joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140024e60
Capabilities:
Get thread local storage value
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rdi, [0x140029618]
mov rbx, rcx
mov rcx, rdi
mov esi, edx
call sym.pthread_mutex_lock
mov rcx, rbx
call sym.__pthread_get_pointer
test rax, rax
je 0x140024ed8
cmp qword [rax + 0x1d8], rbx
jne 0x140024ed8
test byte [rax + 0x40], 0xc
jne 0x140024ed8
mov edx, dword [rax + 0xbc]
test edx, edx
jne 0x140024ed8
mov rax, qword [rax + 0x28]
sub rax, 1
cmp rax, 0xfffffffffffffffd
ja 0x140024ed8
mov rcx, rdi
call sym.pthread_mutex_unlock
test esi, esi
je 0x140024ef0
lea edx, [rsi - 2]
cmp edx, 0x15
ja 0x140024ef8
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp sym.pthread_cancel
mov rcx, rdi
call sym.pthread_mutex_unlock
mov eax, 3
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor eax, eax
jmp 0x140024ee5
mov eax, 0x16
jmp 0x140024ee5

Function at 0x1400250c0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov esi, ecx
mov rdi, rdx
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x140029628]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x140025130
cmp esi, 1
ja 0x14002513d
lea rbp, [rbx + 0x38]
mov rcx, rbp
call sym.pthread_mutex_lock
test rdi, rdi
je 0x140025104
mov eax, dword [rbx + 0x44]
and eax, 1
mov dword [rdi], eax
mov eax, dword [rbx + 0x44]
mov rcx, qword [rbx + 0x1d8]
and eax, 0xfffffffe
or eax, esi
mov dword [rbx + 0x44], eax
call sym.test_cancel_locked
mov rcx, rbp
call sym.pthread_mutex_unlock
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
call sym.__pthread_self_lite.part.0
test rax, rax
mov rbx, rax
jne 0x1400250e6
mov eax, 0x16
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x140025150
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov esi, ecx
mov rdi, rdx
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x140029628]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x1400251c8
mov ebp, esi
and ebp, 0xfffffffd
jne 0x1400251d5
lea r12, [rbx + 0x38]
mov rcx, r12
call sym.pthread_mutex_lock
test rdi, rdi
je 0x140025198
mov eax, dword [rbx + 0x44]
and eax, 2
mov dword [rdi], eax
mov eax, dword [rbx + 0x44]
mov rcx, qword [rbx + 0x1d8]
and eax, 0xfffffffd
or eax, esi
mov dword [rbx + 0x44], eax
call sym.test_cancel_locked
mov rcx, r12
call sym.pthread_mutex_unlock
mov eax, ebp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call sym.__pthread_self_lite.part.0
test rax, rax
mov rbx, rax
jne 0x140025178
mov ebp, 0x16
mov eax, ebp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x140025480
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
test rcx, rcx
mov rsi, rcx
mov rbp, rdx
je 0x1400255a0
lea rdi, [0x140029618]
mov rcx, rdi
call sym.pthread_mutex_lock
mov rcx, rsi
call sym.__pthread_get_pointer
mov rcx, rdi
mov rbx, rax
call sym.pthread_mutex_unlock
test rbx, rbx
je 0x1400255a0
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x1400255a0
lea rdx, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x1400255a0
test byte [rbx + 0x44], 4
jne 0x1400255b0
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x140029628]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400255d0
cmp rsi, qword [rax + 0x1d8]
je 0x1400255f8
mov eax, dword [rbx + 0xbc]
mov rcx, qword [rbx + 0x28]
test eax, eax
je 0x14002552b
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14002553a
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x28]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14002554e
call rsi
mov qword [rbx + 0x30], 0
lea rcx, [rbx + 0x38]
test rbp, rbp
je 0x1400255e8
mov rax, qword [rbx + 8]
mov qword [rbp], rax
call sym.pthread_mutex_destroy
lea rcx, [rbx + 0x68]
call sym.pthread_spin_destroy
cmp eax, 1
je 0x1400255ff
cmp qword [rbx + 0x1d0], 0
mov qword [rbx + 0x68], 0xffffffffffffffff
je 0x1400255c0
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov eax, 3
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov eax, 0x16
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, rbx
call sym.push_pthread_mem.part.0
xor eax, eax
jmp 0x140025596
call sym.__pthread_self_lite.part.0
test rax, rax
jne 0x140025506
jmp 0x140025513
call sym.pthread_mutex_destroy
jmp 0x140025570
mov eax, 0x24
jmp 0x1400255a5
call sym.replace_spin_keys.part.0
nop
nop word cs:[rax + rax]
Function at 0x140025610
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
lea rbp, [0x140029618]
mov rsi, rcx
mov rcx, rbp
mov rdi, rdx
call sym.pthread_mutex_lock
mov rcx, rsi
call sym.__pthread_get_pointer
test rax, rax
mov rbx, rax
je 0x140025730
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x140025730
lea rdx, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x140025730
test byte [rbx + 0x44], 4
jne 0x140025750
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x140029628]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140025790
mov rdx, qword [rax + 0x1d8]
cmp rsi, rdx
je 0x1400257c8
mov edx, dword [rbx + 0xbc]
mov rcx, qword [rbx + 0x28]
test edx, edx
jne 0x1400256b7
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140025770
mov rcx, qword [rbx + 0x28]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x1400256cb
call rsi
mov qword [rbx + 0x30], 0
lea rcx, [rbx + 0x38]
test rdi, rdi
je 0x1400257a8
mov rax, qword [rbx + 8]
mov qword [rdi], rax
call sym.pthread_mutex_destroy
lea rcx, [rbx + 0x68]
call sym.pthread_spin_destroy
cmp eax, 1
je 0x1400257da
cmp qword [rbx + 0x1d0], 0
mov qword [rbx + 0x68], 0xffffffffffffffff
je 0x1400257b8
mov rcx, rbp
call sym.pthread_mutex_unlock
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, rbp
call sym.pthread_mutex_unlock
mov eax, 3
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, rbp
call sym.pthread_mutex_unlock
mov eax, 0x16
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov eax, dword [rbx + 0xbc]
test eax, eax
jne 0x1400256b3
mov rcx, rbp
call sym.pthread_mutex_unlock
mov eax, 0x10
jmp 0x14002571e
call sym.__pthread_self_lite.part.0
xor edx, edx
test rax, rax
jne 0x140025685
jmp 0x14002568c
call sym.pthread_mutex_destroy
jmp 0x1400256ec
mov rcx, rbx
call sym.push_pthread_mem.part.0
jmp 0x140025714
mov rcx, rbp
call sym.pthread_mutex_unlock
mov eax, 0x24
jmp 0x14002571e
call sym.replace_spin_keys.part.0
nop

Function at 0x140025ec0
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
lea rdi, [0x140029638]
mov rbx, rcx
mov rcx, rdi
mov esi, edx
call sym.pthread_spin_lock
mov rax, qword [rbx]
cmp dword [rax], 0xbab1f0ed
jne 0x140025f09
mov rax, qword [rbx]
mov eax, dword [rax + 4]
test eax, eax
jle 0x140025f09
mov rax, qword [rbx]
mov rcx, rdi
sub dword [rax + 4], 1
call sym.pthread_spin_unlock
mov eax, esi
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov dword [rsp + 0x20], 0x28
lea r9, str..._.._src_mingw_w64_mingw_w64_libraries_winpthreads_src_rwlock.c
lea r8, str.___rwlock_t__rwl___valid__LIFE_RWLOCK______rwlock_t__rwl___busy___0_
mov rcx, rax
lea rdx, str.Assertion_failed:___s___file__s__line__d_n
call sym.fprintf
mov ecx, 1
call sym.exit
nop
nop word cs:[rax + rax]
nop
Function at 0x140026330
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
call sym.rwl_ref.constprop.0
test eax, eax
je 0x140026358
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rsi, qword [rbx]
lea rdi, [rsi + 0x18]
mov rcx, rdi
call sym.pthread_mutex_lock
test eax, eax
jne 0x140026381
lock add dword [rsi + 0xc], 1
cmp dword [rsi + 0xc], 0x7fffffff
je 0x140026398
mov rcx, rdi
call sym.pthread_mutex_unlock
mov edx, eax
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.rwl_unref
lea r12, [rsi + 0x20]
mov rcx, r12
call sym.pthread_mutex_lock
test eax, eax
mov ebp, eax
je 0x1400263c0
mov rcx, rdi
call sym.pthread_mutex_unlock
mov edx, ebp
jmp 0x140026383
mov eax, dword [rsi + 0x10]
mov rcx, r12
mov dword [rsi + 0x10], 0
sub dword [rsi + 0xc], eax
call sym.pthread_mutex_unlock
mov rcx, rdi
mov esi, eax
call sym.pthread_mutex_unlock
test esi, esi
cmove esi, eax
mov edx, esi
jmp 0x140026383

Function at 0x1400263f0
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rdi, rdx
call sym.rwl_ref.constprop.0
test eax, eax
je 0x140026418
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rsi, qword [rbx]
mov rdx, rdi
lea rbp, [rsi + 0x18]
mov rcx, rbp
call sym.pthread_mutex_timedlock
test eax, eax
jne 0x140026444
lock add dword [rsi + 0xc], 1
cmp dword [rsi + 0xc], 0x7fffffff
je 0x140026460
mov rcx, rbp
call sym.pthread_mutex_unlock
mov edx, eax
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.rwl_unref
lea r12, [rsi + 0x20]
mov rdx, rdi
mov rcx, r12
call sym.pthread_mutex_timedlock
test eax, eax
mov edi, eax
je 0x140026490
cmp eax, 0x8a
je 0x1400264c0
mov rcx, rbp
call sym.pthread_mutex_unlock
mov edx, edi
jmp 0x140026446
mov eax, dword [rsi + 0x10]
mov rcx, r12
mov dword [rsi + 0x10], 0
sub dword [rsi + 0xc], eax
call sym.pthread_mutex_unlock
mov rcx, rbp
mov esi, eax
call sym.pthread_mutex_unlock
test esi, esi
cmove esi, eax
mov edx, esi
jmp 0x140026446
lock add dword [rsi + 0x10], 1
jmp 0x14002647c

Function at 0x1400264d0
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
call sym.rwl_ref.constprop.0
test eax, eax
je 0x1400264f8
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rsi, qword [rbx]
lea rdi, [rsi + 0x18]
mov rcx, rdi
call sym.pthread_mutex_trylock
test eax, eax
jne 0x140026521
lock add dword [rsi + 0xc], 1
cmp dword [rsi + 0xc], 0x7fffffff
je 0x140026538
