joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800a1340
Capabilities:
Allocate or change rwx memory

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x70
mov rdi, rsp
mov ecx, 0x1c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x80]
mov eax, dword [rsp + 0x80]
imul rax, rax, 0x38
mov rcx, qword [0x1800ebcf0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x48], 5
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x20]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x1800a13c4
mov rax, qword [rsp + 0x50]
sub rax, 5
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x48]
add rax, 2
mov qword [rsp + 0x48], rax
lea r9, [rsp + 0x34]
mov r8d, 0x40
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1800a13ed
mov eax, 0xa
jmp 0x1800a1527
cmp dword [rsp + 0x88], 0
je 0x1800a145b
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov byte [rax], 0xe9
mov rax, qword [rsp + 0x50]
add rax, 5
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx + 8]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x58]
mov dword [rcx + 1], eax
mov rax, qword [rsp + 0x20]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x1800a1459
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov byte [rax], 0xeb
mov rax, qword [rsp + 0x60]
mov byte [rax + 1], 0xf9
jmp 0x1800a14a7
mov rax, qword [rsp + 0x20]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x1800a148b
mov rax, qword [rsp + 0x20]
add rax, 0x18
mov r8d, 7
mov rdx, rax
mov rcx, qword [rsp + 0x50]
call sub.VCRUNTIME140.dll_memcpy
jmp 0x1800a14a7
mov rax, qword [rsp + 0x20]
add rax, 0x18
mov r8d, 5
mov rdx, rax
mov rcx, qword [rsp + 0x50]
call sub.VCRUNTIME140.dll_memcpy
lea r9, [rsp + 0x34]
mov r8d, dword [rsp + 0x34]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movzx eax, byte [rsp + 0x88]
and al, 1
shl al, 1
mov rcx, qword [rsp + 0x20]
movzx ecx, byte [rcx + 0x20]
and cl, 0xfd
or cl, al
movzx eax, cl
mov rcx, qword [rsp + 0x20]
mov byte [rcx + 0x20], al
movzx eax, byte [rsp + 0x88]
and al, 1
shl al, 2
mov rcx, qword [rsp + 0x20]
movzx ecx, byte [rcx + 0x20]
and cl, 0xfb
or cl, al
movzx eax, cl
mov rcx, qword [rsp + 0x20]
mov byte [rcx + 0x20], al
xor eax, eax
mov rdi, rax
mov rcx, rsp
lea rdx, reloc.d2d1.dll_Ordinal_1
call fcn.1800a4bd8
mov rax, rdi
add rsp, 0x70
pop rdi
ret
Function at 0x4019d8
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x1c
mov ecx, 0x11385def
call fcn.004018ef
add rsp, 0x1c
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x401c98
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x1c
mov ecx, 0x42cdb7dd
call fcn.004018ef
add rsp, 0x1c
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x401d18
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x1c
mov ecx, 0xf798ed1a
call fcn.004018ef
add rsp, 0x1c
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x401d58
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x1c
mov ecx, 0xf768efe9
call fcn.004018ef
add rsp, 0x1c
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x401d98
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x1c
mov ecx, 0x3910913
call fcn.004018ef
add rsp, 0x1c
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140001e30
Capabilities:
Bypass uac via icmluautil

Disassembly:
push rbp
mov rbp, rsp
push r13
push r12
