joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006dd48
Capabilities:
Encode data using xor

Disassembly:
push r14
push r13
push rdi
push rsi
push rbx
sub rsp, 0x50
xor edi, edi
mov rsi, qword [rsp + 0xb0]
mov r13, rdx
mov r14d, r8d
mov rbx, r9
test rsi, rsi
je 0x14006dd71
mov edi, dword [rsi + 0x10]
mov rsi, qword [rsi]
mov rax, qword [rbx]
mov qword [rsp + 0x48], rax
mov rax, qword [rcx]
cmp qword [rax + 0x2d0], 0
je 0x14006ddc2
mov qword [rsp + 0x80], rcx
call fcn.1400213c2
mov rcx, qword [rsp + 0x80]
lea r9, [rsp + 0x48]
mov rdx, r13
mov r8, rax
mov rax, qword [rcx]
mov qword [rsp + 0x30], r8
mov r8d, r14d
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rsi
call qword [rax + 0x2d0]
jmp 0x14006ddf2
mov rdx, qword [rcx + 0x98]
mov rcx, qword [rsp + 0xa8]
call fcn.140046ce4
test eax, eax
jne 0x14006de37
mov r9, qword [rsp + 0xa8]
lea r8, [rsp + 0x48]
mov edx, r14d
mov rcx, r13
call fcn.14004609b
mov edx, eax
lea eax, [rax - 1]
mov r8, qword [rsp + 0xa0]
lea r10, [rsp + 0x48]
shr eax, 0x1f
lea r9d, [rax - 1]
neg eax
movsx ecx, r9b
and eax, edx
and ecx, edx
xor edx, edx
mov dword [r8], ecx
mov r8b, byte [rbx + rdx]
mov cl, byte [rdx + r10]
xor ecx, r8d
and ecx, r9d
xor ecx, r8d
mov byte [rbx + rdx], cl
inc rdx
cmp rdx, 8
jne 0x14006de1a
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop r13
pop r14
ret

Function at 0x14006ea8e
Capabilities:
Hash data using sha512

Disassembly:
push rdi
push rbx
sub rsp, 0x28
cmp qword [rcx + 0x80], 0
mov rbx, rcx
je 0x14006eaa6
call fcn.14006ea26
mov ecx, 0x3f0
call fcn.14004eee8
mov qword [rbx + 0x80], rax
mov rdx, rax
test rax, rax
je 0x14006eb3c
xor eax, eax
mov rdi, rdx
mov ecx, 0xfc
rep stosd dword [rdi], eax
mov rax, qword [rbx + 0x80]
mov rdx, qword [rbx + 0xb0]
mov r8d, dword [rbx + 0x1410]
lea rcx, [rax + 0x1b0]
call fcn.14004424c
test eax, eax
jne 0x14006eb41
mov rax, qword [rbx + 0x80]
mov rdx, qword [rbx + 0xb0]
mov r8d, dword [rbx + 0x1410]
lea rcx, [rax + 0x230]
call fcn.14004d0e6
test eax, eax
jne 0x14006eb41
mov rax, qword [rbx + 0x80]
mov rdx, qword [rbx + 0xb0]
mov r8d, dword [rbx + 0x1410]
lea rcx, [rax + 0x310]
add rsp, 0x28
pop rbx
pop rdi
jmp fcn.14004cdb3
mov eax, 0xffffff83
add rsp, 0x28
pop rbx
pop rdi
ret
Function at 0x140071b12
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xd8
mov r11d, 0xff
mov r12d, dword [rsp + 0x140]
lea r14d, [r12 - 1]
mov r10d, r12d
movsxd rsi, r14d
add rsi, rdx
mov rdi, rcx
sub r10d, r9d
sub r9d, r12d
movzx ecx, byte [rsi]
mov rbp, rdx
lea ebx, [r9 + rcx]
mov edx, ecx
shr ebx, 0x1f
dec ebx
cmp r14d, 0xff
cmovle r11d, r14d
xor eax, eax
cmp r11d, eax
jle 0x140071b95
mov r9d, r14d
sub r9d, eax
movsxd r9, r9d
mov r13b, byte [rbp + r9]
mov r9d, ecx
sub r9d, eax
inc eax
shr r9d, 0x1f
xor r13d, edx
dec r9d
and r9d, r13d
or ebx, r9d
jmp 0x140071b68
mov ecx, dword [rsp + 0x148]
mov eax, r8d
mov dword [rsp + 0x20], r8d
lea rdx, [rsp + 0x50]
not eax
mov r8, rbp
mov dword [rsp + 0x38], 1
lea r9d, [rax + r10]
mov dword [rsp + 0x28], ecx
mov rcx, rdi
mov dword [rsp + 0x30], 1
call qword [rdi + 0x108]
movzx r9d, byte [rdi + 0x2f7]
lea r10d, [r12 - 0x100]
mov r13d, eax
movzx eax, byte [rsi]
sub r10d, r9d
lea r8d, [r9 - 1]
mov rcx, r9
sub r14d, eax
mov eax, r10d
shr eax, 0x1f
mov esi, r14d
sub esi, r9d
dec eax
and r10d, eax
mov eax, esi
shr eax, 0x1f
dec eax
and esi, eax
mov eax, r9d
and eax, r8d
mov dword [rsp + 0x48], eax
jne 0x140071c26
mov r11d, r9d
sub r11d, r10d
add r11d, esi
and r11d, r8d
jmp 0x140071c44
cmp r9d, 0x14
je 0x140071c35
xor r11d, r11d
cmp r9d, 0x30
jne 0x140071c44
mov eax, r9d
sub eax, r10d
add eax, esi
cdq
idiv r9d
mov r11d, edx
lea rdx, [rsp + 0x90]
xor eax, eax
lea r15, [rsp + 0x8f]
mov rdi, rdx
rep stosb byte [rdi], al
mov edi, r12d
mov eax, r14d
sub edi, esi
sub eax, r10d
mov dword [rsp + 0x4c], edi
cmp r12d, r10d
jle 0x140071cc0
movsxd rcx, r10d
mov r14d, r10d
xor edx, edx
lea rdi, [rbp + rcx]
sub r14d, esi
mov qword [rsp + 0x40], rdi
cmp r9d, edx
jle 0x140071cb8
inc rdx
cmp dword [rsp + 0x4c], r14d
je 0x140071cb8
mov rdi, qword [rsp + 0x40]
mov ecx, r14d
inc r14d
shr ecx, 0x1f
dec ecx
and cl, byte [rdi + rdx - 1]
mov edi, eax
sub edi, edx
shr edi, 0x1f
dec edi
and ecx, edi
or byte [r15 + rdx], cl
jmp 0x140071c84
add r10d, r9d
sub eax, r9d
jmp 0x140071c6a
cmp dword [rsp + 0x48], 0
jne 0x140071cf6
xor eax, eax
xor ecx, ecx
lea r10, [rsp + 0x50]
cmp r9d, eax
jle 0x140071d5c
lea edx, [r11 + rax]
inc rax
and edx, r8d
movsxd rdx, edx
mov dl, byte [rsp + rdx + 0x90]
xor dl, byte [rax + r10 - 1]
or ecx, edx
jmp 0x140071cd0
cmp r9d, 0x14
jne 0x140071d2a
xor r8d, r8d
xor ecx, ecx
lea r10, [rsp + 0x50]
lea eax, [r11 + r8]
inc r8
cdq
idiv r9d
movsxd rdx, edx
mov al, byte [rsp + rdx + 0x90]
xor al, byte [r8 + r10 - 1]
or ecx, eax
cmp r8, 0x14
jne 0x140071d06
jmp 0x140071d5c
xor ecx, ecx
cmp r9d, 0x30
jne 0x140071d5c
xor r8d, r8d
lea r10, [rsp + 0x50]
lea eax, [r11 + r8]
inc r8
cdq
idiv r9d
movsxd rdx, edx
mov al, byte [rsp + rdx + 0x90]
xor al, byte [r8 + r10 - 1]
or ecx, eax
cmp r8, 0x30
jne 0x140071d3a
or ecx, ebx
not ecx
mov ebx, ecx
shr bl, 4
and ebx, ecx
mov ecx, ebx
shr cl, 2
and ebx, ecx
mov ecx, ebx
shr cl, 1
and ecx, ebx
movzx ecx, cl
lea eax, [r13 + rcx - 1]
test eax, eax
je 0x140071d85
mov eax, 0xfffffecf
add rsp, 0xd8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14007f8f0
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.14008d740
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.14008d740
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]
Function at 0x14007f960
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x1400c9cc4]
mov r12, rcx
mov rsi, rdx
mov rbx, r8
test edi, edi
jle 0x14007fb10
mov rax, qword [0x1400c9cc8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp r12, rdx
jb 0x14007f9ac
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x14007fa37
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x14007f990
mov rcx, r12
call fcn.140080410
mov rbp, rax
test rax, rax
je 0x14007fb6d
mov rax, qword [0x1400c9cc8]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call fcn.140080540
mov ecx, dword [rbp + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x1400c9cc8]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14007fb52
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x14007fa30
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x14007fac0
add dword [0x1400c9cc4], 1
cmp ebx, 8
jae 0x14007fa68
test bl, 4
jne 0x14007fb20
test ebx, ebx
je 0x14007fa59
movzx eax, byte [rsi]
mov byte [r12], al
test bl, 2
jne 0x14007fb40
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi]
lea rcx, [r12 + 8]
and rcx, 0xfffffffffffffff8
mov qword [r12], rax
mov eax, ebx
mov rdx, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], rdx
sub r12, rcx
add ebx, r12d
sub rsi, r12
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x14007fa59
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x14007fa9a
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rdi, qword [0x1400c9cc8]
mov qword [rdi + 8], rcx
mov r9, rdi
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14007fa30
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.14007f8f0
xor edi, edi
jmp 0x14007f9b7
mov eax, dword [rsi]
mov ebx, ebx
mov dword [r12], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r12 + rbx - 4], eax
jmp 0x14007fa59
mov ebx, ebx
movzx eax, word [rsi + rbx - 2]
mov word [r12 + rbx - 2], ax
jmp 0x14007fa59
mov rax, qword [0x1400c9cc8]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call fcn.14007f8f0
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.14007f8f0
nop
nop dword [rax]
Function at 0x140080080
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x1400c9d20]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400c9d00]
test rbx, rbx
je 0x1400800d4
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x1400800cb
test r12, r12
je 0x1400800cb
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1400800b0
lea rcx, [0x1400c9d20]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140080410
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x1400afe10]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x140080489
mov rcx, r10
call fcn.1400802e0
test eax, eax
je 0x140080489
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x140080486
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x14008047d
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x140080489
add r8, 0x28
cmp r8, r9
jne 0x140080468
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret

Function at 0x14008e080
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x140095228], eax
cmp eax, 0xffffffff
je 0x140093390
add rsp, 0x28
ret

Function at 0x14008e6e0
Capabilities:
Print debug messages

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x98
mov rbx, rcx
test rcx, rcx
je 0x14008e705
call fcn.140091c70
cmp eax, 1
je 0x14008e712
mov qword [rbx], 0xffffffffffffffff
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop r12
ret
lea r12, [rsp + 0x20]
xor eax, eax
mov ecx, 0xa
lea rsi, str.Error_cleaning_up_spin_keys_for_thread
mov rdi, r12
rep movsd dword [rdi], dword [rsi]
lea rdi, [rsp + 0x48]
mov ecx, 0x43
rep stosb byte [rdi], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [rsp + 0x47]
mov r8d, 0xa
mov ecx, eax
call qword [sym.imp.msvcrt.dll__ultoa]
cmp byte [rsp + 0x47], 0
je 0x14008e798
mov eax, 0x28
jmp 0x14008e76a
add rax, 1
cmp rax, 0x6b
je 0x14008e78a
cmp byte [r12 + rax], 0
mov edx, eax
jne 0x14008e760
cmp eax, 0x6a
je 0x14008e78a
movsxd rax, edx
mov byte [rsp + rax + 0x20], 0xa
lea eax, [rdx + 1]
cdqe
mov byte [rsp + rax + 0x20], 0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call sub.msvcrt.dll_abort
mov edx, 0x27
jmp 0x14008e778
Function at 0x14008e7a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x48
cmp dword [0x1400ca7c0], 1
je 0x14008e7b7
call fcn.14008e650
mov ecx, dword [0x140095228]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12, rax
test rax, rax
je 0x14008e7e0
mov rax, r12
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop r12
ret
call fcn.14008e580
cmp qword [0x1400cd050], 0
mov rbx, rax
je 0x14008e7cb
test rax, rax
je 0x14008e7cb
mov dword [rax + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
mov dword [rbx + 0x70], eax
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x38], 0xffffffffffffffff
lea rcx, [rbx + 0x68]
mov qword [rbx + 0x30], rax
call fcn.14008e6e0
mov rdi, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rbx + 0xb8], 0
mov qword [rbx + 0x28], 0
call rdi
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r12, rax
call rdi
mov dword [rsp + 0x30], 2
mov r8, rsi
mov rdx, r12
mov dword [rsp + 0x28], 0
mov rcx, rax
lea r9, [rbx + 0x28]
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x140093396
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov ecx, dword [0x140095228]
mov rdx, rbx
mov dword [rbx + 0xbc], 0
mov dword [rbx + 0xc0], eax
movzx eax, byte [rbx + 0x40]
and eax, 0xffffffcf
or eax, 0x10
mov byte [rbx + 0x40], al
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x140093396
mov r12, rbx
mov rax, r12
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop r12
ret
Function at 0x14008f9a0
Capabilities:
Hijack thread execution

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x4f8
mov rsi, rcx
call fcn.14008e8e0
mov rbx, rax
test rax, rax
je 0x14008fa6c
mov rcx, qword [rax + 0x28]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14008fa6c
lea r12, [rsp + 0x20]
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x14008fa6c
lea r13, [rbx + 0x38]
mov rcx, r13
call fcn.14008d940
call fcn.14008e7a0
test rax, rax
je 0x14008faf0
mov rdx, qword [rax + 0x1d8]
movzx eax, byte [rbx + 0x40]
cmp rsi, rdx
je 0x14008fa80
mov edx, dword [rbx + 0x44]
and edx, 3
cmp edx, 3
je 0x14008fa60
test al, 3
jne 0x14008fad8
and eax, 0xfffffffc
or eax, 1
mov byte [rbx + 0x40], al
lock add dword [0x1400ca7c8], 1
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14008fa46
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, r13
call fcn.14008dc60
xor eax, eax
add rsp, 0x4f8
pop rbx
pop rsi
pop r12
pop r13
ret
test al, 0xc
jne 0x14008fad8
test al, 0xf
je 0x14008fb00
mov eax, 3
add rsp, 0x4f8
pop rbx
pop rsi
pop r12
pop r13
ret
test al, 3
jne 0x14008fad8
and eax, 0xfffffffc
or eax, 1
mov byte [rbx + 0x40], al
lock add dword [0x1400ca7c8], 1
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14008faa4
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [rbx + 0x44]
mov edx, eax
and edx, 3
cmp edx, 3
jne 0x14008fa46
and eax, 0xfffffffe
mov rcx, r13
mov dword [rbx + 0x44], eax
movzx eax, byte [rbx + 0x40]
and eax, 0xfffffff3
or eax, 4
mov byte [rbx + 0x40], al
call fcn.14008dc60
call fcn.14008f730
nop dword [rax]
mov rcx, r13
call fcn.14008dc60
test byte [rbx + 0x40], 0xc
jne 0x14008fa6c
xor eax, eax
jmp 0x14008fa50
xor edx, edx
jmp 0x14008fa0a
mov rcx, qword [rbx + 0x28]
mov dword [rsp + 0x50], 0x100001
call qword [sym.imp.KERNEL32.dll_SuspendThread]
xor edx, edx
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x14008fa46
mov rcx, qword [rbx + 0x28]
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
lea rax, [fcn.14008f730]
mov rcx, qword [rbx + 0x28]
mov rdx, r12
mov qword [rsp + 0x118], rax
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
movzx eax, byte [rbx + 0x40]
and dword [rbx + 0x44], 0xfffffffe
and eax, 0xfffffff0
or eax, 5
mov byte [rbx + 0x40], al
lock add dword [0x1400ca7c8], 1
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14008fb7a
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, r13
call fcn.14008dc60
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x14008fa46
Function at 0x14008fec0
Capabilities:
Create thread
Resume thread

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rdi, rcx
mov rsi, rdx
mov rbx, r8
mov rbp, r9
call fcn.14008e580
mov r12, rax
test rax, rax
je 0x140090130
test rdi, rdi
je 0x14008fefa
mov rax, qword [rax + 0x1d8]
mov qword [rdi], rax
mov r13, qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [r12 + 8], rbp
mov dword [r12 + 0x44], 1
mov rbp, qword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [r12 + 0xbc], 0
mov r14, r13
mov qword [r12 + 0x28], 0xffffffffffffffff
mov qword [r12 + 0x10], rbx
xor ebx, ebx
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call rbp
mov qword [r12 + 0x30], rax
test rax, rax
jne 0x14008ff70
test ebx, ebx
je 0x14008ff68
mov ecx, 0x14
call r14
cmp ebx, 4
je 0x14008ff70
add ebx, 1
jmp 0x14008ff35
xor ecx, ecx
call r13
jmp 0x14008ff5f
mov qword [r12 + 0x38], 0xffffffffffffffff
lea r14, [r12 + 0x68]
mov rcx, r14
call fcn.14008e6e0
cmp qword [r12 + 0x30], 0
mov dword [r12], 0xbab1f00d
mov dword [r12 + 0xc0], 0
mov dword [r12 + 0xb8], 0
je 0x1400900dc
xor edx, edx
test rsi, rsi
je 0x14008ffd6
mov eax, dword [rsi]
mov edx, dword [rsi + 0x10]
mov dword [r12 + 0x44], eax
test al, 8
jne 0x140090108
mov eax, dword [rsi + 0x18]
mov dword [r12 + 0xc0], eax
lea r8, [0x14008ec50]
mov r9, r12
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov r13, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400900a8
mov eax, dword [r12 + 0xc0]
mov edx, 0xfffffff1
cmp eax, 0xfffffff2
jge 0x140090080
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [r12 + 0x30]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
test byte [r12 + 0x44], 4
jne 0x140090060
mov qword [r12 + 0x28], r13
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov qword [r12 + 0x28], 0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140090046
mov edx, 0xfffffffe
cmp eax, 0xffffffff
jl 0x14009001c
mov edx, 0xf
cmp eax, 0xe
jg 0x14009001c
cmp eax, 2
mov edx, 2
cmovle edx, eax
jmp 0x14009001c
mov rcx, qword [r12 + 0x30]
test rcx, rcx
je 0x1400900b8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [r12 + 0x38]
call fcn.14008de30
mov rcx, r14
call fcn.14008e6e0
mov qword [r12 + 0x30], 0
mov qword [r12 + 0x28], 0
test rdi, rdi
je 0x1400900e8
mov qword [rdi], 0
mov rcx, r12
call fcn.14008e2d0
mov eax, 0xb
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov dword [rsp + 0x3c], edx
call fcn.14008e7a0
mov edx, dword [rsp + 0x3c]
mov eax, dword [rax + 0xc0]
mov dword [r12 + 0xc0], eax
jmp 0x14008ffd6
mov eax, 0xb
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x14000ade0
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140016f20
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.140016f20
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]
Function at 0x14000ae50
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x1400df0a4]
mov r12, rcx
mov rsi, rdx
mov rbx, r8
test edi, edi
jle 0x14000b000
mov rax, qword [0x1400df0a8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp r12, rdx
jb 0x14000ae9c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x14000af27
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x14000ae80
mov rcx, r12
call fcn.14000b900
mov rbp, rax
test rax, rax
je 0x14000b05d
mov rax, qword [0x1400df0a8]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call fcn.14000ba30
mov ecx, dword [rbp + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x1400df0a8]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14000b042
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x14000af20
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x14000afb0
add dword [0x1400df0a4], 1
cmp ebx, 8
jae 0x14000af58
test bl, 4
jne 0x14000b010
test ebx, ebx
je 0x14000af49
movzx eax, byte [rsi]
mov byte [r12], al
test bl, 2
jne 0x14000b030
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi]
lea rcx, [r12 + 8]
and rcx, 0xfffffffffffffff8
mov qword [r12], rax
mov eax, ebx
mov rdx, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], rdx
sub r12, rcx
add ebx, r12d
sub rsi, r12
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x14000af49
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x14000af8a
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rdi, qword [0x1400df0a8]
mov qword [rdi + 8], rcx
mov r9, rdi
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14000af20
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.14000ade0
xor edi, edi
jmp 0x14000aea7
mov eax, dword [rsi]
mov ebx, ebx
mov dword [r12], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r12 + rbx - 4], eax
jmp 0x14000af49
mov ebx, ebx
movzx eax, word [rsi + rbx - 2]
mov word [r12 + rbx - 2], ax
jmp 0x14000af49
mov rax, qword [0x1400df0a8]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call fcn.14000ade0
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.14000ade0
nop
nop dword [rax]