joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140007130
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
call fcn.140005d80
mov ecx, dword [0x14001c038]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x1400070e8
test byte [rbx + 0x40], 0xc
jne 0x14000709f
mov eax, dword [0x1400260b8]
test eax, eax
jne 0x1400070b0
add rsp, 0x28
pop rbx
pop rsi
ret
lea rsi, [rbx + 0x38]
mov rcx, rsi
call fcn.140004f70
movzx eax, byte [rbx + 0x40]
test al, 3
je 0x1400070d3
mov edx, dword [rbx + 0x44]
test dl, 1
je 0x1400070d3
mov ecx, dword [rbx + 0x20]
test ecx, ecx
jle 0x1400070fc
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.140005260
call fcn.140005e30
mov rbx, rax
test rax, rax
jne 0x14000708f
add rsp, 0x28
pop rbx
pop rsi
ret
and eax, 0xfffffff3
mov rcx, qword [rbx + 0x30]
and edx, 0xfffffffe
or eax, 4
mov dword [rbx + 0x44], edx
mov byte [rbx + 0x40], al
test rcx, rcx
je 0x14000711a
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, rsi
call fcn.140005260
call fcn.140006f90
nop
nop dword [rax + rax]
push rdi
push rsi
push rbx
sub rsp, 0x20
test rcx, rcx
je 0x1400071a0
call fcn.140004d20
mov rsi, rax
mov eax, 0xfffffffe
cmp rax, rsi
jb 0x1400071d8
call fcn.140005d80
mov ecx, dword [0x14001c038]
mov edi, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140007230
test esi, esi
je 0x1400071b6
call fcn.140007070
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140007210
mov edx, edi
call fcn.140004dd0
call fcn.140007070
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.140005d80
mov ecx, dword [0x14001c038]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140007220
call fcn.140007070
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140007070
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.140005d80
mov ecx, dword [0x14001c038]
mov edi, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
jne 0x140007175
call fcn.140005e30
mov rbx, rax
jmp 0x140007175
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14000718e
call fcn.140005e30
jmp 0x1400071b6
call fcn.140005e30
mov rbx, rax
jmp 0x140007171

Function at 0x140007240
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov esi, ecx
call fcn.140005d80
mov ecx, dword [0x14001c038]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x1400072b0
test esi, esi
je 0x140007290
call fcn.140007070
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x1400072c0
mov edx, esi
call fcn.140004dd0
call fcn.140007070
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
call fcn.140007070
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140007070
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
call fcn.140005e30
mov rbx, rax
jmp 0x140007261
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14000727a
Function at 0x1400072d0
Capabilities:
Get thread local storage value
Hijack thread execution

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x4f8
mov rsi, rcx
test rcx, rcx
je 0x1400073c0
lea rdi, [0x14001c028]
mov rcx, rdi
call fcn.140004f70
mov rcx, rsi
call fcn.1400055e0
mov rcx, rdi
mov rbx, rax
call fcn.140005260
test rbx, rbx
je 0x1400073c0
mov rcx, qword [rbx + 0x28]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400073c0
lea rdi, [rsp + 0x20]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x1400073c0
lea rbp, [rbx + 0x38]
mov rcx, rbp
call fcn.140004f70
call fcn.140005d80
mov ecx, dword [0x14001c038]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400074d0
movzx edx, byte [rbx + 0x40]
cmp rsi, qword [rax + 0x1d8]
je 0x1400073d8
mov eax, dword [rbx + 0x44]
and eax, 3
cmp eax, 3
je 0x140007430
test dl, 3
jne 0x1400073b0
and edx, 0xfffffffc
or edx, 1
mov byte [rbx + 0x40], dl
lock add dword [0x1400260b8], 1
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x1400073a1
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rbp
call fcn.140005260
xor eax, eax
jmp 0x1400073c5
mov rcx, rbp
call fcn.140005260
test byte [rbx + 0x40], 0xc
je 0x1400073a9
nop
mov eax, 3
add rsp, 0x4f8
pop rbx
pop rsi
pop rdi
pop rbp
ret
test dl, 3
jne 0x1400073b0
and edx, 0xfffffffc
or edx, 1
mov byte [rbx + 0x40], dl
lock add dword [0x1400260b8], 1
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x1400073fd
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [rbx + 0x44]
mov edx, eax
and edx, 3
cmp edx, 3
jne 0x1400073a1
and eax, 0xfffffffe
mov rcx, rbp
mov dword [rbx + 0x44], eax
movzx eax, byte [rbx + 0x40]
and eax, 0xfffffff3
or eax, 4
mov byte [rbx + 0x40], al
call fcn.140005260
call fcn.140006f90
nop word [rax + rax]
test dl, 0xc
jne 0x1400073b0
and edx, 0xf
jne 0x1400073c0
mov rcx, qword [rbx + 0x28]
mov dword [rsp + 0x50], 0x100001
call qword [sym.imp.KERNEL32.dll_SuspendThread]
xor edx, edx
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1400073a1
mov rcx, qword [rbx + 0x28]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
lea rax, [fcn.140006f90]
mov rcx, qword [rbx + 0x28]
mov rdx, rdi
mov qword [rsp + 0x118], rax
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
movzx eax, byte [rbx + 0x40]
and dword [rbx + 0x44], 0xfffffffe
and eax, 0xfffffff0
or eax, 5
mov byte [rbx + 0x40], al
lock add dword [0x1400260b8], 1
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x1400074b8
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rbp
call fcn.140005260
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x1400073a1
call fcn.140005e30
test rax, rax
jne 0x140007360
movzx edx, byte [rbx + 0x40]
jmp 0x14000736d
Function at 0x140007850
Capabilities:
Create thread
Get thread local storage value
Resume thread

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rbp, rcx
mov rdi, rdx
mov rsi, r8
mov r12, r9
call fcn.140005b10
mov rbx, rax
test rax, rax
je 0x140007a87
test rbp, rbp
je 0x14000788b
mov rax, qword [rax + 0x1d8]
mov qword [rbp], rax
mov r13, qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbx + 0x44], 1
mov dword [rbx + 0xbc], 0
mov qword [rbx + 0x28], 0xffffffffffffffff
mov r14, r13
mov qword [rbx + 8], r12
mov r12, qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x10], rsi
xor esi, esi
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call r12
mov qword [rbx + 0x30], rax
test rax, rax
jne 0x140007900
test esi, esi
jne 0x1400078f0
xor ecx, ecx
mov esi, 1
call r14
jmp 0x1400078bf
add esi, 1
mov ecx, 0x14
call r13
cmp esi, 5
jne 0x1400078bf
mov qword [rbx + 0x38], 0xffffffffffffffff
lea r12, [rbx + 0x68]
mov rcx, r12
call fcn.140005560
cmp eax, 1
je 0x140007ad7
cmp qword [rbx + 0x30], 0
mov dword [rbx], 0xbab1f00d
mov qword [rbx + 0x68], 0xffffffffffffffff
mov dword [rbx + 0xc0], 0
mov dword [rbx + 0xb8], 0
je 0x140007a70
xor edx, edx
test rdi, rdi
je 0x14000796d
mov eax, dword [rdi]
mov rsi, qword [rdi + 0x10]
mov dword [rbx + 0x44], eax
test al, 8
jne 0x140007a98
mov eax, dword [rdi + 0x18]
mov dword [rbx + 0xc0], eax
mov edx, esi
lea r8, [0x1400060e0]
mov r9, rbx
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rsi, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140007a38
mov eax, dword [rbx + 0xc0]
mov edx, 0xfffffff1
cmp eax, 0xfffffff2
jge 0x140007a10
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
test byte [rbx + 0x44], 4
jne 0x1400079f0
mov qword [rbx + 0x28], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rcx, rsi
mov qword [rbx + 0x28], 0
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400079d7
mov edx, 0xfffffffe
cmp eax, 0xffffffff
jl 0x1400079b1
mov edx, 2
cmp eax, edx
cmovle edx, eax
cmp eax, 0xf
mov eax, 0xf
cmovge edx, eax
jmp 0x1400079b1
mov rcx, qword [rbx + 0x30]
lea rsi, [rbx + 0x38]
test rcx, rcx
je 0x140007a4b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call fcn.1400053f0
mov rcx, r12
call fcn.140005560
cmp eax, 1
je 0x140007ad7
mov qword [rbx + 0x68], 0xffffffffffffffff
pxor xmm0, xmm0
movups xmmword [rbx + 0x28], xmm0
test rbp, rbp
je 0x140007a7d
mov qword [rbp], 0
cmp qword [rbx + 0x1d0], 0
je 0x140007ac0
mov eax, 0xb
jmp 0x1400079e1
call fcn.140005d80
mov ecx, dword [0x14001c038]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140007ad0
mov eax, dword [rax + 0xc0]
jmp 0x140007965
mov rcx, rbx
call fcn.140005be0
jmp 0x140007a87
call fcn.140005e30
jmp 0x140007aae
call fcn.1400058e0
nop
nop dword [rax]
Function at 0x140008670
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
lea rdi, [0x14001c048]
mov rbx, rcx
mov rcx, rdi
mov esi, edx
call fcn.140005570
mov rax, qword [rbx]
cmp dword [rax], 0xbab1f0ed
jne 0x1400086b9
mov rax, qword [rbx]
mov eax, dword [rax + 4]
test eax, eax
jle 0x1400086b9
mov rax, qword [rbx]
mov rcx, rdi
sub dword [rax + 4], 1
call fcn.1400055b0
mov eax, esi
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov dword [rsp + 0x20], 0x28
lea r9, str..._mingw_w64_mingw_w64_libraries_winpthreads_src_rwlock.c
lea r8, str.___rwlock_t__rwl___valid__LIFE_RWLOCK______rwlock_t__rwl___busy___0_
mov rcx, rax
lea rdx, str.Assertion_failed:___s___file__s__line__d_n
call fcn.1400193f0
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop
nop word cs:[rax + rax]
nop
push rbx
sub rsp, 0x20
mov eax, dword [rcx + 0x10]
neg eax
mov dword [rcx + 0xc], eax
mov rbx, rcx
lea rcx, [rcx + 0x20]
mov dword [rcx - 0x10], 0
call fcn.140005260
lea rcx, [rbx + 0x18]
add rsp, 0x20
pop rbx
jmp fcn.140005260

Function at 0x140008ae0
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.140008940
test eax, eax
je 0x140008b08
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rsi, qword [rbx]
lea rdi, [rsi + 0x18]
mov rcx, rdi
call fcn.140004f70
test eax, eax
jne 0x140008b31
lock add dword [rsi + 0xc], 1
cmp dword [rsi + 0xc], 0x7fffffff
je 0x140008b48
mov rcx, rdi
call fcn.140005260
mov edx, eax
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.140008670
lea r12, [rsi + 0x20]
mov rcx, r12
call fcn.140004f70
mov ebp, eax
test eax, eax
je 0x140008b70
mov rcx, rdi
call fcn.140005260
mov edx, ebp
jmp 0x140008b33
mov eax, dword [rsi + 0x10]
sub dword [rsi + 0xc], eax
mov rcx, r12
mov dword [rsi + 0x10], 0
call fcn.140005260
mov rcx, rdi
mov esi, eax
call fcn.140005260
test esi, esi
cmove esi, eax
mov edx, esi
jmp 0x140008b33

Function at 0x140008e10
Capabilities:
Terminate process

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
call fcn.140008600
test eax, eax
jne 0x140008e90
mov rdi, qword [rbx]
mov edx, dword [rdi + 8]
lea rbp, [rdi + 0x20]
test edx, edx
je 0x140008e68
lock sub dword [rdi + 8], 1
mov rcx, rbp
call fcn.140005260
lea rcx, [rdi + 0x18]
mov esi, eax
call fcn.140005260
test esi, esi
cmove esi, eax
mov edx, esi
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.140008670
mov rcx, rbp
call fcn.140004f70
mov esi, eax
test eax, eax
jne 0x140008e4f
lock add dword [rdi + 0x10], 1
mov eax, dword [rdi + 0x10]
test eax, eax
je 0x140008ea0
mov rcx, rbp
call fcn.140005260
mov esi, eax
jmp 0x140008e4f
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rcx, [rdi + 0x28]
call fcn.1400044a0
mov rcx, rbp
mov esi, eax
call fcn.140005260
test esi, esi
cmove esi, eax
jmp 0x140008e4f
Function at 0x140008ec0
Capabilities:
Terminate process

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbx, rcx
call fcn.140008940
test eax, eax
je 0x140008ee8
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rsi, qword [rbx]
lea rdi, [rsi + 0x18]
mov rcx, rdi
call fcn.140004f70
mov ebp, eax
test eax, eax
jne 0x140008f39
lea r12, [rsi + 0x20]
mov rcx, r12
call fcn.140004f70
mov ebp, eax
test eax, eax
jne 0x140008fd0
mov edx, dword [rsi + 8]
test edx, edx
jne 0x140008f34
mov edx, dword [rsi + 0x10]
mov eax, dword [rsi + 0xc]
test edx, edx
jle 0x140008f30
sub eax, edx
mov dword [rsi + 0x10], 0
mov dword [rsi + 0xc], eax
test eax, eax
jg 0x140008f50
lock add dword [rsi + 8], 1
mov edx, ebp
mov rcx, rbx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp fcn.140008670
neg eax
mov qword [rsp + 0x28], rsi
lea r13, [rsi + 0x28]
mov dword [rsi + 0x10], eax
lea rax, [0x140008700]
mov qword [rsp + 0x20], rax
call fcn.140006da0
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
lock or qword [rsp], 0
call fcn.140006da0
lea rdx, [rsp + 0x20]
mov qword [rax], rdx
lock or qword [rsp], 0
jmp 0x140008f9f
mov eax, dword [rsi + 0x10]
test eax, eax
jns 0x140008fe0
mov rdx, r12
mov rcx, r13
call fcn.140004700
mov edi, eax
test eax, eax
je 0x140008f98
call fcn.140006da0
mov rdx, qword [rsp + 0x30]
mov ebp, edi
mov qword [rax], rdx
mov rcx, qword [rsp + 0x28]
call qword [rsp + 0x20]
jmp 0x140008f39
mov rcx, rdi
call fcn.140005260
jmp 0x140008f39
call fcn.140006da0
mov rdx, qword [rsp + 0x30]
mov qword [rax], rdx
mov dword [rsi + 0xc], 0
jmp 0x140008f34

Function at 0x140012570
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call fcn.1400192f0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop
nop dword [rax]
Function at 0x1400125e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x140026134]
mov rbx, rcx
test esi, esi
jle 0x140012710
mov rax, qword [0x140026138]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x14001262b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x1400126b5
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140012610
mov rcx, rbx
call fcn.140013030
mov rdi, rax
test rax, rax
je 0x140012732
mov rax, qword [0x140026138]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.140013170
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x140026138]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140012717
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x1400126ae
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x1400126c0
add dword [0x140026134], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x140026138]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400126ae
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140012570
nop dword [rax]
xor esi, esi
jmp 0x140012638
mov rax, qword [0x140026138]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140012570
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.140012570
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140012ca0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x1400261a0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140026180]
test rbx, rbx
je 0x140012cfc
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x140012cf3
test rsi, rsi
je 0x140012cf3
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140012cd8
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x140013030
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1400209b0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140013050
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140013058
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140013050
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x1400130ad
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1400130a4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140013050
add rax, 0x28
cmp rax, r9
jne 0x140013090
xor eax, eax
ret

Function at 0x1400130b0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400209b0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x1400130cf
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400130d8
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x1400130cf
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140013170
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400209b0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14001318f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140013198
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x140013c60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x138
mov rbx, rcx
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov dword [rax], 0
test rbx, rbx
je 0x140013e10
cmp byte [rbx], 0
je 0x140013dd8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140013e20
test al, 0x10
je 0x140013dd8
lea rsi, [rsp + 0x20]
mov rdx, rbx
mov r8d, 0x104
mov rcx, rsi
call sub.api_ms_win_crt_filesystem_l1_1_0.dll__fullpath
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
lea rcx, [rax + 0x24b]
mov rbx, rax
mov rbp, rax
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov rdx, rax
test rax, rax
je 0x140013e48
lea r8, [rax + 0x244]
lea rax, [rbx + 1]
cmp eax, 8
jb 0x140013da0
mov rcx, qword [rsp + 0x20]
lea rdi, [rdx + 0x24c]
and rdi, 0xfffffffffffffff8
mov qword [rdx + 0x244], rcx
mov ecx, eax
mov r9, qword [rsi + rcx - 8]
mov qword [r8 + rcx - 8], r9
mov rcx, r8
sub rcx, rdi
sub rsi, rcx
add ecx, eax
shr ecx, 3
rep movsq qword [rdi], qword [rsi]
cmp byte [rdx + 0x244], 0
je 0x140013d48
movzx ecx, byte [rdx + rbx + 0x243]
cmp cl, 0x5c
je 0x140013d48
cmp cl, 0x2f
jne 0x140013df8
mov eax, 0x2a
mov ecx, 0x20
mov word [r8 + rbp], ax
lea r8, [rdx + 0x130]
xor eax, eax
mov qword [rdx + 0x238], 0xffffffffffffffff
mov rdi, r8
mov dword [rdx + 0x240], 0
mov qword [rdx + 0x128], 0
rep stosq qword [rdi], rax
mov rax, rdx
mov dword [rdi], 0
add rsp, 0x138
pop rbx
pop rsi
pop rdi
pop rbp
ret
test al, 4
jne 0x140013e30
test eax, eax
je 0x140013d29
movzx ecx, byte [rsp + 0x20]
mov byte [r8], cl
test al, 2
je 0x140013d29
mov ecx, eax
movzx r9d, word [rsi + rcx - 2]
mov word [r8 + rcx - 2], r9w
jmp 0x140013d29
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
xor edx, edx
mov dword [rax], 0x14
mov rax, rdx
add rsp, 0x138
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov ecx, 0x5c
mov rbp, rax
mov word [r8 + rbx], cx
jmp 0x140013d48
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
xor edx, edx
mov dword [rax], 0xe
jmp 0x140013de5
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
xor edx, edx
mov dword [rax], 2
jmp 0x140013de5
mov ecx, dword [rsp + 0x20]
mov dword [r8], ecx
mov ecx, eax
mov r9d, dword [rsi + rcx - 4]
mov dword [r8 + rcx - 4], r9d
jmp 0x140013d29
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
xor edx, edx
mov dword [rax], 0xc
jmp 0x140013de5
Function at 0x140d848e0
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg r8d, r11d
mov di, word [rsp + 7]
jmp 0x140d84997
sub r13w, 0xf2f6
std
mov r9d, dword [rsp]
mov eax, 0xc6f617a5
push rbx
jmp 0x140d8496a
lea rsp, [rsp + 6]
mov qword [rsp + 3], rcx
neg r11d
lea r11, [r14*4]
bswap r11
mov r9b, byte [rsp]
jmp 0x140d8491a
bts ax, bp
btr ecx, r9d
push r14
bswap r14
jmp 0x140d849d1
cmp r11, 0xffffffff8f49706a
btc edx, r14d
xchg cl, r13b
mov rbx, qword [rsp]
rdtsc
mov di, 0x7c51
jmp 0x140d84954
bswap r9
mov r8, 0x4a166197
mov r9b, byte [rsp + 2]
mov word [rsp + 1], sp
mov r11, 0xfffffffff5fedd0d
pop r11w
jmp 0x140d84936
lea rsp, [rsp + 2]
mov qword [rsp], r15
cpuid
xchg r13, r9
std
jmp 0x140d84b15
sub rsp, 0x10
bswap r9d
mov r9, 0x23e70000
xchg word [rsp + 3], si
push qword [rsp + 0xc]
add rsp, 0xe
jmp 0x140d849bb
lea r13, [rcx + riz - 0xf5]
neg dl
mov r14w, 0x1324
jmp 0x140d84a8f
lea r14, [rbp + rbp]
mov r11, 0x75f84551
push r12
mov r9d, 0x9a3373c0
cld
xchg cx, ax
jmp 0x140d84a0a
xchg cl, dl
lea rsp, [rsp + 2]
mov qword [rsp], r10
setge dl
shl rax, 0x14
cpuid
jmp 0x140d84a20
xchg qword [rsp], r11
mov dword [rsp + 9], ebp
mov esi, dword [rsp + 2]
setg dl
jmp 0x140d84aa8
mov ebp, 0xe6e969c6
xchg r15w, r14w
sub rsp, 0xf
mov byte [rsp + 7], bpl
jmp 0x140d84a5e
mov edi, 0xa0d66231
cpuid
mov rbx, qword [rsp]
bsf bp, r10w
mov ax, 0x3e42
setb al
jmp 0x140d84a74
add rsp, 0
cpuid
add rsp, 6
pop di
mov r12b, byte [rsp + 5]
neg bx
jmp 0x140d84af6
push rbp
mov rdx, 0x79ac9023
dec ebx
push rbp
push r9w
cpuid
jmp 0x140d84a48
mov ebp, 0xb5e07e5e
bswap rdi
mov bp, r10w
lea rax, [rdi + r8]
jmp 0x140d84b41
xchg dword [rsp], r13d
mov ebx, r14d
not si
not r14b
mov r9d, dword [rsp + 3]
bswap r11
jmp 0x140d84ae0
mov r11d, ecx
xchg r14, rdx
mov esi, r11d
setl r8b
bswap r14
mov cx, word [rsp]
jmp 0x140d84aca
mov si, 0xd95a
mov byte [rsp + 4], cl
rdtsc
lea rsp, [rsp + 5]
jmp 0x140d84b9e
cpuid
mov byte [rsp], r15b
mov r14b, byte [rsp + 1]
mov ax, r15w
xchg di, ax
neg al
jmp 0x140d84b2b
push dx
cpuid
call fcn.140d84bb8
jno 0x140d84b5f
add byte [rcx - 3], dh
insd dword [rdi], dx
hlt
neg r8
mov r11w, si
xor r11, 0xffffffffae0a5dbf
pushfq
lea r14, [r10 + riz + 0xdab4]
xchg qword [rsp], rbx
jmp 0x140d84b56
push word [rsp]
dec r14d
bswap rbx
btr r11w, r12w
sub rsp, 3
mov word [rsp + 3], di
jmp 0x140d84b6c

Function at 0x140d84c62
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsr r13d, esp
xchg r15w, r8w
jmp 0x140d84c70
mov dword [rsp + 7], r11d
push qword [rsp + 8]
sub rsp, 5
pop dx
jmp 0x140d84cb6
mov r9b, 0xb6
rdtsc
xchg dword [rsp + 0xa], r13d
bswap r11d
not r8w
lea rsp, [rsp + 0x26]
jmp 0x140d84ca0