joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b9c0
Capabilities:
Check mutex on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rcx, qword [0x004ab510]
test rcx, rcx
je 0x41b940
call fcn.0041b770
mov rax, qword [0x004ab508]
test rax, rax
je 0x41b963
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x41b843
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
call fcn.0041b140
test rax, rax
mov rbx, rax
je 0x41b9ab
cmp qword [0x004ae050], 0
je 0x41b9ab
mov dword [rax + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, 1
mov dword [rbx + 0x68], eax
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rsi, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rbx + 0x30], rax
mov qword [rbx + 0x38], 0xffffffffffffffff
mov qword [rbx + 0x60], 0xffffffffffffffff
mov dword [rbx + 0xb0], 0
mov qword [rbx + 0x28], 0
call rsi
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rdi, rax
call rsi
mov dword [rsp + 0x30], 2
mov rcx, rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rbx + 0x28]
mov r8, rbp
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x41b9b2
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [rbx + 0xb8], eax
movzx eax, byte [rbx + 0x40]
mov dword [rbx + 0xb4], 0
and eax, 0xffffffcf
or eax, 0x10
mov byte [rbx + 0x40], al
mov rax, qword [0x004ab508]
test rax, rax
je 0x41b987
mov rdx, rbx
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x41b9b2
mov rax, rbx
jmp 0x41b83a
lea rcx, str._pthread_tls_once_shmem
xor r8d, r8d
mov edx, 4
call fcn.00420620
mov rcx, rax
mov qword [0x004ab510], rax
jmp 0x41b818
lea r8, [0x0041a780]
lea rcx, str._pthread_tls_shmem
mov edx, 4
call fcn.00420620
mov qword [0x004ab508], rax
jmp 0x41b82d
lea r8, [0x0041a780]
lea rcx, str._pthread_tls_shmem
mov edx, 4
call fcn.00420620
mov qword [0x004ab508], rax
jmp 0x41b928
xor eax, eax
jmp 0x41b83a
call sub.msvcrt.dll_abort
nop
nop dword [rax + rax]
lea rcx, str._pthread_key_dest_shmem
xor r8d, r8d
mov edx, 8
jmp fcn.00420620
Function at 0x41dbb0
Capabilities:
Create thread
Resume thread

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov r14, rcx
mov r12, rdx
mov rsi, r8
mov rdi, r9
call fcn.0041b140
test rax, rax
mov rbx, rax
je 0x41dd61
test r14, r14
je 0x41dbea
mov rax, qword [rax + 0x1c8]
mov qword [r14], rax
mov r13, qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rbx + 8], rdi
mov rdi, qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x10], rsi
mov esi, 1
mov dword [rbx + 0xb4], 0
mov dword [rbx + 0x44], 1
mov qword [rbx + 0x28], 0xffffffffffffffff
mov rbp, r13
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, 1
call rdi
test rax, rax
mov qword [rbx + 0x30], rax
jne 0x41de10
cmp esi, 1
jne 0x41dc50
xor ecx, ecx
call r13
add esi, 1
jmp 0x41dc21
mov ecx, 0x14
call rbp
cmp esi, 5
jne 0x41dc47
mov rax, qword [rbx + 0x30]
mov qword [rbx + 0x38], 0xffffffffffffffff
mov qword [rbx + 0x60], 0xffffffffffffffff
mov dword [rbx], 0xbab1f00d
mov dword [rbx + 0xb8], 0
mov dword [rbx + 0xb0], 0
test rax, rax
je 0x41dd47
test r12, r12
je 0x41de50
mov eax, dword [r12]
mov rsi, qword [r12 + 0x10]
test al, 8
mov dword [rbx + 0x44], eax
jne 0x41dde0
mov eax, dword [r12 + 0x18]
mov edx, esi
mov dword [rbx + 0xb8], eax
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
mov r9, rbx
lea r8, [0x0041c000]
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov rsi, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
ja 0x41dd17
mov edx, dword [rbx + 0xb8]
cmp edx, 0xfffffff2
jl 0x41dd75
cmp edx, 0xffffffff
jl 0x41de00
cmp edx, 0xe
jg 0x41de40
cmp edx, 2
mov eax, 2
cmovge edx, eax
jmp 0x41dd7a
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x41dd26
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbx + 0x38]
call fcn.0041f2d0
mov qword [rbx + 0x60], 0xffffffffffffffff
mov qword [rbx + 0x30], 0
mov qword [rbx + 0x28], 0
test r14, r14
je 0x41dd53
mov qword [r14], 0
cmp qword [rbx + 0x1c0], 0
je 0x41de57
mov eax, 0xb
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov edx, 0xfffffff1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
test byte [rbx + 0x44], 4
je 0x41ddd0
mov rcx, rsi
mov qword [rbx + 0x28], 0
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov qword [rbx + 0x28], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x41ddad
call fcn.0041b800
mov eax, dword [rax + 0xb8]
mov edx, esi
mov dword [rbx + 0xb8], eax
jmp 0x41dcbd
mov edx, 0xfffffffe
jmp 0x41dd7a
mov qword [rbx + 0x38], 0xffffffffffffffff
mov qword [rbx + 0x60], 0xffffffffffffffff
mov dword [rbx], 0xbab1f00d
mov dword [rbx + 0xb8], 0
mov dword [rbx + 0xb0], 0
jmp 0x41dc93
mov edx, 0xf
jmp 0x41dd7a
xor edx, edx
jmp 0x41dcbd
mov rcx, rbx
call fcn.0041b370
jmp 0x41dd61
Function at 0x41e8c0
Capabilities:
Check mutex on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
mov rcx, qword [0x004ab558]
mov esi, edx
test rcx, rcx
je 0x41e860
call fcn.004209e0
cmp dword [rbx], 0xbab1f00d
jne 0x41e887
mov eax, dword [rbx + 4]
test eax, eax
jle 0x41e887
mov eax, dword [rbx + 4]
test eax, eax
jle 0x41e813
mov eax, dword [rbx + 4]
sub eax, 1
mov dword [rbx + 4], eax
mov rcx, qword [0x004ab558]
test rcx, rcx
je 0x41e830
call fcn.00420a90
mov eax, esi
add rsp, 0x38
pop rbx
pop rsi
ret
lea r8, [0x0041e5a0]
lea rcx, str.mutex_global_shmem
mov edx, 8
call fcn.00420620
mov rcx, rax
mov qword [0x004ab558], rax
call fcn.00420a90
mov eax, esi
add rsp, 0x38
pop rbx
pop rsi
ret
lea rcx, str.mutex_global_shmem
lea r8, [0x0041e5a0]
mov edx, 8
call fcn.00420620
mov rcx, rax
mov qword [0x004ab558], rax
jmp 0x41e7e7
call qword [sym.imp.msvcrt.dll___iob_func]
lea r9, str.C:_crossdev_src_winpthreads_git20141130_src_mutex.c
lea rcx, [rax + 0x60]
lea r8, str._m___valid__LIFE_MUTEX____m___busy___0_
lea rdx, [0x0048e0a0]
mov dword [rsp + 0x20], 0x39
call sub.msvcrt.dll_fprintf
mov ecx, 1
call sub.msvcrt.dll_exit
nop
nop
lea r8, [0x0041e5a0]
lea rcx, str.mutex_global_shmem
mov edx, 8
jmp fcn.00420620
Function at 0x420620
Capabilities:
Check mutex on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x80]
mov rdi, rcx
movsxd r12, edx
mov r13, r8
call sub.msvcrt.dll_strlen
mov r14, rax
lea ebx, [rax + 0xf]
lea eax, [rax + 0x51]
cdqe
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.0040feb0
sub rsp, rax
movsxd r15, r14d
movabs rax, 0x656d68732d636367
lea rsi, [rsp + 0x20]
lea rcx, [rsp + 0x2f]
mov r8, r15
mov rdx, rdi
mov qword [rsp + 0x20], rax
mov eax, 0x326d
mov dword [rsp + 0x28], 0x64742d6d
mov word [rsp + 0x2c], ax
movsxd rbx, ebx
mov byte [rsp + 0x2e], 0x2d
call sub.msvcrt.dll_memcpy
lea rax, [rsi + r15 + 0x10]
lea r15d, [r14 + 0x50]
movabs rdx, 0x6161616161616161
xor ecx, ecx
mov r8, rsi
mov qword [rax], rdx
mov qword [rax + 8], rdx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], rdx
mov qword [rax + 0x20], rdx
mov qword [rax + 0x28], rdx
mov qword [rax + 0x30], rdx
mov qword [rax + 0x38], rdx
movsxd rax, r15d
xor edx, edx
mov byte [rsp + rax + 0x20], 0
mov byte [rsp + rbx + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov byte [rsp + rbx + 0x20], 0x2d
mov rdi, rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x420709
int3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindAtomA]
test ax, ax
jne 0x4207a2
mov rcx, r12
add r14d, 0x10
call sub.msvcrt.dll_malloc
mov r10d, 0x40
mov rbx, rax
bt rbx, r10
jae 0x420744
mov r11d, r15d
sub r11d, r10d
movsxd r11, r11d
mov byte [rsi + r11], 0x41
sub r10d, 1
jne 0x420730
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_AddAtomA]
test ax, ax
je 0x42079f
mov rdx, rsi
movzx ecx, ax
mov r9d, r14d
mov r8d, r15d
call fcn.004205a0
cmp rax, rbx
mov rsi, rax
je 0x4207b9
mov rcx, rbx
call fcn.0041a4b8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rsi
lea rsp, [rbp - 0x58]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
int3
lea r9d, [r14 + 0x10]
mov rdx, rsi
movzx ecx, ax
mov r8d, r15d
call fcn.004205a0
mov rsi, rax
jmp 0x420779
xor edx, edx
mov r8, r12
mov rcx, rbx
call sub.msvcrt.dll_memset
test r13, r13
je 0x420779
mov rcx, rbx
call r13
jmp 0x420779

Function at 0x4223c0
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [0x00473b40]
lea rcx, str.__terminate_handler_sh
mov edx, 8
jmp fcn.0040ff70

Function at 0x4223e0
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [0x00473b50]
lea rcx, str.__unexpected_handler_sh
mov edx, 8
jmp fcn.0040ff70
Function at 0x452ca0
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, qword [sym.imp.msvcrt.dll__errno]
mov rbp, rcx
mov rdi, rdx
mov esi, r8d
mov rcx, rbp
call fcn.00452b80
mov r8d, esi
mov rdx, rdi
mov ecx, eax
call sub.msvcrt.dll__read
movsxd rbx, eax
cmp rbx, 0xffffffffffffffff
je 0x452cf0
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call r12
cmp dword [rax], 4
je 0x452cba
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x140008742
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rcx
push r15
xor rax, rax
push rax
push rax
push rax
push rax
push rax
sub rsp, 0x28
call fcn.14003bb40
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x28]
sub rsp, 0x10
call fcn.14003bc10
add rsp, 0x10
mov rax, qword [rsp + 0x28]
mov rax, rax
push rax
push 1
push 0
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_CreateMutexW
mov qword [rsp + 0x30], rax
mov r15, qword [rsp + 0x30]
and r15, r15
je 0x1400087b6
call sub.KERNEL32.dll_GetLastError
mov r15, rax
cmp r15, 0xb7
jne 0x1400087b6
mov rax, 1
jmp 0x1400087b9
xor rax, rax
and rax, rax
je 0x14000880e
push qword [rsp + 0x30]
pop rcx
call sub.KERNEL32.dll_CloseHandle
movabs rdx, str.An_instance_of_the_application_is_currently_running._n_nDo_you_want_to_continue_
lea rcx, [rsp + 0x38]
call fcn.14003b8c0
push 0x124
push qword [rsp + 0x40]
movabs rax, str.Chromium_WebGadget
push rax
pop rcx
pop rdx
pop r8
call fcn.140009580
mov qword [rsp + 0x40], rax
mov r15, qword [rsp + 0x40]
cmp r15, 7
jne 0x14000880e
jmp 0x140001d4b
xor rax, rax
push rax
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.14003bbe0
add rsp, 0x28
mov rcx, qword [rsp + 0x40]
sub rsp, 0x28
call fcn.14003bbe0
add rsp, 0x28
pop rax
add rsp, 0x50
pop r15
ret
Function at 0x1400089e3
Capabilities:
Hide graphical window

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push r15
xor rax, rax
push rax
push rax
sub rsp, 0x28
call fcn.14003bb40
push 0
sub rsp, 8
push 1
mov rbp, qword [rsp + 0x68]
movsxd rax, dword [rbp]
mov rax, rax
push rax
pop rcx
pop rdx
sub rsp, 0x20
call sub.USER32.dll_GetAncestor
add rsp, 0x28
mov rax, rax
push rax
pop rcx
pop rdx
call sub.USER32.dll_ShowWindow
mov rbp, qword [rsp + 0x50]
movsxd rax, dword [rbp + 0x30]
mov rax, rax
push rax
pop rcx
call sub.USER32.dll_IsWindow
and rax, rax
je 0x140008ba2
push 5
mov rbp, qword [rsp + 0x58]
movsxd rax, dword [rbp + 0x30]
mov rax, rax
push rax
pop rcx
pop rdx
call sub.USER32.dll_GetWindow
mov qword [rsp + 0x28], rax
push 0xffffffffffffffec
mov rbp, qword [rsp + 0x58]
movsxd rax, dword [rbp + 0x30]
mov rax, rax
push rax
pop rcx
pop rdx
call sub.USER32.dll_GetWindowLongPtrW
mov r15, rax
or r15, 0x80000
mov rax, r15
push rax
push 0xffffffffffffffec
mov rbp, qword [rsp + 0x60]
movsxd rax, dword [rbp + 0x30]
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
call sub.USER32.dll_SetWindowLongPtrW
push 2
push 0
push 0
mov rbp, qword [rsp + 0x68]
movsxd rax, dword [rbp + 0x30]
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
call sub.USER32.dll_SetLayeredWindowAttributes
push 2
push 0
push 0
push qword [rsp + 0x40]
pop rcx
pop rdx
pop r8
pop r9
call sub.USER32.dll_SetLayeredWindowAttributes
push 0xfffffffffffffff0
push qword [rsp + 0x30]
pop rcx
pop rdx
call sub.USER32.dll_GetWindowLongPtrW
mov r15, rax
and r15, 0xffffffffefffffff
mov rax, r15
push rax
push 0xfffffffffffffff0
push qword [rsp + 0x38]
pop rcx
pop rdx
pop r8
call sub.USER32.dll_SetWindowLongPtrW
push 0xfffffffffffffff0
mov rbp, qword [rsp + 0x58]
movsxd rax, dword [rbp + 0x30]
mov rax, rax
push rax
pop rcx
pop rdx
call sub.USER32.dll_GetWindowLongPtrW
mov r15, rax
or r15, 0x20000000
and r15, 0xffffffffbfffffff
mov rax, r15
push rax
push 0xfffffffffffffff0
mov rbp, qword [rsp + 0x60]
movsxd rax, dword [rbp + 0x30]
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
call sub.USER32.dll_SetWindowLongPtrW
push 0
mov rbp, qword [rsp + 0x58]
movsxd rax, dword [rbp + 0x30]
mov rax, rax
push rax
pop rcx
pop rdx
call sub.USER32.dll_SetParent
mov rbp, qword [rsp + 0x50]
movsxd rax, dword [rbp]
mov rax, rax
push rax
mov rbp, qword [rsp + 0x58]
movsxd rax, dword [rbp + 0x30]
mov rax, rax
push rax
pop rcx
pop rdx
call sub.USER32.dll_SetParent
push qword [0x1400dec4c]
pop rcx
call fcn.140009388
and rax, rax
je 0x140008bdf
push 0
lea rax, [0x14000883e]
mov rax, rax
push rax
pop rcx
pop rdx
call fcn.140009424
mov qword [rsp + 0x30], rax
push 0x7d0
push qword [rsp + 0x38]
pop rcx
pop rdx
call fcn.140009504
xor rax, rax
add rsp, 0x38
pop r15
pop rbp
ret

Function at 0x140008fbc
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
call sub.KERNEL32.dll_GetLastError
mov qword [rsp + 0x38], rax
mov rcx, qword [0x1400dbf34]
call sub.KERNEL32.dll_TlsGetValue
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret
Function at 0x140009424
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x30
lea rax, [r11 + 0x18]
mov r9, rdx
mov r8, rcx
mov qword [r11 - 0x10], rax
xor edi, edi
mov edx, 0x1000
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbp, rax
test rax, rax
je 0x1400094ea
lea rcx, [0x1400dfa20]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400ded18]
jmp 0x1400094ae
lea rsi, [rbx + 0x10]
xor edx, edx
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1400094ab
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rbx]
lea rcx, [0x1400ded18]
mov rdx, rsi
call fcn.14003adfc
jmp 0x1400094ae
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14000947b
mov rdx, qword [reloc.WS2_32.dll_accept]
lea rcx, [0x1400ded18]
mov rdi, rdx
inc rdx
mov qword [reloc.WS2_32.dll_accept], rdx
lea edx, [rbx + 0x20]
call fcn.14003ae44
lea rcx, [0x1400dfa20]
mov qword [rax], rbp
mov qword [rax + 8], rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
mov rax, rdi
add rsp, 0x30
pop rdi
ret

Function at 0x1400096cc
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
test ecx, ecx
je 0x140009743
movsxd rdx, ecx
lea rcx, [0x140009628]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rbx, qword [0x1400ded20]
test rbx, rbx
je 0x1400097b6
mov rdi, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbx + 0x10], eax
jne 0x140009739
cmp byte [rbx + 0x20], 0
je 0x140009739
mov rcx, qword [rbx + 0x18]
xor r9d, r9d
mov dword [rsp + 0x30], 3
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea rdx, [r9 - 2]
xor r8d, r8d
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rbx, rdi
test rdi, rdi
jne 0x1400096ff
jmp 0x1400097b6
mov rbx, qword [0x1400ded20]
test rbx, rbx
je 0x1400097b6
mov rdi, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbx + 0x10], eax
jne 0x1400097ae
cmp byte [rbx + 0x21], 0
je 0x140009772
mov rcx, qword [rbx + 0x18]
mov edx, 1
call qword [sym.imp.USER32.dll_EnableWindow]
cmp byte [rbx + 0x20], 0
je 0x14000979e
mov rcx, qword [rbx + 0x18]
mov dword [rsp + 0x30], 3
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
or rdx, 0xffffffffffffffff
call qword [sym.imp.USER32.dll_SetWindowPos]
lea rdx, [rbx + 0x10]
lea rcx, [0x1400ded20]
call fcn.14003adfc
mov rbx, rdi
test rdi, rdi
jne 0x14000974f
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x1400274e0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x1400ded48], 0
jne 0x140027505
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1400ded48], 1
mov dword [0x1400ded4c], eax
mov rcx, qword [0x1400debcc]
xor edx, edx
mov r8d, 0x90
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x1400ded4c]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor ebx, eax
mov ecx, ebx
add rsp, 0x20
pop rbx
jmp 0x1400276c0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp dword [0x1400ded48], 0
mov ebx, ecx
jne 0x1400276e4
call fcn.1400274e0
mov ecx, dword [0x1400ded4c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rax, rax
jne 0x14002770c
call fcn.1400274e0
mov ecx, dword [0x1400ded4c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
lea rdx, [rdi + 8]
mov r8d, sendto
nop word [rax + rax]
imul eax, ebx, 0x53a9b4fb
mov ecx, 1
mov ebx, 1
sub ecx, eax
lea rdx, [rdx + 4]
mov dword [rdx + 0x40], ecx
imul eax, ecx, 0x53a9b4fb
sub ebx, eax
mov dword [rdx - 4], ebx
dec r8
jne 0x140027720
lea esi, [r8 + 0x1f]
mov dword [rdi], r8d
mov dword [rdi + 4], 0xa
lea ebp, [rsi - 0xf]
nop word [rax + rax]
movsxd r11, dword [rdi]
movsxd rbx, dword [rdi + 4]
mov r10d, dword [rdi + rbx*4 + 8]
mov r9d, dword [rdi + r11*4 + 8]
mov eax, dword [rdi + r11*4 + 0x4c]
ror r9d, 5
lea rcx, [rdi + r11*4]
lea r8, [rdi + r11*4]
ror eax, 0xd
add r9d, r10d
add eax, dword [rdi + rbx*4 + 0x4c]
dec r11d
mov dword [r8 + 0x4c], r9d
cmovs r11d, ebp
dec ebx
mov dword [rcx + 8], eax
cmovs ebx, ebp
mov dword [rdi], r11d
mov dword [rdi + 4], ebx
dec rsi
jne 0x140027760
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400276c0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x1400ded48], 0
jne 0x140027505
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1400ded48], 1
mov dword [0x1400ded4c], eax
mov rcx, qword [0x1400debcc]
xor edx, edx
mov r8d, 0x90
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x1400ded4c]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor ebx, eax
mov ecx, ebx
add rsp, 0x20
pop rbx
jmp 0x1400276c0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp dword [0x1400ded48], 0
mov ebx, ecx
jne 0x1400276e4
call fcn.1400274e0
mov ecx, dword [0x1400ded4c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rax, rax
jne 0x14002770c
call fcn.1400274e0
mov ecx, dword [0x1400ded4c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
lea rdx, [rdi + 8]
mov r8d, sendto
nop word [rax + rax]
imul eax, ebx, 0x53a9b4fb
mov ecx, 1
mov ebx, 1
sub ecx, eax
lea rdx, [rdx + 4]
mov dword [rdx + 0x40], ecx
imul eax, ecx, 0x53a9b4fb
sub ebx, eax
mov dword [rdx - 4], ebx
dec r8
jne 0x140027720
lea esi, [r8 + 0x1f]
mov dword [rdi], r8d
mov dword [rdi + 4], 0xa
lea ebp, [rsi - 0xf]
nop word [rax + rax]
movsxd r11, dword [rdi]
movsxd rbx, dword [rdi + 4]
mov r10d, dword [rdi + rbx*4 + 8]
mov r9d, dword [rdi + r11*4 + 8]
mov eax, dword [rdi + r11*4 + 0x4c]
ror r9d, 5
lea rcx, [rdi + r11*4]
lea r8, [rdi + r11*4]
ror eax, 0xd
add r9d, r10d
add eax, dword [rdi + rbx*4 + 0x4c]
dec r11d
mov dword [r8 + 0x4c], r9d
cmovs r11d, ebp
dec ebx
mov dword [rcx + 8], eax
cmovs ebx, ebp
mov dword [rdi], r11d
mov dword [rdi + 4], ebx
dec rsi
jne 0x140027760
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400277c0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x1400ded48], 0
mov rbx, rcx
jne 0x1400277d7
call fcn.1400274e0
mov ecx, dword [0x1400ded4c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r9, rax
test rax, rax
jne 0x1400277ff
call fcn.1400274e0
mov ecx, dword [0x1400ded4c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r9, rax
movsxd r8, dword [r9]
movsxd rdx, dword [r9 + 4]
mov eax, reloc.WS2_32.dll_recv
mov r10d, dword [r9 + r8*4 + 0x4c]
mov r11d, dword [r9 + r8*4 + 8]
ror r10d, 0xd
add r10d, dword [r9 + rdx*4 + 0x4c]
ror r11d, 5
add r11d, dword [r9 + rdx*4 + 8]
mov dword [r9 + r8*4 + 8], r10d
mov dword [r9 + r8*4 + 0x4c], r11d
dec r8d
mov ecx, r11d
cmovs r8d, eax
dec edx
cmovs edx, eax
mov dword [r9], r8d
mov dword [r9 + 4], edx
inc rbx
je 0x140027878
mov edx, r10d
mov r8, rbx
mov eax, ebx
shr r8, 0x20
imul rax, rdx
shr rax, 0x20
imul rcx, r8
imul rdx, r8
shr rcx, 0x20
add rax, rcx
add rax, rdx
add rsp, 0x20
pop rbx
ret
mov eax, r10d
shl rax, 0x20
and rax, rcx
add rsp, 0x20
pop rbx
ret
Function at 0x14002a178
Capabilities:
Create thread
Reference http user-agent string

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r13d, ecx
mov rcx, qword [0x1400dfc00]
mov rsi, r9
mov r14, r8
mov r15, rdx
xor ebx, ebx
call fcn.14003a1d8
mov r12, rax
test r15, r15
je 0x14002a2ba
mov rcx, qword [0x1400debcc]
lea edx, [rbx + 8]
mov r8d, 0x98
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ebp, [rbx + 1]
mov rcx, r15
or dword [rax + 4], 0xffffffff
mov dword [rax], ebp
mov rdi, rax
call sub.msvcrt.dll__wcsdup
lea rcx, str.Mozilla_5.0_Gecko_41.0_Firefox_41.0
mov qword [rdi + 8], rax
call sub.msvcrt.dll__wcsdup
mov ecx, dword [rsp + 0x80]
mov qword [rdi + 0x60], rax
mov dword [rdi + 0x40], ecx
mov eax, dword [r12]
mov dword [rdi + 0x44], eax
mov eax, dword [r12 + 4]
mov dword [rdi + 0x80], r13d
mov dword [rdi + 0x48], eax
mov rax, qword [rsp + 0x88]
mov qword [rdi + 0x88], rsi
mov qword [rdi + 0x78], rax
test bpl, cl
je 0x14002a2ab
test rsi, rsi
je 0x14002a264
mov rcx, qword [0x1400debcc]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rdi + 0x70], rax
test rax, rax
je 0x14002a25e
mov r8, rsi
mov rdx, r14
mov rcx, rax
call sub.msvcrt.dll_memcpy
cmp qword [rdi + 0x70], rbx
je 0x14002a2a1
lea rax, [rsp + 0x68]
lea r8, [0x14002a2dc]
mov r9, rdi
mov qword [rsp + 0x28], rax
mov edx, 0x10000
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x14002a299
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14002a29d
mov ebp, dword [rsp + 0x68]
test ebp, ebp
jne 0x14002a2b7
mov rcx, rdi
call fcn.140029c04
jmp 0x14002a2ba
mov rcx, rdi
mov qword [rdi + 0x70], r14
call fcn.140029ca0
mov rbx, rdi
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rax, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret