joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800480f0
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push r14
push r15
sub rsp, 0x98
mov rax, qword [0x180064040]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, rcx
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r14, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
cmp rdi, 0x40000000
jbe 0x18004813f
lea rax, [rdi - 0x40000000]
cmp r14, rax
cmovb r14, rax
mov rsi, qword [0x180064fb0]
lea r15, [rdi + 0x40000000]
cmp rcx, r15
cmovbe r15, rcx
sub r15, 0xfff
test rsi, rsi
je 0x18004817d
cmp rsi, r14
jb 0x180048175
cmp rsi, r15
jae 0x180048175
cmp qword [rsi + 8], 0
jne 0x180048347
mov rsi, qword [rsi]
test rsi, rsi
jne 0x180048160
mov qword [rsp + 0xc8], rbx
mov rbx, rdi
mov qword [rsp + 0xd0], rbp
mov qword [rsp + 0x90], r12
mov r12d, 0x40
cmp rdi, r14
jb 0x180048212
nop dword [rax]
nop word [rax + rax]
mov ebp, dword [rsp + 0x78]
mov rax, rbx
xor edx, edx
div rbp
sub rbx, rdx
sub rbx, rbp
cmp rbx, r14
jb 0x180048209
nop word [rax + rax]
mov r8d, 0x30
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x180048209
cmp dword [rsp + 0x40], 0x10000
je 0x18004828b
mov rbx, qword [rsp + 0x28]
cmp rbx, rbp
jb 0x180048209
sub rbx, rbp
cmp rbx, r14
jae 0x1800481d0
test rsi, rsi
jne 0x1800482f0
cmp rdi, r15
ja 0x18004832f
nop dword [rax + rax]
mov ebp, dword [rsp + 0x78]
xor edx, edx
mov rax, rdi
mov ebx, ebp
div rbp
mov eax, ebp
sub rax, rdx
add rax, rdi
mov rdi, rax
cmp rax, r15
ja 0x18004832f
mov r8d, 0x30
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18004832f
cmp dword [rsp + 0x40], 0x10000
je 0x1800482c1
xor edx, edx
lea edi, [rbp - 1]
add rdi, qword [rsp + 0x38]
add rdi, qword [rsp + 0x20]
mov rax, rdi
div rbx
sub rdi, rdx
cmp rdi, r15
jbe 0x180048242
jmp 0x18004832f
test rbx, rbx
je 0x180048209
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x1800482f0
cmp rbx, r14
jae 0x1800481b0
jmp 0x180048212
test rdi, rdi
je 0x18004832f
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x1800482f0
cmp rdi, r15
jbe 0x180048220
jmp 0x18004832f
xor edx, edx
lea rcx, [rsi + 0x40]
mov dword [rsi + 0x10], edx
nop dword [rax]
mov qword [rcx], rdx
mov rax, rcx
mov qword [rsi + 8], rcx
add r12, 0x40
add rcx, 0x40
mov rdx, rax
cmp r12, 0xfc0
jbe 0x180048300
mov rax, qword [0x180064fb0]
mov qword [rsi], rax
mov qword [0x180064fb0], rsi
mov r12, qword [rsp + 0x90]
mov rbp, qword [rsp + 0xd0]
mov rbx, qword [rsp + 0xc8]
mov rax, rsi
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.18004d510
add rsp, 0x98
pop r15
pop r14
pop rdi
pop rsi
ret
Function at 0x180048ce0
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x180064040]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor esi, esi
mov r14d, edx
mov qword [rcx], rsi
mov rbx, rcx
mov qword [rcx + 8], rsi
xor edx, edx
mov ecx, 4
mov ebp, r8d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180048e0b
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x180048e02
nop dword [rax + rax]
cmp dword [rsp + 0x20], 0x10
jb 0x180048de4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x2c], eax
jne 0x180048de4
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x28], eax
je 0x180048de4
mov rdx, qword [rbx]
test rdx, rdx
jne 0x180048da2
mov rcx, qword [0x180064d68]
mov r8d, 0x200
mov dword [rbx + 8], 0x80
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx], rax
mov rdx, rax
test rax, rax
je 0x180048e02
jmp 0x180048dd7
