joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140014390
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.14000d0f0
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14001441a
cmp byte [rbp - 0x21], r15b
je 0x140014415
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x140014450
call fcn.140009514
test eax, eax
jne 0x14001443c
cmp byte [rbp - 0x21], r15b
je 0x140014434
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x140014450
cmp byte [rbp - 0x21], r15b
je 0x14001444d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14000c6d0
test eax, eax
jne 0x1400144f0
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.14000d0f0
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14001448f
cmp byte [rbp - 0x21], r15b
je 0x1400144c4
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x1400144c4
call fcn.140009514
test eax, eax
jne 0x1400144b0
cmp byte [rbp - 0x21], r15b
je 0x1400144a9
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x1400144c4
cmp byte [rbp - 0x21], r15b
je 0x1400144c1
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14000c6d0
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x1400144f0
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x1400144f3
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x140014501
mov rcx, rdi
call fcn.1400092c4
cmp byte [rbp + 0x3f], r15b
je 0x140014510
mov rcx, qword [rbp + 0x27]
call fcn.1400092c4
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140014930
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x140024660]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x140014987
cmp word [rdx], r13w
jne 0x140014987
or byte [rax + rdi*8 + 0x38], cl
jmp 0x14001498c
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x140014ab1
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x140014ad2
lea r9, [rdx + 2]
cmp cx, r11w
je 0x1400149c5
mov rdx, r9
mov word [rbx], cx
jmp 0x1400149ec
cmp r9, r8
jae 0x1400149fc
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x1400149a6
jmp 0x140014ab1
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140014aa6
cmp dword [rsp + 0x80], esi
je 0x140014aa6
lea r8, [0x140024660]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x140014a7e
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x140014a4e
mov word [rbx], r13w
jmp 0x140014aae
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x140014a5b
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x140014aae
cmp word [rsp + 0x70], r13w
jne 0x140014a8b
cmp rbx, r14
je 0x140014a48
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.140014850
cmp word [rsp + 0x70], r13w
je 0x140014ab1
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x140024660]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x140014aab
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x140014ab1
Function at 0x1400152a0
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.140014850
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.140014850
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1400153f0
cmp rax, 0xffffffffffffffff
je 0x1400153f0
xor edi, edi
test rbp, rbp
jle 0x14001539b
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14000924c
mov rbx, rax
test rax, rax
jne 0x140015328
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140015391
mov edx, 0x8000
mov ecx, r14d
call fcn.1400083ac
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1400105b8
cmp eax, 0xffffffff
je 0x140015371
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140015338
mov edx, r15d
mov ecx, r14d
call fcn.1400083ac
jmp 0x140015391
cmp byte [rsi + 0x38], dil
je 0x140015388
cmp dword [rsi + 0x34], 5
jne 0x140015388
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140015391
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1400092c4
jmp 0x140015404
jns 0x140015404
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.140014850
cmp rax, 0xffffffffffffffff
jne 0x1400153bc
cmp byte [rsi + 0x30], dil
je 0x140015404
mov edi, dword [rsi + 0x2c]
jmp 0x140015404
mov ecx, r14d
call fcn.14000ec20
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140015404
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140015404
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1400153fd
mov eax, dword [rsi + 0x2c]
jmp 0x140015402
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.140014850
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x180009630
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov r10, r9
mov r11d, edx
mov rbx, rcx
test edx, edx
jne 0x18000964a
xor eax, eax
mov rbx, qword [rsp + 8]
ret
mov r9, qword [r8]
movzx eax, r9b
mov rdx, r9
xor eax, 0x811c9dc5
shr rdx, 8
movzx ecx, dl
shr rdx, 8
imul eax, eax, 0x1000193
xor ecx, eax
movzx eax, dl
shr rdx, 8
imul ecx, ecx, 0x1000193
xor eax, ecx
movzx ecx, dl
shr rdx, 8
imul eax, eax, 0x1000193
xor ecx, eax
movzx eax, dl
shr rdx, 8
imul ecx, ecx, 0x1000193
xor eax, ecx
movzx ecx, dl
shr rdx, 8
imul eax, eax, 0x1000193
xor ecx, eax
movzx eax, dl
shr rdx, 8
imul ecx, ecx, 0x1000193
xor eax, ecx
movzx ecx, dl
shr rdx, 8
movzx r8d, dl
xor edx, edx
imul eax, eax, 0x1000193
xor ecx, eax
imul ecx, ecx, 0x1000193
xor r8d, ecx
imul r8d, r8d, 0x1000193
mov eax, r8d
div r11d
mov rax, qword [rbx + rdx*8]
lea rdx, [rbx + rdx*8]
test rax, rax
je 0x180009701
nop
cmp qword [rax + 8], r9
je 0x180009701
mov rdx, rax
mov rax, qword [rax]
test rax, rax
jne 0x1800096f0
test r10, r10
je 0x180009709
mov dword [r10], r8d
mov rbx, qword [rsp + 8]
mov rax, rdx
ret
Function at 0x18000bbf0
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, 0x28
call fcn.18002da40
sub rsp, rax
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x18000bc30
Capabilities:
Get thread local storage value

Disassembly:
mov eax, 0x28
call fcn.18002da40
sub rsp, rax
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x18000bc50
Capabilities:
Set thread local storage value

Disassembly:
mov eax, 0x28
call fcn.18002da40
sub rsp, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
neg eax
sbb eax, eax
neg eax
dec eax
add rsp, 0x28
ret

Function at 0x18000d4f0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x40
call fcn.18002da40
sub rsp, rax
mov rdx, qword [rcx + 0x18]
mov eax, dword [rcx + 8]
xor ebx, ebx
lea r8, [rdx + rax*8]
mov rsi, rcx
cmp rdx, r8
je 0x18000d533
nop dword [rax]
cmp qword [rdx], rbx
jne 0x18000d530
add rdx, 8
cmp rdx, r8
jne 0x18000d520
jmp 0x18000d533
mov rbx, qword [rdx]
test rbx, rbx
je 0x18000d69f
mov rbx, qword [rbx + 8]
mov rax, qword [rsi]
mov rdx, rsi
mov rcx, qword [rbx]
call qword [rax + 8]
mov dl, 1
mov rcx, rbx
call fcn.18000a7b0
test eax, eax
jne 0x18000d6a1
mov rcx, rbx
call fcn.180009570
mov rcx, rbx
call fcn.18000be10
mov r11d, dword [rsi + 8]
mov r9, qword [rsi + 0x18]
test r11d, r11d
je 0x18000d65d
movzx ecx, bl
mov r8, rbx
xor ecx, 0x811c9dc5
shr r8, 8
movzx eax, r8b
shr r8, 8
imul ecx, ecx, 0x1000193
xor eax, ecx
movzx ecx, r8b
shr r8, 8
imul eax, eax, 0x1000193
xor ecx, eax
movzx eax, r8b
shr r8, 8
imul ecx, ecx, 0x1000193
xor eax, ecx
movzx ecx, r8b
shr r8, 8
imul eax, eax, 0x1000193
xor ecx, eax
movzx eax, r8b
shr r8, 8
imul ecx, ecx, 0x1000193
xor eax, ecx
movzx ecx, r8b
shr r8, 8
movzx edx, r8b
shr r8, 8
imul eax, eax, 0x1000193
xor ecx, eax
movzx eax, r8b
imul ecx, ecx, 0x1000193
xor edx, ecx
imul edx, edx, 0x1000193
xor eax, edx
xor edx, edx
imul eax, eax, 0x1000193
div r11d
mov rax, qword [r9 + rdx*8]
lea rdx, [r9 + rdx*8]
test rax, rax
je 0x18000d634
cmp qword [rax + 8], rbx
je 0x18000d634
mov rdx, rax
mov rax, qword [rax]
test rax, rax
jne 0x18000d623
test rdx, rdx
je 0x18000d65d
mov rcx, qword [rdx]
test rcx, rcx
je 0x18000d65d
mov rax, qword [rcx]
mov qword [rdx], rax
call fcn.18000be10
dec qword [rsi + 0x10]
mov rdx, qword [rsi + 0x10]
lea rcx, [rsi + 8]
call fcn.18000cdd0
mov rcx, qword [rsi + 0x18]
mov eax, dword [rsi + 8]
xor ebx, ebx
lea rdx, [rcx + rax*8]
cmp rcx, rdx
je 0x18000d690
nop
cmp qword [rcx], rbx
jne 0x18000d68d
add rcx, 8
cmp rcx, rdx
jne 0x18000d670
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x30], rdx
jmp 0x18000d533
mov rbx, qword [rcx]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x30], rdx
jmp 0x18000d533
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x18000df80
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
mov eax, 0x20
call fcn.18002da40
sub rsp, rax
xor ebx, ebx
mov rsi, rcx
mov ebp, ebx
test rcx, rcx
je 0x18000e067
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
or rcx, 0xffffffffffffffff
mov rdi, rsi
mov r12d, eax
xor eax, eax
repne scasw ax, word [rdi]
not rcx
lea rdx, [rcx - 1]
lea ecx, [r12 + 1]
add rdx, rcx
lea ecx, [rbx + 0x40]
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbp, rax
test rax, rax
je 0x18000e06a
mov edx, r12d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea ecx, [rax - 1]
cmp word [rbp + rcx*2], 0x5c
je 0x18000e014
mov ecx, eax
mov edx, 0x5c
inc eax
mov word [rbp + rcx*2], dx
or rcx, 0xffffffffffffffff
movsxd r8, eax
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
dec rcx
je 0x18000e067
add r8, r8
mov rdx, rsi
sub r8, rsi
add r8, rbp
nop word [rax + rax]
movzx eax, word [rdx]
or rcx, 0xffffffffffffffff
inc ebx
mov word [r8 + rdx], ax
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
mov eax, ebx
add rdx, 2
not rcx
dec rcx
cmp rax, rcx
jb 0x18000e040
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x18000edc0
Capabilities:
Hash data using sha256

Disassembly:
push rbx
sub rsp, 0xb0
mov rax, qword [0x1800a9050]
xor rax, rsp
mov qword [rsp + 0xa0], rax
xor eax, eax
mov dword [rsp + 0x20], 0x6a09e667
mov rbx, rcx
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x50], rax
lea r8, [r8*8]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x24], 0xbb67ae85
mov dword [rsp + 0x28], 0x3c6ef372
mov dword [rsp + 0x2c], 0xa54ff53a
mov dword [rsp + 0x30], 0x510e527f
mov dword [rsp + 0x34], 0x9b05688c
mov dword [rsp + 0x38], 0x1f83d9ab
mov qword [rsp + 0x3c], 0x5be0cd19
call fcn.18000ee80
mov r9b, 1
lea rcx, [rsp + 0x20]
mov r8b, 0x81
mov rdx, rbx
call fcn.18000eb70
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.18002ce70
add rsp, 0xb0
pop rbx
ret

Function at 0x18002c650
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
test ecx, ecx
jle 0x18002c72d
push rbx
sub rsp, 0x40
movsxd rbx, ecx
cmp ebx, 0x64
jle 0x18002c6ba
imul rcx, rbx, 0xfffffffffffffff6
xor r8d, r8d
mov qword [rsp + 0x58], rcx
xor ecx, ecx
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
xor r9d, r9d
lea rdx, [rsp + 0x58]
mov rbx, rax
xor r8d, r8d
xor eax, eax
mov rcx, rbx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_SetWaitableTimer]
or edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x40
pop rbx
ret
lea rcx, [rsp + 0x68]
movaps xmmword [rsp + 0x30], xmm6
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movss xmm6, dword [0x18007c6fc]
nop dword [rax]
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x58]
xorps xmm1, xmm1
sub rax, qword [rsp + 0x60]
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [rsp + 0x68]
cvtsi2ss xmm1, rax
divss xmm1, xmm0
mulss xmm1, xmm6
mulss xmm1, xmm6
cvttss2si rax, xmm1
cmp rax, rbx
jl 0x18002c6e0
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop rbx
ret
Function at 0x1800371c8
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x18003709f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x18003709f
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x18003709f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x18003709f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x18003709f
cmp dword [rcx + 0x84], 0xe
jbe 0x18003709f
cmp dword [rcx + 0xf8], 0
je 0x18003709f
mov ecx, ebx
call fcn.180037140
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.180036f30
cmp dword [rbp + 0x20], 0
je 0x1800370ec
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1800370f4
int3
xor r8d, r8d
xor edx, edx
jmp 0x180037038

Function at 0x180051bf4
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x180051c07
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.18005226c
lea rdx, [0x1800a75d8]
lea rcx, [rsp + 0x20]
call fcn.180032764
int3

Function at 0x18005c824
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x1800b1f98]
xor edx, edx
jmp fcn.180051bf4

Function at 0x18005d210
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x1800b1f98]
jmp fcn.180051bf4
Function at 0x140001480
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x140109b20]
mov dword [rax], 1
mov rax, qword [0x140109b30]
mov dword [rax], 1
mov rax, qword [0x140109b40]
mov dword [rax], 1
mov rax, qword [0x140109b10]
mov dword [rax], 1
mov rax, qword [0x1401099c0]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400014de
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x14000150a
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x140001530
cmp eax, 0x20b
je 0x140001557
jmp 0x140001586
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x140001543
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x14000158b
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x140001572
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x14000158b
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x1400067a0
Capabilities:
Read file on windows

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x20
mov r13, rcx
mov rcx, rdx
mov edx, 1
mov rbx, r8
mov r9, r13
call sym.fread
mov r12, rax
cmp rbx, rax
je 0x1400067d3
mov rcx, r13
call sym.ferror
test eax, eax
jne 0x1400067e0
mov rax, r12
add rsp, 0x20
pop rbx
pop r12
pop r13
ret
mov rcx, r13
call sym.checkErr__stdZsyncio_u162.part.0
mov rax, r12
add rsp, 0x20
pop rbx
pop r12
pop r13
ret

Function at 0x140007210
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
sub rsp, 0x28
mov r12, rcx
mov rcx, rdx
mov edx, 1
mov r9, r12
call sym.fwrite
mov rcx, r12
mov r13, rax
call sym.ferror
test eax, eax
je 0x140007242
mov rcx, r12
call sym.checkErr__stdZsyncio_u162.part.0
mov rax, r13
add rsp, 0x28
pop r12
pop r13
ret
Function at 0x140007480
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rax, [0x1400ee460]
mov r14, rcx
mov r13, rdx
lea rcx, [rsp + 0x20]
mov edx, 0xfa0
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
call sym.mnewString
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x40], rax
mov rbx, rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x48], rax
test rbx, rbx
jle 0x1400075f8
mov rcx, qword [0x140109990]
lea rdi, [rsp + 0x30]
movabs r15, 0x7fffffffffffffff
movabs rbp, 0x8000000000000000
call sym.__emutls_get_address
mov rsi, rax
nop dword [rax]
mov rax, qword [rsp + 0x48]
mov r9, r13
mov r8d, 0xfa0
mov edx, 1
lea rcx, [rax + 8]
call sym.fread
mov r12, rax
cmp rax, 0xfa0
je 0x140007590
mov rcx, r13
call sym.ferror
test eax, eax
je 0x140007553
mov rcx, r13
call sym.checkErr__stdZsyncio_u162.part.0
cmp byte [rsi], 0
je 0x140007640
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140007570
test byte [rcx + 7], 0x40
je 0x140007630
movdqa xmm0, xmmword [rsp + 0x30]
mov rax, r14
movups xmmword [r14], xmm0
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
cmp byte [rsi], 0
jne 0x14000755c
mov rdx, qword [rsp + 0x40]
mov rcx, rdi
call sym.prepareAdd
mov rbx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
test rbx, rbx
jle 0x1400075f8
mov r8, rbx
add r8, 1
jo 0x14000760d
test r8, r8
js 0x140007618
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
add rdx, 8
lea rcx, [rcx + rax + 8]
call sym.memcpy
add rbx, qword [rsp + 0x30]
jo 0x14000760d
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsp + 0x40]
test rbx, rbx
jg 0x140007518
nop dword [rax]
xor ecx, ecx
lea rdx, [rbx - 1]
call sym.raiseIndexError2
mov rcx, qword [rsp + 0x48]
jmp 0x140007561
call sym.raiseOverflow
jmp 0x1400075e3
mov r8, r15
xor edx, edx
mov rcx, rbp
call sym.raiseRangeErrorI
jmp 0x1400075e3
call sym.deallocShared
jmp 0x140007570
test r12, r12
js 0x1400076b8
lea rcx, [rsp + 0x40]
mov rdx, r12
call sym.setLengthStrV2
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x30]
call sym.prepareAdd
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
test rbx, rbx
jle 0x140007561
mov r8, rbx
add r8, 1
jo 0x1400076fb
test r8, r8
js 0x1400076d6
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
lea r9, [rdx + rax + 8]
lea rdx, [rcx + 8]
mov rcx, r9
call sym.memcpy
add rbx, qword [rsp + 0x30]
jo 0x1400076fb
mov qword [rsp + 0x30], rbx
mov rcx, qword [rsp + 0x48]
jmp 0x140007561
movabs r8, 0x7fffffffffffffff
mov rcx, r12
xor edx, edx
call sym.raiseRangeErrorI
mov rcx, qword [rsp + 0x48]
jmp 0x140007561
movabs rcx, 0x8000000000000000
xor edx, edx
movabs r8, 0x7fffffffffffffff
call sym.raiseRangeErrorI
mov rcx, qword [rsp + 0x48]
jmp 0x140007561
call sym.raiseOverflow
jmp 0x14000755c
Function at 0x140007710
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x40
mov r14, rcx
mov r13, rdx
mov r12, r8
test r8, r8
js 0x140007800
lea rdi, [rsp + 0x20]
mov rdx, r8
mov rcx, rdi
call sym.mnewString
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov rdx, rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
test rdx, rdx
jle 0x140007850
mov rax, qword [rsp + 0x38]
mov r9, r13
mov r8, r12
mov edx, 1
lea rcx, [rax + 8]
call sym.fread
mov r15, rax
cmp r12, rax
je 0x140007792
mov rcx, r13
call sym.ferror
test eax, eax
jne 0x140007820
mov rcx, qword [0x140109990]
call sym.__emutls_get_address
cmp byte [rax], 0
mov rbx, rax
jne 0x1400077de
mov rcx, r13
call sym.fgetc
mov rdx, r13
mov ecx, eax
mov esi, eax
call sym.ungetc
cmp byte [rbx], 0
jne 0x1400077de
test esi, esi
jns 0x140007860
cmp r12, r15
jle 0x1400077de
test r15, r15
js 0x140007830
lea rcx, [rsp + 0x30]
mov rdx, r15
call sym.setLengthStrV2
movdqa xmm0, xmmword [rsp + 0x30]
mov rax, r14
movups xmmword [r14], xmm0
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
ret
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, r12
call sym.raiseRangeErrorI
jmp 0x1400077de
mov rcx, r13
call sym.checkErr__stdZsyncio_u162.part.0
jmp 0x140007792
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, r15
call sym.raiseRangeErrorI
jmp 0x1400077de
sub rdx, 1
xor ecx, ecx
call sym.raiseIndexError2
jmp 0x1400077de
mov rdx, r13
mov rcx, rdi
call sym.readAllBuffer__stdZsyncio_u511
cmp byte [rbx], 0
mov rsi, qword [rsp + 0x20]
mov r12, qword [rsp + 0x28]
jne 0x1400078bf
lea rcx, [rsp + 0x30]
mov rdx, rsi
call sym.prepareAdd
test rsi, rsi
jle 0x1400078bf
mov r8, rsi
add r8, 1
jo 0x1400078e1
test r8, r8
js 0x1400078f0
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
lea rcx, [rdx + rax + 8]
lea rdx, [r12 + 8]
call sym.memcpy
add rsi, qword [rsp + 0x30]
jo 0x1400078e1
mov qword [rsp + 0x30], rsi
test r12, r12
je 0x1400077de
test byte [r12 + 7], 0x40
jne 0x1400077de
mov rcx, r12
call sym.deallocShared
jmp 0x1400077de
call sym.raiseOverflow
jmp 0x1400078bf
movabs r8, 0x7fffffffffffffff
xor edx, edx
movabs rcx, 0x8000000000000000
call sym.raiseRangeErrorI
jmp 0x1400078bf

Function at 0x140007e20
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
sub rsp, 0x28
mov r12, rcx
mov rcx, rdx
mov r13, rdx
call sym.strlen
mov rcx, r13
mov r9, r12
mov edx, 1
mov r8, rax
call sym.fwrite
mov rcx, r12
add rsp, 0x28
pop r12
pop r13
jmp sym.fflush

Function at 0x14000d230
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x20
mov rbx, rdx
mov r13, rcx
mov ecx, 2
call qword [sym.__acrt_iob_func]
mov rcx, r13
mov r8, rbx
mov edx, 1
mov r12, rax
mov r9, rax
call sym.fwrite
mov rcx, r12
add rsp, 0x20
pop rbx
pop r12
pop r13
jmp sym.fflush