joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1403ac7e0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
mov eax, r8d
xor eax, 0x803a028e
mov r9d, dword [0x1405eeba8]
add r9d, eax
cmp ecx, r9d
jne 0x1403ac83c
add eax, dword [0x1405eeba8]
cmp edx, eax
jne 0x1403ac88c
movzx eax, byte [0x1405ee340]
cmp al, 0xd
je 0x1403ac834
mov cl, 0xfc
nop word [rax + rax]
mov al, 0x73
lock cmpxchg byte [0x1405ee340], cl
je 0x1403ac93d
cmp al, 0xd
jne 0x1403ac820
lea rax, [0x1405ee330]
ret
test edx, edx
je 0x1403ac8bc
movzx eax, byte [0x1405ee53f]
mov ecx, r8d
xor cl, 0xae
add cl, byte [0x1405eebb8]
cmp al, cl
je 0x1403ac884
nop word [rax + rax]
movzx ecx, byte [0x1405eebb8]
mov eax, r8d
xor al, 0x28
add al, cl
mov edx, r8d
xor dl, 0x5a
add dl, cl
lock cmpxchg byte [0x1405ee53f], dl
je 0x1403ac8f8
cmp al, 0xab
jne 0x1403ac860
lea rax, [0x1405ee530]
ret
movzx eax, byte [0x1405ee2a4]
cmp al, 0x84
je 0x1403ac8b4
mov cl, 0x70
nop dword [rax]
mov al, 0x4b
lock cmpxchg byte [0x1405ee2a4], cl
je 0x1403ac98d
cmp al, 0x84
jne 0x1403ac8a0
lea rax, [0x1405ee290]
ret
movzx eax, byte [0x1405ee303]
cmp al, 0xf0
je 0x1403ac8f0
mov cl, 0x67
nop dword [rax]
mov al, 0x5a
lock cmpxchg byte [0x1405ee303], cl
je 0x1403aca0c
mov edx, r8d
xor dl, 0xeb
add dl, byte [0x1405eebb8]
cmp al, dl
jne 0x1403ac8d0
lea rax, [0x1405ee2f0]
ret
xor eax, eax
lea rcx, [0x1405ee530]
lea rdx, [0x1404ed600]
xor r8d, 0x803a028f
nop
cdqe
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
mov r9d, dword [0x1405eeba8]
add r9d, r8d
add eax, r9d
cmp eax, 0xf
jl 0x1403ac910
mov al, 0xab
xchg byte [0x1405ee53f], al
lea rax, [0x1405ee530]
ret
xor eax, eax
lea rcx, [0x1405ee330]
lea rdx, [0x1404ed430]
xor r8d, 0x803a028f
nop word cs:[rax + rax]
cdqe
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
mov r9d, dword [0x1405eeba8]
add r9d, r8d
add eax, r9d
cmp eax, 0x10
jl 0x1403ac960
mov al, 0xd
xchg byte [0x1405ee340], al
lea rax, [0x1405ee330]
ret
xor edx, edx
lea rax, [0x1405ee290]
lea rcx, [0x1404ed390]
xor r8d, 0x803a029a
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r9d, byte [rdx + rax]
movzx r10d, byte [rdx + rcx]
not r9b
mov r11d, r9d
and r11b, r10b
or r9b, r10b
not r9b
or r9b, r11b
mov byte [rdx + rax], r9b
add edx, 0xd8edb990
mov r9d, edx
xor r9d, 0x27124671
and edx, 0x27124671
lea edx, [r9 + rdx*2]
mov r9d, dword [0x1405eeba8]
add r9d, r8d
cmp edx, r9d
jl 0x1403ac9b0
mov al, 0x84
xchg byte [0x1405ee2a4], al
lea rax, [0x1405ee290]
ret
xor eax, eax
lea rcx, [0x1405ee2f0]
lea rdx, [0x1404ed3f0]
nop dword [rax]
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rax + rcx]
xor r10b, r9b
mov byte [rax + rcx], r10b
lea r9d, [rax + 1]
cmp r9d, 0x12
jg 0x1403aca48
inc rax
jmp 0x1403aca20
xor r8b, 0xeb
add r8b, byte [0x1405eebb8]
xchg byte [0x1405ee303], r8b
lea rax, [0x1405ee2f0]
ret
Function at 0x1403c5b80
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1403c5bbc
test edx, edx
je 0x1403c5bf6
movzx eax, byte [0x1405f173f]
cmp al, 0x4b
je 0x1403c5bb4
mov cl, 0xfb
nop word cs:[rax + rax]
mov al, 0x3c
lock cmpxchg byte [0x1405f173f], cl
je 0x1403c5c6c
cmp al, 0x4b
jne 0x1403c5ba0
lea rax, [0x1405f1730]
ret
test edx, edx
je 0x1403c5c2c
movzx eax, byte [0x1405f167d]
cmp al, 0xbe
je 0x1403c5bee
mov cl, 0xc
