joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b26b0
Capabilities:
Allocate thread local storage

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov rax, qword [0x1402b4bc8]
test rax, rax
jne 0x1400b2788
mov ecx, 0x95050
call fcn.1401a8b5c
mov rdi, rax
mov qword [rsp + 0x40], rax
xor ebx, ebx
test rax, rax
je 0x1400b2707
xor edx, edx
mov r8d, 0x95050
mov rcx, rax
call fcn.1401ab060
mov rcx, rdi
call fcn.1400afb30
jmp 0x1400b270a
mov rax, rbx
mov qword [0x1402b4bc8], rax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsAlloc]
mov dword [0x1402ab1b8], eax
cmp eax, 0xffffffff
jne 0x1400b277e
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
lea rdx, [0x1402aebf0]
mov rcx, qword [0x1402aebf0]
cmp rcx, rdx
je 0x1400b275f
test byte [rcx + 0x44], 0x40
je 0x1400b275f
cmp byte [rcx + 0x41], 4
jb 0x1400b275f
mov edx, 0x2c
mov r9d, eax
lea r8, [0x140228e60]
mov rcx, qword [rcx + 0x38]
call fcn.14001ef30
mov rcx, qword [0x1402b4bc8]
test rcx, rcx
je 0x1400b2775
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov qword [0x1402b4bc8], rbx
jmp 0x1400b2785
mov rbx, qword [0x1402b4bc8]
mov rax, rbx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400b36e0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
xor esi, esi
mov rbx, rdx
mov dword [rsp + 0x50], esi
mov rdi, rcx
mov rcx, qword [0x1402aebf0]
lea rbp, [0x1402aebf0]
cmp rcx, rbp
je 0x1400b3732
test byte [rcx + 0x44], 0x40
je 0x1400b3732
cmp byte [rcx + 0x41], 4
jb 0x1400b3732
mov rcx, qword [rcx + 0x38]
lea edx, [rsi + 0x2d]
lea r8, [0x140228e60]
call fcn.14001d350
add rdi, 0x94dd8
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
cmp byte [0x1402b4cb0], sil
jne 0x1400b37dd
mov rcx, rdi
mov byte [0x1402b4cb0], 1
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
mov rax, qword [0x1402aebf0]
cmp rax, rbp
je 0x1400b37bc
test byte [rax + 0x44], 0x40
je 0x1400b37bc
cmp byte [rax + 0x41], 2
jb 0x1400b37bc
cmp qword [rbx + 0x18], 8
jb 0x1400b3781
mov rbx, qword [rbx]
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.1400b3ef0
mov esi, 1
cmp qword [rax + 0x18], 0x10
jb 0x1400b379d
mov rax, qword [rax]
mov rcx, qword [0x1402aebf0]
lea r8, [0x140228e60]
mov edx, 0x2f
mov r9, rax
mov rcx, qword [rcx + 0x38]
call fcn.140023320
test sil, 1
je 0x1400b37cc
lea rcx, [rsp + 0x20]
call fcn.140005dd0
call fcn.1400b4660
mov ecx, 0x2c9
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ExitProcess]
mov rcx, qword [0x1402aebf0]
cmp rcx, rbp
je 0x1400b380a
test byte [rcx + 0x44], 0x40
je 0x1400b380a
cmp byte [rcx + 0x41], 5
jb 0x1400b380a
mov rcx, qword [rcx + 0x38]
lea r8, [0x140228e60]
mov edx, 0x2e
call fcn.14001d350
mov rcx, rdi
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
jmp qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
Function at 0x1400b3b40
Capabilities:
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rdx + 0x18], 8
mov esi, r8d
mov rbx, rdx
jb 0x1400b3b61
mov rcx, qword [rdx]
jmp 0x1400b3b64
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
mov edi, eax
or edi, esi
mov rcx, qword [0x1402aebf0]
lea rsi, [0x1402aebf0]
cmp rcx, rsi
je 0x1400b3ba5
test byte [rcx + 0x44], 0x40
je 0x1400b3ba5
cmp byte [rcx + 0x41], 4
jb 0x1400b3ba5
mov rcx, qword [rcx + 0x38]
lea r8, [0x140228e60]
mov edx, 0x17
mov r9d, edi
call fcn.14001ef30
cmp qword [rbx + 0x18], 8
jb 0x1400b3bb1
mov rcx, qword [rbx]
jmp 0x1400b3bb4
mov rcx, rbx
