joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14025e90d
Capabilities:
Terminate process

Disassembly:
push rax
pushf
mov eax, 0x7fc0142f
pushf
not eax
add eax, 0xfa618098
xor eax, 0xde6efd1e
rol eax, 0x95
popf
pushf
not eax
add eax, 0x967404a3
xor eax, 0xcadd724f
rol eax, 0x1a
popf
pushf
not eax
add eax, 0xebb64448
xor eax, 0xc0801a97
rol eax, 0xb0
popf
pushf
not eax
add eax, 0xb39c027e
xor eax, 0x9228d4fc
rol eax, 0x67
popf
cmp eax, 2
jne 0x14025e970
popf
pop rax
jmp 0x14025ea51
cmp eax, 0
jne 0x14025e97f
popf
pop rax
jmp 0x14025e98e
cmp eax, 1
jne 0x14025e98e
popf
pop rax
jmp 0x14025ea3f
push rbx
sub rsp, 0x20
mov ebx, ecx
call fcn.14029d2f8
test al, al
je 0x14025e9e5
push rax
pushf
mov eax, 0xb778a4b1
pushf
not eax
add eax, 0x9ac5d419
xor eax, 0xcbbe7c88
rol eax, 3
popf
pushf
not eax
add eax, 0x829c02d3
xor eax, 0xd21c02d2
rol eax, 0xde
popf
pushf
not eax
add eax, 0x8c779a4e
xor eax, 0x923041ef
rol eax, 0x1e
popf
jmp 0x14025e961
push rax
pushf
mov eax, 0xb3347f1c
pushf
not eax
add eax, 0xafad30c2
xor eax, 0xe1084016
rol eax, 0xbd
popf
pushf
not eax
add eax, 0xa73f9f3b
xor eax, 0xdfd8cb76
rol eax, 0xb7
popf
pushf
not eax
add eax, 0xdb2c3593
xor eax, 0xa708c15a
rol eax, 0xb7
popf
pushf
not eax
add eax, 0x8e6b27ae
xor eax, 0xb2e7bcc5
rol eax, 0x5a
popf
jmp 0x14025e961
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, ebx
jmp 0x14025ea4b
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
call fcn.140258147
mov ecx, ebx
jmp 0x14025ea5b
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x14026c320
Capabilities:
Hash data using murmur3

Disassembly:
push rax
pushf
mov eax, 0x9b0e011c
pushf
not eax
add eax, 0xd19a2c25
xor eax, 0xc3896b21
rol eax, 0xc5
popf
pushf
not eax
add eax, 0x96d3e478
xor eax, 0xf62bdf39
rol eax, 0xdf
popf
cmp eax, 0
jne 0x14026c35d
popf
pop rax
jmp 0x14026c35d
jmp fcn.14030157e
Function at 0x14026ddcf
Capabilities:
Get geographical location

Disassembly:
push rax
pushf
mov eax, 0xbf9db3ca
pushf
not eax
add eax, 0xf27f5a9b
xor eax, 0xbfdd3321
rol eax, 0x5b
popf
pushf
not eax
add eax, 0xabc836b5
xor eax, 0x8d4c4d81
rol eax, 0xf3
popf
pushf
not eax
add eax, 0xa3da85e1
xor eax, 0xd9c75d4d
rol eax, 0xd5
popf
pushf
not eax
add eax, 0xd94cef5d
xor eax, 0xd59d2107
rol eax, 0x8c
popf
cmp eax, 2
jne 0x14026de32
popf
pop rax
jmp 0x14026e023
cmp eax, 0
jne 0x14026de41
popf
pop rax
jmp 0x14026de5f
cmp eax, 3
jne 0x14026de50
popf
pop rax
jmp 0x14026e097
cmp eax, 1
jne 0x14026de5f
popf
pop rax
jmp 0x14026dfa1
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov ebx, r9d
mov rdi, r8
mov esi, edx
lea r9, [0x1b8f458eb]
pushf
sub r9, 0x78e303e3
popf
mov rbp, rcx
lea r8, [0x1afdb9255]
pushf
sub r8, 0x6fca3d55
popf
lea rdx, [0x1bbc128fc]
pushf
sub rdx, 0x7bafd3f4
popf
mov ecx, 0x54b81464
pushf
not ecx
add ecx, 0x8678bf38
xor ecx, 0xfe320c2a
rol ecx, 0xce
popf
pushf
not ecx
add ecx, 0xa3611609
xor ecx, 0xd4926427
rol ecx, 0x43
popf
pushf
not ecx
add ecx, 0xfcc844d5
xor ecx, 0x9346137b
rol ecx, 0x71
popf
call fcn.1401013bc
test rax, rax
je 0x14026df5b
push rax
pushf
mov eax, 0x9c53d5e6
pushf
not eax
add eax, 0xa296da18
xor eax, 0xa0b1612a
rol eax, 0xce
popf
pushf
not eax
add eax, 0xa16785a9
xor eax, 0xddac1879
rol eax, 0x97
popf
pushf
not eax
add eax, 0xe7e3001a
xor eax, 0xf436170e
rol eax, 0x80
popf
pushf
not eax
add eax, 0xda062bec
xor eax, 0xe137fd15
rol eax, 0x24
popf
jmp 0x14026de23
push rax
pushf
mov eax, 0x3377edfa
pushf
not eax
add eax, 0xface43eb
xor eax, 0x9fec28f6
rol eax, 0x5c
popf
pushf
not eax
add eax, 0xa85d213b
xor eax, 0x9e63c5ba
rol eax, 0x16
popf
pushf
not eax
add eax, 0xf86bdbe3
xor eax, 0xc430af33
rol eax, 0xef
popf
jmp 0x14026de23
movabs r10, 0x9059d3915cd375aa
pushf
not r10
add r10, 0x67d0922f
xor r10, 0x510e0e4f
rol r10, 0xa9
popf
pushf
not r10
add r10, 0x569fc42d
xor r10, 0x6c834a91
rol r10, 0x19
popf
pushf
not r10
add r10, 0x5ca69480
xor r10, 0x5e9d64e1
rol r10, 0x4e
popf
pushf
not r10
add r10, 0x682741d8
xor r10, 0x5e5a25d9
rol r10, 0xec
popf
mov r9d, ebx
mov r8, rdi
mov edx, esi
mov rcx, rbp
jmp 0x14026e01b
call qword [0x1401112f0]
jmp 0x14026e097
xor edx, edx
mov rcx, rbp
call fcn.140282e96
mov ecx, eax
mov r9d, ebx
mov r8, rdi
mov edx, esi
jmp 0x14026e038
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push rax
pushf
mov eax, 0x1b1e44e7
pushf
not eax
add eax, 0xd87f5918
xor eax, 0xa80d38d3
rol eax, 0x5b
popf
pushf
not eax
add eax, 0x879da422
xor eax, 0xb0010900
rol eax, 4
popf
pushf
not eax
add eax, 0x8074c9f9
xor eax, 0xb63d8e02
rol eax, 0x46
popf
pushf
not eax
add eax, 0xbefa48f7
xor eax, 0xdf8236ad
rol eax, 0x6d
popf
jmp 0x14026de23
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1402b16dc
Capabilities:
Authenticate hmac

Disassembly:
push rax
pushf
mov eax, 0xae5f48b9
pushf
not eax
add eax, 0x972a1352
xor eax, 0x94f9bef4
rol eax, 0x36
popf
pushf
not eax
add eax, 0x855021f2
xor eax, 0x9fb8248c
rol eax, 0xbd
popf
pushf
not eax
add eax, 0xfd8830f7
xor eax, 0xf1bd7122
rol eax, 0x25
popf
pushf
not eax
add eax, 0x98b373b4
xor eax, 0xab63f78e
rol eax, 0x7b
popf
cmp eax, 2
jne 0x1402b173f
popf
pop rax
jmp 0x1402b190f
cmp eax, 0
jne 0x1402b174e
popf
pop rax
jmp 0x1402b175d
cmp eax, 1
jne 0x1402b175d
popf
pop rax
jmp 0x1402b188b
push rbx
sub rsp, 0x20
mov rbx, rcx
lea r9, [0x191ae333f]
pushf
sub r9, 0x519cdd67
popf
mov ecx, 0xd8e3c058
pushf
not ecx
add ecx, 0xdaf3f1dc
xor ecx, 0xa04bf96b
rol ecx, 0xee
popf
pushf
not ecx
add ecx, 0xecfc045e
xor ecx, 0xafef4a9c
rol ecx, 0x21
popf
pushf
not ecx
add ecx, 0xd80ceae9
xor ecx, 0x9c6ffa93
rol ecx, 0x8c
popf
pushf
not ecx
add ecx, 0xd1d53024
xor ecx, 0xceab1627
rol ecx, 0x1b
popf
lea r8, [0x18f31ec8a]
pushf
sub r8, 0x4f2096b6
popf
lea rdx, [0x185a60a21]
pushf
sub rdx, 0x4594b449
popf
call fcn.1401013bc
test rax, rax
je 0x1402b1858
push rax
pushf
mov eax, 0xac8ad191
pushf
not eax
add eax, 0xfd0e5c4a
xor eax, 0xbb74764e
rol eax, 0xb3
popf
pushf
not eax
add eax, 0xc1943324
xor eax, 0x8a1b851a
rol eax, 0x8e
popf
pushf
not eax
add eax, 0x89a6312c
xor eax, 0xc351448f
rol eax, 0x16
popf
pushf
not eax
add eax, 0xdd37e893
xor eax, 0xafda329c
rol eax, 0x93
popf
jmp 0x1402b1730
push rax
pushf
mov eax, 0x648a7862
pushf
not eax
add eax, 0x85147eea
xor eax, 0xf5a29d91
rol eax, 0xc9
popf
pushf
not eax
add eax, 0xeee9ccac
xor eax, 0x9db39e01
rol eax, 0x19
popf
jmp 0x1402b1730
movabs r10, 0x390eddeea2665a0a
pushf
not r10
add r10, 0x60115f24
xor r10, 0x4f3942e7
rol r10, 0x5c
popf
pushf
not r10
add r10, 0x78704c55
xor r10, 0x657ca996
rol r10, 4
popf
pushf
not r10
add r10, 0x407d7c98
xor r10, 0x40e3b731
rol r10, 0x51
popf
pushf
not r10
add r10, 0x56b0fb25
xor r10, 0x69699b34
rol r10, 0x52
popf
mov rdx, rbx
mov rcx, 0xfffffffffffffffa
add rsp, 0x20
pop rbx
jmp qword [0x1401112f0]
mov eax, 0x7ce605c0
pushf
not eax
add eax, 0xfa80fa5d
xor eax, 0xdb21f8e2
rol eax, 0x2b
popf
pushf
not eax
add eax, 0xb938dac0
xor eax, 0xe0f6b98a
rol eax, 0x14
popf
add rsp, 0x20
pop rbx
ret
Function at 0x140300c8a
Capabilities:
Encode data using base64
Hash data using murmur3

Disassembly:
push rax
pushf
mov eax, 0x922b9c7b
pushf
not eax
add eax, 0xa787b39c
xor eax, 0xd0e22b3b
rol eax, 0xeb
popf
pushf
not eax
add eax, 0xde5c47be
xor eax, 0xec7b6990
rol eax, 0x4d
popf
cmp eax, 4
jne 0x140300cc7
popf
pop rax
jmp 0x140300e4a
cmp eax, 0
jne 0x140300cd6
popf
pop rax
jmp 0x140300d12
cmp eax, 3
jne 0x140300ce5
popf
pop rax
jmp 0x140300de8
cmp eax, 1
jne 0x140300cf4
popf
pop rax
jmp 0x140300d97
cmp eax, 5
jne 0x140300d03
popf
pop rax
jmp 0x140300e9e
cmp eax, 2
jne 0x140300d12
popf
pop rax
jmp 0x140300de2
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x140300d64
push rax
pushf
mov eax, 0x47b98bc6
pushf
not eax
add eax, 0x8db39b3e
xor eax, 0xdb284d54
rol eax, 0xb6
popf
pushf
not eax
add eax, 0xfe2c7200
xor eax, 0xab5c3157
rol eax, 0xd2
popf
pushf
not eax
add eax, 0xd51a5b4d
xor eax, 0xa436a2ea
rol eax, 0x12
popf
jmp 0x140300cb8
push rax
pushf
mov eax, 0x100078dd
pushf
not eax
add eax, 0xc148ac73
xor eax, 0xbc27f752
rol eax, 0xbd
popf
pushf
not eax
add eax, 0xd6ddc5bb
xor eax, 0xf52fdd22
rol eax, 0x55
popf
jmp 0x140300cb8
call fcn.140268c65
mov dword [rax], 0x16
call fcn.14029e498
or eax, 0xffffffff
jmp 0x140300e9e
sub dword [rcx + 0x10], 1
jns 0x140300e4a
add rsp, 0x28
jmp fcn.140258548
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
push rax
pushf
mov eax, 0x5d099483
pushf
not eax
add eax, 0xbc22c3b7
xor eax, 0xd7c8de9c
rol eax, 0xbd
popf
pushf
not eax
add eax, 0x98e5e3f1
xor eax, 0xae9ccaa2
rol eax, 0x1d
popf
pushf
not eax
add eax, 0xad2e8ed7
xor eax, 0x8c03a0f6
rol eax, 0x20
popf
jmp 0x140300cb8
add rsp, 0x28
ret
Function at 0x180014a8c
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x180014aa2
mov al, 1
jmp 0x180014b02
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x180014ab3
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x180014b00
mov ecx, dword [rcx + 0x18]
nop
call fcn.18001e678
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180014b00
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x180014b00
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x180014b00
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x180014b02
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x1800192fc
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.1800076e0
sub rsp, rax
mov rax, qword [0x180039068]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.18001496c
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x18001934b
mov rax, rbp
jmp 0x180019453
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x180000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x3b2c0]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.18001a248
mov r13, rax
lea rax, [0x180000000]
mov rcx, qword [rax + rbx*8 + 0x3b2c0]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x18001944f
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18001944f
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.18001a248
test rax, rax
js 0x18001944f
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x18001944f
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x180019441
lea r8, [0x180000000]
cmp rcx, rdx
jae 0x180019441
cmp byte [rcx], 0xd
jne 0x180019427
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x180019436
cmp byte [rcx + 1], 0xa
jne 0x180019436
inc rcx
jmp 0x180019436
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x39460]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x180019409
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x180019453
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.1800076b0
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800195e8
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x18003b2c0]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x18001963f
cmp word [rdx], r13w
jne 0x18001963f
or byte [rax + rdi*8 + 0x38], cl
jmp 0x180019644
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x180019769
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x18001978a
lea r9, [rdx + 2]
cmp cx, r11w
je 0x18001967d
mov rdx, r9
mov word [rbx], cx
jmp 0x1800196a4
cmp r9, r8
jae 0x1800196b4
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x18001965e
jmp 0x180019769
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18001975e
cmp dword [rsp + 0x80], esi
je 0x18001975e
lea r8, [0x18003b2c0]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x180019736
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x180019706
mov word [rbx], r13w
jmp 0x180019766
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x180019713
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x180019766
cmp word [rsp + 0x70], r13w
jne 0x180019743
cmp rbx, r14
je 0x180019700
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.18001a250
cmp word [rsp + 0x70], r13w
je 0x180019769
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x18003b2c0]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x180019763
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x180019769
Function at 0x18001debc
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x18001deec
xor eax, eax
jmp 0x18001dfaf
mov rbp, rbx
cmp word [rax], si
je 0x18001df11
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x18001def8
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x18001def4
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.18001c5a4
movsxd r14, eax
test eax, eax
jne 0x18001df4f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x18001dee5
mov rcx, r14
call fcn.18001a2f4
mov rdi, rax
test rax, rax
jne 0x18001df68
xor ecx, ecx
call fcn.180017bcc
jmp 0x18001df44
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.18001c5a4
test eax, eax
jne 0x18001df99
mov rcx, rdi
call fcn.180017bcc
jmp 0x18001dfa3
xor ecx, ecx
call fcn.180017bcc
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x180020d24
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.180014f90
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x180020dc5
cmp ebx, dword [rsp + 0x30]
je 0x180020dbe
test esi, esi
je 0x180020dbe
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x180020d99
sub r8w, 0x61
cmp r8w, 0x19
ja 0x180020da6
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x180020d83
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x180020daa
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x180020dc7
mov eax, 1
jmp 0x180020dc7
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180023be4
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.18001a250
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.18001a250
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x180023d34
cmp rax, 0xffffffffffffffff
je 0x180023d34
xor edi, edi
test rbp, rbp
jle 0x180023cdf
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.1800181b8
mov rbx, rax
test rax, rax
jne 0x180023c6c
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x180023cd5
mov edx, 0x8000
mov ecx, r14d
call fcn.180023a68
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1800178c4
cmp eax, 0xffffffff
je 0x180023cb5
cdqe
sub rbp, rax
test rbp, rbp
jg 0x180023c7c
mov edx, r15d
mov ecx, r14d
call fcn.180023a68
jmp 0x180023cd5
cmp byte [rsi + 0x38], dil
je 0x180023ccc
cmp dword [rsi + 0x34], 5
jne 0x180023ccc
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x180023cd5
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.180017bcc
jmp 0x180023d48
jns 0x180023d48
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.18001a250
cmp rax, 0xffffffffffffffff
jne 0x180023d00
cmp byte [rsi + 0x30], dil
je 0x180023d48
mov edi, dword [rsi + 0x2c]
jmp 0x180023d48
mov ecx, r14d
call fcn.18001e678
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x180023d48
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x180023d48
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x180023d41
mov eax, dword [rsi + 0x2c]
jmp 0x180023d46
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.18001a250
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x140046e90
Capabilities:
Set thread local storage value

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rax, qword [0x1400c9028]
xor rax, rsp
mov qword [rsp + 0x50], rax
test rcx, rcx
je 0x1400470a0
movabs rax, 0xe69e32f3ad9ea63
cmp qword [0x1400caed0], rax
jne 0x1400470a3
mov rsi, rcx
mov r14d, dword [rcx + 0xc]
add r14, 0x518
mov byte [rsp + 0x3f], 0xaa
mov dl, byte [rcx + 2]
mov rcx, r14
call fcn.1400470c0
movzx eax, ax
lea r12, [rax + rax*4]
lea r15, [rsi + r12*8]
add r15, 0x48
lea rbx, [rsi + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
jne 0x140046f12
mov rcx, rbx
call fcn.1400479b0
mov rax, qword [r15]
mov rdi, qword [rax]
test rdi, rdi
je 0x140047001
mov byte [rsp + 0x3f], 0
mov rcx, qword [rdi]
test rcx, rcx
je 0x140046f60
lea rdx, [rsi + 0x48]
bswap rcx
mov r14d, dword [rdx + r12*8 + 0x18]
mov rdx, rcx
xor rdx, rdi
cmp rdx, 0x1fffff
ja 0x140047068
mov edx, ecx
and edx, 0x1fc000
je 0x140047068
prefetcht0 byte [rcx]
jmp 0x140046f62
xor ecx, ecx
mov qword [rax], rcx
mov ecx, dword [rax + 0x18]
lea edx, [rcx + 2]
and edx, 0x3ffe
and ecx, 0xffffc001
or ecx, edx
mov dword [rax + 0x18], ecx
mov rax, qword [rax + 0x10]
mov eax, dword [rax + 0x18]
add rax, qword [rsi + 0x1498]
mov qword [rsi + 0x1498], rax
mov rcx, qword [rsi + 0x14a0]
cmp rcx, rax
cmova rax, rcx
mov qword [rsi + 0x14a0], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov rcx, rdi
mov rdx, rsi
call fcn.140047250
mov ecx, dword [0x1400db5bc]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x1400d8694]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x120], rdi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140076ac0
mov rax, rdi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rax, [rsp + 0x3f]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x4000
mov rcx, r15
mov rdx, rsi
mov r8d, 2
mov r9, r14
call fcn.14004dbf0
test rax, rax
je 0x140047099
mov rdi, rax
mov rcx, rax
and rcx, 0xffffffffffe00000
mov rdx, rax
shr rdx, 9
and edx, 0xfe0
lea rax, [rdx + rcx]
movzx ecx, byte [rdx + rcx + 0x101e]
and ecx, 0x3f
shl rcx, 5
sub rax, rcx
add rax, 0x1000
jmp 0x140046f7c
movaps xmm0, xmmword [0x1400b3900]
lea rsi, [rsp + 0x40]
movaps xmmword [rsi], xmm0
mov r8, qword [rdi]
lea rdx, str.first
mov rcx, rsi
call fcn.1400476f0
mov rcx, rsi
call fcn.140018a40
mov rcx, r14
call fcn.140047760
xor edi, edi
jmp 0x140046fa6
int3
int3

Function at 0x14004d9f0
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
sub rsp, 0x28
cmp qword [0x1400de9c8], 0
jne 0x14004da2d
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x14004da20
mov dword [rdi], eax
mov dword [0x1400de9d0], eax
mov qword [0x1400de9c8], rsi
cmp eax, 0xffffffff
setne al
add rsp, 0x28
pop rdi
pop rsi
ret
int3
Function at 0x1400529f0
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rbx, rdx
mov rsi, rcx
mov rax, qword [rcx + 8]
cmp rax, qword [rcx + 0x10]
je 0x140052a2e
test rax, rax
je 0x140052af7
mov rcx, qword [rbx]
mov qword [rax], rcx
add rax, 8
mov qword [rsi + 8], rax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
sub rax, qword [rsi]
mov r15, rax
sar r15, 3
lea rcx, [r15 + 1]
mov rdx, rcx
shr rdx, 0x3d
jne 0x140052b23
movabs rdx, 0x1fffffffffffffff
lea rdi, [rsi + 0x18]
mov r14, rax
shr r14, 2
cmp r14, rcx
cmovbe r14, rcx
movabs rcx, 0x7ffffffffffffff8
cmp rax, rcx
cmovae r14, rdx
test r14, r14
je 0x140052a88
mov rcx, rdi
mov rdx, r14
call fcn.140053710
jmp 0x140052a8a
xor eax, eax
shl r15, 3
add r15, rax
je 0x140052af7
lea rax, [rax + r14*8]
mov rcx, qword [rbx]
mov qword [r15], rcx
lea rcx, [r15 + 8]
mov rdx, qword [rsi]
mov r8, qword [rsi + 8]
cmp r8, rdx
je 0x140052ac5
mov r9, qword [r8 - 8]
add r8, 0xfffffffffffffff8
mov qword [r15 - 8], r9
add r15, 0xfffffffffffffff8
cmp r8, rdx
jne 0x140052aad
mov rdx, qword [rsi]
mov qword [rsi], r15
mov qword [rsi + 8], rcx
mov r8, qword [rsi + 0x10]
mov qword [rsi + 0x10], rax
test rdx, rdx
je 0x140052a22
sub r8, rdx
sar r8, 3
mov rcx, rdi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.1400531a0
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x25
call fcn.14001c910
mov rcx, rsi
call fcn.14001dc20
int3