joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001360
Capabilities:
Execute command

Disassembly:
push rbp
push rbx
sub rsp, 0xa8
lea rbp, [rsp + 0xa0]
call sym.__main
lea rax, str.taskkill__F__IM_AIS_catcher.exe_2_NUL
mov rcx, rax
call sym.system
lea rax, str.C:Program_Files__x86_OpenCPNplugins_rtlsdr_pi_binAIS_catcher.exe
mov qword [rbp - 8], rax
lea rax, str._gr_RTLAGC_on_TUNER_auto__o_2__a_192K__u_127.0.0.1_10110__N_8100__N_REALTIME_on_PLUGIN_DIR_plugins
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x19]
mov qword [rbp - 0x18], rax
nop
nop
lea rcx, [rbp - 0x19]
mov rdx, qword [rbp - 8]
lea rax, [rbp - 0x40]
mov r8, rcx
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_std.allocator_char____char_const__std::allocator_char__const_
lea rax, [rbp - 0x60]
lea rdx, [rbp - 0x40]
lea r8, [0x14007b0d3]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____char_const_
lea rax, [rbp - 0x80]
mov rcx, qword [rbp - 0x10]
lea rdx, [rbp - 0x60]
mov r8, rcx
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____char_const_
lea rax, [rbp - 0x60]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp - 0x40]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp - 0x19]
mov rcx, rax
call method.std::__new_allocator_char_.__new_allocator__
nop
lea rax, [rbp - 0x80]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.c_str___const
mov rcx, rax
call sym.system
lea rax, str.AIS_catcher.exe_pokrenut_sa_parametrima._n
mov rdx, rax
mov rax, qword [0x1400800b0]
mov rcx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov ebx, 0
lea rax, [rbp - 0x80]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
mov eax, ebx
jmp 0x1400014a8
add rsp, 0xa8
pop rbx
pop rbp
ret
Function at 0x140006f80
Capabilities:
Get thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rdi, [0x1400a6100]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400a60e0]
test rbx, rbx
je 0x140006fcc
mov ecx, dword [rbx]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rsi, rsi
je 0x140006fc6
test eax, eax
jne 0x140006fc6
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
jmp 0x140006f9e
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140007180
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x1400071a3
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x1400071a3
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x1400071a4
Capabilities:
Enumerate pe sections

Disassembly:
xor r8d, r8d
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r9d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
cmp r8d, r9d
jae 0x1400071de
mov r10d, dword [rax + 0xc]
mov rcx, r10
cmp rdx, r10
jb 0x1400071d5
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x1400071e0
inc r8d
add rax, 0x28
jmp 0x1400071bc
xor eax, eax
ret

Function at 0x140007251
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x140080530]
mov r8, rcx
mov rcx, r9
call sym._ValidateImageBase
test eax, eax
je 0x14000727d
mov rdx, r8
mov rcx, r9
sub rdx, r9
add rsp, 0x28
jmp sym._FindPESection
xor eax, eax
add rsp, 0x28
ret

Function at 0x14000dcce
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
lea rcx, str.msvcrt.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rsi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.rand_s
mov rcx, rax
call rsi
test rax, rax
jne 0x14000dd23
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.SystemFunction036
mov rcx, rax
call rsi
mov qword [0x1400a6b80], rax
lea rax, [sym.mingw_rand_s]
mov rcx, rbx
mov qword [sym.init_rand_s], rax
add rsp, 0x28
pop rbx
pop rsi
jmp rax

Function at 0x14000fbae
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1400772e8], eax
inc eax
jne 0x14000fbc8
call sym.abort
nop
add rsp, 0x28
ret

Function at 0x14000fd65
Capabilities:
Print debug messages

Disassembly:
push rdi
push rbx
sub rsp, 0x68
mov rbx, rcx
call sym.pthread_spin_destroy
dec eax
jne 0x14000fdb5
xor eax, eax
lea rdi, [rsp + 0x2b]
mov ecx, 0x35
rep stosb byte [rdi], al
lea rbx, [rsp + 0x2b]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea r8, str.Error_cleaning_up_spin_keys_for_thread__lu._n
mov edx, 0x35
mov rcx, rbx
mov r9d, eax
call sym.snprintf.constprop.0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call sym.abort
mov qword [rbx], 0xffffffffffffffff
add rsp, 0x68
pop rbx
pop rdi
ret
Function at 0x14000fe5a
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x1400772e8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
jne 0x14000ff58
call sym.pop_pthread_mem
mov rbx, rax
test rax, rax
je 0x14000ff58
mov dword [rax + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
mov dword [rbx + 0x70], eax
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x38], 0xffffffffffffffff
lea rcx, [rbx + 0x68]
mov qword [rbx + 0x30], rax
call sym.replace_spin_keys.constprop.0
xor edx, edx
xor ecx, ecx
mov rdi, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rbx + 0xb8], edx
mov qword [rbx + 0x28], rcx
call rdi
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rsi, rax
call rdi
xor r8d, r8d
mov dword [rsp + 0x30], 2
mov rdx, rsi
mov dword [rsp + 0x28], r8d
mov rcx, rax
lea r9, [rbx + 0x28]
mov dword [rsp + 0x20], r8d
mov r8, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x14000ff21
call sym.abort
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov ecx, dword [0x1400772e8]
mov rdx, rbx
mov dword [rbx + 0xc0], eax
xor eax, eax
mov dword [rbx + 0xbc], eax
mov al, byte [rbx + 0x40]
and eax, 0xffffffcf
or eax, 0x10
mov byte [rbx + 0x40], al
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x14000ff1c
mov rax, rbx
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
Function at 0x1400106a7
Capabilities:
Get thread local storage value
Print debug messages
Set thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
test edx, edx
jne 0x1400106e9
test r8, r8
jne 0x14001082e
mov rcx, qword [0x1400a6c00]
test rcx, rcx
je 0x14001082e
mov rax, qword [0x1400a6bf0]
test rax, rax
je 0x1400106da
call rax
xor r9d, r9d
mov qword [0x1400a6c00], r9
jmp 0x14001082e
cmp edx, 1
jne 0x140010714
mov rax, qword [0x1400a6bf8]
test rax, rax
je 0x1400106da
lea rdx, [sym.SetThreadName_VEH]
mov ecx, 1
call rax
mov qword [0x1400a6c00], rax
jmp 0x14001082e
cmp edx, 3
jne 0x14001082e
mov ecx, dword [0x1400772e8]
cmp ecx, 0xffffffff
je 0x14001082e
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x14001082e
test byte [rax + 0x40], 0x30
lea rdi, [rax + 0x38]
lea rsi, [rax + 0x68]
je 0x1400107b1
mov rcx, qword [rax + 0x1d8]
call sym._pthread_cleanup_dest
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x140010782
mov rbp, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbp
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140010775
call rbp
xor r8d, r8d
mov qword [rbx + 0x30], r8
xor ecx, ecx
mov qword [rbx + 0x28], rcx
mov rcx, rdi
call sym.pthread_mutex_destroy
mov rcx, rsi
call sym.replace_spin_keys.constprop.0
mov rcx, rbx
call sym.push_pthread_mem
mov ecx, dword [0x1400772e8]
xor edx, edx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp dword [rax + 0xbc], 0
mov rcx, qword [rax + 0x30]
jne 0x140010805
test rcx, rcx
je 0x1400107c9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov rcx, qword [rbx + 0x1d8]
mov dword [rbx + 0xbc], 1
mov qword [rbx + 0x30], rdx
call sym._pthread_cleanup_dest
test byte [rbx + 0x44], 4
je 0x140010816
mov rcx, qword [rbx + 0x28]
mov dword [rbx], 0xdeadbeef
test rcx, rcx
je 0x14001077c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14001077c
test rcx, rcx
je 0x140010810
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov qword [rbx + 0x30], rax
mov rcx, rdi
call sym.pthread_mutex_destroy
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.replace_spin_keys.constprop.0
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x140010837
Capabilities:
Set thread local storage value

Disassembly:
push rbp
mov rbp, rsp
push rsi
push rbx
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
call sym._fpreset
lea rcx, [0x1400772d8]
call sym.pthread_mutex_lock
mov rax, qword [rbp + 0x10]
lea rbx, [rax + 0x38]
mov rcx, rbx
call sym.pthread_mutex_lock
call sym._pthread_once_raw.constprop.0.isra.0
mov rdx, qword [rbp + 0x10]
mov ecx, dword [0x1400772e8]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rsi, qword [rbp + 0x10]
mov rcx, rbx
mov dword [rsi + 0x70], eax
call sym.pthread_mutex_unlock
mov rax, qword [rbp + 0x10]
mov rdx, rbp
lea rcx, [rax + 0xd0]
call sym._setjmp
test eax, eax
jne 0x140010917
lea rcx, [0x1400772d8]
mov ebx, pe_nt_image_headers64
call sym.pthread_mutex_unlock
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0x10]
test rax, rax
je 0x1400108d2
mov rdx, qword [rbp + 0x10]
mov rcx, qword [rdx + 8]
call rax
mov rbx, rax
nop
nop
lea rcx, [0x1400772d8]
call sym.pthread_mutex_lock
mov rax, qword [rbp + 0x10]
mov qword [rax + 8], rbx
mov rcx, qword [rax + 0x1d8]
call sym._pthread_cleanup_dest
mov rax, qword [rbp + 0x10]
lea rbx, [rax + 0x38]
mov rcx, rbx
call sym.pthread_mutex_lock
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 0x30]
mov rsi, qword [rax + 8]
test rcx, rcx
jne 0x140010925
jmp 0x14001092b
lea rcx, [0x1400772d8]
call sym.pthread_mutex_lock
jmp 0x1400108f4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp + 0x10]
xor edx, edx
cmp qword [rax + 0x28], 0
mov qword [rax + 0x30], rdx
jne 0x14001096f
mov rax, qword [rbp + 0x10]
mov rcx, rbx
mov dword [rax], 0xdeadbeef
call sym.pthread_mutex_unlock
mov rcx, rbx
call sym.pthread_mutex_destroy
mov rcx, qword [rbp + 0x10]
call sym.push_pthread_mem
mov ecx, dword [0x1400772e8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x140010995
mov rcx, rbx
call sym.pthread_mutex_unlock
mov rcx, rbx
call sym.pthread_mutex_destroy
mov rax, qword [rbp + 0x10]
mov qword [rax + 0x38], 0xffffffffffffffff
mov dword [rax + 0xbc], 1
lea rbx, [0x1400772d8]
mov rcx, rbx
call sym.pthread_mutex_unlock
test eax, eax
jne 0x1400109b2
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14001099c
mov ecx, esi
call qword [sym.imp.msvcrt.dll__endthreadex]
nop
Function at 0x140010b0b
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, rcx
call sym.__pthread_self_lite
mov qword [rax + 8], rsi
mov rcx, qword [rax + 0x1d8]
mov rbx, rax
call sym._pthread_cleanup_dest
test byte [rbx + 0x40], 0x30
jne 0x140010b44
lea rcx, [rbx + 0xd0]
mov edx, 1
call qword [sym.imp.msvcrt.dll_longjmp]
mov ecx, dword [0x1400772e8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140010bcf
cmp qword [rax + 0x28], 0
mov rcx, qword [rax + 0x30]
jne 0x140010b7f
mov dword [rax], 0xdeadbeef
test rcx, rcx
je 0x140010b74
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
mov esi, dword [rbx + 8]
mov qword [rbx + 0x30], rcx
jmp 0x140010bb9
mov dword [rax + 0xbc], 1
mov esi, dword [rax + 8]
test rcx, rcx
je 0x140010b97
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov qword [rbx + 0x30], rdx
test byte [rbx + 0x44], 4
je 0x140010bcf
mov dword [rbx], 0xdeadbeef
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov qword [rbx + 0x28], rax
mov rcx, rbx
call sym.push_pthread_mem
mov ecx, dword [0x1400772e8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, esi
call qword [sym.imp.msvcrt.dll__endthreadex]
nop
Function at 0x140010e01
Capabilities:
Hijack thread execution

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x4f8
mov rdi, rcx
call sym.__pth_gpointer_locked
mov rbx, rax
test rax, rax
je 0x140010fa9
mov rcx, qword [rax + 0x28]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140010fa9
lea rbp, [rsp + 0x20]
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x140010fa9
lea rsi, [rbx + 0x38]
mov rcx, rsi
call sym.pthread_mutex_lock
call sym.pthread_self
mov rdx, rax
mov al, byte [rbx + 0x40]
cmp rdx, rdi
jne 0x140010eb6
test al, 3
jne 0x140010ec8
and eax, 0xfffffffc
or eax, 1
mov byte [rbx + 0x40], al
lock inc dword [0x1400a6c48]
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140010e87
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [rbx + 0x44]
mov edx, eax
not edx
and dl, 3
jne 0x140010f9c
and eax, 0xfffffffe
mov rcx, rsi
mov dword [rbx + 0x44], eax
mov al, byte [rbx + 0x40]
and eax, 0xfffffff3
or eax, 4
mov byte [rbx + 0x40], al
call sym.pthread_mutex_unlock
call sym._pthread_invoke_cancel
mov edx, dword [rbx + 0x44]
not edx
and dl, 3
jne 0x140010f75
test al, 0xc
je 0x140010ee1
mov rcx, rsi
call sym.pthread_mutex_unlock
test byte [rbx + 0x40], 0xc
jne 0x140010fa9
xor eax, eax
jmp 0x140010fae
test al, 0xf
jne 0x140010fa9
mov rcx, qword [rbx + 0x28]
mov dword [rsp + 0x50], 0x100001
call qword [sym.imp.KERNEL32.dll_SuspendThread]
xor edx, edx
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140010f9c
mov rcx, qword [rbx + 0x28]
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
lea rax, [sym._pthread_invoke_cancel]
mov rcx, qword [rbx + 0x28]
mov rdx, rbp
mov qword [rsp + 0x118], rax
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov al, byte [rbx + 0x40]
and dword [rbx + 0x44], 0xfffffffe
and eax, 0xfffffff0
or eax, 5
mov byte [rbx + 0x40], al
lock inc dword [0x1400a6c48]
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140010f61
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rsi
call sym.pthread_mutex_unlock
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x140010f9c
test al, 3
jne 0x140010ec8
and eax, 0xfffffffc
or eax, 1
mov byte [rbx + 0x40], al
lock inc dword [0x1400a6c48]
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140010f9c
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rsi
call sym.pthread_mutex_unlock
jmp 0x140010eda
mov eax, 3
add rsp, 0x4f8
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x140010fba
Capabilities:
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rdi, [0x1400772d8]
mov rsi, rcx
mov rcx, rdi
mov ebx, edx
call sym.pthread_mutex_lock
mov rcx, rsi
call sym.__pthread_get_pointer
test rax, rax
je 0x140011007
cmp qword [rax + 0x1d8], rsi
jne 0x140011007
test byte [rax + 0x40], 0xc
jne 0x140011007
cmp dword [rax + 0xbc], 0
jne 0x140011007
mov rax, qword [rax + 0x28]
dec rax
cmp rax, 0xfffffffffffffffd
jbe 0x140011016
mov rcx, rdi
mov ebx, 3
call sym.pthread_mutex_unlock
jmp 0x14001103e
mov rcx, rdi
call sym.pthread_mutex_unlock
test ebx, ebx
je 0x14001103e
sub ebx, 2
cmp ebx, 0x15
ja 0x140011039
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp sym.pthread_cancel
mov ebx, 0x16
mov eax, ebx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
Function at 0x140011207
Capabilities:
Create thread
Resume thread

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rdi, rcx
mov rsi, rdx
mov rbp, r8
mov r12, r9
test rdx, rdx
je 0x140011233
cmp dword [rdx + 0x14], 1
mov eax, 0x16
jae 0x140011404
call sym.pop_pthread_mem
mov rbx, rax
test rax, rax
je 0x1400112f7
test rdi, rdi
je 0x140011253
mov rax, qword [rax + 0x1d8]
mov qword [rdi], rax
xor r11d, r11d
mov qword [rbx + 8], r12
mov r13, qword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [rbx + 0xbc], r11d
mov r12, qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbx + 0x44], 1
mov qword [rbx + 0x28], 0xffffffffffffffff
mov qword [rbx + 0x10], rbp
xor ebp, ebp
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call r13
mov qword [rbx + 0x30], rax
test rax, rax
jne 0x1400112b2
mov ecx, 0x14
test ebp, ebp
jne 0x1400112a8
xor ecx, ecx
call r12
inc ebp
cmp ebp, 5
jne 0x140011284
mov qword [rbx + 0x38], 0xffffffffffffffff
lea r12, [rbx + 0x68]
mov rcx, r12
call sym.replace_spin_keys.constprop.0
xor r10d, r10d
cmp qword [rbx + 0x30], 0
mov dword [rbx], 0xbab1f00d
mov dword [rbx + 0xc0], r10d
mov dword [rbx + 0xb8], r10d
jne 0x140011301
test rdi, rdi
je 0x1400112ef
xor r9d, r9d
mov qword [rdi], r9
mov rcx, rbx
call sym.push_pthread_mem
mov eax, 0xb
jmp 0x140011404
xor edx, edx
test rsi, rsi
je 0x14001132f
mov eax, dword [rsi]
mov rbp, qword [rsi + 0x10]
mov dword [rbx + 0x44], eax
test al, 8
je 0x14001132a
call sym.__pthread_self_lite
mov eax, dword [rax + 0xc0]
mov dword [rbx + 0xc0], eax
mov edx, ebp
jmp 0x14001132f
mov eax, dword [rsi + 0x18]
jmp 0x140011320
xor r8d, r8d
mov dword [rsp + 0x20], 4
mov r9, rbx
xor ecx, ecx
mov qword [rsp + 0x28], r8
lea r8, [sym.pthread_create_wrapper]
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov rsi, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
jbe 0x14001138d
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14001136d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbx + 0x38]
call sym.pthread_mutex_destroy
mov rcx, r12
call sym.replace_spin_keys.constprop.0
xor ecx, ecx
mov qword [rbx + 0x30], rcx
mov qword [rbx + 0x28], rcx
jmp 0x1400112e4
mov eax, dword [rbx + 0xc0]
mov edx, 0xfffffff1
cmp eax, 0xfffffff2
jl 0x1400113bb
mov edx, 0xfffffffe
cmp eax, 0xffffffff
jl 0x1400113bb
mov edx, 0xf
cmp eax, 0xe
jg 0x1400113bb
mov edx, 2
cmp eax, edx
cmovle edx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
test byte [rbx + 0x44], 4
mov rax, qword [sym.imp.KERNEL32.dll_ResumeThread]
je 0x1400113f1
xor edx, edx
mov rcx, rsi
mov qword [rbx + 0x28], rdx
call rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400113fa
mov qword [rbx + 0x28], rsi
mov rcx, rsi
call rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x140016130
Capabilities:
Read file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov r9, qword [rcx + 0x40]
mov rsi, rdx
mov rbx, rcx
mov edx, 1
mov rcx, rsi
call sym.fread
or edx, 0xffffffff
test rax, rax
jle 0x14001615a
movzx edx, byte [rsi + rax - 1]
mov dword [rbx + 0x48], edx
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x140052840
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
mov rcx, rbx
call method.std::__basic_file_char_.fd__
mov r8d, edi
mov rdx, rsi
mov ecx, eax
call sym.read
movsxd rbp, eax
inc eax
jne 0x140052878
call qword [sym.imp.msvcrt.dll__errno]
cmp dword [rax], 4
je 0x140052851
mov rax, rbp
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x14005e7e0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov rbx, rcx
test rax, rax
je 0x14005e802
mov rcx, qword [rcx]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov esi, 4
lea rdi, [rsp + 0x2c]
mov ecx, dword [rbx + 0x10]
mov r8d, esi
mov rdx, rdi
call sym.read
test eax, eax
jle 0x14005e83c
cdqe
add rdi, rax
sub rsi, rax
jne 0x14005e813
mov eax, dword [rsp + 0x2c]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
inc eax
je 0x14005e850
call rbp
lea rdx, str.random_device_could_not_be_read
mov ecx, dword [rax]
call method.std._anonymous_namespace_::__throw_syserr_int__char_const_
call rbp
cmp dword [rax], 4
je 0x14005e813
jmp 0x14005e840
Function at 0x140063250
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rdi, rcx
mov ecx, dword [rcx]
mov rbx, rdx
mov eax, ecx
not eax
test ax, 0x101
jne 0x140063270
add dword [rdx + 8], 0xc
mov sil, byte [rdi]
test sil, sil
jns 0x14006329b
xor edx, edx
test byte [rdi + 1], 2
je 0x14006328d
mov eax, dword [rbx + 0x14]
mov r8d, 0x64
cdq
idiv r8d
mov eax, dword [rdi + 4]
sub eax, 0x13
imul eax, eax, 0x64
add eax, edx
mov dword [rbx + 0x14], eax
and cx, 0x402
cmp cx, 0x400
jne 0x140063349
mov eax, esi
not eax
test al, 0x18
je 0x140063327
test esi, 4
je 0x140063327
mov eax, dword [rbx + 0x14]
lea r10, [0x1400808e0]
xor r9d, r9d
lea ecx, [rax + 0x76c]
call method.std._anonymous_namespace_::is_leap_int_
mov ecx, dword [rbx + 0x1c]
mov r8, rax
neg r8
and r8d, 0x1a
add r8, r10
movzx r11d, word [r8 + r9*2]
mov rdx, r9
lea r9, [r9 + 1]
cmp r11d, ecx
jle 0x1400632e3
test esi, 8
jne 0x140063304
lea r8d, [rdx - 1]
mov dword [rbx + 0x10], r8d
and esi, 0x10
jne 0x140063324
movzx eax, al
dec edx
imul rax, rax, 0xd
movsxd rdx, edx
add rax, rdx
movzx eax, word [r10 + rax*2]
sub ecx, eax
inc ecx
mov dword [rbx + 0xc], ecx
or byte [rdi], 0x18
mov sil, byte [rdi]
mov edx, dword [rbx + 0x10]
test esi, 8
jne 0x14006333a
cmp edx, 0xb
ja 0x140063349
mov ecx, dword [rbx + 0x14]
mov r8d, dword [rbx + 0xc]
call method.std._anonymous_namespace_::day_of_the_week_int__int__int_
mov dword [rbx + 0x18], eax
mov eax, dword [rdi]
and ax, 0x404
cmp ax, 0x400
jne 0x140063394
movsxd r9, dword [rbx + 0x10]
test esi, 8
jne 0x140063367
cmp r9d, 0xb
ja 0x140063394
mov eax, dword [rbx + 0x14]
lea ecx, [rax + 0x76c]
call method.std._anonymous_namespace_::is_leap_int_
lea rcx, [0x1400808e0]
mov edx, dword [rbx + 0xc]
movzx eax, al
imul rax, rax, 0xd
add rax, r9
movzx eax, word [rcx + rax*2]
lea eax, [rdx + rax - 1]
mov dword [rbx + 0x1c], eax
test esi, 0x60
je 0x140063477
test esi, 2
je 0x140063477
mov ebp, dword [rbx + 0x14]
test esi, 4
jne 0x140063409
mov r12d, esi
mov r8d, 1
xor edx, edx
mov ecx, ebp
call method.std._anonymous_namespace_::day_of_the_week_int__int__int_
shr r12b, 5
mov r8d, 7
and r12d, 1
xor r12d, 1
sub eax, r12d
mov edx, eax
mov eax, r8d
sub eax, edx
cdq
idiv r8d
mov al, byte [rdi + 2]
and eax, 0x3f
dec eax
imul eax, eax, 7
lea ecx, [rdx + rax]
mov eax, dword [rbx + 0x18]
sub eax, r12d
add eax, 7
cdq
idiv r8d
add ecx, edx
mov dword [rbx + 0x1c], ecx
mov eax, esi
not eax
test al, 0x18
je 0x140063477
lea ecx, [rbp + 0x76c]
lea r10, [0x1400808e0]
xor r9d, r9d
call method.std._anonymous_namespace_::is_leap_int_
mov ecx, dword [rbx + 0x1c]
mov r8, rax
neg r8
and r8d, 0x1a
add r8, r10
movzx r11d, word [r8 + r9*2]
mov rdx, r9
lea r9, [r9 + 1]
cmp r11d, ecx
jle 0x140063436
test esi, 8
jne 0x140063457
lea r8d, [rdx - 1]
mov dword [rbx + 0x10], r8d
and esi, 0x10
jne 0x140063477
movzx eax, al
dec edx
imul rax, rax, 0xd
movsxd rdx, edx
add rax, rdx
movzx eax, word [r10 + rax*2]
sub ecx, eax
inc ecx
mov dword [rbx + 0xc], ecx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret