joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140046140
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1400462aa
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x140046158
cmp edx, ecx
jne 0x140046298
nop dword [rax]
test rsi, rsi
jne 0x140046298
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x1400461b4
nop
call fcn.1400686c0
xorps xmm15, xmm15
mov r14, qword [0x140513140]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call fcn.140046040
mov rcx, qword [0x1404bfb58]
mov rdx, qword [0x1404bfb50]
mov rbx, qword [rsp + 0x28]
mov esi, dword [rbx]
mov edi, esi
sar esi, 0x1f
shr esi, 0x1b
add esi, edi
mov r8d, esi
and esi, 0xffffffe0
sub edi, esi
test edi, edi
jl 0x140046293
cmp edi, 0x20
sbb esi, esi
sar r8d, 5
mov rax, rcx
mov ecx, edi
mov r9d, 1
shl r9d, cl
and r9d, esi
movsxd rsi, r8d
cmp rax, rsi
jbe 0x140046288
lea rcx, [rdx + rsi*4]
lock or dword [rcx], r9d
mov rcx, qword [0x1404c0bf0]
mov qword [rbx + 8], rcx
nop
mov rcx, rbx
mov qword [0x1404c0bf0], rbx
nop
mov edx, 1
lea rsi, [0x1404c0bf8]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1220]
shr rdx, 0x3d
test dl, dl
jne 0x140046277
nop
nop
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
xchg qword [rcx + 0x1220], rdx
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x140286f70]
mov ebx, 0x28
call fcn.140037900
mov rcx, rax
mov rax, rsi
call fcn.140066d00
call fcn.140035f20
lea rax, [0x1402855e9]
mov ebx, 0x23
call fcn.140037900
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.140064680
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.140046140
Function at 0x140053240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x1400533b8
movzx edx, byte [rax]
nop
test edx, edx
jne 0x14005327c
test r8b, r8b
jne 0x14005327c
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
bt edx, 7
jae 0x14005328f
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x140053378
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
cmp rbx, r8
jb 0x140053366
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rcx
sar rcx, 0x3f
and r8, rcx
lea rsi, [rax + r8]
test rbx, rbx
jbe 0x14005335c
movzx r8d, byte [rax + r8]
bt r8d, 7
jae 0x1400532e3
xor eax, eax
xor ecx, ecx
xor r8d, r8d
jmp 0x140053326
mov eax, 1
cmp rax, rbx
ja 0x140053315
add qword [rdi], r8
sub rdx, rax
sub rbx, rax
mov rcx, rdx
neg rdx
sar rdx, 0x3f
and rax, rdx
add rax, rsi
mov edi, 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rcx, rbx
call fcn.140066dc0
lea r8d, [rcx + 7]
mov ecx, eax
mov eax, r10d
cmp rax, rbx
jae 0x140053354
movzx r9d, byte [rax + rsi]
lea r10d, [rax + 1]
mov r11d, r9d
and r9d, 0x7f
mov eax, ecx
mov ecx, r8d
shl r9d, cl
or eax, r9d
test r11b, 0x80
jne 0x14005331d
mov r8d, eax
mov eax, r10d
jmp 0x1400532e8
mov rcx, rbx
call fcn.140066d00
xor eax, eax
mov rcx, rax
call fcn.140066d00
mov eax, r8d
mov rcx, rbx
call fcn.140066dc0
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x1400533ae
movzx r10d, byte [rdx + rax]
inc edx
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
or r8d, r10d
test r11b, 0x80
jne 0x140053371
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x140053295
mov eax, edx
mov rcx, rbx
call fcn.140066d00
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.140066d00
nop
int3
Function at 0x14005af60
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14005b019
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rdx, [0x14005b060]
mov qword [rsp + 0x10], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x28], rdx
mov rdx, r14
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.140064540
xorps xmm15, xmm15
mov r14, qword [0x140513140]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.140064680
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.14005af60
Function at 0x140066780
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x1405132a0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x140512ef5], 0
je 0x1400667b6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x1405135e0]
aesenc xmm0, xmmword [0x1405135f0]
aesenc xmm0, xmmword [0x140513600]
movq rax, xmm0
ret
jmp 0x14000ae00
Function at 0x1400c4ee0
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1400c512c
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov ebx, dword [rax + 0x2c]
nop dword [rax + rax]
test ebx, ebx
jne 0x1400c4f8c
mov qword [rsp + 0x88], rax
lea rbx, [0x14026e680]
mov rcx, rax
lea rax, [0x1404bfce0]
call fcn.140070200
test cl, cl
jne 0x1400c4f71
mov rax, qword [rsp + 0x88]
call fcn.1400c1c00
mov ecx, 1
mov rdi, rax
mov rsi, rbx
lea rax, [rsp + 0x30]
lea rbx, [0x1402d9818]
call fcn.14004f420
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x28], rbx
nop dword [rax]
call fcn.1400c64e0
mov rcx, qword [rsp + 0x88]
xor edx, edx
jmp 0x1400c4fae
lea rdx, [0x14026e940]
cmp rax, rdx
jne 0x1400c4f9c
test byte [rbx], al
mov rax, rbx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
nop
call fcn.140061be0
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov rbx, rdx
lea rcx, [0x14023f280]
call fcn.14000b940
inc rdx
cmp rbx, rdx
jle 0x1400c4ff8
mov rsi, qword [rax + rdx*8]
cmp qword [rsi + 0x30], rcx
jne 0x1400c4fab
lea rax, [0x1404bfce0]
lea rbx, [0x14026e680]
lea rdi, [0x14026e940]
call fcn.1400703c0
lea rdx, [0x14026e940]
nop
cmp rax, rdx
jne 0x1400c511c
test byte [rbx], al
mov rax, rbx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
lea rcx, [0x14022fea0]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], 0
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x50], rcx
lea rax, [0x140253ee0]
nop
call fcn.14000e720
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x50]
test byte [rcx], al
cmp dword [0x140513220], 0
jne 0x1400c505a
mov rdx, qword [rcx]
mov qword [rax], rdx
movups xmm0, xmmword [rcx + 8]
movups xmmword [rax + 8], xmm0
movups xmm0, xmmword [rcx + 0x18]
movups xmmword [rax + 0x18], xmm0
movups xmm0, xmmword [rcx + 0x28]
movups xmmword [rax + 0x28], xmm0
jmp 0x1400c5069
mov rbx, rax
lea rax, [0x140253ee0]
call fcn.140014920
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x28]
xor ecx, ecx
xor edi, edi
xor esi, esi
mov r8d, esi
nop dword [rax]
call fcn.1400c16a0
nop
call fcn.140061ce0
mov rsi, qword [rsp + 0x60]
mov dword [rsi + 0x28], eax
mov dword [rsi + 0x2c], 0
mov rcx, qword [rsp + 0x88]
mov edx, dword [rcx + 0x10]
xor eax, eax
jmp 0x1400c50b7
imul edx, edx, 0x1000193
xor edx, 0x2a
mov eax, 1
cmp rax, 1
jl 0x1400c50a9
mov dword [rsi + 0x10], edx
cmp dword [0x140513220], 0
jne 0x1400c50cf
mov qword [rsi + 0x30], rcx
jmp 0x1400c50d8
lea rdi, [rsi + 0x30]
call fcn.140066960
lea rax, [0x1404bfce0]
lea rbx, [0x14026e680]
lea rdi, [0x14026e940]
call fcn.1400703c0
lea rdx, [0x14026e940]
cmp rax, rdx
jne 0x1400c510d
test byte [rbx], al
mov rax, rbx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov rbx, rdx
lea rcx, [0x14023f280]
call fcn.14000b940
mov rbx, rdx
lea rcx, [0x14023f280]
call fcn.14000b940
nop
mov qword [rsp + 8], rax
call fcn.140064680
mov rax, qword [rsp + 8]
nop dword [rax + rax]
jmp fcn.1400c4ee0
Function at 0x1401e0570
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.1401eb710
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.1401eb710
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]

Function at 0x1401e05e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x50
movsxd rbx, dword [0x140517bd4]
mov r12, rcx
test ebx, ebx
jle 0x1401e0710
mov rax, qword [0x140517bd8]
xor ecx, ecx
add rax, 0x18
nop word [rax + rax]
mov rdx, qword [rax]
cmp rdx, r12
ja 0x1401e062c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x1401e06b3
add ecx, 1
add rax, 0x28
cmp ecx, ebx
jne 0x1401e0610
mov rcx, r12
call fcn.1401e0f80
mov rsi, rax
test rax, rax
je 0x1401e0732
mov rax, qword [0x140517bd8]
lea rbx, [rbx + rbx*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rsi
mov dword [rax], 0
call fcn.1401e10b0
mov ecx, dword [rsi + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x140517bd8]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1401e0717
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x1401e06ac
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x1401e06c0
add dword [0x140517bd4], 1
add rsp, 0x50
pop rbx
pop rsi
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rbx, qword [0x140517bd8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1401e06ac
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.1401e0570
nop dword [rax]
xor ebx, ebx
jmp 0x1401e0637
mov rax, qword [0x140517bd8]
mov edx, dword [rsi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.1401e0570
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.1401e0570
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x1401e0bf0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x140517c40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140517c20]
test rbx, rbx
je 0x1401e0c44
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x1401e0c3b
test r12, r12
je 0x1401e0c3b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1401e0c20
lea rcx, [0x140517c40]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x1401e0f80
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1404b9b00]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1401e0fa0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1401e0fa8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1401e0fa0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x1401e0ff5
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1401e0fec
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1401e0fa0
add rax, 0x28
cmp rax, r9
jne 0x1401e0fd8
xor eax, eax
ret

Function at 0x1401e1000
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1404b9b00]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x1401e1020
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1401e1028
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x1401e1020
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x1401e10b0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1404b9b00]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x1401e10d0
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x1401e10d8
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret

Function at 0x1401e2a30
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, qword [str._Q_]
mov rax, qword [rsi]
test rax, rax
je 0x1401e2ac0
cmp qword [rax + 0x30], 0
jne 0x1401e2ae0
lea rbx, [0x140217b68]
mov qword [rax + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [rbx], eax
mov rax, qword [rsi]
test rax, rax
je 0x1401e2a90
cmp qword [rax + 0x30], 0
jne 0x1401e2ab0
lea rdx, [0x140217b68]
mov qword [rax + 0x30], rdx
mov rax, rdx
cmp dword [rax], 0xffffffff
je 0x1401eb8a0
add rsp, 0x28
pop rbx
pop rsi
ret
call fcn.1401e7930
mov r8, rax
mov rax, qword [rsi]
cmp qword [r8 + 0x30], 0
je 0x1401e2a72
test rax, rax
jne 0x1401e2ab0
call fcn.1401e7930
nop dword [rax]
mov rax, qword [rax + 0x30]
jmp 0x1401e2a80
call fcn.1401e7930
cmp qword [rax + 0x30], 0
mov rax, qword [rsi]
je 0x1401e2a50
test rax, rax
jne 0x1401e2ae0
call fcn.1401e7930
nop dword [rax]
mov rbx, qword [rax + 0x30]
jmp 0x1401e2a5b
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
mov rax, qword [pe_dos_header]
ud2
Function at 0x1401e2af0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x98
movabs rax, 0x6c6320726f727245
movabs rdx, 0x7520676e696e6165
mov qword [rsp + 0x20], rax
movabs rax, 0x6b5f6e6970732070
mov qword [rsp + 0x28], rdx
movabs rdx, 0x20726f6620737965
mov qword [rsp + 0x30], rax
movabs rax, 0x20646165726874
mov qword [rsp + 0x38], rdx
xor edx, edx
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0
mov word [rsp + 0x88], ax
mov byte [rsp + 0x8a], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [rsp + 0x47]
mov r8d, 0xa
mov ecx, eax
call qword [sym.imp.msvcrt.dll__ultoa]
cmp byte [rsp + 0x47], 0
je 0x1401e2c02
mov eax, 0x28
lea rcx, [rsp + 0x20]
jmp 0x1401e2bda
add rax, 1
cmp rax, 0x6b
je 0x1401e2bf7
cmp byte [rcx + rax], 0
movsxd rdx, eax
jne 0x1401e2bd0
cmp edx, 0x6a
je 0x1401e2bf7
lea eax, [rdx + 1]
cdqe
mov byte [rsp + rdx + 0x20], 0xa
mov byte [rsp + rax + 0x20], 0
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call sub.msvcrt.dll_abort
mov eax, 0x28
mov edx, 0x27
lea rcx, [rsp + 0x20]
jmp 0x1401e2beb
Function at 0x1401e3610
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rsi, qword [str._Q_]
mov rax, qword [rsi]
test rax, rax
je 0x1401e3800
cmp qword [rax + 0x28], 0
jne 0x1401e37e8
lea rcx, [0x140517cf8]
cmp dword [rcx], 1
mov qword [rax + 0x28], rcx
je 0x1401e37f5
call fcn.1401e2c20
mov rax, qword [rsi]
test rax, rax
je 0x1401e3690
cmp qword [rax + 0x30], 0
jne 0x1401e36b0
lea rdx, [0x140217b68]
mov qword [rax + 0x30], rdx
mov rax, rdx
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12, rax
test rax, rax
je 0x1401e36c4
mov rax, r12
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call fcn.1401e7930
cmp qword [rax + 0x30], 0
mov rax, qword [rsi]
je 0x1401e3660
test rax, rax
jne 0x1401e36b0
call fcn.1401e7930
nop dword [rax]
mov rax, qword [rax + 0x30]
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12, rax
test rax, rax
jne 0x1401e367e
call fcn.1401e2760
cmp qword [0x14051b050], 0
mov rbx, rax
je 0x1401e367e
test rax, rax
je 0x1401e367e
mov dword [rax + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor ecx, ecx
xor r9d, r9d
xor r8d, r8d
mov dword [rbx + 0x70], eax
mov edx, 1
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x38], 0xffffffffffffffff
lea rcx, [rbx + 0x68]
mov qword [rbx + 0x30], rax
call fcn.1401e97d0
cmp eax, 1
je 0x1401e386d
mov rbp, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rbx + 0x68], 0xffffffffffffffff
mov dword [rbx + 0xb8], 0
mov qword [rbx + 0x28], 0
call rbp
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r12, rax
call rbp
mov dword [rsp + 0x30], 2
mov r8, rdi
mov rdx, r12
mov dword [rsp + 0x28], 0
mov rcx, rax
lea r9, [rbx + 0x28]
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x1401eb8a6
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [rbx + 0xbc], 0
mov dword [rbx + 0xc0], eax
movzx eax, byte [rbx + 0x40]
and eax, 0xffffffcf
or eax, 0x10
mov byte [rbx + 0x40], al
mov rax, qword [rsi]
test rax, rax
je 0x1401e3848
cmp qword [rax + 0x30], 0
je 0x1401e3830
mov rax, qword [rax + 0x30]
mov ecx, dword [rax]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1401eb8a6
mov r12, rbx
mov rax, r12
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, qword [rax + 0x28]
cmp dword [rcx], 1
jne 0x1401e364c
mov rax, qword [rsi]
jmp 0x1401e3659
call fcn.1401e7930
cmp qword [rax + 0x28], 0
mov rax, qword [rsi]
je 0x1401e3638
test rax, rax
jne 0x1401e37e8
call fcn.1401e7930
mov rcx, qword [rax + 0x28]
cmp dword [rcx], 1
jne 0x1401e364c
jmp 0x1401e3651
lea rdx, [0x140217b68]
mov qword [rax + 0x30], rdx
mov rax, rdx
jmp 0x1401e37be
call fcn.1401e7930
mov r8, rax
mov rax, qword [rsi]
cmp qword [r8 + 0x30], 0
je 0x1401e3830
test rax, rax
jne 0x1401e37ba
call fcn.1401e7930
jmp 0x1401e37ba
call fcn.1401e2af0
nop word cs:[rax + rax]
nop dword [rax]
mov rax, qword [str._Q_]
mov rdx, qword [rax]
lea rax, [0x140517d08]
mov qword [rdx + 0x10], rax
ret
Function at 0x1401e77b0
Capabilities:
Print debug messages

Disassembly:
push r12
push rbx
sub rsp, 0x58
mov r12, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1401e77d0
add rsp, 0x58
pop rbx
pop r12
ret
lea rdx, [rsp + 0x48]
mov r9d, 0x400
mov r8d, eax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rdx
mov ecx, 0x1100
xor edx, edx
mov dword [rsp + 0x28], 0
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
jne 0x1401e7818
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1401e77c4
int3
mov rcx, qword [rsp + 0x48]
mov rbx, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rbx
mov rcx, r12
call rbx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1401e7805
Function at 0x1401e7930
Capabilities:
Check mutex on windows

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x30
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [0x140517de0]
mov dword [rsp + 0x2c], eax
lea rcx, [rsp + 0x2c]
lea r9, [rsp + 0x30]
movzx eax, byte [rcx]
add rcx, 1
add rdx, 2
mov r8d, eax
and eax, 0xf
shr r8b, 4
add eax, 0x61
add r8d, 0x41
mov byte [rdx - 1], al
mov byte [rdx - 2], r8b
cmp rcx, r9
jne 0x1401e7953
lea rax, [0x140517de8]
mov ecx, 0x5f
lea rdx, str.__shmem3_winpthreads_tdm_
lea r8, [rax + 0x1a]
jmp 0x1401e799b
movzx ecx, byte [rdx]
add rax, 1
add rdx, 1
mov byte [rax - 1], cl
cmp rax, r8
jne 0x1401e7998
lea rax, [0x140517e20]
mov ecx, 0x5f
lea rdx, str.__shmem3_winpthreads_tdm_
lea r8, [rax + 0x19]
jmp 0x1401e79cb
movzx ecx, byte [rdx]
add rax, 1
add rdx, 1
mov byte [rax - 1], cl
cmp rax, r8
jne 0x1401e79c8
xor ecx, ecx
mov byte [0x140517e39], 0x2d
movabs rax, 0x6161616161616161
movabs rdx, 0x6161616161616161
mov qword [0x140517e42], rdx
lea r8, [0x140517de0]
lea rbx, [0x140517e3a]
mov qword [0x140517e52], rdx
mov qword [0x140517e62], rdx
mov qword [0x140517e72], rdx
xor edx, edx
mov qword [0x140517e3a], rax
mov qword [0x140517e4a], rax
mov qword [0x140517e5a], rax
mov qword [0x140517e6a], rax
mov byte [0x140517e7a], 0
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edx, 0xffffffff
mov r12, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1401e7ba6
lea rcx, [0x140517e20]
call qword [sym.imp.KERNEL32.dll_FindAtomA]
test ax, ax
jne 0x1401e7af1
lea rsi, [0x140517d20]
lea r8, [0x140517e7a]
mov rax, rbx
lea ecx, [rbx + 0x40]
nop dword [rax]
mov edx, ecx
sub edx, eax
bt rsi, rdx
jae 0x1401e7a9d
mov byte [rax], 0x41
add rax, 1
cmp r8, rax
jne 0x1401e7a90
lea rcx, [0x140517e20]
call qword [sym.imp.KERNEL32.dll_AddAtomA]
test ax, ax
je 0x1401e7b93
lea rcx, [0x1401e7840]
mov qword [0x140517d20], rsi
call sub.msvcrt.dll__onexit
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x140517d20]
add rsp, 0x30
pop rbx
pop rsi
pop r12
ret
mov r8d, 0x5b
lea rdx, [0x140517e20]
movzx ecx, ax
call qword [sym.imp.KERNEL32.dll_GetAtomNameA]
lea r8, [0x140517e7a]
xor edx, edx
lea r10d, [rbx + 0x40]
mov r11d, eax
mov r9d, 1
mov rax, rbx
test r11d, r11d
je 0x1401e7bc6
nop dword [rax]
cmp byte [rax], 0x41
jne 0x1401e7b43
mov ecx, r10d
mov rbx, r9
sub ecx, eax
shl rbx, cl
or rdx, rbx
add rax, 1
cmp r8, rax
jne 0x1401e7b30
mov rax, rdx
mov qword [0x140517d20], rax
lea rsi, [0x140517d20]
jmp 0x1401e7b69
cmp rdx, rsi
je 0x1401e7acf
mov rdx, rax
mov rax, qword [rax + 8]
test rax, rax
jne 0x1401e7b60
cmp rdx, rsi
je 0x1401e7acf
mov qword [rdx + 8], rsi
lea rcx, [0x1401e7840]
call sub.msvcrt.dll__onexit
jmp 0x1401e7acf
lea rcx, str.failed_to_add_string_to_atom_table_n
call fcn.1401e77b0
xor eax, eax
jmp 0x1401e7ae8
lea rcx, str.failed_to_to_lock_creation_mutex_n
call fcn.1401e77b0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop r12
ret
lea rcx, str.failed_to_get_string_from_atom_n
call fcn.1401e77b0
xor eax, eax
jmp 0x1401e7b4f
Function at 0x140013ec0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140013cec

Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
push rcx
push rsi
xor rdx, rdx
mov rdx, qword gs:[rdx + 0x60]
mov rdx, qword [rdx + 0x18]
mov rdx, qword [rdx + 0x20]
movzx rcx, word [rdx + 0x4a]
mov rsi, qword [rdx + 0x50]
xor r9, r9
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
mov rdx, qword [rdx + 0x20]
push r9
mov eax, dword [rdx + 0x3c]
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
mov r8d, dword [rax + 0x20]
mov ecx, dword [rax + 0x18]
add r8, rdx
push rax
jrcxz 0x1400040ca
xor r9, r9
dec rcx
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor rax, rax
ror r9d, 0xd
lodsb al, byte [rsi]
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
pop r8
add rax, rdx
pop r8
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021