joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14023f7c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov ecx, dword [0x140284a88]
test ecx, ecx
je 0x14023f912
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jb 0x14023f7f3
mov rsi, rax
cmp qword [rax + 8], 0
je 0x14023f7f3
add rsi, 8
jmp 0x14023f909
mov ecx, dword [0x140284a88]
test ecx, ecx
je 0x14023f925
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x14023f907
mov rsi, rax
test rax, rax
jne 0x14023f888
movzx eax, byte [0x14036c240]
mov rcx, qword [0x14036c198]
test rcx, rcx
jne 0x14023f845
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x14023f95c
mov rcx, rax
mov qword [0x14036c198], rax
mov r8d, 0x10
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x14023f95c
mov rsi, rax
lea rax, [0x140284a70]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x140284a88]
test ecx, ecx
je 0x14023f938
dec ecx
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
movzx eax, byte [0x14036c240]
mov rcx, qword [0x14036c198]
test rcx, rcx
jne 0x14023f8b3
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x14023f94b
mov rcx, rax
mov qword [0x14036c198], rax
mov r8d, 0x30
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x14023f94b
add rsi, 8
mov qword [rax], 1
mov qword [rax + 8], 1
mov qword [rax + 0x10], 0
mov byte [rax + 0x18], 0
xorps xmm0, xmm0
movups xmmword [rax + 0x20], xmm0
mov rcx, qword [rsi]
mov qword [rsi], rax
test rcx, rcx
je 0x14023f909
lock dec qword [rcx]
jne 0x14023f909
call fcn.1401ee7f0
jmp 0x14023f909
xor esi, esi
mov rax, rsi
add rsp, 0x20
pop rsi
ret
lea rcx, [0x140284a70]
call fcn.140202220
mov ecx, eax
jmp 0x14023f7d5
lea rcx, [0x140284a70]
call fcn.140202220
mov ecx, eax
jmp 0x14023f803
lea rcx, [0x140284a70]
call fcn.140202220
mov ecx, eax
jmp 0x14023f880
mov ecx, 8
mov edx, 0x30
call fcn.140004360
ud2
mov ecx, 8
mov edx, 0x10
call fcn.140004360
ud2
Function at 0x14023f970
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x80
mov ecx, dword [0x140284ac0]
test ecx, ecx
je 0x14023fb0f
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jb 0x14023f9a1
mov rsi, rax
cmp qword [rax + 8], 0
jne 0x14023fb32
mov ecx, dword [0x140284ac0]
test ecx, ecx
je 0x14023fb42
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x14023fb0b
mov rsi, rax
test rax, rax
jne 0x14023fa67
movzx eax, byte [0x14036c240]
mov rcx, qword [0x14036c198]
test rcx, rcx
jne 0x14023f9f7
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x14023fb68
mov rcx, rax
mov qword [0x14036c198], rax
mov r8d, 0x60
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x14023fb68
mov rsi, rax
lea rax, [0x140284aa8]
mov qword [rsi], rax
mov qword [rsi + 8], 0
movups xmm0, xmmword [rsp + 0x20]
movups xmm1, xmmword [rsp + 0x30]
movups xmm2, xmmword [rsp + 0x40]
movups xmm3, xmmword [rsp + 0x50]
movups xmmword [rsi + 0x10], xmm0
movups xmmword [rsi + 0x20], xmm1
movups xmmword [rsi + 0x30], xmm2
movups xmmword [rsi + 0x40], xmm3
movups xmm0, xmmword [rsp + 0x60]
movups xmmword [rsi + 0x50], xmm0
mov ecx, dword [0x140284ac0]
test ecx, ecx
je 0x14023fb55
dec ecx
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
mov rax, qword [rsi + 0x58]
mov qword [rsp + 0x70], rax
movups xmm0, xmmword [rsi + 0x48]
movaps xmmword [rsp + 0x60], xmm0
movups xmm0, xmmword [rsi + 8]
movups xmm1, xmmword [rsi + 0x18]
movups xmm2, xmmword [rsi + 0x28]
movups xmm3, xmmword [rsi + 0x38]
movaps xmmword [rsp + 0x50], xmm3
movaps xmmword [rsp + 0x40], xmm2
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsi + 8], 1
movups xmm0, xmmword [0x140307870]
movups xmmword [rsi + 0x50], xmm0
movups xmm0, xmmword [0x140307860]
movups xmmword [rsi + 0x40], xmm0
movups xmm0, xmmword [0x140307850]
movups xmmword [rsi + 0x30], xmm0
movups xmm0, xmmword [0x140307840]
movups xmmword [rsi + 0x20], xmm0
movups xmm0, xmmword [0x140307830]
movups xmmword [rsi + 0x10], xmm0
cmp qword [rsp + 0x20], 0
je 0x14023fb32
mov rax, qword [rsp + 0x30]
cmp rax, 2
je 0x14023fb32
lea rcx, [rsp + 0x38]
test rax, rax
je 0x14023fb22
mov rax, qword [rsp + 0x38]
lock dec qword [rax]
jne 0x14023fb32
call fcn.140240370
jmp 0x14023fb32
xor esi, esi
jmp 0x14023fb36
lea rcx, [0x140284aa8]
call fcn.140202220
mov ecx, eax
jmp 0x14023f988
mov rax, qword [rsp + 0x38]
lock dec qword [rax]
jne 0x14023fb32
call fcn.140240e80
add rsi, 0x10
mov rax, rsi
add rsp, 0x80
pop rsi
ret
lea rcx, [0x140284aa8]
call fcn.140202220
mov ecx, eax
jmp 0x14023f9b1
lea rcx, [0x140284aa8]
call fcn.140202220
mov ecx, eax
jmp 0x14023fa5f
mov ecx, 8
mov edx, 0x60
call fcn.140004360
ud2
Function at 0x140242f30
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, r9
mov r12, r8
mov qword [rsp + 0x20], rcx
mov rax, qword [rsp + 0xb0]
mov r14, qword [rdx + 0x10]
mov r15, qword [rdx + 0x18]
cmp rax, 0x7fffffff
mov edi, 0x7fffffff
cmovb rdi, rax
mov rax, qword [rdx + 0x20]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x30]
mov qword [rsp + 0x28], rdi
jmp 0x140242f8d
lea rbx, [rsp + 0x30]
mov rcx, rbx
call fcn.1400b4570
mov rcx, rbx
mov rdx, r14
mov r8, r12
mov r9b, 1
call fcn.14022e820
movzx eax, byte [rsp + 0x39]
cmp al, 3
je 0x1402430a5
mov r13, qword [rsp + 0x30]
cmp al, 2
je 0x1402430b3
cmp r15, 0xffffffffffffffff
je 0x1402430fa
movzx ebx, byte [rsp + 0x38]
mov rcx, r15
mov rdx, rsi
mov r8d, edi
xor r9d, r9d
call sub.ws2_32.dll_send
cmp eax, 0xffffffff
jne 0x1402430c5
call sub.ws2_32.dll_WSAGetLastError
mov ebp, eax
shl rbp, 0x20
or rbp, 2
mov rcx, rbp
call fcn.1400b32e0
cmp al, 0xd
jne 0x140243053
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x140243053
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
lock inc qword [rdx]
jle 0x140243114
mov rdi, r15
mov r15, r12
mov r12, rsi
add rcx, 0x10
mov r8, qword [rax + 0x10]
movzx r9d, byte [rax + 0x18]
call fcn.1400b3090
mov rsi, rax
test rax, rax
je 0x140243045
mov rcx, rbp
call fcn.1400b9660
mov rbp, rsi
mov rsi, r12
mov r12, r15
mov r15, rdi
mov rdi, qword [rsp + 0x28]
mov rcx, rbp
call fcn.1400b32e0
cmp al, 0xd
jne 0x1402430d9
mov qword [rsp + 0x30], rbp
and r13d, 0x23
mov rax, qword [r14 + 0xd0]
xor r13, 0x2f
mov rcx, rbx
shl rcx, 0x10
nop word [rax + rax]
mov edx, eax
shr edx, 0x10
cmp bl, dl
jne 0x140242f80
mov edx, r13d
and edx, eax
or rdx, rcx
lock cmpxchg qword [r14 + 0xd0], rdx
jne 0x140243080
jmp 0x140242f80
mov rax, qword [rsp + 0x20]
mov qword [rax], 2
jmp 0x1402430e9
mov rax, qword [rsp + 0x20]
mov qword [rax], 1
mov qword [rax + 8], r13
jmp 0x1402430e9
cdqe
mov rcx, qword [rsp + 0x20]
mov qword [rcx], 0
mov qword [rcx + 8], rax
jmp 0x1402430e9
mov rax, qword [rsp + 0x20]
mov qword [rax], 1
mov qword [rax + 8], rbp
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.called__Option::unwrap____on_a__None__value_rustc_82e1608dfa6e0b5569232559e3d385fea5a93112library_alloc_srccollections_btree_navigate.rs
lea r8, str._Users_ma__kiri_.cargo_registry_src_index.crates.io_6f17d22bba15001f_tokio_1.35.1_src_io_poll_evented.rs
mov edx, 0x2b
call fcn.14003e7d0
ud2
ud2

Function at 0x140243140
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm6
mov qword [rsp + 0x60], r9
mov qword [rsp + 0x68], r8
mov qword [rsp + 0x40], rcx
mov rax, qword [rsp + 0xf0]
mov r14, qword [rdx + 0x10]
mov r15, qword [rdx + 0x18]
mov ecx, 0xffffffff
cmp rax, rcx
cmovb rcx, rax
mov qword [rsp + 0x58], rcx
mov rdi, qword [rdx + 0x20]
lea r12, [rsp + 0x48]
xorps xmm6, xmm6
jmp 0x1402431a8
Function at 0x140258630
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov ecx, dword [0x1402850b0]
test ecx, ecx
je 0x14025871a
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jb 0x140258660
cmp qword [rax + 8], 0
je 0x140258660
add rax, 0x10
jmp 0x140258714
mov ecx, dword [0x1402850b0]
test ecx, ecx
je 0x14025872d
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x140258712
mov rsi, rax
test rax, rax
jne 0x1402586f1
movzx eax, byte [0x14036c240]
mov rcx, qword [0x14036c198]
test rcx, rcx
jne 0x1402586b2
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x140258750
mov rcx, rax
mov qword [0x14036c198], rax
mov r8d, 0x38
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x140258750
mov rsi, rax
lea rax, [0x140285098]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x1402850b0]
test ecx, ecx
