joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140019c70
Capabilities:
Get thread local storage value
Hijack thread execution

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x4f8
mov rsi, rcx
test rcx, rcx
je 0x140019d60
lea rdi, [0x1400b9168]
mov rcx, rdi
call dbg.pthread_mutex_lock
mov rcx, rsi
call dbg.__pthread_get_pointer
mov rcx, rdi
mov rbx, rax
call dbg.pthread_mutex_unlock
test rbx, rbx
je 0x140019d60
mov rcx, qword [rbx + 0x28]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140019d60
lea rdi, [rsp + 0x20]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x140019d60
lea rbp, [rbx + 0x38]
mov rcx, rbp
call dbg.pthread_mutex_lock
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x1400b9178]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140019e70
movzx edx, byte [rbx + 0x40]
cmp rsi, qword [rax + 0x1d8]
je 0x140019d78
mov eax, dword [rbx + 0x44]
and eax, 3
cmp eax, 3
je 0x140019dd0
test dl, 3
jne 0x140019d50
and edx, 0xfffffffc
or edx, 1
mov byte [rbx + 0x40], dl
lock add dword [0x1400ebd88], 1
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140019d41
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rbp
call dbg.pthread_mutex_unlock
xor eax, eax
jmp 0x140019d65
mov rcx, rbp
call dbg.pthread_mutex_unlock
test byte [rbx + 0x40], 0xc
je 0x140019d49
nop
mov eax, 3
add rsp, 0x4f8
pop rbx
pop rsi
pop rdi
pop rbp
ret
test dl, 3
jne 0x140019d50
and edx, 0xfffffffc
or edx, 1
mov byte [rbx + 0x40], dl
lock add dword [0x1400ebd88], 1
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140019d9d
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [rbx + 0x44]
mov edx, eax
and edx, 3
cmp edx, 3
jne 0x140019d41
and eax, 0xfffffffe
mov rcx, rbp
mov dword [rbx + 0x44], eax
movzx eax, byte [rbx + 0x40]
and eax, 0xfffffff3
or eax, 4
mov byte [rbx + 0x40], al
call dbg.pthread_mutex_unlock
call dbg._pthread_invoke_cancel
nop word [rax + rax]
test dl, 0xc
jne 0x140019d50
and edx, 0xf
jne 0x140019d60
mov rcx, qword [rbx + 0x28]
mov dword [rsp + 0x50], 0x100001
call qword [sym.imp.KERNEL32.dll_SuspendThread]
xor edx, edx
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140019d41
mov rcx, qword [rbx + 0x28]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
lea rax, [dbg._pthread_invoke_cancel]
mov rcx, qword [rbx + 0x28]
mov rdx, rdi
mov qword [rsp + 0x118], rax
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
movzx eax, byte [rbx + 0x40]
and dword [rbx + 0x44], 0xfffffffe
and eax, 0xfffffff0
or eax, 5
mov byte [rbx + 0x40], al
lock add dword [0x1400ebd88], 1
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140019e58
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rbp
call dbg.pthread_mutex_unlock
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x140019d41
call sym.__pthread_self_lite.part.0
test rax, rax
jne 0x140019d00
movzx edx, byte [rbx + 0x40]
jmp 0x140019d0d
Function at 0x140019e90
Capabilities:
Get thread local storage value
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rdi, [0x1400b9168]
mov rbx, rcx
mov rcx, rdi
mov esi, edx
call dbg.pthread_mutex_lock
mov rcx, rbx
call dbg.__pthread_get_pointer
test rax, rax
je 0x140019f08
cmp qword [rax + 0x1d8], rbx
jne 0x140019f08
test byte [rax + 0x40], 0xc
jne 0x140019f08
mov edx, dword [rax + 0xbc]
test edx, edx
jne 0x140019f08
mov rax, qword [rax + 0x28]
sub rax, 1
cmp rax, 0xfffffffffffffffd
ja 0x140019f08
mov rcx, rdi
call dbg.pthread_mutex_unlock
test esi, esi
je 0x140019f20
lea edx, [rsi - 2]
cmp edx, 0x15
ja 0x140019f28
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp dbg.pthread_cancel
mov rcx, rdi
call dbg.pthread_mutex_unlock
mov eax, 3
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor eax, eax
jmp 0x140019f15
mov eax, 0x16
jmp 0x140019f15

Function at 0x14001a0c0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov esi, ecx
mov rdi, rdx
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x1400b9178]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x14001a130
cmp esi, 1
ja 0x14001a13d
lea rbp, [rbx + 0x38]
mov rcx, rbp
call dbg.pthread_mutex_lock
test rdi, rdi
je 0x14001a104
mov eax, dword [rbx + 0x44]
and eax, 1
mov dword [rdi], eax
mov eax, dword [rbx + 0x44]
mov rcx, qword [rbx + 0x1d8]
and eax, 0xfffffffe
or eax, esi
mov dword [rbx + 0x44], eax
call dbg.test_cancel_locked
mov rcx, rbp
call dbg.pthread_mutex_unlock
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
call sym.__pthread_self_lite.part.0
mov rbx, rax
test rax, rax
jne 0x14001a0e6
mov eax, 0x16
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x14001a150
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov esi, ecx
mov rdi, rdx
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x1400b9178]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x14001a1c8
mov ebp, esi
and ebp, 0xfffffffd
jne 0x14001a1d5
lea r12, [rbx + 0x38]
mov rcx, r12
call dbg.pthread_mutex_lock
test rdi, rdi
je 0x14001a198
mov eax, dword [rbx + 0x44]
and eax, 2
mov dword [rdi], eax
mov eax, dword [rbx + 0x44]
mov rcx, qword [rbx + 0x1d8]
and eax, 0xfffffffd
or eax, esi
mov dword [rbx + 0x44], eax
call dbg.test_cancel_locked
mov rcx, r12
call dbg.pthread_mutex_unlock
mov eax, ebp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call sym.__pthread_self_lite.part.0
mov rbx, rax
test rax, rax
jne 0x14001a178
mov ebp, 0x16
mov eax, ebp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x14001a480
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rsi, rcx
mov rbp, rdx
test rcx, rcx
je 0x14001a5a0
lea rdi, [0x1400b9168]
mov rcx, rdi
call dbg.pthread_mutex_lock
mov rcx, rsi
call dbg.__pthread_get_pointer
mov rcx, rdi
mov rbx, rax
call dbg.pthread_mutex_unlock
test rbx, rbx
je 0x14001a5a0
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x14001a5a0
lea rdx, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x14001a5a0
test byte [rbx + 0x44], 4
jne 0x14001a5b0
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x1400b9178]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14001a5d0
cmp rsi, qword [rax + 0x1d8]
je 0x14001a5f8
mov eax, dword [rbx + 0xbc]
mov rcx, qword [rbx + 0x28]
test eax, eax
je 0x14001a52b
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14001a53a
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x28]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14001a54e
call rsi
mov qword [rbx + 0x30], 0
lea rcx, [rbx + 0x38]
test rbp, rbp
je 0x14001a5e8
mov rax, qword [rbx + 8]
mov qword [rbp], rax
call dbg.pthread_mutex_destroy
lea rcx, [rbx + 0x68]
call dbg.pthread_spin_destroy
cmp eax, 1
je 0x14001a5ff
cmp qword [rbx + 0x1d0], 0
mov qword [rbx + 0x68], 0xffffffffffffffff
je 0x14001a5c0
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov eax, 3
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov eax, 0x16
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, rbx
call sym.push_pthread_mem.part.0
xor eax, eax
jmp 0x14001a596
call sym.__pthread_self_lite.part.0
test rax, rax
jne 0x14001a506
jmp 0x14001a513
call dbg.pthread_mutex_destroy
jmp 0x14001a570
mov eax, 0x24
jmp 0x14001a5a5
call sym.replace_spin_keys.part.0
nop
nop word cs:[rax + rax]
Function at 0x14001a610
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
lea rbp, [0x1400b9168]
mov rsi, rcx
mov rcx, rbp
mov rdi, rdx
call dbg.pthread_mutex_lock
mov rcx, rsi
call dbg.__pthread_get_pointer
mov rbx, rax
test rax, rax
je 0x14001a730
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x14001a730
lea rdx, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x14001a730
test byte [rbx + 0x44], 4
jne 0x14001a750
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x1400b9178]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14001a790
mov rdx, qword [rax + 0x1d8]
cmp rsi, rdx
je 0x14001a7c8
mov edx, dword [rbx + 0xbc]
mov rcx, qword [rbx + 0x28]
test edx, edx
jne 0x14001a6b7
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14001a770
mov rcx, qword [rbx + 0x28]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14001a6cb
call rsi
mov qword [rbx + 0x30], 0
lea rcx, [rbx + 0x38]
test rdi, rdi
je 0x14001a7a8
mov rax, qword [rbx + 8]
mov qword [rdi], rax
call dbg.pthread_mutex_destroy
lea rcx, [rbx + 0x68]
call dbg.pthread_spin_destroy
cmp eax, 1
je 0x14001a7da
cmp qword [rbx + 0x1d0], 0
mov qword [rbx + 0x68], 0xffffffffffffffff
je 0x14001a7b8
mov rcx, rbp
call dbg.pthread_mutex_unlock
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, rbp
call dbg.pthread_mutex_unlock
mov eax, 3
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, rbp
call dbg.pthread_mutex_unlock
mov eax, 0x16
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov eax, dword [rbx + 0xbc]
test eax, eax
jne 0x14001a6b3
mov rcx, rbp
call dbg.pthread_mutex_unlock
mov eax, 0x10
jmp 0x14001a71e
call sym.__pthread_self_lite.part.0
xor edx, edx
test rax, rax
jne 0x14001a685
jmp 0x14001a68c
call dbg.pthread_mutex_destroy
jmp 0x14001a6ec
mov rcx, rbx
call sym.push_pthread_mem.part.0
jmp 0x14001a714
mov rcx, rbp
call dbg.pthread_mutex_unlock
mov eax, 0x24
jmp 0x14001a71e
call sym.replace_spin_keys.part.0
nop

Function at 0x14001d830
Capabilities:
Read file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov r9, qword [rcx + 0x40]
mov rsi, rdx
mov rbx, rcx
mov edx, 1
mov rcx, rsi
call sym.fread
mov edx, 0xffffffff
test rax, rax
jle 0x14001d85c
movzx edx, byte [rsi + rax - 1]
mov dword [rbx + 0x48], edx
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x14001e480
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
cmp byte [0x1400bbef0], 0
jne 0x14001e583
mov byte [0x1400bbef0], 1
call dbg.__cxa_current_exception_type
test rax, rax
je 0x14001e558
mov rbx, qword [rax + 8]
xor eax, eax
lea r9, [rsp + 0x2c]
cmp byte [rbx], 0x2a
mov dword [rsp + 0x2c], 0xffffffff
sete al
xor r8d, r8d
xor edx, edx
add rbx, rax
mov rcx, rbx
call dbg.__cxa_demangle
mov ecx, 2
mov rsi, qword [dbg.__acrt_iob_func]
mov rdi, rax
call rsi
mov edx, 1
lea rcx, str.terminate_called_after_throwing_an_instance_of_
mov r8d, 0x30
mov r9, rax
call sym.fwrite
mov edx, dword [rsp + 0x2c]
mov ecx, 2
test edx, edx
je 0x14001e549
call rsi
mov rcx, rbx
mov rdx, rax
call sym.fputs
mov ecx, 2
call rsi
mov r8d, 2
mov edx, 1
lea rcx, [0x1400bc431]
mov r9, rax
call sym.fwrite
mov eax, dword [rsp + 0x2c]
test eax, eax
jne 0x1400b5d77
jmp 0x1400b5d6f
call rsi
mov rcx, rdi
mov rdx, rax
call sym.fputs
jmp 0x14001e517
mov ecx, 2
call qword [dbg.__acrt_iob_func]
mov r8d, 0x2d
mov edx, 1
lea rcx, str.terminate_called_without_an_active_exception_n
mov r9, rax
call sym.fwrite
nop
jmp 0x1400b5d6a
mov ecx, 2
call qword [dbg.__acrt_iob_func]
mov r8d, 0x1d
mov edx, 1
lea rcx, str.terminate_called_recursively_n
mov r9, rax
call sym.fwrite
call sym.abort
nop
nop
nop

Function at 0x14007d0b0
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, qword [sym.imp.msvcrt.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
mov rcx, qword [rdi]
call sym.fileno
mov ecx, eax
mov r8d, ebx
mov rdx, rsi
call sym.read
movsxd rbp, eax
cmp eax, 0xffffffff
je 0x14007d0f8
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call r12
cmp dword [rax], 4
je 0x14007d0ca
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x14008fa20
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov rdi, rcx
test rax, rax
je 0x14008fa48
mov rcx, qword [rcx]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov ebx, 4
lea rsi, [rsp + 0x2c]
nop dword [rax]
mov ecx, dword [rdi + 0x10]
mov r8d, ebx
mov rdx, rsi
call sym.read
test eax, eax
jle 0x14008fa90
cdqe
add rsi, rax
sub rbx, rax
jne 0x14008fa60
mov eax, dword [rsp + 0x2c]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp eax, 0xffffffff
jne 0x14008fa9c
call rbp
cmp dword [rax], 4
je 0x14008fa60
lea rcx, str.random_device_could_not_be_read
call dbg.std::__throw_runtime_error(char const*)
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x1400b5d00
Capabilities:
Write file on windows

Disassembly:
nop
mov rcx, rax
mov rax, rdx
sub rax, 1
jne 0x1400b5d7c
call dbg.__cxa_begin_catch
mov rcx, rax
mov rax, qword [rax]
call qword [rax + 0x10]
mov ecx, 2
mov rbx, rax
call rsi
mov r9, rax
mov r8d, 0xb
mov edx, 1
lea rcx, str.__what__:
call sym.fwrite
mov ecx, 2
call rsi
mov rdx, rax
mov rcx, rbx
call sym.fputs
mov ecx, 2
call rsi
mov rdx, rax
mov ecx, 0xa
call sym.fputc
call dbg.__cxa_end_catch
call sym.abort
mov rcx, rdi
call sym.free
call dbg.__cxa_rethrow
call dbg.__cxa_begin_catch
call dbg.__cxa_end_catch
jmp 0x1400b5d6a

Function at 0x1400b7460
Capabilities:
Query environment variable

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
xor edx, edx
lea rcx, [0x1400b97a0]
movabs rdi, 0x2e78786362696c67
movabs r12, 0x6c6f6f705f68652e
call dbg.pthread_mutex_init
pxor xmm0, xmm0
lea rcx, str.GLIBCXX_TUNABLES
mov qword [0x1400b97b8], 0
movups xmmword [0x1400b97a8], xmm0
call sym.getenv
mov dword [rsp + 0x40], 0
mov rbx, rax
lea rax, str.obj_size
mov qword [rsp + 0x30], 8
mov qword [rsp + 0x38], rax
lea rax, str.obj_count
mov qword [rsp + 0x48], 9
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], 0x100
test rbx, rbx
jne 0x1400b7515
jmp 0x1400b75bf
mov rcx, rbx
mov edx, 0x3a
call sym.strchr
mov rbx, rax
test rax, rax
je 0x1400b7570
xor eax, eax
cmp byte [rbx], 0x3a
sete al
add rbx, rax
cmp qword [rbx], rdi
jne 0x1400b7500
cmp qword [rbx + 7], r12
jne 0x1400b7500
cmp byte [rbx + 0xf], 0x2e
jne 0x1400b7500
add rbx, 0x10
lea rbp, [rsp + 0x30]
lea r13, [rsp + 0x60]
mov rsi, qword [rbp]
mov rcx, qword [rbp + 8]
test rsi, rsi
je 0x1400b755b
mov r8, rsi
mov rdx, rbx
call sym.memcmp
test eax, eax
jne 0x1400b7565
cmp byte [rbx + rsi], 0x3d
je 0x1400b75f5
add rbp, 0x18
cmp rbp, r13
jne 0x1400b753f
jmp 0x1400b7500
mov eax, dword [rsp + 0x58]
mov edx, 0x1000
mov ecx, 6
cmp eax, edx
cmovle edx, eax
mov eax, dword [rsp + 0x40]
test eax, eax
cmove eax, ecx
movsxd rbx, eax
movsxd rax, edx
add rbx, 0x26
imul rbx, rax
shl rbx, 3
mov qword [0x1400b97b8], rbx
jne 0x1400b75cf
lea rcx, [sym.__tcf_0_3]
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp dbg.atexit
mov qword [0x1400b97b8], 0x16000
mov ebx, 0x16000
mov rcx, rbx
call sym.malloc
mov qword [0x1400b97b0], rax
test rax, rax
je 0x1400b762c
xor edx, edx
mov qword [0x1400b97a8], rax
mov qword [rax], rbx
mov qword [rax + 8], rdx
jmp 0x1400b75a7
lea rdx, [rsp + 0x28]
lea rcx, [rbx + rsi + 1]
xor r8d, r8d
call sym.strtoul
mov rbx, qword [rsp + 0x28]
movzx edx, byte [rbx]
cmp dl, 0x3a
je 0x1400b761c
test dl, dl
jne 0x1400b7500
test eax, eax
js 0x1400b7500
mov dword [rbp + 0x10], eax
jmp 0x1400b7500
xor ecx, ecx
mov qword [0x1400b97b8], rcx
jmp 0x1400b75a7
Function at 0x1400b8280
Capabilities:
Enumerate process modules

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x90
xor esi, esi
call dbg.__main
call dbg.__p__acmdln
mov rbx, qword [rax]
test rbx, rbx
jne 0x1400b82cb
jmp 0x1400b8341
test cl, cl
je 0x1400b82f8
and esi, 1
je 0x1400b82e0
mov esi, 1
call sym._ismbblead
test eax, eax
je 0x1400b82c7
cmp byte [rbx + 1], 1
sbb rbx, 0xffffffffffffffff
add rbx, 1
movsx ecx, byte [rbx]
cmp cl, 0x20
jle 0x1400b82a8
mov eax, esi
xor eax, 1
cmp cl, 0x22
cmove esi, eax
jmp 0x1400b82b6
test cl, cl
je 0x1400b82f8
nop dword [rax]
movzx eax, byte [rbx + 1]
add rbx, 1
test al, al
je 0x1400b82f8
cmp al, 0x20
jle 0x1400b82e8
lea rdx, [rsp + 0x20]
xor eax, eax
mov ecx, 0xd
mov rdi, rdx
rep stosq qword [rdi], rax
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov r9d, 0xa
test byte [rsp + 0x5c], 1
je 0x1400b8326
movzx r9d, word [rsp + 0x60]
mov rcx, qword [0x1400c2750]
mov r8, rbx
xor edx, edx
add rsp, 0x90
pop rbx
pop rsi
pop rdi
jmp sym.WinMain
lea rbx, [0x1400c0f70]
jmp 0x1400b82f8
Function at 0x140001000
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ecx, 0x22
mov dword [rbp - 0x30], 0x610030
mov dword [rbp - 0x2c], 0x600077
mov dword [rbp - 0x28], 0x73007b
mov dword [rbp - 0x24], 0x30007e
lea ebx, [rcx - 0x10]
mov dword [rbp - 0x20], 0x300028
mov word [rbp - 0x10], bx
mov dword [rbp - 0x1c], 0x220037
mov dword [rbp - 0x18], 0x4a002a
mov dword [rbp - 0x14], 0x3e0030
call fcn.140002534
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 1]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140001064
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x140001084
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov ebx, 0x12
mov dword [rbp - 0x39], 0x66007a
mov dword [rbp - 0x35], 0x620066
mov dword [rbp - 0x31], 0x280061
mov dword [rbp - 0x2d], 0x3d003d
lea ecx, [rbx + 0x52]
mov dword [rbp - 0x29], 0x7d0074
mov dword [rbp - 0x25], 0x79007e
mov dword [rbp - 0x21], 0x77007f
mov dword [rbp - 0x1d], 0x7b0076
mov dword [rbp - 0x19], 0x780073
mov dword [rbp - 0x15], 0x67007d
mov dword [rbp - 0x11], 0x7c0060
mov dword [rbp - 0xd], 0x7e0073
mov dword [rbp - 9], 0x71003c
mov dword [rbp - 5], 0x7f007d
mov dword [rbp - 1], 0x73003d
mov dword [rbp + 3], 0x73007c
mov dword [rbp + 7], 0x6b007e
mov dword [rbp + 0xb], 0x7b0066
mov dword [rbp + 0xf], 0x610071
mov dword [rbp + 0x13], 0x61003d
mov dword [rbp + 0x17], 0x600071
mov dword [rbp + 0x1b], 0x62007b
mov dword [rbp + 0x1f], 0x3c0066
mov dword [rbp + 0x23], 0x7a0062
mov dword [rbp + 0x27], 0x120062
call fcn.140002534
lea r9, [rbp - 0x39]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 0x20]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140001171
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1400011a8
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov ecx, 0x62
mov dword [rbp - 0x29], 0x66007a
mov dword [rbp - 0x25], 0x620066
mov dword [rbp - 0x21], 0x280061
mov dword [rbp - 0x1d], 0x3d003d
lea ebx, [rcx - 0x50]
mov dword [rbp - 0x19], 0x7e0073
mov word [rbp + 0x37], bx
mov dword [rbp - 0x15], 0x66007e
mov dword [rbp - 0x11], 0x710077
mov dword [rbp - 0xd], 0x7a007a
mov dword [rbp - 9], 0x7e0073
mov dword [rbp - 5], 0x7c0074
mov dword [rbp - 1], 0x650077
mov dword [rbp + 3], 0x3c0061
mov dword [rbp + 7], 0x7d0071
mov dword [rbp + 0xb], 0x3d007f
mov dword [rbp + 0xf], 0x7c0073
mov dword [rbp + 0x13], 0x7e0073
mov dword [rbp + 0x17], 0x66006b
mov dword [rbp + 0x1b], 0x71007b
mov dword [rbp + 0x1f], 0x3d0061
mov dword [rbp + 0x23], 0x710061
mov dword [rbp + 0x27], 0x7b0060
mov dword [rbp + 0x2b], 0x660062
mov dword [rbp + 0x2f], 0x62003c
mov dword [rbp + 0x33], 0x62007a
call fcn.140002534
lea r9, [rbp - 0x29]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 0x1f]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000128e
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x1400012c0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov ebx, 0x12
mov dword [rbp - 0x50], 0x730030
mov dword [rbp - 0x4c], 0x620062
mov dword [rbp - 0x48], 0x730076
mov dword [rbp - 0x44], 0x730066
lea ecx, [rbx + 0x36]
mov dword [rbp - 0x40], 0x71004d
mov dword [rbp - 0x3c], 0x770060
mov dword [rbp - 0x38], 0x660073
mov dword [rbp - 0x34], 0x7d007b
mov dword [rbp - 0x30], 0x4d007c
mov dword [rbp - 0x2c], 0x7b0066
mov dword [rbp - 0x28], 0x77007f
mov dword [rbp - 0x24], 0x280030
mov dword [rbp - 0x20], 0x370030
mov dword [rbp - 0x1c], 0x2a0022
mov dword [rbp - 0x18], 0x37004a
mov dword [rbp - 0x14], 0x2a0022
mov dword [rbp - 0x10], 0x30004a
mov dword [rbp - 0xc], 0x12003e
call fcn.140002534
lea r9, [rbp - 0x50]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 0x12]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140001366
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x14000138c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x12
mov dword [rbp - 0x30], 0x610030
mov dword [rbp - 0x2c], 0x7b0079
mov dword [rbp - 0x28], 0x4d0062
mov dword [rbp - 0x24], 0x7b0061
lea ecx, [rbx + 0x14]
mov dword [rbp - 0x20], 0x7c0075
mov dword [rbp - 0x1c], 0x660073
mov dword [rbp - 0x18], 0x600067
mov dword [rbp - 0x14], 0x300077
mov dword [rbp - 0x10], 0x300028
mov word [rbp - 0xc], bx
call fcn.140002534
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 1]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400013f7
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret