joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e9f00
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x1400ea161
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
test rax, rax
je 0x1400ea145
mov qword [rsp + 0xb8], rax
mov rbx, qword [rax + 8]
mov rdx, qword [rax]
mov rcx, qword [rax + 0x10]
test rbx, rbx
jne 0x1400e9f4d
xor ebx, ebx
xor ecx, ecx
jmp 0x1400e9f60
mov rax, rdx
call fcn.1400db460
mov rcx, rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x48], rbx
cmp qword [rax + 0x28], 0
je 0x1400ea078
mov rcx, qword [rax + 0x18]
mov rax, rcx
nop
call fcn.14006d040
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0xb8]
mov r8, qword [rcx + 0x20]
mov r9, qword [rcx + 0x28]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x140239710]
mov esi, 1
lea rax, [rsp + 0x68]
mov rbx, qword [rsp + 0x88]
call fcn.14004dfa0
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.140003940
xorps xmm15, xmm15
mov r14, qword [0x140352338]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x1400ea03b
xor eax, eax
lea rbx, [0x140239880]
mov ecx, 1
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x60]
lea r8, [0x1401e956e]
mov r9d, 2
mov r10, qword [rsp + 0x98]
mov r11, qword [rsp + 0x58]
call fcn.14004e080
jmp 0x1400ea068
xor eax, eax
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x60]
lea rdi, [0x140239798]
mov esi, 1
mov r8, qword [rsp + 0x98]
mov r9, qword [rsp + 0x58]
call fcn.14004dfa0
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov rax, qword [rax + 0x18]
nop dword [rax]
call fcn.14006d040
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsp + 0x88]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 0x3a
call fcn.140003940
xorps xmm15, xmm15
mov r14, qword [0x140352338]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x1400ea108
xor eax, eax
lea rbx, [0x140239880]
mov ecx, 1
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x48]
lea r8, [0x1401e956e]
mov r9d, 2
mov r10, qword [rsp + 0x90]
mov r11, qword [rsp + 0x50]
call fcn.14004e080
jmp 0x1400ea135
xor eax, eax
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x140239798]
mov esi, 1
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x50]
call fcn.14004dfa0
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
lea rax, [0x1401e9983]
mov ebx, 5
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov qword [rsp + 8], rax
call fcn.140061ce0
mov rax, qword [rsp + 8]
jmp fcn.1400e9f00
Function at 0x1401011a0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x1401011df
jb 0x1401011f4
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesdeclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret
Function at 0x140101260
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x140101330
jb 0x14010138f
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.140101140
aeskeygenassist xmm1, xmm0, 1
call fcn.140101160
aeskeygenassist xmm1, xmm2, 2
call fcn.140101140
aeskeygenassist xmm1, xmm0, 2
call fcn.140101160
aeskeygenassist xmm1, xmm2, 4
call fcn.140101140
aeskeygenassist xmm1, xmm0, 4
call fcn.140101160
aeskeygenassist xmm1, xmm2, 8
call fcn.140101140
aeskeygenassist xmm1, xmm0, 8
call fcn.140101160
aeskeygenassist xmm1, xmm2, 0x10
call fcn.140101140
aeskeygenassist xmm1, xmm0, 0x10
call fcn.140101160
aeskeygenassist xmm1, xmm2, 0x20
call fcn.140101140
aeskeygenassist xmm1, xmm0, 0x20
call fcn.140101160
aeskeygenassist xmm1, xmm2, 0x40
call fcn.140101140
jmp 0x1401013fd
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.1401010a0
aeskeygenassist xmm1, xmm2, 2
call fcn.140101100
aeskeygenassist xmm1, xmm2, 4
call fcn.1401010a0
aeskeygenassist xmm1, xmm2, 8
call fcn.140101100
aeskeygenassist xmm1, xmm2, 0x10
call fcn.1401010a0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.140101100
aeskeygenassist xmm1, xmm2, 0x40
call fcn.1401010a0
aeskeygenassist xmm1, xmm2, 0x80
call fcn.140101100
jmp 0x1401013fd
aeskeygenassist xmm1, xmm0, 1
call fcn.140101060
aeskeygenassist xmm1, xmm0, 2
call fcn.140101060
aeskeygenassist xmm1, xmm0, 4
call fcn.140101060
aeskeygenassist xmm1, xmm0, 8
call fcn.140101060
aeskeygenassist xmm1, xmm0, 0x10
call fcn.140101060
aeskeygenassist xmm1, xmm0, 0x20
call fcn.140101060
aeskeygenassist xmm1, xmm0, 0x40
call fcn.140101060
aeskeygenassist xmm1, xmm0, 0x80
call fcn.140101060
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.140101060
aeskeygenassist xmm1, xmm0, 0x36
call fcn.140101060
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x14010140a
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
ret
Function at 0x140101980
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140101ac6
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x80], rbx
mov rcx, qword [rax]
mov qword [rsp + 0x18], rcx
movups xmm0, xmmword [rax + 8]
movups xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [rax + 0x18]
movups xmmword [rsp + 0x30], xmm0
lea rax, [rsp + 0x18]
nop
call fcn.140101620
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
mov rcx, qword [rsp + 0x18]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x48], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x60], rcx
mov rcx, qword [rsp + 0x80]
xor eax, eax
jmp 0x140101a20
inc rax
mov rcx, rbx
nop dword [rax + rax]
cmp rax, 5
jge 0x140101a63
imul rdx, rax, 0x33
mov rsi, rdx
sar rdx, 0x3f
shr rdx, 0x3d
add rdx, rsi
mov rdi, rdx
and rdx, 0xfffffffffffffff8
sub rsi, rdx
cmp rsi, 0x40
sbb rdx, rdx
mov r8, qword [rsp + rax*8 + 0x40]
mov rbx, rcx
mov rcx, rsi
shl r8, cl
and r8, rdx
mov qword [rsp + 0x10], r8
xor ecx, ecx
jmp 0x140101a8c
test byte [rcx], al
mov rax, rcx
mov ebx, 0x20
mov rcx, rbx
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
movzx r8d, byte [rbx + rdi]
or r8d, edx
mov byte [rbx + rdi], r8b
inc rcx
mov rdi, rsi
cmp rcx, 8
jge 0x140101a15
movzx edx, byte [rsp + rcx + 0x10]
mov rsi, rdi
sar rdi, 3
add rdi, rcx
cmp rdi, 0x20
jge 0x140101a15
test byte [rbx], al
cmp rdi, 0x20
jb 0x140101a7a
mov rax, rdi
mov ecx, 0x20
nop dword [rax + rax]
call fcn.140064360
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.140061ce0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.140101980
Function at 0x140102ea0
Capabilities:
Hash data using sha384
Hash data using sha512

Disassembly:
mov rcx, qword [rax + 0xd0]
cmp rcx, 6
jne 0x140102f25
movabs rcx, 0xcbbb9d5dc1059ed8
mov qword [rax], rcx
movabs rcx, 0x629a292a367cd507
mov qword [rax + 8], rcx
movabs rcx, 0x9159015a3070dd17
mov qword [rax + 0x10], rcx
movabs rcx, 0x152fecd8f70e5939
mov qword [rax + 0x18], rcx
movabs rcx, 0x67332667ffc00b31
mov qword [rax + 0x20], rcx
movabs rcx, 0x8eb44a8768581511
mov qword [rax + 0x28], rcx
movabs rcx, 0xdb0c2e0d64f98fa7
mov qword [rax + 0x30], rcx
movabs rcx, 0x47b5481dbefa4fa4
mov qword [rax + 0x38], rcx
nop dword [rax]
jmp 0x140103086
cmp rcx, 0xe
jne 0x140102fa0
movabs rcx, 0x8c3d37c819544da2
mov qword [rax], rcx
movabs rcx, 0x73e1996689dcd4d6
mov qword [rax + 8], rcx
movabs rcx, 0x1dfab7ae32ff9c82
mov qword [rax + 0x10], rcx
movabs rcx, 0x679dd514582f9fcf
mov qword [rax + 0x18], rcx
movabs rcx, 0xf6d2b697bd44da8
mov qword [rax + 0x20], rcx
movabs rcx, 0x77e36f7304c48942
mov qword [rax + 0x28], rcx
movabs rcx, 0x3f9d85a86a1d36c8
mov qword [rax + 0x30], rcx
movabs rcx, 0x1112e6ad91d692a1
mov qword [rax + 0x38], rcx
jmp 0x140103086
cmp rcx, 0xf
jne 0x140103017
movabs rcx, 0x22312194fc2bf72c
mov qword [rax], rcx
movabs rcx, 0x9f555fa3c84c64c2
mov qword [rax + 8], rcx
movabs rcx, 0x2393b86b6f53b151
mov qword [rax + 0x10], rcx
movabs rcx, 0x963877195940eabd
mov qword [rax + 0x18], rcx
movabs rcx, 0x96283ee2a88effe3
mov qword [rax + 0x20], rcx
movabs rcx, 0xbe5e1e2553863992
mov qword [rax + 0x28], rcx
movabs rcx, 0x2b0199fc2c85b8aa
mov qword [rax + 0x30], rcx
movabs rcx, 0xeb72ddc81c52ca2
mov qword [rax + 0x38], rcx
jmp 0x140103086
movabs rcx, 0x6a09e667f3bcc908
mov qword [rax], rcx
movabs rcx, 0xbb67ae8584caa73b
mov qword [rax + 8], rcx
movabs rcx, 0x3c6ef372fe94f82b
mov qword [rax + 0x10], rcx
movabs rcx, 0xa54ff53a5f1d36f1
mov qword [rax + 0x18], rcx
movabs rcx, 0x510e527fade682d1
mov qword [rax + 0x20], rcx
movabs rcx, 0x9b05688c2b3e6c1f
mov qword [rax + 0x28], rcx
movabs rcx, 0x1f83d9abfb41bd6b
mov qword [rax + 0x30], rcx
movabs rcx, 0x5be0cd19137e2179
mov qword [rax + 0x38], rcx
movups xmmword [rax + 0xc0], xmm15
ret
Function at 0x14010d760
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x14010d778
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x14010d778
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x14010d780
xor eax, eax
ret
cmp rbx, 3
je 0x14010d78c
cmp rbx, 4
jne 0x14010d7b9
cmp al, 0x2c
ja 0x14010d7a6
lea ecx, [rax - 0x21]
cmp cl, 1
jbe 0x14010d7b6
cmp al, 0x24
je 0x14010d7b6
nop dword [rax]
cmp al, 0x26
jae 0x14010d7b6
jmp 0x14010d7b9
lea ecx, [rax - 0x3a]
cmp cl, 4
jbe 0x14010d7b6
cmp al, 0x5b
je 0x14010d7b6
cmp al, 0x5d
jne 0x14010d7b9
xor eax, eax
ret
cmp al, 0x2f
ja 0x14010d7f2
nop dword [rax]
cmp al, 0x26
ja 0x14010d7d1
cmp al, 0x24
je 0x14010d811
cmp al, 0x26
je 0x14010d811
jmp 0x14010d88b
lea ecx, [rax - 0x2b]
cmp cl, 1
jbe 0x14010d811
lea ecx, [rax - 0x2d]
nop dword [rax]
cmp cl, 1
jbe 0x14010d888
cmp al, 0x2f
je 0x14010d811
jmp 0x14010d88b
cmp al, 0x3d
ja 0x14010d809
lea ecx, [rax - 0x3a]
cmp cl, 1
jbe 0x14010d811
nop
cmp al, 0x3d
je 0x14010d811
jmp 0x14010d88b
lea ecx, [rax - 0x3f]
cmp cl, 1
ja 0x14010d880
cmp rbx, 2
jg 0x14010d847
cmp rbx, 1
je 0x14010d841
nop dword [rax]
cmp rbx, 2
jne 0x14010d88b
cmp al, 0x2f
je 0x14010d832
cmp al, 0x3b
je 0x14010d832
cmp al, 0x2c
jne 0x14010d839
mov ecx, 1
jmp 0x14010d83e
cmp al, 0x3f
sete cl
mov eax, ecx
ret
cmp al, 0x3f
sete al
ret
cmp rbx, 5
jne 0x14010d86a
cmp al, 0x40
je 0x14010d859
cmp al, 0x2f
je 0x14010d859
cmp al, 0x3f
jne 0x14010d862
mov ecx, 1
nop
jmp 0x14010d867
cmp al, 0x3a
sete cl
mov eax, ecx
ret
cmp rbx, 6
je 0x14010d879
cmp rbx, 7
jne 0x14010d88b
xor eax, eax
ret
mov eax, 1
ret
cmp al, 0x5f
je 0x14010d888
cmp al, 0x7e
jne 0x14010d88b
xor eax, eax
ret
cmp rbx, 7
jne 0x14010d8a1
cmp al, 0x21
je 0x14010d89d
lea ecx, [rax - 0x28]
cmp cl, 2
ja 0x14010d8a1
xor eax, eax
nop
ret
mov eax, 1
ret
Function at 0x140142730
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.14014d8d0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.14014d8d0
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]

Function at 0x1401427a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x50
movsxd rbx, dword [0x1403570f4]
mov r12, rcx
test ebx, ebx
jle 0x1401428d0
mov rax, qword [0x1403570f8]
xor ecx, ecx
add rax, 0x18
nop word [rax + rax]
mov rdx, qword [rax]
cmp rdx, r12
ja 0x1401427ec
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x140142873
add ecx, 1
add rax, 0x28
cmp ecx, ebx
jne 0x1401427d0
mov rcx, r12
call fcn.140143140
mov rsi, rax
test rax, rax
je 0x1401428f2
mov rax, qword [0x1403570f8]
lea rbx, [rbx + rbx*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rsi
mov dword [rax], 0
call fcn.140143270
mov ecx, dword [rsi + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x1403570f8]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1401428d7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x14014286c
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140142880
add dword [0x1403570f4], 1
add rsp, 0x50
pop rbx
pop rsi
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rbx, qword [0x1403570f8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14014286c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140142730
nop dword [rax]
xor ebx, ebx
jmp 0x1401427f7
mov rax, qword [0x1403570f8]
mov edx, dword [rsi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140142730
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.140142730
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140142db0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x140357160]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140357140]
test rbx, rbx
je 0x140142e04
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x140142dfb
test r12, r12
je 0x140142dfb
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140142de0
lea rcx, [0x140357160]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x140143140
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1402f9920]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140143160
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140143168
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140143160
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x1401431b5
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1401431ac
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140143160
add rax, 0x28
cmp rax, r9
jne 0x140143198
xor eax, eax
ret

Function at 0x1401431c0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1402f9920]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x1401431e0
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1401431e8
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x1401431e0
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x140143270
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1402f9920]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x140143290
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x140143298
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret

Function at 0x140144bf0
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, qword [str._r5_]
mov rax, qword [rsi]
test rax, rax
je 0x140144c80
cmp qword [rax + 0x30], 0
jne 0x140144ca0
lea rbx, [0x1401a91c8]
mov qword [rax + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [rbx], eax
mov rax, qword [rsi]
test rax, rax
je 0x140144c50
cmp qword [rax + 0x30], 0
jne 0x140144c70
lea rdx, [0x1401a91c8]
mov qword [rax + 0x30], rdx
mov rax, rdx
cmp dword [rax], 0xffffffff
je 0x14014da60
add rsp, 0x28
pop rbx
pop rsi
ret
call fcn.140149af0
mov r8, rax
mov rax, qword [rsi]
cmp qword [r8 + 0x30], 0
je 0x140144c32
test rax, rax
jne 0x140144c70
call fcn.140149af0
nop dword [rax]
mov rax, qword [rax + 0x30]
jmp 0x140144c40
call fcn.140149af0
cmp qword [rax + 0x30], 0
mov rax, qword [rsi]
je 0x140144c10
test rax, rax
jne 0x140144ca0
call fcn.140149af0
nop dword [rax]
mov rbx, qword [rax + 0x30]
jmp 0x140144c1b
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
mov rax, qword [pe_dos_header]
ud2
Function at 0x140144cb0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x98
movabs rax, 0x6c6320726f727245
movabs rdx, 0x7520676e696e6165
mov qword [rsp + 0x20], rax
movabs rax, 0x6b5f6e6970732070
mov qword [rsp + 0x28], rdx
movabs rdx, 0x20726f6620737965
mov qword [rsp + 0x30], rax
movabs rax, 0x20646165726874
mov qword [rsp + 0x38], rdx
xor edx, edx
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0
mov word [rsp + 0x88], ax
mov byte [rsp + 0x8a], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [rsp + 0x47]
mov r8d, 0xa
mov ecx, eax
call qword [sym.imp.msvcrt.dll__ultoa]
cmp byte [rsp + 0x47], 0
je 0x140144dc2
mov eax, 0x28
lea rcx, [rsp + 0x20]
jmp 0x140144d9a
add rax, 1
cmp rax, 0x6b
je 0x140144db7
cmp byte [rcx + rax], 0
movsxd rdx, eax
jne 0x140144d90
cmp edx, 0x6a
je 0x140144db7
lea eax, [rdx + 1]
cdqe
mov byte [rsp + rdx + 0x20], 0xa
mov byte [rsp + rax + 0x20], 0
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call sub.msvcrt.dll_abort
mov eax, 0x28
mov edx, 0x27
lea rcx, [rsp + 0x20]
jmp 0x140144dab
Function at 0x1401457d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rsi, qword [str._r5_]
mov rax, qword [rsi]
test rax, rax
je 0x1401459c0
cmp qword [rax + 0x28], 0
jne 0x1401459a8
lea rcx, [0x140357218]
cmp dword [rcx], 1
mov qword [rax + 0x28], rcx
je 0x1401459b5
call fcn.140144de0
mov rax, qword [rsi]
test rax, rax
je 0x140145850
cmp qword [rax + 0x30], 0
jne 0x140145870
lea rdx, [0x1401a91c8]
mov qword [rax + 0x30], rdx
mov rax, rdx
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12, rax
test rax, rax
je 0x140145884
mov rax, r12
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call fcn.140149af0
cmp qword [rax + 0x30], 0
mov rax, qword [rsi]
je 0x140145820
test rax, rax
jne 0x140145870
call fcn.140149af0
nop dword [rax]
mov rax, qword [rax + 0x30]
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12, rax
test rax, rax
jne 0x14014583e
call fcn.140144920
cmp qword [0x14035b050], 0
mov rbx, rax
je 0x14014583e
test rax, rax
je 0x14014583e
mov dword [rax + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor ecx, ecx
xor r9d, r9d
xor r8d, r8d
mov dword [rbx + 0x70], eax
mov edx, 1
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x38], 0xffffffffffffffff
lea rcx, [rbx + 0x68]
mov qword [rbx + 0x30], rax
call fcn.14014b990
cmp eax, 1
je 0x140145a2d
mov rbp, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rbx + 0x68], 0xffffffffffffffff
mov dword [rbx + 0xb8], 0
mov qword [rbx + 0x28], 0
call rbp
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r12, rax
call rbp
mov dword [rsp + 0x30], 2
mov r8, rdi
mov rdx, r12
mov dword [rsp + 0x28], 0
mov rcx, rax
lea r9, [rbx + 0x28]
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x14014da66
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [rbx + 0xbc], 0
mov dword [rbx + 0xc0], eax
movzx eax, byte [rbx + 0x40]
and eax, 0xffffffcf
or eax, 0x10
mov byte [rbx + 0x40], al
mov rax, qword [rsi]
test rax, rax
je 0x140145a08
cmp qword [rax + 0x30], 0
je 0x1401459f0
mov rax, qword [rax + 0x30]
mov ecx, dword [rax]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x14014da66
mov r12, rbx
mov rax, r12
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, qword [rax + 0x28]
cmp dword [rcx], 1
jne 0x14014580c
mov rax, qword [rsi]
jmp 0x140145819
call fcn.140149af0
cmp qword [rax + 0x28], 0
mov rax, qword [rsi]
je 0x1401457f8
test rax, rax
jne 0x1401459a8
call fcn.140149af0
mov rcx, qword [rax + 0x28]
cmp dword [rcx], 1
jne 0x14014580c
jmp 0x140145811
lea rdx, [0x1401a91c8]
mov qword [rax + 0x30], rdx
mov rax, rdx
jmp 0x14014597e
call fcn.140149af0
mov r8, rax
mov rax, qword [rsi]
cmp qword [r8 + 0x30], 0
je 0x1401459f0
test rax, rax
jne 0x14014597a
call fcn.140149af0
jmp 0x14014597a
call fcn.140144cb0
nop word cs:[rax + rax]
nop dword [rax]
mov rax, qword [str._r5_]
mov rdx, qword [rax]
lea rax, [0x140357228]
mov qword [rdx + 0x10], rax
ret
Function at 0x140149970
Capabilities:
Print debug messages

Disassembly:
push r12
push rbx
sub rsp, 0x58
mov r12, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140149990
add rsp, 0x58
pop rbx
pop r12
ret
lea rdx, [rsp + 0x48]
mov r9d, 0x400
mov r8d, eax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rdx
mov ecx, 0x1100
xor edx, edx
mov dword [rsp + 0x28], 0
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
jne 0x1401499d8
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140149984
int3
mov rcx, qword [rsp + 0x48]
mov rbx, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rbx
mov rcx, r12
call rbx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1401499c5