joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41cda0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
cmp edx, 3
je 0x41cdc0
mov eax, 1
add rsp, 0x28
pop rbx
pop rsi
ret
mov rax, qword [0x004ab508]
test rax, rax
je 0x41cf20
mov ecx, dword [rax]
cmp ecx, 0xffffffff
je 0x41cdab
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x41cdab
test byte [rax + 0x40], 0x30
je 0x41ce71
mov rcx, qword [rax + 0x1c8]
test rcx, rcx
jne 0x41cf10
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x41ce2c
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x41ce1c
call rsi
mov qword [rbx + 0x30], 0
mov qword [rbx + 0x28], 0
lea rcx, [rbx + 0x38]
call sym.pthread_mutex_destroy
cmp qword [rbx + 0x1c0], 0
mov qword [rbx + 0x60], 0xffffffffffffffff
je 0x41cf65
mov rax, qword [0x004ab508]
test rax, rax
je 0x41cf41
mov ecx, dword [rax]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, 1
add rsp, 0x28
pop rbx
pop rsi
ret
mov eax, dword [rax + 0xb4]
mov rcx, qword [rbx + 0x30]
test eax, eax
jne 0x41ced0
test rcx, rcx
je 0x41ce8a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x1c8]
mov qword [rbx + 0x30], 0
mov dword [rbx + 0xb4], 1
test rcx, rcx
jne 0x41cf00
test byte [rbx + 0x44], 4
je 0x41cee3
mov rcx, qword [rbx + 0x28]
mov dword [rbx], 0xdeadbeef
test rcx, rcx
je 0x41ce24
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41ce24
test rcx, rcx
je 0x41cedb
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x30], 0
lea rcx, [rbx + 0x38]
call sym.pthread_mutex_destroy
mov qword [rbx + 0x60], 0xffffffffffffffff
jmp 0x41cdab
call sym._pthread_cleanup_dest.part.3
jmp 0x41cea8
call sym._pthread_cleanup_dest.part.3
jmp 0x41cdff
lea r8, [sym.__shmem_winpthreads_init__pthread_tls_shmem]
lea rcx, str._pthread_tls_shmem
mov dl, 4
call sym.__shmem_winpthreads_grab
mov qword [0x004ab508], rax
jmp 0x41cdd0
lea r8, [sym.__shmem_winpthreads_init__pthread_tls_shmem]
lea rcx, str._pthread_tls_shmem
mov edx, 4
call sym.__shmem_winpthreads_grab
mov qword [0x004ab508], rax
jmp 0x41ce5b
mov rcx, rbx
call sym.push_pthread_mem.part.0
jmp 0x41ce4b
Function at 0x41d370
Capabilities:
Check mutex on windows

Disassembly:
lea rcx, str.once_obj_shmem
xor r8d, r8d
mov edx, 8
jmp sym.__shmem_winpthreads_grab

Function at 0x41d390
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_winpthreads_init_once_global_shmem]
lea rcx, str.once_global_shmem
mov edx, 8
jmp sym.__shmem_winpthreads_grab
Function at 0x41e560
Capabilities:
Hijack thread execution

