joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140057f50
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
mov ecx, dword [0x14009a090]
test ecx, ecx
je 0x140058069
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x140057f7f
cmp qword [rax + 8], 0
jne 0x140058063
mov ecx, dword [0x14009a090]
test ecx, ecx
je 0x14005808b
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x1400580a8
test rax, rax
jne 0x140058009
mov qword [rsp + 0x28], 0
lea rax, sym.std::sys::thread_local::os_local::destroy_value::h22e5c3fb0297a310
mov qword [rsp + 0x20], rax
mov rax, qword [0x14129ac48]
movzx eax, byte [rax]
mov ecx, 0x18
mov edx, 8
call sym.__rust_alloc
test rax, rax
je 0x1400580ca
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rax], xmm0
mov ecx, dword [0x14009a090]
test ecx, ecx
je 0x1400580b1
dec ecx
mov rdx, rax
mov rdi, rax
call fcn.140097654
mov rax, rdi
test rsi, rsi
je 0x140058023
mov rcx, qword [rsi]
mov qword [rsi], 0
test rcx, rcx
je 0x140058025
mov rcx, qword [rsi + 8]
jmp 0x140058025
xor ecx, ecx
mov r8, qword [rax + 8]
mov rdx, qword [rax + 0x10]
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x28], rdx
mov qword [rax + 8], 1
mov qword [rax + 0x10], rcx
test r8, r8
je 0x140058063
test rdx, rdx
je 0x140058063
lock dec qword [rdx]
jne 0x140058063
lea rcx, [rsp + 0x28]
mov rsi, rax
call sym.alloc::sync::Arc_T_A_::drop_slow::hc72eedd0a1b3284b
mov rax, rsi
add rax, 0x10
jmp 0x1400580aa
lea rcx, sym.std::sys::thread_local::os_local::destroy_value::h22e5c3fb0297a310
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h07a33ae87c46ead8
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x140057f74
jmp 0x140057f7f
lea rcx, sym.std::sys::thread_local::os_local::destroy_value::h22e5c3fb0297a310
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h07a33ae87c46ead8
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x140057f9e
xor eax, eax
add rsp, 0x38
pop rdi
pop rsi
ret
lea rcx, sym.std::sys::thread_local::os_local::destroy_value::h22e5c3fb0297a310
mov rdi, rax
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h07a33ae87c46ead8
mov ecx, eax
mov rax, rdi
jmp 0x140057ffb
mov ecx, 8
mov edx, 0x18
call sym.alloc::alloc::handle_alloc_error::ha700c182da133e1c
ud2
Function at 0x140058100
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov ecx, dword [0x14009a0b0]
test ecx, ecx
je 0x14005812f
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x140058148
cmp byte [rax + 8], 0
je 0x140058148
add rax, 9
jmp 0x1400581fb
lea rcx, sym.std::sys::thread_local::os_local::destroy_value::he2cadb065b083091
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h07a33ae87c46ead8
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x140058120
mov ecx, dword [0x14009a0b0]
test ecx, ecx
je 0x1400581dc
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x1400581f9
test rax, rax
jne 0x1400581b6
mov rax, qword [0x14129ac48]
movzx eax, byte [rax]
mov ecx, 0x10
mov edx, 8
call sym.__rust_alloc
test rax, rax
je 0x140058218
lea rcx, sym.std::sys::thread_local::os_local::destroy_value::he2cadb065b083091
mov qword [rax], rcx
mov byte [rax + 8], 0
mov ecx, dword [0x14009a0b0]
test ecx, ecx
je 0x140058202
dec ecx
mov rdx, rax
mov rdi, rax
call fcn.140097654
mov rax, rdi
xor ecx, ecx
test rsi, rsi
je 0x1400581cc
cmp byte [rsi], 0
mov byte [rsi], 0
movzx edx, byte [rsi + 1]
cmove edx, ecx
mov ecx, edx
lea rdx, [rax + 9]
mov byte [rax + 8], 1
mov byte [rax + 9], cl
mov rax, rdx
jmp 0x1400581fb
lea rcx, sym.std::sys::thread_local::os_local::destroy_value::he2cadb065b083091
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h07a33ae87c46ead8
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x140058167
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, sym.std::sys::thread_local::os_local::destroy_value::he2cadb065b083091
mov rdi, rax
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h07a33ae87c46ead8
mov ecx, eax
mov rax, rdi
jmp 0x1400581a8
mov ecx, 8
mov edx, 0x10
call sym.alloc::alloc::handle_alloc_error::ha700c182da133e1c
int3
Function at 0x140058230
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov ecx, dword [0x14009a0d0]
test ecx, ecx
