joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14021e3f0
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rax, rcx
mov rbp, rsp
push r13
push r12
push rdi
push rsi
mov esi, r9d
push rbx
mov ebx, r8d
and rsp, 0xfffffffffffffff0
sub rsp, 0x430
mov r12, qword [rcx + 0x40]
mov rax, qword [rax + 0x30]
movzx ecx, byte [r12 + 0x80]
cmp qword [rdx], rax
jb 0x14021e46c
mov r8d, r9d
mov al, 0xff
mov rdi, rdx
shl r8, cl
mov rcx, r8
rep stosb byte [rdi], al
mov dword [rdx + 0x10], ebx
test byte [r12 + 6], 8
jne 0x14021e518
movzx ecx, byte [r12 + 0x80]
mov r10, qword [r12 + 0x10]
mov r9d, ebx
lea rsp, [rbp - 0x28]
pop rbx
pop rsi
shl r9, cl
pop rdi
mov rcx, r10
pop r12
pop r13
pop rbp
jmp fcn.14021a0c0
mov eax, dword [r12 + 0x78]
shl rbx, cl
mov r8d, 1
lea r13, [rsp + 0x30]
mov edi, 0x40
mov qword [rsp + 0x38], rax
add rax, qword [r12 + 0xa8]
mov qword [rsp + 0x30], rax
dec esi
mov eax, r8d
je 0x14021e4f2
movaps xmm0, xmmword [rsp + 0x30]
shl rax, 4
inc r8d
movaps xmmword [rsp + rax + 0x30], xmm0
cmp r8d, 0x40
jne 0x14021e496
mov rax, rdi
mov r10, qword [r12 + 0x10]
mov r9, rbx
mov rdx, r13
movzx ecx, byte [r12 + 0x80]
shl rax, cl
mov rcx, r10
mov qword [rsp + 0x20], rax
call fcn.14013ad50
mov rax, rdi
xor r8d, r8d
movzx ecx, byte [r12 + 0x80]
shl rax, cl
add rbx, rax
jmp 0x14021e496
mov r10, qword [r12 + 0x10]
lea rdx, [rsp + 0x30]
mov r9, rbx
movzx ecx, byte [r12 + 0x80]
shl rax, cl
mov rcx, r10
mov qword [rsp + 0x20], rax
call fcn.14013ad50
lea rsp, [rbp - 0x28]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop rbp
ret
Function at 0x14021f940
Capabilities:
Allocate thread local storage

Disassembly:
push r15
push r14
mov r14, rcx
push r13
push r12
mov r12, rdx
push rbp
mov rbp, r8
push rdi
push rsi
push rbx
sub rsp, 0x38
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [r14], eax
inc eax
je 0x14021f990
lea r13, [0x1403e9420]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x1403e93cc]
mov r10d, dword [0x1403e93c8]
mov r9d, dword [r14]
mov r15, rbx
cmp ebx, r10d
jne 0x14021f9f9
jmp 0x14021f9a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14021fa40
jmp 0x14021f966
mov rsi, qword [0x1403e93c0]
xor ecx, ecx
imul rdx, rbx, 0x30
mov dword [rsp + 0x2c], r9d
lea rdi, [0x1403e9240]
mov dword [rsp + 0x28], r10d
cmp rsi, rdi
cmovne rcx, rsi
call sub.msvcrt.dll_realloc
test rax, rax
je 0x14021fa2a
cmp rsi, rdi
mov r10d, dword [rsp + 0x28]
mov r9d, dword [rsp + 0x2c]
jne 0x14021f9e8
mov ecx, 0x60
mov rdi, rax
rep movsd dword [rdi], dword [rsi]
add r10d, r10d
mov qword [0x1403e93c0], rax
mov dword [0x1403e93c8], r10d
imul rax, rbx, 0x18
inc r15d
add rax, qword [0x1403e93c0]
mov rcx, r13
mov byte [rax + 0x14], 1
mov dword [rax + 0x10], r9d
mov qword [rax], r12
mov qword [rax + 8], rbp
mov dword [0x1403e93cc], r15d
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
jmp 0x14021fa40
mov ecx, dword [r14]
call fcn.14021d4c0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 0xe
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140220c00
Capabilities:
Print debug messages

Disassembly:
push r12
mov r10, rcx
lea r12, str._troubles_with_panic_message_preparation_
push rbx
sub rsp, 0x38
mov qword [rsp + 0x58], rdx
lea rcx, [rsp + 0x28]
mov rdx, r10
mov qword [rsp + 0x60], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x28], 0
call fcn.14021a030
test eax, eax
jle 0x140220c55
mov r12, qword [rsp + 0x28]
test r12, r12
jne 0x140220c55
lea r12, str._troubles_with_panic_message_preparation_
lea rcx, str._r_nMDBX_PANIC:
mov rbx, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rbx
mov rcx, r12
call rbx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140220c7a
call qword [sym.imp.KERNEL32.dll_DebugBreak]
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_FatalExit]
Function at 0x140221ab0
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
push r12
mov rax, rcx
push rbp
push rdi
mov rdi, rcx
push rsi
mov rsi, rdx
push rbx
mov rbx, r8
sub rsp, 0x60
or rax, rdx
jne 0x140221ae2
mov eax, 0x57
test r8, r8
je 0x140221b8e
mov qword [rbx], 0xffffffffffffffff
jmp 0x140221af3
test rdx, rdx
je 0x140221aee
mov qword [rdx], 0xffffffffffffffff
test rbx, rbx
jne 0x140221ad9
lea r12, [rsp + 0x20]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [rsp + 0x24]
mov rbp, rdx
test rdi, rdi
je 0x140221b10
mov qword [rdi], rdx
mov eax, 0xffff87c0
cmp rdx, 0xff
jle 0x140221b8e
lea rcx, [rdx - 1]
test rcx, rdx
jne 0x140221b8e
xor eax, eax
mov ecx, 0x10
mov rdi, r12
bsf ebp, ebp
rep stosd dword [rdi], eax
mov dword [rsp + 0x20], 0x40
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
jne 0x140221b53
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140221b8e
test rsi, rsi
jne 0x140221b5f
test rbx, rbx
jne 0x140221b73
jmp 0x140221b85
mov rax, qword [rsp + 0x28]
mov ecx, ebp
shr rax, cl
mov qword [rsi], rax
test rax, rax
jg 0x140221b58
jmp 0x140221b89
mov rax, qword [rsp + 0x30]
mov ecx, ebp
shr rax, cl
mov qword [rbx], rax
test rax, rax
jle 0x140221b89
xor eax, eax
jmp 0x140221b8e
mov eax, 0x32
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x140221dc0
Capabilities:
Get system information on windows

Disassembly:
push r12
mov edx, 0x2f0
push rsi
push rbx
mov rbx, rcx
mov ecx, 1
sub rsp, 0x60
call sub.msvcrt.dll_calloc
mov r12, rax
mov eax, 0xe
test r12, r12
je 0x140221f26
movabs rax, 0x20000003d
mov dword [r12 + 0x168], 2
mov qword [r12 + 0x8c], rax
mov qword [r12 + 0x10], 0xffffffffffffffff
mov qword [r12 + 0x38], 0xffffffffffffffff
mov qword [r12 + 0x48], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rcx, [rsp + 0x30]
mov byte [r12 + 0x81], 0xff
mov dword [r12 + 0x94], eax
movabs rax, 0x4000000000400
mov qword [r12 + 0xe8], rax
mov eax, 0x3fa0001
shl rax, 0x10
mov qword [r12 + 0xf0], rax
movabs rax, 0x400000080840
mov qword [r12 + 0xf8], rax
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x34]
lea rcx, [rax - 1]
mov rdx, rax
test rcx, rax
jne 0x140221e93
cmp rax, 0xff
ja 0x140221ed5
cmp byte [0x1403e8a08], 0
je 0x140221ebf
mov qword [rsp + 0x20], rax
lea r9, str.unsuitable_system_pagesize__llu_n
mov r8d, 0x39d8
lea rdx, str.mdbx_env_create
mov ecx, 1
call fcn.14021c450
mov rcx, r12
call sub.msvcrt.dll_free
mov qword [rbx], 0
mov eax, 0xffff87c0
jmp 0x140221f26
mov dword [r12 + 0x88], eax
mov eax, 0x10000
mov rcx, r12
cmp edx, eax
cmova rdx, rax
call fcn.140221ba0
mov rsi, qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [r12 + 0x140]
call rsi
lea rcx, [r12 + 0x188]
call qword [0x1403e94c8]
lea rcx, [r12 + 0x190]
call rsi
mov dword [r12], 0x9a899641
xor eax, eax
mov qword [rbx], r12
add rsp, 0x60
pop rbx
pop rsi
pop r12
ret
Function at 0x14001113b
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x140016160
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x14003006c]
call fcn.1400116e5
mov rax, qword [rbp + 0x100]
cmp dword [rax], 0x270
jne 0x14001619c
mov rcx, qword [rbp + 0x100]
call fcn.140011177
jmp 0x1400161b7
mov rax, qword [rbp + 0x100]
cmp dword [rax], 0x4e0
jb 0x1400161b7
mov rcx, qword [rbp + 0x100]
call fcn.14001136b
mov rax, qword [rbp + 0x100]
mov eax, dword [rax]
mov rcx, qword [rbp + 0x100]
mov eax, dword [rcx + rax*4 + 4]
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x100]
mov eax, dword [rax]
inc eax
mov rcx, qword [rbp + 0x100]
mov dword [rcx], eax
mov eax, dword [rbp + 4]
shr eax, 0xb
mov rcx, qword [rbp + 0x100]
and eax, dword [rcx + 0x1384]
mov ecx, dword [rbp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shl eax, 7
and eax, 0x9d2c5680
mov ecx, dword [rbp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shl eax, 0xf
and eax, 0xefc60000
mov ecx, dword [rbp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 0x12
mov ecx, dword [rbp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x14001136b
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x140016d90
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x20]
lea rcx, [0x14003006c]
call fcn.1400116e5
mov qword [rbp + 8], 0x26f
mov qword [rbp + 0x28], 0xe3
mov qword [rbp + 0x48], 0
jmp 0x140016dd4
mov rax, qword [rbp + 0x48]
inc rax
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0xe3
jae 0x140016e65
mov rax, qword [rbp + 0x1e0]
mov rcx, qword [rbp + 0x48]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x48]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rbp + 0x64], eax
mov eax, dword [rbp + 0x64]
and eax, 1
test eax, eax
je 0x140016e2a
mov dword [rbp + 0x1b4], 0x9908b0df
jmp 0x140016e34
mov dword [rbp + 0x1b4], 0
mov eax, dword [rbp + 0x64]
shr eax, 1
xor eax, dword [rbp + 0x1b4]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x48]
xor eax, dword [rcx + rdx*4 + 0xff8]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x48]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x140016dc9
mov qword [rbp + 0x88], 0xe3
jmp 0x140016e83
mov rax, qword [rbp + 0x88]
inc rax
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0x26f
jae 0x140016f2c
mov rax, qword [rbp + 0x1e0]
mov rcx, qword [rbp + 0x88]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x88]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rbp + 0xa4], eax
mov eax, dword [rbp + 0xa4]
and eax, 1
test eax, eax
je 0x140016ee8
mov dword [rbp + 0x1b4], 0x9908b0df
jmp 0x140016ef2
mov dword [rbp + 0x1b4], 0
mov eax, dword [rbp + 0xa4]
shr eax, 1
xor eax, dword [rbp + 0x1b4]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x88]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x88]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x140016e72
mov qword [rbp + 0xc8], 0x26f
mov eax, 4
imul rax, rax, 0x4df
mov rcx, qword [rbp + 0x1e0]
mov eax, dword [rcx + rax + 4]
and eax, 0x80000000
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rbp + 0x1e0]
mov ecx, dword [rdx + rcx + 4]
btr ecx, 0x1f
or eax, ecx
mov dword [rbp + 0xe4], eax
mov eax, dword [rbp + 0xe4]
and eax, 1
test eax, eax
je 0x140016f8c
mov dword [rbp + 0x1b4], 0x9908b0df
jmp 0x140016f96
mov dword [rbp + 0x1b4], 0
mov eax, dword [rbp + 0xe4]
shr eax, 1
xor eax, dword [rbp + 0x1b4]
mov ecx, 4
imul rcx, rcx, 0x18c
mov rdx, qword [rbp + 0x1e0]
xor eax, dword [rdx + rcx + 4]
mov ecx, 4
imul rcx, rcx, 0x26f
mov rdx, qword [rbp + 0x1e0]
mov dword [rdx + rcx + 4], eax
mov rax, qword [rbp + 0x1e0]
mov dword [rax], 0
lea rsp, [rbp + 0x1c8]
pop rdi
pop rbp
ret

Function at 0x1400113e8
Capabilities:
Terminate process

Disassembly:
jmp 0x14001be40
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400114ec
Capabilities:
Parse pe header

Disassembly:
jmp 0x14001acf0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14001ad10
xor al, al
jmp 0x14001ad91
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14001ad23
xor al, al
jmp 0x14001ad91
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001ad4d
xor al, al
jmp 0x14001ad91
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14001ad61
xor al, al
jmp 0x14001ad91
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14001ad73
xor al, al
jmp 0x14001ad91
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001ad8f
xor al, al
jmp 0x14001ad91
mov al, 1
add rsp, 0x38
ret
Function at 0x40e900
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
movsxd rbp, dword [0x004aa064]
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
test ebp, ebp
jle 0x40ea1a
mov rax, qword [0x004aa068]
xor r9d, r9d
add rax, 8
mov r10, qword [rax]
cmp rbx, r10
jb 0x40e94e
mov rdx, qword [rax + 8]
mov r11d, dword [rdx + 8]
add r10, r11
cmp rbx, r10
jb 0x40ea00
add r9d, 1
add rax, 0x18
cmp r9d, ebp
jne 0x40e932
mov rcx, rbx
call fcn.0040f740
test rax, rax
mov r12, rax
je 0x40ea52
lea rbp, [rbp + rbp*2]
shl rbp, 3
mov r13, rbp
add r13, qword [0x004aa068]
mov qword [r13 + 0x10], rax
mov dword [r13], 0
call fcn.0040f860
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
lea rdx, [rsp + 0x20]
mov qword [r13 + 8], rax
mov rax, qword [0x004aa068]
mov rcx, qword [rax + rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x40ea35
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x40e9f9
sub eax, 0x40
and eax, 0xffffffbf
je 0x40e9f9
mov r9, rbp
add r9, qword [0x004aa068]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x40ea21
add dword [0x004aa064], 1
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sub.msvcrt.dll_memcpy
xor ebp, ebp
jmp 0x40e95b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.0040e890
mov rax, qword [0x004aa068]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbp + 8]
call fcn.0040e890
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.0040e890
nop
nop word cs:[rax + rax]

Function at 0x40f650
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x40f691
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x40f688
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x40f693
add rax, 0x28
cmp rax, r9
jne 0x40f674
xor eax, eax
repz ret

Function at 0x40f740
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [0x0048ec30]
cmp word [rbx], 0x5a4d
je 0x40f760
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov rsi, rcx
mov rcx, rbx
call fcn.0040f610
test eax, eax
je 0x40f754
sub rsi, rbx
mov rcx, rbx
mov rdx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.0040f650
Function at 0x40f9b0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x004aa9c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004aa9a0]
test rbx, rbx
je 0x40fa04
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x40f9fb
test rsi, rsi
je 0x40f9fb
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x40f9e0
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x004aa9c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax

Function at 0x4101a0
Capabilities:
Check mutex on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x80]
mov rdi, rcx
movsxd r12, edx
mov r13, r8
call sub.msvcrt.dll_strlen
mov rsi, rax
lea ebx, [rax + 0xf]
lea eax, [rax + 0x52]
cdqe
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.004100e0
sub rsp, rax
movsxd r14, esi
movabs rax, 0x656d68732d636367
lea r15, [rsp + 0x20]
lea rcx, [rsp + 0x2f]
mov r8, r14
mov rdx, rdi
mov qword [rsp + 0x20], rax
mov eax, 0x326d
mov dword [rsp + 0x28], 0x64742d6d
mov word [rsp + 0x2c], ax
movsxd rbx, ebx
mov byte [rsp + 0x2e], 0x2d
call sub.msvcrt.dll_memcpy
lea rax, [r15 + r14 + 0x10]
lea r14d, [rsi + 0x50]
movabs rdx, 0x6161616161616161
xor ecx, ecx
mov r8, r15
mov qword [rax], rdx
mov qword [rax + 8], rdx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], rdx
mov qword [rax + 0x20], rdx
mov qword [rax + 0x28], rdx
mov qword [rax + 0x30], rdx
mov qword [rax + 0x38], rdx
movsxd rax, r14d
xor edx, edx
mov byte [rsp + rax + 0x20], 0
mov byte [rsp + rbx + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov byte [rsp + rbx + 0x20], 0x2d
mov rdi, rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x410289
int3
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindAtomA]
test ax, ax
jne 0x410328
mov rcx, r12
call sub.msvcrt.dll_malloc
lea r9d, [rsi + 0x10]
mov rbx, rax
mov r10d, 0x40
bt rbx, r10
jae 0x4102c4
mov r11d, r14d
sub r11d, r10d
movsxd r11, r11d
mov byte [r15 + r11], 0x41
sub r10d, 1
jne 0x4102b0
mov dword [rbp - 0x54], r9d
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_AddAtomA]
test ax, ax
mov r9d, dword [rbp - 0x54]
je 0x410325
lea r8d, [rsi + 0x51]
movzx ecx, ax
mov rdx, r15
call fcn.00410120
cmp rax, rbx
mov rsi, rax
je 0x410340
mov rcx, rbx
call fcn.0041a720
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rsi
lea rsp, [rbp - 0x48]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
int3
lea r9d, [rsi + 0x10]
lea r8d, [rsi + 0x51]
movzx ecx, ax
mov rdx, r15
call fcn.00410120
mov rsi, rax
jmp 0x4102ff
xor edx, edx
mov r8, r12
mov rcx, rbx
call sub.msvcrt.dll_memset
test r13, r13
je 0x4102ff
mov rcx, rbx
call r13
jmp 0x4102ff
Function at 0x41b530
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [0x004ab508]
test rbx, rbx
je 0x41b560
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [rbx], eax
mov rax, qword [0x004ab508]
test rax, rax
je 0x41b584
cmp dword [rax], 0xffffffff
je 0x41b5a5
add rsp, 0x20
pop rbx
ret
lea r8, [0x0041a9c0]
lea rcx, str._pthread_tls_shmem
mov edx, 4
call fcn.00420710
mov rbx, rax
mov qword [0x004ab508], rax
jmp 0x41b541
lea r8, [0x0041a9c0]
lea rcx, str._pthread_tls_shmem
mov edx, 4
call fcn.00420710
mov qword [0x004ab508], rax
jmp 0x41b555
call sub.msvcrt.dll_abort
nop
nop dword [rax + rax]

Function at 0x41ba40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rcx, qword [0x004ab510]
test rcx, rcx
je 0x41bb80
call fcn.0041b9b0
mov rax, qword [0x004ab508]
test rax, rax
je 0x41bba3
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x41ba83
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
call fcn.0041b380
test rax, rax
mov rbx, rax
je 0x41bbeb
cmp qword [0x004ae050], 0
je 0x41bbeb
mov dword [rax + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, 1
mov dword [rbx + 0x68], eax
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rsi, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rbx + 0x30], rax
mov qword [rbx + 0x38], 0xffffffffffffffff
mov qword [rbx + 0x60], 0xffffffffffffffff
mov dword [rbx + 0xb0], 0
mov qword [rbx + 0x28], 0
call rsi
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rdi, rax
call rsi
mov dword [rsp + 0x30], 2
mov rcx, rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rbx + 0x28]
mov r8, rbp
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x41bbf2
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [rbx + 0xb8], eax
movzx eax, byte [rbx + 0x40]
mov dword [rbx + 0xb4], 0
and eax, 0xffffffcf
or eax, 0x10
mov byte [rbx + 0x40], al
mov rax, qword [0x004ab508]
test rax, rax
je 0x41bbc7
mov rdx, rbx
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x41bbf2
mov rax, rbx
jmp 0x41ba7a
lea rcx, str._pthread_tls_once_shmem
xor r8d, r8d
mov edx, 4
call fcn.00420710
mov rcx, rax
mov qword [0x004ab510], rax
jmp 0x41ba58
lea r8, [0x0041a9c0]
lea rcx, str._pthread_tls_shmem
mov edx, 4
call fcn.00420710
mov qword [0x004ab508], rax
jmp 0x41ba6d
lea r8, [0x0041a9c0]
lea rcx, str._pthread_tls_shmem
mov edx, 4
call fcn.00420710
mov qword [0x004ab508], rax
jmp 0x41bb68
xor eax, eax
jmp 0x41ba7a
call sub.msvcrt.dll_abort
nop
nop dword [rax + rax]
lea rcx, str._pthread_key_dest_shmem
xor r8d, r8d
mov edx, 8
jmp fcn.00420710
Function at 0x41bc00
Capabilities:
Check mutex on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rcx, qword [0x004ab510]
test rcx, rcx
je 0x41bb80
call fcn.0041b9b0
mov rax, qword [0x004ab508]
test rax, rax
je 0x41bba3
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x41ba83
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
call fcn.0041b380
test rax, rax
mov rbx, rax
je 0x41bbeb
cmp qword [0x004ae050], 0
je 0x41bbeb
mov dword [rax + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, 1
mov dword [rbx + 0x68], eax
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rsi, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rbx + 0x30], rax
mov qword [rbx + 0x38], 0xffffffffffffffff
mov qword [rbx + 0x60], 0xffffffffffffffff
mov dword [rbx + 0xb0], 0
mov qword [rbx + 0x28], 0
call rsi
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rdi, rax
call rsi
mov dword [rsp + 0x30], 2
mov rcx, rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rbx + 0x28]
mov r8, rbp
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x41bbf2
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [rbx + 0xb8], eax
movzx eax, byte [rbx + 0x40]
mov dword [rbx + 0xb4], 0
and eax, 0xffffffcf
or eax, 0x10
mov byte [rbx + 0x40], al
mov rax, qword [0x004ab508]
test rax, rax
je 0x41bbc7
mov rdx, rbx
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x41bbf2
mov rax, rbx
jmp 0x41ba7a
lea rcx, str._pthread_tls_once_shmem
xor r8d, r8d
mov edx, 4
call fcn.00420710
mov rcx, rax
mov qword [0x004ab510], rax
jmp 0x41ba58
lea r8, [0x0041a9c0]
lea rcx, str._pthread_tls_shmem
mov edx, 4
call fcn.00420710
mov qword [0x004ab508], rax
jmp 0x41ba6d
lea r8, [0x0041a9c0]
lea rcx, str._pthread_tls_shmem
mov edx, 4
call fcn.00420710
mov qword [0x004ab508], rax
jmp 0x41bb68
xor eax, eax
jmp 0x41ba7a
call sub.msvcrt.dll_abort
nop
nop dword [rax + rax]
lea rcx, str._pthread_key_dest_shmem
xor r8d, r8d
mov edx, 8
jmp fcn.00420710
Function at 0x41e9b0
Capabilities:
Check mutex on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
mov rcx, qword [0x004ab558]
mov esi, edx
test rcx, rcx
je 0x41e950
call fcn.00420ad0
cmp dword [rbx], 0xbab1f00d
jne 0x41e977
mov eax, dword [rbx + 4]
test eax, eax
jle 0x41e977
mov eax, dword [rbx + 4]
test eax, eax
jle 0x41e903
mov eax, dword [rbx + 4]
sub eax, 1
mov dword [rbx + 4], eax
mov rcx, qword [0x004ab558]
test rcx, rcx
je 0x41e920
call fcn.00420b80
mov eax, esi
add rsp, 0x38
pop rbx
pop rsi
ret
lea r8, [0x0041e690]
lea rcx, str.mutex_global_shmem
mov edx, 8
call fcn.00420710
mov rcx, rax
mov qword [0x004ab558], rax
call fcn.00420b80
mov eax, esi
add rsp, 0x38
pop rbx
pop rsi
ret
lea rcx, str.mutex_global_shmem
lea r8, [0x0041e690]
mov edx, 8
call fcn.00420710
mov rcx, rax
mov qword [0x004ab558], rax
jmp 0x41e8d7
call qword [sym.imp.msvcrt.dll___iob_func]
lea r9, str.C:_crossdev_src_winpthreads_git20141130_src_mutex.c
lea rcx, [rax + 0x60]
lea r8, str._m___valid__LIFE_MUTEX____m___busy___0_
lea rdx, [0x0048e0e0]
mov dword [rsp + 0x20], 0x39
call sub.msvcrt.dll_fprintf
mov ecx, 1
call sub.msvcrt.dll_exit
nop
nop
lea r8, [0x0041e690]
lea rcx, str.mutex_global_shmem
mov edx, 8
jmp fcn.00420710