joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140015cb4
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov ebp, edx
lea r9, [rsp + 0x58]
xor edx, edx
mov rsi, r8
mov r14, rcx
xor r8d, r8d
lea ecx, [rdx + 0x62]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ebx, eax
cmp eax, 0xc0000023
je 0x140015cf3
test eax, eax
js 0x140015d6d
jmp 0x140015d81
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8d, dword [rsp + 0x58]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdi, rax
test rax, rax
je 0x140015d81
mov r8d, dword [rsp + 0x58]
lea r9, [rsp + 0x58]
mov rdx, rax
mov ecx, 0x62
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ebx, eax
test eax, eax
js 0x140015d55
movzx ecx, word [rdi]
add ecx, 2
mov dword [rsi], ecx
cmp ecx, ebp
jbe 0x140015d46
mov ebx, 0xc0000023
jmp 0x140015d55
mov rdx, qword [rdi + 8]
mov r8d, ecx
mov rcx, r14
call sub.msvcrt.dll_memcpy
mov rcx, qword gs:[0x60]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov ecx, 0x80000000
lea eax, [rbx + rcx]
test ecx, eax
jne 0x140015d91
cmp ebx, 0xc0000023
je 0x140015d91
mov r9, rsi
mov r8d, ebp
mov rdx, r14
call fcn.140015eb0
mov ebx, eax
mov rbp, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x140015dac
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x14003f008]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov ebx, 1
lea rdx, [rsp + 0x20]
xor r9d, r9d
lea r8d, [rbx + 0x1f]
lea ecx, [rbx + 0x59]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x140015deb
xor ebx, ebx
cmp dword [rsp + 0x30], 3
cmovl ebx, dword [rsp + 0x30]
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140027ea0
add rsp, 0x50
pop rbx
ret

Function at 0x140016028
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x14003f008]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor ebx, ebx
cmp dword [0x14003f688], ebx
jne 0x140016091
lea rdx, [rsp + 0x20]
lea rcx, str.ZwFilterBootOption
call fcn.140012960
test eax, eax
js 0x140016086
lea r8d, [rbx + 0x18]
xor r9d, r9d
lea ecx, [r8 + 0x77]
lea rdx, [rsp + 0x28]
call qword [sym.imp.ntdll.dll_ZwQuerySystemInformation]
test eax, eax
js 0x140016086
mov rcx, qword [rsp + 0x20]
xor eax, eax
lock cmpxchg qword [0x14003f680], rcx
mov ecx, 1
xchg dword [0x14003f688], ecx
cmp qword [0x14003f680], rbx
setne al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140027ea0
add rsp, 0x50
pop rbx
ret
Function at 0x1400160b4
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0xf0
mov rax, qword [0x14003f008]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xor ebp, ebp
lea rax, [rsp + 0x38]
mov r14, rdx
mov qword [rsp + 0x30], rbp
mov r9d, 0xa0
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x40]
mov dword [rsp + 0x38], r9d
lea edx, [rbp + 3]
mov edi, ebp
mov sil, bpl
call qword [sym.imp.ntdll.dll_ZwQueryKey]
mov ebx, eax
test eax, eax
jns 0x14001611e
cmp eax, 0xc0000023
jne 0x140016157
mov ebx, ebp
jmp 0x140016157
cmp dword [rsp + 0x40], 0x4c
jb 0x140016157
lea r9, [rsp + 0x30]
mov word [rsp + 0x7e], bp
mov r8d, 0x20019
lea rdx, [rsp + 0x44]
xor ecx, ecx
call fcn.140011728
mov rdi, qword [rsp + 0x30]
mov ebx, eax
test eax, eax
js 0x14001615e
mov rcx, rdi
call fcn.14000c3e8
mov sil, al
test ebx, ebx
js 0x14001615e
mov byte [r14], sil
test rdi, rdi
je 0x14001616b
mov rcx, rdi
call fcn.140011308
mov eax, ebx
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.140027ea0
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x14001855c
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
movzx eax, byte [rcx + 3]
xor edi, edi
shl eax, 8
mov r12, rdx
movsxd r9, eax
mov r15, r8
movzx eax, byte [rcx + 2]
mov r8b, 0x7f
or r9, rax
mov rbx, rcx
add r9, rcx
mov esi, edi
mov dl, byte [r9]
mov al, dl
and al, r8b
cmp al, r8b
je 0x1400186a5
cmp dl, 4
jne 0x1400185d2
cmp byte [r9 + 1], dl
jne 0x1400185d2
movzx ecx, byte [r9 + 3]
movzx eax, byte [r9 + 2]
shl ecx, 8
or ecx, eax
cmp ecx, 4
jb 0x14001862a
lea eax, [rcx - 4]
add esi, eax
movzx eax, byte [r9 + 3]
shl eax, 8
movsxd rcx, eax
movzx eax, byte [r9 + 2]
or rcx, rax
add r9, rcx
mov dl, byte [r9]
mov al, dl
and al, r8b
cmp al, r8b
jne 0x1400185ae
test esi, esi
je 0x1400186a5
mov rcx, qword gs:[0x60]
add esi, 2
mov r8d, esi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbp, rax
test rax, rax
jne 0x140018631
mov eax, 0xc000009a
jmp 0x1400186aa
mov eax, 0xc0000095
jmp 0x1400186aa
mov r14, rax
movzx eax, byte [rbx + 3]
shl eax, 8
movsxd rdi, eax
movzx eax, byte [rbx + 2]
or rdi, rax
add rdi, rbx
jmp 0x14001868c
cmp cl, 4
jne 0x140018678
cmp byte [rdi + 1], cl
jne 0x140018678
movzx ecx, byte [rdi + 3]
lea rdx, [rdi + 4]
movzx eax, byte [rdi + 2]
shl ecx, 8
or ecx, eax
sub ecx, 4
mov ebx, ecx
mov r8d, ecx
mov rcx, r14
call sub.msvcrt.dll_memcpy
add r14, rbx
movzx eax, byte [rdi + 3]
shl eax, 8
movsxd rcx, eax
movzx eax, byte [rdi + 2]
or rcx, rax
add rdi, rcx
mov cl, byte [rdi]
mov al, cl
and al, 0x7f
cmp al, 0x7f
jne 0x14001864a
xor eax, eax
mov qword [r12], rbp
mov word [r14], ax
mov dword [r15], esi
jmp 0x1400186aa
mov eax, 0xc0000225
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x140019e3c
Capabilities:
Query or enumerate registry value

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
mov r14, qword [rbp + 0x50]
lea rcx, [rbp - 0x10]
mov rsi, qword [rbp + 0x58]
xor edi, edi
and qword [rbp + 0x40], rdi
mov rbx, r8
and qword [r14], rdi
and dword [rsi], edi
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
test rbx, rbx
je 0x140019e97
lea r9, [rbp + 0x40]
mov r8d, 0x20019
mov rdx, rbx
xor ecx, ecx
call fcn.140019b80
mov ebx, eax
test eax, eax
jns 0x140019e9b
jmp 0x140019f7a
and qword [rbp + 0x40], rdi
mov rcx, qword [rbp + 0x40]
lea rax, [rbp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], edi
lea rdx, [rbp - 0x10]
lea r8d, [r9 + 2]
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
mov ebx, eax
cmp eax, 0xc0000023
je 0x140019ed8
test eax, eax
js 0x140019f7a
mov ebx, 0xc0000001
jmp 0x140019f7a
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8d, dword [rbp + 0x48]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdi, rax
test rax, rax
jne 0x140019f00
mov ebx, 0xc000009a
jmp 0x140019f7a
mov rcx, qword [rbp + 0x40]
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, [rbp - 0x10]
mov eax, dword [rbp + 0x48]
mov r9, rdi
mov r8d, 2
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
mov ebx, eax
test eax, eax
js 0x140019f7a
cmp dword [rdi + 4], 1
je 0x140019f3a
mov ebx, 0xc0000024
jmp 0x140019f7a
mov eax, dword [rbp + 0x48]
xor edx, edx
add eax, 0xfffffff4
mov dword [rbp + 0x48], eax
mov rcx, qword gs:[0x60]
mov r8d, eax
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov qword [r14], rax
test rax, rax
je 0x140019ef9
mov r8d, dword [rbp + 0x48]
lea rdx, [rdi + 0xc]
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov eax, dword [rbp + 0x48]
xor ebx, ebx
mov dword [rsi], eax
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x140019f89
call qword [sym.imp.ntdll.dll_NtClose]
test rdi, rdi
je 0x140019fa6
mov rcx, qword gs:[0x60]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, ebx
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140019fbc
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
mov rsi, rdx
xor r14d, r14d
mov rdx, rcx
mov qword [rbp + 0x38], r14
lea rcx, [rbp - 0x40]
mov qword [rbp - 0x48], r14
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rbp - 0x40]
mov dword [rbp - 0x30], 0x30
xorps xmm0, xmm0
mov qword [rbp - 0x20], rax
lea r8, [rbp - 0x30]
mov qword [rbp - 0x28], r14
lea edx, [r14 + 1]
mov dword [rbp - 0x18], 0x40
lea rcx, [rbp + 0x38]
movdqu xmmword [rbp - 0x10], xmm0
call qword [sym.imp.ntdll.dll_NtOpenSymbolicLinkObject]
test eax, eax
js 0x14001a14a
xor edx, edx
lea rcx, [rbp - 0x50]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov edi, r14d
mov dword [rbp + 0x30], r14d
jmp 0x14001a08b
cmp qword [rbp - 0x48], r14
je 0x14001a05c
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rbp - 0x48]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword [rbp + 0x30]
xor edx, edx
mov word [rbp - 0x4e], ax
mov rcx, qword gs:[0x60]
lea edi, [rax + 2]
mov r8d, edi
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov qword [rbp - 0x48], rax
test rax, rax
je 0x14001a15f
mov rcx, qword [rbp + 0x38]
lea r8, [rbp + 0x30]
lea rdx, [rbp - 0x50]
call qword [sym.imp.ntdll.dll_NtQuerySymbolicLinkObject]
mov ebx, eax
cmp eax, 0xc0000023
je 0x14001a03d
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.ntdll.dll_NtClose]
mov rax, qword [rbp - 0x48]
mov qword [rbp + 0x38], r14
test ebx, ebx
js 0x14001a12a
movzx ecx, word [rbp - 0x50]
lea r8, [rbp - 0x30]
shr rcx, 1
xorps xmm0, xmm0
mov edx, 1
mov word [rax + rcx*2], r14w
lea rax, [rbp - 0x50]
lea rcx, [rbp + 0x38]
mov qword [rbp - 0x20], rax
mov word [rbp - 0x4e], di
mov dword [rbp - 0x30], 0x30
mov qword [rbp - 0x28], r14
mov dword [rbp - 0x18], 0x40
movdqu xmmword [rbp - 0x10], xmm0
call qword [sym.imp.ntdll.dll_NtOpenSymbolicLinkObject]
test eax, eax
jns 0x14001a08b
mov rax, qword [rbp - 0x48]
mov ebx, r14d
mov qword [rsi], rax
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x14001a126
call qword [sym.imp.ntdll.dll_NtClose]
mov rax, qword [rbp - 0x48]
mov qword [rbp + 0x38], r14
test ebx, ebx
jns 0x14001a148
test rax, rax
je 0x14001a148
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rbp - 0x48]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, ebx
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
mov ebx, 0xc000009a
jmp 0x14001a10f
Function at 0x14001afa4
Capabilities:
Delete registry key
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
xor r15d, r15d
lea rdx, str.RegistryMachineSYSTEMCurrentControlSetControlSyspart
mov r14, rcx
mov dword [rbp + 0x6f], r15d
lea rcx, [rbp - 0x19]
mov qword [rbp + 0x77], r15
mov esi, r15d
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rbp - 0x19]
mov dword [rbp + 7], 0x30
xorps xmm0, xmm0
mov qword [rbp + 0x17], rax
movdqu xmmword [rbp + 0x27], xmm0
mov qword [rbp + 0xf], r15
mov dword [rbp + 0x1f], 0x40
call fcn.14001b11c
mov ebx, eax
test eax, eax
js 0x14001b0c5
lea rax, [rbp + 0x6f]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea r8, [rbp + 7]
mov dword [rsp + 0x28], 1
lea rcx, [rbp + 0x77]
mov edx, 0xf003f
mov qword [rsp + 0x20], r15
call qword [sym.imp.ntdll.dll_NtCreateKey]
mov ebx, eax
test eax, eax
js 0x14001b0c5
or rax, 0xffffffffffffffff
inc rax
cmp word [r14 + rax*2], r15w
jne 0x14001b049
mov rdi, qword [rbp + 0x77]
lea rdx, str.SystemPartition
lea rcx, [rbp - 9]
lea ebx, [rax*2 + 2]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov r9d, 1
mov dword [rsp + 0x28], ebx
xor r8d, r8d
mov qword [rsp + 0x20], r14
lea rdx, [rbp - 9]
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtSetValueKey]
mov ebx, eax
test eax, eax
js 0x14001b0c5
mov ecx, 0x60019
call fcn.140019658
mov rsi, rax
test rax, rax
jne 0x14001b0ad
mov ebx, 0xc0000001
jmp 0x14001b0c5
mov rcx, qword [rbp + 0x77]
mov r8, rax
mov edx, 4
call qword [sym.imp.ntdll.dll_NtSetSecurityObject]
mov ebx, eax
test eax, eax
jns 0x14001b0cf
mov rcx, qword [rbp + 0x77]
call qword [sym.imp.ntdll.dll_NtDeleteKey]
mov rcx, qword [rbp + 0x77]
test rcx, rcx
je 0x14001b0de
call qword [sym.imp.ntdll.dll_NtClose]
test rsi, rsi
je 0x14001b0fb
mov rcx, qword gs:[0x60]
mov r8, rsi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, ebx
mov rbx, qword [rsp + 0xc0]
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001b11c
Capabilities:
Delete registry key

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x20
and qword [rax + 8], 0
lea r9, [rax + 8]
mov r8d, 0x60019
lea rdx, str.RegistryMachineSYSTEMCurrentControlSetControlSyspart
xor ecx, ecx
xor esi, esi
call fcn.140019b80
mov edi, eax
test eax, eax
jns 0x14001b19c
cmp eax, 0xc0000034
jne 0x14001b15a
xor edi, edi
mov rbx, qword [rsp + 0x30]
test rbx, rbx
je 0x14001b16d
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtClose]
test rsi, rsi
je 0x14001b18a
mov rcx, qword gs:[0x60]
mov r8, rsi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rbx, qword [rsp + 0x38]
mov eax, edi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov ecx, 0xf003f
call fcn.140019658
mov rbx, qword [rsp + 0x30]
mov rsi, rax
test rax, rax
jne 0x14001b1ba
mov edi, 0xc0000001
jmp 0x14001b15f
mov r8, rax
mov edx, 4
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtSetSecurityObject]
mov edi, eax
test eax, eax
js 0x14001b15f
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtClose]
and qword [rsp + 0x30], 0
lea r9, [rsp + 0x30]
mov r8d, 0xf003f
lea rdx, str.RegistryMachineSYSTEMCurrentControlSetControlSyspart
xor ecx, ecx
call fcn.140019b80
mov edi, eax
test eax, eax
js 0x14001b15a
mov rbx, qword [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtDeleteKey]
mov edi, eax
jmp 0x14001b15f
Function at 0x14001bb30
Capabilities:
Get file size
Read file on windows

Disassembly:
mov r9, rdx
xor edx, edx
lea r8d, [rdx + 1]
jmp sym.bcdedit.exe_OROpenHiveInternal

Function at 0x14001bb50
Capabilities:
Get file size
Read file on windows

Disassembly:
mov r9, rdx
mov r8d, 1
mov rdx, rcx
xor ecx, ecx
jmp sym.bcdedit.exe_OROpenHiveInternal

Function at 0x14001be10
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 8], rbp
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
xor esi, esi
xor r14b, r14b
mov eax, 0x746e
cmp word [rcx + 0x1c], ax
jne 0x14001bef6
mov rsi, qword [rcx + 0x10]
test rsi, rsi
je 0x14001bef6
cmp dword [rsi], 0xbee0bee0
jne 0x14001bef6
lea rcx, [rsi + 0x88]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp qword [rsi + 0x80], 0
mov r14b, 1
je 0x14001bef6
cmp dword [rsi + 0xb4], 0
jne 0x14001be7d
xor edi, edi
jmp 0x14001befb
mov rcx, rsi
call fcn.14001e834
mov edi, eax
test eax, eax
jne 0x14001befb
mov rbp, qword [rsi + 0x80]
xor r9d, r9d
mov rcx, rbp
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x14001beb1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x14001bec0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x14001bea7
xor edi, edi
test edi, edi
jne 0x14001befb
mov rdx, rbp
mov rcx, rsi
call fcn.14001f5d4
mov edi, eax
test eax, eax
jne 0x14001befb
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
jne 0x14001beea
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jne 0x14001befb
and dword [rsi + 0xb4], edi
jmp 0x14001be79
mov edi, 6
lea rdx, [rsi + 0x50]
mov rcx, rsi
call fcn.14001f544
test r14b, r14b
je 0x14001bf19
lea rcx, [rsi + 0x88]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbp, qword [rsp + 0x30]
mov eax, edi
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret
Function at 0x14001da80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov eax, 0x746e
mov r15, r9
mov rbx, rcx
cmp word [rcx + 0x1c], ax
jne 0x14001dc60
mov rcx, qword [rcx + 0x10]
cmp dword [rcx], 0xbee0bee0
jne 0x14001dc60
xor r9d, r9d
test r15, r15
je 0x14001dace
mov dword [r15], r9d
mov r14, qword [rsp + 0x90]
test r14, r14
je 0x14001dade
mov dword [r14], r9d
mov rbp, qword [rsp + 0x98]
test rbp, rbp
je 0x14001daef
mov dword [rbp], r9d
mov r12, qword [rsp + 0xa0]
test r12, r12
je 0x14001db00
mov dword [r12], r9d
mov r13, qword [rsp + 0xa8]
test r13, r13
je 0x14001db11
mov dword [r13], r9d
mov rdi, qword [rsp + 0xb0]
test rdi, rdi
je 0x14001db21
mov dword [rdi], r9d
mov rax, qword [rsp + 0xb8]
test rax, rax
je 0x14001db31
mov dword [rax], r9d
test rdx, rdx
jne 0x14001db3e
test r8, r8
je 0x14001db3e
mov dword [r8], r9d
mov rsi, qword [rsp + 0xc0]
test rsi, rsi
je 0x14001db4e
mov qword [rsi], r9
lea rax, [rcx + 0x88]
mov rcx, rax
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor r8d, r8d
cmp word [rbx + 0x1e], r8w
je 0x14001db77
mov edi, 0x3fa
jmp 0x14001dc53
mov r9, qword [rsp + 0x78]
test r9, r9
je 0x14001dbb7
mov rax, qword [rbx + 0x28]
xor ecx, ecx
mov rdx, qword [rbx + 0x60]
movzx r8d, word [rax + 0x4a]
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
call fcn.14001fd34
xor r8d, r8d
mov edi, eax
test eax, eax
jne 0x14001dc53
mov rdi, qword [rsp + 0xb0]
test r15, r15
je 0x14001dbc6
mov rax, qword [rbx + 0x28]
mov ecx, dword [rax + 0x14]
mov dword [r15], ecx
test r14, r14
je 0x14001dbdd
mov rax, qword [rbx + 0x28]
mov ecx, dword [rax + 0x34]
shr ecx, 1
and ecx, 0x7fff
mov dword [r14], ecx
test rbp, rbp
je 0x14001dbee
mov rax, qword [rbx + 0x28]
mov ecx, dword [rax + 0x38]
shr ecx, 1
mov dword [rbp], ecx
test r12, r12
je 0x14001dbfe
mov rax, qword [rbx + 0x28]
mov ecx, dword [rax + 0x24]
mov dword [r12], ecx
test r13, r13
je 0x14001dc10
mov rax, qword [rbx + 0x28]
mov ecx, dword [rax + 0x3c]
shr ecx, 1
mov dword [r13], ecx
test rdi, rdi
je 0x14001dc1e
mov rax, qword [rbx + 0x28]
mov ecx, dword [rax + 0x40]
mov dword [rdi], ecx
mov rdx, qword [rsp + 0xb8]
test rdx, rdx
je 0x14001dc38
mov rax, qword [rbx + 0x48]
mov rcx, qword [rax + 0x10]
mov eax, dword [rcx + 0x10]
mov dword [rdx], eax
test rsi, rsi
je 0x14001dc50
mov rax, qword [rbx + 0x28]
mov edx, dword [rax + 4]
mov dword [rsi], edx
mov rax, qword [rbx + 0x28]
mov edx, dword [rax + 8]
mov dword [rsi + 4], edx
mov edi, r8d
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x14001dc65
mov edi, 6
mov eax, edi
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001f5d4
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
xor ebx, ebx
mov r13, rdx
mov dword [rax + 8], ebx
mov rsi, rcx
mov r12d, ebx
mov r15b, bl
mov r14d, ebx
test rcx, rcx
jne 0x14001f611
lea edi, [rcx + 0x57]
jmp 0x14001f6f9
mov rdx, qword [rcx + 0x10]
mov r9d, 1
test rdx, rdx
je 0x14001f669
add rcx, 0x50
mov r8d, ebx
mov rax, qword [rcx]
jmp 0x14001f633
add r8d, dword [rax + 0x14]
mov rax, qword [rax]
cmp rax, rcx
jne 0x14001f62c
mov dword [rdx + 0x28], r8d
mov eax, ebx
mov r8d, 0x7f
mov rcx, rdx
xor eax, dword [rcx]
lea rcx, [rcx + 4]
sub r8, r9
jne 0x14001f647
cmp eax, 0xffffffff
mov ecx, 0xfffffffe
cmove eax, ecx
test eax, eax
cmove eax, r9d
mov dword [rdx + 0x1fc], eax
mov rcx, qword [rsi + 0x10]
mov edx, 0x1000
mov eax, dword [rcx + 0x28]
add eax, edx
je 0x14001f6dc
test r15b, r15b
jne 0x14001f682
mov ebp, edx
jmp 0x14001f68a
mov ebp, dword [r14 + 0x14]
mov rcx, qword [r14 + 0x18]
mov rdx, rcx
mov qword [rsp + 0x20], rbx
mov rcx, r13
lea r9, [rsp + 0x60]
mov r8d, ebp
mov edi, ebx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14001f6b1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jne 0x14001f6f9
test r15b, r15b
je 0x14001f6bf
mov r14, qword [r14]
jmp 0x14001f6c6
mov r14, qword [rsi + 0x50]
mov r15b, 1
mov rcx, qword [rsi + 0x10]
mov edx, 0x1000
add r12d, ebp
mov eax, dword [rcx + 0x28]
add eax, edx
cmp r12d, eax
jb 0x14001f679
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
jne 0x14001f6f1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, ebx
neg ecx
sbb edi, edi
and edi, ebx
mov rbx, qword [rsp + 0x68]
mov eax, edi
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400216fc
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x1428]
mov eax, 0x1520
call fcn.140028650
sub rsp, rax
mov rax, qword [0x14003f008]
xor rax, rsp
mov qword [rbp + 0x1410], rax
and qword [rbp - 0x70], 0
mov rdi, rcx
lea rcx, [rbp - 0x68]
xor edx, edx
mov r8d, 0x158
call sub.msvcrt.dll_memset
xor ebx, ebx
or esi, 0xffffffff
cmp dword [0x14003f07c], esi
jne 0x140021782
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ecx, eax
cmp eax, esi
jne 0x14002176d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x140021782
or eax, 0xffffffff
lock cmpxchg dword [0x14003f07c], ecx
cmp eax, esi
je 0x140021782
call qword [sym.imp.KERNEL32.dll_TlsFree]
test ebx, ebx
jne 0x140021867
mov ecx, dword [0x14003f07c]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rsi, qword [rdi + 0x10]
mov ecx, 0x1000
cmp dword [rdi + 0x30], ecx
jb 0x140021862
mov eax, dword [rsi + 0x28]
add eax, ecx
cmp eax, ecx
jb 0x140021862
cmp eax, dword [rdi + 0x30]
ja 0x140021862
and dword [rdi + 0xb0], ebx
lea rcx, [rbp + 0xf0]
xor edx, edx
mov r8d, 0x1320
call sub.msvcrt.dll_memset
xor edx, edx
lea r8d, [rbx + 0x28]
lea rcx, [rsp + 0x60]
call sub.msvcrt.dll_memset
lea rax, [0x140021620]
mov qword [rsp + 0x60], rax
lea rcx, [rbp + 0xf0]
lea rax, [0x1400216b0]
mov qword [rsp + 0x68], rax
lea rax, [rbp - 0x70]
mov qword [rbp + 0x128], rax
lea rax, [rbp + 0xf0]
mov qword [rbp - 0x70], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
call fcn.140021cc4
test eax, eax
jns 0x140021850
mov eax, dword [rdi + 0xb0]
neg eax
sbb ebx, ebx
and ebx, 0xfffffc0f
add ebx, 0x3f9
jmp 0x140021867
lea rcx, [rbp + 0xf0]
call fcn.140022000
test eax, eax
je 0x140021867
jmp 0x140021838
mov ebx, 0x3f1
and qword [rbp + 0x128], 0
lea rsi, [rdi + 0x70]
mov rcx, qword [rsi]
cmp rcx, rsi
je 0x1400218a2
mov rdi, qword [rcx]
mov rax, qword [rcx + 8]
cmp qword [rdi + 8], rcx
jne 0x1400218da
cmp qword [rax], rcx
jne 0x1400218da
mov qword [rax], rdi
mov qword [rdi + 8], rax
call qword [sym.imp.msvcrt.dll_free]
mov rcx, rdi
cmp rdi, rsi
jne 0x14002187b
mov ecx, dword [0x14003f07c]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, ebx
mov rcx, qword [rbp + 0x1410]
xor rcx, rsp
call fcn.140027ea0
lea r11, [rsp + 0x1520]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov ecx, 3
int 0x29
int3