lea r12, str.3E5FC7F9_9A51_4367_9063_A120244FBEC7
push rdi
push rsi
push rbx
mov rbx, rcx
mov rcx, r12
and rsp, 0xfffffffffffffff0
sub rsp, 0x270
movups xmm0, xmmword [0x140004ea0]
mov rax, qword [0x140004e00]
and qword [rsp + 0x20], 0
movups xmmword [rsp + 0x28], xmm0
call qword [rax]
xchg rdx, rax
mov eax, 0x80004005
cmp rdx, 0x40
ja 0x140001f00
lea rdx, [rsp + 0x3c]
lea r13, [rsp + 0x38]
push 0xb
xor eax, eax
pop rcx
mov rdi, rdx
lea r8, str.Elevation:Administrator_new:
mov edx, 0x104
rep stosd dword [rdi], eax
mov rax, qword [0x140004e60]
lea rsi, [rsp + 0x68]
mov dword [rsp + 0x38], 0x30
mov rcx, rsi
mov dword [rsp + 0x4c], 4
call qword [rax]
mov rax, qword [0x140004e50]
mov r8, r12
mov rcx, rsi
mov edx, 0x104
call qword [rax]
mov rax, qword [0x140004bd0]
lea rdx, str.CoGetObject
mov rcx, qword [rax]
mov rax, qword [0x140004cf0]
call qword [rax]
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x28]
mov rdx, r13
mov rcx, rsi
call rax
mov rdx, qword [rsp + 0x20]
mov qword [rbx], rdx
lea rsp, [rbp - 0x28]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop rbp
ret
Function at 0x10007510
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xa0
mov dword [rsp + 0x20], 0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor edi, edi
xor eax, eax
lock cmpxchg qword [0x10015150], rbx
je 0x10007566
cmp rax, rbx
jne 0x10007559
mov edi, 1
jmp 0x10007566
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10007540
mov eax, dword [0x10015148]
cmp eax, 1
jne 0x1000757b
lea ecx, [rax + 0x1e]
call fcn.10150000
jmp 0x100075ba
mov eax, dword [0x10015148]
test eax, eax
jne 0x100075b0
mov dword [0x10015148], 1
lea rdx, [0x100014d0]
lea rcx, [0x100014b8]
call sub.MSVCR80.dll__initterm_e
test eax, eax
je 0x100075ba
mov eax, 0xff
jmp 0x10007714
mov dword [0x10014314], 1
mov eax, dword [0x10015148]
cmp eax, 1
jne 0x100075e2
lea rdx, [0x100014b0]
lea rcx, [0x10001470]
call sub.MSVCR80.dll__initterm
mov dword [0x10015148], 2
test edi, edi
jne 0x100075ef
xor eax, eax
xchg qword [0x10015150], rax
cmp qword [0x10015168], 0
je 0x10007618
lea rcx, [0x10015168]
call fcn.10007b90
test eax, eax
je 0x10007618
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x10015168]
mov rax, qword [sym.imp.MSVCR80.dll__acmdln]
mov rbx, qword [rax]
mov qword [rsp + 0x28], rbx
mov edi, dword [rsp + 0x20]
nop
nop
movzx ecx, byte [rbx]
cmp cl, 0x20
ja 0x100076aa
test cl, cl
je 0x10007640
test edi, edi
jne 0x100076aa
movzx eax, byte [rbx]
test al, al
je 0x10007656
cmp al, 0x20
ja 0x10007656
add rbx, 1
mov qword [rsp + 0x28], rbx
jmp 0x10007640
test byte [rsp + 0x6c], 1
je 0x10007665
movzx r9d, word [rsp + 0x70]
jmp 0x1000766b
mov r9d, 0xa
mov r8, rbx
xor edx, edx
lea rcx, [0x10000000]
call fcn.10005300
mov dword [0x10014310], eax
cmp dword [0x100142f4], 0
jne 0x10007693
mov ecx, eax
call qword [sym.imp.MSVCR80.dll_exit]
cmp dword [0x10014314], 0
jne 0x100076a8
call qword [sym.imp.MSVCR80.dll__cexit]
mov eax, dword [0x10014310]
jmp 0x1000770d
cmp cl, 0x22
jne 0x100076bc
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [rsp + 0x20], eax
movzx ecx, cl
call qword [sym.imp.MSVCR80.dll__ismbblead]
test eax, eax
je 0x100076d2
add rbx, 1
mov qword [rsp + 0x28], rbx
add rbx, 1
mov qword [rsp + 0x28], rbx
jmp 0x10007630
jmp 0x10007714
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rdi
ret
sub rsp, 0x28
call fcn.10007c10
add rsp, 0x28
jmp 0x10007510
Function at 0x14008bd60
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x14008bd82
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x14008bdfc
mov rdi, r14
mov rcx, rbx
call fcn.14008d340
test rax, rax
jle 0x14008bdd4
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.14009da40
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14008bdec
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x14008bdf4
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x14008bd96
sub r14, rdi
jmp 0x14008bee9
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x14008be13
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14008be15
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14008be4a
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.14009da40
mov rax, qword [rbx + 0x50]
sub rbp, rdi
add rsi, rdi
mov r8, rbp
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14008bee6
mov r9, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r9], rax
jne 0x14008be85
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rdi, r8
cmp r8, 0xfff
jbe 0x14008bec1
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.1400aa304
sub rbp, rax
add rsi, rax
mov rdi, rbp
cmp rax, 0xfff
jne 0x14008beff
cmp rbp, rax
ja 0x14008be91
mov r8, rdi
test rdi, rdi
je 0x14008bee6
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.1400aa304
mov r8, rdi
sub r8, rax
sub r14, r8
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
sub r14, rbp
jmp 0x14008bee9
Function at 0x14009ae60
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
jne 0x14009aea8
mov r9d, 0x197
lea r8, str.._boost_thread_detail_platform_time.hpp
lea rdx, str.struct_boost::detail::mono_platform_timepoint___cdecl_boost::detail::mono_platform_clock::now_void_
lea rcx, str.0___Boost::Thread___QueryPerformanceFrequency_Internal_Error_
call fcn.1401a2ff0
mov rax, rdi
mov qword [rdi], 0
add rsp, 0x20
pop rdi
ret
cmp qword [rsp + 0x40], 0
jg 0x14009aeb8
mov r9d, 0x19c
jmp 0x14009ae7e
mov qword [rsp + 0x30], rbx
lea rcx, [rsp + 0x38]
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x14009aee6
nop
inc ebx
cmp ebx, 3
ja 0x14009af1c
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x14009aed0
mov rbx, qword [rsp + 0x30]
xorps xmm1, xmm1
cvtsi2sd xmm1, qword [rsp + 0x38]
xorps xmm0, xmm0
mulsd xmm1, qword [0x1401be800]
cvtsi2sd xmm0, qword [rsp + 0x40]
divsd xmm1, xmm0
cvttsd2si rax, xmm1
mov qword [rdi], rax
mov rax, rdi
add rsp, 0x20
pop rdi
ret
mov r9d, 0x1a6
lea r8, str.._boost_thread_detail_platform_time.hpp
lea rdx, str.struct_boost::detail::mono_platform_timepoint___cdecl_boost::detail::mono_platform_clock::now_void_
lea rcx, str.0___Boost::Thread___QueryPerformanceCounter_Internal_Error_
call fcn.1401a2ff0
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov qword [rdi], 0
add rsp, 0x20
pop rdi
ret
Function at 0x14009b0c0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ecx, dword [0x14024d050]
cmp ecx, 0xffffffff
jne 0x14009b0de
xor esi, esi
jmp 0x14009b0e7
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
mov qword [rsp + 0x30], rsi
test rsi, rsi
je 0x14009b1f0
mov rax, qword [rsi + 0x30]
test rax, rax
jne 0x14009b110
cmp qword [rsi + 0x18], 0
je 0x14009b1e8
nop dword [rax]
mov rbx, qword [rsi + 0x18]
test rbx, rbx
je 0x14009b1b1
mov rax, qword [rbx + 8]
mov qword [rsi + 0x18], rax
mov rcx, qword [rbx]
test rcx, rcx
je 0x14009b176
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rdi, qword [rbx]
mov rax, qword [rdi]
xor edx, edx
mov rcx, rdi
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
jne 0x14009b176
lea r9d, [rax + 0x23]
lea r8, str.._boost_thread_win32_thread_heap_alloc.hpp
lea rdx, str.void___cdecl_boost::detail::free_raw_heap_memory_void__
lea rcx, str.winapi::HeapFree_winapi::GetProcessHeap___0_heap_memory__0
call fcn.1401a2ff0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
jne 0x14009b110
lea r9d, [rax + 0x23]
lea r8, str.._boost_thread_win32_thread_heap_alloc.hpp
lea rdx, str.void___cdecl_boost::detail::free_raw_heap_memory_void__
lea rcx, str.winapi::HeapFree_winapi::GetProcessHeap___0_heap_memory__0
call fcn.1401a2ff0
jmp 0x14009b110
mov rax, qword [rsi + 0x30]
test rax, rax
je 0x14009b0fe
mov rbx, qword [rsi + 0x28]
mov rbx, qword [rbx]
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14009b1da
mov rdx, qword [rbx + 0x38]
test rdx, rdx
je 0x14009b1da
call qword [rbx + 0x28]
mov rdx, rbx
lea rcx, [rsi + 0x28]
call fcn.140099af0
jmp 0x14009b1b1
xor ecx, ecx
call fcn.14009b260
nop
test rsi, rsi
je 0x14009b245
mov eax, 0xffffffff
lock xadd dword [rsi + 8], eax
cmp eax, 1
jne 0x14009b245
mov rax, qword [rsi]
xor edx, edx
mov rcx, rsi
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
jne 0x14009b245
lea r9d, [rax + 0x23]
lea r8, str.._boost_thread_win32_thread_heap_alloc.hpp
lea rdx, str.void___cdecl_boost::detail::free_raw_heap_memory_void__
lea rcx, str.winapi::HeapFree_winapi::GetProcessHeap___0_heap_memory__0
call fcn.1401a2ff0
nop
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14009b260
Capabilities:
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rdx, [0x14009a2b0]
lea rcx, [0x140250f20]
call fcn.140099fc0
mov ecx, dword [0x14024d050]
cmp ecx, 0xffffffff
je 0x14009b2a1
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x14009b2c6
lea r9d, [rax + 0x70]
lea rcx, str.TlsSetValue_current_thread_tls_key__new_data_
jmp 0x14009b2ae
mov r9d, reloc.WS2_32.dll_WSACleanup
lea rcx, str.false
lea r8, str.libs_thread_srcwin32_thread.cpp
lea rdx, str.void___cdecl_boost::_anonymous_namespace::set_current_thread_data_struct_boost::detail::thread_data_base__
add rsp, 0x20
pop rbx
jmp fcn.1401a2ff0
add rsp, 0x20
pop rbx
ret

Function at 0x14009b2d0
Capabilities:
Create thread
Resume thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x30
mov r9, qword [rcx]
mov rbx, rcx
test r9, r9
jne 0x14009b308
mov r9d, 0xc9
lea r8, str.._boost_smart_ptr_intrusive_ptr.hpp
lea rdx, str.struct_boost::detail::thread_data_base___cdecl_boost::intrusive_ptr_struct_boost::detail::thread_data_base_::operator____void__const
lea rcx, str.px___0
call fcn.1401a2ff0
mov r9, qword [rbx]
lea rax, [r9 + 0x20]
xor edx, edx
mov qword [rsp + 0x28], rax
lea r8, [0x14009b400]
xor ecx, ecx
mov dword [rsp + 0x20], 4
call fcn.1400b7bb4
mov rsi, rax
test rax, rax
jne 0x14009b33c
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rsi
ret
mov rax, qword [rbx]
mov qword [rsp + 0x40], rdi
lock inc dword [rax + 8]
mov rdi, qword [rbx]
test rdi, rdi
jne 0x14009b373
mov r9d, 0xc9
lea r8, str.._boost_smart_ptr_intrusive_ptr.hpp
lea rdx, str.struct_boost::detail::thread_data_base___cdecl_boost::intrusive_ptr_struct_boost::detail::thread_data_base_::operator____void__const
lea rcx, str.px___0
call fcn.1401a2ff0
mov rdi, qword [rbx]
mov rcx, qword [rdi + 0x10]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14009b3ab
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x14009b3ab
mov r9d, 0xe7
lea r8, str.._boost_thread_win32_thread_primitives.hpp
lea rdx, str.void___cdecl_boost::detail::win32::handle_manager::cleanup_void_
lea rcx, str.::boost::winapi::CloseHandle_handle_to_manage_
call fcn.1401a2ff0
mov qword [rdi + 0x10], rsi
mov rcx, qword [rbx]
mov rdi, qword [rsp + 0x40]
test rcx, rcx
jne 0x14009b3df
mov r9d, 0xc9
lea r8, str.._boost_smart_ptr_intrusive_ptr.hpp
lea rdx, str.struct_boost::detail::thread_data_base___cdecl_boost::intrusive_ptr_struct_boost::detail::thread_data_base_::operator____void__const
lea rcx, str.px___0
call fcn.1401a2ff0
mov rcx, qword [rbx]
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rbx, qword [rsp + 0x48]
mov al, 1
add rsp, 0x30
pop rsi
ret
Function at 0x1400ac404
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.14009c040
sub rsp, rax
mov rax, qword [0x14024d070]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.1400ba9e4
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x1400ac453
mov rax, rbp
jmp 0x1400ac55b
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x251ca0]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.1400bda30
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0x251ca0]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x1400ac557
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400ac557
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.1400bda30
test rax, rax
js 0x1400ac557
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x1400ac557
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x1400ac549
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x1400ac549
cmp byte [rcx], 0xd
jne 0x1400ac52f
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x1400ac53e
cmp byte [rcx + 1], 0xa
jne 0x1400ac53e
inc rcx
jmp 0x1400ac53e
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x24d480]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x1400ac511
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x1400ac55b
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.14009b490
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400bb7c0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rsi, rcx
test rcx, rcx
jne 0x1400bb7f2
call fcn.1400b41b0
mov dword [rax], 0x16
call fcn.1400a8ae8
jmp 0x1400bb911
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1400bb911
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x1400bb911
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x1400bb821
lock or dword [rcx + 0x14], 0x10
jmp 0x1400bb911
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x1400bb835
call fcn.1400bbd24
mov rdi, qword [rsi + 8]
mov rcx, rsi
mov ebx, dword [rsi + 0x20]
mov qword [rsi], rdi
call fcn.1400ba9e4
mov r8d, ebx
mov rdx, rdi
mov ecx, eax
call fcn.1400bdf88
mov dword [rsi + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 1
jbe 0x1400bb8ff
mov eax, dword [rsi + 0x14]
or edi, 0xffffffff
test al, 6
jne 0x1400bb8ca
mov rcx, rsi
call fcn.1400ba9e4
cmp eax, edi
je 0x1400bb8b5
mov rcx, rsi
call fcn.1400ba9e4
cmp eax, 0xfffffffe
je 0x1400bb8b5
mov rcx, rsi
call fcn.1400ba9e4
movsxd rbx, eax
lea r14, [0x140251ca0]
mov rcx, rsi
sar rbx, 6
call fcn.1400ba9e4
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rbx*8]
lea rdx, [rax + rcx*8]
jmp 0x1400bb8bc
lea rdx, [0x14024d430]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1400bb8ca
lock or dword [rsi + 0x14], 0x20
cmp dword [rsi + 0x20], 0x200
jne 0x1400bb8ee
mov eax, dword [rsi + 0x14]
shr eax, 6
test al, 1
je 0x1400bb8ee
mov eax, dword [rsi + 0x14]
shr eax, 8
test al, 1
jne 0x1400bb8ee
mov dword [rsi + 0x20], 0x1000
mov rax, qword [rsi]
add dword [rsi + 0x10], edi
movzx edi, byte [rax]
inc rax
mov qword [rsi], rax
jmp 0x1400bb914
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rsi + 0x14], eax
and dword [rsi + 0x10], 0
or edi, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret
Function at 0x1400bdadc
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
movsxd rbp, ecx
mov r9, r8
mov rax, rbp
lea rcx, [0x140251ca0]
and eax, 0x3f
mov r10, rbp
sar r10, 6
xor edi, edi
mov rsi, rdx
mov r14, rbp
lea r8, [rax + rax*8]
mov rax, qword [rcx + r10*8]
mov ecx, 4
mov qword [rsp + 0x78], rcx
mov r11, qword [rax + r8*8 + 0x28]
lea r12d, [rcx + 6]
test r9, r9
je 0x1400bdb3a
cmp word [rdx], r12w
jne 0x1400bdb3a
or byte [rax + r8*8 + 0x38], cl
jmp 0x1400bdb40
and byte [rax + r8*8 + 0x38], 0xfb
lea rdx, [rdx + r9*2]
mov rcx, rsi
mov rbx, rsi
cmp rsi, rdx
jae 0x1400bdc9b
mov r9d, 0x1a
lea r13d, [r9 - 0xd]
movzx eax, word [rcx]
cmp ax, r9w
je 0x1400bdc76
lea r9, [rcx + 2]
cmp ax, r13w
je 0x1400bdb79
mov rcx, r9
jmp 0x1400bdb9c
cmp r9, rdx
jae 0x1400bdbb3
cmp word [r9], r12w
mov eax, 2
cmove rax, qword [rsp + 0x78]
add rcx, rax
mov eax, r12d
cmp word [r9], r12w
cmovne ax, r13w
mov word [rbx], ax
mov r9d, 0x1a
add rbx, 2
cmp rcx, rdx
jb 0x1400bdb5d
jmp 0x1400bdc9b
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rdi
mov r8d, 2
lea rdx, [rsp + 0x70]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400bdc70
cmp dword [rsp + 0x80], edi
je 0x1400bdc70
mov rdx, r14
lea r11, [0x140251ca0]
sar rdx, 6
and r14d, 0x3f
mov rax, qword [r11 + rdx*8]
lea r8, [r14 + r14*8]
test byte [rax + r8*8 + 0x38], 0x48
je 0x1400bdc49
movzx eax, word [rsp + 0x70]
cmp ax, r12w
jne 0x1400bdc1c
mov word [rbx], r12w
jmp 0x1400bdc97
mov word [rbx], r13w
mov word [rsp + 0x78], ax
mov rax, qword [r11 + rdx*8]
lea rcx, [rax + r8*8]
mov al, byte [rsp + rdi + 0x78]
mov byte [rcx + rdi + 0x3a], al
inc rdi
cmp rdi, 2
jl 0x1400bdc25
mov rax, qword [r11 + rdx*8]
mov byte [rax + r8*8 + 0x3c], r12b
jmp 0x1400bdc97
cmp word [rsp + 0x70], r12w
jne 0x1400bdc56
cmp rbx, rsi
je 0x1400bdc16
mov rdx, 0xfffffffffffffffe
mov ecx, ebp
lea r8d, [rdx + 3]
call fcn.1400bda38
cmp word [rsp + 0x70], r12w
je 0x1400bdc9b
mov word [rbx], r13w
jmp 0x1400bdc97
lea r11, [0x140251ca0]
mov rcx, qword [r11 + r10*8]
mov al, byte [rcx + r8*8 + 0x38]
test al, 0x40
jne 0x1400bdc93
or al, 2
mov byte [rcx + r8*8 + 0x38], al
jmp 0x1400bdc9b
mov word [rbx], r9w
add rbx, 2
sub rbx, rsi
sar rbx, 1
lea eax, [rbx + rbx]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret