joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140014a60
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x140107b80]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140107b60]
test rbx, rbx
je 0x140014abc
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x140014ab3
test rsi, rsi
je 0x140014ab3
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140014a98
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140014df0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140102880]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140014e10
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140014e18
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140014e10
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x140014e6d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140014e64
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140014e10
add rax, 0x28
cmp rax, r9
jne 0x140014e50
xor eax, eax
ret

Function at 0x140014e70
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140102880]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x140014e8f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140014e98
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x140014e8f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140014f30
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140102880]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x140014f4f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140014f58
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x140015200
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [0x140107c00], 0xffffffff
mov r8d, 0xffff
call qword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov qword [0x140107c08], rax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x140015250
lea rdx, [0x140015110]
mov ecx, eax
mov dword [0x140107bf8], eax
call fcn.14001abc0
test eax, eax
jne 0x140015258
add rsp, 0x28
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140015247
call sub.msvcrt.dll_abort
nop
nop
Function at 0x140015260
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rsi, qword [0x140102810]
mov r11d, dword [rsi]
mov rbx, rcx
test r11d, r11d
jne 0x140015298
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x140015300
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov r12, qword [rcx + 0x10]
test r12, r12
je 0x140015310
mov esi, dword [0x140107bf8]
mov r13, qword [sym.imp.KERNEL32.dll_GetLastError]
call r13
mov edi, eax
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, edi
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rsi, rsi
je 0x140015380
mov rbp, qword [rsi]
cmp rbp, r12
jb 0x1400153c8
sub r12, 1
mov rax, qword [rsi + r12*8 + 8]
test rax, rax
jne 0x140015287
mov rcx, rbx
call fcn.140015160
mov qword [rsi + r12*8 + 8], rax
jmp 0x140015287
call fcn.140015160
mov qword [rbx + 0x10], rax
jmp 0x140015287
mov r10d, dword [rsi]
test r10d, r10d
je 0x14001542a
mov r9d, dword [0x14001b560]
test r9d, r9d
je 0x140015458
lock add dword [0x140107c00], 1
jne 0x14001548c
mov r12, qword [rbx + 0x10]
test r12, r12
je 0x140015437
mov eax, dword [rsi]
test eax, eax
je 0x1400152a1
lock sub dword [0x140107c00], 1
js 0x1400152a1
mov rcx, qword [0x140107c08]
xor r8d, r8d
mov edx, 1
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
jmp 0x1400152a1
lea rcx, [r12 + 0x21]
mov edx, 8
lea rdi, [r12 + 0x20]
call sub.msvcrt.dll_calloc
mov rsi, rax
test rax, rax
je 0x1400154b3
mov qword [rax], rdi
mov ecx, dword [0x140107bf8]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x1400152db
call r13
jmp 0x1400152db
lea rdi, [rbp + rbp]
lea rax, [r12 + 0x20]
mov rcx, rsi
cmp rdi, r12
cmovb rdi, rax
lea rdx, [rdi*8 + 8]
call sub.msvcrt.dll_realloc
mov rsi, rax
test rax, rax
je 0x1400154b3
mov qword [rax], rdi
sub rdi, rbp
lea rcx, [rax + rbp*8 + 8]
xor edx, edx
lea r8, [rdi*8]
call sub.msvcrt.dll_memset
jmp 0x1400153a3
call fcn.140015200
mov dword [0x14001b560], 1
mov edx, dword [rsi]
test edx, edx
jne 0x14001532c
mov r12, qword [rbx + 0x10]
test r12, r12
jne 0x1400152a1
mov rax, qword [0x140107bf0]
lea r12, [rax + 1]
mov qword [0x140107bf0], r12
mov qword [rbx + 0x10], r12
jmp 0x140015347
lock add dword [0x14001b564], 1
je 0x140015411
mov r8d, dword [0x14001b560]
mov rbp, qword [sym.imp.KERNEL32.dll_Sleep]
lea rdi, [0x14001b560]
test r8d, r8d
jne 0x140015420
nop dword [rax]
xor ecx, ecx
call rbp
mov ecx, dword [rdi]
test ecx, ecx
je 0x140015480
jmp 0x140015420
mov rcx, qword [0x140107c08]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14001533a
lock sub dword [0x140107c00], 1
jmp 0x14001533a
call sub.msvcrt.dll_abort
nop
nop dword [rax]
cmp qword [rcx], rdx
jae 0x1400154d0
mov qword [rcx], rdx
mov qword [rcx + 0x18], 0
cmp qword [rcx + 8], r8
jae 0x1400154da
mov qword [rcx + 8], r8
test r9, r9
je 0x1400154e4
cmp qword [rcx], rdx
je 0x1400154e8
ret
mov qword [rcx + 0x18], r9
ret
Function at 0x140002390
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbp
sub rsp, 0x570
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x560], rax
movups xmm0, xmmword [str.0123456789ABCDEF0123456789ABCDEF]
lea rdx, [0x1400052a0]
movups xmm1, xmmword [0x140005310]
lea rcx, str.shit.dll
movups xmmword [rsp + 0x140], xmm0
movups xmmword [rsp + 0x150], xmm1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rbp, rax
test rax, rax
jne 0x140002409
lea ecx, [rax + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea r8, str.shit.dll
lea rdx, str.Error:_Unable_to_open_input_file__s_n
call fcn.140002340
jmp 0x14000255a
lea rdx, [0x1400052d0]
mov qword [rsp + 0x598], r14
lea rcx, str.exploit.dll
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov r14, rax
test rax, rax
jne 0x14000245b
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea ecx, [r14 + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea r8, str.exploit.dll
lea rdx, str.Error:_Unable_to_open_output_file__s_n
call fcn.140002340
jmp 0x140002552
lea r8, [rsp + 0x20]
mov qword [rsp + 0x588], rsi
lea rdx, [rsp + 0x140]
mov ecx, pe_nt_image_headers64
call fcn.140001000
mov r9, rbp
mov dword [rsp + 0x130], eax
mov edx, 1
lea rcx, [rsp + 0x160]
mov r8d, 0x400
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rsi, rax
test eax, eax
jle 0x140002538
mov qword [rsp + 0x580], rbx
mov qword [rsp + 0x590], rdi
nop dword [rax + rax]
lea edi, [rsi - 1]
shr edi, 4
lea rbx, [rsp + 0x160]
inc edi
mov ecx, dword [rsp + 0x130]
lea r8, [rsp + 0x20]
mov r9, rbx
mov rdx, rbx
call fcn.1400019f0
add rbx, 0x10
sub rdi, 1
jne 0x1400024d0
mov r8d, esi
lea edx, [rdi + 1]
mov r9, r14
lea rcx, [rsp + 0x160]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, rbp
lea edx, [rdi + 1]
mov r8d, 0x400
lea rcx, [rsp + 0x160]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov esi, eax
test eax, eax
jg 0x1400024c0
mov rdi, qword [rsp + 0x590]
mov rbx, qword [rsp + 0x580]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rsi, qword [rsp + 0x588]
mov r14, qword [rsp + 0x598]
xor eax, eax
mov rcx, qword [rsp + 0x560]
xor rcx, rsp
call fcn.140002590
add rsp, 0x570
pop rbp
ret

Function at 0x140002e50
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002e9a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002e9a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002e9a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002e9a
cmp dword [rcx + 0x84], 0xe
jbe 0x140002e9a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002e9c
xor al, al
add rsp, 0x28
ret
Function at 0x1400166f0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x140026878], rbx
je 0x14001673c
cmp rax, rbx
jne 0x14001672f
mov ebx, 1
mov esi, ebx
jmp 0x140016741
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140016714
mov ebx, 1
mov eax, dword [0x140026880]
cmp eax, ebx
jne 0x140016757
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x1400167bc
mov eax, dword [0x140026880]
test eax, eax
jne 0x1400167b6
mov dword [0x140026880], ebx
lea r15, [0x14001a6f0]
lea rdi, [0x14001a6d8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x1400167a8
test eax, eax
jne 0x1400167ac
cmp qword [rdi], 0
je 0x14001679d
mov rax, qword [rdi]
mov rcx, qword [case.0x140006774.0]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x14001677e
test eax, eax
je 0x1400167bc
mov eax, 0xff
jmp 0x140016898
mov dword [0x140026178], ebx
mov eax, dword [0x140026880]
cmp eax, ebx
jne 0x1400167e3
lea rdx, [0x14001a6d0]
lea rcx, [0x14001a618]
call sub.msvcrt.dll__initterm
mov dword [0x140026880], 2
test esi, esi
jne 0x1400167f0
xor eax, eax
xchg qword [0x140026878], rax
cmp qword [0x140026898], 0
je 0x140016824
lea rcx, [0x140026898]
call fcn.140017310
test eax, eax
je 0x140016824
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140026898]
mov r9, qword [case.0x140006774.0]
call r9
mov r8, qword [0x140026190]
mov rdx, qword [0x140026188]
mov ecx, dword [0x140026180]
call fcn.140002c70
mov dword [0x140026174], eax
cmp dword [0x140026198], 0
jne 0x140016854
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140026178], 0
jne 0x140016869
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140026174]
jmp 0x140016898
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.140173000
add rsp, 0x28
jmp 0x1400166f0

Function at 0x140016e34
Capabilities:
Print debug messages

Disassembly:
jmp 0x140016e40
push rbx
sub rsp, 0x540
mov rax, qword [0x140026110]
xor rax, rsp
mov qword [rsp + 0x530], rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x140016ebd
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlVirtualUnwind]
jmp 0x140016edd
mov rax, qword [rsp + 0x548]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x548]
mov qword [rsp + 0xf8], rax
lea rcx, str.Invalid_parameter_passed_to_C_runtime_function._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.1400168f0
add rsp, 0x540
pop rbx
ret
Function at 0x14000b9ac
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140016950], eax
call fcn.14000b730
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x140016950], 0
jne case.default.0x14000ba02
mov ecx, 1
call fcn.14000b730
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
cmp dx, cx
cdq
test eax, 0x7def3532
invalid
Function at 0x140014740
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1400148cb
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [0x14009b8b8]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.1400305a0
xorps xmm15, xmm15
mov r14, qword [0x1404e9488]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x1400147a5
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x1400147b4
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x1400147d3
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x1400147e3
cmp rbx, 0x1000
jae 0x1400147ab
jmp 0x14001484d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x1400147f5
xor edx, edx
jmp 0x140014844
mov rcx, qword [0x14009b8b8]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.1400305a0
xorps xmm15, xmm15
mov r14, qword [0x1404e9488]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x1400147d9
jmp 0x1400147c8
call fcn.14005ec00
xorps xmm15, xmm15
mov r14, qword [0x1404e9488]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.1400349a0
lea rax, [0x1400c1371]
mov ebx, 0x18
nop dword [rax]
call fcn.140035220
mov rax, qword [rsp + 0x38]
call fcn.140034f60
lea rax, [0x1400c1680]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.140035220
mov rax, qword [rsp + 0x30]
call fcn.140034f60
call fcn.140034be0
call fcn.140034a00
lea rax, [0x1400c310a]
mov ebx, 0x21
call fcn.140033000
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.14005b540
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.140014740
Function at 0x140014900
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140014b26
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [0x14009b8b0]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.140030620
xorps xmm15, xmm15
mov r14, qword [0x1404e9488]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x140014973
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x140014982
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x1400149a5
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x1400149b5
cmp rbx, 0x1000
jae 0x140014979
nop
jmp 0x140014a38
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x1400149cd
xor esi, esi
jmp 0x140014a2a
mov rax, qword [0x14009b8b0]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.140030620
xorps xmm15, xmm15
mov r14, qword [0x1404e9488]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x1400149ab
jmp 0x140014996
call fcn.14005ec00
xorps xmm15, xmm15
mov r14, qword [0x1404e9488]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x140014ac0
nop dword [rax + rax]
call fcn.1400349a0
lea rax, [0x1400c1699]
mov ebx, 0x19
call fcn.140035220
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.140034f60
lea rax, [0x1400c1680]
mov ebx, 0x19
call fcn.140035220
mov eax, dword [rsp + 0x34]
call fcn.140034f60
nop
call fcn.140034be0
call fcn.140034a00
lea rax, [0x1400bed61]
mov ebx, 0xd
call fcn.140033000
nop dword [rax + rax]
cmp eax, 0x5af
je 0x140014a60
call fcn.1400349a0
lea rax, [0x1400c1699]
mov ebx, 0x19
call fcn.140035220
mov rax, qword [rsp + 0x38]
call fcn.140034f60
lea rax, [0x1400c1680]
mov ebx, 0x19
call fcn.140035220
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.140034f60
call fcn.140034be0
call fcn.140034a00
lea rax, [0x1400c2a8f]
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.140033000
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.14005b540
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.140014900
Function at 0x14005d340
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x1404e9520]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x1404e9268], 0
je 0x14005d375
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x1404e9800]
aesenc xmm0, xmmword [0x1404e9810]
aesenc xmm0, xmmword [0x1404e9820]
movq rax, xmm0
ret
jmp 0x140009440

Function at 0x14005d380
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x1404e9520]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x1404e9268], 0
je 0x14005d3b6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x1404e9800]
aesenc xmm0, xmmword [0x1404e9810]
aesenc xmm0, xmmword [0x1404e9820]
movq rax, xmm0
ret
jmp 0x1400094a0

Function at 0x140066900
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1400669ca
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.1400036a0
xorps xmm15, xmm15
mov r14, qword [0x1404e9488]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x1400669af
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x1400aabc0]
xor ebx, ebx
mov rcx, rdx
call fcn.140045b60
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.140066ee0
inc rbx
cmp rcx, rbx
jae 0x14006699e
mov edi, 1
lea rsi, [0x1400aabc0]
call fcn.140045c40
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x1400de288]
lea rsi, [0x1400ddc30]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.14005b540
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.140066900
Function at 0x140089da0
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140094f70
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.140094f70
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]

Function at 0x140089e10
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x50
movsxd rbx, dword [0x1404eddb4]
mov r12, rcx
test ebx, ebx
jle 0x140089f40
mov rax, qword [0x1404eddb8]
xor ecx, ecx
add rax, 0x18
nop word [rax + rax]
mov rdx, qword [rax]
cmp rdx, r12
ja 0x140089e5c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x140089ee3
add ecx, 1
add rax, 0x28
cmp ecx, ebx
jne 0x140089e40
mov rcx, r12
call fcn.14008a7b0
mov rsi, rax
test rax, rax
je 0x140089f62
mov rax, qword [0x1404eddb8]
lea rbx, [rbx + rbx*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rsi
mov dword [rax], 0
call fcn.14008a8e0
mov ecx, dword [rsi + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x1404eddb8]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140089f47
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140089edc
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140089ef0
add dword [0x1404eddb4], 1
add rsp, 0x50
pop rbx
pop rsi
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rbx, qword [0x1404eddb8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140089edc
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140089da0
nop dword [rax]
xor ebx, ebx
jmp 0x140089e67
mov rax, qword [0x1404eddb8]
mov edx, dword [rsi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140089da0
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.140089da0
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x14008a420
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x1404ede20]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1404ede00]
test rbx, rbx
je 0x14008a474
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x14008a46b
test r12, r12
je 0x14008a46b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x14008a450
lea rcx, [0x1404ede20]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]