mov rcx, rdi
call sym.pthread_mutex_unlock
mov edx, eax
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.rwl_unref
lea r12, [rsi + 0x20]
mov rcx, r12
call sym.pthread_mutex_lock
test eax, eax
mov ebp, eax
je 0x140026560
mov rcx, rdi
call sym.pthread_mutex_unlock
mov edx, ebp
jmp 0x140026523
mov eax, dword [rsi + 0x10]
mov rcx, r12
mov dword [rsi + 0x10], 0
sub dword [rsi + 0xc], eax
call sym.pthread_mutex_unlock
mov rcx, rdi
mov esi, eax
call sym.pthread_mutex_unlock
test esi, esi
cmove esi, eax
mov edx, esi
jmp 0x140026523
Function at 0x140026590
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
call sym.rwl_ref.constprop.0
test eax, eax
je 0x1400265b8
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rsi, qword [rbx]
lea rbp, [rsi + 0x18]
mov rcx, rbp
call sym.pthread_mutex_trylock
test eax, eax
mov edx, eax
jne 0x14002660e
lea r12, [rsi + 0x20]
mov rcx, r12
call sym.pthread_mutex_trylock
test eax, eax
mov edi, eax
jne 0x140026648
mov eax, dword [rsi + 8]
mov edx, 0x10
test eax, eax
jne 0x14002660e
mov edx, dword [rsi + 0x10]
mov eax, dword [rsi + 0xc]
test edx, edx
jle 0x140026601
sub eax, edx
mov dword [rsi + 0x10], 0
mov dword [rsi + 0xc], eax
test eax, eax
jg 0x140026620
mov dword [rsi + 8], 1
xor edx, edx
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.rwl_unref
mov rcx, r12
call sym.pthread_mutex_unlock
mov rcx, rbp
mov esi, eax
call sym.pthread_mutex_unlock
test esi, esi
jne 0x140026640
test eax, eax
mov esi, 0x10
cmovne esi, eax
mov edx, esi
jmp 0x14002660e
mov rcx, rbp
call sym.pthread_mutex_unlock
test eax, eax
cmovne edi, eax
mov edx, edi
jmp 0x14002660e

Function at 0x140026660
Capabilities:
Terminate process

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
call sym.rwl_ref_unlock
test eax, eax
jne 0x1400266e0
mov rdi, qword [rbx]
mov edx, dword [rdi + 8]
lea rbp, [rdi + 0x20]
test edx, edx
je 0x1400266b8
lock sub dword [rdi + 8], 1
mov rcx, rbp
call sym.pthread_mutex_unlock
lea rcx, [rdi + 0x18]
mov esi, eax
call sym.pthread_mutex_unlock
test esi, esi
cmove esi, eax
mov edx, esi
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.rwl_unref
mov rcx, rbp
call sym.pthread_mutex_lock
test eax, eax
mov esi, eax
jne 0x14002669f
lock add dword [rdi + 0x10], 1
mov eax, dword [rdi + 0x10]
test eax, eax
je 0x1400266f0
mov rcx, rbp
call sym.pthread_mutex_unlock
mov esi, eax
jmp 0x14002669f
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rcx, [rdi + 0x28]
call sym.pthread_cond_signal
mov rcx, rbp
mov esi, eax
call sym.pthread_mutex_unlock
test esi, esi
cmove esi, eax
jmp 0x14002669f
Function at 0x140026710
Capabilities:
Terminate process

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbx, rcx
call sym.rwl_ref.constprop.0
test eax, eax
je 0x140026738
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rsi, qword [rbx]
lea rdi, [rsi + 0x18]
mov rcx, rdi
call sym.pthread_mutex_lock
test eax, eax
mov ebp, eax
jne 0x140026789
lea r12, [rsi + 0x20]
mov rcx, r12
call sym.pthread_mutex_lock
test eax, eax
mov ebp, eax
jne 0x140026820
mov edx, dword [rsi + 8]
test edx, edx
jne 0x140026784
mov edx, dword [rsi + 0x10]
mov eax, dword [rsi + 0xc]
test edx, edx
jle 0x140026780
sub eax, edx
mov dword [rsi + 0x10], 0
mov dword [rsi + 0xc], eax
test eax, eax
jg 0x1400267a0
lock add dword [rsi + 8], 1
mov edx, ebp
mov rcx, rbx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.rwl_unref
mov qword [rsp + 0x28], rsi
lea r13, [rsi + 0x28]
neg eax
mov dword [rsi + 0x10], eax
lea rax, [sym.st_cancelwrite]
mov qword [rsp + 0x20], rax
call sym.pthread_getclean
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
lock or qword [rsp], 0
call sym.pthread_getclean
lea rdx, [rsp + 0x20]
mov qword [rax], rdx
lock or qword [rsp], 0
jmp 0x1400267ef
mov eax, dword [rsi + 0x10]
test eax, eax
jns 0x140026830
mov rdx, r12
mov rcx, r13
call sym.pthread_cond_wait
test eax, eax
mov edi, eax
je 0x1400267e8
call sym.pthread_getclean
mov rdx, qword [rsp + 0x30]
mov ebp, edi
mov qword [rax], rdx
mov rcx, qword [rsp + 0x28]
call qword [rsp + 0x20]
jmp 0x140026789
mov rcx, rdi
call sym.pthread_mutex_unlock
jmp 0x140026789
call sym.pthread_getclean
mov rdx, qword [rsp + 0x30]
mov qword [rax], rdx
mov dword [rsi + 0xc], 0
jmp 0x140026784
Function at 0x140026850
Capabilities:
Terminate process

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
test rcx, rcx
mov rbx, rcx
mov rsi, rdx
je 0x140026900
test rdx, rdx
je 0x140026900
call sym.rwl_ref.constprop.0
test eax, eax
je 0x140026890
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rdi, qword [rbx]
mov rdx, rsi
lea rbp, [rdi + 0x18]
mov rcx, rbp
call sym.pthread_mutex_timedlock
test eax, eax
mov edx, eax
jne 0x1400268e7
lea r13, [rdi + 0x20]
mov rdx, rsi
mov rcx, r13
call sym.pthread_mutex_timedlock
test eax, eax
mov r12d, eax
jne 0x140026918
mov edx, dword [rdi + 8]
test edx, edx
jne 0x1400268df
mov edx, dword [rdi + 0x10]
mov eax, dword [rdi + 0xc]
test edx, edx
jle 0x1400268db
sub eax, edx
mov dword [rdi + 0x10], 0
mov dword [rdi + 0xc], eax
test eax, eax
jg 0x140026928
lock add dword [rdi + 8], 1
mov edx, r12d
mov rcx, rbx
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp sym.rwl_unref
mov eax, 0x16
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rcx, rbp
call sym.pthread_mutex_unlock
jmp 0x1400268e4
mov qword [rsp + 0x28], rdi
lea r14, [rdi + 0x28]
neg eax
mov dword [rdi + 0x10], eax
lea rax, [sym.st_cancelwrite]
mov qword [rsp + 0x20], rax
call sym.pthread_getclean
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
lock or qword [rsp], 0
call sym.pthread_getclean
lea rdx, [rsp + 0x20]
mov qword [rax], rdx
lock or qword [rsp], 0
jmp 0x140026974
test ebp, ebp
jne 0x14002698b
mov r8, rsi
mov rdx, r13
mov rcx, r14
call sym.pthread_cond_timedwait
mov ebp, eax
mov eax, dword [rdi + 0x10]
test eax, eax
js 0x140026970
call sym.pthread_getclean
mov rdx, qword [rsp + 0x30]
test ebp, ebp
mov qword [rax], rdx
jne 0x1400269b0
mov dword [rdi + 0xc], 0
jmp 0x1400268df
mov rcx, qword [rsp + 0x28]
mov r12d, ebp
call qword [rsp + 0x20]
jmp 0x1400268e4
Function at 0x1400018c4
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x40
mov r12d, Ordinal_69
mov rbp, rdx
mov rsi, rcx
mov edx, r12d
mov r14d, r9d
mov edi, r8d
lea ecx, [r12 - 1]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
xor r15d, r15d
mov rbx, rax
test rax, rax
je 0x140001a28
lea r10d, [r12 - 0x3a]
mov r11d, r15d
cmp edi, r10d
cmovb r10d, edi
lea edi, [r12 - 0x40]
test r10d, r10d
je 0x1400019a6
lea r9, [rbp + 2]
movzx edx, byte [r9 - 2]
lea r8d, [r11*8]
lea ecx, [r8 + 2]
mov al, dl
or al, 0x10
movzx eax, al
test dl, 0xf0
cmove edx, eax
lea eax, [r8 + 1]
add r11d, edi
mov byte [rax + rbx], dl
mov al, byte [r9 - 1]
mov byte [rcx + rbx], al
lea ecx, [r8 + 3]
mov al, byte [r9]
lea r9, [r9 + 8]
mov byte [rcx + rbx], al
lea ecx, [r8 + 4]
mov al, byte [r9 - 7]
mov byte [rcx + rbx], al
lea ecx, [r8 + 5]
mov al, byte [r9 - 6]
mov byte [rcx + rbx], al
lea ecx, [r8 + 6]
mov al, byte [r9 - 5]
mov byte [rcx + rbx], al
lea ecx, [r8 + 7]
mov al, byte [r9 - 4]
mov byte [rcx + rbx], al
lea ecx, [r8 + 8]
mov al, byte [r9 - 3]
mov byte [rcx + rbx], al
cmp r11d, r10d
jb 0x14000192d
or word [rbx + 0x3d], 0xffff
lea rdx, [rbx + 1]
mov dword [rbx + 0x39], 0xff550404
movzx ecx, r15w
mov r8d, 0x3e
movzx eax, byte [rdx]
add rdx, rdi
add cx, ax
sub r8, rdi
jne 0x1400019c1
movzx eax, cx
mov byte [rbx + 0x40], cl
shr ax, 8
mov byte [rbx + 0x3f], al
jmp 0x140001a18
mov rcx, qword [rsi + 0x78]
mov edx, r15d
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140001a0e
cmp r12w, word [rsi + 0x2a]
ja 0x140001a0e
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], r15
mov r8d, r12d
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, eax
and edi, edx
test r14d, r14d
je 0x140001a1d
mov rsi, qword [rsi]
test rsi, rsi
jne 0x1400019de
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140001a2b
mov edi, r15d
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rdi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop r12
ret

Function at 0x140001a4c
Capabilities:
Terminate thread

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x20
and dword [rax + 8], 0
mov esi, edx
mov dword [rax + 0xc], 0x80000000
mov rdi, rcx
mov rbx, rcx
test rcx, rcx
je 0x140001aa3
and dword [rbx + 0x90], 0
mov rcx, qword [rbx + 0x98]
test rcx, rcx
je 0x140001a97
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
and qword [rbx + 0x98], 0
test esi, esi
je 0x140001aa3
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140001a74
mov r9d, esi
lea rdx, [rsp + 0x30]
mov r8d, 1
mov rcx, rdi
call fcn.1400018c4
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140001edc
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x70
mov rbp, rcx
mov edx, 0x338
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x140002074
and dword [rbx + 0x1c], 0
lea r14, [rax + 8]
and dword [rbx + 0x20], 0
mov eax, 0x4000000
mov dword [r14], eax
mov r8, rbp
mov dword [rbx + 0xc], eax
xor edx, edx
mov eax, SQLGetData
mov rcx, r14
mov word [rbx + 0x28], ax
call fcn.140001de0
test eax, eax
je 0x140002062
lea rsi, [rbx + 0x22a]
mov edi, 0x100
mov rdx, rsi
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x140002062
mov edx, edi
mov rax, rsi
cmp byte [rax], 0
je 0x140001f7b
inc rax
sub rdx, 1
jne 0x140001f6d
mov rcx, rdi
mov rax, rdx
sub rcx, rdx
neg rax
sbb r8, r8
and r8, rcx
test rdx, rdx
je 0x140002062
lea rcx, [r8 + rsi]
sub rdi, r8
je 0x140001fcb
lea rdx, [0x1400fc07c]
mov eax, 0x7fffffff
sub rdx, rcx
test rax, rax
je 0x140001fcb
mov r8b, byte [rdx + rcx]
test r8b, r8b
je 0x140001fcb
mov byte [rcx], r8b
dec rax
inc rcx
sub rdi, 1
jne 0x140001fae
test rdi, rdi
lea rax, [rcx - 1]
cmovne rax, rcx
mov byte [rax], 0
je 0x140002062
mov qword [rsp + 0x60], rbp
lea rax, [0x140001d08]
mov qword [rsp + 0x58], r14
lea rcx, [rbx + 0x32c]
mov qword [rsp + 0x50], rax
lea r9, [0x140001b6c]
lea rax, [0x140001cd4]
mov qword [rsp + 0x48], rax
lea r8, [0x140001b5c]
lea rax, [0x140001c9c]
mov qword [rsp + 0x40], rax
lea rdx, [fcn.140001b58]
lea rax, [fcn.140001c68]
mov qword [rsp + 0x38], rax
lea rax, [0x140001c30]
mov qword [rsp + 0x30], rax
lea rax, [0x140001bf8]
mov qword [rsp + 0x28], rax
lea rax, [fcn.140001b74]
mov qword [rsp + 0x20], rax
call qword [sym.imp.Cabinet.dll_FCICreate]
mov qword [rbx], rax
cmp qword [rbx], 0
jne 0x140002074
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbx, rax
lea r11, [rsp + 0x70]
mov rax, rbx
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x140003560
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
xor ebx, ebx
mov r15, r9
mov esi, r8d
mov r14, rdx
mov edi, ecx
cmp ecx, 0x8000
jne 0x1400035f9
cmp dword [rbp + 0x40], 4
jne 0x1400036db
lea rdx, [rbp - 0x20]
mov ecx, 0xffffff7c
call qword [sym.imp.cryptdll.dll_CDLocateCheckSum]
test eax, eax
js 0x1400036db
mov rax, qword [rbp - 0x20]
lea rdx, [rbp - 0x10]
xor ecx, ecx
call qword [rax + 0x10]
test eax, eax
js 0x1400036db
mov rax, qword [rbp - 0x20]
mov r8, r14
mov rcx, qword [rbp - 0x10]
mov edx, esi
call qword [rax + reloc.ODBC32.dll_SQLAllocHandle]
mov rax, qword [rbp - 0x20]
mov rdx, r15
mov rcx, qword [rbp - 0x10]
call qword [rax + 0x20]
test eax, eax
lea rcx, [rbp - 0x10]
mov rax, qword [rbp - 0x20]
setns bl
call qword [rax + Ordinal_41]
jmp 0x1400036db
mov r9d, reloc.ODBC32.dll_SQLAllocHandle
mov dword [rsp + 0x20], 0xf0000000
xor r8d, r8d
lea rcx, [rbp - 8]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1400036db
mov rcx, qword [rbp - 8]
lea rax, [rbp - 0x18]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1400036cf
mov rcx, qword [rbp - 0x18]
xor r9d, r9d
mov r8d, esi
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1400036c5
mov rcx, qword [rbp - 0x18]
lea r9, [rbp + 0x20]
xor r8d, r8d
mov dword [rsp + 0x20], ebx
lea esi, [r8 + 2]
mov edx, esi
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x1400036c5
mov edx, dword [rbp + 0x20]
lea ecx, [rsi + 0x3e]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x1400036c5
mov rcx, qword [rbp - 0x18]
lea r9, [rbp + 0x20]
mov r8, rax
mov dword [rsp + 0x20], ebx
mov edx, esi
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov ecx, dword [rbp + 0x40]
mov rdx, rdi
cmp dword [rbp + 0x20], ecx
mov ebx, eax
cmovb ecx, dword [rbp + 0x20]
mov r8d, ecx
mov rcx, r15
call fcn.1400c5960
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rbp - 8]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea r11, [rsp + 0x50]
mov eax, ebx
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret