joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002b3d0
Capabilities:
Encode data using base64
Get thread local storage value
Resolve function by parsing pe exports
Set thread local storage value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov r14, qword [rsp + 0xc0]
mov r13, qword [rsp + 0xc8]
mov r12, qword [rsp + 0xd0]
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
mov ebp, r9d
mov qword [rsp + 0x48], 0
test rcx, rcx
je 0x14002b500
call fcn.140025d30
mov rdx, rax
mov rax, qword [rbx]
test rax, rax
je 0x14002b42b
cmp qword [rax], rdx
je 0x14002b43b
mov rcx, rbx
call fcn.1400b1670
test eax, eax
je 0x14002b500
test rsi, rsi
je 0x14002b4c0
test rdi, rdi
je 0x14002b5a0
js 0x14002b510
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.140025e90
test eax, eax
je 0x14002b600
mov rax, qword [rbx + 0x18]
mov r15, qword [rbx]
mov rcx, rbx
mov qword [rax + 8], r13
call fcn.1400a9ca0
mov r9d, ebp
mov r8, rdi
mov rdx, rsi
lea rax, [0x140026240]
mov qword [rsp + 0xd0], r12
mov rcx, rbx
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0xc0], r14
mov rax, qword [r15 + 0xa0]
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp rax
lea rax, [0x14036b268]
lea r9, str.g_input_stream_read_async
lea r8, [0x14036aa17]
mov edx, 8
mov qword [rsp + 0xc0], rax
lea rcx, [0x14036a973]
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.1400d2190
lea rax, [0x14036aa31]
jmp 0x14002b4c7
mov rcx, qword [0x14048def0]
mov rax, qword [rcx]
test rax, rax
je 0x14002b638
lea rdx, [0x14036b298]
lea rcx, [0x14036a7e5]
call fcn.1400c7f40
mov rdi, qword [0x14048eee0]
mov rsi, rax
mov eax, dword [rdi]
test eax, eax
jne 0x14002b554
lea rcx, [0x14036a7ec]
call fcn.1400daa90
mov dword [rdi], eax
mov qword [rsp + 0x30], rsi
mov r8, r12
mov rdx, r13
mov rcx, rbx
lea rdi, str.g_input_stream_read_async
mov dword [rsp + 0x28], 0xd
lea r9, [fcn.14002b3d0]
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x20], eax
call fcn.14002b370
nop
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rbx
mov r9, r12
mov r8, r13
mov rdx, r14
call fcn.140029f90
lea rdx, [fcn.14002b3d0]
mov rbx, rax
mov rcx, rax
call fcn.14002a300
mov rcx, rbx
call fcn.140030520
test rax, rax
je 0x14002b650
mov rcx, rbx
xor edx, edx
call fcn.1400325f0
mov rcx, rbx
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.1400a9ff0
mov rax, qword [rsp + 0x48]
mov r8, r12
mov rdx, r13
mov rcx, rbx
lea r9, [fcn.14002b3d0]
mov qword [rsp + 0xc0], rax
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.14002b020
call fcn.1400e7370
test eax, eax
je 0x14002b523
call fcn.1400cb3d0
jmp 0x14002b523
lea rdx, [0x14036b33f]
mov rcx, rbx
call fcn.14002a380
jmp 0x14002b5d4
Function at 0x14002edb0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x40]
call fcn.1400d5f30
mov rax, qword [rbx + 0x60]
test rax, rax
je 0x14002edd7
mov rcx, qword [rbx + 0x18]
mov r8, qword [rbx + 0x68]
mov rdx, rbx
call rax
or byte [rbx + 0x98], 1
mov rcx, rbx
lea rdx, str.completed
call fcn.1400acfa0
mov rcx, qword [rbx + 0x40]
add rsp, 0x20
pop rbx
jmp fcn.1400d8cc0

Function at 0x14002ef60
Capabilities:
Get thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rbx, rcx
lea rdi, [rcx + 0x78]
mov rsi, rdx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_InitializeSRWLock]
lea rcx, [rbx + 0x80]
call qword [sym.imp.KERNEL32.dll_InitializeConditionVariable]
mov rcx, rdi
call fcn.140341618
mov rcx, qword [rbx + 0x58]
mov qword [rbx + 0x70], rsi
test rcx, rcx
je 0x14002efd7
test byte [rbx + 0x94], 2
jne 0x14002f030
mov rcx, rbx
call fcn.1400a9ca0
mov rcx, qword [rbx + 0x58]
lea r8, [0x140031f90]
lea rdx, [0x14036c726]
mov r9, rax
lea rax, [0x14002ee70]
mov qword [rsp + 0x20], rax
call fcn.1402b2410
mov rax, qword [0x1404c9f80]
mov ecx, eax
test eax, eax
je 0x14002f020
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14002eff6
or byte [rbx + 0x9c], 4
mov rcx, rbx
call fcn.1400a9ca0
mov rdx, rax
mov rax, qword [0x14048f6e0]
mov rcx, qword [rax]
add rsp, 0x30
pop rbx
pop rsi
pop rdi
jmp fcn.1402b59b0
lea rcx, [0x1404c9f80]
call fcn.1401001a0
mov ecx, eax
jmp 0x14002efe4
lea rdx, [rbx + 0xa0]
call fcn.140042df0
test eax, eax
je 0x14002efa9
or byte [rbx + 0x94], 1
mov dword [rbx + 0x90], 0xffffffff
jmp 0x14002eff6

Function at 0x1400305a0
Capabilities:
Encode data using base64
Get thread local storage value
Resolve function by parsing pe exports
Set thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
mov rsi, rdx
test rcx, rcx
je 0x140030660
call fcn.140029820
mov rdx, rax
mov rax, qword [rbx]
test rax, rax
je 0x1400305cc
cmp qword [rax], rdx
je 0x1400305dc
mov rcx, rbx
call fcn.1400b1670
test eax, eax
je 0x140030660
mov rcx, rbx
lea rbp, [rbx + 0x80]
call fcn.1400a9ca0
or byte [rbx + 0x9c], 2
mov rdx, rsi
mov rcx, rbx
lea rsi, [rbx + 0x78]
call fcn.14002ef60
mov rdi, qword [sym.imp.KERNEL32.dll_SleepConditionVariableSRW]
test byte [rbx + 0x94], 1
jne 0x140030632
nop dword [rax]
xor r9d, r9d
mov r8d, 0xffffffff
mov rdx, rsi
mov rcx, rbp
call rdi
test byte [rbx + 0x94], 1
je 0x140030618
mov rcx, rsi
call fcn.140341260
or byte [rbx + 0x98], 1
mov rcx, rbx
lea rdx, str.completed
call fcn.1400acfa0
mov rcx, rbx
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.1400a9ff0
lea rax, [0x14036c739]
lea r9, str.g_task_run_in_thread_sync
mov edx, 8
mov qword [rsp + 0x20], rax
lea r8, [0x14036c6ea]
lea rcx, [0x14036c730]
call fcn.1400d2190
nop
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x140031110
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
mov rbp, qword [rsp + 0x58]
mov r12d, edx
movzx edx, word [rcx]
mov rax, rcx
cmp dx, 0x20
jne 0x14003113e
nop dword [rax]
movzx edx, word [rax + 2]
add rax, 2
cmp dx, 0x20
je 0x140031130
xor ebx, ebx
cmp dx, 0x22
jne 0x14003114f
add rax, 2
mov ebx, 1
movzx edx, word [rax]
test dx, dx
je 0x140031280
xor ecx, ecx
nop dword [rax]
add rcx, 1
cmp word [rax + rcx*2], 0
jne 0x140031160
lea r10, [rax + rcx*2]
cmp rax, r10
jae 0x1400312ba
mov edi, ebx
mov rcx, rax
xor r13d, r13d
xor r11d, r11d
xor edi, 1
xor esi, esi
and edi, r12d
jmp 0x1400311ae
cmp dx, 0x20
je 0x140031250
add r11, 1
mov rdx, rcx
lea rcx, [rdx + 2]
cmp rcx, r10
jae 0x1400311d0
movzx edx, word [rdx + 2]
cmp dx, 0x22
je 0x140031230
cmp dx, 0x2c
jne 0x140031190
test edi, edi
je 0x14003119a
mov rdx, r10
mov rsi, rcx
mov r13d, edi
lea rcx, [rdx + 2]
cmp rcx, r10
jb 0x1400311aa
test r13d, r13d
cmove rsi, r10
test r8, r8
je 0x1400311df
mov qword [r8], rax
test r9, r9
je 0x1400311e7
mov qword [r9], r11
test rbp, rbp
je 0x14003121c
mov rdx, rax
test r11, r11
je 0x140031218
lea rdx, [rax + r11*2 - 2]
cmp rax, rdx
jae 0x140031218
nop
movzx ecx, word [rdx]
cmp cx, 0x2f
je 0x140031270
cmp cx, 0x5c
je 0x140031270
sub rdx, 2
cmp rax, rdx
jb 0x140031200
mov qword [rbp], rdx
mov rax, qword [rsp + 0x60]
mov qword [rax], rsi
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
test ebx, ebx
je 0x14003119a
lea rsi, [rcx + 2]
mov r13d, ebx
mov rdx, r10
jmp 0x1400311a1
test ebx, ebx
jne 0x14003119a
mov rsi, rcx
mov rdx, r10
mov r13d, 1
jmp 0x1400311a1
add rdx, 2
jmp 0x140031218
mov rsi, rax
test r8, r8
je 0x1400312a4
mov qword [r8], rax
xor r11d, r11d
test r9, r9
jne 0x1400311e4
test rbp, rbp
je 0x14003121c
mov rdx, rax
jmp 0x140031218
test r9, r9
je 0x140031297
mov qword [r9], 0
test rbp, rbp
jne 0x14003129c
jmp 0x14003121c
mov rsi, r10
jmp 0x140031283
Function at 0x140031940
Capabilities:
Encode data using base64
Get thread local storage value
Resolve function by parsing pe exports
Set thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rsi, rcx
call fcn.1400a9ca0
mov rdi, qword [0x14048cc20]
mov rax, qword [rdi]
mov ecx, eax
test eax, eax
jne 0x140031969
mov rcx, rdi
call fcn.1401001a0
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140031b00
mov rbx, qword [rbx + 8]
test rbx, rbx
je 0x1400319a6
mov eax, dword [rbx + 0x18]
test eax, eax
jle 0x140031a40
mov rax, qword [rbx + 0x20]
test rax, rax
je 0x140031ae0
cmp qword [rsi + 0x40], rax
je 0x140031a77
mov edx, 0x68
lea rcx, [0x14035c020]
call fcn.1400d4150
mov edx, 0xc8
mov dword [rax + 0x60], 0
mov rbx, rax
mov rcx, rax
call fcn.1400d45b0
lea rdx, [0x14036cbbe]
mov r8d, 1
mov rcx, rbx
call fcn.1400d4940
mov rdx, qword [rsi + 0x28]
test rdx, rdx
je 0x140031ac0
xor r9d, r9d
lea r8, str._complete_in_idle_cb
lea rcx, str._gio_
call fcn.1400e4ea0
mov rcx, rbx
xor r8d, r8d
mov rdi, rax
mov rdx, rax
call fcn.1400d4940
mov rcx, rdi
call fcn.14034efb0
mov rcx, rsi
lea r8, [0x14002ee00]
mov rdx, rbx
call fcn.1400306a0
mov rcx, rbx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
jmp fcn.1400d9040
lea rax, [0x14036cb58]
mov qword [rsp + 0x20], rax
lea r9, str.g_source_get_context
lea r8, [0x14036c6ea]
mov edx, 8
lea rcx, [0x14036c9fa]
call fcn.1400d2190
xor eax, eax
cmp qword [rsi + 0x40], rax
jne 0x1400319a6
mov rcx, rbx
call fcn.1400d4fb0
cmp rax, qword [rsi + 0x48]
jle 0x1400319a6
mov rax, qword [rsi + 0x58]
test rax, rax
je 0x140031aa0
mov rax, qword [rax + 0x18]
mov eax, dword [rax]
test eax, eax
jne 0x1400319a6
mov rcx, rsi
call fcn.14002edb0
mov rcx, rsi
add rsp, 0x30
pop rbx
pop rsi
pop rdi
jmp fcn.1400a9ff0
mov r8d, 1
lea rdx, str._gio___unnamed__complete_in_idle_cb
mov rcx, rbx
call fcn.1400d4940
jmp 0x140031a1f
lea rax, str.source__context___NULL___SOURCE_DESTROYED__source_
test byte [rbx + 0x2c], 1
je 0x140031a47
xor eax, eax
jmp 0x140031a6d
mov edx, 0x10
mov ecx, 1
call sub.msvcrt.dll_calloc
mov rbx, rax
test rax, rax
je 0x140031b38
mov rax, qword [rdi]
mov ecx, eax
test eax, eax
jne 0x140031b2a
mov rcx, rdi
call fcn.1401001a0
mov ecx, eax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x14003197b
mov qword [rsp + 0x20], 0x10
lea r9, [0x14036c9c2]
lea r8, [0x14036c9d8]
mov edx, 4
lea rcx, [0x14036c9fa]
call fcn.1400d2190
jmp 0x140031b60
Function at 0x140032450
Capabilities:
Encode data using base64
Get thread local storage value
Resolve function by parsing pe exports
Set thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
mov rsi, rdx
test rcx, rcx
je 0x1400324e8
call fcn.140029820
mov rdx, rax
mov rax, qword [rbx]
test rax, rax
je 0x14003247a
cmp qword [rax], rdx
je 0x140032486
mov rcx, rbx
call fcn.1400b1670
test eax, eax
je 0x1400324e8
mov rcx, rbx
call fcn.1400a9ca0
mov rcx, rbx
mov rdx, rsi
call fcn.14002ef60
lea rcx, [rbx + 0x78]
test byte [rbx + 0x94], 1
je 0x1400324d0
call fcn.140341260
test byte [rbx + 0x9c], 2
jne 0x1400324d5
mov rcx, rbx
call fcn.140031940
mov rcx, rbx
add rsp, 0x38
pop rbx
pop rsi
jmp fcn.1400a9ff0
call fcn.140341260
mov rcx, rbx
add rsp, 0x38
pop rbx
pop rsi
jmp fcn.1400a9ff0
lea rax, [0x14036c739]
lea r9, str.g_task_run_in_thread
mov edx, 8
mov qword [rsp + 0x20], rax
lea r8, [0x14036c6ea]
lea rcx, [0x14036c730]
call fcn.1400d2190
nop
add rsp, 0x38
pop rbx
pop rsi
ret

Function at 0x140032520
Capabilities:
Encode data using base64
Get thread local storage value
Resolve function by parsing pe exports
Set thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rbx, rcx
mov rdi, rdx
mov rsi, r8
test rcx, rcx
je 0x1400325d0
call fcn.140029820
mov rdx, rax
mov rax, qword [rbx]
test rax, rax
je 0x14003254e
cmp qword [rax], rdx
je 0x14003255a
mov rcx, rbx
call fcn.1400b1670
test eax, eax
je 0x1400325d0
movzx eax, byte [rbx + 0x98]
test al, 8
jne 0x140032598
or eax, 0xc
mov qword [rbx + 0xa8], rdi
mov qword [rbx + 0xb0], rsi
mov byte [rbx + 0x98], al
test byte [rbx + 0x9c], 2
jne 0x14003258c
cmp qword [rbx + 0x70], 0
je 0x1400325e0
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
lea rax, str._task__ever_returned
mov qword [rsp + 0x20], rax
lea r9, str.g_task_return_pointer
lea r8, [0x14036c6ea]
mov edx, 8
lea rcx, [0x14036c730]
call fcn.1400d2190
nop
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
lea rax, [0x14036c739]
jmp 0x14003259f
mov rcx, rbx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
jmp fcn.140031940

Function at 0x1400325f0
Capabilities:
Encode data using base64
Get thread local storage value
Resolve function by parsing pe exports
Set thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
mov rsi, rdx
test rcx, rcx
je 0x140032698
call fcn.140029820
mov rdx, rax
mov rax, qword [rbx]
test rax, rax
je 0x14003261a
cmp qword [rax], rdx
je 0x140032626
mov rcx, rbx
call fcn.1400b1670
test eax, eax
je 0x140032698
movzx eax, byte [rbx + 0x98]
test al, 8
jne 0x140032660
or eax, 0xc
mov qword [rbx + 0xa8], rsi
mov byte [rbx + 0x98], al
test byte [rbx + 0x9c], 2
jne 0x140032651
cmp qword [rbx + 0x70], 0
je 0x1400326a8
add rsp, 0x38
pop rbx
pop rsi
ret
lea rax, str._task__ever_returned
mov qword [rsp + 0x20], rax
lea r9, str.g_task_return_int
lea r8, [0x14036c6ea]
mov edx, 8
lea rcx, [0x14036c730]
call fcn.1400d2190
nop
add rsp, 0x38
pop rbx
pop rsi
ret
lea rax, [0x14036c739]
jmp 0x140032667
mov rcx, rbx
add rsp, 0x38
pop rbx
pop rsi
jmp fcn.140031940
Function at 0x1400326c0
Capabilities:
Encode data using base64
Get thread local storage value
Resolve function by parsing pe exports
Set thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
mov esi, edx
test rcx, rcx
je 0x140032768
call fcn.140029820
mov rdx, rax
mov rax, qword [rbx]
test rax, rax
je 0x1400326e9
cmp qword [rax], rdx
je 0x1400326f5
mov rcx, rbx
call fcn.1400b1670
test eax, eax
je 0x140032768
movzx eax, byte [rbx + 0x98]
test al, 8
jne 0x140032730
or eax, 0xc
mov dword [rbx + 0xa8], esi
mov byte [rbx + 0x98], al
test byte [rbx + 0x9c], 2
jne 0x14003271f
cmp qword [rbx + 0x70], 0
je 0x140032778
add rsp, 0x38
pop rbx
pop rsi
ret
lea rax, str._task__ever_returned
mov qword [rsp + 0x20], rax
lea r9, str.g_task_return_boolean
lea r8, [0x14036c6ea]
mov edx, 8
lea rcx, [0x14036c730]
call fcn.1400d2190
nop
add rsp, 0x38
pop rbx
pop rsi
ret
lea rax, [0x14036c739]
jmp 0x140032737
mov rcx, rbx
add rsp, 0x38
pop rbx
pop rsi
jmp fcn.140031940

Function at 0x140032790
Capabilities:
Encode data using base64
Get thread local storage value
Resolve function by parsing pe exports
Set thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
mov rsi, rdx
test rcx, rcx
je 0x140032850
call fcn.140029820
mov rdx, rax
mov rax, qword [rbx]
test rax, rax
je 0x1400327ba
cmp qword [rax], rdx
je 0x1400327ca
mov rcx, rbx
call fcn.1400b1670
test eax, eax
je 0x140032850
movzx eax, byte [rbx + 0x98]
test al, 8
jne 0x140032808
test rsi, rsi
je 0x140032840
or eax, 8
mov qword [rbx + 0xa0], rsi
mov byte [rbx + 0x98], al
test byte [rbx + 0x9c], 2
jne 0x1400327fa
cmp qword [rbx + 0x70], 0
je 0x140032860
add rsp, 0x38
pop rbx
pop rsi
ret
lea rax, str._task__ever_returned
mov qword [rsp + 0x20], rax
lea r9, str.g_task_return_error
lea r8, [0x14036c6ea]
mov edx, 8
lea rcx, [0x14036c730]
call fcn.1400d2190
nop
add rsp, 0x38
pop rbx
pop rsi
ret
lea rax, [0x14036cc94]
jmp 0x14003280f
lea rax, [0x14036c739]
jmp 0x14003280f
mov rcx, rbx
add rsp, 0x38
pop rbx
pop rsi
jmp fcn.140031940
Function at 0x140039500
Capabilities:
Encode data using base64
Get thread local storage value
Resolve function by parsing pe exports
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
call fcn.14034efb0
mov rcx, qword [rbx + 0x30]
call fcn.14034efb0
mov rcx, qword [rbx + 0x60]
call fcn.14034efb0
mov rcx, qword [rbx + 0x70]
call fcn.14034efb0
mov rcx, qword [rbx + 0x50]
call fcn.14034efb0
mov rcx, qword [rbx + 0x80]
call fcn.14034efb0
mov rcx, qword [rbx]
mov qword [rbx], 0
test rcx, rcx
je 0x140039560
add rsp, 0x20
pop rbx
jmp fcn.1400a9ff0
add rsp, 0x20
pop rbx
ret

Function at 0x140039860
Capabilities:
Get common file path

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rbx, qword [0x1404ca058]
test rbx, rbx
je 0x140039890
mov rax, qword [0x1404ca058]
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
lea rsi, [0x1404ca058]
mov rcx, rsi
call fcn.1400e7370
test eax, eax
je 0x14003987a
mov r12, qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
xor edx, edx
xor ecx, ecx
call r12
mov edi, eax
test eax, eax
jne 0x140039910
xor ebp, ebp
mov r13, qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor edx, edx
xor ecx, ecx
call r13
mov edi, eax
test eax, eax
jne 0x140039950
mov edx, 0x18
mov ecx, 1
call sub.msvcrt.dll_calloc
test rax, rax
je 0x1400399ce
mov rdx, rax
test rbp, rbp
je 0x1400398f9
mov qword [rax], rbp
lea rax, [rdx + rbx*8 + 8]
mov qword [rax], 0
mov rcx, rsi
call fcn.1400e6720
jmp 0x14003987a
mov r14d, eax
add r14, r14
mov rcx, r14
call sub.msvcrt.dll_malloc
mov r13, rax
mov rbp, rax
test rax, rax
je 0x1400399f8
mov edx, edi
mov rcx, rax
call r12
test eax, eax
jne 0x1400398b9
mov rcx, r13
call fcn.14034efb0
jmp 0x1400398b7
mov r14d, eax
add r14, r14
mov rcx, r14
call sub.msvcrt.dll_malloc
mov r12, rax
test rax, rax
je 0x1400399a8
mov edx, edi
mov rcx, rax
call r13
test eax, eax
jne 0x140039980
mov rcx, r12
call fcn.14034efb0
jmp 0x1400398d1
mov edx, 0x18
mov ecx, 1
call sub.msvcrt.dll_calloc
mov rdx, rax
test rax, rax
je 0x1400399ce
mov qword [rax], r12
mov ebx, 1
lea rax, [rax + 8]
jmp 0x1400398ec
mov qword [rsp + 0x20], r14
lea r9, [0x14036dc20]
lea r8, [0x14036dc38]
mov edx, 4
lea rcx, [0x14036dc5a]
call fcn.1400d2190
jmp 0x1400399cc
mov qword [rsp + 0x20], 0x18
lea r9, [0x14036e267]
lea r8, [0x14036dc38]
mov edx, 4
lea rcx, [0x14036dc5a]
call fcn.1400d2190
jmp 0x1400399f6
mov qword [rsp + 0x20], r14
lea r9, [0x14036dc20]
lea r8, [0x14036dc38]
mov edx, 4
lea rcx, [0x14036dc5a]
call fcn.1400d2190
jmp 0x140039a1c
Function at 0x140043510
Capabilities:
Hash data using djb2

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
xor r10d, r10d
mov r9d, dword [rcx + 0x38]
mov r13, rcx
mov rdi, rdx
mov r11d, r8d
test r9d, r9d
je 0x140043641
mov r8d, dword [rcx + 0x48]
test r8d, r8d
je 0x140043641
movsx eax, byte [rdx]
xor esi, esi
mov ebx, 0x1505
test al, al
je 0x14004356f
nop dword [rax]
mov edx, ebx
shl edx, 5
add ebx, edx
add ebx, eax
lea eax, [rsi + 1]
mov rsi, rax
movsx eax, byte [rdi + rax]
test al, al
jne 0x140043558
mov r10d, dword [r13 + 0x28]
test r10d, r10d
je 0x1400435b6
mov ecx, dword [r13 + 0x2c]
mov eax, ebx
shr eax, cl
mov ecx, eax
mov eax, 1
mov edx, eax
shl edx, cl
mov ecx, ebx
shl eax, cl
mov ecx, edx
xor edx, edx
or ecx, eax
mov eax, ebx
shr eax, 5
div r10d
mov rax, qword [r13 + 0x20]
xor r10d, r10d
mov edx, edx
mov r14d, dword [rax + rdx*4]
and r14d, ecx
cmp ecx, r14d
jne 0x140043641
mov eax, ebx
xor edx, edx
mov r10, qword [r13 + 0x30]
div r9d
sub r9d, 1
mov eax, edx
mov ecx, dword [r10 + rax*4]
mov eax, r8d
cmp r9d, edx
je 0x1400435e1
lea eax, [rdx + 1]
mov eax, dword [r10 + rax*4]
cmp r8d, eax
cmovbe eax, r8d
xor r10d, r10d
cmp ecx, eax
jae 0x140043641
sub eax, ecx
mov edx, ecx
mov r10, qword [r13 + 0x40]
mov dword [rsp + 0x4c], esi
sub eax, 1
lea r9, [rdx + rdx*2]
mov byte [rsp + 0x4b], r11b
mov r14d, r8d
add rax, rdx
mov qword [rsp + 0x28], r10
lea r12, [r10 + r9*8]
lea rax, [rax + rax*2]
mov r15, r12
lea rax, [r10 + rax*8 + 0x18]
mov qword [rsp + 0x30], rax
mov r10, r15
cmp dword [r15], ebx
je 0x140043658
nop dword [rax + rax]
mov rax, qword [rsp + 0x30]
add r15, 0x18
cmp r15, rax
jne 0x140043620
xor r10d, r10d
mov rax, r10
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov edx, dword [r15 + 8]
movzx eax, word [r15 + 0xc]
mov ecx, edx
add ecx, eax
jb 0x140043630
mov rsi, qword [r13 + 0x10]
mov r12d, dword [rsp + 0x4c]
mov qword [rsp + 0x40], r10
movzx ebp, ax
mov qword [rsp + 0x38], rsi
mov rsi, r15
mov ecx, ecx
cmp qword [rsp + 0x38], rcx
jb 0x140043630
mov ecx, edx
add rcx, qword [r13 + 8]
cmp r12d, eax
jb 0x140043630
test rcx, rcx
je 0x140043630
sub r12d, eax
mov r8, rbp
mov edx, r12d
add rdx, rdi
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x140043630
mov eax, dword [rsi + 4]
test r12d, r12d
jne 0x1400436bb
cmp eax, 0xffffffff
je 0x1400436ef
test rbp, rbp
je 0x140043630
cmp eax, r14d
jae 0x140043630
mov rsi, qword [rsp + 0x28]
lea rax, [rax + rax*2]
lea rsi, [rsi + rax*8]
mov edx, dword [rsi + 8]
movzx ebp, word [rsi + 0xc]
mov ecx, edx
mov rax, rbp
add ecx, ebp
jae 0x140043680
jmp 0x140043630
mov r10, qword [rsp + 0x40]
movzx eax, byte [rsp + 0x4b]
cmp byte [r15 + 0xe], al
jne 0x140043630
jmp 0x140043641
Function at 0x140043f60
Capabilities:
Encode data using base64
Get thread local storage value
Resolve function by parsing pe exports
Set thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rdi, [0x1404ca0e0]
mov rbx, qword [rcx + 0x18]
mov rsi, rcx
mov rcx, rdi
call fcn.140341618
mov eax, 1
xchg dword [rbx], eax
test eax, eax
jne 0x140044010
mov rcx, qword [rbx + 0x10]
or byte [rbx + 4], 1
test rcx, rcx
je 0x140043fa3
mov rax, qword [0x14048f6b0]
call qword [rax + 0x18]
mov rcx, rdi
call fcn.140341260
mov rcx, rsi
call fcn.1400a9ca0
mov edx, dword [0x1404ca1a8]
xor r8d, r8d
mov rcx, rsi
call fcn.1400b6730
mov rcx, rdi
call fcn.140341618
movzx eax, byte [rbx + 4]
mov edx, eax
and edx, 0xfffffffe
mov byte [rbx + 4], dl
test al, 2
jne 0x140044000
and byte [rbx + 4], 0xfd
mov rcx, rdi
call fcn.140341260
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.1400a9ff0
lea rcx, [0x1404ca0d0]
call qword [sym.imp.KERNEL32.dll_WakeAllConditionVariable]
jmp 0x140043fdc
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.140341260

Function at 0x140044e40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rsi, rcx
mov rbx, rdx
call qword [sym.imp.msvcrt.dll__errno]
mov edi, dword [rax]
cmp edi, 0x16
je 0x140044f10
mov rcx, rsi
call fcn.1400c69f0
mov ecx, edi
mov rsi, rax
call fcn.1400e79b0
mov rcx, qword [0x14048def0]
mov r12, rax
mov rax, qword [rcx]
test rax, rax
je 0x140044ef8
lea rdx, str.Error_opening_file__s:__s
lea rcx, [0x14036fd08]
call fcn.1400c7f40
mov ecx, edi
mov rbp, rax
call fcn.140026320
mov r13, qword [0x14048eee0]
mov edi, eax
mov edx, dword [r13]
test edx, edx
jne 0x140044ec7
lea rcx, [0x14036fd0f]
call fcn.1400daa90
mov dword [r13], eax
mov edx, eax
mov qword [rsp + 0x28], r12
mov rcx, rbx
mov r9, rbp
mov r8d, edi
mov qword [rsp + 0x20], rsi
call fcn.1400cab90
mov rcx, rsi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp fcn.14034efb0
call fcn.1400e7370
test eax, eax
je 0x140044e87
call fcn.1400cb3d0
jmp 0x140044e87
mov rcx, qword [0x14048def0]
mov rax, qword [rcx]
test rax, rax
je 0x140044fb0
lea rdx, str.Invalid_filename
lea rcx, [0x14036fd08]
call fcn.1400c7f40
mov rdi, qword [0x14048eee0]
mov rsi, rax
mov eax, dword [rdi]
test eax, eax
je 0x140044f80
test rbx, rbx
je 0x140044fa2
cmp qword [rbx], 0
je 0x140044f90
mov r9, rsi
lea r8, [0x14036fd20]
mov edx, 0x10
lea rcx, [0x14036fde6]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp fcn.1400d2190
lea rcx, [0x14036fd0f]
call fcn.1400daa90
mov dword [rdi], eax
jmp 0x140044f46
mov r8, rsi
mov edx, 0xa
mov ecx, eax
call fcn.1400cac00
mov qword [rbx], rax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
call fcn.1400e7370
test eax, eax
je 0x140044f23
call fcn.1400cb3d0
jmp 0x140044f23