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x4f8
mov rsi, rcx
call sym.__pth_gpointer_locked
test rax, rax
mov rbx, rax
je 0x41e589
mov rcx, qword [rax + 0x28]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
jbe 0x41e5a0
mov eax, 3
add rsp, 0x4f8
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rdi, [rsp + 0x20]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x41e589
lea rbp, [rbx + 0x38]
mov rcx, rbp
call sym.pthread_mutex_lock
call sym.__pthread_self_lite
test rax, rax
je 0x41e745
mov rax, qword [rax + 0x1c8]
cmp rsi, rax
je 0x41e643
mov eax, dword [rbx + 0x44]
and eax, 3
cmp eax, 3
movzx eax, byte [rbx + 0x40]
je 0x41e6a0
test al, 3
jne 0x41e62a
and eax, 0xfffffffc
or eax, 1
mov byte [rbx + 0x40], al
mov rax, qword [0x004ab520]
test rax, rax
je 0x41e74c
lock add dword [rax], 1
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x41e61b
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rbp
call sym.pthread_mutex_unlock
xor eax, eax
jmp 0x41e58e
mov rcx, rbp
call sym.pthread_mutex_unlock
test byte [rbx + 0x40], 0xc
jne 0x41e589
xor eax, eax
jmp 0x41e58e
movzx eax, byte [rbx + 0x40]
test al, 3
jne 0x41e62a
and eax, 0xfffffffc
or eax, 1
mov byte [rbx + 0x40], al
mov rax, qword [0x004ab520]
test rax, rax
je 0x41e76c
lock add dword [rax], 1
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x41e677
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [rbx + 0x44]
and eax, 3
cmp eax, 3
jne 0x41e61b
movzx eax, byte [rbx + 0x40]
and dword [rbx + 0x44], 0xfffffffe
mov rcx, rbp
and eax, 0xfffffff3
or eax, 4
mov byte [rbx + 0x40], al
call sym.pthread_mutex_unlock
call sym._pthread_invoke_cancel
test al, 0xc
jne 0x41e62a
test al, 0xf
jne 0x41e589
mov rcx, qword [rbx + 0x28]
mov dword [rsp + 0x50], 0x100001
call qword [sym.imp.KERNEL32.dll_SuspendThread]
xor edx, edx
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x41e61b
mov rcx, qword [rbx + 0x28]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
lea rax, [sym._pthread_invoke_cancel]
mov rcx, qword [rbx + 0x28]
mov rdx, rdi
mov qword [rsp + 0x118], rax
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
movzx eax, byte [rbx + 0x40]
and dword [rbx + 0x44], 0xfffffffe
and eax, 0xfffffff0
or eax, 5
mov byte [rbx + 0x40], al
mov rax, qword [0x004ab520]
test rax, rax
je 0x41e78c
lock add dword [rax], 1
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x41e72e
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rbp
call sym.pthread_mutex_unlock
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x41e61b
xor eax, eax
jmp 0x41e5d3
lea rcx, str._pthread_cancelling_shmem
xor r8d, r8d
mov edx, 4
call sym.__shmem_winpthreads_grab
mov qword [0x004ab520], rax
jmp 0x41e608
lea rcx, str._pthread_cancelling_shmem
xor r8d, r8d
mov edx, 4
call sym.__shmem_winpthreads_grab
mov qword [0x004ab520], rax
jmp 0x41e664
lea rcx, str._pthread_cancelling_shmem
xor r8d, r8d
mov edx, 4
call sym.__shmem_winpthreads_grab
mov qword [0x004ab520], rax
jmp 0x41e71b
Function at 0x41e7b0
Capabilities:
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [0x004ab4d8]
mov edi, edx
test rcx, rcx
je 0x41e890
call sym.pthread_mutex_lock
mov rcx, rbx
call sym.__pthread_get_pointer
test rax, rax
je 0x41e7ea
mov rsi, qword [rax + 0x1c8]
cmp rsi, rbx
je 0x41e810
mov rcx, qword [0x004ab4d8]
test rcx, rcx
je 0x41e860
mov ebx, 3
call sym.pthread_mutex_unlock
mov eax, ebx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
test byte [rax + 0x40], 0xc
jne 0x41e7ea
mov ebx, dword [rax + 0xb4]
test ebx, ebx
jne 0x41e7ea
mov rax, qword [rax + 0x28]
sub rax, 1
cmp rax, 0xfffffffffffffffd
ja 0x41e7ea
mov rcx, qword [0x004ab4d8]
test rcx, rcx
je 0x41e8b7
call sym.pthread_mutex_unlock
test edi, edi
je 0x41e800
sub edi, 2
mov ebx, 0x16
cmp edi, 0x15
ja 0x41e800
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp sym.pthread_cancel
lea rcx, str.mtx_pthr_locked_shmem
lea r8, [sym.__shmem_winpthreads_init_mtx_pthr_locked_shmem]
mov edx, 8
call sym.__shmem_winpthreads_grab
mov rcx, rax
mov qword [0x004ab4d8], rax
jmp 0x41e7f6
lea rcx, str.mtx_pthr_locked_shmem
lea r8, [sym.__shmem_winpthreads_init_mtx_pthr_locked_shmem]
mov edx, 8
call sym.__shmem_winpthreads_grab
mov rcx, rax
mov qword [0x004ab4d8], rax
jmp 0x41e7cc
lea rcx, str.mtx_pthr_locked_shmem
lea r8, [sym.__shmem_winpthreads_init_mtx_pthr_locked_shmem]
mov edx, 8
call sym.__shmem_winpthreads_grab
mov rcx, rax
mov qword [0x004ab4d8], rax
jmp 0x41e83a
Function at 0x41eb30
Capabilities:
Create thread
Resume thread

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov r14, rcx
mov r12, rdx
mov rsi, r8
mov rdi, r9
call sym.pop_pthread_mem
test rax, rax
mov rbx, rax
je 0x41ece1
test r14, r14
je 0x41eb6a
mov rax, qword [rax + 0x1c8]
mov qword [r14], rax
mov r13, qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rbx + 8], rdi
mov rdi, qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x10], rsi
mov esi, 1
mov dword [rbx + 0xb4], 0
mov dword [rbx + 0x44], 1
mov qword [rbx + 0x28], 0xffffffffffffffff
mov rbp, r13
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, 1
call rdi
test rax, rax
mov qword [rbx + 0x30], rax
jne 0x41ed90
cmp esi, 1
jne 0x41ebd0
xor ecx, ecx
call r13
add esi, 1
jmp 0x41eba1
mov ecx, 0x14
call rbp
cmp esi, 5
jne 0x41ebc7
mov rax, qword [rbx + 0x30]
mov qword [rbx + 0x38], 0xffffffffffffffff
mov qword [rbx + 0x60], 0xffffffffffffffff
mov dword [rbx], 0xbab1f00d
mov dword [rbx + 0xb8], 0
mov dword [rbx + 0xb0], 0
test rax, rax
je 0x41ecc7
test r12, r12
je 0x41edd0
mov eax, dword [r12]
mov rsi, qword [r12 + 0x10]
test al, 8
mov dword [rbx + 0x44], eax
jne 0x41ed60
mov eax, dword [r12 + 0x18]
mov edx, esi
mov dword [rbx + 0xb8], eax
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
mov r9, rbx
lea r8, [sym.pthread_create_wrapper]
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov rsi, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
ja 0x41ec97
mov edx, dword [rbx + 0xb8]
cmp edx, 0xfffffff2
jl 0x41ecf5
cmp edx, 0xffffffff
jl 0x41ed80
cmp edx, 0xe
jg 0x41edc0
cmp edx, 2
mov eax, 2
cmovge edx, eax
jmp 0x41ecfa
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x41eca6
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbx + 0x38]
call sym.pthread_mutex_destroy
mov qword [rbx + 0x60], 0xffffffffffffffff
mov qword [rbx + 0x30], 0
mov qword [rbx + 0x28], 0
test r14, r14
je 0x41ecd3
mov qword [r14], 0
cmp qword [rbx + 0x1c0], 0
je 0x41edd7
mov eax, 0xb
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov edx, 0xfffffff1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
test byte [rbx + 0x44], 4
je 0x41ed50
mov rcx, rsi
mov qword [rbx + 0x28], 0
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov qword [rbx + 0x28], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x41ed2d
call sym.__pthread_self_lite
mov eax, dword [rax + 0xb8]
mov edx, esi
mov dword [rbx + 0xb8], eax
jmp 0x41ec3d
mov edx, 0xfffffffe
jmp 0x41ecfa
mov qword [rbx + 0x38], 0xffffffffffffffff
mov qword [rbx + 0x60], 0xffffffffffffffff
mov dword [rbx], 0xbab1f00d
mov dword [rbx + 0xb8], 0
mov dword [rbx + 0xb0], 0
jmp 0x41ec13
mov edx, 0xf
jmp 0x41ecfa
xor edx, edx
jmp 0x41ec3d
mov rcx, rbx
call sym.push_pthread_mem.part.0
jmp 0x41ece1
Function at 0x41f310
Capabilities:
Check mutex on windows

Disassembly:
lea rcx, str.dummy_concurrency_level_shmem
xor r8d, r8d
mov edx, 4
jmp sym.__shmem_winpthreads_grab

Function at 0x41f6f0
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_winpthreads_init_mutex_global_shmem]
lea rcx, str.mutex_global_shmem
mov edx, 8
jmp sym.__shmem_winpthreads_grab

Function at 0x41f710
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_winpthreads_init_mutex_global_static_shmem]
lea rcx, str.mutex_global_static_shmem
mov edx, 8
jmp sym.__shmem_winpthreads_grab

Function at 0x41f810
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_winpthreads_init_mxattr_recursive_shmem]
lea rcx, str.mxattr_recursive_shmem
mov edx, 4
jmp sym.__shmem_winpthreads_grab

Function at 0x41f830
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_winpthreads_init_mxattr_errorcheck_shmem]
lea rcx, str.mxattr_errorcheck_shmem
mov edx, 4
jmp sym.__shmem_winpthreads_grab

Function at 0x420460
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_winpthreads_init_cond_locked_shmem_cond]
lea rcx, str.cond_locked_shmem_cond
mov edx, 8
jmp sym.__shmem_winpthreads_grab
Function at 0x421450
Capabilities:
Check mutex on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x80]
mov rdi, rcx
movsxd r12, edx
mov r13, r8
call sym.strlen
mov r14, rax
lea ebx, [rax + 0xf]
lea eax, [rax + 0x51]
cdqe
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.00410630
sub rsp, rax
movsxd r15, r14d
movabs rax, 0x656d68732d636367
lea rsi, [rsp + 0x20]
lea rcx, [rsp + 0x2f]
mov r8, r15
mov rdx, rdi
mov qword [rsp + 0x20], rax
mov eax, 0x326d
mov dword [rsp + 0x28], 0x64742d6d
mov word [rsp + 0x2c], ax
movsxd rbx, ebx
mov byte [rsp + 0x2e], 0x2d
call sym.memcpy
lea rax, [rsi + r15 + 0x10]
lea r15d, [r14 + 0x50]
movabs rdx, 0x6161616161616161
xor ecx, ecx
mov r8, rsi
mov qword [rax], rdx
mov qword [rax + 8], rdx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], rdx
mov qword [rax + 0x20], rdx
mov qword [rax + 0x28], rdx
mov qword [rax + 0x30], rdx
mov qword [rax + 0x38], rdx
movsxd rax, r15d
xor edx, edx
mov byte [rsp + rax + 0x20], 0
mov byte [rsp + rbx + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov byte [rsp + rbx + 0x20], 0x2d
mov rdi, rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x421539
int3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindAtomA]
test ax, ax
jne 0x4215d2
mov rcx, r12
add r14d, 0x10
call sym.malloc
mov r10d, 0x40
mov rbx, rax
bt rbx, r10
jae 0x421574
mov r11d, r15d
sub r11d, r10d
movsxd r11, r11d
mov byte [rsi + r11], 0x41
sub r10d, 1
jne 0x421560
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_AddAtomA]
test ax, ax
je 0x4215cf
mov rdx, rsi
movzx ecx, ax
mov r9d, r14d
mov r8d, r15d
call sym.get_ptr_from_atom_1
cmp rax, rbx
mov rsi, rax
je 0x4215e9
mov rcx, rbx
call sym.free
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rsi
lea rsp, [rbp - 0x58]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
int3
lea r9d, [r14 + 0x10]
mov rdx, rsi
movzx ecx, ax
mov r8d, r15d
call sym.get_ptr_from_atom_1
mov rsi, rax
jmp 0x4215a9
xor edx, edx
mov r8, r12
mov rcx, rbx
call sym.memset
test r13, r13
je 0x4215a9
mov rcx, rbx
call r13
jmp 0x4215a9

Function at 0x421740
Capabilities:
Check mutex on windows

Disassembly:
lea rcx, str.global_lock_spinlock
xor r8d, r8d
mov edx, 4
jmp sym.__shmem_winpthreads_grab

Function at 0x421f30
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_winpthreads_init_rwl_global_shmem]
lea rcx, str.rwl_global_shmem
mov edx, 8
jmp sym.__shmem_winpthreads_grab

Function at 0x422000
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_winpthreads_init_cond_locked_shmem_rwlock]
lea rcx, str.cond_locked_shmem_rwlock
mov edx, 8
jmp sym.__shmem_winpthreads_grab

Function at 0x422b20
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_init_init]
lea rcx, str.init
mov edx, 8
jmp dbg.__shmem_grab

Function at 0x422b40
Capabilities:
Check mutex on windows

Disassembly:
lea rcx, str.eh_globals
xor r8d, r8d
mov edx, 0x10
jmp dbg.__shmem_grab
Function at 0x4231f0
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_init___terminate_handler_sh]
lea rcx, str.__terminate_handler_sh
mov edx, 8
jmp dbg.__shmem_grab

Function at 0x423210
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_init___unexpected_handler_sh]
lea rcx, str.__unexpected_handler_sh
mov edx, 8
jmp dbg.__shmem_grab

Function at 0x4244d0
Capabilities:
Read file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov r9, qword [rcx + 0x40]
mov rsi, rdx
mov rbx, rcx
mov edx, 1
mov rcx, rsi
call sym.fread
test rax, rax
jle 0x424501
movzx edx, byte [rsi + rax - 1]
mov dword [rbx + 0x48], edx
add rsp, 0x28
pop rbx
pop rsi
ret
mov dword [rbx + 0x48], 0xffffffff
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x424e50
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
cmp byte [0x00489090], 0
jne 0x424f17
mov byte [0x00489090], 1
call sym.__cxa_current_exception_type
test rax, rax
je 0x424faa
mov rbx, qword [rax + 8]
xor eax, eax
lea r9, [rsp + 0x2c]
cmp byte [rbx], 0x2a
mov dword [rsp + 0x2c], 0xffffffff
sete al
xor r8d, r8d
xor edx, edx
add rbx, rax
mov rcx, rbx
call sym.__cxa_demangle
mov rsi, qword [sym.imp.msvcrt.dll___iob_func]
mov rdi, rax
call rsi
lea rcx, str.terminate_called_after_throwing_an_instance_of_
lea r9, [rax + 0x60]
mov r8d, 0x30
mov edx, 1
call sym.fwrite
cmp dword [rsp + 0x2c], 0
je 0x424f07
call rsi
lea rdx, [rax + 0x60]
mov rcx, rbx
call sym.fputs
call rsi
lea rcx, [0x0048b4e1]
lea r9, [rax + 0x60]
mov r8d, 2
mov edx, 1
call sym.fwrite
cmp dword [rsp + 0x2c], 0
je 0x424f3d
call sym.__cxa_rethrow
call rsi
lea rdx, [rax + 0x60]
mov rcx, rdi
call sym.fputs
jmp 0x424ede
call qword [sym.imp.msvcrt.dll___iob_func]
lea rcx, str.terminate_called_recursively_n
lea r9, [rax + 0x60]
mov r8d, 0x1d
mov edx, 1
call sym.fwrite
call sym.abort
mov rcx, rdi
call sym.free
jmp 0x424f02
call sym.abort
call qword [sym.imp.msvcrt.dll___iob_func]
lea rcx, str.terminate_called_without_an_active_exception_n
lea r9, [rax + 0x60]
mov r8d, 0x2d
mov edx, 1
call sym.fwrite
jmp 0x424fa5

Function at 0x4533d0
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, qword [sym.imp.msvcrt.dll__errno]
mov rbp, rcx
mov rdi, rdx
mov esi, r8d
mov rcx, rbp
call method.std::__basic_file_char_.fd__
mov r8d, esi
mov rdx, rdi
mov ecx, eax
call sym.read
movsxd rbx, eax
cmp rbx, 0xffffffffffffffff
je 0x453420
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call r12
cmp dword [rax], 4
je 0x4533ea
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x140001080
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x1400010b3
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x1400010f6
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rbx
and edi, 0xf
jbe 0x1400010f1
cmp rbx, r11
jae 0x1400010f6
dec edi
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
jne 0x1400010e0
cmp rbx, r11
jb 0x1400010fa
xor eax, eax
jmp 0x140001106
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140003020
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [rcx + 8]
xor ebx, ebx
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x140003050
Capabilities:
Delete registry value

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x140003070
Capabilities:
Delete registry key

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x1400030d0
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov dword [rax - 0x38], 6
mov dword [rax + 0x20], r8d
mov dword [rax - 0x40], 4
lea rax, [rax + 0x20]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov r11d, eax
mov dword [rsp + 0x30], eax
jmp 0x14000311c
xor eax, eax
test r11d, r11d
sete al
add rsp, 0x68
ret

Function at 0x140003130
Capabilities:
Set registry value

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov r10, rcx
mov dword [rsp + 0x30], 6
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r8
repne scasb al, byte [rdi]
not rcx
and ecx, ecx
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], r8
lea r9d, [rax + 1]
xor r8d, r8d
mov rcx, qword [r10 + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, eax
mov dword [rsp + 0x30], eax
jmp 0x140003180
xor eax, eax
test edx, edx
sete al
add rsp, 0x50
pop rdi
ret

Function at 0x140003190
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], r8
push rbx
sub rsp, 0x60
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rbx, r8
mov dword [r11 + 0x20], 4
mov dword [rsp + 0x30], 6
lea rax, [r11 + 0x20]
mov qword [r11 - 0x40], rax
lea rax, [r11 - 0x34]
mov qword [r11 - 0x48], rax
lea r9, [r11 - 0x30]
xor r8d, r8d
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [rsp + 0x30], eax
jmp 0x1400031eb
test eax, eax
jne 0x1400031fc
mov eax, dword [rsp + 0x34]
mov dword [rbx], eax
mov eax, 1
jmp 0x1400031fe
xor eax, eax
add rsp, 0x60
pop rbx
ret
Function at 0x140003210
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], r8
push r12
push r13
push r14
sub rsp, 0x80
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rdi
mov r13, r8
mov rdi, rdx
mov r14, rcx
mov dword [rsp + 0x50], 0x1f4
mov dword [rsp + 0xb8], 0
mov qword [r11 - 0x60], 0
mov dword [rsp + 0x40], 6
cmp dword [0x1402211e8], 0x14
jle 0x1400032a9
lea rax, [r11 + 0x20]
mov qword [r11 - 0x68], rax
lea rdx, str...CommonRegistry.cpp
lea rcx, [r11 + 0x20]
call fcn.140001db0
nop
lea r12, str.szString
mov qword [rsp + 0x20], r12
xor r9d, r9d
mov r8d, 0x136
mov rdx, rax
lea ecx, [r9 + 0x15]
call fcn.140001e70
jmp 0x1400033f9
mov ecx, 0x400
call fcn.14015f71c
mov rbx, rax
mov qword [rsp + 0x38], rax
lea rdx, str...CommonRegistry.cpp
test rax, rax
jne 0x1400032fe
lea rax, [rsp + 0x30]
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x30]
call fcn.140001db0
nop
lea r12, str.szString
mov qword [rsp + 0x20], r12
xor r9d, r9d
mov r8d, 0x136
mov rdx, rax
lea ecx, [rbx + 0x13]
call fcn.140001e70
jmp 0x140003314
mov r8d, 0x136
lea r12, str.szString
mov rcx, r12
call fcn.140002da0
nop
test rbx, rbx
je 0x1400033f9
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x54]
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [r14 + 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [rsp + 0x40], eax
jmp 0x14000335f
test eax, eax
jne 0x14000338b
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
lea r8d, [rcx - 1]
mov rdx, rbx
mov rcx, r13
call fcn.140001610
mov dword [rsp + 0xb8], 1
cmp dword [0x1402211e8], 0
jg 0x1400033d6
lea rax, [rsp + 0x30]
mov qword [rsp + 0x48], rax
lea rdx, str...CommonRegistry.cpp
lea rcx, [rsp + 0x30]
call fcn.140001db0
nop
mov qword [rsp + 0x20], r12
xor r9d, r9d
mov r8d, 0x14e
mov rdx, rax
lea ecx, [r9 + 0x15]
call fcn.140001e70
mov dword [0x1402211e8], 0
jmp 0x1400033f0
mov rcx, rbx
call fcn.14015f6dc
mov qword [rsp + 0x38], 0
mov rcx, r12
call fcn.140002ed0
nop
mov eax, dword [rsp + 0xb8]
jmp 0x1400033fb
xor eax, eax
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop r13
pop r12
ret

Function at 0x140003720
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, r9
mov rbp, r8
mov rdi, rdx
mov rbx, rcx
call fcn.1400034a0
test eax, eax
jne 0x140003754
mov rdx, rdi
mov rcx, rbx
call fcn.1400034f0
mov r8d, dword [rsi]
mov rdx, rbp
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.1400030d0