joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140015c80
Capabilities:
Get thread local storage value
Hijack thread execution

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x4f8
test rcx, rcx
mov rsi, rcx
je 0x140015d70
lea rdi, [0x14006ba48]
mov rcx, rdi
call sym.pthread_mutex_lock
mov rcx, rsi
call sym.__pthread_get_pointer
mov rcx, rdi
mov rbx, rax
call sym.pthread_mutex_unlock
test rbx, rbx
je 0x140015d70
mov rcx, qword [rbx + 0x28]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140015d70
lea rdi, [rsp + 0x20]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x140015d70
lea rbp, [rbx + 0x38]
mov rcx, rbp
call sym.pthread_mutex_lock
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x14006ba58]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140015e80
cmp rsi, qword [rax + 0x1d8]
movzx edx, byte [rbx + 0x40]
je 0x140015d88
mov eax, dword [rbx + 0x44]
and eax, 3
cmp eax, 3
je 0x140015de0
test dl, 3
jne 0x140015d60
and edx, 0xfffffffc
or edx, 1
mov byte [rbx + 0x40], dl
lock add dword [0x140079bf8], 1
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140015d51
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rbp
call sym.pthread_mutex_unlock
xor eax, eax
jmp 0x140015d75
mov rcx, rbp
call sym.pthread_mutex_unlock
test byte [rbx + 0x40], 0xc
je 0x140015d59
nop
mov eax, 3
add rsp, 0x4f8
pop rbx
pop rsi
pop rdi
pop rbp
ret
test dl, 3
jne 0x140015d60
and edx, 0xfffffffc
or edx, 1
mov byte [rbx + 0x40], dl
lock add dword [0x140079bf8], 1
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140015dad
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [rbx + 0x44]
mov edx, eax
and edx, 3
cmp edx, 3
jne 0x140015d51
and eax, 0xfffffffe
mov rcx, rbp
mov dword [rbx + 0x44], eax
movzx eax, byte [rbx + 0x40]
and eax, 0xfffffff3
or eax, 4
mov byte [rbx + 0x40], al
call sym.pthread_mutex_unlock
call sym._pthread_invoke_cancel
nop word [rax + rax]
test dl, 0xc
jne 0x140015d60
and edx, 0xf
jne 0x140015d70
mov rcx, qword [rbx + 0x28]
mov dword [rsp + 0x50], 0x100001
call qword [sym.imp.KERNEL32.dll_SuspendThread]
xor edx, edx
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140015d51
mov rcx, qword [rbx + 0x28]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
lea rax, [sym._pthread_invoke_cancel]
mov rcx, qword [rbx + 0x28]
mov rdx, rdi
mov qword [rsp + 0x118], rax
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
movzx eax, byte [rbx + 0x40]
and dword [rbx + 0x44], 0xfffffffe
and eax, 0xfffffff0
or eax, 5
mov byte [rbx + 0x40], al
lock add dword [0x140079bf8], 1
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140015e68
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rbp
call sym.pthread_mutex_unlock
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x140015d51
call sym.__pthread_self_lite.part.0
test rax, rax
jne 0x140015d10
movzx edx, byte [rbx + 0x40]
jmp 0x140015d1d
Function at 0x140015ea0
Capabilities:
Get thread local storage value
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rdi, [0x14006ba48]
mov rbx, rcx
mov rcx, rdi
mov esi, edx
call sym.pthread_mutex_lock
mov rcx, rbx
call sym.__pthread_get_pointer
test rax, rax
je 0x140015f18
cmp qword [rax + 0x1d8], rbx
jne 0x140015f18
test byte [rax + 0x40], 0xc
jne 0x140015f18
mov edx, dword [rax + 0xbc]
test edx, edx
jne 0x140015f18
mov rax, qword [rax + 0x28]
sub rax, 1
cmp rax, 0xfffffffffffffffd
ja 0x140015f18
mov rcx, rdi
call sym.pthread_mutex_unlock
test esi, esi
je 0x140015f30
lea edx, [rsi - 2]
cmp edx, 0x15
ja 0x140015f38
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp sym.pthread_cancel
mov rcx, rdi
call sym.pthread_mutex_unlock
mov eax, 3
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor eax, eax
jmp 0x140015f25
mov eax, 0x16
jmp 0x140015f25

Function at 0x140016100
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov esi, ecx
mov rdi, rdx
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x14006ba58]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x140016170
cmp esi, 1
ja 0x14001617d
lea rbp, [rbx + 0x38]
mov rcx, rbp
call sym.pthread_mutex_lock
test rdi, rdi
je 0x140016144
mov eax, dword [rbx + 0x44]
and eax, 1
mov dword [rdi], eax
mov eax, dword [rbx + 0x44]
mov rcx, qword [rbx + 0x1d8]
and eax, 0xfffffffe
or eax, esi
mov dword [rbx + 0x44], eax
call sym.test_cancel_locked
mov rcx, rbp
call sym.pthread_mutex_unlock
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
call sym.__pthread_self_lite.part.0
test rax, rax
mov rbx, rax
jne 0x140016126
mov eax, 0x16
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x140016190
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov esi, ecx
mov rdi, rdx
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x14006ba58]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x140016208
mov ebp, esi
and ebp, 0xfffffffd
jne 0x140016215
lea r12, [rbx + 0x38]
mov rcx, r12
call sym.pthread_mutex_lock
test rdi, rdi
je 0x1400161d8
mov eax, dword [rbx + 0x44]
and eax, 2
mov dword [rdi], eax
mov eax, dword [rbx + 0x44]
mov rcx, qword [rbx + 0x1d8]
and eax, 0xfffffffd
or eax, esi
mov dword [rbx + 0x44], eax
call sym.test_cancel_locked
mov rcx, r12
call sym.pthread_mutex_unlock
mov eax, ebp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call sym.__pthread_self_lite.part.0
test rax, rax
mov rbx, rax
jne 0x1400161b8
mov ebp, 0x16
mov eax, ebp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x1400164c0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
test rcx, rcx
mov rsi, rcx
mov rbp, rdx
je 0x1400165e0
lea rdi, [0x14006ba48]
mov rcx, rdi
call sym.pthread_mutex_lock
mov rcx, rsi
call sym.__pthread_get_pointer
mov rcx, rdi
mov rbx, rax
call sym.pthread_mutex_unlock
test rbx, rbx
je 0x1400165e0
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x1400165e0
lea rdx, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x1400165e0
test byte [rbx + 0x44], 4
jne 0x1400165f0
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x14006ba58]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140016610
cmp rsi, qword [rax + 0x1d8]
je 0x140016638
mov eax, dword [rbx + 0xbc]
mov rcx, qword [rbx + 0x28]
test eax, eax
je 0x14001656b
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14001657a
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x28]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14001658e
call rsi
mov qword [rbx + 0x30], 0
lea rcx, [rbx + 0x38]
test rbp, rbp
je 0x140016628
mov rax, qword [rbx + 8]
mov qword [rbp], rax
call sym.pthread_mutex_destroy
lea rcx, [rbx + 0x68]
call sym.pthread_spin_destroy
cmp eax, 1
je 0x14001663f
cmp qword [rbx + 0x1d0], 0
mov qword [rbx + 0x68], 0xffffffffffffffff
je 0x140016600
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov eax, 3
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov eax, 0x16
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, rbx
call sym.push_pthread_mem.part.0
xor eax, eax
jmp 0x1400165d6
call sym.__pthread_self_lite.part.0
test rax, rax
jne 0x140016546
jmp 0x140016553
call sym.pthread_mutex_destroy
jmp 0x1400165b0
mov eax, 0x24
jmp 0x1400165e5
call sym.replace_spin_keys.part.0
nop
nop word cs:[rax + rax]
Function at 0x140016650
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
lea rbp, [0x14006ba48]
mov rsi, rcx
mov rcx, rbp
mov rdi, rdx
call sym.pthread_mutex_lock
mov rcx, rsi
call sym.__pthread_get_pointer
test rax, rax
mov rbx, rax
je 0x140016770
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x140016770
lea rdx, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x140016770
test byte [rbx + 0x44], 4
jne 0x140016790
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x14006ba58]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400167d0
mov rdx, qword [rax + 0x1d8]
cmp rsi, rdx
je 0x140016808
mov edx, dword [rbx + 0xbc]
mov rcx, qword [rbx + 0x28]
test edx, edx
jne 0x1400166f7
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1400167b0
mov rcx, qword [rbx + 0x28]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14001670b
call rsi
mov qword [rbx + 0x30], 0
lea rcx, [rbx + 0x38]
test rdi, rdi
je 0x1400167e8
mov rax, qword [rbx + 8]
mov qword [rdi], rax
call sym.pthread_mutex_destroy
lea rcx, [rbx + 0x68]
call sym.pthread_spin_destroy
cmp eax, 1
je 0x14001681a
cmp qword [rbx + 0x1d0], 0
mov qword [rbx + 0x68], 0xffffffffffffffff
je 0x1400167f8
mov rcx, rbp
call sym.pthread_mutex_unlock
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, rbp
call sym.pthread_mutex_unlock
mov eax, 3
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, rbp
call sym.pthread_mutex_unlock
mov eax, 0x16
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov eax, dword [rbx + 0xbc]
test eax, eax
jne 0x1400166f3
mov rcx, rbp
call sym.pthread_mutex_unlock
mov eax, 0x10
jmp 0x14001675e
call sym.__pthread_self_lite.part.0
xor edx, edx
test rax, rax
jne 0x1400166c5
jmp 0x1400166cc
call sym.pthread_mutex_destroy
jmp 0x14001672c
mov rcx, rbx
call sym.push_pthread_mem.part.0
jmp 0x140016754
mov rcx, rbp
call sym.pthread_mutex_unlock
mov eax, 0x24
jmp 0x14001675e
call sym.replace_spin_keys.part.0
nop
Function at 0x14001a9b0
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
cmp byte [0x14006bb60], 0
jne 0x14001aab6
mov byte [0x14006bb60], 1
call sym.__cxa_current_exception_type
test rax, rax
je 0x14001aa8c
mov rbx, qword [rax + 8]
lea r9, [rsp + 0x2c]
xor eax, eax
cmp byte [rbx], 0x2a
mov dword [rsp + 0x2c], 0xffffffff
sete al
xor r8d, r8d
xor edx, edx
add rbx, rax
mov rcx, rbx
call sym.__cxa_demangle
mov ecx, 2
mov rsi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rdi, rax
call rsi
mov edx, 1
mov r8d, 0x30
lea rcx, str.terminate_called_after_throwing_an_instance_of_
mov r9, rax
call sym.fwrite
mov edx, dword [rsp + 0x2c]
mov ecx, 2
test edx, edx
je 0x14001aa7d
call rsi
mov rcx, rbx
mov rdx, rax
call sym.fputs
mov ecx, 2
call rsi
mov r8d, 2
mov edx, 1
lea rcx, [0x14006c291]
mov r9, rax
call sym.fwrite
mov eax, dword [rsp + 0x2c]
test eax, eax
jne 0x14001aa78
mov rcx, rdi
call sym.free
call sym.__cxa_rethrow
call rsi
mov rcx, rdi
mov rdx, rax
call sym.fputs
jmp 0x14001aa47
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, 0x2d
mov edx, 1
lea rcx, str.terminate_called_without_an_active_exception_n
mov r9, rax
call sym.fwrite
call sym.abort
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, 0x1d
mov edx, 1
lea rcx, str.terminate_called_recursively_n
mov r9, rax
call sym.fwrite
call sym.abort
sub rdx, 1
mov rcx, rax
jne 0x14001ab4b
call sym.__cxa_begin_catch
mov rcx, rax
mov rax, qword [rax]
call qword [rax + 0x10]
mov ecx, 2
mov rbx, rax
call rsi
mov r9, rax
mov r8d, 0xb
mov edx, 1
lea rcx, str.__what__:
call sym.fwrite
mov ecx, 2
call rsi
mov rdx, rax
mov rcx, rbx
call sym.fputs
mov ecx, 2
call rsi
mov rdx, rax
mov ecx, 0xa
call sym.fputc
call sym.__cxa_end_catch
jmp 0x14001aab1
call sym.__cxa_begin_catch
call sym.__cxa_end_catch
jmp 0x14001aab1

Function at 0x140023700
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rcx + 8]
test rax, rax
mov rdi, rcx
je 0x140023728
mov rcx, qword [rcx]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
mov rbp, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
lea rsi, [rsp + 0x2c]
mov ebx, 4
nop dword [rax]
mov ecx, dword [rdi + 0x10]
mov r8d, ebx
mov rdx, rsi
call sym.read
test eax, eax
jle 0x140023770
cdqe
add rsi, rax
sub rbx, rax
jne 0x140023740
mov eax, dword [rsp + 0x2c]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp eax, 0xffffffff
jne 0x14002377c
call rbp
cmp dword [rax], 4
je 0x140023740
lea rcx, str.random_device_could_not_be_read
call method.std.__throw_runtime_error_char_const_
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x14002e4d0
Capabilities:
Query environment variable

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rcx, [0x14006bb00]
xor edx, edx
movabs rdi, 0x2e78786362696c67
movabs r12, 0x6c6f6f705f68652e
call sym.pthread_mutex_init
lea rcx, str.GLIBCXX_TUNABLES
pxor xmm0, xmm0
mov qword [0x14006bb18], 0
movups xmmword [0x14006bb08], xmm0
call sym.getenv
mov dword [rsp + 0x40], 0
mov rbx, rax
mov dword [rsp + 0x58], 0x100
lea rax, str.obj_size
test rbx, rbx
mov qword [rsp + 0x30], 8
mov qword [rsp + 0x38], rax
lea rax, str.obj_count
mov qword [rsp + 0x48], 9
mov qword [rsp + 0x50], rax
jne 0x14002e585
jmp 0x14002e632
mov rcx, rbx
mov edx, 0x3a
call sym.strchr
test rax, rax
mov rbx, rax
je 0x14002e5e0
xor eax, eax
cmp byte [rbx], 0x3a
sete al
add rbx, rax
cmp qword [rbx], rdi
jne 0x14002e570
cmp qword [rbx + 7], r12
jne 0x14002e570
cmp byte [rbx + 0xf], 0x2e
jne 0x14002e570
lea rbp, [rsp + 0x30]
add rbx, 0x10
lea r13, [rsp + 0x60]
mov rsi, qword [rbp]
mov rcx, qword [rbp + 8]
test rsi, rsi
je 0x14002e5cb
mov r8, rsi
mov rdx, rbx
call sym.memcmp
test eax, eax
jne 0x14002e5d5
cmp byte [rbx + rsi], 0x3d
je 0x14002e668
add rbp, 0x18
cmp rbp, r13
jne 0x14002e5af
jmp 0x14002e570
mov eax, dword [rsp + 0x58]
mov edx, 0x1000
mov ecx, 6
cmp eax, edx
cmovle edx, eax
mov eax, dword [rsp + 0x40]
test eax, eax
cmove eax, ecx
movsxd rbx, eax
movsxd rax, edx
add rbx, 0x26
imul rbx, rax
shl rbx, 3
test rbx, rbx
mov qword [0x14006bb18], rbx
jne 0x14002e642
lea rcx, [sym.__tcf_0]
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.atexit
mov qword [0x14006bb18], 0x16000
mov ebx, 0x16000
mov rcx, rbx
call sym.malloc
test rax, rax
mov qword [0x14006bb10], rax
je 0x14002e69f
xor edx, edx
mov qword [0x14006bb08], rax
mov qword [rax], rbx
mov qword [rax + 8], rdx
jmp 0x14002e61a
lea rdx, [rsp + 0x28]
xor r8d, r8d
lea rcx, [rbx + rsi + 1]
call sym.strtoul
mov rbx, qword [rsp + 0x28]
movzx edx, byte [rbx]
cmp dl, 0x3a
je 0x14002e68f
test dl, dl
jne 0x14002e570
test eax, eax
js 0x14002e570
mov dword [rbp + 0x10], eax
jmp 0x14002e570
xor ecx, ecx
mov qword [0x14006bb18], rcx
jmp 0x14002e61a
Function at 0x2fc53b690
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc53c770
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc53c092
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc55e108]
test eax, eax
je 0x2fc53c12a
lea rax, [0x2fc55e0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc55e110]
mov qword [rbp - 8], rax
jmp 0x2fc53c10e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc53c102
cmp qword [rbp - 0x10], 0
je 0x2fc53c102
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc53c0c8
lea rax, [0x2fc55e0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc53c12b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc53c230
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc53c258
mov eax, 0
jmp 0x2fc53c2a6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc53c281
mov eax, 0
jmp 0x2fc53c2a6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc53c2a1
mov eax, 0
jmp 0x2fc53c2a6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc53c2ac
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc53c32a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc53c321
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc53c321
mov rax, qword [rbp - 8]
jmp 0x2fc53c33f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc53c2f4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140001450
Capabilities:
Access peb ldr_data

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x70
movzx esi, word [section..rdata]
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
mov rbx, r8
movq xmm1, rcx
mov rcx, rdx
mov rax, qword [rax + 0x20]
mov rdi, qword [rax]
mov r8, qword [rdi - 0x10]
lea r11, [rdi - 0x10]
cmp rdi, r8
je 0x1400014d5
nop
mov rax, qword [r11 + 0x60]
lea r9, [rax + 2]
movzx eax, word [rax]
test ax, ax
je 0x1400014ca
mov edx, 0x2108
nop dword [rax]
mov r10d, edx
add r9, 2
shl r10d, 6
add edx, r10d
add edx, eax
movzx eax, word [r9 - 2]
test ax, ax
jne 0x1400014a8
cmp edx, 0xfcdfbd0e
je 0x140001532
mov r11, r8
mov r8, qword [r11]
cmp rdi, r8
jne 0x140001490
xor eax, eax
movq xmm0, rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x50]
mov rdx, rbx
punpcklqdq xmm0, xmm1
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x60], 0
movaps xmmword [rsp + 0x50], xmm0
call fcn.140002640
add rsp, 0x70
pop rbx
pop rsi
pop rdi
ret
mov edx, dword [r11 + 0x40]
mov rax, qword [r11 + 0x30]
cmp edx, 2
je 0x1400014d5
sub edx, 3
lea rdx, [rax + rdx + 1]
nop word [rax + rax]
cmp word [rax], si
je 0x1400014d7
add rax, 1
cmp rax, rdx
jne 0x140001550
jmp 0x1400014d5

Function at 0x140001570
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
movzx edi, word [section..rdata]
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
mov rbx, rcx
mov rsi, rdx
mov r8d, r8d
mov dword [rsp + 0x5c], 0
mov rax, qword [rax + 0x20]
mov rbp, qword [rax]
mov r11, qword [rbp - 0x10]
lea r10, [rbp - 0x10]
cmp rbp, r11
je 0x140001604
nop dword [rax + rax]
mov rax, qword [r10 + 0x60]
lea rcx, [rax + 2]
movzx eax, word [rax]
test ax, ax
je 0x1400015f9
mov edx, 0x2108
nop dword [rax]
mov r9d, edx
add rcx, 2
shl r9d, 6
add edx, r9d
add edx, eax
movzx eax, word [rcx - 2]
test ax, ax
jne 0x1400015d8
cmp edx, 0xfcdfbd0e
je 0x140001677
mov r10, r11
mov r11, qword [r10]
cmp rbp, r11
jne 0x1400015c0
xor eax, eax
mov qword [rsp + 0x60], rax
lea r9, [rsp + 0x5c]
mov rdx, rsi
mov rcx, rbx
mov qword [rsp + 0x40], 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x70], 0
call fcn.140002640
mov rdx, rax
xor eax, eax
test edx, edx
je 0x14000166b
mov eax, dword [rsp + 0x5c]
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov edx, dword [r10 + 0x40]
mov rax, qword [r10 + 0x30]
cmp edx, 2
je 0x140001604
sub edx, 3
lea rdx, [rax + rdx + 1]
nop dword [rax]
cmp word [rax], di
je 0x140001606
add rax, 1
cmp rdx, rax
jne 0x140001690
jmp 0x140001604
Function at 0x140001890
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
movzx edi, word [section..rdata]
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
mov rsi, r8
mov r8, r9
movq xmm1, rcx
mov rcx, rdx
mov rax, qword [rax + 0x20]
mov rbp, qword [rax]
mov rbx, qword [rbp - 0x10]
lea r9, [rbp - 0x10]
cmp rbp, rbx
je 0x14000191d
nop word [rax + rax]
mov rax, qword [r9 + 0x60]
lea r10, [rax + 2]
movzx eax, word [rax]
test ax, ax
je 0x140001912
mov edx, 0x2108
nop dword [rax]
mov r11d, edx
add r10, 2
shl r11d, 6
add edx, r11d
add edx, eax
movzx eax, word [r10 - 2]
test ax, ax
jne 0x1400018f0
cmp edx, 0xfcdfbd0e
je 0x14000198d
mov r9, rbx
mov rbx, qword [r9]
cmp rbp, rbx
jne 0x1400018d8
xor eax, eax
movq xmm0, rax
mov rdx, rsi
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x60], 0
mov r9, qword [rsp + 0xc0]
punpcklqdq xmm0, xmm1
movaps xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call fcn.140002640
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov edx, dword [r9 + 0x40]
mov rax, qword [r9 + 0x30]
cmp edx, 2
je 0x14000191d
sub edx, 3
lea rdx, [rax + rdx + 1]
nop word [rax + rax]
cmp word [rax], di
je 0x14000191f
add rax, 1
cmp rax, rdx
jne 0x1400019a8
jmp 0x14000191d