mov edx, edi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFileAttributesW]
test eax, eax
jne 0x1400b3c1e
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov rcx, qword [0x1402aebf0]
cmp rcx, rsi
je 0x1400b3c09
test byte [rcx + 0x44], 0x40
je 0x1400b3c09
cmp byte [rcx + 0x41], 2
jb 0x1400b3c09
cmp qword [rbx + 0x18], 8
jb 0x1400b3be8
mov rbx, qword [rbx]
mov rcx, qword [rcx + 0x38]
lea r8, [0x140228e60]
mov dword [rsp + 0x28], eax
mov edx, 0x18
mov r9d, edi
mov qword [rsp + 0x20], rbx
call fcn.1400b4420
mov eax, 0x3eb
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x40]
xor eax, eax
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400b7e90
Capabilities:
Resume thread

Disassembly:
push rdi
sub rsp, 0x90
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0xa8], rbx
mov rax, qword [0x1402adcf8]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, rcx
lea rax, [0x1402aebf0]
mov rcx, qword [0x1402aebf0]
cmp rcx, rax
je 0x1400b7efa
test dword [rcx + 0x44], 0x8000
je 0x1400b7efa
cmp byte [rcx + 0x41], 4
jb 0x1400b7efa
mov edx, 0x11
mov r9d, dword [rbx + 0x58]
lea r8, [0x14022bb38]
mov rcx, qword [rcx + 0x38]
call fcn.14001f1d0
lea rcx, [rbx + 0x30]
mov qword [rsp + 0x30], rcx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
mov byte [rsp + 0x38], 1
mov eax, dword [rbx + 0x20]
cmp eax, 4
je 0x1400b7f20
mov edi, 0x139f
jmp 0x1400b7fbd
mov dword [rbx + 0x20], 1
mov rcx, qword [rbx + 8]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x1400b7f40
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
jmp 0x1400b7fbd
xor edi, edi
cmp qword [rbx + 0x18], rdi
je 0x1400b7fbd
xor eax, eax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov rcx, qword [0x1402b4bc8]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov rdx, rax
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], dil
mov r9d, 0xb8
lea r8, str.ServiceThread::resume
lea rcx, [rsp + 0x48]
call fcn.14006d3f0
mov rcx, qword [rbx + 0x18]
call fcn.1400b7ff0
mov qword [rbx + 0x18], rdi
cmp byte [rsp + 0x50], dil
jne 0x1400b7fbd
lea rcx, [rsp + 0x48]
call fcn.14006de90
nop
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
mov eax, edi
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1401a8cb0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x90
pop rdi
ret
Function at 0x1400b8090
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
movzx esi, dl
mov rcx, qword [rcx + 0x60]
add rcx, 0xa0
call fcn.1400a7690
mov edi, eax
test eax, eax
je 0x140085b81
mov rcx, qword [0x1402aebf0]
lea rdx, [0x1402aebf0]
cmp rcx, rdx
je 0x140085b6f
test byte [rcx + 0x44], 4
je 0x140085b6f
cmp byte [rcx + 0x41], 2
jb 0x140085b6f
mov edx, 0x2d
mov rcx, qword [rcx + 0x38]
lea r8, [0x1402238f0]
call fcn.14001d350
mov eax, edi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x60]
mov ecx, dword [rax + 0xac]
cmp ecx, 2
je 0x140085be8
mov rcx, qword [rbx + 0x60]
add rcx, 0xa0
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edi, eax
test eax, eax
je 0x140085bcd
mov rcx, qword [0x1402aebf0]
lea rdx, [0x1402aebf0]
cmp rcx, rdx
je 0x140085b6f
test byte [rcx + 0x44], 4
je 0x140085b6f
cmp byte [rcx + 0x41], 2
jb 0x140085b6f
mov edx, 0x2e
jmp 0x140085b5f
movzx edx, sil
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp method.ServiceThread.virtual_16
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
movzx ebp, dl
mov rbx, rcx
mov rcx, qword [0x1402aebf0]
lea rax, [0x1402aebf0]
cmp rcx, rax
je 0x1400b80e5
test dword [rcx + 0x44], 0x8000
je 0x1400b80e5
cmp byte [rcx + 0x41], 4
jb 0x1400b80e5
mov r9d, dword [rbx + 0x58]
lea r8, [0x14022bb38]
mov rcx, qword [rcx + 0x38]
mov edx, 0x12
call fcn.14001f1d0
lea rcx, [rbx + 0x30]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
mov eax, dword [rbx + 0x20]
cmp eax, 3
je 0x1400b80fe
mov edi, 0x139f
jmp 0x1400b8153
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ResetEvent]
movzx eax, bpl
lea r8, [0x1400b7910]
neg al
mov r9, rbx
sbb ecx, ecx
xor edi, edi
and ecx, 4
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ecx
xor edx, edx
xor ecx, ecx
call fcn.1401d0e00
mov qword [rbx + 8], rax
cmp rax, 0xffffffffffffffff
jne 0x1400b8140
lea edi, [rax + 0x6f]
jmp 0x1400b8153
test bpl, bpl
mov edx, 1
mov eax, 4
cmovne edx, eax
mov dword [rbx + 0x20], edx
lea rcx, [rbx + 0x30]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1400b8510
Capabilities:
Suspend thread

Disassembly:
push rbx
sub rsp, 0x90
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x1402adcf8]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, rcx
lea rax, [0x1402aebf0]
mov rcx, qword [0x1402aebf0]
cmp rcx, rax
je 0x1400b8572
test dword [rcx + 0x44], 0x8000
je 0x1400b8572
cmp byte [rcx + 0x41], 4
jb 0x1400b8572
mov edx, 0x10
mov r9d, dword [rbx + 0x58]
lea r8, [0x14022bb38]
mov rcx, qword [rcx + 0x38]
call fcn.14001f1d0
lea rcx, [rbx + 0x30]
mov qword [rsp + 0x30], rcx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
mov byte [rsp + 0x38], 1
xor eax, eax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov rcx, qword [0x1402b4bc8]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov rdx, rax
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
mov r9d, 0x89
lea r8, str.ServiceThread::suspend
lea rcx, [rsp + 0x48]
call fcn.14006d3f0
nop
mov rcx, qword [rbx + 0x10]
call fcn.1400b8690
mov qword [rbx + 0x18], rax
mov eax, dword [rbx + 0x20]
cmp eax, 1
je 0x1400b85f9
mov ebx, 0x139f
jmp 0x1400b8649
mov dword [rbx + 0x20], 4
mov rcx, qword [0x1402b4bc8]
mov rax, qword [rcx]
call qword [rax + 0x28]
lea rcx, [rax + 0x10]
call fcn.14002bbf0
mov rcx, qword [rbx + 8]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_SuspendThread]
mov ebx, eax
mov rcx, qword [0x1402b4bc8]
mov rdx, qword [rcx]
call qword [rdx + 0x28]
lea rcx, [rax + 0x10]
call fcn.14002bc10
cmp ebx, 0xffffffff
jne 0x1400b8647
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
jmp 0x1400b8649
xor ebx, ebx
cmp byte [rsp + 0x50], 0
jne 0x1400b865b
lea rcx, [rsp + 0x48]
call fcn.14006de90
nop
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
mov eax, ebx
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1401a8cb0
add rsp, 0x90
pop rbx
ret
Function at 0x1400f2860
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rdi
push r14
sub rsp, 0x68
movzx eax, byte [rdx]
mov r14, rdx
mov rdi, rcx
cmp al, 0xaf
jne 0x1400f2879
movzx eax, byte [rdx + 2]
cmp al, 0xb0
jne 0x1400f2883
mov rax, qword [rdx + 0x20]
jmp 0x1400f2893
cmp al, 0x89
jne 0x1400f2a17
mov rax, qword [rdx + 0x20]
mov rax, qword [rax + 0x20]
movsxd rcx, dword [rax]
cmp ecx, 1
je 0x1400f2a17
mov dword [r8], 0
cmp byte [rdx], 0x89
jne 0x1400f28ba
mov rcx, rdi
add rsp, 0x68
pop r14
pop rdi
jmp fcn.14011c290
mov eax, dword [rdi + 0x38]
mov qword [rsp + 0x60], r12
mov r12, rcx
mov qword [rsp + 0x58], r13
lea r13d, [rax + 1]
add eax, ecx
mov dword [rsp + 0x88], r13d
mov dword [rdi + 0x38], eax
test ecx, ecx
jle 0x1400f2a02
mov qword [rsp + 0x80], rbx
lea rcx, [0x140145ee0]
mov qword [rsp + 0x90], rbp
mov ebp, r13d
mov qword [rsp + 0x50], r15
lea r13, [fcn.1400f3aa0]
xor r15d, r15d
mov qword [rsp + 0x98], rsi
lea edx, [r15 + 2]
nop dword [rax + rax]
cmp byte [rdi + 0x23], 0
mov rax, qword [r14 + 0x20]
mov rbx, qword [rax + r15 + 8]
je 0x1400f2970
mov word [rsp + 0x44], dx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x48], 0
test rbx, rbx
je 0x1400f2960
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140174060
cmp word [rsp + 0x44], 0
je 0x1400f2970
mov r8d, ebp
mov rdx, rbx
mov rcx, rdi
call fcn.140125580
jmp 0x1400f29b0
mov rsi, qword [rdi]
test rbx, rbx
je 0x1400f298c
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call fcn.1400f2cf0
mov rbx, rax
cmp byte [rsi + 0x63], 0
jne 0x1400f29a0
mov r8d, ebp
mov rdx, rbx
mov rcx, rdi
call fcn.140123b30
test rbx, rbx
je 0x1400f29b0
mov rdx, rbx
mov rcx, rsi
call fcn.140127100
inc ebp
lea rcx, [0x140145ee0]
add r15, 0x20
mov edx, 2
sub r12, 1
jne 0x1400f2920
mov eax, dword [rsp + 0x88]
mov r15, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x98]
mov rbp, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x80]
mov r12, qword [rsp + 0x60]
mov r13, qword [rsp + 0x58]
add rsp, 0x68
pop r14
pop rdi
ret
mov r12, qword [rsp + 0x60]
mov eax, r13d
mov r13, qword [rsp + 0x58]
add rsp, 0x68
pop r14
pop rdi
ret
mov rcx, rdi
add rsp, 0x68
pop r14
pop rdi
jmp fcn.140126a90
Function at 0x14010b3a0
Capabilities:
Reference sql statements

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
mov r14, qword [rsp + 0x70]
mov ebx, r8d
mov qword [rax - 0x18], r14
mov rbp, r9
mov qword [rax - 0x20], r9
mov rdi, rdx
mov r9, rdx
mov byte [rcx + 0x1c], 1
mov r8, rdx
mov dword [rax - 0x28], ebx
lea rdx, str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d___Q___Q_NULL
mov rsi, rcx
call fcn.140135a60
test ebx, ebx
jne 0x14010b409
mov r9, rbp
mov qword [rsp + 0x20], r14
mov r8, rdi
lea rdx, str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1___Q___Q_NULL
mov rcx, rsi
call fcn.140135a60
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140129790
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x28
xor r11d, r11d
mov rdi, r8
mov ebx, r11d
mov r14, rdx
mov rsi, rcx
cmp dword [rcx + 0x28], ebx
jle 0x140129899
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], r12
lea r12, str.main
mov qword [rsp + 0x20], r15
lea r15, [0x14022ead0]
nop
mov rax, qword [rsi + 0x20]
mov r10d, ebx
xor r10d, 1
cmp ebx, 2
cmovge r10d, ebx
movsxd rcx, r10d
shl rcx, 5
mov rbp, qword [rcx + rax + 0x18]
test rdi, rdi
je 0x140129811
mov r8, qword [rcx + rax]
mov r9, rdi
sub r9, r8
nop dword [rax]
movzx ecx, byte [r8]
movzx eax, byte [r9 + r8]
cmp ecx, eax
jne 0x14012984c
test ecx, ecx
jne 0x14012985a
lea rcx, [rbp + 0x20]
xor r8d, r8d
mov rdx, r14
call fcn.1400f4b70
mov r11, qword [rax + 0x10]
test r11, r11
jne 0x140129830
inc ebx
cmp ebx, dword [rsi + 0x28]
jl 0x1401297d0
mov r12, qword [rsp + 0x60]
mov rax, r11
mov rbp, qword [rsp + 0x58]
mov r15, qword [rsp + 0x20]
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
movzx edx, byte [rax + r15]
movzx ecx, byte [rcx + r15]
cmp ecx, edx
jne 0x14012985f
inc r8
jmp 0x140129800
test r10d, r10d
jne 0x140129829
mov r9, rdi
mov rax, r12
sub r9, r12
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [r9 + rax]
cmp edx, ecx
jne 0x140129885
test edx, edx
je 0x140129811
inc rax
jmp 0x140129870
movzx r8d, byte [rcx + r15]
movzx edx, byte [rdx + r15]
cmp edx, r8d
jne 0x140129829
inc rax
jmp 0x140129870
mov rax, r11
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x14016fb90
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov qword [rcx], 0
mov ecx, 0x28
mov rsi, r8
mov rbp, rdx
call fcn.1401351c0
mov rbx, rax
test rax, rax
jne 0x14016fbce
lea eax, [rbx + 7]
jmp 0x14016fc50
cmp byte [0x1402ab274], 0
je 0x14016fc22
mov rax, qword [0x1402ab3f8]
test rax, rax
je 0x14016fbee
mov ecx, reloc.OLEAUT32.dll_SetErrorInfo
call rax
test eax, eax
jne 0x14016fc22
lea rax, [rbx + 8]
mov qword [rbx + 0x10], rbp
mov qword [rsp + 0x28], rax
lea r8, [0x140148130]
mov r9, rbx
mov dword [rsp + 0x20], 0
xor edx, edx
mov qword [rbx + 0x18], rsi
xor ecx, ecx
call fcn.1401d0e00
mov qword [rbx], rax
test rax, rax
jne 0x14016fc32
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
mov qword [rbx + 0x20], rax
cmp qword [rbx + 0x10], 0
jne 0x14016fc4b
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
mov rcx, rsi
mov dword [rbx + 8], eax
call rbp
mov qword [rbx + 0x20], rax
mov qword [rdi], rbx
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1401aee58
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea r9, [0x140242758]
xor ecx, ecx
lea r8, [0x140242750]
lea rdx, str.FlsAlloc
call fcn.1401ae9d4
mov rbx, rax
test rax, rax
je 0x1401aee98
mov rcx, rax
call fcn.1401aa094
mov rcx, rdi
call rbx
jmp 0x1401aee9e
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsAlloc]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1401aef00
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, ecx
lea r9, [0x140242768]
mov ecx, 2
lea r8, [0x140242760]
lea rdx, str.FlsGetValue
call fcn.1401ae9d4
mov rdi, rax
test rax, rax
je 0x1401aef41
mov rcx, rax
call fcn.1401aa094
mov ecx, ebx
call rdi
jmp 0x1401aef49
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1401aef54
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x140242770]
mov edi, ecx
lea rdx, str.FlsSetValue
mov ecx, 3
lea r8, [0x140242768]
call fcn.1401ae9d4
mov rsi, rax
test rax, rax
je 0x1401aefa0
mov rcx, rax
call fcn.1401aa094
mov rdx, rbx
mov ecx, edi
call rsi
jmp 0x1401aefab
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1401d2a40
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x1401d2827
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleW]
test rax, rax
je 0x1401d2827
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401d2827
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401d2827
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401d2827
cmp dword [rcx + 0x84], 0xe
jbe 0x1401d2827
cmp dword [rcx + 0xf8], 0
je 0x1401d2827
mov ecx, ebx
call fcn.1401d2958
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.1401d25a0
cmp dword [rbp + 0x20], 0
je 0x1401d2874
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1401d287c
int3
xor r8d, r8d
xor edx, edx
jmp 0x1401d27c0
Function at 0x14000ca90
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 0
mov qword [rbp + 0x3d0], 2
mov qword [rbp + 0x3d8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor ebx, ebx
xor edi, edi
xor r12d, r12d
cmp r8, 0x201
jae 0x14000cb30
jmp 0x14000cb1f
jae 0x14000cbf0
cmp r8, 0x201
jae 0x14000cb30
mov esi, 0x200
lea r13, [rbp - 0x58]
mov r15, r8
jmp 0x14000cb88
sub r8, r12
sub rdi, r12
cmp rdi, r8
jae 0x14000cb5f
lea rcx, [rbp + 0x3c8]
mov rdx, r12
call fcn.14002dba0
mov rbx, qword [rbp + 0x3c8]
mov rax, qword [rbp + 0x3d0]
mov qword [rbp + 0x3e8], rax
mov eax, 0xffffffff
cmp rbx, rax
mov r12d, 0xffffffff
cmovb r12, rbx
mov qword [rbp + 0x3d8], r12
mov rdi, rbx
mov rsi, r12
mov r13, qword [rbp + 0x3e8]
mov r15, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r15d
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x14000cbb1
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14000cc58
mov r8d, r14d
cmp r15, r8
jne 0x14000cb10
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14000cc85
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x14000cb1f
jmp 0x14000cb30
cmp rsi, r8
jb 0x14000cc9f
lea rcx, [rbp + 0x3a8]
mov rdx, r13
call fcn.14000f2f0
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rbx, rbx
je 0x14000cc41
add rbx, rbx
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rbx
call fcn.140005c20
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
test rbx, rbx
jne 0x14000cc29
jmp 0x14000cc41
lea rcx, str.internal_error:_entered_unreachable_code_
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.14002e670
jmp 0x14000ccb4
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.14002eac0
ud2
Function at 0x140012400
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x10b8
call fcn.14002cf80
sub rsp, rax
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x1020], xmm6
mov qword [rbp + 0x1018], 0xfffffffffffffffe
mov qword [rbp + 0x1008], rdx
mov r12, rcx
lea r13, [rbp - 0x50]
mov r8d, 0x1000
mov rcx, r13
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0xfe8]
xorps xmm6, xmm6
lea rbx, [rbp + 0xffc]
lea rsi, [0x140017cf0]
lea r15, [rbp + 0xfb0]
mov r14, qword [sym.imp.KERNEL32.dll_WriteFileEx]
mov rdi, qword [sym.imp.KERNEL32.dll_SleepEx]
mov qword [rbp + 0x1010], r12
mov r9d, 0x1000
mov rdx, r12
mov r8, r13
call fcn.140017a90
cmp qword [rbp + 0xfe8], 0
jne 0x1400125d7
mov r12, qword [rbp + 0xff0]
test r12, r12
je 0x1400125a3
cmp r12, 0x1000
ja 0x1400125f9
xor r13d, r13d
nop word cs:[rax + rax]
mov r8d, r12d
sub r8d, r13d
lea rdx, [r13 - 0x50]
add rdx, rbp
mov dword [rbp + 0xffc], 0
movaps xmmword [rbp + 0xfb0], xmm6
mov qword [rbp + 0xfc0], 0
mov qword [rbp + 0xfc8], rbx
mov qword [rsp + 0x20], rsi
mov rcx, qword [rbp + 0x1008]
mov r9, r15
call r14
test eax, eax
je 0x140012577
nop word [rax + rax]
mov ecx, 0xffffffff
mov edx, 1
call rdi
cmp dword [rbp + 0xffc], 0
je 0x140012520
movsxd rax, dword [rbp + 0x1000]
test rax, rax
jne 0x14001257d
mov eax, dword [rbp + 0x1004]
add r13, rax
cmp r13, r12
je 0x140012560
jbe 0x1400124d0
jmp 0x1400125e5
mov r12, qword [rbp + 0x1010]
lea r13, [rbp - 0x50]
lea rcx, [rbp + 0xfe8]
jmp 0x140012485
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp + 0xfe0], rax
mov qword [rbp + 0xfd8], 1
lea rcx, [rbp + 0xfe0]
call fcn.140006ff0
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x1010]
call rsi
mov rcx, qword [rbp + 0x1008]
call rsi
movaps xmm6, xmmword [rbp + 0x1020]
add rsp, 0x10b8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, [rbp + 0xff0]
call fcn.140006ff0
jmp 0x1400125a3
lea r8, str.library_std_src_syswindowspipe.rs
mov rcx, r13
mov rdx, r12
call fcn.14002eb40
jmp 0x14001260d
lea r8, str.library_std_src_syswindowspipe.rs
mov edx, 0x1000
mov rcx, r12
call fcn.14002eac0
ud2