joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001bb80
Capabilities:
Get thread local storage value
Hijack thread execution

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x4f8
mov rsi, rcx
test rcx, rcx
je 0x14001bc70
lea rdi, [0x1400cd178]
mov rcx, rdi
call sym.pthread_mutex_lock
mov rcx, rsi
call sym.__pthread_get_pointer
mov rcx, rdi
mov rbx, rax
call sym.pthread_mutex_unlock
test rbx, rbx
je 0x14001bc70
mov rcx, qword [rbx + 0x28]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14001bc70
lea rdi, [rsp + 0x20]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x14001bc70
lea rbp, [rbx + 0x38]
mov rcx, rbp
call sym.pthread_mutex_lock
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x1400cd188]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14001bd80
movzx edx, byte [rbx + 0x40]
cmp rsi, qword [rax + 0x1d8]
je 0x14001bc88
mov eax, dword [rbx + 0x44]
not eax
test al, 3
je 0x14001bce0
test dl, 3
jne 0x14001bc60
and edx, 0xfffffffc
or edx, 1
mov byte [rbx + 0x40], dl
lock add dword [0x140102d08], 1
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14001bc4f
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rbp
call sym.pthread_mutex_unlock
xor eax, eax
jmp 0x14001bc75
mov rcx, rbp
call sym.pthread_mutex_unlock
test byte [rbx + 0x40], 0xc
je 0x14001bc57
nop
mov eax, 3
add rsp, 0x4f8
pop rbx
pop rsi
pop rdi
pop rbp
ret
test dl, 3
jne 0x14001bc60
and edx, 0xfffffffc
or edx, 1
mov byte [rbx + 0x40], dl
lock add dword [0x140102d08], 1
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14001bcad
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [rbx + 0x44]
mov edx, eax
not edx
and edx, 3
jne 0x14001bc4f
and eax, 0xfffffffe
mov rcx, rbp
mov dword [rbx + 0x44], eax
movzx eax, byte [rbx + 0x40]
and eax, 0xfffffff3
or eax, 4
mov byte [rbx + 0x40], al
call sym.pthread_mutex_unlock
call sym._pthread_invoke_cancel
nop dword [rax]
test dl, 0xc
jne 0x14001bc60
and edx, 0xf
jne 0x14001bc70
mov rcx, qword [rbx + 0x28]
mov dword [rsp + 0x50], 0x100001
call qword [sym.imp.KERNEL32.dll_SuspendThread]
xor edx, edx
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x14001bc4f
mov rcx, qword [rbx + 0x28]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
lea rax, [sym._pthread_invoke_cancel]
mov rcx, qword [rbx + 0x28]
mov rdx, rdi
mov qword [rsp + 0x118], rax
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
movzx eax, byte [rbx + 0x40]
and dword [rbx + 0x44], 0xfffffffe
and eax, 0xfffffff0
or eax, 5
mov byte [rbx + 0x40], al
lock add dword [0x140102d08], 1
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14001bd68
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rbp
call sym.pthread_mutex_unlock
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x14001bc4f
call sym.__pthread_self_lite.part.0
test rax, rax
jne 0x14001bc10
movzx edx, byte [rbx + 0x40]
jmp 0x14001bc1d
Function at 0x14001bda0
Capabilities:
Get thread local storage value
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rdi, [0x1400cd178]
mov rbx, rcx
mov rcx, rdi
mov esi, edx
call sym.pthread_mutex_lock
mov rcx, rbx
call sym.__pthread_get_pointer
test rax, rax
je 0x14001be18
cmp qword [rax + 0x1d8], rbx
jne 0x14001be18
test byte [rax + 0x40], 0xc
jne 0x14001be18
mov edx, dword [rax + 0xbc]
test edx, edx
jne 0x14001be18
mov rax, qword [rax + 0x28]
sub rax, 1
cmp rax, 0xfffffffffffffffd
ja 0x14001be18
mov rcx, rdi
call sym.pthread_mutex_unlock
test esi, esi
je 0x14001be30
lea edx, [rsi - 2]
cmp edx, 0x15
ja 0x14001be38
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp sym.pthread_cancel
mov rcx, rdi
call sym.pthread_mutex_unlock
mov eax, 3
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor eax, eax
jmp 0x14001be25
mov eax, 0x16
jmp 0x14001be25

Function at 0x14001bfd0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov esi, ecx
mov rdi, rdx
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x1400cd188]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x14001c040
cmp esi, 1
ja 0x14001c04d
lea rbp, [rbx + 0x38]
mov rcx, rbp
call sym.pthread_mutex_lock
test rdi, rdi
je 0x14001c014
mov eax, dword [rbx + 0x44]
and eax, 1
mov dword [rdi], eax
mov eax, dword [rbx + 0x44]
mov rcx, qword [rbx + 0x1d8]
and eax, 0xfffffffe
or eax, esi
mov dword [rbx + 0x44], eax
call sym.test_cancel_locked
mov rcx, rbp
call sym.pthread_mutex_unlock
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
call sym.__pthread_self_lite.part.0
mov rbx, rax
test rax, rax
jne 0x14001bff6
mov eax, 0x16
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x14001c060
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov esi, ecx
mov rdi, rdx
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x1400cd188]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x14001c0d8
mov ebp, esi
and ebp, 0xfffffffd
jne 0x14001c0e5
lea r12, [rbx + 0x38]
mov rcx, r12
call sym.pthread_mutex_lock
test rdi, rdi
je 0x14001c0a8
mov eax, dword [rbx + 0x44]
and eax, 2
mov dword [rdi], eax
mov eax, dword [rbx + 0x44]
mov rcx, qword [rbx + 0x1d8]
and eax, 0xfffffffd
or eax, esi
mov dword [rbx + 0x44], eax
call sym.test_cancel_locked
mov rcx, r12
call sym.pthread_mutex_unlock
mov eax, ebp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call sym.__pthread_self_lite.part.0
mov rbx, rax
test rax, rax
jne 0x14001c088
mov ebp, 0x16
mov eax, ebp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x14001c390
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rsi, rcx
mov rbp, rdx
test rcx, rcx
je 0x14001c4b0
lea rdi, [0x1400cd178]
mov rcx, rdi
call sym.pthread_mutex_lock
mov rcx, rsi
call sym.__pthread_get_pointer
mov rcx, rdi
mov rbx, rax
call sym.pthread_mutex_unlock
test rbx, rbx
je 0x14001c4b0
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x14001c4b0
lea rdx, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x14001c4b0
test byte [rbx + 0x44], 4
jne 0x14001c4c0
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x1400cd188]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14001c4e0
cmp rsi, qword [rax + 0x1d8]
je 0x14001c510
mov eax, dword [rbx + 0xbc]
mov rcx, qword [rbx + 0x28]
test eax, eax
je 0x14001c43b
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14001c44a
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x28]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14001c45e
call rsi
mov qword [rbx + 0x30], 0
test rbp, rbp
je 0x14001c4f8
mov rax, qword [rbx + 8]
lea rcx, [rbx + 0x38]
mov qword [rbp], rax
call sym.pthread_mutex_destroy
lea rcx, [rbx + 0x68]
call sym.pthread_spin_destroy
cmp eax, 1
je 0x14001c517
cmp qword [rbx + 0x1d0], 0
mov qword [rbx + 0x68], 0xffffffffffffffff
je 0x14001c4d0
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov eax, 3
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov eax, 0x16
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, rbx
call sym.push_pthread_mem.part.0
xor eax, eax
jmp 0x14001c4a6
call sym.__pthread_self_lite.part.0
test rax, rax
jne 0x14001c416
jmp 0x14001c423
lea rcx, [rbx + 0x38]
call sym.pthread_mutex_destroy
lea rcx, [rbx + 0x68]
jmp 0x14001c484
mov eax, 0x24
jmp 0x14001c4b5
call sym.replace_spin_keys.part.0
nop
nop dword [rax]
Function at 0x14001c520
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
lea rbp, [0x1400cd178]
mov rsi, rcx
mov rcx, rbp
mov rdi, rdx
call sym.pthread_mutex_lock
mov rcx, rsi
call sym.__pthread_get_pointer
mov rbx, rax
test rax, rax
je 0x14001c640
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x14001c640
lea rdx, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x14001c640
test byte [rbx + 0x44], 4
jne 0x14001c660
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x1400cd188]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14001c6a0
mov rdx, qword [rax + 0x1d8]
cmp rsi, rdx
je 0x14001c6e0
mov edx, dword [rbx + 0xbc]
mov rcx, qword [rbx + 0x28]
test edx, edx
jne 0x14001c5c7
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14001c680
mov rcx, qword [rbx + 0x28]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14001c5db
call rsi
mov qword [rbx + 0x30], 0
test rdi, rdi
je 0x14001c6b8
mov rax, qword [rbx + 8]
lea rcx, [rbx + 0x38]
mov qword [rdi], rax
call sym.pthread_mutex_destroy
lea rcx, [rbx + 0x68]
call sym.pthread_spin_destroy
cmp eax, 1
je 0x14001c6f2
cmp qword [rbx + 0x1d0], 0
mov qword [rbx + 0x68], 0xffffffffffffffff
je 0x14001c6d0
mov rcx, rbp
call sym.pthread_mutex_unlock
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, rbp
call sym.pthread_mutex_unlock
mov eax, 3
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, rbp
call sym.pthread_mutex_unlock
mov eax, 0x16
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov eax, dword [rbx + 0xbc]
test eax, eax
jne 0x14001c5c3
mov rcx, rbp
call sym.pthread_mutex_unlock
mov eax, 0x10
jmp 0x14001c62e
call sym.__pthread_self_lite.part.0
xor edx, edx
test rax, rax
jne 0x14001c595
jmp 0x14001c59c
lea rcx, [rbx + 0x38]
call sym.pthread_mutex_destroy
lea rcx, [rbx + 0x68]
jmp 0x14001c600
mov rcx, rbx
call sym.push_pthread_mem.part.0
jmp 0x14001c624
mov rcx, rbp
call sym.pthread_mutex_unlock
mov eax, 0x24
jmp 0x14001c62e
call sym.replace_spin_keys.part.0
nop
nop dword [rax + rax]

Function at 0x14001f920
Capabilities:
Read file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov r9, qword [rcx + 0x40]
mov rsi, rdx
mov rbx, rcx
mov edx, 1
mov rcx, rsi
call sym.fread
mov edx, 0xffffffff
test rax, rax
jle 0x14001f94c
movzx edx, byte [rsi + rax - 1]
mov dword [rbx + 0x48], edx
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x140020570
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
cmp byte [0x1400cff10], 0
jne 0x140020673
mov byte [0x1400cff10], 1
call sym.__cxa_current_exception_type
test rax, rax
je 0x140020648
mov rbx, qword [rax + 8]
xor eax, eax
lea r9, [rsp + 0x2c]
cmp byte [rbx], 0x2a
mov dword [rsp + 0x2c], 0xffffffff
sete al
xor r8d, r8d
xor edx, edx
add rbx, rax
mov rcx, rbx
call sym.__cxa_demangle
mov ecx, 2
mov rsi, qword [sym.__acrt_iob_func]
mov rdi, rax
call rsi
mov edx, 1
lea rcx, str.terminate_called_after_throwing_an_instance_of_
mov r8d, 0x30
mov r9, rax
call sym.fwrite
mov edx, dword [rsp + 0x2c]
mov ecx, 2
test edx, edx
je 0x140020639
call rsi
mov rcx, rbx
mov rdx, rax
call sym.fputs
mov ecx, 2
call rsi
mov r8d, 2
mov edx, 1
lea rcx, [0x1400d03c1]
mov r9, rax
call sym.fwrite
mov eax, dword [rsp + 0x2c]
test eax, eax
jne 0x1400c9c47
jmp 0x1400c9c3f
call rsi
mov rcx, rdi
mov rdx, rax
call sym.fputs
jmp 0x140020607
mov ecx, 2
call qword [sym.__acrt_iob_func]
mov r8d, 0x2d
mov edx, 1
lea rcx, str.terminate_called_without_an_active_exception_n
mov r9, rax
call sym.fwrite
nop
jmp 0x1400c9c3a
mov ecx, 2
call qword [sym.__acrt_iob_func]
mov r8d, 0x1d
mov edx, 1
lea rcx, str.terminate_called_recursively_n
mov r9, rax
call sym.fwrite
call sym.abort
nop
nop
nop

Function at 0x140080260
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, qword [sym.imp.msvcrt.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
mov rcx, qword [rdi]
call sym.fileno
mov ecx, eax
mov r8d, ebx
mov rdx, rsi
call sym.read
movsxd rbp, eax
cmp eax, 0xffffffff
je 0x1400802a8
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call r12
cmp dword [rax], 4
je 0x14008027a
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x140092c00
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov rdi, rcx
test rax, rax
je 0x140092c28
mov rcx, qword [rcx]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov ebx, 4
lea rsi, [rsp + 0x2c]
nop dword [rax]
mov ecx, dword [rdi + 0x10]
mov r8d, ebx
mov rdx, rsi
call sym.read
test eax, eax
jle 0x140092c70
cdqe
add rsi, rax
sub rbx, rax
jne 0x140092c40
mov eax, dword [rsp + 0x2c]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp eax, 0xffffffff
jne 0x140092c7c
call rbp
cmp dword [rax], 4
je 0x140092c40
lea rcx, str.random_device_could_not_be_read
call method.std.__throw_runtime_error_char_const_
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x1400c98a0
Capabilities:
Query environment variable

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
xor edx, edx
lea rcx, [0x1400cd7c0]
movabs rdi, 0x2e78786362696c67
movabs r12, 0x6c6f6f705f68652e
call sym.pthread_mutex_init
pxor xmm0, xmm0
lea rcx, str.GLIBCXX_TUNABLES
mov qword [0x1400cd7d8], 0
movups xmmword [0x1400cd7c8], xmm0
call sym.getenv
mov dword [rsp + 0x40], 0
mov rbx, rax
lea rax, str.obj_size
mov qword [rsp + 0x30], 8
mov qword [rsp + 0x38], rax
lea rax, str.obj_count
mov qword [rsp + 0x48], 9
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], 0x100
test rbx, rbx
jne 0x1400c9955
jmp 0x1400c99ff
mov rcx, rbx
mov edx, 0x3a
call sym.strchr
mov rbx, rax
test rax, rax
je 0x1400c99b0
xor eax, eax
cmp byte [rbx], 0x3a
sete al
add rbx, rax
cmp qword [rbx], rdi
jne 0x1400c9940
cmp qword [rbx + 7], r12
jne 0x1400c9940
cmp byte [rbx + 0xf], 0x2e
jne 0x1400c9940
add rbx, 0x10
lea rbp, [rsp + 0x30]
lea r13, [rsp + 0x60]
mov rsi, qword [rbp]
mov rcx, qword [rbp + 8]
test rsi, rsi
je 0x1400c999b
mov r8, rsi
mov rdx, rbx
call sym.memcmp
test eax, eax
jne 0x1400c99a5
cmp byte [rbx + rsi], 0x3d
je 0x1400c9a35
add rbp, 0x18
cmp rbp, r13
jne 0x1400c997f
jmp 0x1400c9940
mov eax, dword [rsp + 0x58]
mov edx, 0x1000
mov ecx, 6
cmp eax, edx
cmovle edx, eax
mov eax, dword [rsp + 0x40]
test eax, eax
cmove eax, ecx
movsxd rbx, eax
movsxd rax, edx
add rbx, 0x26
imul rbx, rax
shl rbx, 3
mov qword [0x1400cd7d8], rbx
jne 0x1400c9a0f
lea rcx, [sym.__tcf_0]
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.atexit
mov qword [0x1400cd7d8], 0x16000
mov ebx, 0x16000
mov rcx, rbx
call sym.malloc
mov qword [0x1400cd7d0], rax
test rax, rax
je 0x1400c9a6c
xor edx, edx
mov qword [0x1400cd7c8], rax
mov qword [rax], rbx
mov qword [rax + 8], rdx
jmp 0x1400c99e7
lea rdx, [rsp + 0x28]
lea rcx, [rbx + rsi + 1]
xor r8d, r8d
call sym.strtoul
mov rbx, qword [rsp + 0x28]
movzx edx, byte [rbx]
cmp dl, 0x3a
je 0x1400c9a5c
test dl, dl
jne 0x1400c9940
test eax, eax
js 0x1400c9940
mov dword [rbp + 0x10], eax
jmp 0x1400c9940
xor ecx, ecx
mov qword [0x1400cd7d8], rcx
jmp 0x1400c99e7

Function at 0x1400c9bd0
Capabilities:
Write file on windows

Disassembly:
nop
mov rcx, rax
mov rax, rdx
sub rax, 1
jne 0x1400c9c4c
call sym.__cxa_begin_catch
mov rcx, rax
mov rax, qword [rax]
call qword [rax + 0x10]
mov ecx, 2
mov rbx, rax
call rsi
mov r9, rax
mov r8d, 0xb
mov edx, 1
lea rcx, str.__what__:
call sym.fwrite
mov ecx, 2
call rsi
mov rdx, rax
mov rcx, rbx
call sym.fputs
mov ecx, 2
call rsi
mov rdx, rax
mov ecx, 0xa
call sym.fputc
call sym.__cxa_end_catch
call sym.abort
mov rcx, rdi
call sym.free
call sym.__cxa_rethrow
call sym.__cxa_begin_catch
call sym.__cxa_end_catch
jmp 0x1400c9c3a
Function at 0x14005f650
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14005f65d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14005f66d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14005f655
lea eax, [rcx + 1]
jmp 0x14005f67b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14005f68e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14005f674
sub eax, 3
jb 0x14005f6ae
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14005f6fd
sar eax, 1
movsxd rbp, eax
jb 0x14005f6e4
jmp 0x14005f6bc
add ebx, ebx
jne 0x14005f6ba
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14005f6e4
inc ecx
add ebx, ebx
jne 0x14005f6ca
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14005f6e4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14005f6dd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14005f6cc
add ecx, 2
jmp 0x14005f6e9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.14005f612
jmp 0x14005f65d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x38200
mov dl, 0xe
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14005f74d
cmp rsi, rcx
jae 0x14005f755
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14005f734
cmp al, 0x8f
ja 0x14005f734
cmp byte [rsi - 2], 0xf
je 0x14005f73a
sub al, 0xe8
cmp al, 1
ja 0x14005f71e
cmp rsi, rcx
jae 0x14005f755
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14005f724
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14005f755
lodsb al, byte [rsi]
jmp 0x14005f734
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x5d000]
mov eax, dword [rdi]
or eax, eax
je 0x14005f7b2
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x5f000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14005f762
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14005f7ac
mov qword [rbx], rax
add rbx, 8
jmp 0x14005f782
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14005f7ec
cmp al, 0xef
ja 0x14005f7de
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14005f7be
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x14005f7cd
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1a7]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.14005f86b], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.14005f86b
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14005f85b
sub rsp, 0xffffffffffffff80
jmp 0x14002ab70
Function at 0x1400029f0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x140002a4d
lea rbx, [0x140055310]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140002a34
cmp r10, 2
jb 0x140002a34
cmp byte [r9], r8b
jne 0x140002a34
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140002a10
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x140002a8f
lea rbx, [0x140055310]
cmp r8b, 0x23
jne 0x140002a73
cmp byte [r9], r8b
jne 0x140002a73
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140002a60
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140002bd0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x140002bea
mov qword [r8], 0
lea rdx, [0x140054f74]
call fcn.140002aa0
mov rbx, rax
test rax, rax
jne 0x140002c0a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x140002ce3
xor edx, edx
mov r8d, 2
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140002ce3
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140002ce3
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140002ce3
cmp rdi, 0xffffffffffffffff
je 0x140002ce3
mov rax, qword [0x14008ab00]
test rax, rax
je 0x140002c80
inc dword [rax + 0xec]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x140002ce3
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x140002cd0
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x14008ab00]
test rax, rax
je 0x140002cc5
dec dword [rax + 0xec]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140002cec
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x140002cde
mov qword [r14], rdi
mov rax, rsi
jmp 0x140002cee
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret