joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a8a0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x448
mov rbp, rcx
mov rbx, rdx
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41a8c3
test al, 0x10
jne 0x41a929
mov rcx, rbx
call sub.msvcrt.dll_wcslen
cmp rax, 0x103
ja 0x41a96f
lea rsi, [rsp + 0x230]
mov rdx, rbx
lea rdi, [rsp + 0x20]
mov rcx, rsi
call sub.msvcrt.dll_wcscpy
lea rdx, [0x0042a44a]
mov rcx, rax
call fcn.00427cf0
mov rdx, rsi
mov rcx, rdi
call fcn.0041a800
test rax, rax
je 0x41a91a
mov rcx, rdi
call fcn.0041a7d0
test al, al
jne 0x41a940
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x41a94d
add rsp, 0x448
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rdx, rdi
mov rcx, rbp
call fcn.0041a8a0
jmp 0x41a91a
mov edx, dword [0x00434680]
lea rcx, str._r_c_r__ERROR__Cant_create_directory__s__n
mov r9, rbx
xor r8d, r8d
call sub.msvcrt.dll_wprintf
mov ecx, 1
call sub.msvcrt.dll_exit
mov edx, dword [0x00434680]
lea rcx, str._r_c_r__ERROR__get_parent_failed__n
xor r8d, r8d
call sub.msvcrt.dll_printf
mov ecx, 1
call sub.msvcrt.dll_exit
nop
nop
lea rax, [0x0042b870]
mov qword [rcx], rax
add rcx, 0x18
jmp fcn.00421a20
Function at 0x41b4f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rbx
lea r9, [0x00432680]
xor r8d, r8d
nop dword [rax + rax]
mov edx, r8d
mov ecx, 8
nop dword [rax + rax]
mov eax, edx
shr edx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor edx, eax
sub ecx, 1
jne 0x41b510
mov dword [r9 + r8*4], edx
add r8, 1
cmp r8, 0x100
jne 0x41b500
mov r11d, 0x400
xor r10d, r10d
lea rbx, [r9 + r11]
mov rdx, r9
sub rdx, r10
nop dword [rax]
mov eax, dword [rdx]
lea rcx, [r10 + rdx]
add rdx, 4
movzx r8d, al
shr eax, 8
xor eax, dword [r9 + r8*4]
cmp rdx, rbx
mov dword [rcx + r11], eax
jne 0x41b550
sub r10, 0x400
add r11, 0x400
cmp r10, 0xffffffffffffe400
jne 0x41b53f
pop rbx
ret

Function at 0x41ba80
Capabilities:
Get memory capacity

Disassembly:
push rbx
sub rsp, 0x60
mov rbx, rcx
mov dword [rsp + 0x20], 0x40
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
cmp rbx, qword [rsp + 0x30]
ja 0x41badb
lea rcx, [rbx + 8]
call sub.msvcrt.dll_malloc
test rax, rax
je 0x41bafa
mov qword [rax], rbx
add rbx, qword [0x0043aac0]
cmp rbx, qword [0x004367c0]
mov qword [0x0043aac0], rbx
jbe 0x41bad1
mov qword [0x004367c0], rbx
add rax, 8
add rsp, 0x60
pop rbx
ret
mov edx, dword [0x00434680]
lea rcx, str._r_c_r__ERROR__Not_enough_memory__n
xor r8d, r8d
call sub.msvcrt.dll_printf
mov ecx, 1
call sub.msvcrt.dll_exit
mov edx, dword [0x00434680]
lea rcx, str._r_c_r__ERROR__alloc0_failed__n
xor r8d, r8d
call sub.msvcrt.dll_printf
mov ecx, 1
call sub.msvcrt.dll_exit
nop
nop word [rax + rax]
Function at 0x41bfc0
Capabilities:
Check if file exists
Create directory
Get file attributes
Set file attributes

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
test edx, edx
mov r13, rcx
mov esi, edx
mov r12d, r8d
js 0x41c0a1
lea rdi, [rcx + 0xa0]
jmp 0x41bffe
mov esi, dword [rbx + 0x224]
test esi, esi
js 0x41c0a1
mov edx, esi
mov rcx, rdi
call fcn.0041bce0
test byte [rax + 0x220], 0x10
mov rbx, rax
je 0x41bff0
cmp byte [rax + 0x230], 0
je 0x41bff0
call fcn.0041a790
xor r9d, r9d
mov r8d, esi
mov rcx, rdi
mov rdx, rax
call fcn.0041bd20
test r12b, r12b
mov qword [rsp + 0x48], 0xffffffffffffffff
mov qword [rsp + 0x40], 0
mov rsi, rax
je 0x41c0b0
lea rbp, [rsp + 0x40]
mov edx, dword [rbx + 0x220]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor r9d, r9d
mov rdx, rsi
mov rcx, rbp
mov dword [rsp + 0x20], 0
mov r8d, 4
call fcn.00417c10
test al, al
jne 0x41c0f0
mov edx, dword [rbx + 0x228]
test edx, edx
jns 0x41c0e0
mov rcx, rbp
call fcn.00417bb0
mov esi, dword [rbx + 0x224]
test esi, esi
jns 0x41bffe
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41c0c2
test al, 0x10
jne 0x41c0d1
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x41c12a
mov edx, dword [rbx + 0x228]
lea rbp, [rsp + 0x40]
test edx, edx
js 0x41c08b
movzx r8d, r12b
mov rcx, r13
call fcn.0041bfc0
jmp 0x41c08b
mov rax, qword [rbx + 0x210]
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rcx, qword [rsp + 0x48]
imul edx, eax, 0x989680
imul rax, rax, 0x989680
mov dword [rsp + 0x38], edx
xor edx, edx
sar rax, 0x20
mov dword [rsp + 0x3c], eax
call qword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x41c081
mov edx, dword [0x00434680]
lea rcx, str._r_c_r__ERROR__Cant_create_directory__s__n
mov r9, rsi
xor r8d, r8d
call sub.msvcrt.dll_wprintf
mov ecx, 1
call sub.msvcrt.dll_exit
nop
nop
nop
Function at 0x41c150
Capabilities:
Set console window title

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xb8
movaps xmmword [rsp + 0x90], xmm6
movaps xmmword [rsp + 0xa0], xmm7
mov rbp, qword [sym.imp.WINMM.dll_timeGetTime]
mov rbx, rcx
mov r12, rdx
mov r13d, r8d
mov rsi, r9
call rbp
sub eax, dword [rbx + 0xf4]
cmp eax, 0x3e7
ja 0x41c1c0
movaps xmm6, xmmword [rsp + 0x90]
movaps xmm7, xmmword [rsp + 0xa0]
add rsp, 0xb8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
call rbp
sub eax, 1
cmp qword [r12 + 0x208], rsi
mov dword [rbx + 0xf4], eax
jge 0x41c1dd
mov qword [r12 + 0x208], rsi
pxor xmm0, xmm0
pxor xmm1, xmm1
cvtsi2sd xmm0, qword [rbx + 0x28]
movsd xmm7, qword [0x0042b938]
mov r9, qword [0x0043aac0]
lea rdi, [rsp + 0x40]
pxor xmm6, xmm6
cvtsi2sd xmm1, qword [rbx + 0xd0]
mov rcx, rdi
lea rdx, str.RZ__0.1f_____iM_
mulsd xmm0, xmm7
shr r9, 0x14
divsd xmm0, xmm1
movapd xmm2, xmm0
movq r8, xmm0
call sub.msvcrt.dll_sprintf
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov edi, dword [0x00434680]
call fcn.0041a790
lea rcx, [rbx + 0xa0]
xor r9d, r9d
mov r8d, r13d
mov rdx, rax
call fcn.0041bd20
pxor xmm0, xmm0
cvtsi2sd xmm6, rsi
mov rsi, qword [rbx + 0x28]
mov r13, rax
cvtsi2sd xmm0, qword [r12 + 0x208]
mulsd xmm6, xmm7
divsd xmm6, xmm0
call rbp
pxor xmm2, xmm2
pxor xmm0, xmm0
mov qword [rsp + 0x38], r13
cvtsi2sd xmm2, qword [rbx + 0x28]
mov ecx, eax
sub ecx, dword [rbx + 0xf0]
mov rax, rsi
cvtsi2sd xmm0, qword [rbx + 0xd0]
cqo
movapd xmm1, xmm2
idiv rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rbx + 0x68]
mulsd xmm1, xmm7
test rax, rax
divsd xmm1, xmm0
movsd qword [rsp + 0x30], xmm6
js 0x41c330
pxor xmm0, xmm0
cvtsi2sd xmm0, rax
mulsd xmm0, xmm7
movq r9, xmm1
movapd xmm3, xmm1
lea r8, str.__0.1f_____0.1f_____iK_s____0.1f____s
mov edx, 0x1000
lea rcx, [0x004347c0]
divsd xmm0, xmm2
movsd qword [rsp + 0x20], xmm0
call fcn.0041b170
mov ecx, edi
call fcn.0041b1a0
mov edx, dword [0x00434680]
xor r8d, r8d
lea rcx, str._r_c_r_s
mov r9, rax
call sub.msvcrt.dll_wprintf
jmp 0x41c191
mov rdx, rax
and eax, 1
pxor xmm0, xmm0
shr rdx, 1
or rdx, rax
cvtsi2sd xmm0, rdx
addsd xmm0, xmm0
jmp 0x41c2d2
Function at 0x41c350
Capabilities:
Read file on windows

Disassembly:
push r15
mov eax, 0x10078
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.00427c70
sub rsp, rax
lea rbx, [rcx + 0xa0]
mov rsi, rcx
mov r12d, edx
mov rcx, rbx
call fcn.0041bce0
cmp byte [0x00432660], 0
mov rbp, rax
je 0x41c4e0
mov dword [rsp + 0x48], 0xffffffff
lea rdi, [rsp + 0x50]
mov qword [rsp + 0x58], 0xffffffffffffffff
mov qword [rsp + 0x50], 0
call fcn.0041a790
mov r9d, 1
mov r8d, r12d
mov rcx, rbx
mov rdx, rax
call fcn.0041bd20
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x20], 0
mov rdx, rax
mov qword [rsp + 0x38], rdi
call fcn.00417c10
test al, al
je 0x41c4a0
lea rax, [rsp + 0x48]
xor ebx, ebx
mov r13, qword [sym.imp.KERNEL32.dll_ReadFile]
lea r14, [rsp + 0x4c]
mov qword [rsp + 0x30], rax
lea rdi, [rsp + 0x70]
jmp 0x41c445
mov r8d, edx
mov rcx, rsi
mov rdx, rdi
call fcn.00401590
mov rcx, qword [rsp + 0x30]
mov r8d, r15d
mov rdx, rdi
call fcn.00417e60
movsxd rax, r15d
mov r8d, r12d
mov rdx, rbp
add rbx, rax
mov rcx, rsi
mov r9, rbx
call fcn.0041c150
mov qword [rsp + 0x20], 0
mov r9, r14
mov r8d, 0x10000
mov rdx, rdi
mov rcx, qword [rsp + 0x58]
call r13
test eax, eax
je 0x41c4f1
mov edx, dword [rsp + 0x4c]
add qword [rsp + 0x60], rdx
test edx, edx
mov r15, rdx
jne 0x41c410
mov rax, rbx
sub rax, qword [rbp + 0x208]
add qword [rsi + 0xd0], rax
mov qword [rbp + 0x208], rbx
mov eax, dword [rsp + 0x48]
not eax
mov dword [rbp + 0x218], eax
jmp 0x41c4b5
mov rax, qword [rbp + 0x208]
sub qword [rsi + 0xd0], rax
mov byte [rbp + 0x230], 0
mov rcx, qword [rsp + 0x38]
call fcn.00417bb0
nop
add rsp, 0x10078
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov byte [0x00432660], 1
call fcn.0041b4f0
jmp 0x41c38e
mov edx, dword [0x00434680]
lea rcx, str._r_c_r__ERROR__Read_failed__n
xor r8d, r8d
call sub.msvcrt.dll_printf
mov ecx, 1
call sub.msvcrt.dll_exit
nop
nop
nop dword [rax]
nop word cs:[rax + rax]
Function at 0x41d180
Capabilities:
Set current directory

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x448
lea rbx, [rsp + 0x20]
mov r14, rdx
mov rsi, rcx
lea rdx, [0x0042ac30]
mov rcx, rbx
mov r12d, r8d
lea rdi, [rsp + 0x230]
mov r13d, r9d
call fcn.0041a800
mov rbp, qword [sym.imp.msvcrt.dll__wcslwr]
mov rcx, rax
call rbp
mov rdx, r14
mov rcx, rdi
call fcn.0041a800
mov rcx, rax
call rbp
mov rcx, rdi
call fcn.0041a7d0
test al, al
je 0x41d340
test r13b, r13b
jne 0x41d300
movzx eax, word [rsp + 0x20]
lea r13, [rsi + 0x10]
test ax, ax
je 0x41d233
cmp ax, word [rsp + 0x230]
jne 0x41d24f
lea rcx, [rsp + 0x22e]
mov eax, 2
jmp 0x41d22a
add rax, 2
cmp dx, word [rcx + rax]
jne 0x41d24f
movzx edx, word [rbx + rax]
test dx, dx
jne 0x41d220
mov rcx, rbx
call sub.msvcrt.dll_wcslen
lea rbp, [rdi + rax*2]
mov rcx, rbp
call fcn.0041a7d0
test al, al
jne 0x41d360
mov edx, 0x5c
mov rcx, rdi
call sub.msvcrt.dll_wcsrchr
mov r15d, dword [rsi + 0x24]
mov edx, dword [rsi + 0x18]
lea r14, [rax + 2]
mov rbp, r14
sub rbp, rdi
sar rbp, 1
cmp r15d, edx
jb 0x41d288
lea eax, [r15 + 1]
add edx, edx
mov rcx, r13
cmp edx, eax
cmovl edx, eax
call fcn.0041bc40
lea r8d, [rbp + rbp]
shl r15, 0xd
add r15, qword [rsi + 0x10]
mov rdx, rdi
movsxd r8, r8d
movsxd rbp, ebp
mov rcx, r15
call sub.msvcrt.dll_memcpy
xor eax, eax
mov rcx, r15
mov rdi, qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov word [r15 + rbp*2], ax
call rdi
test eax, eax
je 0x41d2d7
mov edx, dword [rsi + 0x24]
movzx r9d, r12b
mov r8, r14
mov rcx, rsi
neg edx
call fcn.0041cc90
movzx eax, al
add dword [rsi + 0x24], eax
mov rcx, rbx
call rdi
test eax, eax
je 0x41d3b3
add rsp, 0x448
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov ebp, dword [0x00434680]
mov r9, rdi
mov edx, 0x1000
lea r8, str._Scanning__s
lea rcx, [0x004347c0]
call fcn.0041b170
mov ecx, ebp
call fcn.0041b1a0
lea rcx, [0x0042ac50]
mov rdx, rax
call sub.msvcrt.dll_wprintf
jmp 0x41d1f0
lea rdx, [0x0042a772]
mov rcx, rdi
call fcn.00427cf0
jmp 0x41d1e7
mov edi, dword [rsi + 0x24]
mov eax, dword [rsi + 0x18]
cmp edi, eax
jb 0x41d37c
lea edx, [rdi + 1]
add eax, eax
mov rcx, r13
cmp eax, edx
cmovge edx, eax
call fcn.0041bc40
mov ecx, edi
mov rdx, rbx
mov rdi, rcx
shl rdi, 0xd
add rdi, qword [rsi + 0x10]
mov rcx, rdi
call sub.msvcrt.dll_wcscpy
mov edx, dword [rsi + 0x24]
movzx r9d, r12b
mov r8, rbp
mov rcx, rsi
neg edx
call 0x41cfa0
movzx eax, al
add dword [rsi + 0x24], eax
jmp 0x41d2e4
mov edx, dword [0x00434680]
lea rcx, str._r_c_r__ERROR__Directory_error__n
xor r8d, r8d
call sub.msvcrt.dll_printf
mov ecx, 1
call sub.msvcrt.dll_exit
nop
nop
nop
nop word cs:[rax + rax]
Function at 0x41d3e0
Capabilities:
Read file on windows

Disassembly:
push r15
mov eax, 0x4078
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.00427c70
sub rsp, rax
mov ebp, dword [0x00434680]
mov r9, rdx
mov rbx, rdx
mov rsi, rcx
mov qword [rsp + 0x2050], 0xffffffffffffffff
lea rcx, [0x004347c0]
mov edi, r8d
mov edx, 0x1000
mov qword [rsp + 0x2048], 0
lea r8, str._Scanning____s
call fcn.0041b170
lea r13, [rsp + 0x1040]
mov ecx, ebp
call fcn.0041b1a0
lea rcx, [0x0042ac50]
mov rdx, rax
call sub.msvcrt.dll_wprintf
xor r8d, r8d
mov rdx, rbx
mov dword [rsp + 0x20], 0
lea rcx, [r13 + 0x1008]
mov r9d, 1
call fcn.00417c10
test al, al
jne 0x41d640
mov edx, dword [rsp + 0x2060]
mov r8d, dword [rsp + 0x2064]
lea r12, [rsp + 0x3c]
lea rbx, [rsp + 0x40]
nop word [rax + rax]
movsxd rax, edx
cmp byte [rsp + rax + 0x1040], 0
jne 0x41d4ee
cmp edx, r8d
jge 0x41d590
lea ecx, [r8 - 1]
lea eax, [rdx + 1]
mov r10d, ecx
cdqe
sub r10d, edx
lea rcx, [rax + r10 + 1]
jmp 0x41d4dd
add rax, 1
cmp rcx, rax
je 0x41d584
cmp byte [r13 + rax], 0
mov edx, eax
je 0x41d4d0
mov dword [rsp + 0x2060], eax
cmp edx, r8d
jge 0x41d590
movsxd rdx, dword [rsp + 0x2060]
lea rbp, [r13 + rdx]
mov r14, rdx
mov rcx, rbp
call sub.msvcrt.dll_strlen
cmp eax, 0xfff
mov r15, rax
ja 0x41d6a0
lea r8d, [rax + 1]
mov rdx, rbp
mov rcx, rbx
call sub.msvcrt.dll_memcpy
lea eax, [r14 + r15]
cmp eax, dword [rsp + 0x2064]
mov dword [rsp + 0x2060], eax
je 0x41d620
lea rcx, [rsp + 0x2070]
mov r8d, 0x1000
mov rdx, rbx
call fcn.0041abc0
movzx r8d, dil
xor r9d, r9d
lea rcx, [rsi + 0xa0]
mov rdx, rax
call fcn.0041d180
mov edx, dword [rsp + 0x2060]
mov r8d, dword [rsp + 0x2064]
jmp 0x41d4a0
mov dword [rsp + 0x2060], edx
nop dword [rax + rax]
mov qword [rsp + 0x20], 0
mov r9, r12
mov r8d, 0x1000
mov rdx, r13
mov rcx, qword [rsp + 0x2050]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41d681
mov eax, dword [rsp + 0x3c]
add qword [rsp + 0x2058], rax
cmp eax, 0
mov rdx, rax
mov dword [rsp + 0x2064], eax
je 0x41d660
mov dword [rsp + 0x2060], 0
cdqe
mov byte [rsp + rax + 0x1040], 0
jle 0x41d611
sub edx, 1
mov rax, r13
lea rdx, [r13 + rdx + 1]
nop dword [rax]
cmp byte [rax], 0x1f
jg 0x41d608
mov byte [rax], 0
add rax, 1
cmp rdx, rax
jne 0x41d600
mov rbp, r13
xor r14d, r14d
jmp 0x41d507
mov edx, r15d
mov r8d, 0x1000
mov rcx, r13
add rdx, rbx
sub r8d, r15d
call fcn.0041a9b0
jmp 0x41d544
mov qword [rsp + 0x2060], 0
xor r8d, r8d
xor edx, edx
jmp 0x41d490
lea rcx, [r13 + 0x1008]
call fcn.00417bb0
nop
add rsp, 0x4078
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov edx, dword [0x00434680]
lea rcx, str._r_c_r__ERROR__Read_failed__n
xor r8d, r8d
call sub.msvcrt.dll_printf
mov ecx, 1
call sub.msvcrt.dll_exit
mov edx, dword [0x00434680]
lea rcx, str._r_c_r__ERROR__Line_too_long__n
xor r8d, r8d
call sub.msvcrt.dll_printf
mov ecx, 1
call sub.msvcrt.dll_exit
nop
Function at 0x41e7a0
Capabilities:
Get common file path

Disassembly:
push rsi
push rbx
sub rsp, 0x238
mov ecx, 0x208
call fcn.0041bb20
lea rbx, [rsp + 0x20]
mov ecx, 0x104
mov rsi, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, 0x104
jg 0x41e7fb
test eax, eax
je 0x41e7fb
xor r8d, r8d
mov r9, rsi
mov rcx, rbx
lea rdx, [0x0042a3c0]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x41e7fb
mov rax, rsi
add rsp, 0x238
pop rbx
pop rsi
ret
mov edx, dword [0x00434680]
lea rcx, str._r_c_r__ERROR__get_tempfile_failed__n
xor r8d, r8d
call sub.msvcrt.dll_printf
mov ecx, 1
call sub.msvcrt.dll_exit
nop
nop
nop dword [rax]
Function at 0x421d30
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x00429038], eax
je 0x421d4a
add rsp, 0x28
ret
call sub.msvcrt.dll_abort
nop

Function at 0x422160
Capabilities:
Print debug messages

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x90
test rcx, rcx
mov rbx, rcx
je 0x422183
call fcn.00426660
cmp eax, 1
je 0x42218e
mov qword [rbx], 0xffffffffffffffff
add rsp, 0x90
pop rbx
pop rsi
pop rdi
ret
lea rdi, [rsp + 0x20]
xor eax, eax
mov ecx, 0xa
lea rsi, str.Error_cleaning_up_spin_keys_for_thread
rep movsd dword [rdi], dword [rsi]
lea rdi, [rsp + 0x48]
mov ecx, 0x43
rep stosb byte [rdi], al
lea rbx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [rbx + 0x27]
mov r8d, 0xa
mov ecx, eax
call qword [sym.imp.msvcrt.dll__ultoa]
cmp byte [rsp + 0x47], 0
je 0x422217
mov eax, 0x28
jmp 0x4221ea
add rax, 1
cmp rax, 0x6b
je 0x422209
cmp byte [rbx + rax], 0
mov edx, eax
jne 0x4221e0
cmp eax, 0x6a
je 0x422209
movsxd rax, edx
mov byte [rsp + rax + 0x20], 0xa
lea eax, [rdx + 1]
cdqe
mov byte [rsp + rax + 0x20], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call sub.msvcrt.dll_abort
mov edx, 0x27
jmp 0x4221f7

Function at 0x4222b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
cmp dword [0x0043ab80], 1
je 0x4222c6
call fcn.00422220
mov ecx, dword [0x00429038]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x4222f0
mov rax, rbx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
call fcn.004220a0
cmp qword [0x0043e050], 0
mov rsi, rax
je 0x4222da
test rax, rax
je 0x4222da
mov dword [rax + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
mov dword [rsi + 0x70], eax
call qword [sym.imp.KERNEL32.dll_CreateEventA]
lea rcx, [rsi + 0x68]
mov qword [rsi + 0x38], 0xffffffffffffffff
mov qword [rsi + 0x30], rax
call fcn.00422160
mov rbx, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsi + 0xb8], 0
mov qword [rsi + 0x28], 0
call rbx
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rdi, rax
call rbx
mov dword [rsp + 0x30], 2
mov r8, rbp
mov rdx, rdi
mov dword [rsp + 0x28], 0
lea r9, [rsi + 0x28]
mov rcx, rax
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x4223d9
mov rcx, qword [rsi + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov rdx, rsi
mov ecx, dword [0x00429038]
mov dword [rsi + 0xbc], 0
mov dword [rsi + 0xc0], eax
movzx eax, byte [rsi + 0x40]
and eax, 0xffffffcf
or eax, 0x10
mov byte [rsi + 0x40], al
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x4223d9
mov rbx, rsi
jmp 0x4222da
call sub.msvcrt.dll_abort
nop
nop
Function at 0x423930
Capabilities:
Create thread
Resume thread

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov r13, rcx
mov rbp, rdx
mov rsi, r8
mov rdi, r9
call fcn.004220a0
test rax, rax
mov rbx, rax
je 0x423b41
test r13, r13
je 0x42396b
mov rax, qword [rax + 0x1d8]
mov qword [r13], rax
mov r12, qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rbx + 8], rdi
mov rdi, qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x10], rsi
mov esi, 1
mov dword [rbx + 0xbc], 0
mov dword [rbx + 0x44], 1
mov qword [rbx + 0x28], 0xffffffffffffffff
mov r14, r12
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, 1
call rdi
test rax, rax
mov qword [rbx + 0x30], rax
jne 0x4239e0
cmp esi, 1
je 0x4239d1
mov ecx, 0x14
call r14
cmp esi, 5
je 0x4239e0
add esi, 1
jmp 0x4239a2
xor ecx, ecx
call r12
jmp 0x4239cc
lea rdi, [rbx + 0x68]
mov qword [rbx + 0x38], 0xffffffffffffffff
mov rcx, rdi
call fcn.00422160
cmp qword [rbx + 0x30], 0
mov dword [rbx], 0xbab1f00d
mov dword [rbx + 0xc0], 0
mov dword [rbx + 0xb8], 0
je 0x423b22
test rbp, rbp
je 0x423b90
mov eax, dword [rbp]
mov rsi, qword [rbp + 0x10]
test al, 8
mov dword [rbx + 0x44], eax
jne 0x423b70
mov eax, dword [rbp + 0x18]
mov edx, esi
mov dword [rbx + 0xc0], eax
xor ecx, ecx
mov dword [rsp + 0x20], 4
mov r9, rbx
mov qword [rsp + 0x28], 0
lea r8, [0x00422720]
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov rsi, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
ja 0x423af2
mov eax, dword [rbx + 0xc0]
mov edx, 0xfffffff1
cmp eax, 0xfffffff2
jl 0x423aa2
cmp eax, 0xffffffff
mov edx, 0xfffffffe
jl 0x423aa2
cmp eax, 0xe
mov edx, 0xf
jg 0x423aa2
cmp eax, 2
mov edx, 2
cmovle edx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
test byte [rbx + 0x44], 4
je 0x423b55
mov rcx, rsi
mov qword [rbx + 0x28], 0
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x423b01
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbx + 0x38]
call fcn.00421a20
mov rcx, rdi
call fcn.00422160
mov qword [rbx + 0x30], 0
mov qword [rbx + 0x28], 0
test r13, r13
je 0x423b2f
mov qword [r13], 0
cmp qword [rbx + 0x1d0], 0
jne 0x423b41
mov rcx, rbx
call fcn.00421f50
mov eax, 0xb
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov qword [rbx + 0x28], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x423ad9
call fcn.004222b0
mov edx, esi
mov eax, dword [rax + 0xc0]
mov dword [rbx + 0xc0], eax
jmp 0x423a3f
xor edx, edx
jmp 0x423a3f
Function at 0x426d10
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rsi, rcx
mov ecx, dword [0x0043b1a4]
mov rdi, rdx
mov rbp, r8
test ecx, ecx
jle 0x426e28
mov rax, qword [0x0043b1a8]
xor ebx, ebx
add rax, 8
mov rdx, qword [rax]
cmp rsi, rdx
jb 0x426d5c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rsi, rdx
jb 0x426e0e
add ebx, 1
add rax, 0x18
cmp ebx, ecx
jne 0x426d40
mov rcx, rsi
call fcn.00427970
test rax, rax
mov r12, rax
je 0x426e60
movsxd rbx, ebx
lea rbx, [rbx + rbx*2]
shl rbx, 3
mov r13, rbx
add r13, qword [0x0043b1a8]
mov qword [r13 + 0x10], rax
mov dword [r13], 0
call fcn.00427ac0
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
mov qword [r13 + 8], rax
mov rax, qword [0x0043b1a8]
lea rdx, [rsp + 0x20]
mov rcx, qword [rax + rbx + 8]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x426e43
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x426e07
sub eax, 4
and eax, 0xfffffffb
je 0x426e07
add rbx, qword [0x0043b1a8]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x426e2f
add dword [0x0043b1a4], 1
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sub.msvcrt.dll_memcpy
xor ebx, ebx
jmp 0x426d67
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.00426ca0
mov rax, qword [0x0043b1a8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rbx + 8]
call fcn.00426ca0
lea rcx, str.Address__p_has_no_image_section
mov rdx, rsi
call fcn.00426ca0
nop

Function at 0x4275e0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x0043b480]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x0043b460]
test rbx, rbx
je 0x427634
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x42762b
test rsi, rsi
je 0x42762b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x427610
lea rcx, [0x0043b480]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]