joyce8/EMBER2024-capa huggingface dataset:
Function at 0x664691
Capabilities:
Query environment variable

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x180
mov eax, dword [0x0067a54c]
cmp eax, 0
je 0x6646bd
lea rax, [0x0067c0b0]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_EnterCriticalSection
mov eax, dword [0x0067a448]
cmp eax, 0
je 0x6646f2
mov eax, dword [0x0067a54c]
cmp eax, 0
je 0x6646ed
lea rax, [0x0067c0b0]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x6648eb
mov eax, dword [0x0067a444]
mov dword [rbp - 4], eax
mov eax, 1
mov dword [0x0067a448], eax
mov eax, dword [0x0067a440]
mov dword [rbp - 0xc], eax
mov eax, dword [rbp - 0xc]
cmp eax, 0
jbe 0x664776
mov eax, dword [rbp - 0xc]
shl rax, 3
mov r8, rax
lea rax, [0x0067a300]
mov r11, rax
lea rax, [rbp - 0x150]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memcpy
mov eax, 0
mov dword [0x0067a440], eax
mov eax, dword [rbp - 0xc]
shl rax, 3
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [0x0067a300]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov eax, dword [0x0067a54c]
cmp eax, 0
je 0x664797
lea rax, [0x0067c0b0]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_LeaveCriticalSection
mov eax, dword [0x0067a464]
cmp eax, 0
je 0x6647b5
mov r11, qword [0x00679f18]
call r11
jmp 0x6647bd
mov eax, 0
mov dword [rbp - 4], eax
mov eax, dword [rbp - 0xc]
cmp eax, 0
jbe 0x6647ec
mov eax, dword [rbp - 0xc]
mov r11, rax
lea rax, str.Found__u_leaked_objects:_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00669174
mov eax, 1
mov dword [rbp - 4], eax
mov eax, 0
mov dword [rbp - 8], eax
mov eax, dword [rbp - 8]
mov ecx, dword [rbp - 0xc]
cmp eax, ecx
jae 0x66485a
jmp 0x664814
mov eax, dword [rbp - 8]
mov ecx, eax
add eax, 1
mov dword [rbp - 8], eax
jmp 0x6647f4
mov eax, dword [rbp - 8]
shl rax, 3
lea rcx, [rbp - 0x150]
add rcx, rax
mov rax, qword [rcx]
mov qword [rbp - 0x158], rax
mov rax, qword [rbp - 0x158]
mov r10, rax
mov rcx, r10
mov r11, qword [fcn.00650d08]
call r11
mov rax, qword [rbp - 0x158]
mov r10, rax
mov rcx, r10
call fcn.0065f3e9
jmp 0x664807
mov eax, dword [rbp - 4]
cmp eax, 0
je 0x66489e
lea rax, str.GC_ABORT_ON_LEAK
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_getenv
cmp rax, 0
je 0x66489e
lea rax, str.Leaked_or_smashed_objects_encountered
mov r10, rax
mov rcx, r10
mov r11, qword [0x0067a4e8]
call r11
call sub.kernel32.dll_DebugBreak
mov eax, dword [0x0067a54c]
cmp eax, 0
je 0x6648bf
lea rax, [0x0067c0b0]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_EnterCriticalSection
mov eax, 0
mov dword [0x0067a448], eax
mov eax, dword [0x0067a54c]
cmp eax, 0
je 0x6648eb
lea rax, [0x0067c0b0]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_LeaveCriticalSection
leave
ret
Function at 0x66469c
Capabilities:
Query environment variable

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x180
mov eax, dword [0x0067a54c]
cmp eax, 0
je 0x6646bd
lea rax, [0x0067c0b0]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_EnterCriticalSection
mov eax, dword [0x0067a448]
cmp eax, 0
je 0x6646f2
mov eax, dword [0x0067a54c]
cmp eax, 0
je 0x6646ed
lea rax, [0x0067c0b0]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x6648eb
mov eax, dword [0x0067a444]
mov dword [rbp - 4], eax
mov eax, 1
mov dword [0x0067a448], eax
mov eax, dword [0x0067a440]
mov dword [rbp - 0xc], eax
mov eax, dword [rbp - 0xc]
cmp eax, 0
jbe 0x664776
mov eax, dword [rbp - 0xc]
shl rax, 3
mov r8, rax
lea rax, [0x0067a300]
mov r11, rax
lea rax, [rbp - 0x150]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memcpy
mov eax, 0
mov dword [0x0067a440], eax
mov eax, dword [rbp - 0xc]
shl rax, 3
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [0x0067a300]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov eax, dword [0x0067a54c]
cmp eax, 0
je 0x664797
lea rax, [0x0067c0b0]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_LeaveCriticalSection
mov eax, dword [0x0067a464]
cmp eax, 0
je 0x6647b5
mov r11, qword [0x00679f18]
call r11
jmp 0x6647bd
mov eax, 0
mov dword [rbp - 4], eax
mov eax, dword [rbp - 0xc]
cmp eax, 0
jbe 0x6647ec
mov eax, dword [rbp - 0xc]
mov r11, rax
lea rax, str.Found__u_leaked_objects:_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00669174
mov eax, 1
mov dword [rbp - 4], eax
mov eax, 0
mov dword [rbp - 8], eax
mov eax, dword [rbp - 8]
mov ecx, dword [rbp - 0xc]
cmp eax, ecx
jae 0x66485a
jmp 0x664814
mov eax, dword [rbp - 8]
mov ecx, eax
add eax, 1
mov dword [rbp - 8], eax
jmp 0x6647f4
mov eax, dword [rbp - 8]
shl rax, 3
lea rcx, [rbp - 0x150]
add rcx, rax
mov rax, qword [rcx]
mov qword [rbp - 0x158], rax
mov rax, qword [rbp - 0x158]
mov r10, rax
mov rcx, r10
mov r11, qword [fcn.00650d08]
call r11
mov rax, qword [rbp - 0x158]
mov r10, rax
mov rcx, r10
call fcn.0065f3e9
jmp 0x664807
mov eax, dword [rbp - 4]
cmp eax, 0
je 0x66489e
lea rax, str.GC_ABORT_ON_LEAK
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_getenv
cmp rax, 0
je 0x66489e
lea rax, str.Leaked_or_smashed_objects_encountered
mov r10, rax
mov rcx, r10
mov r11, qword [0x0067a4e8]
call r11
call sub.kernel32.dll_DebugBreak
mov eax, dword [0x0067a54c]
cmp eax, 0
je 0x6648bf
lea rax, [0x0067c0b0]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_EnterCriticalSection
mov eax, 0
mov dword [0x0067a448], eax
mov eax, dword [0x0067a54c]
cmp eax, 0
je 0x6648eb
lea rax, [0x0067c0b0]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_LeaveCriticalSection
leave
ret
Function at 0x66580d
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov eax, 0
mov dword [rbp - 0x3c], eax
mov eax, dword [0x0067a47c]
cmp eax, 2
jne 0x66583f
call sub.kernel32.dll_GetTickCount
mov dword [rbp - 0x3c], eax
mov eax, 0
mov dword [rbp - 0xc], eax
mov eax, dword [rbp - 0xc]
mov ecx, dword [0x0067a460]
cmp eax, ecx
jae 0x6659b1
jmp 0x66586a
mov eax, dword [rbp - 0xc]
mov ecx, eax
add eax, 1
mov dword [rbp - 0xc], eax
jmp 0x665847
mov eax, dword [rbp - 0xc]
shl rax, 5
lea rcx, [0x0067a0d0]
add rcx, rax
mov qword [rbp - 0x28], rcx
mov rax, qword [rbp - 0x28]
add rax, 8
mov rcx, qword [rax]
mov qword [rbp - 0x30], rcx
mov rax, qword [rbp - 0x30]
cmp rax, 0
jne 0x6658a1
jmp 0x66585d
movabs rax, 1
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
cmp rax, 0x80
ja 0x6659ac
jmp 0x6658d6
mov rax, qword [rbp - 8]
mov rcx, rax
add rax, 1
mov qword [rbp - 8], rax
jmp 0x6658af
mov rax, qword [rbp - 8]
shl rax, 3
mov rcx, qword [rbp - 0x30]
add rcx, rax
mov qword [rbp - 0x38], rcx
mov rax, qword [rbp - 0x38]
mov rcx, qword [rax]
mov qword [rbp - 0x20], rcx
cmp rcx, 0
je 0x6659a7
mov rax, qword [rbp + 0x10]
cmp rax, 0
je 0x66592e
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x48], rax
mov r11, qword [rbp - 0x48]
call r11
cmp eax, 0
je 0x66592e
mov eax, 0
jmp 0x6659f5
mov rax, qword [rbp - 0x20]
mov r10, rax
mov rcx, r10
call fcn.006519dc
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x18]
mov rdx, qword [rcx]
mov qword [rax], rdx
mov eax, dword [rbp + 0x18]
cmp eax, 0
je 0x66597a
mov rax, qword [rbp - 0x18]
add rax, 0x1a
movzx ecx, word [rax]
mov rax, qword [0x00679e60]
sub rax, 1
cmp rcx, rax
jne 0x6659a2
mov rax, qword [rbp - 0x18]
add rax, 0x20
mov ecx, 0
mov r8, rcx
mov rcx, qword [rax]
mov r11, rcx
mov rax, qword [rbp - 0x20]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00664dc3
jmp 0x6658e9
jmp 0x6658c5
jmp 0x66585d
mov eax, dword [0x0067a47c]
cmp eax, 2
jne 0x6659f0
call sub.kernel32.dll_GetTickCount
mov dword [rbp - 0x4c], eax
mov eax, dword [rbp - 0x4c]
mov ecx, dword [rbp - 0x3c]
sub eax, ecx
mov ecx, 0
mov r8, rcx
mov r11, rax
lea rax, str.Disposing_of_reclaim_lists_took__lu_ms__lu_ns_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00669212
mov eax, 1
leave
ret
Function at 0x665818
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov eax, 0
mov dword [rbp - 0x3c], eax
mov eax, dword [0x0067a47c]
cmp eax, 2
jne 0x66583f
call sub.kernel32.dll_GetTickCount
mov dword [rbp - 0x3c], eax
mov eax, 0
mov dword [rbp - 0xc], eax
mov eax, dword [rbp - 0xc]
mov ecx, dword [0x0067a460]
cmp eax, ecx
jae 0x6659b1
jmp 0x66586a
mov eax, dword [rbp - 0xc]
mov ecx, eax
add eax, 1
mov dword [rbp - 0xc], eax
jmp 0x665847
mov eax, dword [rbp - 0xc]
shl rax, 5
lea rcx, [0x0067a0d0]
add rcx, rax
mov qword [rbp - 0x28], rcx
mov rax, qword [rbp - 0x28]
add rax, 8
mov rcx, qword [rax]
mov qword [rbp - 0x30], rcx
mov rax, qword [rbp - 0x30]
cmp rax, 0
jne 0x6658a1
jmp 0x66585d
movabs rax, 1
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
cmp rax, 0x80
ja 0x6659ac
jmp 0x6658d6
mov rax, qword [rbp - 8]
mov rcx, rax
add rax, 1
mov qword [rbp - 8], rax
jmp 0x6658af
mov rax, qword [rbp - 8]
shl rax, 3
mov rcx, qword [rbp - 0x30]
add rcx, rax
mov qword [rbp - 0x38], rcx
mov rax, qword [rbp - 0x38]
mov rcx, qword [rax]
mov qword [rbp - 0x20], rcx
cmp rcx, 0
je 0x6659a7
mov rax, qword [rbp + 0x10]
cmp rax, 0
je 0x66592e
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x48], rax
mov r11, qword [rbp - 0x48]
call r11
cmp eax, 0
je 0x66592e
mov eax, 0
jmp 0x6659f5
mov rax, qword [rbp - 0x20]
mov r10, rax
mov rcx, r10
call fcn.006519dc
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x18]
mov rdx, qword [rcx]
mov qword [rax], rdx
mov eax, dword [rbp + 0x18]
cmp eax, 0
je 0x66597a
mov rax, qword [rbp - 0x18]
add rax, 0x1a
movzx ecx, word [rax]
mov rax, qword [0x00679e60]
sub rax, 1
cmp rcx, rax
jne 0x6659a2
mov rax, qword [rbp - 0x18]
add rax, 0x20
mov ecx, 0
mov r8, rcx
mov rcx, qword [rax]
mov r11, rcx
mov rax, qword [rbp - 0x20]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00664dc3
jmp 0x6658e9
jmp 0x6658c5
jmp 0x66585d
mov eax, dword [0x0067a47c]
cmp eax, 2
jne 0x6659f0
call sub.kernel32.dll_GetTickCount
mov dword [rbp - 0x4c], eax
mov eax, dword [rbp - 0x4c]
mov ecx, dword [rbp - 0x3c]
sub eax, ecx
mov ecx, 0
mov r8, rcx
mov r11, rax
lea rax, str.Disposing_of_reclaim_lists_took__lu_ms__lu_ns_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00669212
mov eax, 1
leave
ret
Function at 0x668d6e
Capabilities:
Query environment variable

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x180
mov eax, 0
mov dword [rbp - 0x14], eax
lea rax, [rbp - 0x128]
mov qword [rbp - 0x10], rax
mov eax, 0x105
mov r8, rax
lea rax, [rbp - 0x128]
mov r11, rax
lea rax, str.GC_LOG_FILE
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GetEnvironmentVariableA
sub eax, 1
cmp eax, 0x104
jae 0x668dcf
mov eax, 1
mov dword [rbp - 0x14], eax
jmp 0x668e77
mov eax, 0x105
mov r8, rax
lea rax, [rbp - 0x128]
mov r11, rax
movabs rax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GetModuleFileNameA
mov dword [rbp - 0x12c], eax
mov eax, dword [rbp - 0x12c]
cmp eax, 4
jle 0x668e3f
mov eax, dword [rbp - 0x12c]
sub eax, 4
movsxd rax, eax
lea rcx, [rbp - 0x128]
add rcx, rax
movsx eax, byte [rcx]
cmp eax, 0x2e
jne 0x668e3f
mov eax, dword [rbp - 0x12c]
sub eax, 4
mov dword [rbp - 0x12c], eax
mov eax, dword [rbp - 0x12c]
movsxd rax, eax
lea rcx, [rbp - 0x128]
add rcx, rax
movabs rax, 8
mov r8, rax
lea rax, str..gc.log
mov r11, rax
mov r10, rcx
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memcpy
mov eax, dword [rbp - 0x14]
cmp eax, 0
je 0x668e88
jmp 0x668e92
mov eax, 2
jmp 0x668e97
mov eax, 4
mov ecx, dword [0x0067a47c]
cmp ecx, 2
mov dword [rbp - 0x130], eax
jne 0x668eb1
jmp 0x668ebb
mov eax, 0x80000080
jmp 0x668ec0
mov eax, pe_nt_image_headers64
movabs rcx, 0
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov eax, dword [rbp - 0x130]
mov qword [rsp + 0x20], rax
movabs rax, 0
mov r9, rax
mov eax, 1
mov r8, rax
mov eax, 0x40000000
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_CreateFileA
mov qword [rbp - 8], rax
mov eax, dword [rbp - 0x14]
cmp eax, 0
je 0x668f63
mov rax, qword [rbp - 8]
cmp rax, 0xffffffffffffffff
je 0x668f63
mov eax, 0
mov dword [rbp - 0x134], eax
mov eax, 2
mov r9, rax
lea rax, [rbp - 0x134]
mov r8, rax
mov eax, 0
mov r11, rax
mov rax, qword [rbp - 8]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_SetFilePointer
mov rax, qword [rbp - 8]
leave
ret
Function at 0x668d79
Capabilities:
Query environment variable

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x180
mov eax, 0
mov dword [rbp - 0x14], eax
lea rax, [rbp - 0x128]
mov qword [rbp - 0x10], rax
mov eax, 0x105
mov r8, rax
lea rax, [rbp - 0x128]
mov r11, rax
lea rax, str.GC_LOG_FILE
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GetEnvironmentVariableA
sub eax, 1
cmp eax, 0x104
jae 0x668dcf
mov eax, 1
mov dword [rbp - 0x14], eax
jmp 0x668e77
mov eax, 0x105
mov r8, rax
lea rax, [rbp - 0x128]
mov r11, rax
movabs rax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GetModuleFileNameA
mov dword [rbp - 0x12c], eax
mov eax, dword [rbp - 0x12c]
cmp eax, 4
jle 0x668e3f
mov eax, dword [rbp - 0x12c]
sub eax, 4
movsxd rax, eax
lea rcx, [rbp - 0x128]
add rcx, rax
movsx eax, byte [rcx]
cmp eax, 0x2e
jne 0x668e3f
mov eax, dword [rbp - 0x12c]
sub eax, 4
mov dword [rbp - 0x12c], eax
mov eax, dword [rbp - 0x12c]
movsxd rax, eax
lea rcx, [rbp - 0x128]
add rcx, rax
movabs rax, 8
mov r8, rax
lea rax, str..gc.log
mov r11, rax
mov r10, rcx
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memcpy
mov eax, dword [rbp - 0x14]
cmp eax, 0
je 0x668e88
jmp 0x668e92
mov eax, 2
jmp 0x668e97
mov eax, 4
mov ecx, dword [0x0067a47c]
cmp ecx, 2
mov dword [rbp - 0x130], eax
jne 0x668eb1
jmp 0x668ebb
mov eax, 0x80000080
jmp 0x668ec0
mov eax, pe_nt_image_headers64
movabs rcx, 0
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov eax, dword [rbp - 0x130]
mov qword [rsp + 0x20], rax
movabs rax, 0
mov r9, rax
mov eax, 1
mov r8, rax
mov eax, 0x40000000
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_CreateFileA
mov qword [rbp - 8], rax
mov eax, dword [rbp - 0x14]
cmp eax, 0
je 0x668f63
mov rax, qword [rbp - 8]
cmp rax, 0xffffffffffffffff
je 0x668f63
mov eax, 0
mov dword [rbp - 0x134], eax
mov eax, 2
mov r9, rax
lea rax, [rbp - 0x134]
mov r8, rax
mov eax, 0
mov r11, rax
mov rax, qword [rbp - 8]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_SetFilePointer
mov rax, qword [rbp - 8]
leave
ret
Function at 0x668f69
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x18]
cmp rax, 0
jne 0x668f94
mov eax, 0
jmp 0x669088
mov eax, dword [0x0067a54c]
cmp eax, 0
je 0x668fb5
lea rax, [0x0067c3b0]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_EnterCriticalSection
mov rax, qword [0x0067a4d8]
cmp rax, 0
jne 0x668fd2
call fcn.00668d6e
mov qword [0x0067a4d8], rax
mov rax, qword [0x0067a4d8]
cmp rax, 0xffffffffffffffff
jne 0x66900e
mov eax, dword [0x0067a54c]
cmp eax, 0
je 0x669004
lea rax, [0x0067c3b0]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_LeaveCriticalSection
mov eax, 0xffffffff
jmp 0x669088
movabs rax, 0
mov qword [rsp + 0x20], rax
lea rax, [rbp - 8]
mov r9, rax
mov eax, dword [rbp + 0x18]
mov r8, rax
mov rax, qword [rbp + 0x10]
mov r11, rax
mov rax, qword [0x0067a4d8]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_WriteFile
mov dword [rbp - 4], eax
mov eax, dword [0x0067a54c]
cmp eax, 0
je 0x66906a
lea rax, [0x0067c3b0]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_LeaveCriticalSection
mov eax, dword [rbp - 4]
cmp eax, 0
je 0x66907b
jmp 0x669085
mov eax, 0xffffffff
jmp 0x669088
mov eax, dword [rbp - 8]
leave
ret
Function at 0x66c730
Capabilities:
Resume thread
Suspend thread

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x510
mov qword [rbp + 0x10], rcx
mov eax, 0
mov dword [rbp - 8], eax
mov rax, qword [rbp + 0x10]
add rax, 0x10
lea rcx, [rbp - 4]
mov r11, rcx
mov rcx, qword [rax]
mov r10, rcx
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GetExitCodeThread
cmp eax, 0
je 0x66c788
mov eax, dword [rbp - 4]
cmp eax, 0x103
je 0x66c788
mov rax, qword [rbp + 0x10]
mov r10, rax
mov rcx, r10
call fcn.0066be80
jmp 0x66c8ef
mov rax, qword [rbp + 0x10]
add rax, 0x10
mov rcx, qword [rax]
mov r10, rcx
mov rcx, r10
call sub.kernel32.dll_SuspendThread
cmp eax, 0xffffffff
je 0x66c857
mov eax, 0x100003
mov dword [rbp - 0x4b0], eax
mov rax, qword [rbp + 0x10]
add rax, 0x10
lea rcx, [rbp - 0x4e0]
mov r11, rcx
mov rcx, qword [rax]
mov r10, rcx
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GetThreadContext
cmp eax, 0
je 0x66c81c
mov rax, qword [rbp + 0x10]
add rax, 0x40
mov rcx, qword [rbp + 0x10]
add rcx, 0x48
lea rdx, [rbp - 0x4e0]
mov r11, rdx
mov r10, rcx
mov qword [rbp - 0x4e8], rax
mov rcx, r10
mov rdx, r11
call fcn.0066cd60
mov rcx, qword [rbp - 0x4e8]
mov qword [rcx], rax
jmp 0x66c8a9
mov rax, qword [rbp + 0x10]
add rax, 0x10
mov rcx, qword [rax]
mov r10, rcx
mov rcx, r10
call sub.kernel32.dll_ResumeThread
cmp eax, 0xffffffff
jne 0x66c857
lea rax, str.ResumeThread_failed_in_suspend_loop
mov r10, rax
mov rcx, r10
mov r11, qword [0x0067a4e8]
call r11
call sub.kernel32.dll_DebugBreak
mov eax, dword [rbp - 8]
cmp eax, 1
jle 0x66c873
mov eax, 0
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov eax, dword [rbp - 8]
add eax, 1
mov dword [rbp - 8], eax
cmp eax, 0xf4240
jl 0x66c8a4
lea rax, str.SuspendThread_loop_failed
mov r10, rax
mov rcx, r10
mov r11, qword [0x0067a4e8]
call r11
call sub.kernel32.dll_DebugBreak
jmp 0x66c73c
mov rax, qword [rbp + 0x10]
add rax, 0x3b
mov ecx, 1
mov byte [rax], cl
mov rax, qword [0x0067a4f0]
cmp rax, 0
je 0x66c8ef
mov rax, qword [rbp + 0x10]
add rax, 0x10
mov rcx, qword [rax]
mov r11, rcx
mov eax, 0xa
mov r10, rax
mov rcx, r10
mov rdx, r11
mov r11, qword [0x0067a4f0]
call r11
leave
ret
Function at 0x66ca19
Capabilities:
Resume thread

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
jmp 0x66caff
mov eax, 0
mov dword [rbp - 0x1c], eax
mov eax, dword [rbp - 0x1c]
cmp eax, 0x100
jge 0x66cc07
jmp 0x66cb28
mov eax, dword [rbp - 0x1c]
mov ecx, eax
add eax, 1
mov dword [rbp - 0x1c], eax
jmp 0x66cb07
mov eax, dword [rbp - 0x1c]
movsxd rax, eax
shl rax, 3
lea rcx, [0x006aa9a0]
add rcx, rax
mov rax, qword [rcx]
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
cmp rax, 0
je 0x66cc02
jmp 0x66cb63
mov rax, qword [rbp - 0x18]
mov rcx, qword [rax]
mov qword [rbp - 0x18], rcx
jmp 0x66cb43
mov rax, qword [rbp - 0x18]
add rax, 0x3b
movzx ecx, byte [rax]
cmp ecx, 0
je 0x66cbfd
mov rax, qword [rbp - 0x18]
add rax, 0x10
mov rcx, qword [rax]
mov r10, rcx
mov rcx, r10
call sub.kernel32.dll_ResumeThread
cmp eax, 0xffffffff
jne 0x66cbb2
lea rax, str.ResumeThread_failed
mov r10, rax
mov rcx, r10
mov r11, qword [0x0067a4e8]
call r11
call sub.kernel32.dll_DebugBreak
mov rax, qword [rbp - 0x18]
add rax, 0x3b
mov ecx, 0
mov byte [rax], cl
mov rax, qword [0x0067a4f0]
cmp rax, 0
je 0x66cbf8
mov rax, qword [rbp - 0x18]
add rax, 0x10
mov rcx, qword [rax]
mov r11, rcx
mov eax, 0xb
mov r10, rax
mov rcx, r10
mov rdx, r11
mov r11, qword [0x0067a4f0]
call r11
jmp 0x66cbfd
jmp 0x66cb56
jmp 0x66cb1b
leave
ret
Function at 0x1400025b0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
not r8d
mov r10, rcx
mov r9d, r8d
test rdx, rdx
je 0x14000260a
mov r11b, 0x23
lea rdi, [0x140038f40]
movzx ebx, byte [r10]
dec rdx
inc r10
cmp bl, r11b
jne 0x1400025f4
cmp rdx, 2
jb 0x1400025f4
cmp byte [r10], r11b
jne 0x1400025f4
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
xor rcx, rbx
shr r9d, 8
xor r9d, dword [rdi + rcx*4]
test rdx, rdx
jne 0x1400025d2
jmp 0x14000264b
mov dl, byte [rcx]
inc r10
test dl, dl
je 0x14000264b
mov r11b, 0x23
lea rdi, [0x140038f40]
cmp dl, r11b
jne 0x14000262f
cmp byte [r10], r11b
jne 0x14000262f
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
movzx eax, dl
mov dl, byte [r10]
xor rcx, rax
shr r9d, 8
inc r10
xor r9d, dword [rdi + rcx*4]
test dl, dl
jne 0x14000261d
mov rbx, qword [rsp + 8]
not r9d
mov rdi, qword [rsp + 0x10]
mov eax, r9d
ret

Function at 0x140002780
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
test r8, r8
je 0x1400027a0
and qword [r8], 0
lea rdx, [0x1400389b8]
call fcn.14000265c
mov rbx, rax
test rax, rax
je 0x140002891
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x140002888
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140002888
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140002888
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140002888
mov rbp, rdi
cmp rdi, 0xffffffffffffffff
je 0x140002888
mov rax, qword [0x140083ad0]
test rax, rax
je 0x140002825
inc dword [rax + 0x3b0]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
je 0x140002888
mov r9, rbx
mov r8, rbp
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rbp
je 0x140002875
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x140083ad0]
test rax, rax
je 0x14000286a
dec dword [rax + 0x3b0]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140002891
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x140002883
mov qword [rsi], rbp
mov rax, rdi
jmp 0x140002893
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret