joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14010b4b0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x130]
sub rsp, 0x230
mov rax, qword [0x14048a080]
xor rax, rsp
mov qword [rbp + 0x128], rax
mov rdi, rdx
xor esi, esi
mov rax, qword [rcx + 0x28]
mov rbx, qword [rax + 0x40]
mov rax, qword [rcx + 0x10]
mov rdx, qword [rax + 0x18]
call rdx
lea r8, [rsp + 0x28]
mov rdx, rax
lea rcx, [rsp + 0x40]
call rbx
nop
mov rcx, qword [rsp + 0x50]
mov qword [rbp + 0x108], rcx
mov rax, qword [rsp + 0x60]
mov qword [rbp + 0x118], rax
lea rax, fcn.140009110
mov qword [rsp + 0x50], rax
lea rax, [0x1404048f8]
mov qword [rsp + 0x60], rax
mov rax, qword [rcx + 0x10]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0xf8]
call rax
mov qword [rsp + 0x58], rsi
mov rax, qword [rsp + 0x68]
mov qword [rbp + 0x120], rax
lea rax, [0x140403eb0]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x50]
mov rdx, qword [rax]
lea rax, [fcn.140009110]
cmp rdx, rax
je 0x14010b580
lea rcx, [rsp + 0x40]
call rdx
nop
mov rcx, qword [rbp + 0x118]
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x14010b5b4
lea rcx, [0x14010c6b0]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rdi
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0xf8]
call rax
jmp 0x14010b65b
mov r14, qword [rcx + 0x10]
mov rdx, rdi
lea rcx, [rsp + 0x70]
call fcn.14010c330
mov rdi, rax
mov qword [rsp + 0x30], rax
mov ecx, dword [0x140c5b1a4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14010b5e2
mov rsi, qword [rax + 8]
mov r8d, 0x198
mov rdx, rsi
call fcn.140100b00
mov rbx, rax
lea rcx, [rax + 8]
mov rdx, rdi
call fcn.14010c330
lea rax, [0x14010c850]
mov qword [rbx], rax
mov qword [rsp + 0x20], rbx
mov rcx, qword [rdi + 0x108]
test rcx, rcx
je 0x14010b62f
mov eax, 0xffffffff
lock xadd dword [rcx + 0xc], eax
cmp eax, 1
jne 0x14010b62f
mov rax, qword [rcx]
call qword [rax + select]
lea rcx, [rdi + 0x30]
call fcn.1400f0e90
nop
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0xf8]
call r14
nop
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x14010b65b
mov rax, qword [rcx]
xor edx, edx
call rax
nop
mov rax, qword [rbp + 0x108]
mov rdx, qword [rax]
lea rcx, [rbp + 0xf8]
call rdx
nop
mov rcx, qword [rbp + 0x128]
xor rcx, rsp
call fcn.14028bc70
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14010b970
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, qword [rcx + 0x10]
test rbx, rbx
je 0x14010b9bb
mov rcx, qword [rbx + 0x40]
test rcx, rcx
je 0x14010b9a5
mov eax, 0xffffffff
lock xadd dword [rcx + 0xc], eax
cmp eax, 1
jne 0x14010b9a5
mov rax, qword [rcx]
call qword [rax + select]
nop
mov rax, qword [rbx + 0x18]
mov rdx, qword [rax]
lea rcx, [rbx + 8]
call rdx
nop
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x14010ba08
mov ecx, dword [0x140c5b1a4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14010b9f7
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14010b9f7
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x14010ba13
inc ecx
inc rax
cmp rax, 6
jl 0x14010b9e5
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x68]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14010ba40
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, qword [rcx + 0x10]
test rbx, rbx
je 0x14010baa5
mov rcx, qword [rbx + 0xa0]
test rcx, rcx
je 0x14010ba77
mov eax, 0xffffffff
lock xadd dword [rcx + 0xc], eax
cmp eax, 1
jne 0x14010ba77
mov rax, qword [rcx]
call qword [rax + select]
cmp byte [rbx + 0x58], 0
je 0x14010ba8f
lea rcx, [rbx + 0x60]
mov rax, qword [rcx + 0x10]
mov rdx, qword [rax]
call rdx
nop
mov byte [rbx + 0x58], 0
mov rax, qword [rbx + 0x20]
mov rdx, qword [rax]
lea rcx, [rbx + 0x10]
call rdx
nop
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x14010baf3
mov ecx, dword [0x140c5b1a4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14010bae2
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14010bae2
mov ecx, 4
mov eax, ecx
nop
cmp qword [rdx + rax*8], 0
je 0x14010bafe
inc ecx
inc rax
cmp rax, 6
jl 0x14010bad0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0xf0]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14010c3b0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0xb0
mov rbp, rcx
mov rcx, qword [rcx + 0x20]
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x14010c3f3
lea rcx, [0x14010c840]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 0x20]
mov rcx, rbp
call rax
jmp 0x14010c4fd
mov r15, qword [rcx + 0x10]
lea rcx, [rsp + 0x30]
call fcn.14010c530
mov rsi, rax
mov qword [rsp + 0xf0], rax
mov ecx, dword [0x140c5b1a4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor ebx, ebx
test rax, rax
je 0x14010c425
mov rdx, qword [rax + 8]
jmp 0x14010c428
mov rdx, rbx
mov r8d, 0x90
call fcn.140100b00
mov rdi, rax
mov ecx, dword [rsi]
mov dword [rax + 8], ecx
lea rcx, [rax + 0x10]
lea rdx, [rsi + 8]
call fcn.1400d3e30
mov rcx, qword [rsi + 0x38]
mov qword [rdi + 0x40], rcx
mov rax, qword [rsi + 0x40]
mov qword [rdi + 0x48], rax
mov qword [rsi + 0x40], rbx
mov qword [rsi + 0x38], rbx
mov rax, qword [rsi + 0x48]
mov qword [rsi + 0x48], rbx
mov qword [rdi + 0x50], rax
lea rcx, [rdi + 0x58]
lea rdx, [rsi + 0x50]
call fcn.1400d3e30
lea rax, [0x14010cdd0]
mov qword [rdi], rax
mov qword [rsp + 0xe0], rdi
mov rax, qword [rsi + 0x60]
mov rdx, qword [rax]
lea rcx, [rsi + 0x50]
call rdx
nop
mov rcx, qword [rsi + 0x48]
test rcx, rcx
je 0x14010c4ac
mov edx, 0xb8
call fcn.14028bc90
mov rcx, qword [rsi + 0x40]
test rcx, rcx
je 0x14010c4cb
mov eax, 0xffffffff
lock xadd dword [rcx + 0xc], eax
cmp eax, 1
jne 0x14010c4cb
mov rax, qword [rcx]
call qword [rax + select]
nop
mov rax, qword [rsi + 0x18]
mov rdx, qword [rax]
lea rcx, [rsi + 8]
call rdx
nop
lea rdx, [rsp + 0xe0]
mov rcx, rbp
call r15
nop
mov rcx, qword [rsp + 0xe0]
test rcx, rcx
je 0x14010c4fd
mov rax, qword [rcx]
xor edx, edx
call rax
nop
mov rbx, qword [rsp + 0xe8]
add rsp, 0xb0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x14010c5a0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0x10]
mov rdi, rcx
test rax, rax
je 0x14010c5eb
lea rbx, [rax + 0x38]
mov rcx, qword [rbx + 0xd8]
test rcx, rcx
je 0x14010c5db
mov eax, 0xffffffff
lock xadd dword [rcx + 0xc], eax
cmp eax, 1
jne 0x14010c5db
mov rax, qword [rcx]
call qword [rax + select]
mov rcx, rbx
call fcn.1400f0e90
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x14010c638
mov ecx, dword [0x140c5b1a4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14010c627
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14010c627
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x14010c643
inc ecx
inc rax
cmp rax, 6
jl 0x14010c615
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x198]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x30]
mov qword [rdi + 8], 0
add rsp, 0x20
pop rdi
ret
Function at 0x14010c700
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14010c727
add rcx, 8
call fcn.14010bf60
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x14010c774
mov ecx, dword [0x140c5b1a4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14010c763
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14010c763
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x14010c77f
inc ecx
inc rax
cmp rax, 6
jl 0x14010c751
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x90]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x30]
mov qword [rdi + 8], 0
add rsp, 0x20
pop rdi
ret

Function at 0x14010d210
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rbx, rdx
mov rdi, rcx
mov rcx, qword [rcx + 0x20]
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x14010d258
lea rcx, [0x14010d6c0]
mov qword [rbp - 0x60], rcx
mov qword [rbp - 0x58], rdx
lea rdx, [rbp - 0x60]
mov rcx, rdi
call rax
jmp 0x14010d365
mov rsi, qword [rcx + 0x10]
mov eax, dword [rdx]
mov dword [rbp - 0x50], eax
add rdx, 8
lea rcx, [rbp - 0x48]
call fcn.1400d3e30
mov rax, qword [rbx + 0x38]
mov qword [rbp - 0x18], rax
mov rax, qword [rbx + 0x40]
mov qword [rbp - 0x10], rax
xor r14d, r14d
mov qword [rbx + 0x40], r14
mov qword [rbx + 0x38], r14
mov rax, qword [rbx + 0x48]
mov qword [rbx + 0x48], r14
mov qword [rbp - 8], rax
lea rax, [rbp - 0x50]
mov qword [rbp + 0x30], rax
mov ecx, dword [0x140c5b1a4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14010d2b4
mov rdx, qword [rax + 8]
jmp 0x14010d2b7
mov rdx, r14
mov r8d, 0x60
call fcn.140100b00
mov rbx, rax
mov ecx, dword [rbp - 0x50]
mov dword [rax + 8], ecx
lea rcx, [rax + 0x10]
lea rdx, [rbp - 0x48]
call fcn.1400d3e30
mov rcx, qword [rbp - 0x18]
mov qword [rbx + 0x40], rcx
mov rcx, qword [rbp - 0x10]
mov qword [rbx + 0x48], rcx
mov qword [rbp - 0x10], r14
mov qword [rbp - 0x18], r14
mov rax, qword [rbp - 8]
mov qword [rbp - 8], r14
mov qword [rbx + 0x50], rax
lea rax, [0x14010d700]
mov qword [rbx], rax
mov qword [rbp + 0x20], rbx
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x14010d31d
mov edx, 0xb8
call fcn.14028bc90
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x14010d33c
mov eax, 0xffffffff
lock xadd dword [rcx + 0xc], eax
cmp eax, 1
jne 0x14010d33c
mov rax, qword [rcx]
call qword [rax + select]
nop
mov rax, qword [rbp - 0x38]
mov rdx, qword [rax]
lea rcx, [rbp - 0x48]
call rdx
nop
lea rdx, [rbp + 0x20]
mov rcx, rdi
call rsi
nop
mov rcx, qword [rbp + 0x20]
test rcx, rcx
je 0x14010d365
mov rax, qword [rcx]
xor edx, edx
call rax
nop
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14010d5e0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, qword [rcx + 0x10]
test rbx, rbx
je 0x14010d63d
mov rcx, qword [rbx + 0x50]
test rcx, rcx
je 0x14010d609
mov edx, 0xb8
call fcn.14028bc90
mov rcx, qword [rbx + 0x48]
test rcx, rcx
je 0x14010d627
mov eax, 0xffffffff
lock xadd dword [rcx + 0xc], eax
cmp eax, 1
jne 0x14010d627
mov rax, qword [rcx]
call qword [rax + select]
lea rcx, [rbx + 0x10]
mov rax, qword [rcx + 0x10]
mov rdx, qword [rax]
call rdx
nop
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x14010d68a
mov ecx, dword [0x140c5b1a4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14010d679
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14010d679
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x14010d695
inc ecx
inc rax
cmp rax, 6
jl 0x14010d667
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x60]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14010d880
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, qword [rcx + 0x10]
test rbx, rbx
je 0x14010d8e0
mov rcx, qword [rbx + 0x80]
test rcx, rcx
je 0x14010d8ac
mov edx, 0xb8
call fcn.14028bc90
mov rcx, qword [rbx + 0x78]
test rcx, rcx
je 0x14010d8ca
mov eax, 0xffffffff
lock xadd dword [rcx + 0xc], eax
cmp eax, 1
jne 0x14010d8ca
mov rax, qword [rcx]
call qword [rax + select]
lea rcx, [rbx + 0x40]
mov rax, qword [rcx + 0x10]
mov rdx, qword [rax]
call rdx
nop
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x14010d933
mov ecx, dword [0x140c5b1a4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14010d922
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14010d922
mov ecx, 4
mov eax, ecx
nop word [rax + rax]
cmp qword [rdx + rax*8], 0
je 0x14010d93e
inc ecx
inc rax
cmp rax, 6
jl 0x14010d910
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0xb0]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140227af0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x140227b11
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x140227b3e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140227b40
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140227b99
test ecx, ecx
jle 0x140227b79
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140227b99
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140227b99
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
invalid
Function at 0x140227bc0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140227bf1
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je case.default.0x140227c08
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x30], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140227c2b
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140227c2d
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140227c69
mov qword [rsp + 0x38], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x38]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140227cfe
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140227ca4
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x140227cde
nop dword [rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x140227cfe
cmp rbx, rax
ja 0x140227cb0
test rbx, rbx
je 0x140227cfe
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
mov rsi, qword [rsp + 0x48]
sub rbp, rbx
mov rbx, qword [rsp + 0x30]
mov rax, rbp
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
stc
ret
xchg ch, dl
jg 0x140731d3a
add dword [rdi], esp
cld
cmp edx, dword [0x16c89d7ba]
sub byte [rdx], 0x89
lea esi, [rsi]
mov cl, 0x9f
sub ebp, esi
jnp 0x140731dd9
test dword [rax + rbx], 0x14f423c5
jns 0x140731dd7
push rdx
or dword [rbx + 4], 0x861d8989
retf
add ch, ch
xor eax, 0x42c722db
lea edx, [rsi + 0x63]
push rsi
invalid
and dh, byte [rcx]
test byte [rax + 0x2e], 0xe0
adc ecx, dword [rax - 0x34]
cdq
mov dl, 0xce
invalid
jmp 0x13d122e54
Function at 0x140260a90
Capabilities:
Resume thread

Disassembly:
sub rsp, 0x68
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x140c57938], eax
je 0x140260aac
mov eax, 0x10dd
jmp 0x140260bd3
mov rax, qword [0x140c57950]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x140260b57
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x20]
movzx eax, byte [rax + 0x3e]
lea r9, [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov r8d, dword [rcx + 0x28]
mov edx, eax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, qword [rsp + 0x28]
cmp dword [rax + 8], 0
jne 0x140260b22
mov rax, qword [rsp + 0x28]
cmp qword [rax + 0x20], 0
je 0x140260b22
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x20]
call fcn.14025f710
mov rax, qword [rsp + 0x28]
mov qword [rax + 0x20], 0
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov edx, 0x30
mov rcx, qword [rsp + 0x38]
call fcn.14028bc90
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
jmp 0x140260ab8
mov qword [0x140c57950], 0
call fcn.140260170
mov rax, qword [0x140c57948]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x140260bbc
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov edx, select
mov rcx, qword [rsp + 0x48]
call fcn.14028bc90
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
jmp 0x140260b73
mov qword [0x140c57948], 0
mov dword [0x140c57938], 0
xor eax, eax
add rsp, 0x68
ret
Function at 0xaebff0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0xaebffd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0xaec00d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0xaebff5
lea eax, [rcx + 1]
jmp 0xaec01b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0xaec02e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0xaec014
sub eax, 3
jb 0xaec04e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0xaec09d
sar eax, 1
movsxd rbp, eax
jb 0xaec084
jmp 0xaec05c
add ebx, ebx
jne 0xaec05a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xaec084
inc ecx
add ebx, ebx
jne 0xaec06a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xaec084
call r11
adc ecx, ecx
add ebx, ebx
jne 0xaec07d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0xaec06c
add ecx, 2
jmp 0xaec089
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.00aebfb2
jmp 0xaebffd
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x22d200
mov dl, 0x56
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0xaec0e9
cmp rsi, rcx
jae 0xaec0f1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0xaec0d0
cmp al, 0x8f
ja 0xaec0d0
cmp byte [rsi - 2], 0xf
je 0xaec0d6
sub al, 0xe8
cmp al, 1
ja 0xaec0ba
cmp rsi, rcx
jae 0xaec0f1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0xaec0c0
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0xaec0f1
lodsb al, byte [rsi]
jmp 0xaec0d0
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x6e5000]
mov eax, dword [rdi]
or eax, eax
je 0xaec14e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x6ec000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0xaec0fe
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0xaec148
mov qword [rbx], rax
add rbx, 8
jmp 0xaec11e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0xaec192
cmp al, 0xef
ja 0xaec17a
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0xaec15a
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0xaec169
mov eax, dword [rdi]
add rdi, 4
jmp 0xaec169
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0xaec1e6
sub rsp, 0xffffffffffffff80
jmp 0x4662a0
Function at 0x140007820
Capabilities:
Hash data using fnv

Disassembly:
movzx r9d, byte [r8]
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
mov r10, rdx
mov rdx, qword [0x1402a6880]
xor r9, rax
movzx eax, byte [r8 + 1]
mov r11, r8
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 2]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 3]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 4]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 5]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 6]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 7]
mov r8, qword [0x1402a6858]
imul r9, rcx
xor r9, rax
imul r9, rcx
and rdx, r9
shl rdx, 4
add rdx, qword [0x1402a6868]
mov rax, qword [rdx + 8]
cmp rax, r8
je 0x1400078ed
mov rcx, qword [r11]
mov rdx, qword [rdx]
cmp rcx, qword [rax + 0x10]
je 0x1400078ef
nop word [rax + rax]
cmp rax, rdx
je 0x1400078ed
mov rax, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
jne 0x1400078d0
test rax, rax
cmovne r8, rax
mov rax, r10
mov qword [r10], r8
ret
xor eax, eax
test rax, rax
cmovne r8, rax
mov rax, r10
mov qword [r10], r8
ret

Function at 0x140007900
Capabilities:
Hash data using fnv

Disassembly:
movzx r9d, byte [r8]
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
mov r10, rdx
mov rdx, qword [0x1402a6840]
xor r9, rax
movzx eax, byte [r8 + 1]
mov r11, r8
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 2]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 3]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 4]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 5]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 6]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 7]
mov r8, qword [0x1402a6818]
imul r9, rcx
xor r9, rax
imul r9, rcx
and rdx, r9
shl rdx, 4
add rdx, qword [0x1402a6828]
mov rax, qword [rdx + 8]
cmp rax, r8
je 0x1400079cd
mov rcx, qword [r11]
mov rdx, qword [rdx]
cmp rcx, qword [rax + 0x10]
je 0x1400079cf
nop word [rax + rax]
cmp rax, rdx
je 0x1400079cd
mov rax, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
jne 0x1400079b0
test rax, rax
cmovne r8, rax
mov rax, r10
mov qword [r10], r8
ret
xor eax, eax
test rax, rax
cmovne r8, rax
mov rax, r10
mov qword [r10], r8
ret