nop dword [rax]
mov al, 0x71
lock cmpxchg byte [0x1405f167d], cl
je 0x1403c5cc8
movzx edx, byte [0x1405f187c]
add dl, 0x48
cmp al, dl
jne 0x1403c5bd0
lea rax, [0x1405f1670]
ret
movzx eax, byte [0x1405f1690]
cmp al, 0x1b
je 0x1403c5c24
mov cl, 0xc2
nop word cs:[rax + rax]
mov al, 0x3b
lock cmpxchg byte [0x1405f1690], cl
je 0x1403c5d1f
cmp al, 0x1b
jne 0x1403c5c10
lea rax, [0x1405f1680]
ret
movzx eax, byte [0x1405f17ef]
movzx ecx, byte [0x1405f187c]
mov edx, ecx
xor dl, 0x18
and dl, cl
xor cl, 0x67
add dl, dl
add dl, cl
cmp al, dl
je 0x1403c5c64
mov cl, 0x84
nop
mov al, 0xb2
lock cmpxchg byte [0x1405f17ef], cl
je 0x1403c5d58
cmp al, 0xdd
jne 0x1403c5c50
lea rax, [0x1405f17e0]
ret
xor edx, edx
lea rax, [0x1405f1730]
lea rcx, [0x1404ee0e0]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
not r8b
mov r10d, r8d
and r10b, r9b
or r8b, r9b
not r8b
or r8b, r10b
mov byte [rdx + rax], r8b
mov r8d, dword [0x1405f1878]
add edx, r8d
add edx, 0x5de01b8a
cmp edx, 0xf
jl 0x1403c5c80
mov al, 0x4b
xchg byte [0x1405f173f], al
lea rax, [0x1405f1730]
ret
xor edx, edx
lea rax, [0x1405f1670]
lea rcx, [0x1404ee030]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xd
jl 0x1403c5ce0
mov al, 0xbe
xchg byte [0x1405f167d], al
lea rax, [0x1405f1670]
ret
xor eax, eax
lea rcx, [0x1405f1680]
lea rdx, [0x1404ee040]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x1403c5d48
inc rax
jmp 0x1403c5d30
mov al, 0x1b
xchg byte [0x1405f1690], al
lea rax, [0x1405f1680]
ret
xor edx, edx
lea rax, [0x1405f17e0]
lea rcx, [0x1404ee190]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
not r8b
not r9b
mov r10d, r8d
xor r10b, r9b
or r9b, r8b
and r9b, r10b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xf
jl 0x1403c5d70
mov al, 0xdd
xchg byte [0x1405f17ef], al
lea rax, [0x1405f17e0]
ret

Function at 0x1403e2780
Capabilities:
Encode data using xor
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 8], 0xfffffffffffffffe
mov qword [rbp - 0x10], rcx
mov qword [rbp - 0x18], rdx
call fcn.1403f9280
cmp byte [0x140612658], 0
jne 0x1403e27bc
test byte [0x140612ab9], 1
jne 0x1403e27bc
test rax, rax
je 0x1403e27bc
add rsp, 0x40
pop rbp
ret
mov ecx, 0x7f
call fcn.1401ca8b0
mov rcx, qword [rbp - 0x10]
mov rdx, qword [rbp - 0x18]
mov r8d, 0x3030073
add rsp, 0x40
pop rbp
jmp fcn.1403e28f0
Function at 0x1403fbbf0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1403fbc3c
mov eax, r8d
xor eax, 0x6d6890eb
add eax, dword [0x1405f8fc4]
cmp edx, eax
jne 0x1403fbc6c
movzx eax, byte [0x1405f7ed9]
cmp al, 6
je 0x1403fbc34
mov cl, 0x85
nop dword [rax + rax]
mov al, 0x8f
lock cmpxchg byte [0x1405f7ed9], cl
je 0x1403fbcd8
cmp al, 6
jne 0x1403fbc20
lea rax, [0x1405f7ed0]
ret
test edx, edx
je 0x1403fbc9c
movzx eax, byte [0x1405f7dc2]
cmp al, 0x14
je 0x1403fbc64
mov cl, 0xf
nop dword [rax]
mov al, 0xa0
lock cmpxchg byte [0x1405f7dc2], cl
je 0x1403fbd81
cmp al, 0x14
jne 0x1403fbc50
lea rax, [0x1405f7dc0]
ret
movzx eax, byte [0x1405f7e83]
cmp al, 0x14
je 0x1403fbc94
mov cl, 0x93
nop dword [rax]
mov al, 0xbe
lock cmpxchg byte [0x1405f7e83], cl
je 0x1403fbd18
cmp al, 0x14
jne 0x1403fbc80
lea rax, [0x1405f7e80]
ret
movzx eax, byte [0x1405f7e1b]
cmp al, 0x36
je 0x1403fbcd0
mov cl, 0xbc
nop dword [rax]
mov al, 0x69
lock cmpxchg byte [0x1405f7e1b], cl
je 0x1403fbdcf
mov edx, r8d
xor dl, 0xa4
add dl, byte [0x1405f8fc0]
cmp al, dl
jne 0x1403fbcb0
lea rax, [0x1405f7e00]
ret
xor eax, eax
lea rcx, [0x1405f7ed0]
lea rdx, [0x1404efea0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x1403fbd71
inc rax
jmp 0x1403fbcf0
xor eax, eax
lea rcx, [0x1405f7e80]
lea rdx, [0x1404efe50]
xor r8d, 0x6d6890e8
nop
cdqe
movzx r9d, byte [rax + rcx]
movzx r10d, byte [rax + rdx]
mov r11d, r9d
xor r11b, r10b
and r9b, r10b
add r9b, r9b
add r9b, r11b
mov byte [rax + rcx], r9b
mov r9d, dword [0x1405f8fc4]
add r9d, r8d
add eax, r9d
cmp eax, 3
jl 0x1403fbd30
mov al, 0x14
xchg byte [0x1405f7e83], al
lea rax, [0x1405f7e80]
ret
mov al, 6
xchg byte [0x1405f7ed9], al
lea rax, [0x1405f7ed0]
ret
xor edx, edx
lea rax, [0x1405f7dc0]
lea rcx, [0x1404efda0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 2
jl 0x1403fbda0
mov al, 0x14
xchg byte [0x1405f7dc2], al
lea rax, [0x1405f7dc0]
ret
xor eax, eax
lea rcx, [0x1405f7e00]
lea rdx, [0x1404efde0]
xor r8d, 0x6d68908e
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x1405f8fc4]
add r10d, r8d
cmp r9d, r10d
jge 0x1403fbe11
inc rax
jmp 0x1403fbdf0
mov al, 0x36
xchg byte [0x1405f7e1b], al
lea rax, [0x1405f7e00]
ret
Function at 0x1403fc290
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
test rcx, rcx
je 0x1403fc396
mov rsi, rdx
mov rdi, rcx
movabs rax, 0xea524dad12d0427e
movabs rcx, 0x6d6382ba081693c0
xor r14d, r14d
movabs rdx, 0x59cb02cc90816fe
mov r8d, r14d
mov r9, qword [0x140612758]
add r9, rcx
sub r9, rax
add r8, rax
add r8, r9
sub r8, rdx
sub r8, rcx
add r8, rdx
movzx r9d, word [0x140614840]
xor r10d, r10d
add r9w, word [rdi + r8*2]
setne r10b
add r14d, 0xd3088c99
mov r8d, r14d
xor r8d, r10d
and r14d, r10d
lea r14d, [r8 + r14*2]
add r14d, 0x2cf77367
cmp word [rdi + r14*2], 0
jne 0x1403fc2d0
test r14d, r14d
je 0x1403fc3bd
mov dword [rsp + 0x38], 0xaac90f97
mov dword [rsp + 0x30], 0x2361860c
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor ebx, ebx
mov ecx, 1
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call fcn.140405cb0
test rax, rax
je 0x1403fc3bf
mov rcx, qword [rax + 0x10]
xor ebx, ebx
test rcx, rcx
je 0x1403fc3bf
mov rdx, qword [rax + 0x18]
test rdx, rdx
je 0x1403fc3bf
inc r14d
mov r15d, r14d
xor ebx, ebx
mov ebp, 1
mov r8, rcx
xor r12d, r12d
mov qword [rsp + 0x40], rsi
jmp 0x1403fc40c
mov dword [rsp + 0x20], 0xef236587
xor ebx, ebx
xor ecx, ecx
xor edx, edx
xor r8d, r8d
mov r9d, 0xa7b226ad
call fcn.140405fd0
test rax, rax
je 0x1403fc3bf
mov rbx, qword [rax + 0x10]
jmp 0x1403fc3bf
xor ebx, ebx
mov rax, rbx
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ebp, 1
nop dword [rax + rax]
mov r10, qword [r8]
test r10, r10
cmovne r8, r10
movzx r12d, r9b
cmove r12d, ebp
mov r9d, r12d
not r9b
mov r10d, r12d
xor r10b, 1
and r9b, 0xfe
or r9b, r10b
cmp r9b, 0xff
jne 0x1403fc3bf
cmp rcx, qword [rax + 0x10]
je 0x1403fc458
mov dword [rsp + 0x38], 0xaac90f97
mov dword [rsp + 0x30], 0x2361860c
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov ecx, 1
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call fcn.140405cb0
test rax, rax
je 0x1403fc3bf
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov r8, rcx
mov r9d, r12d
xor r9b, 0xfe
and r9b, r12b
add r9b, byte [0x140613ad8]
jne 0x1403fc3f2
cmp r8, rdx
movzx r9d, r12b
cmove r9d, ebp
add r9b, byte [0x140615b48]
movzx r10d, word [r8 + 0x58]
add r10d, dword [0x140612960]
cmp r14d, r10d
ja 0x1403fc3e0
mov r10, qword [r8 + 0x60]
test r10, r10
je 0x1403fc3e0
cmp r10, 0xffff
je 0x1403fc3e0
test r14d, r14d
je 0x1403fc50c
xor r11d, r11d
jmp 0x1403fc4d2
mov rsi, qword [0x140612568]
add r11, rsi
inc r11
cmp r11, r15
je 0x1403fc50c
movzx r13d, word [rdi + r11*2]
lea esi, [r13 - 0x61]
lea r12d, [r13 - 0x20]
cmp si, 0x1a
cmovae r12d, r13d
test r12w, r12w
je 0x1403fc4c0
movzx esi, word [r10 + r11*2]
lea r13d, [rsi - 0x61]
lea ebp, [rsi - 0x20]
cmp r13w, 0x1a
cmovae ebp, esi
cmp r12w, bp
je 0x1403fc4c0
jmp 0x1403fc3d3
mov rbx, qword [r8 + 0x30]
mov r9b, 1
mov rsi, qword [rsp + 0x40]
test rsi, rsi
mov ebp, 1
je 0x1403fc3e0
mov qword [rsi], r8
jmp 0x1403fc3e0
Function at 0x140003950
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x58], rdx
mov rbx, r8
xor edx, edx
test rcx, rcx
je 0x140003984
cmp word [rcx], 0x5a4d
jne 0x140003984
movsxd rax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x140003984
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003984
mov edx, dword [rcx + 0x28]
add rdx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.140003890
test eax, eax
jne 0x1400039a0
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov rcx, rbx
call fcn.140003900
test rax, rax
je 0x140003995
lea rdx, [rax + 0x10]
lea rax, [rsp + 0x38]
mov rcx, qword [rbx]
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x58]
mov qword [rsp + 0x38], 0
call fcn.140004149
not eax
shr eax, 0x1f
add rsp, 0x40
pop rbx
ret

Function at 0x140004050
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov rcx, r10
call fcn.140003ff0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140009654
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rax, qword [0x14002ea98]
xor ebx, ebx
add rax, 0x18
mov r12, rcx
mov ecx, dword [0x14002ea94]
mov rsi, rdx
mov rdi, r8
cmp ebx, ecx
jge 0x1400096a2
mov rdx, qword [rax]
cmp r12, rdx
jb 0x14000969a
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x140009789
inc ebx
add rax, 0x28
jmp 0x14000967a
mov rcx, r12
call fcn.140009e81
mov rbp, rax
test rax, rax
jne 0x1400096c1
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.1400095f0
movsxd rbx, ebx
mov rax, qword [0x14002ea98]
xor edx, edx
imul rbx, rbx, 0x28
add rax, rbx
mov dword [rax], edx
mov qword [rax + 0x20], rbp
call fcn.140009f2f
mov edx, dword [rbp + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x14002ea98]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x140009723
mov rax, qword [0x14002ea98]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.1400095f0
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x140009783
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140009783
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x14002ea98]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140009783
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.1400095f0
inc dword [0x14002ea94]
mov ecx, edi
mov rdi, r12
rep movsb byte [rdi], byte [rsi]
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x140009bb0
Capabilities:
Get thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rdi, [0x14002eb00]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14002eae0]
test rbx, rbx
je 0x140009bfc
mov ecx, dword [rbx]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rsi, rsi
je 0x140009bf6
test eax, eax
jne 0x140009bf6
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
jmp 0x140009bce
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140009db0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140009dd3
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x140009dd3
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140009dd4
Capabilities:
Enumerate pe sections

Disassembly:
xor r8d, r8d
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r9d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
cmp r8d, r9d
jae 0x140009e0e
mov r10d, dword [rax + 0xc]
mov rcx, r10
cmp rdx, r10
jb 0x140009e05
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x140009e10
inc r8d
add rax, 0x28
jmp 0x140009dec
xor eax, eax
ret

Function at 0x140009e81
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x140025510]
mov r8, rcx
mov rcx, r9
call fcn.140009db0
test eax, eax
je 0x140009ead
mov rdx, r8
mov rcx, r9
sub rdx, r9
add rsp, 0x28
jmp fcn.140009dd4
xor eax, eax
add rsp, 0x28
ret
Function at 0x14000e903
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x140021678], eax
inc eax
jne 0x14000e91d
call sub.msvcrt.dll_abort
nop
add rsp, 0x28
ret

Function at 0x14000ea91
Capabilities:
Print debug messages

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x90
mov rbx, rcx
test rcx, rcx
je 0x14000eb2d
call fcn.1400110ba
dec eax
jne 0x14000eb26
xor eax, eax
lea rdi, [rsp + 0x25]
mov ecx, 0xa
lea rsi, str.Error_cleaning_up_spin_keys_for_thread
rep movsd dword [rdi], dword [rsi]
lea rdi, [rsp + 0x4d]
mov ecx, 0x43
rep stosb byte [rdi], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [rsp + 0x4c]
mov r8d, 0xa
mov ecx, eax
call qword [sym.imp.msvcrt.dll__ultoa]
mov eax, 0x27
lea rcx, [rsp + 0x25]
cmp byte [rcx + rax], 0
je 0x14000eb05
inc rax
cmp rax, 0x6b
jne 0x14000eaf4
jmp 0x14000eb1b
cmp eax, 0x6a
je 0x14000eb1b
movsxd rdx, eax
inc eax
cdqe
mov byte [rsp + rdx + 0x25], 0xa
mov byte [rsp + rax + 0x25], 0
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call sub.msvcrt.dll_abort
mov qword [rbx], 0xffffffffffffffff
add rsp, 0x90
pop rbx
pop rsi
pop rdi
ret

Function at 0x14000ebcf
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
call fcn.14000eb38
mov ecx, dword [0x140021678]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
test rax, rax
jne 0x14000ecde
call fcn.14000e9e5
cmp qword [0x140032048], 0
mov rbx, rax
je 0x14000ecde
test rax, rax
je 0x14000ecde
mov dword [rax + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
mov dword [rbx + 0x70], eax
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x38], 0xffffffffffffffff
lea rcx, [rbx + 0x68]
mov qword [rbx + 0x30], rax
call fcn.14000ea91
xor edx, edx
xor ecx, ecx
mov rdi, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rbx + 0xb8], edx
mov qword [rbx + 0x28], rcx
call rdi
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rsi, rax
call rdi
xor r8d, r8d
mov dword [rsp + 0x30], 2
mov rdx, rsi
mov dword [rsp + 0x28], r8d
mov rcx, rax
lea r9, [rbx + 0x28]
mov dword [rsp + 0x20], r8d
mov r8, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x14000eca4
call sub.msvcrt.dll_abort
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov ecx, dword [0x140021678]
mov rdx, rbx
mov dword [rbx + 0xc0], eax
xor eax, eax
mov dword [rbx + 0xbc], eax
mov al, byte [rbx + 0x40]
and eax, 0xffffffcf
or eax, 0x10
mov byte [rbx + 0x40], al
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x14000ec9f
mov rsi, rbx
mov rax, rsi
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
Function at 0x14000f85f
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, rcx
call fcn.14000ebcf
mov qword [rax + 8], rsi
mov rcx, qword [rax + 0x1d8]
mov rbx, rax
call fcn.14000f337
test byte [rbx + 0x40], 0x30
jne 0x14000f898
lea rcx, [rbx + 0xd0]
mov edx, 1
call qword [sym.imp.msvcrt.dll_longjmp]
mov ecx, dword [0x140021678]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x14000f923
cmp qword [rax + 0x28], 0
mov rcx, qword [rax + 0x30]
jne 0x14000f8d3
mov dword [rax], 0xdeadbeef
test rcx, rcx
je 0x14000f8c8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
mov esi, dword [rbx + 8]
mov qword [rbx + 0x30], rcx
jmp 0x14000f90d
mov dword [rax + 0xbc], 1
mov esi, dword [rax + 8]
test rcx, rcx
je 0x14000f8eb
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov qword [rbx + 0x30], rdx
test byte [rbx + 0x44], 4
je 0x14000f923
mov dword [rbx], 0xdeadbeef
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov qword [rbx + 0x28], rax
mov rcx, rbx
call fcn.14000ece9
mov ecx, dword [0x140021678]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, esi
call qword [sym.imp.msvcrt.dll__endthreadex]
nop
Function at 0x140002504
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x3c0]
sub rsp, 0x4c0
mov rax, qword [0x140050310]
xor rax, rsp
mov qword [rbp + 0x3b0], rax
mov r14, rcx
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x70]
call fcn.14001ea40
xor ebx, ebx
mov r9, qword [r14 + 0x30]
lea r8, str.SoftwareSysinternals_sColorMap
mov edx, 0x104
lea rcx, [rbp - 0x70]
call fcn.140001328
lea r8, [rsp + 0x50]
lea rdx, [rbp - 0x70]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140002681
mov edi, ebx
mov dword [rsp + 0x44], 0x104
mov dword [rsp + 0x40], 4
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x44]
lea r8, [rbp + 0x1a0]
mov edx, edi
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov esi, eax
test eax, eax
jne 0x14000266a
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x78], rbx
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], bx
lea rcx, [rbp + 0x1a0]
call fcn.140026ac0
mov r8, rax
lea rdx, [rbp + 0x1a0]
lea rcx, [rsp + 0x68]
call fcn.1400038e4
nop
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x58]
mov rcx, r14
call fcn.140001bdc
mov rcx, qword [rax]
mov eax, dword [rsp + 0x48]
mov dword [rcx + 0x40], eax
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x14000266a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000265e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400026aa
call fcn.14001d3ac
inc edi
jmp 0x140002581
inc edi
test esi, esi
je 0x140002581
mov bl, 1
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
mov rcx, qword [rbp + 0x3b0]
xor rcx, rsp
call fcn.14001d350
lea r11, [rsp + 0x4c0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.140026790
int3