joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140025060
Capabilities:
Encode data using base64

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rdx, qword [rcx + 8]
cmp rdx, qword [rcx]
je 0x140025091
mov rbx, rdx
mov rax, qword [rdi]
mov qword [rbx - 8], rax
add qword [rsi + 8], 0xfffffffffffffff8
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov r8, qword [rsi + 0x10]
mov rax, qword [rsi + 0x18]
cmp r8, rax
jae 0x1400250e3
sub rax, r8
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
lea r14, [rax + rcx]
inc r14
sar r14, 1
lea rbx, [r8 + r14*8]
mov rax, r8
sub rax, rdx
sub rbx, rax
sub r8, rdx
je 0x1400250d5
mov rcx, rbx
call fcn.1400c6530
mov rdx, qword [rsi + 0x10]
mov qword [rsi + 8], rbx
lea rax, [rdx + r14*8]
mov qword [rsi + 0x10], rax
jmp 0x14002507b
mov rcx, rax
sub rcx, rdx
sar rcx, 2
cmp rax, rdx
mov r14d, 1
cmovne r14, rcx
mov rax, r14
shr rax, 0x3d
jne 0x140025189
lea rcx, [r14*8]
call fcn.140027210
lea rbx, [r14*2 + 6]
and rbx, 0xfffffffffffffff8
add rbx, rax
mov rcx, qword [rsi + 8]
mov r10, qword [rsi + 0x10]
lea rdx, [rax + r14*8]
mov r8, rbx
sub r10, rcx
je 0x140025160
mov r9, r10
sar r9, 3
and r10, 0xfffffffffffffff8
mov r8, r10
add r8, rbx
shl r9, 3
xor r10d, r10d
mov r11, qword [rcx + r10]
mov qword [rbx + r10], r11
add r10, 8
cmp r9, r10
jne 0x14002514f
mov rcx, qword [rsi]
mov qword [rsi], rax
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], r8
mov qword [rsi + 0x18], rdx
test rcx, rcx
je 0x14002507b
call fcn.140021d70
mov rbx, qword [rsi + 8]
jmp 0x14002507b
call fcn.140029ed0
int3

Function at 0x140025df0
Capabilities:
Encode data using base64

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rdx, qword [rcx + 8]
cmp rdx, qword [rcx]
je 0x140025e21
mov rbx, rdx
mov rax, qword [rdi]
mov qword [rbx - 8], rax
add qword [rsi + 8], 0xfffffffffffffff8
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov r8, qword [rsi + 0x10]
mov rax, qword [rsi + 0x18]
cmp r8, rax
jae 0x140025e73
sub rax, r8
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
lea r14, [rax + rcx]
inc r14
sar r14, 1
lea rbx, [r8 + r14*8]
mov rax, r8
sub rax, rdx
sub rbx, rax
sub r8, rdx
je 0x140025e65
mov rcx, rbx
call fcn.1400c6530
mov rdx, qword [rsi + 0x10]
mov qword [rsi + 8], rbx
lea rax, [rdx + r14*8]
mov qword [rsi + 0x10], rax
jmp 0x140025e0b
mov rcx, rax
sub rcx, rdx
sar rcx, 2
cmp rax, rdx
mov r14d, 1
cmovne r14, rcx
mov rax, r14
shr rax, 0x3d
jne 0x140025f19
lea rcx, [r14*8]
call fcn.140027210
lea rbx, [r14*2 + 6]
and rbx, 0xfffffffffffffff8
add rbx, rax
mov rcx, qword [rsi + 8]
mov r10, qword [rsi + 0x10]
lea rdx, [rax + r14*8]
mov r8, rbx
sub r10, rcx
je 0x140025ef0
mov r9, r10
sar r9, 3
and r10, 0xfffffffffffffff8
mov r8, r10
add r8, rbx
shl r9, 3
xor r10d, r10d
mov r11, qword [rcx + r10]
mov qword [rbx + r10], r11
add r10, 8
cmp r9, r10
jne 0x140025edf
mov rcx, qword [rsi]
mov qword [rsi], rax
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], r8
mov qword [rsi + 0x18], rdx
test rcx, rcx
je 0x140025e0b
call fcn.140021d70
mov rbx, qword [rsi + 8]
jmp 0x140025e0b
call fcn.140029ed0
int3
Function at 0x14002aee0
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov rax, qword [0x142237158]
mov rcx, qword [rax]
call fcn.140025460
mov rcx, qword [0x142209580]
call fcn.14002afd0
mov rax, rsi
shl rax, 0xf
movabs rcx, 0x7ffffffffff8000
and rcx, rax
mov qword [0x142209578], rcx
mov rcx, rsi
shl rcx, 0x14
call fcn.14002af90
mov qword [0x142209580], rax
test rax, rax
je 0x14002af42
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.14002b060
mov rdi, qword [0x1400db5c8]
lea rdx, str.Failed_to_allocate
mov rcx, rdi
call fcn.14001ce40
mov rcx, rdi
mov rdx, rsi
call fcn.140021d80
mov rsi, rax
lea rdx, str.MB_for_transposition_table.
mov rcx, rax
call fcn.14001ce40
mov rcx, rsi
call fcn.14001d1b0
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3

Function at 0x14002afd0
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
test rcx, rcx
je 0x14002afed
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
je 0x14002aff4
add rsp, 0x28
pop rdi
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rdi, qword [0x1400db5c8]
lea rdx, str.Failed_to_free_large_page_memory._Error_code:_0x
mov rcx, rdi
call fcn.14001ce40
mov rax, qword [rdi]
mov rax, qword [rax - 0x18]
mov ecx, dword [rdi + rax + 8]
and ecx, 0xffffffb5
or ecx, 8
mov dword [rdi + rax + 8], ecx
mov rcx, rdi
mov edx, esi
call fcn.14002bec0
mov rcx, qword [rax]
mov rcx, qword [rcx - 0x18]
mov edx, dword [rax + rcx + 8]
and edx, 0xffffffb5
or edx, 2
mov dword [rax + rcx + 8], edx
mov rcx, rax
call fcn.14001d1b0
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3

Function at 0x14002b580
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov ecx, 0x10
call fcn.140027210
mov qword [rax], rdi
mov qword [rax + 8], rsi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x140086f40]
xor ecx, ecx
xor edx, edx
mov r9, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x14002b5d8
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x140035c00
Capabilities:
Get thread local storage value
Print debug messages
Set thread local storage value

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xb8
mov r15, qword [0x1400c71a0]
mov rax, qword [r15]
xor rax, rsp
mov qword [rsp + 0xb0], rax
call fcn.1400374f0
mov ecx, dword [0x1400f3010]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x140035d47
call fcn.140037a80
mov rsi, rax
xor eax, eax
cmp qword [0x1400db7f8], 0
je 0x140035d47
test rsi, rsi
je 0x140035d47
mov dword [rsi + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsi + 0x70], eax
xor ecx, ecx
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], 0xffffffffffffffff
lea rcx, [rsi + 0x68]
call fcn.1400885e0
cmp eax, 1
je 0x140035d75
mov qword [rsi + 0x68], 0xffffffffffffffff
mov dword [rsi + 0xb8], 0
mov rdi, rsi
add rdi, 0x28
mov qword [rsi + 0x28], 0
mov r12, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call r12
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r14, rax
call r12
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rbx
mov rdx, r14
mov r8, rax
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x140035d70
mov rcx, qword [rsi + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [rsi + 0xc0], eax
mov dword [rsi + 0xbc], 0
mov eax, dword [rsi + 0x40]
and eax, 0xffffffcf
or eax, 0x10
mov dword [rsi + 0x40], eax
mov ecx, dword [0x1400f3010]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, eax
mov rax, rsi
test ecx, ecx
je 0x140035d70
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
mov rdx, qword [r15]
cmp rdx, rcx
jne 0x140035d6b
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.140088640
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
movups xmm0, xmmword [0x1400c718b]
movups xmmword [rsp + 0x9b], xmm0
movaps xmm0, xmmword [0x1400c7180]
movaps xmmword [rsp + 0x90], xmm0
movaps xmm0, xmmword [0x1400c7170]
movaps xmmword [rsp + 0x80], xmm0
movaps xmm0, xmmword [0x1400c7160]
movaps xmmword [rsp + 0x70], xmm0
movaps xmm0, xmmword [0x1400c7150]
movaps xmmword [rsp + 0x60], xmm0
movaps xmm0, xmmword [0x1400c7140]
movaps xmmword [rsp + 0x50], xmm0
movaps xmm0, xmmword [str.Error_cleaning_up_spin_keys_for_thread]
movaps xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [rsp + 0x67]
mov ecx, eax
mov r8d, 0xa
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ultoa]
mov eax, 0x27
mov rcx, rax
inc rax
cmp rcx, 0x69
ja 0x140035e03
cmp byte [rsp + rcx + 0x40], 0
jne 0x140035df0
cmp rcx, 0x69
ja 0x140035e10
mov word [rsp + rax + 0x3f], 0xa
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
int3
Function at 0x140036970
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
call fcn.140035c00
mov rdi, rax
mov qword [rax + 8], rsi
mov rcx, qword [rax + 0x1d8]
call fcn.140036690
test byte [rdi + 0x40], 0x30
jne 0x1400369ac
add rdi, 0xd0
mov rcx, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_longjmp]
mov ecx, dword [0x1400f3010]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140036a47
mov rdi, rax
cmp qword [rax + 0x28], 0
jne 0x1400369ee
mov dword [rdi], 0xdeadbeef
mov rcx, qword [rdi + 0x30]
test rcx, rcx
je 0x1400369e0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 0x30], 0
mov rsi, qword [rdi + 8]
jmp 0x140036a31
mov rsi, qword [rdi + 8]
mov rcx, qword [rdi + 0x30]
mov dword [rdi + 0xbc], 1
test rcx, rcx
je 0x140036a0b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 0x30], 0
test byte [rdi + 0x44], 4
je 0x140036a47
mov dword [rdi], 0xdeadbeef
mov rcx, qword [rdi + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 0x28], 0
mov rcx, rdi
call fcn.140036a50
mov ecx, dword [0x1400f3010]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, esi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__endthreadex]
int3

Function at 0x1400374f0
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
sub rsp, 0x28
cmp dword [0x1400f34b4], 1
jne 0x140037506
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x1400f3018]
call fcn.1400885f0
mov rcx, qword [0x1400f34d8]
test rcx, rcx
je 0x140037543
lea rax, [0x1400f34b4]
nop word cs:[rax + rax]
mov rsi, rcx
cmp qword [rcx], rax
je 0x14003758d
mov rcx, qword [rsi + 0x18]
test rcx, rcx
jne 0x140037530
jmp 0x140037545
xor esi, esi
mov ecx, 1
mov edx, 0x20
call sub.api_ms_win_crt_heap_l1_1_0.dll_calloc
mov rdi, rax
lea rax, [0x1400f34b4]
mov qword [rdi], rax
mov dword [rdi + 0x10], 1
lea rax, [rsi + 0x18]
test rsi, rsi
lea rcx, [0x1400f34d8]
cmovne rcx, rax
mov qword [rcx], rdi
lea rcx, [rdi + 8]
xor edx, edx
call fcn.1400883c0
mov rsi, rdi
jmp 0x140037590
inc dword [rsi + 0x10]
lea rcx, [0x1400f3018]
call fcn.140088630
lea rdi, [rsi + 8]
mov rcx, rdi
call fcn.140088140
mov eax, dword [0x1400f34b4]
cmp eax, 1
je 0x1400375fc
test eax, eax
jne 0x1400375d4
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1400f3010], eax
cmp eax, 0xffffffff
je 0x140037612
mov dword [0x1400f34b4], 1
jmp 0x1400375fc
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9d, dword [0x1400f34b4]
lea r8, [0x1400f34b4]
lea rdx, str._once__p_is__d_n
mov rcx, rax
call fcn.140088cb0
mov rcx, rdi
call fcn.1400882b0
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140036220
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
int3
Function at 0x140037b30
Capabilities:
Print debug messages

Disassembly:
push rsi
push rdi
sub rsp, 0x98
mov rdi, qword [0x1400c71a0]
mov rax, qword [rdi]
xor rax, rsp
mov qword [rsp + 0x90], rax
test rcx, rcx
je 0x140037b67
mov rsi, rcx
call fcn.1400885e0
cmp eax, 1
je 0x140037b89
mov qword [rsi], 0xffffffffffffffff
mov rax, qword [rsp + 0x90]
xor rax, rsp
mov rcx, qword [rdi]
cmp rcx, rax
jne 0x140037b84
add rsp, 0x98
pop rdi
pop rsi
ret
call fcn.140088640
movups xmm0, xmmword [0x1400c718b]
movups xmmword [rsp + 0x7b], xmm0
movaps xmm0, xmmword [0x1400c7180]
movaps xmmword [rsp + 0x70], xmm0
movaps xmm0, xmmword [0x1400c7170]
movaps xmmword [rsp + 0x60], xmm0
movaps xmm0, xmmword [0x1400c7160]
movaps xmmword [rsp + 0x50], xmm0
movaps xmm0, xmmword [0x1400c7150]
movaps xmmword [rsp + 0x40], xmm0
movaps xmm0, xmmword [0x1400c7140]
movaps xmmword [rsp + 0x30], xmm0
movaps xmm0, xmmword [str.Error_cleaning_up_spin_keys_for_thread]
movaps xmmword [rsp + 0x20], xmm0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [rsp + 0x47]
mov ecx, eax
mov r8d, 0xa
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ultoa]
mov eax, 0x27
nop dword [rax + rax]
mov rcx, rax
inc rax
cmp rcx, 0x69
ja 0x140037c13
cmp byte [rsp + rcx + 0x20], 0
jne 0x140037c00
cmp rcx, 0x69
ja 0x140037c20
mov word [rsp + rax + 0x1f], 0xa
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
int3
Function at 0x140037c40
Capabilities:
Print debug messages

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xb0
mov r15, qword [0x1400c71a0]
mov rax, qword [r15]
xor rax, rsp
mov qword [rsp + 0xa8], rax
mov edi, 3
test rcx, rcx
je 0x140037cfe
mov rsi, rdx
mov rbx, rcx
lea rcx, section..data
call fcn.140088140
mov rcx, qword [0x1400f34c0]
test rcx, rcx
je 0x140037cf2
cmp rcx, 1
jne 0x140037ca7
mov rax, qword [0x1400f34c8]
cmp qword [rax + 8], rbx
jne 0x140037cf2
jmp 0x140037d29
dec rcx
mov rax, qword [0x1400f34c8]
xor edx, edx
jmp 0x140037ccb
inc r8
mov rdx, r8
cmp rdx, rcx
ja 0x140037cf2
lea r8, [rdx + rcx]
shr r8, 1
mov r9, r8
shl r9, 4
cmp qword [rax + r9 + 8], rbx
je 0x140037d26
jbe 0x140037cc0
cmp r8, rdx
je 0x140037cf2
dec r8
mov rcx, r8
cmp rdx, rcx
jbe 0x140037ccb
lea rcx, section..data
call fcn.1400882b0
mov rax, qword [rsp + 0xa8]
xor rax, rsp
mov rcx, qword [r15]
cmp rcx, rax
jne 0x140037e02
mov eax, edi
add rsp, 0xb0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
add rax, r9
mov r14, qword [rax]
lea rcx, section..data
call fcn.1400882b0
test r14, r14
je 0x140037cfe
mov rcx, qword [r14 + 0x28]
test rcx, rcx
je 0x140037cfe
lea rdx, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x140037cfe
mov edi, 0x16
test byte [r14 + 0x44], 4
jne 0x140037cfe
call fcn.140035c00
test rax, rax
je 0x140037d74
mov rax, qword [rax + 0x1d8]
jmp 0x140037d76
xor eax, eax
mov edi, 0x24
cmp rax, rbx
je 0x140037cfe
cmp dword [r14 + 0xbc], 0
mov rcx, qword [r14 + 0x28]
je 0x140037d9c
lea rax, [rcx + 1]
cmp rax, 2
jb 0x140037dab
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [r14 + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [r14 + 0x30]
test rcx, rcx
je 0x140037dc0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r14 + 0x30], 0
test rsi, rsi
je 0x140037dd4
mov rax, qword [r14 + 8]
mov qword [rsi], rax
lea rcx, [r14 + 0x38]
call fcn.140088450
lea rcx, [r14 + 0x68]
call fcn.1400885e0
cmp eax, 1
je 0x140037e07
mov qword [r14 + 0x68], 0xffffffffffffffff
mov rcx, r14
call fcn.140036a50
xor edi, edi
jmp 0x140037cfe
call fcn.140088640
movups xmm0, xmmword [0x1400c718b]
movups xmmword [rsp + 0x8b], xmm0
movaps xmm0, xmmword [0x1400c7180]
movaps xmmword [rsp + 0x80], xmm0
movaps xmm0, xmmword [0x1400c7170]
movaps xmmword [rsp + 0x70], xmm0
movaps xmm0, xmmword [0x1400c7160]
movaps xmmword [rsp + 0x60], xmm0
movaps xmm0, xmmword [0x1400c7150]
movaps xmmword [rsp + 0x50], xmm0
movaps xmm0, xmmword [0x1400c7140]
movaps xmmword [rsp + 0x40], xmm0
movaps xmm0, xmmword [str.Error_cleaning_up_spin_keys_for_thread]
movaps xmmword [rsp + 0x30], xmm0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [rsp + 0x57]
mov ecx, eax
mov r8d, 0xa
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ultoa]
mov eax, 0x27
mov rcx, rax
inc rax
cmp rcx, 0x69
ja 0x140037e92
cmp byte [rsp + rcx + 0x30], 0
jne 0x140037e7f
cmp rcx, 0x69
ja 0x140037e9f
mov word [rsp + rax + 0x2f], 0xa
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
int3
Function at 0x1400877d0
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
lea rcx, str.Mingw_w64_runtime_failure:_n
mov edx, 0x1b
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r8, qword [rsp + 0x28]
mov rcx, rax
mov rdx, rsi
call fcn.140091570
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
int3

Function at 0x140088640
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
lea rdx, str._stack_smashing_detected_:_terminated_n
mov ecx, 2
mov r8d, 0x2c
call sub.api_ms_win_crt_stdio_l1_1_0.dll__write
mov ecx, 0x17
call sub.KERNEL32.dll_IsProcessorFeaturePresent
test eax, eax
je 0x140088670
mov ecx, 2
int 0x29
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
int3
Function at 0x140088850
Capabilities:
Check for time delay via gettickcount
Check for time delay via queryperformancecounter

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov ebx, edx
mov rsi, rcx
mov r15, qword [0x1400c71a0]
mov rax, qword [r15]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea eax, [rbx + 1]
cmp eax, 1
ja 0x1400888af
mov rax, qword [rsp + 0x30]
xor rax, rsp
mov rcx, qword [r15]
cmp rcx, rax
jne case.default.0x1400888a8
mov rcx, rsi
mov edx, ebx
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rax, qword [0x1400f3578]
test rax, rax
je 0x1400888c5
call rax
mov rdi, rax
xor r12d, r12d
jmp 0x140088939
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x14008892a
mov r12, qword [rsp + 0x28]
test r12, r12
jle 0x140088931
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x140088931
mov rcx, qword [rsp + 0x20]
mov rax, r12
shr rax, 3
movabs rdx, 0x20c49ba5e353f7cf
mul rdx
mov r8, rdx
shr r8, 4
mov rax, rcx
or rax, r8
shr rax, 0x20
je 0x140088a55
mov rax, rcx
cqo
idiv r8
mov rdi, rax
jmp 0x140088939
mov r12, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov rcx, rsi
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140088a34
mov eax, ebx
add rdi, rax
mov rbp, qword [sym.imp.KERNEL32.dll_GetTickCount]
lea r14, [rsp + 0x20]
mov r13, qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rbx, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
mov rax, qword [0x1400f3578]
test rax, rax
je 0x140088990
call rax
jmp 0x140088a14
test r12, r12
je 0x1400889da
test r12, r12
jle 0x140088a10
mov rcx, r14
call r13
test eax, eax
je 0x140088a10
mov rcx, qword [rsp + 0x20]
mov rax, r12
shr rax, 3
movabs rdx, 0x20c49ba5e353f7cf
mul rdx
mov r8, rdx
shr r8, 4
mov rax, rcx
or rax, r8
shr rax, 0x20
je 0x1400889f5
mov rax, rcx
cqo
idiv r8
jmp 0x140088a14
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x1400889fe
mov r12, qword [rsp + 0x28]
test r12, r12
jg 0x14008899a
jmp 0x140088a10
mov eax, ecx
xor edx, edx
div r8d
jmp 0x140088a14
mov r12, 0xffffffffffffffff
nop word cs:[rax + rax]
call rbp
mov eax, eax
cmp rdi, rax
jbe 0x140088a2f
mov edx, edi
sub edx, eax
mov rcx, rsi
call rbx
cmp eax, 0x102
je 0x140088970
jmp 0x140088a34
mov eax, 0x102
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
mov rdx, qword [r15]
cmp rdx, rcx
jne case.default.0x1400888a8
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov eax, ecx
xor edx, edx
div r8d
jmp 0x140088937
call fcn.140088640
int3
Function at 0x140088a70
Capabilities:
Check for time delay via gettickcount
Check for time delay via queryperformancecounter

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov r15d, r9d
mov esi, r8d
mov rdi, rdx
mov ebx, ecx
mov r13, qword [0x1400c71a0]
mov rax, qword [r13]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea eax, [r15 + 1]
cmp eax, 1
ja 0x140088ade
mov rax, qword [rsp + 0x30]
xor rax, rsp
mov rcx, qword [r13]
cmp rcx, rax
jne case.default.0x140088ad7
mov ecx, ebx
mov rdx, rdi
mov r8d, esi
mov r9d, r15d
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rax, qword [0x1400f3578]
test rax, rax
je 0x140088af3
call rax
mov r14, rax
xor ebp, ebp
jmp 0x140088b68
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x140088b58
mov rbp, qword [rsp + 0x28]
test rbp, rbp
jle 0x140088b5f
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x140088b5f
mov rcx, qword [rsp + 0x20]
mov rax, rbp
shr rax, 3
movabs rdx, 0x20c49ba5e353f7cf
mul rdx
mov r8, rdx
shr r8, 4
mov rax, rcx
or rax, r8
shr rax, 0x20
je 0x140088c8f
mov rax, rcx
cqo
idiv r8
mov r14, rax
jmp 0x140088b68
mov rbp, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r14d, eax
mov ecx, ebx
mov rdx, rdi
mov r8d, esi
mov r9d, r15d
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, 0x102
jne 0x140088c6d
mov eax, r15d
add r14, rax
mov r15, qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r12, qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
nop dword [rax + rax]
mov rax, qword [0x1400f3578]
test rax, rax
je 0x140088bc0
call rax
jmp 0x140088c45
test rbp, rbp
je 0x140088c0f
test rbp, rbp
jle 0x140088c40
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x140088c40
mov rcx, qword [rsp + 0x20]
mov rax, rbp
shr rax, 3
movabs rdx, 0x20c49ba5e353f7cf
mul rdx
mov r8, rdx
shr r8, 4
mov rax, rcx
or rax, r8
shr rax, 0x20
je 0x140088c2a
mov rax, rcx
cqo
idiv r8
jmp 0x140088c45
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x140088c33
mov rbp, qword [rsp + 0x28]
test rbp, rbp
jg 0x140088bca
jmp 0x140088c40
mov eax, ecx
xor edx, edx
div r8d
jmp 0x140088c45
mov rbp, 0xffffffffffffffff
nop word [rax + rax]
call r15
mov eax, eax
cmp r14, rax
jbe 0x140088c68
mov r9d, r14d
sub r9d, eax
mov ecx, ebx
mov rdx, rdi
mov r8d, esi
call r12
cmp eax, 0x102
je 0x140088ba0
jmp 0x140088c6d
mov eax, 0x102
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
mov rdx, qword [r13]
cmp rdx, rcx
jne case.default.0x140088ad7
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov eax, ecx
xor edx, edx
div r8d
jmp 0x140088b65
call fcn.140088640
int3