mov eax, dword [rbx + 8]
cmp dword [rbx + 0xc], eax
jb 0x180048dd7
mov rcx, qword [0x180064d68]
lea r9d, [rax + rax]
mov r8, rdx
shl r9, 2
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rdx, rax
test rax, rax
je 0x180048e02
mov eax, dword [rbx + 8]
add eax, eax
mov qword [rbx], rdx
mov dword [rbx + 8], eax
mov ecx, dword [rbx + 0xc]
mov eax, dword [rsp + 0x28]
mov dword [rdx + rcx*4], eax
inc dword [rbx + 0xc]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x180048d50
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rbx], rsi
je 0x180048e65
cmp dword [rbx + 0xc], esi
jbe 0x180048e65
nop word [rax + rax]
mov r8, qword [rbx]
xor edx, edx
mov eax, esi
mov ecx, 0x5a
mov r8d, dword [r8 + rax*4]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x180048e5e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, ebp
mov edx, r14d
mov rcx, rdi
call fcn.180048b30
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [rbx + 0xc]
jb 0x180048e20
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18004d510
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x180048e90
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x180064040]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov eax, ecx
lea r9, [rsp + 0x20]
imul rbx, rax, 0x38
mov esi, edx
add rbx, qword [0x180064fa0]
mov r8, qword [rbx]
movzx eax, byte [rbx + 0x20]
and al, 1
movzx ecx, al
lea rdi, [r8 - 5]
cmove rdi, r8
mov r8d, 0x40
lea rbp, [rcx*2 + 5]
mov rcx, rdi
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x180048f03
mov eax, 0xa
jmp 0x180048f96
test esi, esi
je 0x180048f25
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, edi
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x180048f48
mov rax, qword [rbx]
mov word [rax], 0xf9eb
jmp 0x180048f48
mov eax, dword [rbx + 0x18]
test byte [rbx + 0x20], 1
mov dword [rdi], eax
je 0x180048f41
movzx eax, word [rbx + 0x1c]
mov word [rdi + 4], ax
movzx eax, byte [rbx + 0x1e]
mov byte [rdi + 6], al
jmp 0x180048f48
movzx eax, byte [rbx + 0x1c]
mov byte [rdi + 4], al
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rbp
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movzx ecx, sil
shl sil, 2
add cl, cl
xor cl, byte [rbx + 0x20]
and cl, 2
xor cl, byte [rbx + 0x20]
xor sil, cl
and sil, 4
xor sil, cl
mov byte [rbx + 0x20], sil
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18004d510
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x180048fc0
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, ecx
mov ecx, dword [0x180064fac]
mov ebx, edi
test ecx, ecx
je 0x1800490fd
mov rax, qword [0x180064fa0]
add rax, 0x20
nop
movzx edx, byte [rax]
shr edx, 1
and edx, 1
cmp edx, esi
jne 0x180049018
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x180048ff0
mov eax, edi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
cmp ebx, 0xffffffff
je 0x1800490fd
mov r8d, edi
lea rcx, [rsp + 0x20]
test esi, esi
mov edx, 0xffffffff
setne r8b
call fcn.180048ce0
mov r8d, dword [0x180064fac]
cmp ebx, r8d
jae 0x180049088
nop word [rax + rax]
mov eax, ebx
imul rcx, rax, 0x38
mov rax, qword [0x180064fa0]
movzx edx, byte [rcx + rax + 0x20]
shr edx, 1
and edx, 1
cmp edx, esi
je 0x180049081
mov edx, esi
mov ecx, ebx
call fcn.180048e90
mov edi, eax
test eax, eax
jne 0x180049088
mov r8d, dword [0x180064fac]
inc ebx
cmp ebx, r8d
jb 0x180049050
cmp qword [rsp + 0x20], 0
je 0x1800490fd
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x1800490e9
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x40], rbp
mov ebp, eax
nop dword [rax]
nop dword [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x1800490da
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rbp, 1
jne 0x1800490b0
mov rbp, qword [rsp + 0x40]
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x180064d68]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x48]
mov eax, edi
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x180049470
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r15
sub rsp, 0x30
xor r15d, r15d
mov esi, edx
mov ebx, r15d
xor eax, eax
mov rdi, rcx
mov ebp, 1
lock cmpxchg dword [0x180064d60], ebp
je 0x1800494c7
cmp rbx, 0x20
jae 0x1800494b0
xor ecx, ecx
jmp 0x1800494b2
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x180064d60], ebp
jne 0x1800494a6
cmp qword [0x180064d68], r15
je 0x1800495c3
test rdi, rdi
jne 0x1800494e7
mov ecx, esi
call fcn.180048fc0
mov ebp, eax
jmp 0x1800495c8
mov ecx, dword [0x180064fac]
mov ebx, r15d
test ecx, ecx
je 0x18004950f
mov r8, qword [0x180064fa0]
mov rax, r8
nop
cmp rdi, qword [rax]
je 0x180049519
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x180049500
mov ebp, 4
jmp 0x1800495c8
cmp ebx, 0xffffffff
je 0x18004950f
mov eax, ebx
imul rdx, rax, 0x38
movzx eax, byte [rdx + r8 + 0x20]
shr eax, 1
and eax, ebp
cmp eax, esi
je 0x1800495ba
mov r8d, ebp
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.180048ce0
mov edx, esi
mov ecx, ebx
call fcn.180048e90
mov ebp, eax
cmp qword [rsp + 0x20], r15
je 0x1800495c8
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x1800495a4
mov rbx, qword [rsp + 0x20]
mov esi, eax
nop word [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x18004959a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rsi, 1
jne 0x180049570
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x180064d68]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1800495c8
neg esi
sbb ebp, ebp
add ebp, 6
jmp 0x1800495c8
mov ebp, 2
xchg dword [0x180064d60], r15d
mov rbx, qword [rsp + 0x40]
mov eax, ebp
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r15
ret
Function at 0x18004ab00
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
test edx, edx
je 0x18004ab42
cmp edx, 1
jne 0x18004ab6c
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor eax, eax
lea r8, [0x18004aa10]
mov qword [rsp + 0x28], rax
mov r9, rbx
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x30
pop rbx
ret
cmp dword [0x180064e60], 0
je 0x18004ab6c
call fcn.1800495f0
mov rcx, qword [0x180064e58]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor eax, eax
mov qword [0x180064e58], rax
mov dword [0x180064e60], eax
mov eax, 1
add rsp, 0x30
pop rbx
ret
Function at 0x140001550
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rdi
push rbx
sub rsp, 0x228
xor eax, eax
mov ecx, 0x3c
lea rdx, str.EGCRT
xor r13d, r13d
lea rbx, [0x140028040]
lea r12, [rsp + 0x20]
lea rdi, [rsp + 0x30]
mov qword [rsp + 0x20], 0
rep stosd dword [rdi], eax
mov rcx, r12
mov qword [rsp + 0x28], 0
lea r14, [rsp + 0x120]
call sub.msvcrt.dll_strcat
lea rdx, [0x140020002]
mov rcx, r12
lea rdi, [0x14002000c]
call sub.msvcrt.dll_strcat
lea rdx, [0x140020004]
mov rcx, r12
call sub.msvcrt.dll_strcat
lea rdx, str.EGCRT
mov rcx, r12
call sub.msvcrt.dll_strcat
lea rdx, [0x140020006]
mov rcx, r12
call sub.msvcrt.dll_strcat
lea rdx, [0x140020008]
mov rcx, r12
call sub.msvcrt.dll_strcat
lea rdx, [0x14002000a]
mov rcx, r12
call sub.msvcrt.dll_strcat
mov rdx, rdi
mov r8, r13
mov rcx, r14
call fcn.14001ba20
mov rcx, r14
call sub.msvcrt.dll_getenv
mov rdx, rax
test rax, rax
je 0x14000169e
mov r15, qword [rbx + r13*8]
mov rcx, r15
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x14000169e
mov rdx, r15
mov rcx, r12
inc r13
call sub.msvcrt.dll_strcat
lea rdx, [0x140020016]
mov rcx, r12
call sub.msvcrt.dll_strcat
cmp r13, 8
jne 0x140001608
mov rcx, r12
call sub.msvcrt.dll_strlen
mov rcx, r14
mov byte [rsp + rax + 0x1f], 0x7d
call sub.msvcrt.dll_tmpnam
lea rcx, [rsp + 0x121]
lea rdx, [0x140020018]
call sub.msvcrt.dll_fopen
mov r13, rax
test rax, rax
je 0x14000169e
mov rcx, r12
mov rdx, rax
call sub.msvcrt.dll_fputs
mov rcx, r13
call sub.msvcrt.dll_fclose
nop
add rsp, 0x228
pop rbx
pop rdi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14000af30
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.14001b970
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.14001b970
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]

Function at 0x14000afa0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x50
movsxd rbx, dword [0x1400281f4]
mov r12, rcx
test ebx, ebx
jle 0x14000b0d0
mov rax, qword [0x1400281f8]
xor ecx, ecx
add rax, 0x18
nop word [rax + rax]
mov rdx, qword [rax]
cmp rdx, r12
ja 0x14000afec
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x14000b073
add ecx, 1
add rax, 0x28
cmp ecx, ebx
jne 0x14000afd0
mov rcx, r12
call fcn.14000b940
mov rsi, rax
test rax, rax
je 0x14000b0f2
mov rax, qword [0x1400281f8]
lea rbx, [rbx + rbx*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rsi
mov dword [rax], 0
call fcn.14000ba70
mov ecx, dword [rsi + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x1400281f8]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14000b0d7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x14000b06c
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x14000b080
add dword [0x1400281f4], 1
add rsp, 0x50
pop rbx
pop rsi
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rbx, qword [0x1400281f8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14000b06c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.14000af30
nop dword [rax]
xor ebx, ebx
jmp 0x14000aff7
mov rax, qword [0x1400281f8]
mov edx, dword [rsi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.14000af30
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.14000af30
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x14000b5b0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x140028260]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140028240]
test rbx, rbx
je 0x14000b604
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x14000b5fb
test r12, r12
je 0x14000b5fb
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x14000b5e0
lea rcx, [0x140028260]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x14000b940
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140022a60]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x14000b960
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x14000b968
ret
cmp word [r8 + 0x18], 0x20b
jne 0x14000b960
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x14000b9b5
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x14000b9ac
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x14000b960
add rax, 0x28
cmp rax, r9
jne 0x14000b998
xor eax, eax
ret

Function at 0x14000b9c0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140022a60]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x14000b9e0
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x14000b9e8
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x14000b9e0
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x14000ba70
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140022a60]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x14000ba90
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x14000ba98
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret

Function at 0x14000bc40
Capabilities:
Print debug messages

Disassembly:
push r12
push rbx
sub rsp, 0x58
mov r12, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14000bc60
add rsp, 0x58
pop rbx
pop r12
ret
lea rdx, [rsp + 0x48]
mov r9d, 0x400
mov r8d, eax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rdx
mov ecx, 0x1100
xor edx, edx
mov dword [rsp + 0x28], 0
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
jne 0x14000bca8
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14000bc54
int3
mov rcx, qword [rsp + 0x48]
mov rbx, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rbx
mov rcx, r12
call rbx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x14000bc95
Function at 0x14000bdc0
Capabilities:
Check mutex on windows

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x30
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [0x140028370]
mov dword [rsp + 0x2c], eax
lea rcx, [rsp + 0x2c]
lea r9, [rsp + 0x30]
movzx eax, byte [rcx]
add rcx, 1
add rdx, 2
mov r8d, eax
and eax, 0xf
shr r8b, 4
add eax, 0x61
add r8d, 0x41
mov byte [rdx - 1], al
mov byte [rdx - 2], r8b
cmp rcx, r9
jne 0x14000bde3
lea rax, [0x140028378]
mov ecx, 0x5f
lea rdx, str.__eh_shmem3_gcc_tdm_
lea r8, [rax + 0x15]
jmp 0x14000be2b
movzx ecx, byte [rdx]
add rax, 1
add rdx, 1
mov byte [rax - 1], cl
cmp rax, r8
jne 0x14000be28
lea rax, [0x1400283a0]
mov ecx, 0x5f
lea rdx, str.__eh_shmem3_gcc_tdm_
lea r8, [rax + 0x14]
jmp 0x14000be5b
movzx ecx, byte [rdx]
add rax, 1
add rdx, 1
mov byte [rax - 1], cl
cmp rax, r8
jne 0x14000be58
xor ecx, ecx
mov byte [0x1400283b4], 0x2d
movabs rax, 0x6161616161616161
movabs rdx, 0x6161616161616161
mov qword [0x1400283bd], rdx
lea r8, [0x140028370]
lea rbx, [0x1400283b5]
mov qword [0x1400283cd], rdx
mov qword [0x1400283dd], rdx
mov qword [0x1400283ed], rdx
xor edx, edx
mov qword [0x1400283b5], rax
mov qword [0x1400283c5], rax
mov qword [0x1400283d5], rax
mov qword [0x1400283e5], rax
mov byte [0x1400283f5], 0
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edx, 0xffffffff
mov r12, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14000c036
lea rcx, [0x1400283a0]
call qword [sym.imp.KERNEL32.dll_FindAtomA]
test ax, ax
jne 0x14000bf81
lea rsi, [0x1400282e0]
lea r8, [0x1400283f5]
mov rax, rbx
lea ecx, [rbx + 0x40]
nop dword [rax]
mov edx, ecx
sub edx, eax
bt rsi, rdx
jae 0x14000bf2d
mov byte [rax], 0x41
add rax, 1
cmp r8, rax
jne 0x14000bf20
lea rcx, [0x1400283a0]
call qword [sym.imp.KERNEL32.dll_AddAtomA]
test ax, ax
je 0x14000c023
lea rcx, [0x14000bcd0]
mov qword [0x1400282e0], rsi
call sub.msvcrt.dll__onexit
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x1400282e0]
add rsp, 0x30
pop rbx
pop rsi
pop r12
ret
mov r8d, 0x56
lea rdx, [0x1400283a0]
movzx ecx, ax
call qword [sym.imp.KERNEL32.dll_GetAtomNameA]
lea r8, [0x1400283f5]
xor edx, edx
lea r10d, [rbx + 0x40]
mov r11d, eax
mov r9d, 1
mov rax, rbx
test r11d, r11d
je 0x14000c056
nop dword [rax]
cmp byte [rax], 0x41
jne 0x14000bfd3
mov ecx, r10d
mov rbx, r9
sub ecx, eax
shl rbx, cl
or rdx, rbx
add rax, 1
cmp r8, rax
jne 0x14000bfc0
mov rax, rdx
mov qword [0x1400282e0], rax
lea rsi, [0x1400282e0]
jmp 0x14000bff9
cmp rdx, rsi
je 0x14000bf5f
mov rdx, rax
mov rax, qword [rax + 8]
test rax, rax
jne 0x14000bff0
cmp rdx, rsi
je 0x14000bf5f
mov qword [rdx + 8], rsi
lea rcx, [0x14000bcd0]
call sub.msvcrt.dll__onexit
jmp 0x14000bf5f
lea rcx, [0x1400223a0]
call fcn.14000bc40
xor eax, eax
jmp 0x14000bf78
lea rcx, [0x140022378]
call fcn.14000bc40
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop r12
ret
lea rcx, [0x1400223c8]
call fcn.14000bc40
xor eax, eax
jmp 0x14000bfdf
Function at 0x14000fb40
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, qword [0x140022ae0]
mov rax, qword [rsi]
test rax, rax
je 0x14000fbd0
cmp qword [rax + 0x30], 0
jne 0x14000fbf0
lea rbx, [0x14001f0a8]
mov qword [rax + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [rbx], eax
mov rax, qword [rsi]
test rax, rax
je 0x14000fba0
cmp qword [rax + 0x30], 0
jne 0x14000fbc0
lea rdx, [0x14001f0a8]
mov qword [rax + 0x30], rdx
mov rax, rdx
cmp dword [rax], 0xffffffff
je 0x14001e820
add rsp, 0x28
pop rbx
pop rsi
ret
call fcn.140014e10
mov r8, rax
mov rax, qword [rsi]
cmp qword [r8 + 0x30], 0
je 0x14000fb82
test rax, rax
jne 0x14000fbc0
call fcn.140014e10
nop dword [rax]
mov rax, qword [rax + 0x30]
jmp 0x14000fb90
call fcn.140014e10
cmp qword [rax + 0x30], 0
mov rax, qword [rsi]
je 0x14000fb60
test rax, rax
jne 0x14000fbf0
call fcn.140014e10
nop dword [rax]
mov rbx, qword [rax + 0x30]
jmp 0x14000fb6b
call sub.msvcrt.dll_abort
nop

Function at 0x14000fc00
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x98
movabs rax, 0x6c6320726f727245
movabs rdx, 0x7520676e696e6165
mov qword [rsp + 0x20], rax
movabs rax, 0x6b5f6e6970732070
mov qword [rsp + 0x28], rdx
movabs rdx, 0x20726f6620737965
mov qword [rsp + 0x30], rax
movabs rax, 0x20646165726874
mov qword [rsp + 0x38], rdx
xor edx, edx
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0
mov word [rsp + 0x88], ax
mov byte [rsp + 0x8a], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [rsp + 0x47]
mov r8d, 0xa
mov ecx, eax
call qword [sym.imp.msvcrt.dll__ultoa]
cmp byte [rsp + 0x47], 0
je 0x14000fd12
mov eax, 0x28
lea rcx, [rsp + 0x20]
jmp 0x14000fcea
add rax, 1
cmp rax, 0x6b
je 0x14000fd07
cmp byte [rcx + rax], 0
movsxd rdx, eax
jne 0x14000fce0
cmp edx, 0x6a
je 0x14000fd07
lea eax, [rdx + 1]
cdqe
mov byte [rsp + rdx + 0x20], 0xa
mov byte [rsp + rax + 0x20], 0
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call sub.msvcrt.dll_abort
mov eax, 0x28
mov edx, 0x27
lea rcx, [rsp + 0x20]
jmp 0x14000fcfb
Function at 0x140014c90
Capabilities:
Print debug messages

Disassembly:
push r12
push rbx
sub rsp, 0x58
mov r12, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140014cb0
add rsp, 0x58
pop rbx
pop r12
ret
lea rdx, [rsp + 0x48]
mov r9d, 0x400
mov r8d, eax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rdx
mov ecx, 0x1100
xor edx, edx
mov dword [rsp + 0x28], 0
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
jne 0x140014cf8
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140014ca4
int3
mov rcx, qword [rsp + 0x48]
mov rbx, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rbx
mov rcx, r12
call rbx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140014ce5