joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14016d1d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
xor ebp, ebp
lea rbx, [0x1403cfba0]
mov eax, dword [rcx + 0x28]
mov r12, rcx
mov rdi, rdx
mov rsi, r8
test eax, eax
jle 0x14016d264
nop dword [rax + rax]
mov r10d, ebp
xor r10d, 1
cmp ebp, 2
cmovge r10d, ebp
movsxd r9, r10d
shl r9, 5
add r9, qword [r12 + 0x20]
test rsi, rsi
je 0x14016d23e
mov r8, qword [r9]
xor ecx, ecx
jmp 0x14016d22d
movzx edx, byte [rbx + rdx]
cmp byte [rbx + rax], dl
jne 0x14016d278
add rcx, 1
movzx eax, byte [r8 + rcx]
movzx edx, byte [rsi + rcx]
cmp eax, edx
jne 0x14016d220
test eax, eax
jne 0x14016d229
mov rcx, qword [r9 + 0x18]
xor r8d, r8d
mov rdx, rdi
add rcx, 0x20
call fcn.140166bf0
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x14016d266
add ebp, 1
cmp dword [r12 + 0x28], ebp
jg 0x14016d1f8
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
test r10d, r10d
jne 0x14016d25a
mov rcx, rsi
mov eax, 0x6d
lea r8, str.main
jmp 0x14016d2a8
cdqe
movzx edx, byte [rbx + rdx]
cmp byte [rbx + rax], dl
jne 0x14016d25a
movzx eax, byte [r8 + 1]
add r8, 1
add rcx, 1
movzx edx, byte [rcx]
cmp eax, edx
jne 0x14016d290
test eax, eax
jne 0x14016d29b
jmp 0x14016d23e

Function at 0x140175950
Capabilities:
Create thread

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
xor edi, edi
movzx ebp, byte [rcx + 0x5b]
sub ebp, 1
mov byte [rcx + 0x58], 1
mov rsi, rcx
test ebp, ebp
jg 0x140175987
jmp 0x1401759c5
lea rax, [rbx + rbx*2]
lea rax, [rbx + rax*4]
cmp qword [rsi + rax*8 + 0x60], 0
je 0x1401759d0
add edi, 1
cmp edi, ebp
je 0x1401759d0
movzx eax, byte [rsi + 0x5a]
lea eax, [rdi + rax + 1]
cdq
idiv ebp
movsxd rbx, edx
lea rax, [rbx + rbx*2]
lea rax, [rbx + rax*4]
shl rax, 3
lea r12, [rsi + rax + 0x60]
mov eax, dword [rsi + rax + 0x68]
test eax, eax
je 0x140175970
mov rcx, r12
call fcn.140160cc0
test eax, eax
je 0x140175970
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
xor r12d, r12d
nop dword [rax + rax]
cmp ebp, edi
je 0x140175a50
lea rdx, [rsi + 0x60]
mov rax, r12
mov rcx, qword [r12 + 0x28]
movdqu xmm0, xmmword [rsi + 0x38]
sub rax, rdx
movabs rdx, 0x4ec4ec4ec4ec4ec5
sar rax, 3
imul rax, rdx
mov byte [rsi + 0x5a], al
mov rax, qword [rsi + 0x48]
movups xmmword [r12 + 0x20], xmm0
mov qword [r12 + 0x30], rax
mov qword [rsi + 0x38], 0
mov dword [rsi + 0x48], 0
test rcx, rcx
je 0x140175a78
mov qword [rsi + 0x40], rcx
call qword [0x14026b498]
mov dword [rsi + 0x54], eax
mov r8, r12
lea rdx, [0x140175930]
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.140160bd0
movsxd rbp, ebp
lea rdx, [rsi + 0x38]
lea rax, [rbp + rbp*2]
lea rax, [rbp + rax*4]
lea rcx, [rsi + rax*8 + 0x60]
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.1401756b0
cmp qword [rsi + 0x40], 0
je 0x140175a2d
movsxd rcx, dword [rsi + 0x54]
call fcn.140160470
mov qword [rsi + 0x40], rax
test rax, rax
jne 0x140175a2d
mov eax, 7
jmp 0x1401759ba
Function at 0x14017c170
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0xc0
mov rbx, r8
mov rsi, r9
movzx r8d, byte [r8 + 8]
cmp byte [rcx + 0x16], r8b
jne 0x14017c1c0
mov r11d, dword [rcx + 0x10]
mov rax, qword [rdx + 8]
mov r10, qword [rbx + 0x10]
mov qword [rsp + 0x20], rax
mov r9d, dword [rdx + 0x10]
mov edx, r11d
mov r8, qword [rcx + 8]
mov rcx, r10
call qword [rbx + 0x18]
add rsp, 0xc0
pop rbx
pop rsi
pop r12
ret
mov rax, qword [rcx + 0x18]
movdqu xmm0, xmmword [rcx]
mov dword [rsp + 0x60], 0
mov dword [rsp + 0xa0], 0
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x98], rax
mov rax, qword [rcx + 0x10]
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rax
movzx eax, word [rcx + 0x14]
test ah, 0x20
jne 0x14017c20a
and ah, 0x8f
or ah, 0x40
mov word [rsp + 0x54], ax
movdqu xmm1, xmmword [rdx]
mov rcx, qword [rdx + 0x10]
movzx edx, word [rdx + 0x14]
mov qword [rsp + 0x90], rcx
movaps xmmword [rsp + 0x80], xmm1
test dh, 0x20
jne 0x14017c239
and dh, 0x8f
or dh, 0x40
mov word [rsp + 0x94], dx
movzx edx, r8b
xor r12d, r12d
test al, 1
jne 0x14017c258
lea rcx, [rsp + 0x40]
call fcn.14017b9e0
movzx edx, byte [rbx + 8]
mov r12, rax
mov r8d, edx
movzx eax, word [rsp + 0x94]
mov ecx, eax
and cx, 0x202
cmp cx, 0x202
je 0x14017c310
test al, 1
jne 0x14017c2e0
lea rcx, [rsp + 0x80]
call fcn.14017b9e0
test r12, r12
je 0x14017c2e0
test rax, rax
je 0x14017c2e0
mov rcx, qword [rbx + 0x10]
mov edx, dword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r8, r12
mov r9d, dword [rsp + 0x90]
call qword [rbx + 0x18]
mov ecx, dword [rsp + 0x60]
test ecx, ecx
jne 0x14017c2f2
mov edx, dword [rsp + 0xa0]
test edx, edx
je 0x14017c1ae
lea rcx, [rsp + 0x80]
mov dword [rsp + 0x3c], eax
call fcn.140165ea0
mov eax, dword [rsp + 0x3c]
add rsp, 0xc0
pop rbx
pop rsi
pop r12
ret
test rsi, rsi
je 0x14017c2e8
mov byte [rsi], 7
mov ecx, dword [rsp + 0x60]
xor eax, eax
test ecx, ecx
je 0x14017c2b0
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x3c], eax
call fcn.140165ea0
mov eax, dword [rsp + 0x3c]
jmp 0x14017c2b0
cmp byte [rsp + 0x96], r8b
jne 0x14017c272
mov rax, qword [rsp + 0x88]
jmp 0x14017c283
Function at 0x14017c330
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movzx eax, word [rcx + 0x14]
movzx r9d, word [rdx + 0x14]
mov r10d, eax
or r10d, r9d
test r10b, 1
jne 0x14017c3b0
test r10b, 0x2c
je 0x14017c380
mov r8d, eax
and r8d, r9d
test r8b, 0x24
jne 0x14017c3d0
and r8d, 8
je 0x14017c3e8
movsd xmm1, qword [rcx]
movsd xmm0, qword [rdx]
comisd xmm0, xmm1
ja 0x14017c43c
xor r8d, r8d
comisd xmm1, xmm0
seta r8b
jmp 0x14017c3c9
and r10d, 2
je 0x14017c3a1
test al, 2
je 0x14017c420
and r9d, 2
je 0x14017c43c
test r8, r8
jne 0x14017c448
jmp fcn.14015c880
and r9d, 1
and eax, 1
sub r9d, eax
mov r8d, r9d
jmp 0x14017c3c9
fstp st(0)
fstp st(0)
jmp 0x14017c3c9
fstp st(0)
fstp st(0)
mov eax, r8d
ret
mov rax, qword [rdx]
cmp qword [rcx], rax
jl 0x14017c43c
setg r8b
movzx r8d, r8b
mov eax, r8d
ret
test al, 0x24
jne 0x14017c430
mov r8d, 1
test al, 8
je 0x14017c3c9
and r9d, 0x24
je 0x14017c43c
fild qword [rdx]
fld qword [rcx]
fcomi st(1)
ja 0x14017c3bf
fxch st(1)
xor r9d, r9d
fcompi st(1)
fstp st(0)
seta r9b
neg r9d
mov r8d, r9d
jmp 0x14017c3c9
mov r8d, 1
jmp 0x14017c3c9
test r9b, 8
jne 0x14017c450
and r9d, 0x24
jne 0x14017c3d0
mov r8d, 0xffffffff
jmp 0x14017c3c9
xor r9d, r9d
jmp fcn.14017c170
fild qword [rcx]
fld qword [rdx]
mov r8d, 0xffffffff
fcomi st(1)
ja 0x14017c3c5
fxch st(1)
xor r8d, r8d
fcompi st(1)
fstp st(0)
seta r8b
jmp 0x14017c3c9
Function at 0x1401835c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov r15d, dword [rsp + 0xb0]
mov rdi, qword [rcx + 0x10]
mov rbp, qword [rsp + 0xb8]
mov r12d, dword [rsp + 0xc0]
mov rsi, rcx
mov r13d, edx
mov rcx, qword [rcx]
mov dword [rsp + 0x3c], r9d
lea edx, [r15*8 + 0x30]
mov r14d, r8d
movsxd rdx, edx
call fcn.140174530
mov rbx, rax
test rax, rax
je 0x140183710
mov byte [rax + 0x2a], r15b
mov edx, dword [rdi + 0x90]
cmp r12d, 1
mov r10d, 0x41
mov qword [rax], 0
adc r10d, 0
mov qword [rax + 8], rbp
mov qword [rax + 0x18], 0
mov dword [rax + 0x24], 0
mov dword [rax + 0x20], edx
cmp edx, dword [rdi + 0x94]
jge 0x1401836f0
lea eax, [rdx + 1]
mov dword [rdi + 0x90], eax
movsxd rax, edx
lea rcx, [rax + rax*2]
mov rax, qword [rdi + 0x88]
lea rax, [rax + rcx*8]
xor ecx, ecx
mov word [rax + 2], cx
mov ecx, dword [rsp + 0x3c]
mov byte [rax], r10b
mov dword [rax + 4], r13d
mov dword [rax + 8], r14d
mov dword [rax + 0xc], ecx
mov qword [rax + 0x10], 0
mov byte [rax + 1], 0
mov r9d, 0xfffffff1
mov r8, rbx
mov rcx, rdi
call fcn.140176120
movsxd rax, dword [rdi + 0x90]
test eax, eax
jle 0x1401836cd
mov rdx, qword [rdi + 0x88]
lea rax, [rax + rax*2]
and r12d, 0x2e
lea rax, [rdx + rax*8]
mov word [rax - 0x16], r12w
mov rax, qword [rsi + 0xa0]
test rax, rax
cmove rax, rsi
mov byte [rax + 0x21], 1
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov eax, dword [rsp + 0x3c]
mov edx, r10d
mov r9d, r14d
mov r8d, r13d
mov rcx, rdi
mov dword [rsp + 0x20], eax
call fcn.1401816c0
mov edx, eax
jmp 0x140183699
test byte [rbp + 4], 0x10
je 0x1401836df
mov rcx, qword [rsi]
mov rdx, rbp
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.140165990
Function at 0x1401b73d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rsi, qword [rsp + 0x90]
mov r13, r8
mov r12, rcx
mov rbx, rdx
mov r8d, r9d
test rdx, rdx
je 0x1401b74e0
mov rdi, qword [rcx + 0x80]
movzx eax, word [rdi + 6]
mov rcx, qword [rdi + 0x10]
add eax, 1
imul eax, eax, 0x38
lea edx, [rax + 0x28]
test rcx, rcx
je 0x1401b74c0
call fcn.140174530
mov r14, rax
test r14, r14
je 0x1401b74d4
lea rax, [r14 + 0x28]
mov qword [r14], rdi
mov r9, r14
mov r8, rbx
mov qword [r14 + 8], rax
movzx eax, word [rdi + 6]
mov edx, r13d
mov rcx, rdi
add eax, 1
mov word [r14 + 0x1c], ax
call fcn.1401697f0
movzx eax, word [r14 + 0x1c]
test ax, ax
je 0x1401b7468
cmp ax, word [rdi + 8]
jbe 0x1401b7500
lea rax, [0x1403be9bc]
mov r9d, 0x10870
lea r8, str.database_corruption
mov ecx, 0xb
mov qword [rsp + 0x20], rax
lea rdx, str._s_at_line__d_of___.10s_
mov r13d, 0xb
call fcn.140197c10
mov rax, qword [r12 + 0x80]
mov rdx, r14
mov rcx, qword [rax + 0x10]
call fcn.140165990
mov eax, r13d
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
ret
mov rcx, rdx
call fcn.140160470
mov r14, rax
test r14, r14
jne 0x1401b742c
mov r13d, 7
jmp 0x1401b74ac
mov r9, rsi
mov rdx, r13
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
jmp fcn.1401b7cb0
mov r8, rsi
mov rdx, r14
mov rcx, r12
call fcn.1401b6ee0
mov r13d, eax
jmp 0x1401b7498
Function at 0x1401dd8a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
movzx eax, byte [rdx]
mov r12, rdx
mov r15, rcx
mov edx, eax
cmp al, 0xb0
jne 0x1401dd8c5
movzx edx, byte [r12 + 2]
cmp dl, 0xb1
je 0x1401dd9e0
cmp dl, 0x8a
je 0x1401dd8f0
mov rdx, r12
mov rcx, r15
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.1401e1c30
mov rdx, qword [r12 + 0x20]
mov rdx, qword [rdx + 0x20]
mov ebx, dword [rdx]
cmp ebx, 1
je 0x1401dd8d3
mov dword [r8], 0
cmp al, 0x8a
je 0x1401dd9f0
mov eax, dword [r15 + 0x38]
lea r13d, [rax + 1]
add eax, ebx
mov dword [r15 + 0x38], eax
test ebx, ebx
jle 0x1401dd9c3
xor r14d, r14d
lea rdi, [0x140170010]
lea rbp, [rsp + 0x30]
lea rsi, [0x140158b00]
jmp 0x1401dd975
mov rcx, rbp
mov dword [rsp + 0x2c], r8d
mov qword [rsp + 0x20], rdx
call fcn.140171470
cmp word [rsp + 0x54], 0
mov rdx, qword [rsp + 0x20]
mov r8d, dword [rsp + 0x2c]
jne 0x1401dd9b2
mov rcx, r15
add r14d, 1
call fcn.1401e0460
cmp r14d, ebx
je 0x1401dd9c3
movsxd rax, r14d
lea r8d, [r13 + r14]
shl rax, 5
add rax, qword [r12 + 0x20]
cmp byte [r15 + 0x23], 0
mov rdx, qword [rax + 8]
je 0x1401dd964
mov eax, 2
mov qword [rsp + 0x38], rdi
mov word [rsp + 0x54], ax
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x58], 0
test rdx, rdx
jne 0x1401dd940
mov rcx, r15
add r14d, 1
call fcn.1401e0cd0
cmp r14d, ebx
jne 0x1401dd975
mov eax, r13d
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rdx, qword [r12 + 0x20]
mov ebx, dword [rdx]
jmp 0x1401dd8fb
mov rdx, r12
mov rcx, r15
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.1401dd470
Function at 0x140224510
Capabilities:
Reference sql statements

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rax, str.SELECT_parentnode_FROM__Q._q_parent_WHERE_nodeno_1
movsxd rdi, edx
mov qword [rsp + 0x40], rax
mov rbx, rcx
mov rbp, r8
cmp qword [rcx + rdi*8 + 0x28], 0
mov rsi, rdi
lea r12, [rdi + 4]
mov r13, r9
lea rax, str.SELECT_nodeno_FROM__Q._q_rowid_WHERE_rowid_1
mov qword [rsp + 0x48], rax
je 0x1402245b0
mov ecx, dword [rbx + 0x40]
test ecx, ecx
je 0x140224568
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov r12, qword [rbx + rdi*8 + 0x28]
mov r8, rbp
mov edx, 1
mov rcx, r12
call fcn.14019c2f0
mov rcx, r12
call fcn.1401fac20
cmp eax, 0x65
je 0x1402245d0
cmp eax, 0x64
je 0x140224600
mov rcx, r12
call fcn.1401cb7f0
mov edx, dword [rbx + 0x40]
test edx, edx
jne 0x140224556
mov dword [rbx + 0x40], eax
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rdx, qword [rsp + rdi*8 + 0x40]
mov r9, qword [rcx + 0x10]
mov r8, qword [rcx + 8]
call fcn.140217780
mov qword [rbx + r12*8 + 8], rax
jmp 0x14022454f
test esi, esi
lea rdx, str.__parent
mov r9, r13
mov r8, rbp
lea rax, str.__rowid
mov rcx, rbx
cmove rax, rdx
lea rdx, str.Mapping___lld_____lld__missing_from__s_table
mov qword [rsp + 0x20], rax
call fcn.1401be620
jmp 0x14022458f
xor edx, edx
mov rcx, r12
call fcn.140167360
mov rcx, rax
call fcn.1401619d0
mov rdi, rax
test r12, r12
je 0x140224622
mov rcx, r12
call fcn.140167300
cmp r13, rdi
je 0x14022458f
test esi, esi
lea rdx, str.__parent
mov r9, rdi
mov r8, rbp
lea rax, str.__rowid
mov qword [rsp + 0x30], r13
mov rcx, rbx
cmove rax, rdx
mov qword [rsp + 0x28], rbp
lea rdx, str.Found___lld_____lld__in__s_table__expected___lld_____lld_
mov qword [rsp + 0x20], rax
call fcn.1401be620
jmp 0x14022458f
Function at 0x14023f7e0
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.14024ab40
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.14024ab40
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]

Function at 0x14023f850
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x50
movsxd rbx, dword [0x1404392b4]
mov r12, rcx
test ebx, ebx
jle 0x14023f980
mov rax, qword [0x1404392b8]
xor ecx, ecx
add rax, 0x18
nop word [rax + rax]
mov rdx, qword [rax]
cmp rdx, r12
ja 0x14023f89c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x14023f923
add ecx, 1
add rax, 0x28
cmp ecx, ebx
jne 0x14023f880
mov rcx, r12
call fcn.1402401f0
mov rsi, rax
test rax, rax
je 0x14023f9a2
mov rax, qword [0x1404392b8]
lea rbx, [rbx + rbx*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rsi
mov dword [rax], 0
call fcn.140240320
mov ecx, dword [rsi + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x1404392b8]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14023f987
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x14023f91c
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x14023f930
add dword [0x1404392b4], 1
add rsp, 0x50
pop rbx
pop rsi
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rbx, qword [0x1404392b8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14023f91c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.14023f7e0
nop dword [rax]
xor ebx, ebx
jmp 0x14023f8a7
mov rax, qword [0x1404392b8]
mov edx, dword [rsi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.14023f7e0
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.14023f7e0
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x14023fe60
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x140439320]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140439300]
test rbx, rbx
je 0x14023feb4
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x14023feab
test r12, r12
je 0x14023feab
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x14023fe90
lea rcx, [0x140439320]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x1402401f0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1403d0d40]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140240210
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140240218
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140240210
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x140240265
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x14024025c
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140240210
add rax, 0x28
cmp rax, r9
jne 0x140240248
xor eax, eax
ret

Function at 0x140240270
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1403d0d40]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x140240290
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140240298
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x140240290
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x140240320
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1403d0d40]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x140240340
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x140240348
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret

Function at 0x140241e70
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, qword [0x1403d0dc0]
mov rax, qword [rsi]
test rax, rax
je 0x140241f00
cmp qword [rax + 0x30], 0
jne 0x140241f20
lea rbx, [0x14026b6c8]
mov qword [rax + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [rbx], eax
mov rax, qword [rsi]
test rax, rax
je 0x140241ed0
cmp qword [rax + 0x30], 0
jne 0x140241ef0
lea rdx, [0x14026b6c8]
mov qword [rax + 0x30], rdx
mov rax, rdx
cmp dword [rax], 0xffffffff
je 0x14024ae60
add rsp, 0x28
pop rbx
pop rsi
ret
call fcn.140246d70
mov r8, rax
mov rax, qword [rsi]
cmp qword [r8 + 0x30], 0
je 0x140241eb2
test rax, rax
jne 0x140241ef0
call fcn.140246d70
nop dword [rax]
mov rax, qword [rax + 0x30]
jmp 0x140241ec0
call fcn.140246d70
cmp qword [rax + 0x30], 0
mov rax, qword [rsi]
je 0x140241e90
test rax, rax
jne 0x140241f20
call fcn.140246d70
nop dword [rax]
mov rbx, qword [rax + 0x30]
jmp 0x140241e9b
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
mov rax, qword [pe_dos_header]
ud2
Function at 0x140241f30
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x98
movabs rax, 0x6c6320726f727245
movabs rdx, 0x7520676e696e6165
mov qword [rsp + 0x20], rax
movabs rax, 0x6b5f6e6970732070
mov qword [rsp + 0x28], rdx
movabs rdx, 0x20726f6620737965
mov qword [rsp + 0x30], rax
movabs rax, 0x20646165726874
mov qword [rsp + 0x38], rdx
xor edx, edx
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0
mov word [rsp + 0x88], ax
mov byte [rsp + 0x8a], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [rsp + 0x47]
mov r8d, 0xa
mov ecx, eax
call qword [sym.imp.msvcrt.dll__ultoa]
cmp byte [rsp + 0x47], 0
je 0x140242042
mov eax, 0x28
lea rcx, [rsp + 0x20]
jmp 0x14024201a
add rax, 1
cmp rax, 0x6b
je 0x140242037
cmp byte [rcx + rax], 0
movsxd rdx, eax
jne 0x140242010
cmp edx, 0x6a
je 0x140242037
lea eax, [rdx + 1]
cdqe
mov byte [rsp + rdx + 0x20], 0xa
mov byte [rsp + rax + 0x20], 0
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call sub.msvcrt.dll_abort
mov eax, 0x28
mov edx, 0x27
lea rcx, [rsp + 0x20]
jmp 0x14024202b
Function at 0x140242a50
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rsi, qword [0x1403d0dc0]
mov rax, qword [rsi]
test rax, rax
je 0x140242c40
cmp qword [rax + 0x28], 0
jne 0x140242c28
lea rcx, [0x1404393d8]
cmp dword [rcx], 1
mov qword [rax + 0x28], rcx
je 0x140242c35
call fcn.140242060
mov rax, qword [rsi]
test rax, rax
je 0x140242ad0
cmp qword [rax + 0x30], 0
jne 0x140242af0
lea rdx, [0x14026b6c8]
mov qword [rax + 0x30], rdx
mov rax, rdx
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12, rax
test rax, rax
je 0x140242b04
mov rax, r12
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call fcn.140246d70
cmp qword [rax + 0x30], 0
mov rax, qword [rsi]
je 0x140242aa0
test rax, rax
jne 0x140242af0
call fcn.140246d70
nop dword [rax]
mov rax, qword [rax + 0x30]
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12, rax
test rax, rax
jne 0x140242abe
call fcn.140241ba0
cmp qword [0x14043d050], 0
mov rbx, rax
je 0x140242abe
test rax, rax
je 0x140242abe
mov dword [rax + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor ecx, ecx
xor r9d, r9d
xor r8d, r8d
mov dword [rbx + 0x70], eax
mov edx, 1
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x38], 0xffffffffffffffff
lea rcx, [rbx + 0x68]
mov qword [rbx + 0x30], rax
call fcn.140248c10
cmp eax, 1
je 0x140242cad
mov rbp, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rbx + 0x68], 0xffffffffffffffff
mov dword [rbx + 0xb8], 0
mov qword [rbx + 0x28], 0
call rbp
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r12, rax
call rbp
mov dword [rsp + 0x30], 2
mov r8, rdi
mov rdx, r12
mov dword [rsp + 0x28], 0
mov rcx, rax
lea r9, [rbx + 0x28]
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x14024ae66
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [rbx + 0xbc], 0
mov dword [rbx + 0xc0], eax
movzx eax, byte [rbx + 0x40]
and eax, 0xffffffcf
or eax, 0x10
mov byte [rbx + 0x40], al
mov rax, qword [rsi]
test rax, rax
je 0x140242c88
cmp qword [rax + 0x30], 0
je 0x140242c70
mov rax, qword [rax + 0x30]
mov ecx, dword [rax]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x14024ae66
mov r12, rbx
mov rax, r12
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, qword [rax + 0x28]
cmp dword [rcx], 1
jne 0x140242a8c
mov rax, qword [rsi]
jmp 0x140242a99
call fcn.140246d70
cmp qword [rax + 0x28], 0
mov rax, qword [rsi]
je 0x140242a78
test rax, rax
jne 0x140242c28
call fcn.140246d70
mov rcx, qword [rax + 0x28]
cmp dword [rcx], 1
jne 0x140242a8c
jmp 0x140242a91
lea rdx, [0x14026b6c8]
mov qword [rax + 0x30], rdx
mov rax, rdx
jmp 0x140242bfe
call fcn.140246d70
mov r8, rax
mov rax, qword [rsi]
cmp qword [r8 + 0x30], 0
je 0x140242c70
test rax, rax
jne 0x140242bfa
call fcn.140246d70
jmp 0x140242bfa
call fcn.140241f30
nop word cs:[rax + rax]
nop dword [rax]
mov rax, qword [0x1403d0dc0]
mov rdx, qword [rax]
lea rax, [0x1404393e8]
mov qword [rdx + 0x10], rax
ret
Function at 0x140246bf0
Capabilities:
Print debug messages

Disassembly:
push r12
push rbx
sub rsp, 0x58
mov r12, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140246c10
add rsp, 0x58
pop rbx
pop r12
ret
lea rdx, [rsp + 0x48]
mov r9d, 0x400
mov r8d, eax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rdx
mov ecx, 0x1100
xor edx, edx
mov dword [rsp + 0x28], 0
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
jne 0x140246c58
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140246c04
int3
mov rcx, qword [rsp + 0x48]
mov rbx, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rbx
mov rcx, r12
call rbx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140246c45