je 0x14005825f
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x140058278
cmp byte [rax + 8], 0
je 0x140058278
add rax, 9
jmp 0x14005832b
lea rcx, sym.std::sys::thread_local::os_local::destroy_value::he2cadb065b083091
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h07a33ae87c46ead8
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x140058250
mov ecx, dword [0x14009a0d0]
test ecx, ecx
je 0x14005830c
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x140058329
test rax, rax
jne 0x1400582e6
mov rax, qword [0x14129ac48]
movzx eax, byte [rax]
mov ecx, 0x10
mov edx, 8
call sym.__rust_alloc
test rax, rax
je 0x140058348
lea rcx, sym.std::sys::thread_local::os_local::destroy_value::he2cadb065b083091
mov qword [rax], rcx
mov byte [rax + 8], 0
mov ecx, dword [0x14009a0d0]
test ecx, ecx
je 0x140058332
dec ecx
mov rdx, rax
mov rdi, rax
call fcn.140097654
mov rax, rdi
xor ecx, ecx
test rsi, rsi
je 0x1400582fc
cmp byte [rsi], 0
mov byte [rsi], 0
movzx edx, byte [rsi + 1]
cmove edx, ecx
mov ecx, edx
lea rdx, [rax + 9]
mov byte [rax + 8], 1
mov byte [rax + 9], cl
mov rax, rdx
jmp 0x14005832b
lea rcx, sym.std::sys::thread_local::os_local::destroy_value::he2cadb065b083091
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h07a33ae87c46ead8
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x140058297
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, sym.std::sys::thread_local::os_local::destroy_value::he2cadb065b083091
mov rdi, rax
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h07a33ae87c46ead8
mov ecx, eax
mov rax, rdi
jmp 0x1400582d8
mov ecx, 8
mov edx, 0x10
call sym.alloc::alloc::handle_alloc_error::ha700c182da133e1c
int3
Function at 0x140058360
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
mov ecx, dword [0x14009a0f0]
test ecx, ecx
je 0x140058473
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x14005838f
cmp qword [rax + 8], 0
jne 0x14005846d
mov ecx, dword [0x14009a0f0]
test ecx, ecx
je 0x1400584a5
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x1400584c2
test rax, rax
jne 0x140058419
mov qword [rsp + 0x28], 0
lea rax, sym.std::sys::thread_local::os_local::destroy_value::h8362f5b0febb6e10
mov qword [rsp + 0x20], rax
mov rax, qword [0x14129ac48]
movzx eax, byte [rax]
mov ecx, 0x18
mov edx, 8
call sym.__rust_alloc
test rax, rax
je 0x1400584e4
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rax], xmm0
mov ecx, dword [0x14009a0f0]
test ecx, ecx
je 0x1400584cb
dec ecx
mov rdx, rax
mov rdi, rax
call fcn.140097654
mov rax, rdi
test rsi, rsi
je 0x140058495
mov rcx, qword [rsi + 8]
cmp qword [rsi], 0
mov qword [rsi], 0
je 0x140058495
mov r8, qword [rax + 8]
mov rdx, qword [rax + 0x10]
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x28], rdx
mov qword [rax + 8], 1
mov qword [rax + 0x10], rcx
test r8, r8
je 0x14005846d
test rdx, rdx
je 0x14005846d
lock dec qword [rdx]
jne 0x14005846d
lea rcx, [rsp + 0x28]
mov rsi, rax
call sym.alloc::sync::Arc_T_A_::drop_slow::h7d297c64500a3644
mov rax, rsi
add rax, 0x10
jmp 0x1400584c4
lea rcx, sym.std::sys::thread_local::os_local::destroy_value::h8362f5b0febb6e10
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h07a33ae87c46ead8
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x140058384
jmp 0x14005838f
mov rsi, rax
call sym.std::sync::mpmc::context::Context::new::h52887c5962e8c9c3
mov rcx, rax
mov rax, rsi
jmp 0x14005842f
lea rcx, sym.std::sys::thread_local::os_local::destroy_value::h8362f5b0febb6e10
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h07a33ae87c46ead8
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x1400583ae
xor eax, eax
add rsp, 0x38
pop rdi
pop rsi
ret
lea rcx, sym.std::sys::thread_local::os_local::destroy_value::h8362f5b0febb6e10
mov rdi, rax
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h07a33ae87c46ead8
mov ecx, eax
mov rax, rdi
jmp 0x14005840b
mov ecx, 8
mov edx, 0x18
call sym.alloc::alloc::handle_alloc_error::ha700c182da133e1c
ud2
Function at 0x140058510
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
mov ecx, dword [0x14009a110]
test ecx, ecx
je 0x140058629
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x14005853f
cmp qword [rax + 8], 0
jne 0x140058623
mov ecx, dword [0x14009a110]
test ecx, ecx
je 0x14005864b
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x140058668
test rax, rax
jne 0x1400585c9
mov qword [rsp + 0x28], 0
lea rax, sym.std::sys::thread_local::os_local::destroy_value::he5e5111988d85b57
mov qword [rsp + 0x20], rax
mov rax, qword [0x14129ac48]
movzx eax, byte [rax]
mov ecx, 0x18
mov edx, 8
call sym.__rust_alloc
test rax, rax
je 0x14005868a
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rax], xmm0
mov ecx, dword [0x14009a110]
test ecx, ecx
je 0x140058671
dec ecx
mov rdx, rax
mov rdi, rax
call fcn.140097654
mov rax, rdi
test rsi, rsi
je 0x1400585e3
mov rcx, qword [rsi]
mov qword [rsi], 0
test rcx, rcx
je 0x1400585e5
mov rcx, qword [rsi + 8]
jmp 0x1400585e5
xor ecx, ecx
mov r8, qword [rax + 8]
mov rdx, qword [rax + 0x10]
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x28], rdx
mov qword [rax + 8], 1
mov qword [rax + 0x10], rcx
test r8, r8
je 0x140058623
test rdx, rdx
je 0x140058623
lock dec qword [rdx]
jne 0x140058623
lea rcx, [rsp + 0x28]
mov rsi, rax
call sym.alloc::sync::Arc_T_A_::drop_slow::h5b9ed3ea51fafdab
mov rax, rsi
add rax, 0x10
jmp 0x14005866a
lea rcx, sym.std::sys::thread_local::os_local::destroy_value::he5e5111988d85b57
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h07a33ae87c46ead8
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x140058534
jmp 0x14005853f
lea rcx, sym.std::sys::thread_local::os_local::destroy_value::he5e5111988d85b57
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h07a33ae87c46ead8
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x14005855e
xor eax, eax
add rsp, 0x38
pop rdi
pop rsi
ret
lea rcx, sym.std::sys::thread_local::os_local::destroy_value::he5e5111988d85b57
mov rdi, rax
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h07a33ae87c46ead8
mov ecx, eax
mov rax, rdi
jmp 0x1400585bb
mov ecx, 8
mov edx, 0x18
call sym.alloc::alloc::handle_alloc_error::ha700c182da133e1c
ud2
Function at 0x1400586c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
mov ecx, dword [0x14009a130]
test ecx, ecx
je 0x1400587b2
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x1400586ef
cmp qword [rax + 8], 0
jne 0x1400587ac
mov ecx, dword [0x14009a130]
test ecx, ecx
je 0x1400587d4
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x1400587f1
test rax, rax
jne 0x140058765
mov rax, qword [0x14129ac48]
movzx eax, byte [rax]
mov ecx, 0x20
mov edx, 8
call sym.__rust_alloc
test rax, rax
je 0x140058813
lea rcx, sym.std::sys::thread_local::os_local::destroy_value::h7e09b80de39a6d21
mov qword [rax], rcx
mov qword [rax + 8], 0
mov ecx, dword [0x14009a130]
test ecx, ecx
je 0x1400587fa
dec ecx
mov rdx, rax
mov rdi, rax
call fcn.140097654
mov rax, rdi
test rsi, rsi
je 0x14005877e
mov rcx, qword [rsi]
movups xmm0, xmmword [rsi + 8]
mov qword [rsi], 0
cmp rcx, 1
je 0x1400587a0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
mov edx, 0x10
mov rsi, rax
call sub.bcryptprimitives.dll_ProcessPrng
mov rax, rsi
movaps xmm0, xmmword [rsp + 0x20]
mov qword [rax + 8], 1
movups xmmword [rax + 0x10], xmm0
add rax, 0x10
jmp 0x1400587f3
lea rcx, sym.std::sys::thread_local::os_local::destroy_value::h7e09b80de39a6d21
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h07a33ae87c46ead8
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x1400586e4
jmp 0x1400586ef
lea rcx, sym.std::sys::thread_local::os_local::destroy_value::h7e09b80de39a6d21
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h07a33ae87c46ead8
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x14005870e
xor eax, eax
add rsp, 0x38
pop rdi
pop rsi
ret
lea rcx, sym.std::sys::thread_local::os_local::destroy_value::h7e09b80de39a6d21
mov rdi, rax
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h07a33ae87c46ead8
mov ecx, eax
mov rax, rdi
jmp 0x140058757
mov ecx, 8
mov edx, 0x20
call sym.alloc::alloc::handle_alloc_error::ha700c182da133e1c
int3
Function at 0x14008ca40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x14008caba
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x14008cab0
cmp r11, r10
ja 0x14008cb45
cmp r10, rdx
ja 0x14008cb57
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x14008cab2
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x14008ca90
jmp 0x14008cb27
ja 0x14008caba
mov r11, r10
cmp rax, r8
jne 0x14008ca62
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x14008cb2b
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x14008cb00
mov r8, r10
sub ecx, r9d
jns 0x14008cb1e
jmp 0x14008cb2d
cmp r10, rdx
je 0x14008cb39
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x14008cb2d
xor al, 1
cmp r8, rdx
jne 0x14008cae0
jmp 0x14008cb2d
xor eax, eax
jmp 0x14008cb2d
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x14128fcb0]
call sym.core::option::unwrap_failed::hc0851016c6838662
lea r8, [0x14128fcc8]
mov rcx, r11
mov rdx, r10
call sym.core::slice::index::slice_index_order_fail::h62af619b02b01d7a
lea r8, [0x14128fcc8]
mov rcx, r10
call sym.core::slice::index::slice_end_index_len_fail::h89faa5dda92f1452
int3
Function at 0x1400915d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
sub rsp, 0xb0
movzx eax, byte [rcx]
mov ecx, dword [rdx + 0x34]
test cl, 0x10
jne 0x14009162a
test cl, 0x20
jne 0x140091674
mov r8d, eax
sar r8b, 7
mov ecx, eax
xor cl, r8b
sub cl, r8b
cmp cl, 0x64
jb 0x1400916f5
add cl, cl
add cl, 0x38
movzx ecx, cl
lea r8, [0x14128f136]
movzx ecx, word [rcx + r8]
mov word [rsp + 0x55], cx
mov r8d, 0x24
mov cl, 1
jmp 0x140091700
lea r9, [rsp + 0xb0]
xor r8d, r8d
mov ecx, eax
nop word [rax + rax]
mov r10d, eax
and r10b, 0xf
shr cl, 4
lea r11d, [r10 + 0x30]
lea esi, [r10 + 0x57]
cmp r10b, 0xa
movzx r10d, r11b
movzx r11d, sil
cmovb r11d, r10d
mov byte [r9 - 1], r11b
dec r9
inc r8
cmp al, 0x10
mov eax, ecx
jae 0x140091640
jmp 0x1400916c2
lea r9, [rsp + 0xb0]
xor r8d, r8d
mov ecx, eax
nop word cs:[rax + rax]
mov r10d, eax
and r10b, 0xf
shr cl, 4
lea r11d, [r10 + 0x30]
lea esi, [r10 + 0x37]
cmp r10b, 0xa
movzx r10d, r11b
movzx r11d, sil
cmovb r11d, r10d
mov byte [r9 - 1], r11b
dec r9
inc r8
cmp al, 0x10
mov eax, ecx
jae 0x140091690
mov ecx, pe_nt_image_headers64
sub rcx, r8
cmp rcx, 0x81
jae 0x140091762
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], r9
lea r8, [0x14128f132]
mov r9d, 2
mov rcx, rdx
mov dl, 1
jmp 0x140091753
mov r8d, 0x26
cmp cl, 0xa
jae 0x14009170a
or cl, 0x30
mov byte [rsp + r8 + 0x30], cl
jmp 0x140091724
movzx ecx, cl
lea r8, [0x14128f136]
movzx ecx, word [r8 + rcx*2]
mov word [rsp + 0x55], cx
mov r8d, 0x25
lea rcx, [rsp + r8]
add rcx, 0x30
mov r9d, 0x27
sub r9, r8
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x20], rcx
not al
shr al, 7
lea r8, [0x14128c598]
mov rcx, rdx
mov edx, eax
xor r9d, r9d
call sym.core::fmt::Formatter::pad_integral::h97b2c26708adf1f6
nop
add rsp, 0xb0
pop rsi
ret
lea r8, [0x14128f118]
mov edx, pe_nt_image_headers64
call sym.core::slice::index::slice_start_index_len_fail::hbdd30c80ba9cb1bd
int3
Function at 0x140098400
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, [0x14129a9c0]
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop dword [rax]

Function at 0x140098470
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x1412a81d4]
test esi, esi
mov rdi, rcx
mov rbp, rdx
mov rbx, r8
jle 0x140098600
mov rax, qword [0x1412a81d8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rdi, rdx
jb 0x1400984bc
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rdi, rdx
jb 0x140098545
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x1400984a0
mov rcx, rdi
call sym.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x140098652
mov rax, qword [0x1412a81d8]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call sym._GetPEImageBase
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x1412a81d8]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140098635
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x14009853e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x1400985b0
add dword [0x1412a81d4], 1
cmp ebx, 8
jae 0x140098571
test bl, 4
jne 0x140098610
test ebx, ebx
je 0x140098566
movzx eax, byte [rbp]
test bl, 2
mov byte [rdi], al
jne 0x140098624
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, ebx
sub ebx, 1
mov rdx, qword [rbp + rax - 8]
cmp ebx, 8
mov qword [rdi + rax - 8], rdx
jb 0x140098566
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, ebx
mov qword [rdi + rdx], rcx
jb 0x14009858a
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp eax, 2
mov r8d, 4
mov eax, 0x40
mov rcx, qword [rsp + 0x20]
cmovne r8d, eax
mov rdx, qword [rsp + 0x38]
add rsi, qword [0x1412a81d8]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14009853e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x14129aa38]
mov edx, eax
call sym.__report_error
xor esi, esi
jmp 0x1400984c7
mov eax, dword [rbp]
mov ebx, ebx
mov dword [rdi], eax
mov eax, dword [rbp + rbx - 4]
mov dword [rdi + rbx - 4], eax
jmp 0x140098566
mov ebx, ebx
movzx eax, word [rbp + rbx - 2]
mov word [rdi + rbx - 2], ax
jmp 0x140098566
mov rax, qword [0x1412a81d8]
lea rcx, [0x14129aa00]
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call sym.__report_error
lea rcx, [0x14129a9e0]
mov rdx, rdi
call sym.__report_error
nop
nop dword [rax]
nop word cs:[rax + rax]
Function at 0x140098c20
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x1412a8240]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1412a8220]
test rbx, rbx
je 0x140098c74
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x140098c6b
test rsi, rsi
je 0x140098c6b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140098c50
lea rcx, [0x1412a8240]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140098ec0
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
jne 0x140098ed0
jmp sym._ValidateImageBase.part.0
xor eax, eax
ret

Function at 0x140098ee0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x140098f21
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x140098f18
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x140098f23
add rax, 0x28
cmp rax, r9
jne 0x140098f04
xor eax, eax
ret

Function at 0x140098fd0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x14129ab80]
xor edx, edx
cmp word [r9], 0x5a4d
mov r8, rcx
jne 0x14009903f
mov rcx, r9
call sym._ValidateImageBase.part.0
test eax, eax
je 0x14009903f
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add r9, rax
movzx eax, word [r9 + 0x14]
lea rdx, [r9 + rax + 0x18]
movzx eax, word [r9 + 6]
test eax, eax
je 0x14009903d
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x140099034
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x14009903f
add rdx, 0x28
cmp rdx, r9
jne 0x140099020
xor edx, edx
mov rax, rdx
add rsp, 0x28
ret

Function at 0x140099140
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x14129ab80]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x1400991af
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x1400991af
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x1400991ad
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x1400991a4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400991b4
add rax, 0x28
cmp rax, r9
jne 0x140099190
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret
Function at 0x1400991d0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x14129ab80]
xor r9d, r9d
cmp word [r11], 0x5a4d
mov r8d, ecx
jne 0x140099243
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x140099243
movsxd rcx, dword [r11 + 0x3c]
add rcx, r11
mov eax, dword [rcx + 0x90]
test eax, eax
je 0x140099243
movzx edx, word [rcx + 0x14]
lea rdx, [rcx + rdx + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x140099243
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r10, [rdx + rcx*8 + 0x28]
mov r9d, dword [rdx + 0xc]
cmp rax, r9
mov rcx, r9
jb 0x140099237
add ecx, dword [rdx + 8]
cmp rax, rcx
jb 0x140099250
add rdx, 0x28
cmp rdx, r10
jne 0x140099223
xor r9d, r9d
mov rax, r9
add rsp, 0x28
ret
add rax, r11
jne 0x140099268
jmp 0x140099240
sub r8d, 1
add rax, 0x14
mov ecx, dword [rax + 4]
test ecx, ecx
jne 0x140099276
mov edx, dword [rax + 0xc]
test edx, edx
je 0x140099240
test r8d, r8d
jg 0x140099260
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
add rsp, 0x28
ret
Function at 0x14047beb8
Capabilities:
Encode data using xor

Disassembly:
xor dl, r11b
neg dl
mov qword [rsp], 0x7b54c0c
add dl, 0xba
not word [rsp + 4]
xor dl, 0xf
push 0x49396e94
neg dl
call fcn.14046baa6