joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x1400ef9d0]
mov dword [rax], 1
mov rax, qword [0x1400ef9e0]
mov dword [rax], 1
mov rax, qword [0x1400ef9f0]
mov dword [rax], 1
mov rax, qword [0x1400ef990]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x14000330c
Capabilities:
Capture screenshot

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x130
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xd0], rcx
lea rax, [rbp + 0x77]
mov qword [rbp + 0x78], rax
nop
nop
mov rax, qword [rbp + 0xd0]
mov rcx, rax
call fcn.140043b70
mov rsi, rax
mov rax, qword [rbp + 0xd0]
mov rcx, rax
call fcn.140043da0
mov rdx, rax
lea rcx, [rbp + 0x77]
lea rax, [rbp + 0x50]
mov r9, rcx
mov r8, rsi
mov rcx, rax
call fcn.1400c40f0
lea rax, [rbp + 0x77]
mov rcx, rax
call fcn.1400afb20
nop
movabs rax, 0xffffffff00000000
and rax, rbx
mov rbx, rax
mov eax, ebx
mov rbx, rax
mov edx, 1
mov rcx, rbx
mov rax, qword [sym.imp.USER32.dll_MonitorFromPoint]
call rax
mov qword [rbp + 0xa8], rax
cmp qword [rbp + 0xa8], 0
jne 0x1400033b7
mov ebx, 0
jmp 0x1400035a0
mov dword [rbp], 0x48
mov rdx, rbp
mov rax, qword [rbp + 0xa8]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_GetMonitorInfoA]
call rax
test eax, eax
sete al
test al, al
je 0x1400033f6
mov rax, qword [0x1401230b8]
mov rcx, rax
call sub.gdiplus.dll_GdiplusShutdown
mov ebx, 0
jmp 0x1400035a0
mov edx, dword [rbp + 0xc]
mov eax, dword [rbp + 4]
sub edx, eax
mov dword [rbp + 0xa4], edx
mov edx, dword [rbp + 0x10]
mov eax, dword [rbp + 8]
sub edx, eax
mov dword [rbp + 0xa0], edx
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_GetDC]
call rax
mov qword [rbp + 0x98], rax
mov rax, qword [rbp + 0x98]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_CreateCompatibleDC]
call rax
mov qword [rbp + 0x90], rax
mov ecx, dword [rbp + 0xa0]
mov edx, dword [rbp + 0xa4]
mov rax, qword [rbp + 0x98]
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
call rax
mov qword [rbp + 0x88], rax
mov rdx, qword [rbp + 0x88]
mov rax, qword [rbp + 0x90]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_SelectObject]
call rax
mov qword [rbp + 0x80], rax
mov ecx, dword [rbp + 0xa4]
mov rax, qword [rbp + 0x90]
mov dword [rsp + 0x40], 0xcc0020
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov rdx, qword [rbp + 0x98]
mov qword [rsp + 0x28], rdx
mov edx, dword [rbp + 0xa0]
mov dword [rsp + 0x20], edx
mov r9d, ecx
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_BitBlt]
call rax
mov rdx, qword [rbp + 0x88]
lea rax, [rbp - 0x20]
mov r8d, 0
mov rcx, rax
call fcn.140033440
lea rax, [rbp - 0x30]
mov rdx, rax
lea rax, str.image_jpeg
mov rcx, rax
call fcn.1400031e6
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.140044b50
mov rdx, rax
lea rcx, [rbp - 0x30]
lea rax, [rbp - 0x20]
mov r9d, 0
mov r8, rcx
mov rcx, rax
call fcn.1400332c0
mov rdx, qword [rbp + 0x80]
mov rax, qword [rbp + 0x90]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_SelectObject]
call rax
mov rax, qword [rbp + 0x88]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_DeleteObject]
call rax
mov rax, qword [rbp + 0x90]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_DeleteDC]
call rax
mov rax, qword [rbp + 0x98]
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_ReleaseDC]
call rax
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.140033550
mov ebx, 1
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.1400c4da0
cmp ebx, 1
jmp 0x1400035f8
add rsp, 0x130
pop rbx
pop rsi
pop rbp
ret
Function at 0x140003795
Capabilities:
Get session user name

Disassembly:
push rbp
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x20], rcx
mov rax, rsp
mov rbx, rax
mov dword [rbp - 0x20], 0x100
mov eax, dword [rbp - 0x20]
mov edx, eax
sub rdx, 1
mov qword [rbp - 8], rdx
mov eax, eax
add rax, 0xf
shr rax, 4
shl rax, 4
call fcn.140011860
sub rsp, rax
lea rax, [rsp + 0x20]
add rax, 0
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x20]
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_GetUserNameA]
call rax
lea rax, [rbp - 0x19]
mov qword [rbp - 0x18], rax
nop
nop
lea rcx, [rbp - 0x19]
mov rdx, qword [rbp - 0x10]
mov rax, qword [rbp + 0x20]
mov r8, rcx
mov rcx, rax
call fcn.1400c0030
lea rax, [rbp - 0x19]
mov rcx, rax
call fcn.1400afb10
nop
mov rsp, rbx
jmp 0x140003843
mov rax, qword [rbp + 0x20]
lea rsp, [rbp + 8]
pop rbx
pop rbp
ret
Function at 0x1400055a3
Capabilities:
Create process on windows
Terminate process

Disassembly:
push rbp
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x70]
mov rax, qword [0x1401230b8]
mov rcx, rax
call sub.gdiplus.dll_GdiplusShutdown
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.140003e15
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.140043db0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.1400c0880
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]
call rax
mov rbx, rax
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.1400c0880
mov rax, rbx
mov rcx, rax
call fcn.140011c50
nop
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0x90]
mov qword [rbp + 0x30], rcx
lea rax, [rbp - 0x70]
mov rcx, rax
call fcn.1400bfd70
mov dword [rbp - 0x44], 0x3c
lea rdx, [rbp - 0x44]
lea rax, [rbp - 0x50]
mov rcx, rax
call fcn.1400b8240
lea rax, [rbp - 0x50]
mov rcx, rax
call fcn.140096170
lea rax, [rbp - 0x14]
mov r8d, edi
lea rdx, str._get_restart_
mov rcx, rax
call fcn.140029870
lea rax, [rbp - 0x14]
mov rcx, rax
call fcn.1400297d0
mov rdx, rax
lea rax, [rbp - 0x40]
mov rcx, qword [rbp + 0x30]
mov r8, rcx
mov rcx, rax
call fcn.1400de5f0
lea rdx, [rbp - 0x70]
lea rax, [rbp - 0x40]
mov r9d, 0x3c
mov r8, rdx
mov rdx, rax
lea rax, [0x1401230e0]
mov rcx, rax
call fcn.140001cdd
cmp eax, 0xe8
sete bl
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.1400c0880
test bl, bl
je 0x14000567e
lea rax, [rbp - 0x70]
mov rcx, rax
call fcn.140043dd0
xor eax, 1
test al, al
je 0x14000567e
lea rax, [rbp - 0x70]
mov rdx, rax
mov rax, qword [0x1400ef370]
mov rcx, rax
call fcn.1400de030
mov rcx, rax
mov rax, qword [0x1400ef380]
mov rdx, rax
call fcn.14008f910
lea rax, [rbp - 5]
mov r8d, esi
lea rdx, [0x1400e9450]
mov rcx, rax
call fcn.14002ee40
lea rax, [rbp - 5]
mov rcx, rax
call fcn.14002eda0
mov rdx, rax
lea rax, [rbp - 0x70]
mov rcx, rax
call fcn.1400ddba0
test al, al
je 0x14000567e
call fcn.1400055a3
jmp 0x14000567e
Function at 0x140006400
Capabilities:
Query environment variable

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xc8
lea rbp, [rsp + 0xc0]
mov r9d, 0
mov r8d, 0
mov edx, 0
lea rax, [0x1401230a0]
mov rcx, rax
call fcn.140033270
lea rax, [rbp - 0x71]
mov qword [rbp - 8], rax
nop
nop
lea rax, [rbp - 0x70]
mov r8d, edi
lea rdx, str.MicrosoftWindowsStart_MenuProgramsStartup_
mov rcx, rax
call fcn.14002f850
lea rax, [rbp - 0x70]
mov rcx, rax
call fcn.14002f7b0
mov rdx, rax
lea rcx, [rbp - 0x71]
lea rax, [rbp - 0xa0]
mov r8, rcx
mov rcx, rax
call fcn.1400c0030
lea rax, [rbp - 0x3a]
mov r8d, esi
lea rdx, str.appdata
mov rcx, rax
call fcn.1400321d0
lea rax, [rbp - 0x3a]
mov rcx, rax
call fcn.140032130
mov rcx, rax
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
mov rdx, rax
lea rax, [0x1401230c0]
lea rcx, [rbp - 0xa0]
mov r8, rcx
mov rcx, rax
call fcn.1400de5a0
lea rax, [rbp - 0xa0]
mov rcx, rax
call fcn.1400c0880
lea rax, [rbp - 0x71]
mov rcx, rax
call fcn.1400afb10
nop
lea rax, [0x1400063c4]
mov rcx, rax
call fcn.140001583
lea rax, [rbp - 0x31]
mov qword [rbp - 0x10], rax
nop
nop
lea rax, [rbp - 0x30]
mov r8d, ebx
lea rdx, str.swizxx_blitz_net.hf.space
mov rcx, rax
call fcn.14002d1c0
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.14002d120
lea rdx, [rbp - 0x31]
mov r8, rdx
mov rdx, rax
lea rax, [0x1401230e0]
mov rcx, rax
call fcn.1400c0030
lea rax, [rbp - 0x31]
mov rcx, rax
call fcn.1400afb10
nop
lea rax, [0x1400063e2]
mov rcx, rax
call fcn.140001583
jmp 0x140006597
add rsp, 0xc8
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x140010540
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.14001bef0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop
Function at 0x140011212
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x1401231c8]
test eax, eax
je 0x1400112aa
lea rax, [0x1401231a0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x1401231d0]
mov qword [rbp - 8], rax
jmp 0x14001128e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x140011282
cmp qword [rbp - 0x10], 0
je 0x140011282
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140011248
lea rax, [0x1401231a0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x1400112ab
nop
add rsp, 0x30
pop rbp
ret

Function at 0x1400113b0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400113d8
mov eax, 0
jmp 0x140011426
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140011401
mov eax, 0
jmp 0x140011426
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x140011421
mov eax, 0
jmp 0x140011426
mov eax, 1
add rsp, 0x20
pop rbp
ret

Function at 0x14001142c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x1400114aa
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x1400114a1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x1400114a1
mov rax, qword [rbp - 8]
jmp 0x1400114bf
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x140011474
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x14001f479
Capabilities:
Print debug messages

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x90
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
cmp qword [rbp + 0x10], 0
je 0x14001f5c4
mov rax, qword [rbp + 0x10]
mov rcx, rax
call fcn.14001ea9d
cmp eax, 1
jne 0x14001f5b7
movabs rax, 0x6c6320726f727245
movabs rdx, 0x7520676e696e6165
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rdx
movabs rax, 0x6b5f6e6970732070
movabs rdx, 0x20726f6620737965
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rdx
movabs rax, 0x20646165726874
mov edx, 0
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rdx
mov qword [rbp - 0x40], 0
mov qword [rbp - 0x38], 0
mov qword [rbp - 0x30], 0
mov qword [rbp - 0x28], 0
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x18], 0
mov qword [rbp - 0x15], 0
mov qword [rbp - 0xd], 0
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call rax
mov ecx, eax
lea rax, [rbp - 0x70]
add rax, 0x27
mov r8d, 0xa
mov rdx, rax
mov rax, qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ultoa]
call rax
mov dword [rbp - 4], 0x27
jmp 0x14001f56d
add dword [rbp - 4], 1
mov eax, dword [rbp - 4]
cdqe
movzx eax, byte [rbp + rax - 0x70]
test al, al
je 0x14001f583
mov eax, dword [rbp - 4]
cmp eax, 0x69
jbe 0x14001f569
mov eax, dword [rbp - 4]
cmp eax, 0x69
ja 0x14001f5a2
mov eax, dword [rbp - 4]
cdqe
mov byte [rbp + rax - 0x70], 0xa
mov eax, dword [rbp - 4]
add eax, 1
cdqe
mov byte [rbp + rax - 0x70], 0
lea rax, [rbp - 0x70]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rax
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov rax, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x18]
mov qword [rax], rdx
jmp 0x14001f5c5
nop
add rsp, 0x90
pop rbp
ret
Function at 0x1400207d7
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xffffffffffffffff
lea rax, [0x1400205fa]
mov rdx, rax
lea rax, [0x140123c50]
mov rcx, rax
call fcn.14001fbf2
mov eax, dword [0x1400e51e0]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
je 0x14002082a
mov rax, qword [rbp - 0x10]
jmp 0x14002098a
call fcn.14001f355
mov qword [rbp - 0x10], rax
mov rax, qword [0x140127048]
test rax, rax
je 0x140020846
cmp qword [rbp - 0x10], 0
jne 0x140020850
mov eax, 0
jmp 0x14002098a
mov rax, qword [rbp - 0x10]
mov dword [rax + 0x44], 1
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call rax
mov rdx, qword [rbp - 0x10]
mov dword [rdx + 0x70], eax
mov r9d, 0
mov r8d, 0
mov edx, 1
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateEventA]
call rax
mov rdx, qword [rbp - 0x10]
mov qword [rdx + 0x30], rax
mov rax, qword [rbp - 0x10]
mov qword [rax + 0x38], 0xffffffffffffffff
mov rax, qword [rbp - 0x10]
lea rcx, [rax + 0x68]
mov rax, qword [rbp - 8]
mov rdx, rax
call fcn.14001f479
mov rax, qword [rbp - 0x10]
mov dword [rax + 0xb8], 0
mov rax, qword [rbp - 0x10]
mov qword [rax + 0x28], 0
mov rax, qword [rbp - 0x10]
lea rdi, [rax + 0x28]
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov rsi, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call rax
mov rbx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, rdi
mov r8, rsi
mov rdx, rbx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DuplicateHandle]
call rax
test eax, eax
jne 0x14002092b
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x28]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetThreadPriority]
call rax
mov rdx, qword [rbp - 0x10]
mov dword [rdx + 0xc0], eax
mov rax, qword [rbp - 0x10]
mov dword [rax + 0xbc], 0
mov rax, qword [rbp - 0x10]
movzx edx, byte [rax + 0x40]
and edx, 0xffffffcf
or edx, 0x10
mov byte [rax + 0x40], dl
mov eax, dword [0x1400e51e0]
mov rdx, qword [rbp - 0x10]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
test eax, eax
jne 0x140020986
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov rax, qword [rbp - 0x10]
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x140020a87
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp - 0x10], 0
mov rax, qword [rbp + 0x10]
mov dword [rbp - 4], eax
call fcn.1400207d7
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
mov rdx, qword [rbp + 0x10]
mov qword [rax + 8], rdx
mov rax, qword [rbp - 0x18]
mov rax, qword [rax + 0x1d8]
mov rcx, rax
call fcn.140020628
mov rax, qword [rbp - 0x18]
movzx eax, byte [rax + 0x40]
and eax, 0x30
test al, al
jne 0x140020af4
mov rax, qword [rbp - 0x18]
add rax, 0xd0
mov edx, 1
mov rcx, rax
mov rax, qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_longjmp]
call rax
mov eax, dword [0x1400e51e0]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
je 0x140020c38
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x28]
test rax, rax
jne 0x140020b91
mov rax, qword [rbp - 0x10]
mov dword [rax], 0xdeadbeef
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x30]
test rax, rax
je 0x140020b4c
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x10]
mov qword [rax + 0x30], 0
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 8]
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call fcn.14001f22e
mov qword [rbp - 0x10], 0
mov eax, dword [0x1400e51e0]
mov rdx, qword [rbp - 0x10]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
jmp 0x140020c38
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 8]
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov dword [rax + 0xbc], 1
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x30]
test rax, rax
je 0x140020bcb
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x10]
mov qword [rax + 0x30], 0
mov rax, qword [rbp - 0x10]
mov eax, dword [rax + 0x44]
and eax, 4
test eax, eax
je 0x140020c38
mov rax, qword [rbp - 0x10]
mov dword [rax], 0xdeadbeef
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x28]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x10]
mov qword [rax + 0x28], 0
mov rax, qword [rbp - 0x10]
mov rcx, rax
call fcn.14001f22e
mov qword [rbp - 0x10], 0
mov eax, dword [0x1400e51e0]
mov rdx, qword [rbp - 0x10]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
mov eax, dword [rbp - 4]
mov ecx, eax
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__endthreadex]
call rax
nop
Function at 0x140022d20
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov dword [rbp + 0x18], edx
lea rax, [0x1400e5200]
mov rcx, rax
call fcn.14001eaac
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov eax, dword [rax]
cmp eax, 0xbab1f0ed
jne 0x140022d5c
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov eax, dword [rax + 4]
test eax, eax
jg 0x140022d9c
mov ecx, 2
mov rax, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
call rax
mov rcx, rax
mov dword [rsp + 0x20], 0x28
lea r9, str..._.._.._mingw_w64_libraries_winpthreads_src_rwlock.c
lea r8, str.___rwlock_t__rwl___valid__LIFE_RWLOCK______rwlock_t__rwl___busy___0_
lea rax, str.Assertion_failed:___s___file__s__line__d_n
mov rdx, rax
call fcn.14001bfa0
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov edx, dword [rax + 4]
sub edx, 1
mov dword [rax + 4], edx
lea rax, [0x1400e5200]
mov rcx, rax
call fcn.14001eb2b
mov eax, dword [rbp + 0x18]
add rsp, 0x30
pop rbp
ret
Function at 0x1400976c0
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
mov rcx, qword [rdi]
call sub.api_ms_win_crt_stdio_l1_1_0.dll__fileno
mov ecx, eax
mov r8d, ebx
mov rdx, rsi
call sub.api_ms_win_crt_stdio_l1_1_0.dll__read
movsxd rbp, eax
cmp eax, 0xffffffff
je 0x140097708
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call r12
cmp dword [rax], 4
je 0x1400976da
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x1400aa1c0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov rdi, rcx
test rax, rax
je 0x1400aa1e8
mov rcx, qword [rcx]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
mov rbp, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ebx, 4
lea rsi, [rsp + 0x2c]
nop dword [rax]
mov ecx, dword [rdi + 0x10]
mov r8d, ebx
mov rdx, rsi
call sub.api_ms_win_crt_stdio_l1_1_0.dll__read
test eax, eax
jle 0x1400aa230
cdqe
add rsi, rax
sub rbx, rax
jne 0x1400aa200
mov eax, dword [rsp + 0x2c]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp eax, 0xffffffff
jne 0x1400aa23c
call rbp
cmp dword [rax], 4
je 0x1400aa200
lea rcx, str.random_device_could_not_be_read
call fcn.1400e34d0
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x1400b6900
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov dword [rbp - 0x14], 0x80000000
mov dword [rbp - 0x18], 0x7fffffff
mov qword [rbp - 8], 0
jmp 0x1400b6992
mov rax, qword [rbp + 0x10]
mov rdx, qword [rbp - 8]
mov eax, dword [rax + rdx*4]
and eax, 0x80000000
mov ecx, eax
mov rax, qword [rbp - 8]
lea rdx, [rax + 1]
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + rdx*4]
and eax, 0x7fffffff
or eax, ecx
mov dword [rbp - 0x24], eax
mov rax, qword [rbp - 8]
lea rdx, [rax + 0x18d]
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + rdx*4]
mov edx, dword [rbp - 0x24]
shr edx, 1
xor edx, eax
mov eax, dword [rbp - 0x24]
and eax, 1
test eax, eax
je 0x1400b6979
mov eax, 0x9908b0df
jmp 0x1400b697e
mov eax, 0
xor eax, edx
mov ecx, eax
mov rax, qword [rbp + 0x10]
mov rdx, qword [rbp - 8]
mov dword [rax + rdx*4], ecx
add qword [rbp - 8], 1
cmp qword [rbp - 8], 0xe2
jbe 0x1400b6924
mov qword [rbp - 0x10], 0xe3
jmp 0x1400b6a14
mov rax, qword [rbp + 0x10]
mov rdx, qword [rbp - 0x10]
mov eax, dword [rax + rdx*4]
and eax, 0x80000000
mov ecx, eax
mov rax, qword [rbp - 0x10]
lea rdx, [rax + 1]
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + rdx*4]
and eax, 0x7fffffff
or eax, ecx
mov dword [rbp - 0x20], eax
mov rax, qword [rbp - 0x10]
lea rdx, [rax - 0xe3]
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + rdx*4]
mov edx, dword [rbp - 0x20]
shr edx, 1
xor edx, eax
mov eax, dword [rbp - 0x20]
and eax, 1
test eax, eax
je 0x1400b69fb
mov eax, 0x9908b0df
jmp 0x1400b6a00
mov eax, 0
xor eax, edx
mov ecx, eax
mov rax, qword [rbp + 0x10]
mov rdx, qword [rbp - 0x10]
mov dword [rax + rdx*4], ecx
add qword [rbp - 0x10], 1
cmp qword [rbp - 0x10], 0x26e
jbe 0x1400b69a6
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x9bc]
and eax, 0x80000000
mov edx, eax
mov rax, qword [rbp + 0x10]
mov eax, dword [rax]
and eax, 0x7fffffff
or eax, edx
mov dword [rbp - 0x1c], eax
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x630]
mov edx, dword [rbp - 0x1c]
shr edx, 1
xor edx, eax
mov eax, dword [rbp - 0x1c]
and eax, 1
test eax, eax
je 0x1400b6a61
mov eax, 0x9908b0df
jmp 0x1400b6a66
mov eax, 0
xor edx, eax
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x9bc], edx
mov rax, qword [rbp + 0x10]
mov qword [rax + 0x9c0], 0
nop
add rsp, 0x30
pop rbp
ret