je 0x140258740
dec ecx
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
mov qword [rsi + 8], 1
lea rax, [rsi + 0x10]
xorps xmm0, xmm0
movups xmmword [rsi + 0x10], xmm0
movups xmmword [rsi + 0x20], xmm0
mov qword [rsi + 0x30], 0
jmp 0x140258714
xor eax, eax
add rsp, 0x20
pop rsi
ret
lea rcx, [0x140285098]
call fcn.140202220
mov ecx, eax
jmp 0x140258645
lea rcx, [0x140285098]
call fcn.140202220
mov ecx, eax
jmp 0x140258670
lea rcx, [0x140285098]
call fcn.140202220
mov ecx, eax
jmp 0x1402586e9
mov ecx, 8
mov edx, 0x38
call fcn.140004360
ud2

Function at 0x140258770
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov ecx, dword [0x140285030]
test ecx, ecx
je 0x14025884b
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jb 0x1402587a0
cmp qword [rax + 8], 0
je 0x1402587a0
add rax, 0x10
jmp 0x140258845
mov ecx, dword [0x140285030]
test ecx, ecx
je 0x14025885e
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x140258843
mov rsi, rax
test rax, rax
jne 0x14025882d
movzx eax, byte [0x14036c240]
mov rcx, qword [0x14036c198]
test rcx, rcx
jne 0x1402587f2
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x140258881
mov rcx, rax
mov qword [0x14036c198], rax
mov r8d, 0x18
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x140258881
mov rsi, rax
lea rax, [0x140285018]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x140285030]
test ecx, ecx
je 0x140258871
dec ecx
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
lea rax, [rsi + 0x10]
mov qword [rsi + 8], 1
mov qword [rsi + 0x10], 0
jmp 0x140258845
xor eax, eax
add rsp, 0x20
pop rsi
ret
lea rcx, [0x140285018]
call fcn.140202220
mov ecx, eax
jmp 0x140258785
lea rcx, [0x140285018]
call fcn.140202220
mov ecx, eax
jmp 0x1402587b0
lea rcx, [0x140285018]
call fcn.140202220
mov ecx, eax
jmp 0x140258825
mov ecx, 8
mov edx, 0x18
call fcn.140004360
ud2
Function at 0x140258b90
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov ecx, dword [0x140285070]
test ecx, ecx
je 0x140258c7b
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jb 0x140258bc0
cmp qword [rax + 8], 0
je 0x140258bc0
add rax, 0x10
jmp 0x140258c75
mov ecx, dword [0x140285070]
test ecx, ecx
je 0x140258c8e
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x140258c73
mov rsi, rax
test rax, rax
jne 0x140258c51
movzx eax, byte [0x14036c240]
mov rcx, qword [0x14036c198]
test rcx, rcx
jne 0x140258c12
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x140258cb1
mov rcx, rax
mov qword [0x14036c198], rax
mov r8d, 0x28
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x140258cb1
mov rsi, rax
lea rax, [0x140285058]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x140285070]
test ecx, ecx
je 0x140258ca1
dec ecx
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
mov qword [rsi + 8], 1
lea rax, [rsi + 0x10]
mov qword [rsi + 0x10], 0
mov byte [rsi + 0x18], 3
mov qword [rsi + 0x20], 0
jmp 0x140258c75
xor eax, eax
add rsp, 0x20
pop rsi
ret
lea rcx, [0x140285058]
call fcn.140202220
mov ecx, eax
jmp 0x140258ba5
lea rcx, [0x140285058]
call fcn.140202220
mov ecx, eax
jmp 0x140258bd0
lea rcx, [0x140285058]
call fcn.140202220
mov ecx, eax
jmp 0x140258c49
mov ecx, 8
mov edx, 0x28
call fcn.140004360
ud2

Function at 0x140258cd0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov ecx, dword [0x140285050]
test ecx, ecx
je 0x140258dec
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jb 0x140258d04
mov rdi, rax
cmp qword [rax + 8], 0
je 0x140258d04
add rdi, 0x10
jmp 0x140258de2
mov ecx, dword [0x140285050]
test ecx, ecx
je 0x140258dff
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x140258de0
mov rsi, rax
test rax, rax
jne 0x140258d99
movzx eax, byte [0x14036c240]
mov rcx, qword [0x14036c198]
test rcx, rcx
jne 0x140258d56
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x140258e25
mov rcx, rax
mov qword [0x14036c198], rax
mov r8d, 0x30
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x140258e25
mov rsi, rax
lea rax, [0x140285038]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x140285050]
test ecx, ecx
je 0x140258e12
dec ecx
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
lea rdi, [rsi + 0x10]
mov r8, qword [rsi + 0x18]
mov rax, qword [rsi + 0x20]
cmp qword [rsi + 8], 0
mov qword [rsi + 8], 1
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], 1
xorps xmm0, xmm0
movups xmmword [rsi + 0x20], xmm0
je 0x140258de2
test rax, rax
je 0x140258de2
mov rcx, qword [0x14036c198]
xor edx, edx
call fcn.14027f164
jmp 0x140258de2
xor edi, edi
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x140285038]
call fcn.140202220
mov ecx, eax
jmp 0x140258ce6
lea rcx, [0x140285038]
call fcn.140202220
mov ecx, eax
jmp 0x140258d14
lea rcx, [0x140285038]
call fcn.140202220
mov ecx, eax
jmp 0x140258d91
mov ecx, 8
mov edx, 0x30
call fcn.140004360
ud2
Function at 0x140266ff0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov rax, qword [rcx + 0x38]
test rax, rax
jle fcn.140267020
cmp qword [rcx + 0x40], 0
js fcn.140267020
add rax, 0xffffffffffffff00
mov qword [rcx + 0x38], rax
jmp fcn.1400d41f0

Function at 0x140267020
Capabilities:
Encode data using xor
Encrypt data using salsa20 or chacha

Disassembly:
push rsi
push rdi
sub rsp, 0xb8
movdqa xmmword [rsp + 0xa0], xmm7
movdqa xmmword [rsp + 0x90], xmm6
mov rsi, rdx
mov rdi, rcx
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x50]
call fcn.1400d6670
test rax, rax
je 0x140267076
mov rcx, qword [0x14036c198]
xor edx, edx
mov r8, rax
call fcn.14027f164
jmp 0x140267141
movdqa xmm7, xmmword [rsp + 0x50]
movdqa xmm6, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x80], xmm6
movdqa xmmword [rsp + 0x70], xmm7
mov rax, qword [0x14036c208]
test rax, rax
je 0x1402670e2
test eax, 0x4000
jne 0x1402670ee
pshufd xmm0, xmm7, 0xee
pshufd xmm1, xmm6, 0xee
movq rax, xmm7
movq rcx, xmm0
movq rdx, xmm6
movq r8, xmm1
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], r8
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x40], xmm0
jmp 0x140267109
call fcn.14022d640
test eax, 0x4000
je 0x1402670a4
lea r8, [0x14032f7f0]
lea rcx, [rsp + 0x20]
lea rdx, [rsp + 0x70]
call fcn.1400d65a0
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
mov qword [rdi + 0x28], rcx
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x38]
mov qword [rdi + 0x18], r8
mov r8, qword [rsp + 0x40]
mov qword [rdi + 0x20], r8
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], rdx
mov rcx, qword [rdi + 0x30]
mov qword [rdi + 0x38], rcx
mov qword [rdi], rax
mov qword [rdi + 0x40], 0
mov rax, 0xffffffffffffff00
add rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov rdx, rsi
movaps xmm6, xmmword [rsp + 0x90]
movaps xmm7, xmmword [rsp + 0xa0]
add rsp, 0xb8
pop rdi
pop rsi
jmp fcn.1400d41f0
Function at 0x1402808f0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.1402816b0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.1402816b0
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x140280960
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x14036c2d4]
mov rbx, rcx
test esi, esi
jle 0x140280a90
mov rax, qword [0x14036c2d8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x1402809ab
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140280a35
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140280990
mov rcx, rbx
call fcn.1402813d0
mov rdi, rax
test rax, rax
je 0x140280ab2
mov rax, qword [0x14036c2d8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.140281510
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x14036c2d8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140280a97
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x140280a2e
lea edx, [rax - 0x40]
and edx, 0xffffffbf
jne 0x140280a40
add dword [0x14036c2d4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x14036c2d8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140280a2e
call qword [sym.imp.kernel32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.1402808f0
nop dword [rax]
xor esi, esi
jmp 0x1402809b8
mov rax, qword [0x14036c2d8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.1402808f0
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.1402808f0
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140281040
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x14036c340]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14036c320]
test rbx, rbx
je 0x14028109c
mov rbp, qword [sym.imp.kernel32.dll_TlsGetValue]
mov rdi, qword [sym.imp.kernel32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test rsi, rsi
je 0x140281093
test eax, eax
jne 0x140281093
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140281078
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x1402813d0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1403351b0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1402813f0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1402813f8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1402813f0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14028144d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140281444
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1402813f0
add rax, 0x28
cmp rax, r9
jne 0x140281430
xor eax, eax
ret

Function at 0x140281450
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1403351b0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14028146f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140281478
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14028146f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140281510
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1403351b0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14028152f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140281538
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x140014330
Capabilities:
Create process on windows
Get common file path
Set current directory
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xf0
mov rax, qword [0x140033010]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rdi, rcx
lea rcx, str._________Inside_execute_Method___________n
xor ebx, ebx
mov rsi, rdx
mov dword [rbp - 0x41], ebx
call fcn.140016938
test rdi, rdi
je 0x14001442e
lea ecx, [rbx + 1]
mov edx, 0x1000
call fcn.140016ce0
mov ecx, 0x1000
mov rdx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov dword [rbp - 0x41], eax
test eax, eax
jne 0x1400143ac
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.execute:_Failed_to_get_the_CurrentWorkingDirectory__n
mov dword [rbp - 0x41], eax
jmp 0x140014590
cmp eax, 0x1000
jbe 0x1400143c6
lea rcx, str.execute_:_CurrentWorkingDirectory_Buffer_overflow._Need_to_allocate_the_length_for__d_chars__n
mov edx, eax
call fcn.140016938
jmp 0x140014595
test rsi, rsi
je 0x140014598
lea rcx, str.execute_:_Current_Working_Directory_:__s__n

Function at 0x1400145c0
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rbp
mov rax, qword [0x140033010]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rsi, rcx
mov edx, 0x64
mov ebp, 1
mov ecx, ebp
call fcn.140016ce0
mov r14, rax
lea edx, [rbp + 0x31]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
call fcn.1400133b0
mov rcx, rax
xor eax, eax
test rcx, rcx
setne al
test eax, eax
jne 0x140014630
mov ecx, 0x80004005
call fcn.1400132b0
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x38], rbx
lea rdx, str.DRMFilter
lea edx, str.DRMFilter

Function at 0x140014810
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [0x140035f68], 0
mov rbx, rcx
jne 0x14001485b
xor edx, edx
mov r8d, 0xf003f
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [0x140035f68], rax
test rax, rax
jne 0x14001485b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.OpenSCManager_failed__last_error_0x_x__n
mov edx, eax
call fcn.140016938
xor eax, eax
add rsp, 0x30
pop rbx
ret
lea rcx, [0x140035e60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x14001488d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.GetSystemDirectory_failed__last_error_0x_x__n
mov edx, eax
call fcn.140016938
xor eax, eax
add rsp, 0x30
pop rbx
ret
lea r9, [0x140035e60]
lea r8, str._sdrivers_s.sys
lea rcx, [0x140035f70]
mov edx, 0x104
mov qword [rsp + 0x20], rbx
call fcn.1400141e0
test eax, eax
jns 0x1400148cb
lea rcx, str.StringCchPrintf_failed__hr_0x_08x__n
mov edx, eax
call fcn.140016938
xor eax, eax
add rsp, 0x30
pop rbx
ret
mov eax, 1
add rsp, 0x30
pop rbx
ret