joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140161ac0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x140
mov rax, qword [0x140304f48]
xor rax, rsp
mov qword [rsp + 0x138], rax
mov r15, r8
mov r13, rdx
mov qword [rsp + 0x20], rcx
movabs rbx, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
xor edi, edi
mov qword [rsp + 0x118], rdi
mov qword [rsp + 0x128], rdi
mov qword [rsp + 0x130], SafeArrayGetLBound
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [r15 + r8], 0
jne 0x1401618e0
mov rdx, r15
lea rcx, [rsp + 0x118]
call fcn.140008fb0
lea r8, [rsp + 0x118]
mov rsi, qword [rsp + 0x118]
mov r14, qword [rsp + 0x130]
cmp r14, 0x10
cmovae r8, rsi
mov rdx, rbp
mov rcx, rdi
mov rdi, qword [rsp + 0x128]
test rdi, rdi
je 0x140161944
nop dword [rax]
movzx eax, byte [rcx + r8]
xor rdx, rax
imul rdx, rbx
inc rcx
cmp rcx, rdi
jb 0x140161930
mov rcx, qword [r13 + 0x30]
and rcx, rdx
add rcx, rcx
mov rax, qword [r13 + 0x18]
mov rbx, qword [rax + rcx*8 + 8]
mov r12, qword [r13 + 8]
cmp rbx, r12
je 0x1401619b3
mov rbp, qword [rax + rcx*8]
nop dword [rax]
nop dword [rax + rax]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x140161982
mov rdx, qword [rdx]
lea rcx, [rsp + 0x118]
cmp r14, 0x10
cmovae rcx, rsi
cmp rdi, rax
jne 0x1401619a3
mov r8, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1401619ae
cmp rbx, rbp
je 0x1401619b3
mov rbx, qword [rbx + 8]
jmp 0x140161970
test rbx, rbx
jne 0x1401619b6
mov rbx, r12
cmp r14, 0x10
jb 0x1401619ed
lea rdx, [r14 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1401619e5
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140161a70
mov rcx, rsi
call fcn.14017fa70
cmp rbx, qword [r13 + 8]
je 0x1401619fd
mov rax, qword [rbx + 0x30]
cmp rax, qword [rbx + 0x38]
jne 0x140161a77
mov rdx, qword [0x140304e60]
test rdx, rdx
je 0x140161a51
lea rcx, [rsp + 0x28]
call fcn.140166980
nop
mov rcx, rax
call fcn.14001e500
mov rcx, rax
lea rdx, str.Couldnt_translate:
call fcn.1400677a0
mov rcx, rax
mov rdx, r15
call fcn.1400677a0
lea rdx, [0x14007f590]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rcx, [rsp + 0x28]
call fcn.140166a40
mov rax, qword [rsp + 0x20]
cmp byte [rax + 0xb0], 0
je 0x140161a83
mov r13, qword [rax + 0xb8]
mov qword [rsp + 0x20], r13
jmp 0x1401618a4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp qword [rax + 0x18], 0x10
jb 0x140161a86
mov rax, qword [rax]
jmp 0x140161a86
mov rax, r15
mov rcx, qword [rsp + 0x138]
xor rcx, rsp
call fcn.140180070
mov rbx, qword [rsp + 0x188]
add rsp, 0x140
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r8, rdx
mov rdx, rcx
jmp 0x140161870
Function at 0x140167d80
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140304f48]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140167e53
cmp byte [rcx + 0x71], 0
je 0x140167e53
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + SafeArrayPutElement]
cmp eax, 0xffffffff
je 0x140167e4f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140167e14
sub eax, 1
je 0x140167e18
cmp eax, 2
jne 0x140167e4f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140180070
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140167e46
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140167e4f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140167dfc
xor al, al
jmp 0x140167dfc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140180070
add rsp, 0x60
pop rbx
ret
Function at 0x140169250
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140304f48]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14016927d
xor eax, eax
jmp 0x1401693d2
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x1401692a8
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x1401692a8
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x1401693d2
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1401693c5
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x1401692eb
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140169316
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1401693ca
lea rax, [rsp + 0x48]
mov byte [rsp + 0x40], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140169385
sub eax, 1
je 0x140169385
cmp eax, 2
jne 0x1401693c5
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1401693ca
mov rsi, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1401693b3
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1401693c5
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x50], rax
mov eax, edi
jne 0x1401693ca
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140180070
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140169d30
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140169d61
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je 0x140169d7f
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rdi
mov rdi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140169da0
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140169da2
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140169dd4
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rbx
sub rdi, rbx
sub dword [rax], ebx
mov rcx, qword [rsi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
mov rbx, rdi
je 0x140169e71
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140169e12
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rdi, 0xfff
jbe 0x140169e51
nop dword [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
add r14, rax
mov rbx, rdi
cmp rax, 0xfff
jne 0x140169e92
cmp rdi, rax
ja 0x140169e20
test rbx, rbx
je 0x140169e71
mov r9, qword [rsi + 0x80]
mov r8, rdi
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x30]
mov rax, rbp
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
sub rbp, rdi
jmp 0x140169e74
Function at 0x140169ea0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x140169ed7
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x140169ef8
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140169efa
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140169f53
test ecx, ecx
jle 0x140169f33
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
sub rbx, rbp
add r14, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140169f53
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140169f53
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140174510
Capabilities:
Get cpu information
Get system information on windows
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x70
mov rbx, rcx
call fcn.1401749a0
test al, al
jne 0x140174536
mov rcx, rbx
call fcn.1401746f0
test al, al
je 0x140174683
cmp qword [0x14030e710], 0
jne 0x1401746b3
lea r8, [rsp + 0x90]
mov rcx, 0xffffffff80000002
lea rdx, str.HARDWAREDESCRIPTIONSystemCentralProcessor0
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov edi, eax
test eax, eax
je 0x1401745c8
cmp byte [0x14030e718], 0
jne 0x140174683
lea rbx, str.C:.conand095201_src_system_wrappers_sourceplatform_win.cpp
mov byte [0x14030e718], 1
mov rcx, rbx
mov edx, 0x5c
call sub.VCRUNTIME140.dll_strrchr
test rax, rax
je 0x1401745a4
mov edx, 0x5c
mov rcx, rbx
call sub.VCRUNTIME140.dll_strrchr
lea rbx, [rax + 1]
mov dword [rsp + 0x38], edi
lea rax, str.em::GetCpuSpeedByReg
mov qword [rsp + 0x30], rax
lea r9, str.__s:_d__s__get_cpu_speed_fail_by_RegOpenKeyW__status_is__ld
mov dword [rsp + 0x28], 0x11a
jmp 0x14017466b
mov rcx, qword [rsp + 0x90]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
lea rdx, str.MHz
lea rax, [rsp + 0x88]
mov dword [rsp + 0x80], 4
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
je 0x140174693
cmp byte [0x14030e718], 0
je 0x140174683
lea rbx, str.C:.conand095201_src_system_wrappers_sourceplatform_win.cpp
mov byte [0x14030e718], 1
mov rcx, rbx
mov edx, 0x5c
call sub.VCRUNTIME140.dll_strrchr
test rax, rax
je 0x14017464c
mov edx, 0x5c
mov rcx, rbx
call sub.VCRUNTIME140.dll_strrchr
lea rbx, [rax + 1]
mov dword [rsp + 0x38], edi
lea rax, str.em::GetCpuSpeedByReg
mov qword [rsp + 0x30], rax
lea r9, str.__s:_d__s__get_cpu_speed_fail_by_RegQueryValueExW__status_is__ld
mov dword [rsp + 0x28], 0x124
mov rdx, qword [str.COMMON]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea ecx, [r8 + 4]
call fcn.14016ddf0
xor al, al
mov rbx, qword [rsp + 0x98]
add rsp, 0x70
pop rdi
ret
mov eax, dword [rsp + 0x88]
mov rcx, qword [rsp + 0x90]
mov qword [rbx + 0x20], rax
mov qword [0x14030e710], rax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x14030e71c]
test eax, eax
jne 0x1401746d2
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x60]
mov dword [0x14030e71c], eax
mov dword [rbx + 0x28], eax
mov al, 1
mov rbx, qword [rsp + 0x98]
add rsp, 0x70
pop rdi
ret
Function at 0x140177fc0
Capabilities:
Get memory capacity

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x140304f48]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbx, rcx
mov dword [rsp + 0x20], 0x40
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rax, qword [rsp + 0x28]
shr rax, 0x14
mov qword [rbx], rax
mov rax, qword [rsp + 0x30]
shr rax, 0x14
mov qword [rbx + 8], rax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140180070
add rsp, 0x70
pop rbx
ret
Function at 0x14017c990
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movsxd rbp, r8d
mov rsi, rdx
mov rdi, rcx
mov rbx, qword [rcx + 0x10]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test ebp, ebp
js 0x14017c9ef
mov r9, qword [rdi + 0x18]
test r9, r9
je 0x14017c9ef
mov r8, rbp
mov edx, 1
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rsi, rax
cmp eax, ebp
je 0x14017c9f4
cmp byte [rdi + 0x21], 0
jne 0x14017c9f4
mov rcx, rdi
call fcn.14017c640
jmp 0x14017c9f4
mov esi, 0xffffffff
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
nop
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14017caf0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movsxd rsi, r8d
mov rbp, rdx
mov rdi, rcx
mov rbx, qword [rcx + 8]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test rbp, rbp
je 0x14017cb7a
test esi, esi
js 0x14017cb7a
cmp byte [rdi + 0x1a], 0
jne 0x14017cb7a
mov r9, qword [rdi + 0x10]
test r9, r9
je 0x14017cb7a
mov rcx, qword [rdi + 0x20]
mov r8, rsi
test rcx, rcx
je 0x14017cb55
mov rdx, qword [rdi + 0x28]
add rdx, rsi
cmp rdx, rcx
jbe 0x14017cb55
mov rcx, r9
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
jmp 0x14017cb7a
mov edx, 1
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
test rax, rax
je 0x14017cb71
add qword [rdi + 0x28], rax
mov dil, 1
jmp 0x14017cb7d
lea rcx, [rdi - 8]
call fcn.14017c640
xor dil, dil
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0x10]
nop
movzx eax, dil
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14017d070
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rsi, rdx
mov rdi, rcx
mov rbx, qword [rcx + 0x38]
mov qword [rsp + 0x40], rbx
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rdi + 8], 0
je 0x14017d197
mov byte [rdi + 0x22], 0
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 0
mov r9, rdi
lea r8, [0x14017d1c0]
mov edx, 0x100000
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi + 0x40], rax
test rax, rax
je 0x14017d197
mov eax, dword [rsi]
mov dword [rdi + 0x48], eax
mov rcx, qword [rdi + 0x28]
mov rax, qword [rcx]
mov edx, 0x2710
call qword [rax + SafeArrayPutElement]
cmp eax, 1
je 0x14017d116
lea r9, str.win_thread_event_never_triggered
mov r8d, 0xffffffff
mov rdx, qword [str.UTILITY]
lea ecx, [r8 + 5]
call fcn.14016ddf0
mov dil, 1
jmp 0x14017d19a
cmp byte [rdi + 0x20], 0
je 0x14017d192
mov ecx, dword [rdi + 0x24]
sub ecx, 1
je 0x14017d183
sub ecx, 1
je 0x14017d172
sub ecx, 1
je 0x14017d15e
sub ecx, 1
je 0x14017d14a
cmp ecx, 1
jne 0x14017d192
lea edx, [rcx + 0xe]
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov dil, 1
jmp 0x14017d19a
mov edx, 2
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov dil, 1
jmp 0x14017d19a
mov edx, 1
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov dil, 1
jmp 0x14017d19a
xor edx, edx
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov dil, 1
jmp 0x14017d19a
mov edx, 0xffffffff
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov dil, 1
jmp 0x14017d19a
xor dil, dil
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0x10]
nop
movzx eax, dil
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14017d1e0
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, rdx
mov rdi, rcx
mov rbx, qword [rcx + 0x38]
mov qword [rsp + 0x30], rbx
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rdi + 0x30]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov byte [rdi + 0x22], 1
mov byte [rdi + 0x20], 0
mov rcx, qword [rdi + 0x28]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor sil, sil
cmp qword [rdi + 0x40], 0
je 0x14017d26b
cmp byte [rdi + 0x21], sil
jne 0x14017d26b
mov rcx, qword [rdi + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov edx, 0x7d0
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
movzx esi, sil
mov ecx, 1
test eax, eax
cmove esi, ecx
mov rcx, qword [rdi + 0x30]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp byte [rdi + 0x21], 0
je 0x14017d276
test sil, sil
jne 0x14017d28a
xor edx, edx
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
setne al
mov byte [r14], al
mov rcx, qword [rdi + 0x40]
test rcx, rcx
je 0x14017d2a1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 0x40], 0
mov rcx, qword [rdi + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp byte [rdi + 0x21], 0
jne 0x14017d2bb
test sil, sil
jne 0x14017d2bb
xor dil, dil
jmp 0x14017d2be
mov dil, 1
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0x10]
nop
movzx eax, dil
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14017eb80
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [0x14030e759], 0
jne 0x14017ecda
mov byte [0x14030e759], 1
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x14030e760], rax
test rax, rax
je 0x14017ece3
lea r9, str.Loaded_Kernel.dll
mov r8d, 0xffffffff
mov rdx, qword [str.UTILITY]
lea ecx, [r8 + 2]
call fcn.14016ddf0
lea rdx, str.InitializeSRWLock
mov rcx, qword [0x14030e760]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14030e730], rax
lea rdx, str.AcquireSRWLockExclusive
mov rcx, qword [0x14030e760]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14030e738], rax
lea rdx, str.ReleaseSRWLockExclusive
mov rcx, qword [0x14030e760]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14030e750], rax
lea rdx, str.AcquireSRWLockShared
mov rcx, qword [0x14030e760]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14030e740], rax
lea rdx, str.ReleaseSRWLockShared
mov rcx, qword [0x14030e760]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14030e748], rax
cmp qword [0x14030e730], 0
je 0x14017ecda
cmp qword [0x14030e738], 0
je 0x14017ecda
cmp qword [0x14030e750], 0
je 0x14017ecda
cmp qword [0x14030e740], 0
je 0x14017ecda
test rax, rax
je 0x14017ecda
lea r9, str.Loaded_Native_RW_Lock
mov r8d, 0xffffffff
mov rdx, qword [str.UTILITY]
lea ecx, [r8 + 2]
call fcn.14016ddf0
mov byte [0x14030e758], 1
mov ecx, SafeArrayGetLBound
call fcn.14017fa34
mov rbx, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14017eceb
lea rax, vtable.em::RWLockWin.0
mov qword [rbx], rax
lea rcx, [rbx + 8]
call qword [0x14030e730]
nop
jmp 0x14017eced
cmp byte [0x14030e758], 0
jne 0x14017ecac
xor eax, eax
add rsp, 0x20
pop rbx
ret
xor ebx, ebx
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x140004dac
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140004df6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140004df6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140004df6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140004df6
cmp dword [rcx + 0x84], 0xe
jbe 0x140004df6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140004df8
xor al, al
add rsp, 0x28
ret
Function at 0x415260
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4153d9
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00430320
xorps xmm15, xmm15
mov r14, qword [0x005f7ff8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x4152d0
mov rbx, qword [rsp + 0x60]
jmp 0x4152e0
add rsp, 0x48
pop rbp
ret
sub rax, rbx
add rcx, rbx
mov rbx, rax
nop
test rbx, rbx
jbe 0x415305
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rcx
mov rax, rbx
jmp 0x415315
cmp rbx, 0x1000
jae 0x4152d6
nop dword [rax]
jmp 0x415389
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
cmp rbx, 0x1000
jae 0x415322
xor edx, edx
jmp 0x415380
mov qword [rsp + 0x30], rbx
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00430320
xorps xmm15, xmm15
mov r14, qword [0x005f7ff8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
mov edx, eax
mov rax, qword [rsp + 0x38]
nop
test dl, dl
jne 0x41530b
jmp 0x4152f4
call fcn.0045bd60
xorps xmm15, xmm15
mov r14, qword [0x005f7ff8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
cmp eax, 8
jne 0x4153c0
lea rax, [0x004c9f4d]
mov ebx, 0xd
call fcn.00432440
nop dword [rax]
cmp eax, 0x5af
je 0x4153a8
lea rax, [0x004cf68d]
mov ebx, 0x1f
call fcn.00432440
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00458640
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00415260