joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2291513d9
Capabilities:
Create thread

Disassembly:
sub rsp, 0x48
dec edx
mov r9, rcx
jne 0x229151415
lea rax, [rsp + 0x3c]
xor ecx, ecx
lea r8, [0x2291513a0]
xor edx, edx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
test rax, rax
je 0x229151415
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x48
ret

Function at 0x229151483
Capabilities:
Encode data using base64

Disassembly:
push rsi
push rbx
lea r11, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov r9, rcx
lea ebx, [r8 - 2]
mov rcx, rdx
xor edx, edx
mov rax, r9
mov r10d, edx
cmp ebx, edx
jle 0x229151521
mov r10b, byte [rcx + rdx]
add rax, 4
shr r10b, 2
and r10d, 0x3f
mov r10b, byte [r11 + r10]
mov byte [rax - 4], r10b
movsx r10d, byte [rcx + rdx]
movsx esi, byte [rcx + rdx + 1]
shl r10d, 4
sar esi, 4
and r10d, 0x30
and esi, 0xf
or r10d, esi
movsxd r10, r10d
mov r10b, byte [r11 + r10]
mov byte [rax - 3], r10b
movsx r10d, byte [rcx + rdx + 1]
movsx esi, byte [rcx + rdx + 2]
shl r10d, 2
sar esi, 6
and r10d, 0x3c
and esi, 3
or r10d, esi
movsxd r10, r10d
mov r10b, byte [r11 + r10]
mov byte [rax - 2], r10b
mov r10b, byte [rcx + rdx + 2]
add rdx, 3
and r10d, 0x3f
mov r10b, byte [r11 + r10]
mov byte [rax - 1], r10b
jmp 0x22915149b
cmp edx, r8d
jge 0x22915159f
movsxd rbx, edx
lea r11, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
dec r8d
add rbx, rcx
mov dl, byte [rbx]
shr dl, 2
and edx, 0x3f
cmp r8d, r10d
mov dl, byte [r11 + rdx]
mov byte [rax], dl
movsx edx, byte [rbx]
jne 0x22915155f
shl edx, 4
mov byte [rax + 2], 0x3d
and edx, 0x30
mov dl, byte [r11 + rdx]
mov byte [rax + 1], dl
jmp 0x229151597
inc r10d
shl edx, 4
movsxd r10, r10d
and edx, 0x30
add rcx, r10
movsx r8d, byte [rcx]
sar r8d, 4
and r8d, 0xf
or edx, r8d
movsxd rdx, edx
mov dl, byte [r11 + rdx]
mov byte [rax + 1], dl
movsx edx, byte [rcx]
shl edx, 2
and edx, 0x3c
mov dl, byte [r11 + rdx]
mov byte [rax + 2], dl
mov byte [rax + 3], 0x3d
add rax, 4
mov byte [rax], 0
inc rax
sub rax, r9
pop rbx
pop rsi
ret
Function at 0x2291516d0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x260
lea rcx, [0x22915d0c0]
call fcn.2291551d0
mov rsi, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor r8d, r8d
mov r9d, 0x108
mov r13, rax
lea rax, [rsp + 0x48]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov rdx, r13
call rsi
mov r12d, eax
test eax, eax
jne 0x2291517f5
lea rcx, [0x22915d12f]
xor ebx, ebx
call fcn.2291551d0
mov rdi, qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov r14, rax
lea r15, [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x44]
mov edx, ebx
mov dword [rsp + 0x44], 0x104
mov r8, r15
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call rdi
test eax, eax
jne 0x2291517e0
lea rax, [rsp + 0x50]
xor r8d, r8d
mov rcx, qword [rsp + 0x48]
mov rdx, r15
mov qword [rsp + 0x20], rax
mov r9d, 0x101
call rsi
test eax, eax
jne 0x2291517d9
mov rcx, qword [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov rdx, r14
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x50]
cmp eax, 1
adc r12d, 0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc ebx
jmp 0x22915173a
mov rcx, r14
call fcn.229155252
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x2291517f8
xor r12d, r12d
mov rcx, r13
call fcn.229155252
mov eax, r12d
add rsp, 0x260
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x22915188e
Capabilities:
Get system information on windows

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x50
lea rcx, [0x22915d18c]
call fcn.2291551d0
mov r12, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, r12
mov r13, rax
call fcn.229155252
lea rcx, [0x22915d1ad]
call fcn.229155150
mov rcx, r13
mov r12, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r12
mov rbx, rax
call fcn.229155252
test rbx, rbx
lea rcx, [rsp + 0x20]
je 0x2291518ee
call rbx
jmp 0x2291518f4
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop r12
pop r13
ret
Function at 0x229151924
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x690
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1a
xor ecx, ecx
xor r12d, r12d
lea rbx, [rsp + 0x30]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x229151a33
lea rcx, [0x22915d1c9]
lea r14, [rsp + 0x238]
call fcn.2291551d0
mov r9, rbx
mov edx, 0x104
mov rcx, r14
mov r13, rax
mov r8, rax
lea rbx, [rsp + 0x440]
call fcn.229151902
mov rcx, r13
call fcn.229155252
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x229151a33
lea rcx, [0x22915d1e0]
lea rsi, [rsp + 0x46c]
call fcn.2291551d0
lea rcx, [0x22915d1eb]
mov r14, rax
call fcn.2291551d0
mov rdi, qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov r15, rax
test byte [rsp + 0x440], 0x10
je 0x229151a0b
mov rdx, r14
mov rcx, rsi
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x229151a0e
mov rdx, r15
mov rcx, rsi
call sub.msvcrt.dll_wcscmp
cmp eax, 1
sbb r12d, 0xffffffff
jmp 0x229151a0e
inc r12d
mov rdx, rbx
mov rcx, r13
call rdi
test eax, eax
jne 0x2291519de
mov rcx, r15
call fcn.229155252
mov rcx, r14
call fcn.229155252
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, r12d
add rsp, 0x690
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x229151a49
Capabilities:
Check mutex on windows

Disassembly:
push r12
sub rsp, 0x20
mov r12, rcx
call fcn.229151924
cmp eax, 4
jle 0x229151a68
call fcn.22915188e
cmp eax, 3
ja 0x229151a74
jmp 0x229151a8e
call fcn.2291516d0
cmp eax, 4
jg 0x229151a5c
jmp 0x229151aa4
call fcn.229151816
cmp eax, 0xeff
jle 0x229151a8e
mov rcx, r12
add rsp, 0x20
pop r12
jmp 0x22915447d
call fcn.22915188e
cmp eax, 7
ja 0x229151a80
call fcn.229151816
cmp eax, 0x1fff
jg 0x229151a80
add rsp, 0x20
pop r12
ret
push r14
push r13
push r12
push rsi
push rbx
sub rsp, 0x20
mov r14, rcx
lea rcx, [0x22915c020]
call fcn.2291551d0
xor ecx, ecx
mov r12, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r8, r12
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov r13, rax
test rax, rax
je 0x2291544ff
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x2291544f6
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor ebx, ebx
and eax, 0x89
mov esi, eax
cmp ebx, esi
je 0x2291544e7
mov ecx, 0x64
inc ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x2291544d4
test ebx, ebx
je 0x2291544f6
mov rdx, r12
mov rcx, r14
call fcn.22915443e
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
pop r13
pop r14
jmp fcn.229155252
Function at 0x229151ab0
Capabilities:
Link many functions at runtime

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x40
cmp qword [0x229161068], 0
jne 0x229151aea
lea rcx, [0x22915d200]
call fcn.2291551d0
mov r12, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, r12
mov qword [0x229161068], rax
call fcn.229155252
cmp qword [0x229161060], 0
jne 0x229151b22
lea rcx, [0x22915d221]
call fcn.229155150
mov rcx, qword [0x229161068]
mov r12, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r12
mov qword [0x229161060], rax
call fcn.229155252
cmp qword [0x229161058], 0
jne 0x229151b5a
lea rcx, [0x22915d23b]
call fcn.229155150
mov rcx, qword [0x229161068]
mov r12, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r12
mov qword [0x229161058], rax
call fcn.229155252
cmp qword [0x229161050], 0
jne 0x229151b8b
lea rcx, [0x22915d24f]
call fcn.2291551d0
mov r12, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, r12
mov qword [0x229161050], rax
call fcn.229155252
cmp qword [0x229161048], 0
jne 0x229151bc3
lea rcx, [0x22915d270]
call fcn.229155150
mov rcx, qword [0x229161050]
mov r12, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r12
mov qword [0x229161048], rax
call fcn.229155252
cmp qword [0x229161040], 0
jne 0x229151bfb
lea rcx, [0x22915d289]
call fcn.229155150
mov rcx, qword [0x229161050]
mov r12, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r12
mov qword [0x229161040], rax
call fcn.229155252
cmp qword [0x229161038], 0
jne 0x229151c33
lea rcx, [0x22915d2a5]
call fcn.229155150
mov rcx, qword [0x229161050]
mov r12, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r12
mov qword [0x229161038], rax
call fcn.229155252
cmp qword [0x229161030], 0
jne 0x229151c6b
lea rcx, [0x22915d2c5]
call fcn.229155150
mov rcx, qword [0x229161050]
mov r12, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r12
mov qword [0x229161030], rax
call fcn.229155252
mov rbx, qword [0x229161048]
xor r13d, r13d
call qword [0x229161060]
lea r8, [rsp + 0x38]
mov edx, 0x18
mov rcx, rax
call rbx
test eax, eax
je 0x229151d20
lea rbx, [rsp + 0x34]
mov rcx, qword [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x19
mov dword [rsp + 0x34], 0
mov qword [rsp + 0x20], rbx
call qword [0x229161040]
mov ecx, dword [rsp + 0x34]
call fcn.229154520
mov r12, rax
test rax, rax
je 0x229151d15
mov qword [rsp + 0x20], rbx
mov r9d, dword [rsp + 0x34]
mov r8, rax
mov edx, 0x19
mov rcx, qword [rsp + 0x38]
call qword [0x229161040]
test eax, eax
je 0x229151d0d
mov rbx, qword [0x229161030]
mov rcx, qword [r12]
call qword [0x229161038]
mov rcx, qword [r12]
mov dl, byte [rax]
dec edx
movzx edx, dl
call rbx
mov r13d, dword [rax]
mov rcx, r12
call fcn.229154578
mov rcx, qword [rsp + 0x38]
call qword [0x229161058]
mov eax, r13d
add rsp, 0x40
pop rbx
pop r12
pop r13
ret
Function at 0x229151d46
Capabilities:
Accept command line arguments

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x30
xor r12d, r12d
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x2c]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rbx, rax
test rax, rax
je 0x229151db7
cmp dword [rsp + 0x2c], 1
jle 0x229151db7
lea rcx, [0x22915d2e0]
mov r12d, 1
call fcn.2291551d0
mov r13, rax
cmp dword [rsp + 0x2c], r12d
jle 0x229151dac
mov rcx, qword [rbx + r12*8]
mov rdx, r13
inc r12
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x229151d8a
mov r12d, 1
jmp 0x229151daf
xor r12d, r12d
mov rcx, r13
call fcn.229155252
mov eax, r12d
add rsp, 0x30
pop rbx
pop r12
pop r13
ret
Function at 0x22915315a
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rbx
sub rsp, 0x58
xor r12d, r12d
mov rsi, rdx
mov ebx, r8d
call fcn.229152531
mov r14, rax
test rax, rax
je 0x229153225
mov rcx, rax
call fcn.2291523f4
mov r15, rax
test rax, rax
je 0x22915321d
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x229153215
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea r9, [rsp + 0x4c]
mov r8d, ebx
mov rdx, rsi
mov qword [rsp + 0x20], 0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r12d, eax
test eax, eax
je 0x22915320c
xor r12d, r12d
cmp dword [rsp + 0x4c], ebx
sete r12b
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r15
call fcn.229154578
mov rcx, r14
call fcn.229154578
mov eax, r12d
add rsp, 0x58
pop rbx
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x22915335d
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rsi, rdx
call fcn.229152531
mov r13, rax
test rax, rax
je 0x22915346a
mov rcx, rax
call fcn.2291523f4
mov r14, rax
test rax, rax
je 0x22915345f
xor r9d, r9d
mov r8d, 7
mov rcx, rax
xor r12d, r12d
mov qword [rsp + 0x30], 0
mov edx, 0x80000000
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x229153454
mov rdi, qword [sym.imp.KERNEL32.dll_SetFilePointer]
xor r8d, r8d
xor edx, edx
mov rcx, rax
mov r9d, 2
call rdi
mov ebx, eax
cmp eax, 0x40000000
ja 0x229153448
mov ecx, eax
call fcn.229154520
mov r12, rax
test rax, rax
je 0x229153448
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r15
call rdi
lea r9, [rsp + 0x4c]
mov r8d, ebx
mov rdx, r12
mov qword [rsp + 0x20], 0
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x229153440
cmp dword [rsp + 0x4c], ebx
jne 0x229153440
test rsi, rsi
je 0x22915344b
mov dword [rsi], ebx
jmp 0x22915344b
mov rcx, r12
call fcn.229154578
xor r12d, r12d
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
mov r14, r12
call fcn.229154578
mov rcx, r13
mov r13, r14
call fcn.229154578
mov rax, r13
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x2291535ee
Capabilities:
Set current directory

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x230
xor r12d, r12d
call fcn.229152504
mov rcx, rax
mov rbx, rax
call sub.msvcrt.dll_wcslen
cmp rax, 1
jbe 0x2291536e7
lea rcx, [0x22915d603]
call fcn.2291551d0
mov r8d, 2
mov rcx, rbx
mov r13, rax
mov rdx, rax
call qword [sym.imp.msvcrt.dll__wcsnicmp]
test eax, eax
je 0x229153644
xor r12d, r12d
jmp 0x2291536df
lea rcx, [rbx + 4]
call fcn.229152504
mov rcx, rax
mov rbx, rax
call sub.msvcrt.dll_wcslen
test rax, rax
je 0x22915363c
mov word [rsp + 0x28], 0
xor eax, eax
cmp word [rbx], 0x22
lea r12, [rsp + 0x28]
movabs r9, 0x100002601
jne 0x2291536ac
mov cx, word [rbx + rax*2 + 2]
movsxd rdx, eax
test cx, cx
je 0x2291536bb
cmp cx, 0x22
je 0x2291536bb
mov word [r12 + rax*2], cx
inc rax
jmp 0x22915367b
mov r8, r9
shr r8, cl
and r8b, 1
jne 0x2291536bb
mov word [r12 + rax*2], cx
inc rax
mov cx, word [rbx + rax*2]
movsxd rdx, eax
cmp cx, 0x20
ja 0x2291536a4
jmp 0x229153698
mov rcx, r12
mov word [rsp + rdx*2 + 0x28], 0
call sub.msvcrt.dll_wcslen
test rax, rax
je 0x22915363c
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov r12d, eax
mov rcx, r13
call fcn.229155252
mov eax, r12d
add rsp, 0x230
pop rbx
pop r12
pop r13
ret
Function at 0x229154180
Capabilities:
Copy file
Delete file
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0xa60
mov r8d, 0x104
mov r13, rdx
lea r12, [rsp + 0x240]
lea rbx, [rsp + 0x38]
mov r15, rcx
mov rdx, rbx
mov rcx, qword [0x2291610c8]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov r8d, 0x104
mov rdx, r12
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rcx, [0x22915d6a4]
call fcn.2291551d0
mov r13, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, r13
mov r14, rax
call fcn.229155252
lea rcx, [0x22915d6c3]
call fcn.229155150
mov rcx, r14
mov r13, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r13
mov rsi, rax
call fcn.229155252
xor ecx, ecx
mov rdx, r12
call rsi
test eax, eax
je 0x229154230
cmp eax, 0xb7
je 0x229154230
xor r12d, r12d
jmp 0x229154382
lea rcx, [0x22915d6dd]
lea rdi, [rsp + 0x448]
call fcn.2291551d0
lea rcx, [0x22915d6fa]
lea rsi, [rsp + 0x650]
mov r13, rax
call fcn.2291551d0
lea rdx, [0x22915d718]
mov rcx, r12
mov r14, rax
call sub.msvcrt.dll_wcscat
mov rcx, rdi
mov rdx, r12
call sub.msvcrt.dll_wcscpy
mov rcx, rdi
mov rdx, r13
call sub.msvcrt.dll_wcscat
mov rdx, r12
mov rcx, rsi
call sub.msvcrt.dll_wcscpy
mov rdx, r14
mov rcx, rsi
call sub.msvcrt.dll_wcscat
cmp dword [0x2291610c0], 0
mov rdx, r13
mov rcx, r12
cmovne rdx, r14
call sub.msvcrt.dll_wcscat
mov rcx, r14
call fcn.229155252
mov rcx, r13
call fcn.229155252
mov rcx, rdi
mov rdi, qword [sym.imp.KERNEL32.dll_DeleteFileW]
call rdi
mov rcx, rsi
call rdi
xor r8d, r8d
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x229154228
lea rcx, [0x22915d71c]
call fcn.2291551d0
cmp dword [0x2291610c0], 0
mov r13, rax
je 0x229154369
lea rcx, [0x22915d729]
lea rbx, [rsp + 0x858]
call fcn.2291551d0
mov qword [rsp + 0x28], r13
mov r9, r12
mov rcx, rbx
mov qword [rsp + 0x20], rax
lea r8, [0x22915d73c]
mov edx, 0x104
mov r14, rax
call fcn.229152340
mov rcx, r14
call fcn.229155252
lea rcx, [0x22915d758]
call fcn.2291551d0
mov rcx, r15
mov r8, rbx
mov r14, rax
mov rdx, rax
call fcn.22915544b
mov rcx, r14
mov r12d, eax
call fcn.229155252
jmp 0x22915437a
mov rdx, r12
mov r8, rax
mov rcx, r15
call fcn.22915544b
mov r12d, eax
mov rcx, r13
call fcn.229155252
mov eax, r12d
add rsp, 0xa60
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x22915447d
Capabilities:
Check mutex on windows

Disassembly:
push r12
sub rsp, 0x20
mov r12, rcx
call fcn.229151924
cmp eax, 4
jle 0x229151a68
call fcn.22915188e
cmp eax, 3
ja 0x229151a74
jmp 0x229151a8e
call fcn.2291516d0
cmp eax, 4
jg 0x229151a5c
jmp 0x229151aa4
call fcn.229151816
cmp eax, 0xeff
jle 0x229151a8e
mov rcx, r12
add rsp, 0x20
pop r12
jmp 0x22915447d
call fcn.22915188e
cmp eax, 7
ja 0x229151a80
call fcn.229151816
cmp eax, 0x1fff
jg 0x229151a80
add rsp, 0x20
pop r12
ret
push r14
push r13
push r12
push rsi
push rbx
sub rsp, 0x20
mov r14, rcx
lea rcx, [0x22915c020]
call fcn.2291551d0
xor ecx, ecx
mov r12, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r8, r12
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov r13, rax
test rax, rax
je 0x2291544ff
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x2291544f6
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor ebx, ebx
and eax, 0x89
mov esi, eax
cmp ebx, esi
je 0x2291544e7
mov ecx, 0x64
inc ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x2291544d4
test ebx, ebx
je 0x2291544f6
mov rdx, r12
mov rcx, r14
call fcn.22915443e
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
pop r13
pop r14
jmp fcn.229155252
Function at 0x229155280
Capabilities:
Link many functions at runtime

Disassembly:
push r12
sub rsp, 0x20
cmp dword [0x229161200], 0
jne 0x229155444
cmp qword [0x2291611f8], 0
jne 0x2291552c4
lea rcx, [0x22915dae0]
call fcn.2291551d0
mov r12, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, r12
mov qword [0x2291611f8], rax
call fcn.229155252
cmp qword [0x2291611f0], 0
jne 0x2291552fc
lea rcx, [0x22915db01]
call fcn.229155150
mov rcx, qword [0x2291611f8]
mov r12, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r12
mov qword [0x2291611f0], rax
call fcn.229155252
cmp qword [0x2291611e8], 0
jne 0x22915532d
lea rcx, [0x22915db16]
call fcn.2291551d0
mov r12, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, r12
mov qword [0x2291611e8], rax
call fcn.229155252
cmp qword [0x2291611e0], 0
jne 0x229155365
lea rcx, [0x22915db31]
call fcn.229155150
mov rcx, qword [0x2291611e8]
mov r12, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r12
mov qword [0x2291611e0], rax
call fcn.229155252
cmp qword [0x2291611d8], 0
jne 0x22915539d
lea rcx, [0x22915db48]
call fcn.229155150
mov rcx, qword [0x2291611e8]
mov r12, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r12
mov qword [0x2291611d8], rax
call fcn.229155252
cmp qword [0x2291611d0], 0
jne 0x2291553d5
lea rcx, [0x22915db61]
call fcn.229155150
mov rcx, qword [0x2291611e8]
mov r12, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r12
mov qword [0x2291611d0], rax
call fcn.229155252
cmp qword [0x2291611c8], 0
jne 0x229155406
lea rcx, [0x22915db78]
call fcn.2291551d0
mov r12, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, r12
mov qword [0x2291611c8], rax
call fcn.229155252
cmp qword [0x2291611c0], 0
jne 0x22915543e
lea rcx, [0x22915db97]
call fcn.229155150
mov rcx, qword [0x2291611c8]
mov r12, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r12
mov qword [0x2291611c0], rax
call fcn.229155252
inc dword [0x229161200]
add rsp, 0x20
pop r12
ret

Function at 0x229155970
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.22915b830
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.22915b830
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]
Function at 0x2291559e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x50
movsxd rbx, dword [0x229161254]
mov r12, rcx
test ebx, ebx
jle 0x229155b10
mov rax, qword [0x229161258]
xor ecx, ecx
add rax, 0x18
nop word [rax + rax]
mov rdx, qword [rax]
cmp rdx, r12
ja 0x229155a2c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x229155ab3
add ecx, 1
add rax, 0x28
cmp ecx, ebx
jne 0x229155a10
mov rcx, r12
call fcn.229156160
mov rsi, rax
test rax, rax
je 0x229155b32
mov rax, qword [0x229161258]
lea rbx, [rbx + rbx*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rsi
mov dword [rax], 0
call fcn.229156290
mov ecx, dword [rsi + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x229161258]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x229155b17
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x229155aac
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x229155ac0
add dword [0x229161254], 1
add rsp, 0x50
pop rbx
pop rsi
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rbx, qword [0x229161258]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x229155aac
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.229155970
nop dword [rax]
xor ebx, ebx
jmp 0x229155a37
mov rax, qword [0x229161258]
mov edx, dword [rsi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.229155970
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.229155970
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x229155dd0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x229161280]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x229161260]
test rbx, rbx
je 0x229155e24
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x229155e1b
test r12, r12
je 0x229155e1b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x229155e00
lea rcx, [0x229161280]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]