joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419620
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov rsi, rcx
movups xmm0, xmmword [0x00453fe8]
movaps xmmword [rbp], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov rax, rbp
mov qword [rsp + 0x20], rax
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.ntdll.dll_NtWriteFile
cmp eax, 0x103
jne 0x41968f
mov rcx, rsi
mov edx, 0xffffffff
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [rbp]
cmp eax, 0x103
je 0x4196bb
test eax, eax
js 0x41969b
mov rdx, qword [rbp + 8]
xor eax, eax
jmp 0x4196b1
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa8
pop rsi
pop rbp
ret
mov dword [rbp + 0x18], 0
mov byte [rbp + 0x1c], 0
lea rax, [0x00454048]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 1
lea rax, [rbp + 0x20]
mov qword [rbp - 0x20], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
lea rcx, [rbp + 0x18]
lea rdx, [rbp - 0x30]
call fcn.00418f70
mov rcx, rax
call fcn.00418ff0
mov ecx, 7
int 0x29
ud2

Function at 0x419c30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov ecx, dword [0x004420a8]
test ecx, ecx
je 0x419d2d
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jb 0x419c61
cmp qword [rax + 8], 0
jne 0x419d1e
mov ecx, dword [0x004420a8]
test ecx, ecx
je 0x419d40
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x419d24
test rax, rax
jne 0x419cdf
mov qword [rbp - 8], 0
lea rax, [0x00442090]
mov qword [rbp - 0x10], rax
movzx eax, byte [0x0045c040]
mov ecx, 0x18
call fcn.0043d500
test rax, rax
je 0x419d6c
mov rcx, qword [rbp]
mov qword [rax + 0x10], rcx
movups xmm0, xmmword [rbp - 0x10]
movups xmmword [rax], xmm0
mov ecx, dword [0x004420a8]
test ecx, ecx
je 0x419d53
dec ecx
mov rdx, rax
mov rsi, rax
call sub.kernel32.dll_TlsSetValue
mov rax, rsi
mov rdx, qword [rax + 8]
mov rcx, qword [rax + 0x10]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov qword [rax + 8], 1
mov qword [rax + 0x10], 0
test rdx, rdx
je 0x419d1e
test rcx, rcx
je 0x419d1e
lock dec qword [rcx]
jne 0x419d1e
lea rcx, [rbp - 8]
mov rsi, rax
call fcn.00419e40
mov rax, rsi
add rax, 0x10
jmp 0x419d26
xor eax, eax
add rsp, 0x38
pop rsi
pop rbp
ret
lea rcx, [0x00442090]
call fcn.00419f00
mov ecx, eax
jmp 0x419c4b
lea rcx, [0x00442090]
call fcn.00419f00
mov ecx, eax
jmp 0x419c71
lea rcx, [0x00442090]
mov rsi, rax
call fcn.00419f00
mov ecx, eax
mov rax, rsi
jmp 0x419cd1
mov ecx, 8
mov edx, 0x18
call fcn.00406060
ud2
Function at 0x419f00
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov rsi, rcx
cmp qword [rcx], 0
je 0x419f90
mov rax, qword [0x0045f040]
mov dword [rbp], 0
lea rdi, [rsi + 0x10]
mov r8, rbp
mov rcx, rdi
xor edx, edx
xor r9d, r9d
call sub.kernel32.dll_InitOnceBeginInitialize
mov dword [rbp + 4], eax
cmp eax, 1
jne 0x419fcf
cmp dword [rbp], 0
je 0x419fb3
call sub.kernel32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x419fe4
mov ebx, eax
inc eax
mov dword [rsi + 0x18], eax
mov rax, qword [0x0045c0f8]
nop word cs:[rax + rax]
mov qword [rsi + 8], rax
lock cmpxchg qword [0x0045c0f8], rsi
jne 0x419f70
mov rcx, rdi
xor edx, edx
xor r8d, r8d
call sub.kernel32.dll_InitOnceComplete
mov eax, ebx
jmp 0x419fc6
call sub.kernel32.dll_TlsAlloc
mov dword [rbp + 4], eax
cmp eax, 0xffffffff
je 0x41a029
mov ecx, eax
inc ecx
xor eax, eax
lock cmpxchg dword [rsi + 0x18], ecx
jne 0x419fb8
mov eax, dword [rbp + 4]
jmp 0x419fc6
mov eax, dword [rsi + 0x18]
jmp 0x419fc4
mov ecx, dword [rbp + 4]
mov esi, eax
call sub.kernel32.dll_TlsFree
mov eax, esi
dec eax
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov qword [rbp - 0x30], 0
lea rcx, [rbp + 4]
lea rdx, [rbp - 0x30]
call fcn.0041a090
mov rcx, rdi
mov edx, 4
xor r8d, r8d
call sub.kernel32.dll_InitOnceComplete
lea rax, str.out_of_TLS_indexes
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 1
lea rax, str._rustc_0bf471f339837af930ec90ef5e1e9cb232e99f29library_alloc_srccollections_btree_navigate.rsIndex_out_of_bounds
mov qword [rbp - 0x20], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
lea rdx, str.library_std_src_syspalwindows_thread_local_key.rs
lea rcx, [rbp - 0x30]
call fcn.00409ae0
lea rax, str.out_of_TLS_indexes
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 1
lea rax, str._rustc_0bf471f339837af930ec90ef5e1e9cb232e99f29library_alloc_srccollections_btree_navigate.rsIndex_out_of_bounds
mov qword [rbp - 0x20], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
lea rcx, [rbp + 4]
lea rdx, [rbp - 0x30]
call fcn.0041a0e0
int3
Function at 0x41a730
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov ecx, dword [0x00442088]
test ecx, ecx
je 0x41a7cb
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jb 0x41a75c
cmp byte [rax + 8], 0
jne 0x41a7bc
mov ecx, dword [0x00442088]
test ecx, ecx
je 0x41a7de
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x41a7c2
test rax, rax
jne 0x41a7b6
movzx eax, byte [0x0045c040]
mov ecx, 0x10
call fcn.0043d500
test rax, rax
je 0x41a807
lea rcx, [0x00442070]
mov qword [rax], rcx
mov byte [rax + 8], 0
mov ecx, dword [0x00442088]
test ecx, ecx
je 0x41a7f1
dec ecx
mov rdx, rax
mov rsi, rax
call sub.kernel32.dll_TlsSetValue
mov rax, rsi
mov word [rax + 8], 1
add rax, 9
jmp 0x41a7c4
xor eax, eax
add rsp, 0x28
pop rsi
pop rbp
ret
lea rcx, [0x00442070]
call fcn.00419f00
mov ecx, eax
jmp 0x41a74b
lea rcx, [0x00442070]
call fcn.00419f00
mov ecx, eax
jmp 0x41a768
lea rcx, [0x00442070]
mov rsi, rax
call fcn.00419f00
mov ecx, eax
mov rax, rsi
jmp 0x41a7a8
mov ecx, 8
mov edx, 0x10
call fcn.00406060
int3

Function at 0x41ac30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov ecx, dword [0x00442068]
test ecx, ecx
je 0x41acf2
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jb 0x41ac66
cmp qword [rax + 8], 0
je 0x41ac66
add rax, 0x10
jmp 0x41aceb
mov ecx, dword [0x00442068]
test ecx, ecx
je 0x41ad05
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x41ace9
test rax, rax
jne 0x41accc
movzx eax, byte [0x0045c040]
mov ecx, 0x20
call fcn.0043d500
test rax, rax
je 0x41ad2e
lea rcx, [0x00442050]
mov qword [rax], rcx
mov qword [rax + 8], 0
mov ecx, dword [0x00442068]
test ecx, ecx
je 0x41ad18
dec ecx
mov rdx, rax
mov rsi, rax
call sub.kernel32.dll_TlsSetValue
mov rax, rsi
mov qword [rax + 8], 1
mov rcx, rax
add rax, 0x10
mov qword [rcx + 0x10], 0
mov byte [rcx + 0x18], 0
jmp 0x41aceb
xor eax, eax
add rsp, 0x28
pop rsi
pop rbp
ret
lea rcx, [0x00442050]
call fcn.00419f00
mov ecx, eax
jmp 0x41ac4b
lea rcx, [0x00442050]
call fcn.00419f00
mov ecx, eax
jmp 0x41ac76
lea rcx, [0x00442050]
mov rsi, rax
call fcn.00419f00
mov ecx, eax
mov rax, rsi
jmp 0x41acbe
mov ecx, 8
mov edx, 0x20
call fcn.00406060
int3
Function at 0x41c5f0
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x488
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3e8], rcx
mov qword [rbp + 0x3f0], 0
mov qword [rbp + 0x3f8], 2
mov qword [rbp + 0x400], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e0], rax
xor esi, esi
xor edi, edi
xor ebx, ebx
cmp r8, 0x201
jae 0x41c680
jmp 0x41c66f
jae 0x41c73b
cmp r8, 0x201
jae 0x41c680
mov r14d, 0x200
lea r15, [rbp - 0x60]
mov r12, r8
jmp 0x41c6d7
sub r8, rbx
sub rdi, rbx
cmp rdi, r8
jae 0x41c6af
lea rcx, [rbp + 0x3f0]
mov rdx, rbx
call fcn.0041e420
mov rsi, qword [rbp + 0x3f0]
mov rax, qword [rbp + 0x3f8]
mov qword [rbp + 0x3e0], rax
mov eax, 0xffffffff
cmp rsi, rax
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rbp + 0x400], rbx
mov rdi, rsi
mov r14, rbx
mov r15, qword [rbp + 0x3e0]
mov r12, rbx
xor ecx, ecx
call sub.kernel32.dll_SetLastError
mov ecx, r12d
mov rdx, r15
call sub.kernel32.dll_GetCurrentDirectoryW
mov r13d, eax
test eax, eax
jne 0x41c6fd
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x41c7b1
mov r8d, r13d
cmp r12, r8
jne 0x41c660
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x41c7e2
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x41c66f
jmp 0x41c680
cmp r14, r8
jb 0x41c7fc
lea rcx, [rbp + 0x3c0]
mov rdx, r15
call fcn.0041d3c0
movups xmm0, xmmword [rbp + 0x3c0]
movups xmm1, xmmword [rbp + 0x3d0]
movaps xmmword [rbp + 0x3b0], xmm1
movaps xmmword [rbp + 0x3a0], xmm0
mov rax, qword [rbp + 0x3e8]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
cmp qword [rbp + 0x3f0], 0
je 0x41c79c
mov r8, qword [rbp + 0x3f8]
mov rcx, qword [0x0045c0f0]
xor edx, edx
call sub.kernel32.dll_HeapFree
nop
add rsp, 0x488
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rcx, qword [rbp + 0x3e8]
mov qword [rcx + 8], rax
movabs rax, 0x8000000000000000
mov qword [rcx], rax
cmp qword [rbp + 0x3f0], 0
jne 0x41c787
jmp 0x41c79c
lea rcx, str.internal_error:_entered_unreachable_codeH
lea r8, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.0040a800
jmp 0x41c811
lea rax, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.0040a490
ud2
Function at 0x41e110
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
and al, 0x20
movzx r9d, byte [rdx + 0x38]
movzx eax, byte [rdx + 0x3a]
test al, al
setne r8b
cmp r9b, 1
ja 0x41e196
test al, al
jne 0x41e16f
movzx esi, byte [rdx + 0x10]
lea eax, [rsi - 5]
cmp al, 1
ja 0x41e16f
mov r10, qword [rdx]
mov rax, qword [rdx + 8]
xor r11d, r11d
test r9b, r9b
jne 0x41e166
cmp sil, 6
je 0x41e166
mov r11d, 2
cmp rax, 1
jbe 0x41e360
cmp r11, rax
jne case.0x41d748.37
xor eax, eax
test r9b, r9b
jne 0x41e19b
movzx r9d, byte [rdx + 0x10]
lea r10, [0x00443d18]
movsxd r9, dword [r10 + r9*4]
invalid
or al, 0x8a
add r9, r10
jmp r9
mov r10, qword [rdx + 0x20]
add r10, 4
jmp 0x41e19e
xor r8d, r8d
xor eax, eax
xor r10d, r10d
movzx r11d, al
movzx edi, r8b
lea r9, [r11 + rdi]
add r9, r10
mov rax, qword [rdx + 8]
cmp r9, rax
ja 0x41e345
mov rsi, qword [rdx]
lea r8, [rsi + r9]
movzx edx, byte [rdx + 0x10]
cmp r9, rax
jne 0x41e1cf
xor r11d, r11d
jmp 0x41e249
add r10, rdi
add r10, r11
add edx, ebx
sub r10, rax
inc r10
lea rdi, [rax + rsi]
dec rdi
xor r11d, r11d
cmp dl, 3
jae 0x41e210
nop word [rax + rax]
cmp byte [rdi], 0x5c
je 0x41e22b
inc r10
dec rdi
cmp r10, 1
jne 0x41e1f0
jmp 0x41e249
movzx ebx, byte [rdi]
cmp ebx, 0x2f
je 0x41e22b
cmp ebx, 0x5c
je 0x41e22b
inc r10
dec rdi
cmp r10, 1
jne 0x41e210
jmp 0x41e249
neg r10
add r9, r10
add ecx, edx
inc r9
cmp r9, rax
ja 0x41e34e
add dword [rax], eax
invalid
add rsi, r9
mov r11d, 1
mov r8, rsi
sub rax, r9
je 0x41e28c
mov r9b, 9
cmp rax, 2
je 0x41e277
cmp rax, 1
jne 0x41e28f
cmp byte [r8], 0x2e
jne 0x41e28f
xor r9d, r9d
cmp dl, 3
setae r9b
lea r9d, [r9 + r9*2]
add r9d, 7
jmp 0x41e28f
cmp byte [r8], 0x2e
jne 0x41e28f
cmp byte [r8 + 1], 0x2e
sete r9b
xor r9b, 9
jmp 0x41e28f
mov r9b, 0xa
add r11, rax
mov qword [rcx], r11
mov byte [rcx + 8], r9b
or byte [r9 + rcx*4 + 0x41], cl
adc byte [rax - 0x77], cl
sbb byte [r8 - 0x7d], cl
invalid
sub byte [rbx + 0x5f], bl
pop rsi
pop rbp
ret
add rax, r10
lea rsi, [r10 + r11]
inc rsi
cmp rsi, rax
sete al
movzx r10d, byte [r10 + r11]
movzx edx, byte [rdx + rbx]
test al, 1
jne 0x41e335
cmp r10b, 0x2e
jne 0x41e335
movzx eax, byte [rsi]
cmp al, 0x5c
sete r10b
cmp al, 0x2f
sete al
or al, r10b
jmp 0x41e171
mov r9, qword [rdx + 0x20]
mov r10, qword [rdx + 0x30]
lea r11, [r10 + 1]
test r10, r10
cmove r11, r10
lea r10, [r9 + r11]
add r10, 8
jmp 0x41e19e
cmp r10b, 0x2e
sete r10b
and al, r10b
jmp 0x41e171
lea r8, [0x00453510]
jmp 0x41e355
lea r8, [0x00453528]
mov rcx, r9
mov rdx, rax
call fcn.00409b40
lea r8, [0x004534f8]
mov ecx, 2
mov rdx, rax
call fcn.00409b40
int3
Function at 0x420400
Capabilities:
Read file via mapping

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov rax, r8
mov rsi, rcx
mov dword [rbp - 0x48], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x30], 7
mov qword [rbp - 0x2c], 0
mov word [rbp - 0x24], 0
mov byte [rbp - 0x28], 1
lea r8, [rbp - 0x48]
mov rcx, rdx
mov rdx, rax
call fcn.00438450
mov rdi, rdx
test rax, rax
je 0x420471
mov rcx, rdi
call fcn.00419010
mov qword [rsi], 0
jmp 0x420597
lea rcx, [rbp - 0x48]
mov rdx, rdi
call fcn.004386b0
cmp dword [rbp - 0x48], 2
jne 0x4204ac
mov rcx, qword [rbp - 0x40]
call fcn.00419010
mov qword [rsi], 0
mov rcx, rdi
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
jmp sub.kernel32.dll_CloseHandle
mov r12, qword [rbp - 0x10]
test rdi, rdi
je 0x4204fa
mov qword [rbp - 0x48], 0
call sub.kernel32.dll_GetCurrentProcess
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rbp - 0x48]
mov rcx, rax
mov rdx, rdi
mov r8, rax
call sub.kernel32.dll_DuplicateHandle
test eax, eax
je 0x420576
mov rbx, qword [rbp - 0x48]
jmp 0x4204fc
xor ebx, ebx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rbx
xor edx, edx
mov r8d, 2
xor r9d, r9d
call sub.kernel32.dll_CreateFileMappingA
test rax, rax
je 0x420565
mov r14, rax
mov qword [rsp + 0x20], r12
mov rcx, rax
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call sub.kernel32.dll_MapViewOfFile
mov r15, rax
mov rcx, r14
call sub.kernel32.dll_CloseHandle
test r15, r15
je 0x420565
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], r12
mov qword [rsi], 1
jmp 0x42058f
mov qword [rsi], 0
mov rcx, rbx
call sub.kernel32.dll_CloseHandle
jmp 0x42058f
call sub.kernel32.dll_GetLastError
shl rax, 0x20
lea rcx, [rax + 2]
call fcn.00419010
mov qword [rsi], 0
mov rcx, rdi
call sub.kernel32.dll_CloseHandle
nop
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
Function at 0x43b460
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov rsi, rcx
movups xmm0, xmmword [0x00453fe8]
movaps xmmword [rbp], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov rax, rbp
mov qword [rsp + 0x20], rax
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.ntdll.dll_NtReadFile
cmp eax, 0x103
jne 0x43b4c8
mov rcx, rsi
mov edx, 0xffffffff
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [rbp]
cmp eax, 0xc0000011
jne case.0x43b21e.51

Function at 0x4406f0
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.004417b0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.004417b0
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]
Function at 0x440760
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x0045c6f4]
mov r12, rcx
mov rsi, rdx
mov rbx, r8
test edi, edi
jle 0x440908
mov rax, qword [0x0045c6f8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp r12, rdx
jb 0x4407ac
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x440837
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x440790
mov rcx, r12
call fcn.004414c0
mov rbp, rax
test rax, rax
je 0x440942
mov rax, qword [0x0045c6f8]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call fcn.004415f0
mov ecx, dword [rbp + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x0045c6f8]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x440951
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x440830
sub eax, 4
and eax, 0xfffffffb
jne 0x4408c0
add dword [0x0045c6f4], 1
cmp ebx, 8
jae 0x440868
test bl, 4
jne 0x440910
test ebx, ebx
je 0x440859
movzx eax, byte [rsi]
mov byte [r12], al
test bl, 2
jne 0x440930
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi]
lea rcx, [r12 + 8]
and rcx, 0xfffffffffffffff8
mov qword [r12], rax
mov eax, ebx
mov rdx, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], rdx
sub r12, rcx
add ebx, r12d
sub rsi, r12
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x440859
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x44089a
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
add rdi, qword [0x0045c6f8]
mov qword [rdi + 8], rcx
mov r9, rdi
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x440830
call qword [sym.imp.kernel32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.004406f0
nop dword [rax]
xor edi, edi
jmp 0x4407b7
mov eax, dword [rsi]
mov ebx, ebx
mov dword [r12], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r12 + rbx - 4], eax
jmp 0x440859
mov ebx, ebx
movzx eax, word [rsi + rbx - 2]
mov word [r12 + rbx - 2], ax
jmp 0x440859
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.004406f0
mov rax, qword [0x0045c6f8]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call fcn.004406f0
nop
nop dword [rax]
Function at 0x441130
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x0045c9e0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x0045c9c0]
test rbx, rbx
je 0x441184
mov rdi, qword [sym.imp.kernel32.dll_TlsGetValue]
mov rsi, qword [sym.imp.kernel32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x44117b
test r12, r12
je 0x44117b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x441160
lea rcx, [0x0045c9e0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x4414c0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x00455350]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x441539
mov rcx, r10
call fcn.00441390
test eax, eax
je 0x441539
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x441536
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x44152d
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x441539
add r8, 0x28
cmp r8, r9
jne 0x441518
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x14000b460]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x14000b470]
mov dword [rax], 1
mov rax, qword [0x14000b480]
mov dword [rax], 1
mov rax, qword [0x14000b400]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x14000b450]
mov dword [0x14000e00c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x14000b530]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x14000b510]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x14000b3b0]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a

Function at 0x140001470
Capabilities:
Query environment variable

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x130
lea rdi, str.USERNAME
mov rsi, rcx
mov rcx, rdi
lea rbx, [rsp + 0x20]
call sub.msvcrt.dll_getenv
lea r8, str.C:Users_username_AppDataRoamingMicrosoftWindowsStart_MenuProgramsStartup
mov edx, 0x104
mov rcx, rbx
mov r9, rax
call sym.snprintf
mov rcx, rbx
call sym.strlen
mov rdx, rbx
mov rcx, rsi
mov r8, rax
call sym.strncmp
test eax, eax
je 0x140001510
mov rcx, rdi
call sub.msvcrt.dll_getenv
lea r8, str.C:WindowsSystem32_
mov edx, 0x104
mov rcx, rbx
mov r9, rax
call sym.snprintf
mov rcx, rbx
call sym.strlen
mov rdx, rbx
mov rcx, rsi
mov r8, rax
call sym.strncmp
mov edx, eax
xor eax, eax
test edx, edx
je 0x140001510
add rsp, 0x130
pop rbx
pop rsi
pop rdi
ret
mov eax, 1
jmp 0x1400014ff