joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413c70
Capabilities:
Identify system language via api

Disassembly:
push rbp
sub rsp, 0x70
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x88], rdx
mov qword [rbp + 0x90], r8
mov rcx, qword [rbp + 0x88]
call fcn.0040e980
mov rcx, qword [rbp + 0x90]
call fcn.0040e980
nop
mov rcx, qword [rbp + 0x28]
call fcn.0040e7f0
cmp qword [rbp + 0x90], 0
je 0x413e36
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0x90]
call fcn.0040eec0
xor rax, rax
cmp qword [rbp + 0x90], 0
je 0x413d21
mov rax, qword [rbp + 0x90]
mov eax, dword [rax - 4]
cmp eax, 1
jl 0x413d5b
mov rcx, qword [rbp + 0x90]
movsxd rdx, eax
cmp word [rcx + rdx*2 - 2], 0x2e
jne 0x413d54
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0x90]
mov r8d, 1
mov r9d, eax
call fcn.00410540
jmp 0x413d5b
sub eax, 1
test eax, eax
jne 0x413d26
nop
lea rcx, [rbp + 0x68]
mov rdx, qword [rbp + 0x88]
call fcn.00413840
cmp qword [rbp + 0x68], 0
je 0x413d99
mov rcx, rbp
lea rdx, [rbp + 0x58]
mov r8, qword [rbp + 0x60]
mov r9, qword [rbp + 0x68]
call fcn.004139f0
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x58]
call fcn.0040ee40
jmp 0x413e35
call sub.kernel32.dll_GetUserDefaultUILanguage
lea rcx, [rbp + 0x48]
mov edx, eax
call fcn.00412f90
mov rcx, rbp
lea rdx, [rbp + 0x50]
mov r8, qword [rbp + 0x60]
mov r9, qword [rbp + 0x48]
call fcn.004139f0
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x50]
call fcn.0040ee40
mov rax, qword [rbp + 0x28]
cmp qword [rax], 0
jne 0x413e0e
cmp byte [0x008b3e68], 0
jne 0x413e0e
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea rcx, [rbp + 0x38]
mov edx, eax
call fcn.00412f90
mov rcx, rbp
lea rdx, [rbp + 0x40]
mov r8, qword [rbp + 0x60]
mov r9, qword [rbp + 0x38]
call fcn.004139f0
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x40]
call fcn.0040ee40
mov rax, qword [rbp + 0x28]
cmp qword [rax], 0
jne 0x413e35
mov rcx, rbp
lea rdx, [rbp + 0x30]
mov r8, qword [rbp + 0x60]
call fcn.00413b30
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x30]
call fcn.0040ee40
nop
lea rcx, [rbp + 0x30]
mov edx, 8
call fcn.0040e8d0
lea rcx, [rbp + 0x88]
mov edx, 2
call fcn.0040e8d0
mov rax, qword [rbp + 0x28]
lea rsp, [rbp + 0x70]
pop rbp
ret

Function at 0x4165b0
Capabilities:
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
call fcn.004165a0
mov ebx, eax
test ebx, ebx
je 0x4165fb
cmp dword [0x0084ffc8], 0xffffffff
jne 0x4165d4
mov ecx, 0xe2
call fcn.0040e4f0
mov ecx, ebx
call fcn.00416580
test rax, rax
jne 0x4165ed
mov ecx, 0xe2
call fcn.0040e4f0
jmp 0x4165fb
mov ecx, dword [0x0084ffc8]
mov rdx, rax
call sub.kernel32.dll_TlsSetValue
add rsp, 0x20
pop rbx
ret
Function at 0x416610
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
cmp byte [0x008b3f44], 0
je 0x41664b
mov ecx, dword [0x0084ffc8]
call sub.kernel32.dll_TlsGetValue
test rax, rax
jne 0x41665e
call fcn.004165b0
mov ecx, dword [0x0084ffc8]
call sub.kernel32.dll_TlsGetValue
test rax, rax
jne 0x41665e
mov rax, qword [0x008b3f78]
jmp 0x41665e
mov rax, qword gs:[0x58]
mov ecx, dword [0x0084ffc8]
mov rax, qword [rax + rcx*8]
add rsp, 0x28
ret

Function at 0x52d390
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbp, rsp
mov rsi, rcx
lea rdi, [rbp + 0x20]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
cmp qword [0x008b8e50], 0
jne 0x52d445
xor rcx, rcx
mov edx, 0x1000
mov r8d, 0x1000
mov r9d, 0x40
call sub.kernel32.dll_VirtualAlloc_1
mov rbx, rax
mov rax, qword [0x008b8e48]
mov qword [rbx], rax
lea rcx, [0x00868d4c]
lea rdx, [rbx + 8]
mov r8d, 8
call fcn.00409100
lea rax, [0x0052d350]
mov qword [rbx + 0x10], rax
lea rsi, [rbx + 0x18]
mov byte [rsi], 0xe8
mov rcx, rsi
lea rdx, [rbx + 8]
call fcn.0052d380
mov dword [rsi + 1], eax
mov rax, qword [0x008b8e50]
mov qword [rsi + 5], rax
mov qword [0x008b8e50], rsi
add rsi, 0x15
mov rax, rbx
neg rax
lea rax, [rsi + rax]
cmp rax, 0xfed
jl 0x52d403
mov qword [0x008b8e48], rbx
mov rax, qword [0x008b8e50]
mov rsi, qword [0x008b8e50]
mov rcx, qword [rsi + 5]
mov qword [0x008b8e50], rcx
lea rdi, [rsi + 5]
lea rsi, [rbp + 0x20]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
lea rsp, [rbp + 0x38]
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x595a20
Capabilities:
Encode data using xor

Disassembly:
mov r8, rcx
xor rax, rax
xor rcx, rcx
sub edx, 1
cmp ecx, edx
jg 0x595a62
add edx, 1
mov r9d, eax
and r9w, 0xf800
movzx r9d, r9w
shr r9d, 0xb
shl eax, 5
or r9w, ax
mov eax, r9d
movzx r9w, byte [r8]
xor ax, r9w
add r8, 1
add ecx, 1
cmp ecx, edx
jne 0x595a33
nop
ret
Function at 0x6c6880
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push rbp
sub rsp, 0x510
mov rbp, rsp
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x58], rbp
mov qword [rbp + 0x520], rcx
nop
mov rax, qword [rbp + 0x520]
cmp qword [rax + 0x80], 0
jne 0x6c6ab2
mov rcx, qword [0x004dc638]
mov dl, 1
call fcn.0050f400
mov rcx, qword [rbp + 0x520]
mov qword [rcx + 0x80], rax
mov rax, qword [rbp + 0x520]
lea rcx, [rax + 0x88]
call fcn.0040e7f0
mov ecx, 0x40
lea rdx, [rbp + 0x2f0]
call sub.user32.dll_GetKeyboardLayoutList
mov dword [rbp + 0x4fc], eax
xor rax, rax
mov ecx, dword [rbp + 0x4fc]
sub ecx, 1
mov dword [rbp + 0x3c], ecx
mov dword [rbp + 0x4f8], eax
mov eax, dword [rbp + 0x3c]
cmp dword [rbp + 0x4f8], eax
jg 0x6c6a8a
mov eax, dword [rbp + 0x3c]
add eax, 1
mov dword [rbp + 0x3c], eax
movsxd rax, dword [rbp + 0x4f8]
mov rcx, qword [rbp + rax*8 + 0x2f0]
call fcn.005e4450
test al, al
je 0x6c6a74
movsxd rax, dword [rbp + 0x4f8]
lea rax, [rbp + rax*8 + 0x2f0]
mov qword [rbp + 0x48], rax
mov byte [rbp + 0x50], 0x10
lea rcx, [rbp + 0x70]
lea rdx, [0x006c6b44]
lea r8, [rbp + 0x48]
xor r9, r9
call fcn.00434800
mov rcx, 0xffffffff80000002
mov rdx, rax
xor r8, r8
mov r9d, 0x20019
lea rax, [rbp + 0x508]
mov qword [rsp + 0x20], rax
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x6c6a74
nop
mov dword [rbp + 0x4f4], 0x200
mov rcx, qword [rbp + 0x508]
lea rdx, [0x006c6bb2]
xor r8, r8
xor r9, r9
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x4f4]
mov qword [rsp + 0x28], rax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x6c6a67
lea rcx, [rbp + 0x40]
lea rdx, [rbp + 0xf0]
mov r8d, pe_nt_image_headers64
call fcn.0040ffd0
mov rax, qword [rbp + 0x520]
mov rax, qword [rax + 0x80]
mov rcx, rax
mov rdx, qword [rbp + 0x40]
movsxd r8, dword [rbp + 0x4f8]
mov r8, qword [rbp + r8*8 + 0x2f0]
mov rax, qword [rax]
call qword [rax + 0x80]
movsxd rax, dword [rbp + 0x4f8]
mov rcx, qword [rbp + 0x520]
mov rax, qword [rbp + rax*8 + 0x2f0]
cmp rax, qword [rcx + 0x90]
jne 0x6c6a67
mov rax, qword [rbp + 0x520]
lea rcx, [rax + 0x88]
lea rdx, [rbp + 0xf0]
mov r8d, pe_nt_image_headers64
call fcn.0040ffd0
nop
mov rcx, qword [rbp + 0x508]
call sub.advapi32.dll_RegCloseKey_1
add dword [rbp + 0x4f8], 1
mov eax, dword [rbp + 0x3c]
cmp dword [rbp + 0x4f8], eax
jne 0x6c6928
nop
mov rax, qword [rbp + 0x520]
mov rax, qword [rax + 0x80]
mov byte [rax + 0x61], 0
mov rax, qword [rbp + 0x520]
mov rcx, qword [rax + 0x80]
mov dl, 1
call fcn.0050f2b0
mov rax, qword [rbp + 0x520]
mov rax, qword [rax + 0x80]
mov qword [rbp + 0x500], rax
nop
lea rcx, [rbp + 0x40]
call fcn.0040e7f0
mov rax, qword [rbp + 0x500]
lea rsp, [rbp + 0x510]
pop rbp
ret
Function at 0x6c7e40
Capabilities:
Create thread

Disassembly:
sub rsp, 0x48
mov rax, qword [0x008b94d0]
cmp byte [rax + 0x159], 0
jne 0x6c7ee3
cmp qword [0x008b9508], 0
jne 0x6c7e86
call sub.kernel32.dll_GetCurrentThreadId_1
mov ecx, 3
mov rdx, qword [0x0088c0f8]
xor r8, r8
mov r9d, eax
call sub.user32.dll_SetWindowsHookExW
mov qword [0x008b9508], rax
cmp qword [0x008b9500], 0
jne 0x6c7ea8
xor rcx, rcx
xor rdx, rdx
xor r8, r8
xor r9, r9
call sub.kernel32.dll_CreateEventW
mov qword [0x008b9500], rax
cmp qword [0x008b9510], 0
jne 0x6c7ee3
xor rcx, rcx
mov edx, 0x3e8
mov r8, qword [0x0088c0f0]
xor r9, r9
mov dword [rsp + 0x20], 0
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
call sub.kernel32.dll_CreateThread_1
mov qword [0x008b9510], rax
add rsp, 0x48
ret

Function at 0x6c9130
Capabilities:
Enumerate gui resources

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x50
mov rbp, rsp
mov rbx, rcx
cmp qword [rbx + 0x2d0], 0
je 0x6c9216
cmp dword [rbx + 0x128], 0
jne 0x6c920c
mov rax, qword [rbx + 0x2d0]
mov qword [rbp + 0x40], rax
mov byte [rbp + 0x48], dl
lea rcx, [0x006c9010]
lea rdx, [rbp + 0x40]
call sub.user32.dll_EnumWindows
mov rax, qword [rbx + 0x120]
cmp dword [rax + 0x10], 0
je 0x6c920c
mov rcx, qword [rbp + 0x40]
mov edx, 3
call sub.user32.dll_GetWindow
mov qword [rbp + 0x40], rax
mov rcx, qword [rbp + 0x40]
mov edx, 0xffffffec
call sub.user32.dll_GetWindowLongPtrW
test rax, 8
je 0x6c91ba
mov qword [rbp + 0x40], 0xfffffffffffffffe
mov rax, qword [rbx + 0x120]
mov esi, dword [rax + 0x10]
sub esi, 1
test esi, esi
jl 0x6c920b
mov rcx, qword [rbx + 0x120]
mov edx, esi
call fcn.005079c0
mov rcx, rax
mov rdx, qword [rbp + 0x40]
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0x213
call sub.user32.dll_SetWindowPos
sub esi, 1
cmp esi, 0xffffffff
jne 0x6c91cb
nop
lea rax, [rbx + 0x128]
add dword [rax], 1
lea rsp, [rbp + 0x50]
pop rbx
pop rsi
pop rbp
ret
Function at 0x6c9560
Capabilities:
Enumerate gui resources

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbp, rsp
mov rbx, rcx
mov esi, edx
mov rax, qword [0x008b94d0]
cmp qword [rax + 0x2d0], 0
je 0x6c973a
test sil, sil
jne 0x6c9659
cmp dword [rbx + 0x138], 0
jne 0x6c964a
mov rcx, rbx
call fcn.006cdca0
lea rcx, [0x006c9400]
mov rdx, rax
call sub.user32.dll_EnumWindows
cmp qword [rbx + 0xa8], 0
je 0x6c960c
mov rax, qword [0x008b94d0]
cmp byte [rax + 0x193], 0
je 0x6c960c
mov rax, qword [rbx + 0x1a0]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
test rax, rax
je 0x6c95e5
mov rax, qword [rax - 8]
lea rdi, [rax - 1]
test edi, edi
jl 0x6c960b
mov rax, qword [rbx + 0x1a0]
movsxd rcx, edi
mov rcx, qword [rax + rcx*8]
xor rdx, rdx
call sub.user32.dll_ShowWindow
sub edi, 1
cmp edi, 0xffffffff
jne 0x6c95ed
nop
mov rax, qword [rbx + 0x130]
mov edi, dword [rax + 0x10]
sub edi, 1
test edi, edi
jl 0x6c9649
mov rcx, qword [rbx + 0x130]
mov edx, edi
call fcn.005079c0
mov rcx, rax
test sil, sil
setne al
movzx rax, al
neg eax
mov edx, eax
call sub.user32.dll_ShowOwnedPopups
sub edi, 1
cmp edi, 0xffffffff
jne 0x6c961d
nop
lea rax, [rbx + 0x138]
add dword [rax], 1
jmp 0x6c973a
cmp dword [rbx + 0x138], 0
jle 0x6c973a
lea rax, [rbx + 0x138]
sub dword [rax], 1
cmp dword [rbx + 0x138], 0
jne 0x6c973a
cmp qword [rbx + 0xa8], 0
je 0x6c96d9
mov rax, qword [0x008b94d0]
cmp byte [rax + 0x193], 0
je 0x6c96d9
mov rax, qword [rbx + 0x1a0]
mov qword [rbp + 0x20], rax
mov rax, qword [rbp + 0x20]
test rax, rax
je 0x6c96af
mov rax, qword [rax - 8]
lea rdi, [rax - 1]
test edi, edi
jl 0x6c96d8
mov rax, qword [rbx + 0x1a0]
movsxd rcx, edi
mov rcx, qword [rax + rcx*8]
mov edx, 5
call sub.user32.dll_ShowWindow
sub edi, 1
cmp edi, 0xffffffff
jne 0x6c96b7
nop
mov rax, qword [rbx + 0x130]
mov edi, dword [rax + 0x10]
sub edi, 1
test edi, edi
jl 0x6c9716
mov rcx, qword [rbx + 0x130]
mov edx, edi
call fcn.005079c0
mov rcx, rax
test sil, sil
setne al
movzx rax, al
neg eax
mov edx, eax
call sub.user32.dll_ShowOwnedPopups
sub edi, 1
cmp edi, 0xffffffff
jne 0x6c96ea
nop
mov rax, qword [rbx + 0x130]
mov rcx, rax
mov rsi, qword [rax]
call qword [rsi + 0x10]
lea rcx, [rbx + 0x1a0]
mov rdx, qword [0x006b3498]
call fcn.00411da0
lea rsp, [rbp + 0x38]
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x6ce0a0
Capabilities:
Hide graphical window from taskbar

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov esi, edx
cmp sil, byte [rbx + 0x193]
je 0x6ce271
mov byte [rbx + 0x193], sil
cmp qword [rbx + 0xa8], 0
je 0x6ce1d2
mov rcx, qword [rbx + 0xa8]
call fcn.005da790
test al, al
je 0x6ce1d2
mov rax, qword [rbx + 0xa8]
movzx rax, word [rax + 0x34]
test ax, 0x10
jne 0x6ce1d2
mov rax, qword [rbx + 0xa8]
movzx rax, word [rax + 0x34]
test ax, 2
jne 0x6ce1d2
test sil, sil
je 0x6ce14f
mov rcx, qword [rbx + 0x2d0]
xor rdx, rdx
xor r8, r8
call fcn.006b7c50
mov rcx, qword [rbx + 0xa8]
call fcn.005da190
mov rcx, rax
mov dl, 1
mov rax, qword [rbx + 0xa8]
movzx r8, byte [rax + 0xa9]
call fcn.006b7c50
jmp 0x6ce1ba
call sub.user32.dll_GetForegroundWindow
mov rdi, rax
mov rcx, qword [rbx + 0xa8]
call fcn.005da190
cmp rdi, rax
sete dil
mov rcx, qword [rbx + 0xa8]
call fcn.005da190
mov rcx, rax
xor rdx, rdx
mov rax, qword [rbx + 0xa8]
movzx r8, byte [rax + 0xa9]
call fcn.006b7c50
mov rcx, qword [rbx + 0x2d0]
mov dl, 1
mov r8b, 1
call fcn.006b7c50
test dil, dil
je 0x6ce1ba
mov rcx, qword [rbx + 0xa8]
call fcn.005da190
mov rcx, rax
call sub.user32.dll_SetForegroundWindow
mov rcx, qword [rbx + 0xa8]
mov edx, 0xb033
xor r8, r8
xor r9, r9
call fcn.005cdba0
test sil, sil
je 0x6ce21c
mov rax, qword [rbx + 0x2d0]
mov rsi, qword [rbx + 0x2d0]
mov rcx, rax
mov edx, 0xffffffec
call sub.user32.dll_GetWindowLongPtrW
or rax, 0x80
mov rcx, rsi
mov edx, 0xffffffec
mov r8, rax
call sub.user32.dll_SetWindowLongPtrW
mov rcx, qword [rbx + 0x2d0]
xor rdx, rdx
call sub.user32.dll_SetWindowTextW
jmp 0x6ce271
mov rax, qword [rbx + 0x2d0]
mov rsi, qword [rbx + 0x2d0]
mov rcx, rax
mov edx, 0xffffffec
call sub.user32.dll_GetWindowLongPtrW
and rax, 0xffffffffffffff7f
mov rcx, rsi
mov edx, 0xffffffec
mov r8, rax
call sub.user32.dll_SetWindowLongPtrW
mov rsi, qword [rbx + 0x2d0]
mov rax, qword [rbx + 0x118]
mov rcx, rax
call fcn.0040fed0
mov rcx, rsi
mov rdx, rax
call sub.user32.dll_SetWindowTextW
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
Function at 0x140001a45
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rax, qword [0x1400120c8]
xor ebx, ebx
add rax, 0x18
mov r12, rcx
mov ecx, dword [0x1400120c4]
mov rsi, rdx
mov rdi, r8
cmp ebx, ecx
jge 0x140001a93
mov rdx, qword [rax]
cmp r12, rdx
jb 0x140001a8b
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x140001b7c
inc ebx
add rax, 0x28
jmp 0x140001a6b
mov rcx, r12
call fcn.1400022b5
mov rbp, rax
test rax, rax
jne 0x140001ab2
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.1400019e0
movsxd rbx, ebx
mov rax, qword [0x1400120c8]
imul rbx, rbx, 0x28
add rax, rbx
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call fcn.140002365
mov edx, dword [rbp + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1400120c8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x140001b16
mov rax, qword [0x1400120c8]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.1400019e0
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140001b76
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x140001b76
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rbx, qword [0x1400120c8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140001b76
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.1400019e0
inc dword [0x1400120c4]
mov ecx, edi
mov rdi, r12
rep movsb byte [rdi], byte [rsi]
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x140001fd0
Capabilities:
Get thread local storage value

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x20
lea r13, [0x140012120]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140012100]
test rbx, rbx
je 0x14000201e
mov ecx, dword [rbx]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140002018
test r12, r12
je 0x140002018
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
jmp 0x140001ff0
mov rcx, r13
add rsp, 0x20
pop rbx
pop r12
pop r13
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x1400021e0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140002203
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x140002203
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140002204
Capabilities:
Enumerate pe sections

Disassembly:
xor r8d, r8d
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r9d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
cmp r9d, r8d
jbe 0x14000223e
mov r10d, dword [rax + 0xc]
mov rcx, r10
cmp r10, rdx
ja 0x140002235
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x140002240
inc r8d
add rax, 0x28
jmp 0x14000221c
xor eax, eax
ret
Function at 0x1400022b5
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x14000e8c0]
mov r8, rcx
mov rcx, r9
call fcn.1400021e0
test eax, eax
je 0x1400022e1
mov rdx, r8
mov rcx, r9
sub rdx, r9
add rsp, 0x28
jmp fcn.140002204
xor eax, eax
add rsp, 0x28
ret

Function at 0x1400062c2
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x14000d108], eax
inc eax
jne 0x1400062dc
call sub.msvcrt.dll_abort
nop
add rsp, 0x28
ret

Function at 0x140006464
Capabilities:
Print debug messages

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x90
mov rbx, rcx
test rcx, rcx
je 0x140006502
call fcn.14000912a
dec eax
jne 0x1400064fb
xor eax, eax
lea rdi, [rsp + 0x25]
mov ecx, 0xa
lea rsi, str.Error_cleaning_up_spin_keys_for_thread
rep movsd dword [rdi], dword [rsi]
lea rdi, [rsp + 0x4d]
mov ecx, 0x43
rep stosb byte [rdi], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [rsp + 0x4c]
mov r8d, 0xa
mov ecx, eax
call qword [sym.imp.msvcrt.dll__ultoa]
mov edx, 0x27
lea rcx, [rsp + 0x25]
cmp byte [rcx + rdx], 0
mov eax, edx
je 0x1400064da
inc rdx
cmp rdx, 0x6b
jne 0x1400064c7
jmp 0x1400064f0
cmp edx, 0x6a
je 0x1400064f0
inc eax
movsxd rdx, edx
cdqe
mov byte [rsp + rdx + 0x25], 0xa
mov byte [rsp + rax + 0x25], 0
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call sub.msvcrt.dll_abort
mov qword [rbx], 0xffffffffffffffff
add rsp, 0x90
pop rbx
pop rsi
pop rdi
ret

Function at 0x1400065ae
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x50
call fcn.14000650d
mov ecx, dword [0x14000d108]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12, rax
test rax, rax
jne 0x1400066c7
call fcn.1400063b0
cmp qword [0x140014048], 0
mov rbx, rax
je 0x1400066c7
test rax, rax
je 0x1400066c7
mov dword [rax + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
mov dword [rbx + 0x70], eax
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x38], 0xffffffffffffffff
lea rcx, [rbx + 0x68]
mov qword [rbx + 0x30], rax
call fcn.140006464
mov rsi, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rbx + 0xb8], 0
mov qword [rbx + 0x28], 0
call rsi
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r12, rax
call rsi
mov r8, qword [rsp + 0x48]
lea r9, [rbx + 0x28]
mov rdx, r12
mov dword [rsp + 0x30], 2
mov rcx, rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x14000668b
call sub.msvcrt.dll_abort
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov ecx, dword [0x14000d108]
mov rdx, rbx
mov dword [rbx + 0xbc], 0
mov dword [rbx + 0xc0], eax
mov al, byte [rbx + 0x40]
and eax, 0xffffffcf
or eax, 0x10
mov byte [rbx + 0x40], al
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x140006686
mov r12, rbx
mov rax, r12
add rsp, 0x50
pop rbx
pop rsi
pop r12
ret
Function at 0x140007287
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r13
push r12
sub rsp, 0x28
mov r13, rcx
call fcn.1400065ae
mov qword [rax + 8], r13
mov rcx, qword [rax + 0x1d8]
mov r12, rax
call fcn.140006d36
test byte [r12 + 0x40], 0x30
jne 0x1400072c5
lea rcx, [r12 + 0xd0]
mov edx, 1
call qword [sym.imp.msvcrt.dll_longjmp]
mov ecx, dword [0x14000d108]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12, rax
test rax, rax
je 0x140007365
cmp qword [rax + 0x28], 0
mov rcx, qword [rax + 0x30]
jne 0x140007309
mov dword [rax], 0xdeadbeef
test rcx, rcx
je 0x1400072f9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r12 + 0x30], 0
mov r13d, dword [r12 + 8]
jmp 0x14000734f
mov dword [rax + 0xbc], 1
mov r13d, dword [rax + 8]
test rcx, rcx
je 0x140007322
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r12 + 0x30], 0
test byte [r12 + 0x44], 4
je 0x140007365
mov dword [r12], 0xdeadbeef
mov rcx, qword [r12 + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r12 + 0x28], 0
mov rcx, r12
call fcn.1400066d3
mov ecx, dword [0x14000d108]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, r13d
call qword [sym.imp.msvcrt.dll__endthreadex]
nop
Function at 0x1400079ba
Capabilities:
Create thread
Resume thread

Disassembly:
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
mov r13, rdx
mov rsi, r8
mov rdi, r9
call fcn.1400063b0
mov r12, rax
mov eax, 0xb
test r12, r12
je 0x140007bd0
test rbx, rbx
je 0x1400079f9
mov rax, qword [r12 + 0x1d8]
mov qword [rbx], rax
mov dword [r12 + 0xbc], 0
mov dword [r12 + 0x44], 1
mov qword [r12 + 0x28], 0xffffffffffffffff
mov qword [r12 + 8], rdi
mov rdi, qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [r12 + 0x10], rsi
xor esi, esi
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call rdi
mov qword [r12 + 0x30], rax
test rax, rax
jne 0x140007a59
mov eax, esi
neg eax
sbb ecx, ecx
inc esi
and ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, 5
jne 0x140007a2a
mov qword [r12 + 0x38], 0xffffffffffffffff
lea r14, [r12 + 0x68]
mov rcx, r14
call fcn.140006464
cmp qword [r12 + 0x30], 0
mov dword [r12], 0xbab1f00d
mov dword [r12 + 0xc0], 0
mov dword [r12 + 0xb8], 0
je 0x140007b32
xor esi, esi
test r13, r13
je 0x140007acc
mov eax, dword [r13]
mov rsi, qword [r13 + 0x10]
mov dword [r12 + 0x44], eax
test al, 8
je 0x140007ac0
call fcn.1400065ae
mov eax, dword [rax + 0xc0]
jmp 0x140007ac4
mov eax, dword [r13 + 0x18]
mov dword [r12 + 0xc0], eax
lea r8, [0x140006fae]
mov r9, r12
mov edx, esi
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov r13, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
jbe 0x140007b50
mov rcx, qword [r12 + 0x30]
test rcx, rcx
je 0x140007b0e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [r12 + 0x38]
call fcn.1400084a9
mov rcx, r14
call fcn.140006464
mov qword [r12 + 0x30], 0
mov qword [r12 + 0x28], 0
test rbx, rbx
je 0x140007b3e
mov qword [rbx], 0
mov rcx, r12
call fcn.1400066d3
mov eax, 0xb
jmp 0x140007bd0
mov eax, dword [r12 + 0xc0]
mov edx, 0xfffffff1
cmp eax, 0xfffffff2
jl 0x140007b80
mov edx, 0xfffffffe
cmp eax, 0xffffffff
jl 0x140007b80
mov edx, 0xf
cmp eax, 0xe
jg 0x140007b80
mov edx, 2
cmp eax, edx
cmovle edx, eax
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [r12 + 0x30]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
test byte [r12 + 0x44], 4
mov rax, qword [sym.imp.KERNEL32.dll_ResumeThread]
je 0x140007bbc
mov qword [r12 + 0x28], 0
mov rcx, r13
call rax
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140007bc6
mov qword [r12 + 0x28], r13
mov rcx, r13
call rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
ret