joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14021c750
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rbp
xor r8d, r8d
xor eax, eax
mov rbp, rsp
push r15
push r14
mov r14d, edx
push r13
shl r14, 2
mov r13, rcx
push r12
lea r12, [rcx + r14]
push rdi
push rsi
push rbx
lea rbx, [r12 + r14]
and rsp, 0xfffffffffffffff0
sub rsp, 0x820
lea rsi, [rsp + 0x20]
lea r11, [rsp + 0x420]
mov edx, dword [r13]
mov ecx, 0x100
mov rdi, rsi
mov r9, r13
rep stosq qword [rdi], rax
mov ecx, r8d
xor edi, edi
not edx
shr edx, cl
nop dword [rax]
mov r10d, edx
mov edx, dword [r9]
mov ecx, r8d
add r9, 4
not edx
shr edx, cl
movzx ecx, dl
xor r10d, edx
add dword [rsp + rcx*4 + 0x20], 1
movzx ecx, dh
or edi, r10d
mov ecx, ecx
add dword [rsp + rcx*4 + 0x420], 1
cmp r12, r9
jne 0x14021c7b0
mov rdx, rsi
xor r9d, r9d
xor ecx, ecx
nop dword [rax]
mov r10d, dword [rdx]
mov dword [rdx], ecx
add rdx, 4
add ecx, r10d
mov r10d, dword [rdx + 0x3fc]
mov dword [rdx + 0x3fc], r9d
add r9d, r10d
cmp r11, rdx
jne 0x14021c7f0
mov r9, r13
nop dword [rax]
mov r10d, dword [r9]
mov ecx, r8d
add r9, 4
mov edx, r10d
not edx
shr edx, cl
movzx edx, dl
mov ecx, dword [rsp + rdx*4 + 0x20]
lea r15d, [rcx + 1]
mov dword [r12 + rcx*4], r10d
mov dword [rsp + rdx*4 + 0x20], r15d
cmp r12, r9
jne 0x14021c818
cmp edi, 0xff
jbe 0x14021c8a7
mov r9, r12
nop dword [rax]
mov r10d, dword [r9]
mov ecx, r8d
add r9, 4
mov edx, r10d
not edx
shr edx, cl
movzx edx, dh
mov edx, edx
add rdx, 0x100
mov ecx, dword [rsp + rdx*4 + 0x20]
lea r15d, [rcx + 1]
mov dword [r13 + rcx*4], r10d
mov dword [rsp + rdx*4 + 0x20], r15d
cmp rbx, r9
jne 0x14021c850
add r8d, 0x10
shr edi, 0x10
jne 0x14021c78e
lea rsp, [rbp - 0x38]
mov eax, 1
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov r8, r14
mov rdx, r12
mov rcx, r13
call sub.msvcrt.dll_memcpy
jmp 0x14021c891

Function at 0x14021c9e0
Capabilities:
Resume thread

Disassembly:
push r13
push r12
xor r12d, r12d
push rdi
push rsi
mov rsi, rcx
push rbx
xor ebx, ebx
sub rsp, 0x30
cmp dword [rsi + 4], ebx
jbe 0x14021ca44
mov eax, ebx
mov r13, qword [rsi + rax*8 + 8]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ResumeThread]
inc eax
jne 0x14021ca37
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 5
je 0x14021ca37
lea rdx, [rsp + 0x2c]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x14021ca37
cmp dword [rsp + 0x2c], 0x103
cmove r12d, edi
mov rcx, r13
inc ebx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14021c9f3
add rsp, 0x30
mov eax, r12d
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
Function at 0x14021cae0
Capabilities:
Enumerate threads

Disassembly:
push r14
push r13
push r12
push rbp
mov rbp, rcx
push rdi
push rsi
mov rsi, rdx
push rbx
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, eax
mov rax, qword [rbp + 0x40]
test rax, rax
je 0x14021cbaa
mov r14d, dword [rax + 0xc0]
lea rbx, [rax + 0x100]
xor r13d, r13d
shl r14, 5
mov rax, qword [rbp + 0xb0]
add r14, rbx
test rax, rax
je 0x14021cb42
mov r13, qword [rax + 0x70]
jmp 0x14021cb42
mov eax, dword [rbx + 0x10]
cmp eax, dword [rbp + 0x94]
je 0x14021cb49
add rbx, 0x20
cmp rbx, r14
jb 0x14021cb33
jmp 0x14021cb84
mov rax, qword [rbx + 8]
test rax, rax
je 0x14021cb3e
mov rax, qword [rbx + 8]
cmp rax, rdi
je 0x14021cb3e
mov rax, qword [rbx + 8]
cmp rax, r13
je 0x14021cb3e
mov rdx, qword [rbx + 8]
mov rcx, rsi
call fcn.14021c4d0
mov r12d, eax
test eax, eax
je 0x14021cb3e
mov rcx, qword [rsi]
call fcn.14021c9e0
jmp 0x14021cc5b
test r13, r13
je 0x14021cb8e
cmp r13, rdi
jne 0x14021cb96
xor r12d, r12d
jmp 0x14021cc5b
mov edx, r13d
mov rcx, rsi
call fcn.14021c4d0
mov r12d, eax
test eax, eax
je 0x14021cb8e
jmp 0x14021cb77
xor edx, edx
mov ecx, 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r13, rax
cmp rax, 0xffffffffffffffff
jne 0x14021cbd3
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
lea r14, [rsp + 0x24]
mov rcx, rax
mov dword [rsp + 0x24], 0x1c
mov rdx, r14
call sub.KERNEL32.dll_Thread32First
test eax, eax
jne 0x14021cc27
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, r13
mov r12d, ebx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsi]
call fcn.14021c9e0
jmp 0x14021cc5b
mov edx, dword [rsp + 0x2c]
cmp edi, edx
jne 0x14021cc35
mov rdx, r14
mov rcx, r13
call sub.KERNEL32.dll_Thread32Next
mov r12d, eax
test eax, eax
je 0x14021cc45
mov eax, dword [rbp + 0x94]
cmp dword [rsp + 0x30], eax
je 0x14021cc0d
jmp 0x14021cc15
mov rcx, rsi
call fcn.14021c4d0
mov ebx, eax
test eax, eax
je 0x14021cc15
jmp 0x14021cbf7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0x12
jne 0x14021cbf7
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x40
mov eax, r12d
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x14021cdf0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push rbp
xor eax, eax
mov rbp, rsp
push r14
push r13
push r12
push rdi
push rsi
push rbx
mov rbx, rcx
mov ecx, 8
mov rdi, rbx
sub rsp, 0x30
rep stosd dword [rdi], eax
mov eax, 0x57
test rdx, rdx
je 0x14021cfe4
mov rsi, r8
mov r8d, 0x7fffffff
mov r12, rdx
mov r13d, r9d
call sub.msvcrt.dll_mbstowcs
mov rdi, rax
lea rax, [rax - 1]
cmp rax, 0x7ffe
jbe 0x14021ce4b
mov eax, 0x7b
jmp 0x14021cfe4
lea r8, [rdi + 1]
lea rax, [r8 + r8]
add rax, 0xf
shr rax, 4
shl rax, 4
call fcn.140035990
sub rsp, rax
mov rdx, r12
lea r14, [rsp + 0x30]
mov rcx, r14
call sub.msvcrt.dll_mbstowcs
cmp rax, rdi
jne 0x14021ce41
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14021ced6
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rdi
cmp eax, 2
jne 0x14021cfe4
test r13w, r13w
je 0x14021cfe4
mov edx, dword [rsi]
bt edx, 0x11
jb 0x14021cfe4
bt edx, 0xe
jb 0x14021cee8
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14021cee8
call rdi
cmp eax, 0xb7
jne 0x14021cfe4
jmp 0x14021cee8
mov edx, dword [rsi]
or dh, 0x40
test al, 0x10
lea ecx, [rdx - 0x4000]
cmovne edx, ecx
mov dword [rsi], edx
mov rcx, r12
call sub.msvcrt.dll_strlen
mov edi, dword [rsi]
mov qword [rbx + 0x18], rax
bt edi, 0xe
jae 0x14021cf2c
cmp rax, 8
jbe 0x14021cf2c
lea r13, [rax - 9]
mov r8d, 9
lea rcx, str._mdbx.dat
lea rdx, [r12 + r13]
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x14021cf2c
sub edi, 0x4000
mov dword [rsi], edi
mov qword [rbx + 0x18], r13
mov esi, dword [rsi]
mov r13, qword [rbx + 0x18]
and esi, 0x4000
lea rdx, [r13 + r13]
cmp esi, 1
sbb rax, rax
and eax, 0xe
lea rcx, [rax + rdx + 6]
call sub.msvcrt.dll_malloc
mov rcx, rax
mov qword [rbx], rax
mov eax, 0xe
test rcx, rcx
je 0x14021cfe4
mov qword [rbx + 8], rcx
test esi, esi
je 0x14021cf99
lea rax, [rcx + r13 + 5]
lea r9, str._lck
mov r8, r12
mov qword [rbx + 0x10], rax
lea rdx, [0x1402b1eec]
call fcn.14021cdc0
mov rcx, qword [rbx + 0x10]
mov rdx, r12
call sub.msvcrt.dll_strcpy
jmp 0x14021cfe2
lea rax, [rcx + r13 + 0xa]
mov r8d, r13d
lea r13, [0x1402b1ef1]
mov r9, r12
mov qword [rbx + 0x10], rax
lea rax, str._mdbx.lck
mov rdx, r13
mov qword [rsp + 0x20], rax
call fcn.14021cdc0
mov rcx, qword [rbx + 0x10]
mov r8d, dword [rbx + 0x18]
mov r9, r12
lea rax, str._mdbx.dat
mov rdx, r13
mov qword [rsp + 0x20], rax
call fcn.14021cdc0
xor eax, eax
lea rsp, [rbp - 0x30]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop rbp
ret
Function at 0x14021d000
Capabilities:
Set file attributes

Disassembly:
push rbp
mov rbp, rsp
push r15
mov r15, r8
mov r8d, 0x7fffffff
push r14
push r13
push r12
push rdi
mov rdi, rdx
mov rdx, r15
push rsi
mov rsi, r9
push rbx
mov ebx, ecx
xor ecx, ecx
sub rsp, 0x88
mov r12d, dword [rbp + 0x30]
mov qword [r9], 0xffffffffffffffff
call sub.msvcrt.dll_mbstowcs
mov r13, rax
dec rax
cmp rax, 0x7ffe
jbe 0x14021d055
mov r12d, 0x7b
jmp 0x14021d1ae
lea r8, [r13 + 1]
lea rax, [r8 + r8]
add rax, 0xf
shr rax, 4
shl rax, 4
call fcn.140035990
sub rsp, rax
mov rdx, r15
lea r14, [rsp + 0x40]
mov rcx, r14
call sub.msvcrt.dll_mbstowcs
cmp rax, r13
jne 0x14021d04a
mov edx, dword [rdi + 4]
cmp r12w, 1
sbb eax, eax
and edx, 0x400000
add eax, 4
cmp edx, 1
sbb r8d, r8d
dec ebx
and r8d, 3
cmp ebx, 4
ja case.default.0x14021d0b8
lea rcx, [0x1402b1ef8]
movsxd rdx, dword [rcx + rbx*4]
add rdx, rcx
jmp rdx
mov edx, 0xc0000080
mov ebx, 0x1002000
jmp 0x14021d136
or r8d, 1
mov edx, 0x80000080
mov ebx, 0x1002000
mov eax, 3
jmp 0x14021d136
mov edx, 0x40000080
mov ebx, 0x81002000
mov eax, 3
jmp 0x14021d136
mov eax, dword [rdi + 0x88]
xor ebx, ebx
cmp dword [rdi + 0x78], eax
mov edx, 0x40000080
setae bl
mov eax, 1
xor r8d, r8d
shl ebx, 0x1d
or ebx, 0x1002000
jmp 0x14021d136
or r8d, 4
mov edx, 0x110180
mov ebx, 0x1002000
mov eax, 3
jmp 0x14021d136
mov edx, 0xc0000080
mov ebx, 0x1002102
mov eax, 4
mov rcx, r14
mov dword [rsp + 0x28], ebx
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsi], rax
mov rcx, rax
cmp rax, 0xffffffffffffffff
jne 0x14021d16a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
jmp 0x14021d1ae
lea rdx, [rbp - 0x74]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x14021d193
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsi]
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi], 0xffffffffffffffff
jmp 0x14021d1ae
mov edx, dword [rbp - 0x74]
xor r12d, r12d
xor ebx, edx
and ebx, 0x2902
je 0x14021d1ae
xor edx, ebx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rsp, [rbp - 0x38]
mov eax, r12d
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x14021d1d0
Capabilities:
Get disk information

Disassembly:
push r14
mov r14, rcx
push r13
push r12
push rsi
push rbx
mov ebx, edx
sub rsp, 0x1e0
cmp qword [0x1403ec488], 0
jne 0x14021d1fe
bt edx, 0x16
mov r12d, 0x307
jae 0x14021d47e
mov rcx, r14
mov r12d, 0x10fe
call qword [sym.imp.KERNEL32.dll_GetFileType]
dec eax
jne 0x14021d47e
mov rax, qword [0x1403ec4c0]
test rax, rax
je 0x14021d265
mov r9d, 0x74
lea r8, [rsp + 0x60]
mov edx, 0xd
mov rcx, r14
call rax
test eax, eax
je 0x14021d265
mov eax, dword [rsp + 0x70]
test al, 2
je 0x14021d24c
bt ebx, 0x11
jae 0x14021d47e
mov edx, ebx
and eax, 1
mov r12d, 0x1100
and edx, 0x400000
or edx, eax
je 0x14021d47e
mov rax, qword [0x1403ec4a0]
test rax, rax
je 0x14021d2f7
lea rdx, [rsp + 0x60]
mov rcx, r14
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], rdx
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rdx
xor edx, edx
mov dword [rsp + 0x48], 0x180
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x90310
call rax
mov ecx, eax
test eax, eax
js 0x14021d2ce
bt ebx, 0x16
mov r12d, 0x1100
jb 0x14021d2f7
jmp 0x14021d47e
cmp eax, 0xc000046d
setne dl
cmp eax, 0xc0000010
setne al
test dl, al
je 0x14021d2f7
cmp ecx, 0xc00000bb
je 0x14021d2f7
call fcn.14021c920
mov r12d, eax
jmp 0x14021d47e
mov rsi, qword [0x1403ec4b8]
xor r12d, r12d
test rsi, rsi
je 0x14021d47e
cmp qword [0x1403ec4b0], 0
je 0x14021d47e
mov ecx, 0xfffe
mov r12d, 0xe
call sub.msvcrt.dll_malloc
mov r13, rax
test rax, rax
je 0x14021d47e
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x50]
mov rdx, r13
mov rcx, r14
mov dword [rsp + 0x38], 0
mov r8d, 0x7fff
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
call rsi
test eax, eax
je 0x14021d39f
mov esi, ebx
and esi, 0x20000
jne 0x14021d383
test dword [rsp + 0x60], 0x188000
jne 0x14021d3d5
mov r9d, 2
mov r8d, 0x7fff
mov rdx, r13
mov rcx, r14
call qword [0x1403ec4b0]
test eax, eax
jne 0x14021d3ad
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
jmp 0x14021d476
mov r12, qword [sym.imp.msvcrt.dll__wcsnicmp]
mov r8d, 0xc
lea rdx, str.DeviceMup_
mov rcx, r13
call r12
test eax, eax
jne 0x14021d3e0
bt ebx, 0x16
jb 0x14021d45b
mov r12d, 0x1100
jmp 0x14021d476
xor r9d, r9d
mov r8d, 0x7fff
mov rdx, r13
mov rcx, r14
call qword [0x1403ec4b0]
test eax, eax
je 0x14021d45b
mov r14, qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov rcx, r13
call r14
cmp eax, 1
jne 0x14021d448
mov r8d, 4
lea rdx, [0x1402b1f26]
mov rcx, r13
call r12
test eax, eax
jne 0x14021d3cb
lea rcx, [r13 + 0xa]
mov r8d, 2
lea rdx, [0x1402b1f30]
call r12
test eax, eax
jne 0x14021d3cb
mov word [r13 + 0xe], 0
lea rcx, [r13 + 8]
call r14
cmp eax, 5
je 0x14021d46d
ja 0x14021d460
sub eax, 2
cmp eax, 1
ja 0x14021d3cb
xor r12d, r12d
jmp 0x14021d476
xor r12d, r12d
cmp eax, 6
je 0x14021d476
jmp 0x14021d3cb
test esi, esi
jne 0x14021d45b
jmp 0x14021d3cb
mov rcx, r13
call sub.msvcrt.dll_free
add rsp, 0x1e0
mov eax, r12d
pop rbx
pop rsi
pop r12
pop r13
pop r14
ret
Function at 0x14021d6e0
Capabilities:
Clear file content

Disassembly:
push r12
mov r12, rcx
sub rsp, 0x30
mov rax, qword [0x1403ec4a8]
test rax, rax
je 0x14021d71e
mov qword [rsp + 0x28], rdx
lea r8, [rsp + 0x28]
mov r9d, 8
mov edx, 6
call rax
mov r8d, eax
xor eax, eax
test r8d, r8d
jne 0x14021d749
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14021d749
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x14021d73a
add rsp, 0x30
pop r12
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x14021d72e
xor eax, eax
add rsp, 0x30
pop r12
ret
Function at 0x14021dc60
Capabilities:
Map section object

Disassembly:
push rbp
xorps xmm0, xmm0
mov rbp, rsp
push r14
mov r14, r9
push r13
push r12
push rdi
mov rdi, r8
push rsi
mov esi, ecx
push rbx
mov rbx, rdx
and rsp, 0xfffffffffffffff0
sub rsp, 0x60
mov qword [rdx], 0
mov rcx, qword [rdx + 8]
mov qword [rdx + 0x20], 0
mov qword [rdx + 0x28], 0
movups xmmword [rdx + 0x10], xmm0
mov edx, esi
call fcn.14021d1d0
mov r12d, eax
test eax, eax
jne 0x14021ddf7
mov r13d, esi
mov rcx, qword [rbx + 8]
and r13d, 0x20000
jne 0x14021dce0
test byte [rbp + 0x30], 1
je 0x14021dce0
mov rdx, rdi
call fcn.14021d6e0
test eax, eax
jne 0x14021ddf4
mov qword [rbx + 0x20], rdi
jmp 0x14021dcf1
lea rdx, [rbx + 0x20]
call fcn.14021c970
test eax, eax
jne 0x14021ddf4
cmp r13d, 1
mov r8, qword [rbx + 8]
lea rcx, [rbx + 0x28]
mov dword [rsp + 0x28], 0x4000000
sbb eax, eax
and esi, 0x80000
lea r9, [rsp + 0x50]
mov qword [rsp + 0x50], rdi
and eax, 2
mov qword [rsp + 0x30], r8
add eax, 2
cmp esi, 1
sbb edx, edx
mov dword [rsp + 0x20], eax
xor r8d, r8d
and edx, 0xfffffffe
add edx, 0x17
call sub.ntdll.dll_NtCreateSection
mov ecx, eax
test eax, eax
js 0x14021ddd9
test r13d, r13d
jne 0x14021dd56
cmp qword [0x1403ec488], 0
cmovne rdi, r14
jmp 0x14021dd58
xor edi, edi
cmp esi, 1
mov qword [rsp + 0x58], rdi
sbb esi, esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
and esi, 0xfffffffe
mov rcx, qword [rbx + 0x28]
mov r8, rbx
add esi, 4
mov rdx, rax
xor eax, eax
test r13d, r13d
sete al
mov dword [rsp + 0x48], esi
xor r9d, r9d
shl eax, 0xd
mov dword [rsp + 0x38], 2
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call sub.ntdll.dll_NtMapViewOfSection
mov r13d, eax
test eax, eax
jns 0x14021dde3
mov rcx, qword [rbx + 0x28]
call sub.ntdll.dll_NtClose
mov qword [rbx + 0x28], 0
mov ecx, r13d
mov qword [rbx], 0
call fcn.14021c920
mov r12d, eax
jmp 0x14021ddf7
movq xmm0, qword [rsp + 0x58]
movhps xmm0, qword [rsp + 0x50]
movups xmmword [rbx + 0x10], xmm0
jmp 0x14021ddf7
mov r12d, eax
lea rsp, [rbp - 0x30]
mov eax, r12d
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop rbp
ret

Function at 0x14021df20
Capabilities:
Read file on windows

Disassembly:
push rbx
mov rbx, r8
sub rsp, 0x60
lea rax, [rsp + 0x40]
mov dword [rsp + 0x50], r9d
lea r9, [rsp + 0x3c]
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x54], 0
mov dword [rsp + 0x3c], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14021df70
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14021df84
mov eax, 0x1e
jmp 0x14021df84
mov eax, dword [rsp + 0x3c]
mov edx, 0x26
cmp rax, rbx
mov eax, 0
cmovne eax, edx
add rsp, 0x60
pop rbx
ret
Function at 0x14021df90
Capabilities:
Query or enumerate registry value

Disassembly:
push r14
mov r14, rdx
push r13
mov r13, rcx
push r12
push rsi
mov rsi, r9
push rbx
mov rbx, r8
sub rsp, 0x50
mov rax, qword [0x1403ec480]
test rax, rax
jne 0x14021e005
mov rdx, rcx
lea r8, [rsp + 0x48]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov r12d, eax
test eax, eax
jne 0x14021e098
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x28], rsi
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x48]
mov r12d, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14021e098
mov qword [rsp + 0x30], r9
mov r9d, 0xffff
mov qword [rsp + 0x28], r8
mov r8, rdx
mov rdx, rcx
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], 0
call rax
mov r12d, eax
cmp eax, 2
jne 0x14021e098
mov qword [rsp + 0x30], rsi
mov r9d, 0x1ffff
mov r8, r14
mov rdx, r13
mov qword [rsp + 0x28], rbx
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], 0
call qword [0x1403ec480]
mov r12d, eax
cmp eax, 2
jne 0x14021e098
mov qword [rsp + 0x30], rsi
mov r9d, 0x2ffff
mov r8, r14
mov rdx, r13
mov qword [rsp + 0x28], rbx
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], 0
call qword [0x1403ec480]
mov r12d, eax
add rsp, 0x50
mov eax, r12d
pop rbx
pop rsi
pop r12
pop r13
pop r14
ret
Function at 0x14021e620
Capabilities:
Print debug messages

Disassembly:
push r13
mov r13, r9
push r12
mov r12, rdx
push rsi
push rbx
mov ebx, r8d
sub rsp, 0x38
mov rax, qword [0x1403eba20]
mov rsi, qword [rsp + 0x80]
test rax, rax
je 0x14021e653
add rsp, 0x38
pop rbx
pop rsi
pop r12
pop r13
jmp rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14021e720
mov qword [rsp + 0x20], 0
test r12, r12
je 0x14021e6a7
test ebx, ebx
jle 0x14021e68c
lea rcx, [rsp + 0x20]
mov r9d, ebx
mov r8, r12
lea rdx, str._s:_d
call fcn.14021e5f0
jmp 0x14021e6bf
test r12, r12
je 0x14021e6a7
lea rcx, [rsp + 0x20]
mov r8, r12
lea rdx, [0x1402b1f6a]
call fcn.14021e5f0
jmp 0x14021e6bf
test ebx, ebx
jle 0x14021e6de
lea rcx, [rsp + 0x20]
mov r8d, ebx
lea rdx, str._d:
call fcn.14021e5f0
test eax, eax
jle 0x14021e6de
mov r12, qword [rsp + 0x20]
test r12, r12
je 0x14021e6de
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, r12
call sub.msvcrt.dll_free
lea rcx, [rsp + 0x28]
mov r8, rsi
mov rdx, r13
mov qword [rsp + 0x28], 0
call fcn.14021c310
test eax, eax
jle 0x14021e720
mov r12, qword [rsp + 0x28]
test r12, r12
je 0x14021e720
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add rsp, 0x38
mov rcx, r12
pop rbx
pop rsi
pop r12
pop r13
jmp sub.msvcrt.dll_free
add rsp, 0x38
pop rbx
pop rsi
pop r12
pop r13
ret

Function at 0x14021f700
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x48
cmp qword [0x1403eba20], 0
je 0x14021f723
mov qword [rsp + 0x20], rcx
lea r9, str.assert:__s_n
xor ecx, ecx
call fcn.14021e730
jmp 0x14021f78a
mov qword [rsp + 0x38], 0
test rdx, rdx
jne 0x14021f738
lea rdx, [0x1402b2736]
mov dword [rsp + 0x20], r8d
lea r10, [rsp + 0x38]
mov r9, rdx
mov r8, rcx
lea rdx, str._r_nMDBX_ASSERTION:__s___s:_u
mov rcx, r10
call fcn.14021e5f0
test eax, eax
jle 0x14021f763
cmp qword [rsp + 0x38], 0
jne 0x14021f76f
lea rax, str._troubles_with_assertion_message_preparation_
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14021f78a
call qword [sym.imp.KERNEL32.dll_DebugBreak]
or ecx, 0xffffffff
add rsp, 0x48
jmp qword [sym.imp.KERNEL32.dll_FatalExit]

Function at 0x14021f7a0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsFree]
test eax, eax
jne 0x14021f7cb
mov r8d, 0x124e
lea rdx, str.thread_key_delete
lea rcx, str.TlsFree_key_
add rsp, 0x28
jmp fcn.14021f700
add rsp, 0x28
ret

Function at 0x14021fa00
Capabilities:
Print debug messages

Disassembly:
mov r8d, 0x125f
lea rdx, str.thread_rthc_set
lea rcx, str.TlsSetValue_key___void__value_
jmp fcn.14021f700
Function at 0x1402206d0
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rax, rcx
mov rbp, rsp
push r13
push r12
push rdi
push rsi
mov esi, r9d
push rbx
mov ebx, r8d
and rsp, 0xfffffffffffffff0
sub rsp, 0x430
mov r12, qword [rcx + 0x40]
mov rax, qword [rax + 0x30]
movzx ecx, byte [r12 + 0x80]
cmp qword [rdx], rax
jb 0x14022074c
mov r8d, r9d
mov al, 0xff
mov rdi, rdx
shl r8, cl
mov rcx, r8
rep stosb byte [rdi], al
mov dword [rdx + 0x10], ebx
test byte [r12 + 6], 8
jne 0x1402207f8
movzx ecx, byte [r12 + 0x80]
mov r10, qword [r12 + 0x10]
mov r9d, ebx
lea rsp, [rbp - 0x28]
pop rbx
pop rsi
shl r9, cl
pop rdi
mov rcx, r10
pop r12
pop r13
pop rbp
jmp fcn.14021c3a0
mov eax, dword [r12 + 0x78]
shl rbx, cl
mov r8d, 1
lea r13, [rsp + 0x30]
mov edi, 0x40
mov qword [rsp + 0x38], rax
add rax, qword [r12 + 0xa8]
mov qword [rsp + 0x30], rax
dec esi
mov eax, r8d
je 0x1402207d2
movaps xmm0, xmmword [rsp + 0x30]
shl rax, 4
inc r8d
movaps xmmword [rsp + rax + 0x30], xmm0
cmp r8d, 0x40
jne 0x140220776
mov rax, rdi
mov r10, qword [r12 + 0x10]
mov r9, rbx
mov rdx, r13
movzx ecx, byte [r12 + 0x80]
shl rax, cl
mov rcx, r10
mov qword [rsp + 0x20], rax
call fcn.14013dee0
mov rax, rdi
xor r8d, r8d
movzx ecx, byte [r12 + 0x80]
shl rax, cl
add rbx, rax
jmp 0x140220776
mov r10, qword [r12 + 0x10]
lea rdx, [rsp + 0x30]
mov r9, rbx
movzx ecx, byte [r12 + 0x80]
shl rax, cl
mov rcx, r10
mov qword [rsp + 0x20], rax
call fcn.14013dee0
lea rsp, [rbp - 0x28]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop rbp
ret
Function at 0x140221c20
Capabilities:
Allocate thread local storage

Disassembly:
push r15
push r14
mov r14, rcx
push r13
push r12
mov r12, rdx
push rbp
mov rbp, r8
push rdi
push rsi
push rbx
sub rsp, 0x38
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [r14], eax
inc eax
je 0x140221c70
lea r13, [0x1403ec440]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x1403ec3ec]
mov r10d, dword [0x1403ec3e8]
mov r9d, dword [r14]
mov r15, rbx
cmp ebx, r10d
jne 0x140221cd9
jmp 0x140221c80
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140221d20
jmp 0x140221c46
mov rsi, qword [0x1403ec3e0]
xor ecx, ecx
imul rdx, rbx, 0x30
mov dword [rsp + 0x2c], r9d
lea rdi, [0x1403ec260]
mov dword [rsp + 0x28], r10d
cmp rsi, rdi
cmovne rcx, rsi
call sub.msvcrt.dll_realloc
test rax, rax
je 0x140221d0a
cmp rsi, rdi
mov r10d, dword [rsp + 0x28]
mov r9d, dword [rsp + 0x2c]
jne 0x140221cc8
mov ecx, 0x60
mov rdi, rax
rep movsd dword [rdi], dword [rsi]
add r10d, r10d
mov qword [0x1403ec3e0], rax
mov dword [0x1403ec3e8], r10d
imul rax, rbx, 0x18
inc r15d
add rax, qword [0x1403ec3e0]
mov rcx, r13
mov byte [rax + 0x14], 1
mov dword [rax + 0x10], r9d
mov qword [rax], r12
mov qword [rax + 8], rbp
mov dword [0x1403ec3ec], r15d
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
jmp 0x140221d20
mov ecx, dword [r14]
call fcn.14021f7a0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 0xe
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140222ee0
Capabilities:
Print debug messages

Disassembly:
push r12
mov r10, rcx
lea r12, str._troubles_with_panic_message_preparation_
push rbx
sub rsp, 0x38
mov qword [rsp + 0x58], rdx
lea rcx, [rsp + 0x28]
mov rdx, r10
mov qword [rsp + 0x60], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x28], 0
call fcn.14021c310
test eax, eax
jle 0x140222f35
mov r12, qword [rsp + 0x28]
test r12, r12
jne 0x140222f35
lea r12, str._troubles_with_panic_message_preparation_
lea rcx, str._r_nMDBX_PANIC:
mov rbx, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rbx
mov rcx, r12
call rbx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140222f5a
call qword [sym.imp.KERNEL32.dll_DebugBreak]
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_FatalExit]