joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140032850
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x850
mov rax, qword [0x140067010]
xor rax, rsp
mov qword [rsp + 0x840], rax
mov rbx, rdx
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x440]
mov r8d, 0x400
call fcn.140034ac0
xor esi, esi
test rbx, rbx
jne 0x14003289a
mov eax, esi
jmp 0x1400328a7
mov edx, 0x104
mov rcx, rbx
call fcn.14003fee4
mov qword [rsp + 0x38], rsi
lea rcx, [rsp + 0x440]
mov qword [rsp + 0x30], rsi
mov r9d, eax
mov dword [rsp + 0x28], 0x400
mov r8, rbx
mov qword [rsp + 0x20], rcx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_string_l1_1_0.dll_WideCharToMultiByte]
mov rcx, qword [0x140067b00]
lea rbx, [0x140067b00]
cmp rcx, rbx
je 0x14003290f
test byte [rcx + 0x1c], 4
je 0x14003290f
mov rcx, qword [rcx + 0x10]
lea rax, [rsp + 0x440]
mov qword [rsp + 0x28], rax
mov edx, 0x11
mov qword [rsp + 0x20], rdi
call fcn.140032310
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x400
call fcn.140034ac0
lea rax, [rsp + 0x440]
mov r9, rdi
lea r8, str._s___s
mov qword [rsp + 0x20], rax
mov edx, 0x400
lea rcx, [rsp + 0x40]
call fcn.140006460
mov rcx, qword [0x140067b00]
test byte [rcx + 0x44], 1
je 0x14003297a
cmp rcx, rbx
je 0x140032a20
mov rcx, qword [rcx + 0x38]
lea rax, [rsp + 0x40]
mov edx, 0x19
mov qword [rsp + 0x20], rax
call fcn.140031fc0
jmp 0x140032a20
cmp qword [0x14006ad18], rsi
je 0x1400329a4
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount64]
mov rcx, qword [0x14006ad18]
sub rax, rcx
cmp rax, 0x2710
jae 0x140032a20
test rcx, rcx
jne 0x1400329b1
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount64]
mov qword [0x14006ad18], rax
lea rcx, [rsp + 0x40]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], sil
jne 0x1400329c0
inc eax
mov ecx, eax
mov edi, eax
call fcn.14003fd84
mov rbx, rax
test rax, rax
je 0x140032a20
lea r8, [rsp + 0x40]
mov edx, edi
mov rcx, rax
call fcn.140039664
mov r9, rbx
mov qword [rsp + 0x28], rsi
lea r8, [0x140032de0]
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
test rax, rax
je 0x140032a18
mov rcx, rax
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
jmp 0x140032a20
mov rcx, rbx
call fcn.14003fd8c
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.140032e60
lea r11, [rsp + 0x850]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140032a50
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x440
mov rax, qword [0x140067010]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov rdi, rdx
mov rbx, rcx
mov rcx, qword [0x140067b00]
lea rsi, [0x140067b00]
cmp rcx, rsi
je 0x140032aab
test byte [rcx + 0x1c], 4
je 0x140032aab
mov rcx, qword [rcx + 0x10]
mov edx, 0x13
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
call fcn.140032310
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x400
call fcn.140034ac0
mov r9, rbx
mov qword [rsp + 0x20], rdi
lea r8, str._s___s
mov edx, 0x400
lea rcx, [rsp + 0x30]
call fcn.140006460
mov rcx, qword [0x140067b00]
test byte [rcx + 0x44], 1
je 0x140032b0e
cmp rcx, rsi
je 0x140032bb4
mov rcx, qword [rcx + 0x38]
lea rax, [rsp + 0x30]
mov edx, 0x19
mov qword [rsp + 0x20], rax
call fcn.140031fc0
jmp 0x140032bb4
cmp qword [0x14006ad18], 0
je 0x140032b39
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount64]
mov rcx, qword [0x14006ad18]
sub rax, rcx
cmp rax, 0x2710
jae 0x140032bb4
test rcx, rcx
jne 0x140032b46
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount64]
mov qword [0x14006ad18], rax
lea rcx, [rsp + 0x30]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140032b52
inc eax
mov ecx, eax
mov edi, eax
call fcn.14003fd84
mov rbx, rax
test rax, rax
je 0x140032bb4
lea r8, [rsp + 0x30]
mov edx, edi
mov rcx, rax
call fcn.140039664
xor eax, eax
lea r8, [0x140032de0]
mov qword [rsp + 0x28], rax
mov r9, rbx
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
test rax, rax
je 0x140032bac
mov rcx, rax
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
jmp 0x140032bb4
mov rcx, rbx
call fcn.14003fd8c
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.140032e60
lea r11, [rsp + 0x440]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140032cd0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov rcx, qword [0x140067b00]
test byte [rcx + 0x44], 1
je 0x140032d0f
lea rax, [0x140067b00]
cmp rcx, rax
je 0x140032dd8
mov rcx, qword [rcx + 0x38]
mov edx, 0x19
mov qword [rsp + 0x20], rbx
call fcn.140031fc0
add rsp, 0x30
pop rbx
ret
cmp qword [0x14006ad18], 0
je 0x140032d3a
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount64]
mov rcx, qword [0x14006ad18]
sub rax, rcx
cmp rax, 0x2710
jae 0x140032dd8
test rcx, rcx
jne 0x140032d47
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount64]
mov qword [0x14006ad18], rax
mov qword [rsp + 0x40], rsi
mov rax, 0xffffffffffffffff
mov qword [rsp + 0x48], rdi
nop dword [rax + rax]
inc rax
cmp byte [rbx + rax], 0
jne 0x140032d60
inc eax
mov ecx, eax
mov esi, eax
call fcn.14003fd84
mov rdi, rax
test rax, rax
je 0x140032dce
mov r8, rbx
mov edx, esi
mov rcx, rax
call fcn.140039664
xor eax, eax
lea r8, [0x140032de0]
mov qword [rsp + 0x28], rax
mov r9, rdi
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
test rax, rax
je 0x140032dc6
mov rcx, rax
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x30
pop rbx
jmp qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rcx, rdi
call fcn.14003fd8c
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x30
pop rbx
ret

Function at 0x140040fdc
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140040e00
Function at 0x402686
Capabilities:
Get common file path
Set current directory

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov byte [rax], 0
mov rax, qword [rbp + 0x10]
mov rdx, rax
mov ecx, 0x104
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
call rax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jne 0x4026d3
lea r8, str.Failed_to_get_current_directory
mov edx, 0
mov ecx, 1
call fcn.004051ba
jmp 0x402727
cmp dword [rbp - 4], 0x104
jbe 0x4026ea
lea rcx, str.Failed_to_get_current_directory__buffer_is_too_small.
call fcn.00405200
jmp 0x402727
mov rax, qword [rbp + 0x18]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
call rax
test eax, eax
sete al
test al, al
je 0x402727
mov rax, qword [rbp + 0x18]
mov r9, rax
lea r8, str.Failed_to_set_current_directory_to___s_
mov edx, 1
mov ecx, 1
call fcn.004051ba
mov rax, qword [rbp + 0x10]
mov byte [rax], 0
add rsp, 0x30
pop rbp
ret

Function at 0x40272e
Capabilities:
Set current directory

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
movzx eax, byte [rax]
test al, al
je 0x40277b
mov rax, qword [rbp + 0x10]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
call rax
test eax, eax
sete al
test al, al
je 0x40277b
mov rax, qword [rbp + 0x10]
mov r9, rax
lea r8, str.Failed_to_set_current_directory_to___s_
mov edx, 1
mov ecx, 1
call fcn.004051ba
nop
add rsp, 0x20
pop rbp
ret

Function at 0x403974
Capabilities:
Get common file path

Disassembly:
push rbp
push rbx
sub rsp, 0x198
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x130], rcx
mov qword [rbp + 0x138], rdx
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0
mov r8d, 0
mov edx, 0x1a
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
call rax
shr eax, 0x1f
test al, al
je 0x4039d3
mov rcx, qword [rbp + 0x130]
call fcn.0041fa90
jmp 0x403b31
mov rax, qword [rbp + 0x138]
mov rax, qword [rax]
add rax, 0x78
mov rbx, qword [rax]
lea rax, [rbp + 0x10f]
mov rcx, rax
call fcn.0041aee0
lea rcx, [rbp + 0x10f]
lea rdx, [rbp - 0x50]
lea rax, [rbp + 0xe0]
mov r8, rcx
mov rcx, rax
call fcn.0041f8b0
lea rax, [rbp + 0xc0]
lea rcx, [rbp + 0xe0]
mov rdx, qword [rbp + 0x138]
mov r9d, 0
mov r8, rcx
mov rcx, rax
call rbx
mov rax, qword [rbp + 0x138]
lea rcx, [rax + 0xc8]
lea rax, [rbp + 0xc0]
mov rdx, rax
call fcn.0041fe40
lea rax, [rbp + 0xc0]
mov rcx, rax
call fcn.0041fe00
lea rax, [rbp + 0xe0]
mov rcx, rax
call fcn.0041fe00
lea rax, [rbp + 0x10f]
mov rcx, rax
call fcn.0041af10
mov rax, qword [rbp + 0x138]
lea rbx, [rax + 0xc8]
mov rax, qword [rbp + 0x138]
add rax, 0xc8
mov r8, 0xffffffffffffffff
mov edx, 0x5c
mov rcx, rax
call fcn.0041a940
mov r8, 0xffffffffffffffff
mov rdx, rax
mov rcx, rbx
call fcn.0041e750
mov rax, qword [rbp + 0x138]
add rax, 0xc8
mov rcx, rax
call fcn.0041a830
mov rdx, rax
lea rcx, str.Default_Userdir_Root:__s
call fcn.00405200
mov rax, qword [rbp + 0x138]
add rax, 0xc8
mov rdx, rax
mov rcx, qword [rbp + 0x130]
call fcn.0041f940
jmp 0x403b31
mov rax, qword [rbp + 0x130]
add rsp, 0x198
pop rbx
pop rbp
ret
Function at 0x403b42
Capabilities:
Get common file path

Disassembly:
push rbp
push rbx
sub rsp, 0x198
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x130], rcx
mov qword [rbp + 0x138], rdx
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0
mov r8d, 0
mov edx, 0x1c
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
call rax
shr eax, 0x1f
test al, al
je 0x403ba1
mov rcx, qword [rbp + 0x130]
call fcn.0041fa90
jmp 0x403cff
mov rax, qword [rbp + 0x138]
mov rax, qword [rax]
add rax, 0x78
mov rbx, qword [rax]
lea rax, [rbp + 0x10f]
mov rcx, rax
call fcn.0041aee0
lea rcx, [rbp + 0x10f]
lea rdx, [rbp - 0x50]
lea rax, [rbp + 0xe0]
mov r8, rcx
mov rcx, rax
call fcn.0041f8b0
lea rax, [rbp + 0xc0]
lea rcx, [rbp + 0xe0]
mov rdx, qword [rbp + 0x138]
mov r9d, 1
mov r8, rcx
mov rcx, rax
call rbx
mov rax, qword [rbp + 0x138]
lea rcx, [rax + 0xe8]
lea rax, [rbp + 0xc0]
mov rdx, rax
call fcn.0041fe40
lea rax, [rbp + 0xc0]
mov rcx, rax
call fcn.0041fe00
lea rax, [rbp + 0xe0]
mov rcx, rax
call fcn.0041fe00
lea rax, [rbp + 0x10f]
mov rcx, rax
call fcn.0041af10
mov rax, qword [rbp + 0x138]
lea rbx, [rax + 0xe8]
mov rax, qword [rbp + 0x138]
add rax, 0xe8
mov r8, 0xffffffffffffffff
mov edx, 0x5c
mov rcx, rax
call fcn.0041a940
mov r8, 0xffffffffffffffff
mov rdx, rax
mov rcx, rbx
call fcn.0041e750
mov rax, qword [rbp + 0x138]
add rax, 0xe8
mov rcx, rax
call fcn.0041a830
mov rdx, rax
lea rcx, str.Default_Cachedir_Root:__s
call fcn.00405200
mov rax, qword [rbp + 0x138]
add rax, 0xe8
mov rdx, rax
mov rcx, qword [rbp + 0x130]
call fcn.0041f940
jmp 0x403cff
mov rax, qword [rbp + 0x130]
add rsp, 0x198
pop rbx
pop rbp
ret
Function at 0x404777
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rdi
mov eax, 0x1058
call fcn.00410aa0
sub rsp, rax
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xff0], rcx
mov qword [rbp + 0xff8], rdx
mov qword [rbp + 0x1000], r8
mov qword [rbp + 0x1008], r9
mov eax, dword [rbp + 0x1010]
mov byte [rbp - 0x44], al
mov rdx, qword [rbp + 0x1000]
mov rax, qword [rbp + 0xff8]
mov r8, rdx
mov rdx, rax
lea rcx, str.getStringFromRegistry___n_tkeyName:__s_n_tvalueName:__s
call fcn.00405200
mov qword [rbp + 0xfc8], 0
cmp byte [rbp - 0x44], 0
je 0x4047eb
mov ecx, 0x20119
jmp 0x4047f0
mov ecx, 0x20019
mov rax, qword [rbp + 0xff8]
lea rdx, [rbp + 0xfc8]
mov qword [rsp + 0x20], rdx
mov r9d, ecx
mov r8d, 0
mov rdx, rax
mov rcx, qword [rbp + 0xff0]
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call rax
test eax, eax
sete al
test al, al
je 0x404937
mov dword [rbp + 0xfc4], 0x1000
mov dword [rbp + 0xfc0], 0
mov qword [rbp - 0x40], 0
mov qword [rbp - 0x38], 0
lea rdx, [rbp - 0x30]
mov eax, 0
mov ecx, 0x1fe
mov rdi, rdx
rep stosq qword [rdi], rax
mov rax, qword [rbp + 0xfc8]
lea r8, [rbp + 0xfc0]
mov rdx, qword [rbp + 0x1000]
lea rcx, [rbp + 0xfc4]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x20], rcx
mov r9, r8
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call rax
test eax, eax
jne 0x4048b9
mov eax, dword [rbp + 0xfc0]
cmp eax, 1
jne 0x4048b9
mov eax, 1
jmp 0x4048be
mov eax, 0
test al, al
je 0x40490c
lea rdx, [rbp - 0x40]
mov rax, qword [rbp + 0x1000]
mov r8, rdx
mov rdx, rax
lea rcx, str._s:__s
call fcn.00405200
mov rax, qword [rbp + 0xfc8]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
lea rdx, [rbp - 0x40]
mov rax, qword [rbp + 0x1008]
mov rcx, rax
call fcn.0041fee0
mov eax, 1
jmp 0x404952
lea r8, str.RegQueryValueEx___failed.
mov edx, 0
mov ecx, 1
call fcn.004051ba
mov rax, qword [rbp + 0xfc8]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
jmp 0x40494d
lea r8, str.RegOpenKeyEx___failed.
mov edx, 0
mov ecx, 1
call fcn.004051ba
mov eax, 0
add rsp, 0x1058
pop rdi
pop rbp
ret
Function at 0x4052cb
Capabilities:
Delete file

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
mov eax, r8d
mov byte [rbp + 0x20], al
mov dword [rbp - 4], 0
mov eax, dword [rbp - 4]
cmp eax, dword [rbp + 0x10]
jge 0x4053dd
mov eax, dword [rbp - 4]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x18]
add rax, rdx
mov rax, qword [rax]
mov rdx, rax
lea rcx, str.__trace
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x4053d3
mov eax, dword [rbp - 4]
add eax, 1
cmp dword [rbp + 0x10], eax
jne 0x405363
mov eax, dword [rbp - 4]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x18]
add rax, rdx
mov rax, qword [rax]
mov r9, rax
lea r8, str.Argument_is_missing_for___s__option.
mov edx, 1
mov ecx, 0
call fcn.004051ba
mov eax, 0
jmp 0x4053e2
add dword [rbp - 4], 1
mov eax, dword [rbp - 4]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x18]
add rax, rdx
mov rax, qword [rax]
mov rdx, rax
lea rcx, [0x0043e040]
call fcn.0041fee0
cmp byte [rbp + 0x20], 0
je 0x4053b0
mov rax, qword [rbp + 0x18]
mov rdx, rax
mov ecx, dword [rbp + 0x10]
call fcn.00405241
xor eax, 1
test al, al
je 0x4053b0
mov eax, 1
jmp 0x4053b5
mov eax, 0
test al, al
je 0x4053dc
lea rcx, [0x0043e040]
call fcn.0041a830
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeleteFileA]
call rax
jmp 0x4053dc
add dword [rbp - 4], 1
jmp 0x4052e7
nop
mov eax, 1
add rsp, 0x30
pop rbp
ret
Function at 0x40fb60
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rsi, rcx
mov ecx, dword [0x0043e684]
mov rdi, rdx
mov rbp, r8
test ecx, ecx
jle 0x40fc80
mov rax, qword [0x0043e688]
xor ebx, ebx
add rax, 0x18
mov rdx, qword [rax]
cmp rsi, rdx
jb 0x40fbac
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rsi, rdx
jb 0x40fc66
add ebx, 1
add rax, 0x28
cmp ebx, ecx
jne 0x40fb90
mov rcx, rsi
call fcn.004107a0
test rax, rax
mov r12, rax
je 0x40fcb8
movsxd rbx, ebx
lea rbx, [rbx + rbx*4]
shl rbx, 3
mov r13, rbx
add r13, qword [0x0043e688]
mov qword [r13 + 0x20], rax
mov dword [r13], 0
call fcn.004108f0
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
lea rdx, [rsp + 0x20]
mov qword [r13 + 0x18], rax
mov rax, qword [0x0043e688]
mov rcx, qword [rax + rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x40fc9b
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x40fc5f
sub eax, 0x40
and eax, 0xffffffbf
je 0x40fc5f
add rbx, qword [0x0043e688]
mov rcx, qword [rsp + 0x20]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov r9, rbx
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x40fc87
add dword [0x0043e684], 1
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sub.msvcrt.dll_memcpy
xor ebx, ebx
jmp 0x40fbb7
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.0040faf0
mov rax, qword [0x0043e688]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.0040faf0
lea rcx, str.Address__p_has_no_image_section
mov rdx, rsi
call fcn.0040faf0
nop
nop dword [rax + rax]

Function at 0x410410
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x0043e960]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x0043e940]
test rbx, rbx
je 0x410464
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x41045b
test rsi, rsi
je 0x41045b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x410440
lea rcx, [0x0043e960]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x4107a0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x004368e0]
xor edx, edx
mov r8, rcx
cmp word [r9], 0x5a4d
je 0x4107c0
mov rax, rdx
add rsp, 0x28
ret
mov rcx, r9
call fcn.00410680
test eax, eax
je 0x4107b8
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add rax, r9
movzx edx, word [rax + 0x14]
lea rdx, [rax + rdx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x41081d
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x410814
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x4107b8
add rdx, 0x28
cmp rdx, r9
jne 0x410800
xor edx, edx
mov rax, rdx
add rsp, 0x28
ret
Function at 0x410b50
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov eax, dword [0x0043e948]
xor esi, esi
mov ebp, ecx
mov rdi, rdx
test eax, eax
jne 0x4104a4
mov eax, esi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov edx, 0x18
mov ecx, 1
call sub.msvcrt.dll_calloc
test rax, rax
mov rbx, rax
je 0x4104f8
mov dword [rax], ebp
mov qword [rax + 8], rdi
lea rcx, [0x0043e960]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x0043e940]
lea rcx, [0x0043e960]
mov qword [0x0043e940], rbx
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov esi, 0xffffffff
jmp 0x410499
push rsi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x410b80
mov rdx, rbx
mov ecx, eax
mov dword [rsi], eax
add rsp, 0x28
pop rbx
pop rsi
jmp 0x416860
add rsp, 0x28
pop rbx
pop rsi
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
test rdx, rdx
je 0x416870
jmp 0x410480
xor eax, eax
ret
sbb bl, byte [rbx + 0x2e]
push rax
jne 0x480eee
invalid
stosd dword [rdi], eax
stosd dword [rdi], eax
mov bl, 0x3f
push 0x4c
imul ebx, ecx, 0x5b3c0426
fldenv [rsi]
add al, 0x3c
pop rbx
fldenv [rsi]
add al, 0x3c
pop rbx
fnstenv [rdx - 0x20f8c345]
sahf
cld
clc
loopne 0x480f2e
test dword [rdi - 0x16], ebx
movsx edi, byte [rbx - 0x6ce77821]
jnp 0x480edf
shl dword [rsp + rdi*8 + 0x5b0cf4e3], 1
insb byte [rdi], dx
mov esi, 0x63483ffd
or eax, 0x3e9cd085
test eax, edx
pushfq
jb 0x480f50
call 0x2ad56dd4
mov ah, 0xf9
fstp xword [rdi - 4]
popfq
shr dword [rbx + 0x40cb3d36], cl
invalid
mov ecx, 0xc624848f
xchg byte [rcx - 0x77a0e4fc], ch
jmp rdi
add edi, eax
out dx, al
invalid
cli
ja 0x4810ad
invalid
mov esi, 0x918a556
xchg dword [rax - 0x1a1e20b2], ecx
invalid
loope 0x48104e
sbb eax, 0x34a3c2ab
jrcxz case.0x4165ab.35
jne case.0x4165ab.33
in al, 0x20
scasb al, byte [rdi]
test al, 0x17
ja 0x48101b
pop rsi
ror byte [rdi + 0x55], 1
invalid
jbe 0x4810e0
push rdx
outsb dx, byte [rsi]
invalid
invalid
xlatb
invalid
invalid
movsb byte [rdi], byte [rsi]
pushfq
fcom qword [rbx - 0x32526d69]
ret 0xfd4b
xor byte [rax + 0x2d], ch
jg case.0x4165ab.49
xchg esi, eax
mov edi, 0x684d47d9
pop rsp
jp 0x481160
js 0x481132
ja 0x4811e7
jle 0x4811d4
mov ah, 0xd4
push rbx
mov al, 0xe7
cld
cmpsd dword [rsi], dword [rdi]
out 0xcf, eax
iretd
cld
mov ebx, 0x54a9e38f
test eax, 0xc16a8954
invalid

Function at 0x410bb0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov ebx, ecx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, ebx
mov esi, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rbx
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x410be0
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x410bf5
xor eax, eax
add rsp, 0x28
ret
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x412260
Capabilities:
Query environment variable

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12d, 1
sub r8d, 1
mov edi, ecx
mov ecx, 0x66666667
mov eax, r8d
mov rbp, rdx
movsxd rsi, r8d
imul ecx
sar r8d, 0x1f
mov rbx, r9
mov ecx, edx
sar ecx, 2
sub ecx, r8d
je 0x4122b5
mov r8d, 0x66666667
nop dword [rax]
mov eax, ecx
sar ecx, 0x1f
add r12d, 1
imul r8d
sar edx, 2
sub edx, ecx
mov ecx, edx
jne 0x4122a0
mov edx, dword [rbx + 0x2c]
cmp edx, 0xffffffff
je 0x412330
mov ecx, dword [rbx + 0xc]
cmp r12d, edx
mov r9, rbx
cmovl r12d, edx
mov r8d, 1
lea edx, [r12 + 2]
mov eax, ecx
sub eax, edx
cmp ecx, edx
mov edx, 0xffffffff
cmovle eax, edx
mov ecx, edi
mov rdx, rbp
mov dword [rbx + 0xc], eax
add r12d, 1
call fcn.00411b20
mov ecx, dword [rbx + 8]
mov eax, dword [rbx + 0x2c]
mov rdx, rbx
mov dword [rbx + 0x10], eax
mov eax, ecx
and ecx, 0x20
or eax, 0x1c0
or ecx, 0x45
mov dword [rbx + 8], eax
call fcn.004116d0
add dword [rbx + 0xc], r12d
mov rdx, rbx
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.00411f90
mov eax, dword [0x004220f0]
cmp eax, 0xffffffff
je 0x41235c
test eax, eax
je 0x41234c
mov edx, 2
mov dword [rbx + 0x2c], edx
jmp 0x4122bd
call fcn.00416570
test al, 1
mov edx, 3
jne 0x41233f
jmp 0x412344
lea rcx, str.PRINTF_EXPONENT_DIGITS
call sub.msvcrt.dll_getenv
test rax, rax
je 0x412384
movsx eax, byte [rax]
sub eax, 0x30
cmp eax, 2
setbe al
movzx eax, al
mov dword [0x004220f0], eax
jmp 0x41233b
xor eax, eax
jmp 0x412379
Function at 0x421130
Capabilities:
Get thread local storage value

Disassembly:
cmp byte [0x00422234], 0
jne 0x421141
lea rax, [0x00422220]
ret
mov ecx, dword [0x00422230]
jmp fcn.00410bb0