [rax + 0x1d8], rbx
jne 0x140018cf8
test byte [rax + 0x40], 0xc
jne 0x140018cf8
mov edx, dword [rax + 0xbc]
test edx, edx
jne 0x140018cf8
mov rax, qword [rax + 0x28]
sub rax, 1
cmp rax, 0xfffffffffffffffd
ja 0x140018cf8
mov rcx, rdi
call sym.pthread_mutex_unlock
test esi, esi
je 0x140018d10
lea edx, [rsi - 2]
cmp edx, 0x15
ja 0x140018d18
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp sym.pthread_cancel
mov rcx, rdi
call sym.pthread_mutex_unlock
mov eax, 3
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor eax, eax
jmp 0x140018d05
mov eax, 0x16
jmp 0x140018d05

Function at 0x140018eb0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov esi, ecx
mov rdi, rdx
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x1400b6158]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140018f20
cmp esi, 1
ja 0x140018f2d
lea rbp, [rbx + 0x38]
mov rcx, rbp
call sym.pthread_mutex_lock
test rdi, rdi
je 0x140018ef4
mov eax, dword [rbx + 0x44]
and eax, 1
mov dword [rdi], eax
mov eax, dword [rbx + 0x44]
mov rcx, qword [rbx + 0x1d8]
and eax, 0xfffffffe
or eax, esi
mov dword [rbx + 0x44], eax
call sym.test_cancel_locked
mov rcx, rbp
call sym.pthread_mutex_unlock
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
call sym.__pthread_self_lite.part.0
mov rbx, rax
test rax, rax
jne 0x140018ed6
mov eax, 0x16
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x140018f40
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov esi, ecx
mov rdi, rdx
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x1400b6158]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140018fb8
mov ebp, esi
and ebp, 0xfffffffd
jne 0x140018fc5
lea r12, [rbx + 0x38]
mov rcx, r12
call sym.pthread_mutex_lock
test rdi, rdi
je 0x140018f88
mov eax, dword [rbx + 0x44]
and eax, 2
mov dword [rdi], eax
mov eax, dword [rbx + 0x44]
mov rcx, qword [rbx + 0x1d8]
and eax, 0xfffffffd
or eax, esi
mov dword [rbx + 0x44], eax
call sym.test_cancel_locked
mov rcx, r12
call sym.pthread_mutex_unlock
mov eax, ebp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call sym.__pthread_self_lite.part.0
mov rbx, rax
test rax, rax
jne 0x140018f68
mov ebp, 0x16
mov eax, ebp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x140019270
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rbp, qword [0x1400bf5b0]
mov rax, qword [rbp]
mov qword [rsp + 0x28], rax
xor eax, eax
mov rsi, rcx
mov rdi, rdx
test rcx, rcx
je 0x1400193a0
lea r12, [0x1400b6148]
mov rcx, r12
call sym.pthread_mutex_lock
mov rcx, rsi
call sym.__pthread_get_pointer
mov rcx, r12
mov rbx, rax
call sym.pthread_mutex_unlock
test rbx, rbx
je 0x1400193a0
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x1400193a0
lea rdx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x1400193a0
test byte [rbx + 0x44], 4
jne 0x1400193c0
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x1400b6158]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400193e0
cmp rsi, qword [rax + 0x1d8]
je 0x140019408
mov eax, dword [rbx + 0xbc]
mov rcx, qword [rbx + 0x28]
test eax, eax
je 0x14001932f
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14001933e
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x28]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140019352
call rsi
mov qword [rbx + 0x30], 0
lea rcx, [rbx + 0x38]
test rdi, rdi
je 0x1400193f8
mov rax, qword [rbx + 8]
mov qword [rdi], rax
call sym.pthread_mutex_destroy
lea rcx, [rbx + 0x68]
call sym.pthread_spin_destroy
cmp eax, 1
je 0x140019414
cmp qword [rbx + 0x1d0], 0
mov qword [rbx + 0x68], 0xffffffffffffffff
je 0x1400193d0
xor eax, eax
jmp 0x1400193a5
mov eax, 3
mov rdx, qword [rsp + 0x28]
sub rdx, qword [rbp]
jne 0x14001940f
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, 0x16
jmp 0x1400193a5
mov rcx, rbx
call sym.push_pthread_mem.part.0
xor eax, eax
jmp 0x1400193a5
call sym.__pthread_self_lite.part.0
test rax, rax
jne 0x14001930a
jmp 0x140019317
call sym.pthread_mutex_destroy
jmp 0x140019373
mov eax, 0x24
jmp 0x1400193a5
call dbg.__stack_chk_fail
call sym.replace_spin_keys.part.0
nop
nop word [rax + rax]
Function at 0x140019420
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rbp, qword [0x1400bf5b0]
lea r12, [0x1400b6148]
mov rax, qword [rbp]
mov qword [rsp + 0x28], rax
xor eax, eax
mov rsi, rcx
mov rcx, r12
mov rdi, rdx
call sym.pthread_mutex_lock
mov rcx, rsi
call sym.__pthread_get_pointer
mov rbx, rax
test rax, rax
je 0x140019560
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x140019560
lea rdx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x140019560
test byte [rbx + 0x44], 4
jne 0x140019570
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x1400b6158]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400195a0
mov rdx, qword [rax + 0x1d8]
cmp rsi, rdx
je 0x1400195d8
mov edx, dword [rbx + 0xbc]
mov rcx, qword [rbx + 0x28]
test edx, edx
jne 0x1400194db
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140019580
mov rcx, qword [rbx + 0x28]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x1400194ef
call rsi
mov qword [rbx + 0x30], 0
lea rcx, [rbx + 0x38]
test rdi, rdi
je 0x1400195b8
mov rax, qword [rbx + 8]
mov qword [rdi], rax
call sym.pthread_mutex_destroy
lea rcx, [rbx + 0x68]
call sym.pthread_spin_destroy
cmp eax, 1
je 0x1400195ef
cmp qword [rbx + 0x1d0], 0
mov qword [rbx + 0x68], 0xffffffffffffffff
je 0x1400195c8
mov rcx, r12
call sym.pthread_mutex_unlock
xor eax, eax
mov rdx, qword [rsp + 0x28]
sub rdx, qword [rbp]
jne 0x1400195ea
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, r12
call sym.pthread_mutex_unlock
mov eax, 3
jmp 0x140019542
mov rcx, r12
call sym.pthread_mutex_unlock
mov eax, 0x16
jmp 0x140019542
mov eax, dword [rbx + 0xbc]
test eax, eax
jne 0x1400194d7
mov rcx, r12
call sym.pthread_mutex_unlock
mov eax, 0x10
jmp 0x140019542
call sym.__pthread_self_lite.part.0
xor edx, edx
test rax, rax
jne 0x1400194a9
jmp 0x1400194b0
call sym.pthread_mutex_destroy
jmp 0x140019510
mov rcx, rbx
call sym.push_pthread_mem.part.0
jmp 0x140019538
mov rcx, r12
call sym.pthread_mutex_unlock
mov eax, 0x24
jmp 0x140019542
call dbg.__stack_chk_fail
call sym.replace_spin_keys.part.0
nop
nop word cs:[rax + rax]

Function at 0x14001abb0
Capabilities:
Create thread
Terminate process

Disassembly:
sub rsp, 0x28
mov ecx, 2
mov r8d, 0x2c
lea rdx, [0x1400be900]
call sym.write
mov ecx, 0x17
call sym.IsProcessorFeaturePresent
test eax, eax
je 0x14001abe0
mov ecx, 2
int 0x29
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp qword [sym.imp.msvcrt.dll__beginthreadex]

Function at 0x14001c7c0
Capabilities:
Read file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov r9, qword [rcx + 0x40]
mov rsi, rdx
mov rbx, rcx
mov edx, 1
mov rcx, rsi
call sym.fread
mov edx, 0xffffffff
test rax, rax
jle 0x14001c7ec
movzx edx, byte [rsi + rax - 1]
mov dword [rbx + 0x48], edx
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x14001d410
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
cmp byte [0x1400b8ec0], 0
jne 0x14001d516
mov byte [0x1400b8ec0], 1
call sym.__cxa_current_exception_type
test rax, rax
je 0x14001d4ec
mov rbx, qword [rax + 8]
xor eax, eax
lea r9, [rsp + 0x2c]
cmp byte [rbx], 0x2a
mov dword [rsp + 0x2c], 0xffffffff
sete al
xor r8d, r8d
xor edx, edx
add rbx, rax
mov rcx, rbx
call sym.__cxa_demangle
mov ecx, 2
mov rsi, qword [dbg.__acrt_iob_func]
mov rdi, rax
call rsi
mov edx, 1
lea rcx, str.terminate_called_after_throwing_an_instance_of_
mov r8d, 0x30
mov r9, rax
call sym.fwrite
mov edx, dword [rsp + 0x2c]
mov ecx, 2
test edx, edx
je 0x14001d4dd
call rsi
mov rcx, rbx
mov rdx, rax
call sym.fputs
mov ecx, 2
call rsi
mov r8d, 2
mov edx, 1
lea rcx, [0x1400bac51]
mov r9, rax
call sym.fwrite
mov eax, dword [rsp + 0x2c]
test eax, eax
jne 0x14001d4d8
mov rcx, rdi
call sym.free
call sym.__cxa_rethrow
call rsi
mov rcx, rdi
mov rdx, rax
call sym.fputs
jmp 0x14001d4a7
mov ecx, 2
call qword [dbg.__acrt_iob_func]
mov r8d, 0x2d
mov edx, 1
lea rcx, str.terminate_called_without_an_active_exception_n
mov r9, rax
call sym.fwrite
call sym.abort
mov ecx, 2
call qword [dbg.__acrt_iob_func]
mov r8d, 0x1d
mov edx, 1
lea rcx, str.terminate_called_recursively_n
mov r9, rax
call sym.fwrite
call sym.abort
sub rdx, 1
mov rcx, rax
jne 0x14001d5ab
call sym.__cxa_begin_catch
mov rcx, rax
mov rax, qword [rax]
call qword [rax + 0x10]
mov ecx, 2
mov rbx, rax
call rsi
mov r9, rax
mov r8d, 0xb
mov edx, 1
lea rcx, str.__what__:
call sym.fwrite
mov ecx, 2
call rsi
mov rdx, rax
mov rcx, rbx
call sym.fputs
mov ecx, 2
call rsi
mov rdx, rax
mov ecx, 0xa
call sym.fputc
call sym.__cxa_end_catch
jmp 0x14001d511
call sym.__cxa_begin_catch
call sym.__cxa_end_catch
jmp 0x14001d511

Function at 0x14007c6e0
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, qword [sym.imp.msvcrt.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
mov rcx, qword [rdi]
call sym.fileno
mov ecx, eax
mov r8d, ebx
mov rdx, rsi
call sym.read
movsxd rbp, eax
cmp eax, 0xffffffff
je 0x14007c728
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call r12
cmp dword [rax], 4
je 0x14007c6fa
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x14008f060
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov rdi, rcx
test rax, rax
je 0x14008f088
mov rcx, qword [rcx]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov ebx, 4
lea rsi, [rsp + 0x2c]
nop dword [rax]
mov ecx, dword [rdi + 0x10]
mov r8d, ebx
mov rdx, rsi
call sym.read
test eax, eax
jle 0x14008f0d0
cdqe
add rsi, rax
sub rbx, rax
jne 0x14008f0a0
mov eax, dword [rsp + 0x2c]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp eax, 0xffffffff
jne 0x14008f0dc
call rbp
cmp dword [rax], 4
je 0x14008f0a0
lea rcx, str.random_device_could_not_be_read
call method.std.__throw_runtime_error_char_const_
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x140001e1c
Capabilities:
Read file on windows

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
and qword [rbp + 0x6f], 0
lea rdx, [0x140002800]
lea rcx, [rbp + 7]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and dword [rsp + 0x50], 0
lea rax, [rbp + 7]
and qword [rsp + 0x48], 0
lea r9, [rbp + 0x17]
and qword [rbp + 0x2f], 0
lea r8, [rbp + 0x27]
mov dword [rsp + 0x40], 0x20
lea rcx, [rbp + 0x67]
mov dword [rsp + 0x38], 1
xorps xmm0, xmm0
and dword [rsp + 0x30], 0
mov edx, 0x10000000
mov dword [rsp + 0x28], 0x80
and qword [rsp + 0x20], 0
mov dword [rbp + 0x27], 0x30
mov dword [rbp + 0x3f], 0x240
mov qword [rbp + 0x37], rax
movdqu xmmword [rbp + 0x47], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
and qword [rsp + 0x40], 0
lea rax, [rbp + 0x6f]
mov rcx, qword [rbp + 0x67]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
lea rax, [0x140005078]
mov dword [rsp + 0x30], 0x32
mov qword [rsp + 0x28], rax
xor edx, edx
lea rax, [rbp + 0x17]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov rcx, qword [rbp + 0x67]
mov byte [0x1400050a9], 0
call qword [sym.imp.ntoskrnl.exe_ZwClose]
add rsp, 0xb0
pop rbp
ret
Function at 0x1400020c0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x170
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x160], rax
xor ebp, ebp
lea r9, [rsp + 0x20]
and dword [rsp + 0x20], ebp
mov rsi, rdx
mov r14, rcx
xor r8d, r8d
xor edx, edx
lea edi, [rbp + 0xb]
mov ecx, edi
call sub.ntoskrnl.exe_ZwQuerySystemInformation
cmp eax, 0xc0000004
jne 0x14000214c
mov edx, dword [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x6e556353
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
je 0x14000214c
mov r8d, dword [rsp + 0x20]
xor r9d, r9d
mov rdx, rax
mov ecx, edi
call sub.ntoskrnl.exe_ZwQuerySystemInformation
lfence
test eax, eax
jns 0x140002176
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor eax, eax
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140002430
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
xor edi, edi
cmp dword [rbx], edi
jbe 0x140002238
mov eax, edi
lea rcx, [rsp + 0x30]
imul rax, rax, 0x128
mov edx, 2
add rax, 8
add rax, rbx
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx + 0x50], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x14000219a
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov rax, qword [rax + 0x20]
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm1
mov qword [rcx + 0x20], rax
lea rcx, [rsp + 0x58]
call fcn.140002288
mov rcx, rax
mov rdx, r14
call sub.ntoskrnl.exe_strstr
test rax, rax
jne 0x140002228
inc edi
cmp edi, dword [rbx]
jb 0x140002180
jmp 0x140002238
mov rbp, qword [rsp + 0x40]
test rsi, rsi
je 0x140002238
mov ecx, dword [rsp + 0x48]
mov dword [rsi], ecx
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rax, rbp
jmp 0x14000214e

Function at 0x14000224c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r8, rcx
test edx, edx
jne 0x140002256
xor eax, eax
ret
movzx eax, byte [rcx]
xor eax, 0x4b9ace2f
imul ecx, eax, 0x1000193
cmp edx, 1
jbe 0x140002283
inc r8
dec edx
movzx eax, byte [r8]
inc r8
xor eax, ecx
imul ecx, eax, 0x1000193
sub rdx, 1
jne 0x14000226e
mov eax, ecx
ret
Function at 0x140002344
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov esi, r8d
mov ebx, ecx
mov edx, r8d
mov rcx, rdi
call fcn.14000224c
xor ebx, eax
test esi, esi
je 0x14000238a
mov ecx, esi
imul ebx, ebx, 0x41c64e6d
add ebx, 0x3039
mov eax, ebx
shr eax, 0x10
xor byte [rdi], al
inc rdi
sub rcx, 1
jne 0x14000236e
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140cbc058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140cbc1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140cbc089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140cbc06f
add dl, dl
jne 0x140cbc096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140cbc0f6
xor eax, eax
add dl, dl
jne 0x140cbc0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140cbc1ad
add dl, dl
jne 0x140cbc0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140cbc0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140cbc0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140cbc0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140cbc0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140cbc07e
mov eax, 1
add dl, dl
jne 0x140cbc106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140cbc113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140cbc0fb
sub eax, ebx
mov ebx, 1
jne 0x140cbc14c
mov ecx, 1
add dl, dl
jne 0x140cbc12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140cbc13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140cbc123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140cbc07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140cbc168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140cbc175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140cbc15d
cmp eax, 0x7d00
jae 0x140cbc19b
cmp eax, 0x500
jb 0x140cbc196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140cbc07e
cmp eax, 0x7f
ja 0x140cbc19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140cbc07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140cbc1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140cbc07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001262
Capabilities:
Terminate process

Disassembly:
jmp 0x1400073e0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movzx eax, word [0x1400294c2]
xorps xmm0, xmm0
mov r10, qword [0x140028120]
mov r11d, ecx
mov rbp, qword [0x140028130]
mov r8, qword [0x140028118]
mov esi, dword [0x140028140]
lea r9, [rax + rax*2]
movsd xmm1, qword [0x14001dea0]
add r9, r9
mov edi, r8d
sub esi, r10d
sub edi, r10d
mov eax, dword [rbp + r9*8 + 0x28]
cvtsi2sd xmm0, rax
xor eax, eax
mulsd xmm0, qword [0x14001de60]
addsd xmm0, qword [0x14001de50]
comisd xmm0, xmm1
jb 0x14000746d
subsd xmm0, xmm1
comisd xmm0, xmm1
jae 0x14000746d
movabs rcx, 0x8000000000000000
mov rax, rcx
cvttsd2si rcx, xmm0
add rcx, rax
lea eax, [rdi + r11]
mov edx, eax
cmp rcx, rdx
mov ebx, eax
mov eax, 0xffffffff
cmovae rbx, rcx
cmp rbx, rax
cmovae rbx, rax
cmp rbx, rdx
jae 0x1400074da
mov rcx, qword [0x140028110]
lea rdx, str.HINT_ERROR:_Unable_to_increase_buffer_size_0x_x_by_0x_x_byte
sub r8, r10
mov r9d, r11d
call fcn.1400015b4
mov rcx, qword [0x140028110]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
mov rcx, qword [0x140028110]
lea rdx, [0x14001cec4]
call fcn.1400015b4
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [rbp + r9*8 + 0x20]
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
movzx ecx, word [0x1400294c2]
lea rdx, [rcx + rcx*2]
mov rcx, qword [0x140028130]
add rdx, rdx
mov qword [rcx + rdx*8 + 0x20], rax
movzx eax, word [0x1400294c2]
lea rcx, [rax + rax*2]
mov rax, qword [0x140028130]
add rcx, rcx
cmp qword [rax + rcx*8 + 0x20], 0
jne 0x14000755e
mov rcx, qword [0x140028110]
lea rdx, str.HINT_ERROR:_Out_of_memory_for_dir_section_no_.buffer
call fcn.1400015b4
mov rcx, qword [0x140028110]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
mov rcx, qword [0x140028110]
lea rdx, [0x14001cec4]
call fcn.1400015b4
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rbp, qword [rsp + 0x38]
mov dword [rax + rcx*8 + 0x28], ebx
movzx eax, word [0x1400294c2]
lea rcx, [rax + rax*2]
mov rax, qword [0x140028130]
add rcx, rcx
mov rdx, qword [rax + rcx*8 + 0x20]
mov qword [0x140028120], rdx
lea rax, [rdx + rbx]
mov rbx, qword [rsp + 0x30]
mov qword [0x140028138], rax
mov eax, esi
mov rsi, qword [rsp + 0x40]
add rax, rdx
mov qword [0x140028140], rax
mov eax, edi
add rax, rdx
mov qword [0x140028118], rax
add rsp, 0x20
pop rdi
ret
Function at 0x140001398
Capabilities:
Terminate process

Disassembly:
jmp 0x140009450
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x1400094d5
mov rdx, qword [0x140028118]
nop word [rax + rax]
mov rax, qword [0x140028138]
sub rax, rdx
cmp rax, 1
jge 0x14000948a
mov ecx, 1
call fcn.140001262
call fcn.1400015c8
mov rax, qword [0x140028118]
movzx ecx, byte [rbx]
mov byte [rax], cl
mov rdx, qword [0x140028118]
inc rdx
mov qword [0x140028118], rdx
movzx eax, byte [rbx]
inc rbx
test al, al
jne 0x140009470
mov rax, qword [0x140028138]
sub rax, rdx
cmp rax, 0x20
jge 0x1400094eb
mov ecx, 0x20
add rsp, 0x20
pop rbx
jmp fcn.140001262
call fcn.1400015c8
mov rax, qword [0x140028118]
mov byte [rax], 0
inc qword [0x140028118]
add rsp, 0x20
pop rbx
ret

Function at 0x14000139d
Capabilities:
Terminate process

Disassembly:
jmp 0x140015548
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x140001460
Capabilities:
Terminate process

Disassembly:
jmp 0x140005390
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov r10, qword [0x1400294a0]
mov ebx, edx
movsxd rax, ecx
lea r8, [rax + rax*2]
mov edi, dword [r10 + r8*8 + 0xc]
cmp edx, 0xff
jle 0x140005400
mov dword [rsp + 0x20], edx
mov r8d, ecx
mov rcx, qword [0x140028110]
lea rdx, str.HINT_ERROR:_Outline__d__depth_level__d_to__d_out_of_range
mov r9d, edi
call fcn.1400015b4
mov rcx, qword [0x140028110]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
mov rcx, qword [0x140028110]
lea rdx, [0x14001cec4]
call fcn.1400015b4
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
cmp ecx, dword [0x140025390]
jg 0x140005444
nop dword [rax + rax]
movsxd rax, ecx
lea rdx, [rax + rax*2]
cmp dword [r10 + rdx*8 + 0xc], edi
jne 0x140005427
mov dword [r10 + rdx*8 + 0xc], ebx
inc ecx
jmp 0x140005433
jle 0x140005444
lea edx, [rbx + 1]
call fcn.140001460
mov ecx, eax
cmp ecx, dword [0x140025390]
jg 0x140005444
mov r10, qword [0x1400294a0]
jmp 0x140005410
mov rbx, qword [rsp + 0x40]
mov eax, ecx
add rsp, 0x30
pop rdi
ret
Function at 0x1400015c8
Capabilities:
Terminate process

Disassembly:
jmp 0x1400066b0
sub rsp, 0x28
mov r9, qword [0x140028118]
cmp r9, qword [0x140028138]
jb 0x140006712
sub r9, qword [0x140028120]
lea rdx, str.HINT_ERROR:_HPUT_overrun_section__d_pos0x_x_n
movzx r8d, word [0x1400294c2]
mov rcx, qword [0x140028110]
call fcn.1400015b4
mov rcx, qword [0x140028110]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
mov rcx, qword [0x140028110]
lea rdx, [0x14001cec4]
call fcn.1400015b4
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
add rsp, 0x28
ret