joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003d9f0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rsi
sub rsp, 0x48
lea rax, [rsp + 0x70]
mov rsi, rdx
mov qword [rsp + 0x20], rax
mov rbx, rcx
test rcx, rcx
jne 0x14003da29
mov rcx, qword [0x1400f52a8]
call sub.KERNEL32.dll_TlsGetValue
mov rbx, rax
cmp rbx, 0x1000
jb 0x14003db11
movabs rax, 0xffff800000000000
test rax, rbx
jne 0x14003db11
cmp dword [rbx], 0x19750113
jne 0x14003db11
mov qword [rsp + 0x38], rdi
lock inc dword [rbx + 4]
xor edi, edi
cmp dword [rbx + 0x1c], 2
jl 0x14003db03
mov rax, qword [rsp + 0x20]
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], rbp
call sym.vkat.exe_nocrt_strchr
cmp rsi, rax
je 0x14003da91
cmp byte [rax - 1], 0xa
jne 0x14003da91
mov dil, 1
lea rcx, [rbx + 0x28]
call fcn.1400518e0
lea rax, [0x1400b3f7c]
test dil, dil
lea rdx, [0x1400b3f78]
mov r8, rsi
cmovne rdx, rax
lea r9, [rsp + 0x20]
mov rcx, rbx
call fcn.14003ca60
mov r8, qword [rbx + 0xc0]
mov edi, eax
test r8, r8
je 0x14003daf5
lea rdx, str.context:__s_n
mov rcx, rbx
call fcn.14003ca60
mov rcx, qword [rbx + 0xc0]
add edi, eax
call fcn.140041e90
mov qword [rbx + 0xc0], 0
lea rcx, [rbx + 0x28]
call fcn.140051ac0
mov rbp, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x38]
add rsp, 0x48
pop rsi
pop rbx
ret
mov eax, 0xfffffffc
add rsp, 0x48
pop rsi
pop rbx
ret

Function at 0x14003db60
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push r14
push r15
sub rsp, 0x30
mov r14, r9
mov r15, r8
mov ebp, edx
mov rbx, rcx
test rcx, rcx
jne 0x14003db8d
mov rcx, qword [0x1400f52a8]
call sub.KERNEL32.dll_TlsGetValue
mov rbx, rax
cmp rbx, 0x1000
jb 0x14003dc27
movabs rax, 0xffff800000000000
test rax, rbx
jne 0x14003dc27
cmp dword [rbx], 0x19750113
jne 0x14003dc27
mov qword [rsp + 0x50], rsi
lea rcx, [rbx + 0x28]
mov qword [rsp + 0x58], rdi
call fcn.1400518e0
xor edi, edi
cmp ebp, dword [rbx + 0x1c]
jg 0x14003dc03
cmp byte [rbx + 0x60], dil
jne 0x14003dbe2
lea rdx, [0x1400a8a58]
mov rcx, rbx
call fcn.14003ca60
mov edi, eax
mov qword [rsp + 0x28], r14
lea rcx, [0x14003caa0]
xor r9d, r9d
mov qword [rsp + 0x20], r15
xor r8d, r8d
mov rdx, rbx
call fcn.1400659b0
add edi, eax
lea rcx, [rbx + 0x28]
call fcn.140051ac0
mov rsi, qword [rsp + 0x50]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rbp
ret
mov rbx, qword [rsp + 0x60]
mov eax, 0xffffffff
add rsp, 0x30
pop r15
pop r14
pop rbp
ret
Function at 0x14003dc40
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push r14
push r15
sub rsp, 0x30
mov r14, r9
mov r15, r8
mov ebp, edx
mov rbx, rcx
test rcx, rcx
jne 0x14003dc6d
mov rcx, qword [0x1400f52a8]
call sub.KERNEL32.dll_TlsGetValue
mov rbx, rax
cmp rbx, 0x1000
jb 0x14003dced
movabs rax, 0xffff800000000000
test rax, rbx
jne 0x14003dced
cmp dword [rbx], 0x19750113
jne 0x14003dced
mov qword [rsp + 0x50], rsi
lea rcx, [rbx + 0x28]
mov qword [rsp + 0x58], rdi
call fcn.1400518e0
xor esi, esi
cmp ebp, dword [rbx + 0x1c]
jg 0x14003dcc9
mov qword [rsp + 0x28], r14
lea rcx, [0x14003caa0]
xor r9d, r9d
mov qword [rsp + 0x20], r15
xor r8d, r8d
mov rdx, rbx
call fcn.1400659b0
mov rsi, rax
lea rcx, [rbx + 0x28]
call fcn.140051ac0
mov rdi, qword [rsp + 0x58]
mov eax, esi
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rbp
ret
mov rbx, qword [rsp + 0x60]
mov eax, 0xffffffff
add rsp, 0x30
pop r15
pop r14
pop rbp
ret

Function at 0x14003dd10
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rsi
push rdi
sub rsp, 0x40
lea rbx, [rsp + 0x70]
mov rsi, rdx
mov rdi, rcx
test rcx, rcx
jne 0x14003dd45
mov rcx, qword [0x1400f52a8]
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
cmp rdi, 0x1000
jb 0x14003ddc2
movabs rax, 0xffff800000000000
test rax, rdi
jne 0x14003ddc2
cmp dword [rdi], 0x19750113
jne 0x14003ddc2
mov qword [rsp + 0x38], rbp
xor ebp, ebp
mov byte [rdi + 0xb0], 1
test rsi, rsi
je 0x14003ddb3
cmp byte [rsi], bpl
je 0x14003ddb3
cmp dword [rdi + 0x1c], 4
jl 0x14003ddb3
lea rcx, [rdi + 0x28]
mov qword [rsp + 0x20], rbx
call fcn.1400518e0
lea r9, [rsp + 0x20]
mov r8, rsi
lea rdx, [0x1400b3f78]
mov rcx, rdi
call fcn.14003ca60
lea rcx, [rdi + 0x28]
mov ebp, eax
call fcn.140051ac0
mov eax, ebp
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
mov eax, 0xfffffffc
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x140043ff0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r15
sub rsp, 0x20
mov rbx, qword gs:[0x60]
mov r12, rcx
call qword [sym.imp.ntdll.dll_RtlAcquirePebLock]
mov rdi, qword [rbx + 0x20]
xor r15d, r15d
mov esi, r15d
test rdi, rdi
je 0x14004405b
mov rdi, qword [rdi + 0x80]
test rdi, rdi
je 0x14004405e
mov rbx, rdi
cmp word [rdi], r15w
je 0x14004405e
nop
mov rcx, rbx
inc rsi
call fcn.140059470
lea rbx, [rbx + rax*2]
add rbx, 2
cmp word [rbx], r15w
jne 0x140044040
jmp 0x14004405e
mov rdi, r15
lea rdx, [0x1400a1620]
mov qword [rsp + 0x40], r14
mov ecx, 0x30
lea rbp, [rsi + 1]
call fcn.1400418f0
mov rbx, rax
test rax, rax
je 0x14004418e
mov ecx, 0x10
mov dword [rax], 0x19571010
cmp rbp, rcx
mov word [rax + 4], 0x100
lea rax, [fcn.14003c7c0]
mov qword [rbx + 0x20], r15
cmovae rcx, rbp
mov qword [rbx + 0x28], rax
add rcx, 0xf
mov qword [rbx + 8], r15
and rcx, 0xfffffffffffffff0
lea rdx, [0x1400a1620]
mov qword [rbx + 0x10], rcx
lea rcx, [rcx*8]
call fcn.140041920
mov qword [rbx + 0x18], rax
test rax, rax
je 0x140044186
mov rbp, r15
test rsi, rsi
je 0x140044159
cmp word [rdi], r15w
je 0x140044159
mov rax, qword [rbx + 0x18]
lea r8, str.C:DevelAntidetect4PersonalVirtualBox_srcVBoxRuntimegenericenv_generic.cpp
mov rcx, rdi
lea rdx, [rax + rbp*8]
call fcn.1400596a0
mov r14d, eax
test eax, eax
js 0x14004416b
mov rcx, qword [rbx + 0x18]
mov edx, 0x3d
mov rcx, qword [rcx + rbp*8]
call sym.vkat.exe_nocrt_strchr
test rax, rax
jne 0x140044141
mov rax, qword [rbx + 0x18]
lea r8, str.C:DevelAntidetect4PersonalVirtualBox_srcVBoxRuntimegenericenv_generic.cpp
lea rdx, [0x1400b4b24]
lea rcx, [rax + rbp*8]
call fcn.140041bd0
mov r14d, eax
test eax, eax
js 0x14004416b
mov rcx, rdi
inc rbp
call fcn.140059470
lea rdi, [rdi + rax*2]
add rdi, 2
cmp rbp, rsi
jb 0x1400440e4
mov rax, qword [rbx + 0x18]
mov qword [rbx + 8], rbp
mov qword [rax + rbp*8], r15
mov qword [r12], rbx
jmp 0x140044194
lea rax, [rbp + 1]
mov qword [rbx + 8], rax
call qword [sym.imp.ntdll.dll_RtlReleasePebLock]
mov rcx, rbx
call fcn.140044a50
mov eax, r14d
jmp 0x14004419d
mov rcx, rbx
call fcn.140041950
mov r15d, 0xfffffff8
call qword [sym.imp.ntdll.dll_RtlReleasePebLock]
mov eax, r15d
mov r14, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r12
pop rdi
ret
Function at 0x140051480
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
sub rsp, 0x28
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax - 8], rdi
mov qword [rax - 0x10], r12
mov r12, r9
mov qword [rax - 0x18], r13
xor r9d, r9d
mov qword [rax - 0x20], r14
mov r13, rdx
mov rax, rcx
mov qword [rsp], r15
movzx ecx, r8b
mov edx, r9d
shr r8d, 8
test r8d, r8d
jne 0x1400514c9
mov r8d, 0xffffffff
cmp ecx, 0x24
mov r10b, 1
cmovb edx, ecx
movzx ecx, byte [rax]
cmp cl, 0x2b
jne 0x1400514df
mov r10b, 1
jmp 0x1400514e8
cmp cl, 0x2d
jne 0x1400514f1
xor r10b, 1
inc rax
add r8d, 0xffffffff
jne 0x1400514d2
lea rbx, [0x140000000]
test edx, edx
jne 0x140051546
cmp byte [rax], 0x30
lea edi, [rdx + 0xa]
jne 0x14005157e
cmp r8d, 1
jbe 0x140051531
movzx ecx, byte [rax + 1]
sub cl, 0x58
test cl, 0xdf
jne 0x140051531
movzx ecx, byte [rax + 2]
cmp byte [rcx + rbx + 0xb7410], 0x10
jae 0x140051531
add rax, 2
lea edi, [rdx + 0x10]
add r8d, 0xfffffffe
jmp 0x14005157e
movzx ecx, byte [rax + 1]
cmp byte [rcx + rbx + 0xb7410], 8
jae 0x14005157e
mov edi, 8
jmp 0x14005157e
mov edi, edx
cmp edx, 0x10
jne 0x14005157e
cmp byte [rax], 0x30
jne 0x14005157e
cmp r8d, 1
jbe 0x14005157e
movzx ecx, byte [rax + 1]
cmp cl, 0x78
je 0x140051566
cmp cl, 0x58
jne 0x14005157e
movzx ecx, byte [rax + 2]
mov edi, edx
cmp byte [rcx + rbx + 0xb7410], 0x10
jae 0x14005157e
add r8d, 0xfffffffe
add rax, 2
mov r14d, edi
mov r15, rax
movsx ebp, byte [r14 + rbx + 0xb7510]
mov rbx, r9
test r8d, r8d
je 0x1400515e7
lea r13, [0x140000000]
mov qword [rsp + 0x48], rsi
movzx ecx, byte [rax]
test cl, cl
je 0x1400515dd
movzx esi, byte [rcx + r13 + 0xb7410]
cmp esi, edi
jae 0x1400515dd
mov r11, rbx
imul rbx, r14
add rbx, rsi
cmp r11, rbx
ja 0x1400515ce
mov ecx, ebp
shr r11, cl
test r11, r11
je 0x1400515d4
mov r9d, 0x37
inc rax
add r8d, 0xffffffff
jne 0x1400515a1
mov r13, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
mov r14, qword [rsp + 8]
mov rdi, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x40]
test r10b, r10b
jne 0x14005160a
test r9d, r9d
mov ecx, 0x39
cmove r9d, ecx
neg rbx
test r12, r12
je 0x140051613
mov qword [r12], rbx
mov r12, qword [rsp + 0x18]
cmp rax, r15
mov r15, qword [rsp]
mov ecx, 0xffffffc8
mov rbx, qword [rsp + 0x30]
cmove r9d, ecx
test r13, r13
je 0x140051636
mov qword [r13], rax
mov r13, qword [rsp + 0x10]
test r9d, r9d
jne 0x140051683
cmp byte [rax], r9b
je 0x140051683
test r8d, r8d
je 0x140051683
nop word [rax + rax]
movzx ecx, byte [rax]
cmp cl, 0x20
je 0x14005165d
cmp cl, 9
jne 0x140051670
inc rax
add r8d, 0xffffffff
jne 0x140051650
mov eax, 0x4d
add rsp, 0x28
ret
test r8d, r8d
je 0x140051666
test cl, cl
je 0x140051666
mov eax, 0x4c
add rsp, 0x28
ret
mov eax, r9d
add rsp, 0x28
ret
Function at 0x140054d00
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov qword [rsp + 0x30], rsi
mov rbx, rcx
mov rsi, rdx
call fcn.140054430
mov eax, dword [rbx + 0x28]
cmp eax, 2
je 0x140054e0d
mov rdx, rsi
mov qword [rsp + 0x38], rdi
lea rcx, [0x140105ab0]
call fcn.14007b080
mov rdi, rax
cmp rax, rbx
je 0x140054e08
test rax, rax
je 0x140054d6b
lea rcx, [rbx + 0x50]
mov edx, 2
call fcn.140001a20
mov rcx, rdi
call fcn.140054530
test byte [rdi + 0x50], 1
je 0x140054d6b
mov rcx, rdi
call fcn.140054f40
mov rax, rsi
lea rcx, [0x140105ab0]
xchg qword [rbx], rax
mov rdx, rbx
call fcn.14007b0b0
lock or dword [rbx + 0x50], 4
test al, al
je 0x140054dca
lock inc dword [0x140105ab8]
movsxd rax, dword [rbx + 0x48]
lea rcx, [0x140105a78]
lock inc dword [rcx + rax*4]
mov rdi, qword [0x1400f66c0]
cmp rdi, 0xffffffffffffffff
je 0x140054e08
mov rcx, rdi
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
jne 0x140054e08
lea rdx, [rbx + 0x8d0]
mov rcx, rdi
call fcn.140066d60
jmp 0x140054e08
lea r9, str.void___cdecl_rtThreadInsert_struct_RTTHREADINT__unsigned___int64_
mov edx, 0x1ed
lea r8, str.C:DevelAntidetect4PersonalVirtualBox_srcVBoxRuntimecommonmisc_thread.cpp
lea rcx, [0x1400b7794]
call fcn.140057f60
lea r9, [rbx + 0x8c0]
mov r8, rsi
mov rdx, rbx
lea rcx, str.Lock_problem___p___RTnthrd___s_n
call fcn.140057f70
call fcn.140057fa0
int3
mov rdi, qword [rsp + 0x38]
mov rcx, qword [0x140105ac0]
call fcn.140071970
mov rsi, qword [rsp + 0x30]
mov ebx, eax
test eax, eax
jns 0x140054e57
lea r9, str.void___cdecl_rtThreadUnLockRW_void_
mov edx, 0x101
lea r8, str.C:DevelAntidetect4PersonalVirtualBox_srcVBoxRuntimecommonmisc_thread.cpp
lea rcx, str.RT_SUCCESS_NP_rc_
call fcn.140057f60
mov edx, ebx
lea rcx, str._Rra_n
call fcn.140057f70
call fcn.140057fa0
int3
add rsp, 0x20
pop rbx
ret

Function at 0x140054e60
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call fcn.140054d00
mov edx, dword [rbx + 0x48]
mov rcx, rbx
call fcn.14007b540
mov eax, 3
mov rcx, rbx
xchg dword [rbx + 0x28], eax
mov rax, qword [rbx + 0x58]
mov rdx, qword [rbx + 0x60]
call qword [case.0x140035d81.0]
mov esi, eax
call fcn.140066d90
mov ecx, 2
mov dword [rbx + 0x54], esi
xchg dword [rbx + 0x28], ecx
lock or dword [rbx + 0x50], 2
mov rcx, qword [rbx + 0x40]
test rcx, rcx
je 0x140054ec0
call fcn.14005bc00
mov rcx, rbx
call fcn.1400544a0
mov rdi, qword [0x1400f66c0]
cmp rdi, 0xffffffffffffffff
je 0x140054ef8
mov rcx, rdi
call sub.KERNEL32.dll_TlsGetValue
lea rdx, [rbx + 0x8d0]
cmp rax, rdx
jne 0x140054ef8
lea rdx, [0x1400f66c8]
mov rcx, rdi
call fcn.140066d60
mov eax, dword [rbx + 0x24]
cmp eax, 1
jb 0x140054f17
mov eax, 0xffffffff
lock xadd dword [rbx + 0x24], eax
cmp eax, 1
jne 0x140054f17
mov rcx, rbx
call fcn.1400543a0
mov rbx, qword [rsp + 0x38]
mov eax, esi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400554d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r10, rcx
mov eax, 0xffffffff
test rdx, rdx
je 0x14005550f
lea r11, [0x1400b7870]
nop dword [rax]
nop dword [rax + rax]
movzx r9d, byte [r10]
lea r10, [r10 + 1]
mov r8d, eax
shr eax, 8
xor r9, r8
movzx ecx, r9b
xor eax, dword [r11 + rcx*4]
sub rdx, 1
jne 0x1400554f0
not eax
ret

Function at 0x140055530
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test r8, r8
je 0x14005555e
lea r10, [0x1400b7870]
nop dword [rax]
movzx r9d, byte [rdx]
lea rdx, [rdx + 1]
mov eax, ecx
shr ecx, 8
xor r9, rax
movzx eax, r9b
xor ecx, dword [r10 + rax*4]
sub r8, 1
jne 0x140055540
mov eax, ecx
ret

Function at 0x140055620
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1400f54e0]
xor rax, rsp
mov qword [rsp + 0x70], rax
xor ebx, ebx
mov ebp, edx
mov rdi, rcx
cmp byte [rcx + 0x14], bl
jne 0x1400556b5
movzx eax, byte [rcx + 0x12]
cmp byte [rcx + 0x10], bl
je 0x1400556bf
test al, al
jne 0x140055756
mov rcx, qword [rcx + 8]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rbx
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x1400556a6
test bpl, 1
je 0x140055756
cmp dword [rsp + 0x30], ebx
jbe 0x140055756
mov ebx, 1
jmp 0x140055756
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x1400556b5
mov byte [rdi + 0x14], 1
mov ebx, 4
jmp 0x140055756
mov esi, 4
test al, al
je 0x1400556d3
call fcn.140055780
cmp byte [rdi + 0x14], bl
cmovne ebx, esi
cmp byte [rdi + 0x12], 0
jne 0x140055756
test ebx, ebx
jne 0x140055756
xor edx, edx
lea r8d, [rbx + 0x10]
lea rcx, [rsp + 0x38]
call sym.vkat.exe_nocrt_memset
xor edx, edx
lea r8d, [rbx + 0x28]
lea rcx, [rsp + 0x48]
call sym.vkat.exe_nocrt_memset
mov rcx, qword [rdi + 8]
lea r9d, [rbx + 0x28]
lea r8, [rsp + 0x48]
mov dword [rsp + 0x20], 0x18
lea rdx, [rsp + 0x38]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
js 0x14005574a
cmp dword [rsp + 0x68], esi
jne 0x14005572f
mov ebx, esi
mov byte [rdi + 0x14], 1
jmp 0x140055756
test bpl, 2
je 0x140055756
cmp dword [rsp + 0x64], 0
ja 0x140055743
cmp dword [rsp + 0x60], 0
jne 0x140055756
mov ebx, 2
jmp 0x140055756
test bpl, 2
mov eax, 2
cmovne ebx, eax
mov eax, ebx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140001270
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14005c580
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
sub rsp, 0x20
mov qword [rsp + 0x30], rsi
mov esi, ecx
mov ecx, 0x8001
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
or eax, 0x8001
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov rcx, qword [0x140105c10]
lea rdx, str.SetDllDirectoryW
xor ebp, ebp
mov ebx, ebp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14005c5e8
lea rcx, [0x1400b80ac]
call qword [case.0x140035d81.0]
test eax, eax
je 0x14005c5e3
mov dword [0x1400f5544], 2
jmp 0x14005c5e8
mov ebx, 0xffffff1d
and esi, 4
mov qword [rsp + 0x38], rdi
cmp dword [0x140105ae4], 0x6c
jg 0x14005c5fd
test esi, esi
je 0x14005c650
mov rcx, qword [0x140105c10]
lea rdx, str.SetDefaultDllDirectories
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14005c650
mov ecx, 0x800
test esi, esi
mov edi, 0xa00
cmovne edi, ecx
mov ecx, edi
call qword [case.0x140035d81.0]
test eax, eax
je 0x14005c646
and edi, 0x200
neg edi
sbb eax, eax
add eax, 4
mov dword [0x1400f5544], eax
jmp 0x14005c650
test ebx, ebx
mov eax, 0xffffff1c
cmovns ebx, eax
mov rcx, qword [0x140105c10]
lea rdx, str.GetCurrentThreadStackLimits
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140105c10]
lea rdx, str.SetUnhandledExceptionFilter
mov qword [0x140105ad0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140105c10]
lea rdx, str.UnhandledExceptionFilter
mov qword [0x140105c78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, qword [rsp + 0x30]
mov qword [0x140105c80], rax
mov rax, qword [0x140105c78]
test rax, rax
je 0x14005c6d9
cmp qword [0x140105ad8], rbp
jne 0x14005c6d9
lea rdi, [0x14005cc70]
mov rcx, rdi
call qword [case.0x140035d81.0]
cmp rax, rdi
cmove rax, rbp
mov qword [0x140105ad8], rax
mov rdi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rbp
ret
Function at 0x140083df0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rbx, rdx
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], 0
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], 0
mov rcx, rax
lea rdx, [0x1400a1620]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140083e60
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0xe0
mov rax, qword [0x1400f54e0]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rbx, rcx
mov esi, r8d
mov ecx, 0xfffffff4
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor ebp, ebp
lea r9, [rsp + 0x40]
mov rcx, rax
mov qword [rsp + 0x20], rbp
mov r8d, edi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea r9d, [rbp + 0xa]
mov dword [rsp + 0x30], 0x2010
mov dword [rsp + 0x28], ebp
lea rcx, [rsp + 0x50]
mov r8d, esi
mov dword [rsp + 0x20], ebp
lea edx, [r9 + 0x76]
call fcn.1400859f0
mov ecx, 0xfffffff4
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rbp
mov rcx, rax
lea rdx, [rsp + 0x50]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rbp
mov rcx, rax
lea r8d, [rbp + 2]
lea rdx, [0x1400c2fbc]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140001270
mov rbx, qword [rsp + 0x118]
add rsp, 0xe0
pop rdi
pop rsi
pop rbp
ret

Function at 0x140083f50
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rbx, rdx
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], 0
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140083fa0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0xe0
mov rax, qword [0x1400f54e0]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov r9d, 0x10
mov dword [rsp + 0x30], 0x4080
mov r8, rcx
mov dword [rsp + 0x28], 0x10
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x20], 0x10
lea edx, [r9 + 0x70]
call fcn.140085ac0
mov ecx, 0xfffffff4
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov rcx, rax
lea rdx, [rsp + 0x50]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140001270
add rsp, 0xe0
pop rbx
ret
Function at 0x140084030
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xe0
mov rax, qword [0x1400f54e0]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rdi, rcx
cmp rcx, 0x1000
jb 0x14008408f
movabs rax, 0xffff800000000000
test rax, rcx
jne 0x14008408f
xor ebx, ebx
cmp byte [rcx], bl
je 0x140084079
inc rbx
cmp byte [rcx + rbx], 0
jne 0x140084070
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r8d, ebx
mov rdx, rdi
jmp 0x140084132
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov rcx, rax
lea rdx, str._pszString
mov r8d, 0xb
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r9d, 0x10
mov dword [rsp + 0x30], 0x4080
mov dword [rsp + 0x28], 0x10
lea rcx, [rsp + 0x50]
mov r8, rdi
mov dword [rsp + 0x20], 0x10
lea edx, [r9 + 0x70]
call fcn.140085ac0
mov ecx, 0xfffffff4
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov rcx, rax
lea rdx, [rsp + 0x50]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r8d, 1
lea rdx, [0x1400b923c]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140001270
mov rbx, qword [rsp + 0xf8]
add rsp, 0xe0
pop rdi
ret

Function at 0x140084170
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x110
mov rax, qword [0x1400f54e0]
xor rax, rsp
mov qword [rsp + 0x100], rax
xor ebp, ebp
mov dword [rsp + 0x30], 0x2000
mov esi, ecx
mov dword [rsp + 0x28], ebp
mov r8d, ecx
mov dword [rsp + 0x20], ebp
mov edi, 0xa8
lea rcx, [rsp + 0x50]
lea r9d, [rbp + 0xa]
mov edx, edi
call fcn.1400859f0
mov dword [rsp + 0x30], 0x2008
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x28], ebp
lea r9d, [rbp + 0x10]
mov r8d, esi
mov dword [rsp + 0x20], ebp
lea rbx, [rax + 2]
mov word [rsp + rax + 0x50], 0x2820
sub rdi, rbx
add rcx, rbx
mov rdx, rdi
call fcn.1400859f0
add rax, rbx
mov ecx, 0xfffffff4
mov byte [rsp + rax + 0x50], 0x29
lea ebx, [rax + 1]
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rbp
mov rcx, rax
lea rdx, [rsp + 0x50]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.140001270
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret