joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000275b0
Capabilities:
Delete registry key
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x90
and dword [rax + 0x10], 0
and qword [rax + 0x18], 0
mov rbp, rcx
lea rcx, [rax - 0x68]
lea rdx, [0x10002ee60]
xor esi, esi
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
and qword [rsp + 0x68], rsi
and qword [rsp + 0x80], rsi
and qword [rsp + 0x88], rsi
lea rax, [rsp + 0x40]
mov dword [rsp + 0x60], 0x30
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x78], 0x40
call fcn.100027740
mov edi, eax
test eax, eax
js 0x1000276e2
lea rax, [rsp + 0xb8]
lea r8, [rsp + 0x60]
lea rcx, [rsp + 0xc0]
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov edx, 0xf003f
mov dword [rsp + 0x28], 1
and qword [rsp + 0x20], rsi
call qword [sym.imp.ntdll.dll_NtCreateKey]
mov edi, eax
test eax, eax
js 0x1000276e2
mov rbx, qword [rsp + 0xc0]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbp
lea rdx, [0x10002eee0]
repne scasw ax, word [rdi]
not rcx
lea edi, [rcx + rcx]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea r9d, [rsi + 1]
lea rdx, [rsp + 0x50]
xor r8d, r8d
mov rcx, rbx
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ntdll.dll_NtSetValueKey]
mov edi, eax
test eax, eax
js 0x1000276e2
mov ecx, 0x60019
call fcn.100021a60
mov rsi, rax
test rax, rax
jne 0x1000276c6
mov edi, 0xc0000001
jmp 0x1000276e2
mov rcx, qword [rsp + 0xc0]
mov r8, rax
mov edx, 4
call qword [sym.imp.ntdll.dll_NtSetSecurityObject]
mov edi, eax
test eax, eax
jns 0x1000276f0
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.ntdll.dll_NtDeleteKey]
mov rcx, qword [rsp + 0xc0]
test rcx, rcx
je 0x100027703
call qword [sym.imp.ntdll.dll_NtClose]
test rsi, rsi
je 0x100027724
mov rax, qword gs:[0x30]
mov r8, rsi
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, edi
mov rbx, qword [rsp + 0xb0]
add rsp, 0x90
pop rdi
pop rsi
pop rbp
ret
Function at 0x100027740
Capabilities:
Delete registry key

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x20
and qword [rax + 8], 0
lea r9, [rax + 8]
lea rdx, [0x10002ee60]
mov r8d, 0x60019
xor ecx, ecx
xor esi, esi
call fcn.100027a60
mov edi, eax
test eax, eax
jns 0x1000277c4
cmp eax, 0xc0000034
jne 0x10002777e
xor edi, edi
mov rbx, qword [rsp + 0x30]
test rbx, rbx
je 0x100027791
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtClose]
test rsi, rsi
je 0x1000277b2
mov rax, qword gs:[0x30]
mov r8, rsi
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, edi
add rsp, 0x20
pop rdi
ret
mov ecx, 0xf003f
call fcn.100021a60
mov rbx, qword [rsp + 0x30]
mov rsi, rax
test rax, rax
jne 0x1000277e2
mov edi, 0xc0000001
jmp 0x100027783
mov r8, rax
mov edx, 4
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtSetSecurityObject]
mov edi, eax
test eax, eax
js 0x100027783
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtClose]
and qword [rsp + 0x30], 0
lea r9, [rsp + 0x30]
lea rdx, [0x10002ee60]
mov r8d, 0xf003f
xor ecx, ecx
call fcn.100027a60
mov edi, eax
test eax, eax
js 0x10002777e
mov rbx, qword [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtDeleteKey]
mov edi, eax
jmp 0x100027783
Function at 0x100027afc
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rbp, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x88]
xor edi, edi
and qword [rax + 0x18], rdi
and qword [rbp], rdi
and dword [rsi], edi
lea rcx, [rax - 0x28]
mov rbx, r8
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
test rbx, rbx
je 0x100027b5c
lea r9, [rsp + 0x70]
mov r8d, 0x20019
mov rdx, rbx
xor ecx, ecx
call fcn.100027a60
mov ebx, eax
test eax, eax
jns 0x100027b61
jmp 0x100027c59
and qword [rsp + 0x70], rdi
mov rcx, qword [rsp + 0x70]
xor r9d, r9d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], edi
lea r8d, [r9 + 2]
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
mov ebx, eax
cmp eax, 0xc0000023
je 0x100027ba1
test eax, eax
js 0x100027c59
mov ebx, 0xc0000001
jmp 0x100027c59
mov rax, qword gs:[0x30]
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdi, rax
test rax, rax
jne 0x100027bd1
mov ebx, 0xc000009a
jmp 0x100027c59
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x80]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x60]
mov r9, rdi
mov r8d, 2
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
mov ebx, eax
test eax, eax
js 0x100027c59
cmp dword [rdi + 4], 1
je 0x100027c12
mov ebx, 0xc0000024
jmp 0x100027c59
add dword [rsp + 0x60], 0xfffffff4
mov rax, qword gs:[0x30]
mov r8d, dword [rsp + 0x60]
mov rcx, qword [rax + 0x60]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov qword [rbp], rax
test rax, rax
je 0x100027bc7
mov r8d, dword [rsp + 0x60]
lea rdx, [rdi + 0xc]
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov r11d, dword [rsp + 0x60]
xor ebx, ebx
mov dword [rsi], r11d
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x100027c69
call qword [sym.imp.ntdll.dll_NtClose]
test rdi, rdi
je 0x100027c8a
mov rax, qword gs:[0x30]
mov r8, rdi
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x10002864c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x100028712
test rdx, rdx
je 0x100028712
xor r9d, r9d
lea rdx, [0x100008248]
lea esi, [r9 + 1]
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
jne 0x100028693
xor ebx, ebx
jmp 0x1000286a2
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
lea rdx, [0x100008248]
xor r9d, r9d
mov r8, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
je 0x1000286c9
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rbx, rbx
je 0x100028707
test rax, rax
je 0x100028707
mov ecx, 0xfecdfecd
cmp dword [rbx], ecx
jne 0x100028701
cmp dword [rax], ecx
jne 0x100028701
mov rdx, qword [rbx + 0x1c]
cmp rdx, qword [rax + 0x1c]
jne 0x1000286f8
mov rdx, qword [rbx + 0x24]
cmp rdx, qword [rax + 0x24]
jne 0x1000286f8
xor eax, eax
jmp 0x1000286fd
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x100028703
xor esi, esi
mov eax, esi
jmp 0x100028714
mov ecx, 0xd
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1000287f8
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x100032100]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov eax, dword [0x100032ab8]
test eax, eax
jne 0x1000288fd
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x11c
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x10002885b
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov ecx, dword [rsp + 0x30]
mov edx, dword [rsp + 0x24]
xor eax, eax
lea r8d, [rax + 1]
mov dword [0x100032ab8], eax
sub ecx, r8d
je 0x1000288dd
cmp ecx, r8d
jne 0x1000288fd
cmp edx, 5
jne 0x1000288cb
mov ecx, dword [rsp + 0x28]
test ecx, ecx
je 0x1000288c4
sub ecx, r8d
je 0x1000288af
cmp ecx, r8d
je 0x100028899
lea eax, [rdx + 0xf]
jmp 0x1000288f7
cmp word [rsp + 0x134], r8w
mov ecx, 0x10
cmovae eax, ecx
or eax, 4
jmp 0x1000288f7
mov edx, 8
lea ecx, [rdx - 6]
cmp word [rsp + 0x134], cx
cmovae eax, edx
jmp 0x1000288aa
mov eax, 4
jmp 0x1000288f7
cmp edx, 4
ja 0x100028915
mov ecx, 2
mov eax, ecx
mov dword [0x100032ab8], ecx
cmp edx, 4
jne 0x1000288fd
mov ecx, dword [rsp + 0x28]
test ecx, ecx
je 0x1000288f4
cmp ecx, 0xa
je 0x1000288f4
cmp ecx, 0x5a
jne 0x1000288fd
mov eax, r8d
mov dword [0x100032ab8], eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1000296e0
add rsp, 0x158
ret
mov eax, 0x20
jmp 0x1000288f7
Function at 0x10002942c
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], r12
push r13
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
xor r12d, r12d
xor eax, eax
lock cmpxchg qword [0x100032ae0], rdi
je 0x10002947a
cmp rax, rdi
jne 0x10002946d
mov edi, 1
mov r12d, edi
jmp 0x10002947f
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100029451
mov edi, 1
mov eax, dword [0x100032ad8]
cmp eax, edi
jne 0x100029495
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x1000294f2
mov eax, dword [0x100032ad8]
test eax, eax
jne 0x1000294ec
mov dword [0x100032ad8], edi
lea r13, [0x100001538]
lea rsi, [0x100001520]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], eax
cmp rsi, r13
jae 0x1000294de
test eax, eax
jne 0x1000294de
mov rcx, qword [rsi]
test rcx, rcx
je 0x1000294d3
call rcx
mov dword [rsp + 0x20], eax
add rsi, 8
mov qword [rsp + 0x28], rsi
jmp 0x1000294bc
test eax, eax
je 0x1000294f2
mov eax, 0xff
jmp 0x1000295c4
mov dword [0x1000324dc], edi
mov eax, dword [0x100032ad8]
cmp eax, edi
jne 0x100029519
lea rdx, [0x100001518]
lea rcx, [0x100001508]
call sub.msvcrt.dll__initterm
mov dword [0x100032ad8], 2
test r12d, r12d
jne 0x100029527
xor eax, eax
xchg qword [0x100032ae0], rax
cmp qword [0x100032ae8], 0
je 0x100029550
lea rcx, [0x100032ae8]
call fcn.100029e3c
test eax, eax
je 0x100029550
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x100032ae8]
mov r8, qword [0x1000324c0]
mov rdx, qword [0x1000324c8]
mov ecx, dword [0x1000324b8]
call fcn.1000198c8
mov dword [0x1000324d8], eax
cmp dword [0x1000324bc], 0
jne 0x100029580
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1000324dc], 0
jne 0x100029595
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1000324d8]
jmp 0x1000295c4
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
add rsp, 0x30
pop r13
ret
sub rsp, 0x28
call fcn.100029f50
add rsp, 0x28
jmp 0x10002942c
Function at 0x1000296e0
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x100032100]
jne 0x1000296fb
rol rcx, 0x10
test cx, 0xffff
jne 0x1000296f7
ret 0
ror rcx, 0x10
jmp 0x10002a00c
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x100032590]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov r11, qword [0x100032688]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.ntdll.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x10002a091
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x100032590]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.ntdll.dll_RtlVirtualUnwind
jmp 0x10002a0b3
mov rax, qword [rsp + 0x88]
mov qword [0x100032688], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x100032628], rax
mov rax, qword [0x100032688]
mov qword [0x100032500], rax
mov rax, qword [rsp + 0x90]
mov qword [0x100032610], rax
mov dword [0x1000324f0], 0xc0000409
mov dword [0x1000324f4], 1
mov rax, qword [0x100032100]
mov qword [rsp + 0x68], rax
mov rax, qword [0x100032108]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x100001598]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x100029744
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x530
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x1000297af
and qword [rsp + 0x38], 0
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x50]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov r8, rbx
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlVirtualUnwind]
jmp 0x1000297cf
mov rax, qword [rsp + 0x538]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x538]
mov qword [rsp + 0xf8], rax
lea rcx, [0x100001560]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add rsp, 0x530
pop rbx
ret

Function at 0x100029ea8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x100029ef5
cmp rcx, 0xffffffffffffffff
je 0x100029ef5
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x100029eed
cmp dword [rcx + 0x3c], edx
jl 0x100029eed
cmp dword [rcx + 0x3c], 0x10000000
jae 0x100029eed
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x100029ef5
mov rax, rdx
add rsp, 0x18
ret
Function at 0x10002c648
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov rsi, rcx
cmp rcx, rdi
jne 0x10002c686
call qword [sym.imp.msvcrt.dll__errno]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
mov dword [rax], 0x16
call fcn.1000297ec
jmp 0x10002c78c
mov eax, dword [rcx + 0x18]
test al, 0x83
je 0x10002c78c
test al, 0x40
jne 0x10002c78c
test al, 2
je 0x10002c6a8
or eax, 0x20
mov dword [rcx + 0x18], eax
jmp 0x10002c78c
or eax, 1
mov dword [rcx + 0x18], eax
test eax, 0x10c
je 0x10002c661
mov rbx, qword [rcx + 0x10]
mov qword [rcx], rbx
call qword [sym.imp.msvcrt.dll__fileno]
mov r8d, dword [rsi + 0x24]
mov ecx, eax
mov rdx, rbx
call qword [sym.imp.msvcrt.dll__read]
mov dword [rsi + 8], eax
cmp eax, edi
je 0x10002c77c
cmp eax, 0xffffffff
je 0x10002c77c
test byte [rsi + 0x18], 0x82
jne 0x10002c74e
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__fileno]
cmp eax, 0xffffffff
je 0x10002c738
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__fileno]
cmp eax, 0xfffffffe
je 0x10002c738
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__fileno]
mov rbx, qword [sym.imp.msvcrt.dll___pioinfo]
mov rcx, rsi
movsxd rdi, eax
sar rdi, 5
call qword [sym.imp.msvcrt.dll__fileno]
mov r11d, eax
and r11d, 0x1f
imul r11, r11, 0x38
add r11, qword [rbx + rdi*8]
jmp 0x10002c73f
mov r11, qword [sym.imp.msvcrt.dll___badioinfo]
mov al, byte [r11 + 8]
and al, 0x82
cmp al, 0x82
jne 0x10002c74e
bts dword [rsi + 0x18], 0xd
cmp dword [rsi + 0x24], 0x200
jne 0x10002c76b
test byte [rsi + 0x18], 8
je 0x10002c76b
bt dword [rsi + 0x18], 0xa
jb 0x10002c76b
mov dword [rsi + 0x24], 0x1000
mov rcx, qword [rsi]
dec dword [rsi + 8]
movzx eax, byte [rcx]
inc rcx
mov qword [rsi], rcx
jmp 0x10002c78f
neg eax
mov dword [rsi + 8], edi
sbb eax, eax
and eax, 0x10
add eax, 0x10
or dword [rsi + 0x18], eax
or eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x10002e4c8
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov rsi, rcx
cmp rcx, rdi
jne 0x10002e506
call qword [sym.imp.msvcrt.dll__errno]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
mov dword [rax], 0x16
call fcn.1000297ec
jmp 0x10002e617
mov eax, dword [rcx + 0x18]
test al, 0x83
je 0x10002e617
test al, 0x40
jne 0x10002e617
test al, 2
je 0x10002e528
or eax, 0x20
mov dword [rcx + 0x18], eax
jmp 0x10002e617
or eax, 1
mov dword [rcx + 0x18], eax
test eax, 0x10c
je 0x10002e4e1
mov rbx, qword [rcx + 0x10]
mov qword [rcx], rbx
call qword [sym.imp.msvcrt.dll__fileno]
mov r8d, dword [rsi + 0x24]
mov ecx, eax
mov rdx, rbx
call qword [sym.imp.msvcrt.dll__read]
mov dword [rsi + 8], eax
cmp eax, edi
je 0x10002e607
cmp eax, 1
je 0x10002e607
cmp eax, 0xffffffff
je 0x10002e607
test byte [rsi + 0x18], 0x82
jne 0x10002e5d7
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__fileno]
cmp eax, 0xffffffff
je 0x10002e5c1
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__fileno]
cmp eax, 0xfffffffe
je 0x10002e5c1
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__fileno]
mov rbx, qword [sym.imp.msvcrt.dll___pioinfo]
mov rcx, rsi
movsxd rdi, eax
sar rdi, 5
call qword [sym.imp.msvcrt.dll__fileno]
mov r11d, eax
and r11d, 0x1f
imul r11, r11, 0x38
add r11, qword [rbx + rdi*8]
jmp 0x10002e5c8
mov r11, qword [sym.imp.msvcrt.dll___badioinfo]
mov al, byte [r11 + 8]
and al, 0x82
cmp al, 0x82
jne 0x10002e5d7
bts dword [rsi + 0x18], 0xd
cmp dword [rsi + 0x24], 0x200
jne 0x10002e5f4
test byte [rsi + 0x18], 8
je 0x10002e5f4
bt dword [rsi + 0x18], 0xa
jb 0x10002e5f4
mov dword [rsi + 0x24], 0x1000
mov rcx, qword [rsi]
add dword [rsi + 8], 0xfffffffe
movzx eax, word [rcx]
add rcx, 2
mov qword [rsi], rcx
jmp 0x10002e61c
neg eax
mov dword [rsi + 8], edi
sbb eax, eax
and eax, 0x10
add eax, 0x10
or dword [rsi + 0x18], eax
mov eax, 0xffff
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400364b0
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x1400b9328]
xor rax, rsp
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x140036549
mov qword [rsp + 0x50], rdi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword gs:[0x58]
mov edi, eax
mov eax, 4
mov dword [rsp + 0x24], 0
mov rdx, qword [rcx]
mov ecx, dword [rax + rdx]
cmp dword [0x1400bf1a0], ecx
jle 0x140036530
lea rcx, [0x1400bf1a0]
call fcn.14006750c
cmp dword [0x1400bf1a0], 0xffffffff
jne 0x140036530
lea rcx, [0x140099bc0]
call fcn.1400677f8
lea rcx, [0x1400bf1a0]
call fcn.1400674a0
lea rax, [0x1400b9f40]
mov dword [rsp + 0x20], edi
test edi, edi
mov qword [rsp + 0x28], rax
mov rdi, qword [rsp + 0x50]
jne 0x14003655e
mov eax, ebx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140067480
add rsp, 0x40
pop rbx
ret
lea rdx, [0x1400a88f0]
lea rcx, [rsp + 0x20]
call fcn.140036380
int3

Function at 0x140036630
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x1400b9328]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rax, qword [rcx + 0x10]
lea rdx, [rsp + 0x20]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rax, qword [rcx + 8]
mov rbx, rcx
mov r9d, 0xffffffff
mov qword [rsp + 0x28], rax
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lock xadd dword [0x1400bf1a4], eax
mov rcx, qword [rbx + 8]
test eax, eax
je 0x1400366a9
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140067480
add rsp, 0x40
pop rbx
ret
mov rdx, rcx
xor r8d, r8d
lea rcx, [fcn.1400366e0]
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, qword [rbx + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140067480
add rsp, 0x40
pop rbx
ret

Function at 0x140038000
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [0x1400bf208]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140038039
mov rdx, qword [rax + 8]
mov r8, rbx
add rsp, 0x20
pop rbx
jmp fcn.14003e460
xor edx, edx
mov r8, rbx
add rsp, 0x20
pop rbx
jmp fcn.14003e460

Function at 0x140038050
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
sub rsp, 0x28
mov rbx, rcx
mov rdi, rdx
mov ecx, dword [0x1400bf208]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor r8d, r8d
test rax, rax
je 0x140038080
mov r9, qword [rax + 8]
jmp 0x140038083
mov r9, r8
cmp rdi, 0x3fc
ja 0x1400380a7
test r9, r9
je 0x1400380a7
mov rax, r8
cmp qword [r9 + rax*8], 0
je 0x1400380b5
inc r8d
inc rax
cmp rax, 2
jl 0x140038094
mov rcx, rbx
add rsp, 0x28
pop rdi
pop rbx
jmp case.0x1400617fb.0
movzx eax, byte [rbx + rdi]
mov byte [rbx], al
movsxd rax, r8d
mov qword [r9 + rax*8], rbx
add rsp, 0x28
pop rdi
pop rbx
ret
Function at 0x140038350
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x40
mov rax, qword [0x1400b9328]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rax, qword [rcx]
xor r14d, r14d
mov rbx, rcx
mov qword [rdx], r14
mov rsi, rdx
mov qword [rdx + 8], r14
mov rbp, r8
mov edx, r14d
mov rcx, qword [rax]
mov r9d, r14d
test rcx, rcx
je 0x1400383b7
mov rax, qword [rcx]
lea rdx, [rsp + 0x20]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r9, qword [rax]
mov rdx, qword [rax + 8]
mov rax, qword [rbx]
mov qword [rsi], r9
mov qword [rsi + 8], rdx
mov qword [rax], r14
cmp rbp, rdx
jbe 0x1400384d4
mov ebx, 6
test r9, r9
je 0x140038419
mov ecx, dword [0x1400bf208]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400383e1
mov rdx, qword [rax + 8]
jmp 0x1400383e4
mov rdx, r14
mov r9, qword [rsi + 8]
mov r8, qword [rsi]
cmp r9, 0x3fc
ja 0x140038411
test rdx, rdx
je 0x140038411
mov ecx, ebx
mov rax, rbx
nop
cmp qword [rdx + rax*8], r14
je 0x14003847a
inc ecx
inc rax
cmp rax, 8
jl 0x140038400
mov rcx, r8
call case.0x1400617fb.0
mov ecx, dword [0x1400bf208]
mov qword [rsp + 0x50], rdi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
lea rdi, [rbp + 3]
shr rdi, 2
test rax, rax
je 0x1400384a6
mov r9, qword [rax + 8]
test r9, r9
je 0x1400384a6
mov ecx, ebx
lea r8, [r9 + 0x30]
mov rdx, qword [r8]
test rdx, rdx
je 0x140038456
movzx eax, byte [rdx]
cmp rax, rdi
jae 0x14003848b
inc ecx
add r8, 8
cmp ecx, 8
jl 0x140038446
mov rax, rbx
mov rcx, qword [r9 + rax*8]
test rcx, rcx
jne 0x14003849a
inc ebx
inc rax
cmp rax, 8
jl 0x140038464
jmp 0x1400384a6
movzx eax, byte [r8 + r9]
mov byte [r8], al
movsxd rax, ecx
mov qword [rdx + rax*8], r8
jmp 0x140038419
movsxd rax, ecx
mov qword [r9 + rax*8], r14
movzx eax, byte [rdx]
mov byte [rdx + rbp], al
jmp 0x1400384c8
movsxd rax, ebx
mov qword [r9 + rax*8], r14
call case.0x1400617fb.0
lea rcx, [rdi*4 + 1]
call fcn.140067584
cmp rdi, 0xff
movzx ecx, dil
mov rdx, rax
cmova ecx, r14d
mov byte [rax + rbp], cl
mov rdi, qword [rsp + 0x50]
mov qword [rsi], rdx
mov qword [rsi + 8], rbp
mov rax, rsi
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140067480
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret