joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140018ed0
Capabilities:
Get thread local storage value
Hijack thread execution

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x4f8
mov rsi, rcx
test rcx, rcx
je 0x140018fd6
lea rcx, [0x1400b2168]
call sym.pthread_mutex_lock
mov rcx, rsi
call sym.__pthread_get_pointer
lea rcx, [0x1400b2168]
mov rbx, rax
call sym.pthread_mutex_unlock
test rbx, rbx
je 0x140018fd6
mov rcx, qword [rbx + 0x28]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140018fd6
lea r12, [rsp + 0x20]
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x140018fd6
lea r13, [rbx + 0x38]
mov rcx, r13
call sym.pthread_mutex_lock
cmp dword [0x1400e2d40], 1
je 0x140018f57
call sym._pthread_once_raw.part.0.constprop.0.isra.0
mov ecx, dword [0x1400b2178]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400190e8
cmp rsi, qword [rax + 0x1d8]
je 0x140018ff0
mov edx, dword [rbx + 0x44]
movzx eax, byte [rbx + 0x40]
and edx, 3
cmp edx, 3
je 0x140019048
test al, 3
jne 0x140018fc8
and eax, 0xfffffffc
or eax, 1
mov byte [rbx + 0x40], al
lock add dword [0x1400e2d48], 1
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140018fac
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, r13
call sym.pthread_mutex_unlock
xor eax, eax
add rsp, 0x4f8
pop rbx
pop rsi
pop r12
pop r13
ret
mov rcx, r13
call sym.pthread_mutex_unlock
test byte [rbx + 0x40], 0xc
je 0x140018fb4
mov eax, 3
add rsp, 0x4f8
pop rbx
pop rsi
pop r12
pop r13
ret
movzx eax, byte [rbx + 0x40]
test al, 3
jne 0x140018fc8
and eax, 0xfffffffc
or eax, 1
mov byte [rbx + 0x40], al
lock add dword [0x1400e2d48], 1
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140019018
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [rbx + 0x44]
mov edx, eax
and edx, 3
cmp edx, 3
jne 0x140018fac
and eax, 0xfffffffe
mov rcx, r13
mov dword [rbx + 0x44], eax
movzx eax, byte [rbx + 0x40]
and eax, 0xfffffff3
or eax, 4
mov byte [rbx + 0x40], al
call sym.pthread_mutex_unlock
call sym._pthread_invoke_cancel
nop dword [rax]
test al, 0xc
jne 0x140018fc8
test al, 0xf
jne 0x140018fd6
mov rcx, qword [rbx + 0x28]
mov dword [rsp + 0x50], 0x100001
call qword [sym.imp.KERNEL32.dll_SuspendThread]
xor edx, edx
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140018fac
mov rcx, qword [rbx + 0x28]
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
lea rax, [sym._pthread_invoke_cancel]
mov rcx, qword [rbx + 0x28]
mov rdx, r12
mov qword [rsp + 0x118], rax
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
movzx eax, byte [rbx + 0x40]
and dword [rbx + 0x44], 0xfffffffe
and eax, 0xfffffff0
or eax, 5
mov byte [rbx + 0x40], al
lock add dword [0x1400e2d48], 1
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x1400190ce
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, r13
call sym.pthread_mutex_unlock
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x140018fac
call sym.__pthread_self_lite.part.0
test rax, rax
je 0x140018f75
jmp 0x140018f6c
Function at 0x140019100
Capabilities:
Get thread local storage value
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push r12
push rbx
sub rsp, 0x28
mov r12, rcx
lea rcx, [0x1400b2168]
mov ebx, edx
call sym.pthread_mutex_lock
mov rcx, r12
call sym.__pthread_get_pointer
test rax, rax
je 0x140019178
cmp qword [rax + 0x1d8], r12
jne 0x140019178
test byte [rax + 0x40], 0xc
jne 0x140019178
mov edx, dword [rax + 0xbc]
test edx, edx
jne 0x140019178
mov rax, qword [rax + 0x28]
sub rax, 1
cmp rax, 0xfffffffffffffffd
ja 0x140019178
lea rcx, [0x1400b2168]
call sym.pthread_mutex_unlock
test ebx, ebx
je 0x140019198
lea edx, [rbx - 2]
cmp edx, 0x15
ja 0x1400191a0
mov rcx, r12
add rsp, 0x28
pop rbx
pop r12
jmp sym.pthread_cancel
lea rcx, [0x1400b2168]
call sym.pthread_mutex_unlock
mov eax, 3
add rsp, 0x28
pop rbx
pop r12
ret
xor eax, eax
jmp 0x140019189
mov eax, 0x16
jmp 0x140019189

Function at 0x140019350
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
cmp dword [0x1400e2d40], 1
mov esi, ecx
mov rdi, rdx
je 0x14001936c
call sym._pthread_once_raw.part.0.constprop.0.isra.0
mov ecx, dword [0x1400b2178]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x1400193e8
test esi, 0xfffffffe
je 0x1400193a0
mov eax, 0x16
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
ret
lea r12, [rbx + 0x38]
mov rcx, r12
call sym.pthread_mutex_lock
test rdi, rdi
je 0x1400193b9
mov eax, dword [rbx + 0x44]
and eax, 1
mov dword [rdi], eax
mov ecx, dword [rbx + 0x44]
and ecx, 0xfffffffe
or esi, ecx
mov rcx, qword [rbx + 0x1d8]
mov dword [rbx + 0x44], esi
call sym.test_cancel_locked
mov rcx, r12
call sym.pthread_mutex_unlock
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
ret
call sym.__pthread_self_lite.part.0
mov rbx, rax
test rax, rax
jne 0x140019380
jmp 0x140019388

Function at 0x140019400
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
cmp dword [0x1400e2d40], 1
mov esi, ecx
mov rdi, rdx
je 0x14001941c
call sym._pthread_once_raw.part.0.constprop.0.isra.0
mov ecx, dword [0x1400b2178]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140019498
test esi, 0xfffffffd
je 0x140019450
mov eax, 0x16
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
ret
lea r12, [rbx + 0x38]
mov rcx, r12
call sym.pthread_mutex_lock
test rdi, rdi
je 0x140019469
mov eax, dword [rbx + 0x44]
and eax, 2
mov dword [rdi], eax
mov ecx, dword [rbx + 0x44]
and ecx, 0xfffffffd
or esi, ecx
mov rcx, qword [rbx + 0x1d8]
mov dword [rbx + 0x44], esi
call sym.test_cancel_locked
mov rcx, r12
call sym.pthread_mutex_unlock
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
ret
call sym.__pthread_self_lite.part.0
mov rbx, rax
test rax, rax
jne 0x140019430
jmp 0x140019438
Function at 0x140019790
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x40
mov rbx, rcx
mov rsi, rdx
test rcx, rcx
je 0x1400198d0
lea rcx, [0x1400b2168]
call sym.pthread_mutex_lock
mov rcx, rbx
call sym.__pthread_get_pointer
lea rcx, [0x1400b2168]
mov r12, rax
call sym.pthread_mutex_unlock
test r12, r12
je 0x1400198d0
mov rcx, qword [r12 + 0x28]
test rcx, rcx
je 0x1400198d0
lea rdx, [rsp + 0x3c]
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x1400198d0
test byte [r12 + 0x44], 4
jne 0x1400198e0
cmp dword [0x1400e2d40], 1
je 0x14001980e
call sym._pthread_once_raw.part.0.constprop.0.isra.0
mov ecx, dword [0x1400b2178]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400198f0
cmp rbx, qword [rax + 0x1d8]
je 0x140019908
mov eax, dword [r12 + 0xbc]
mov rcx, qword [r12 + 0x28]
test eax, eax
je 0x14001984b
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14001985b
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [r12 + 0x28]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbx
mov rcx, qword [r12 + 0x30]
test rcx, rcx
je 0x140019870
call rbx
mov qword [r12 + 0x30], 0
test rsi, rsi
je 0x140019886
mov rax, qword [r12 + 8]
mov qword [rsi], rax
lea rcx, [r12 + 0x38]
call sym.pthread_mutex_destroy
lea rcx, [r12 + 0x68]
call sym.pthread_spin_destroy
cmp eax, 1
je 0x14001990f
mov qword [r12 + 0x68], 0xffffffffffffffff
xor eax, eax
cmp qword [r12 + 0x1d0], 0
jne 0x1400198d5
mov rcx, r12
mov dword [rsp + 0x2c], eax
call sym.push_pthread_mem.part.0
mov eax, dword [rsp + 0x2c]
jmp 0x1400198d5
mov eax, 3
add rsp, 0x40
pop rbx
pop rsi
pop r12
ret
mov eax, 0x16
add rsp, 0x40
pop rbx
pop rsi
pop r12
ret
call sym.__pthread_self_lite.part.0
test rax, rax
je 0x140019830
jmp 0x140019823
mov eax, 0x24
jmp 0x1400198d5
call sym.replace_spin_keys.part.0
nop
nop word cs:[rax + rax]
Function at 0x140019920
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x30
mov rbx, rcx
lea rcx, [0x1400b2168]
mov rsi, rdx
call sym.pthread_mutex_lock
mov rcx, rbx
call sym.__pthread_get_pointer
mov r12, rax
test rax, rax
je 0x140019a50
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x140019a50
lea rdx, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x140019a50
test byte [r12 + 0x44], 4
jne 0x140019a70
cmp dword [0x1400e2d40], 1
je 0x140019988
call sym._pthread_once_raw.part.0.constprop.0.isra.0
mov ecx, dword [0x1400b2178]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140019ab8
mov rdx, qword [rax + 0x1d8]
cmp rbx, rdx
je 0x140019ae0
mov edx, dword [r12 + 0xbc]
test edx, edx
jne 0x1400199ce
xor edx, edx
mov rcx, qword [r12 + 0x28]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140019a90
mov rcx, qword [r12 + 0x28]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbx
mov rcx, qword [r12 + 0x30]
test rcx, rcx
je 0x1400199e8
call rbx
mov qword [r12 + 0x30], 0
test rsi, rsi
je 0x1400199fe
mov rax, qword [r12 + 8]
mov qword [rsi], rax
lea rcx, [r12 + 0x38]
call sym.pthread_mutex_destroy
lea rcx, [r12 + 0x68]
call sym.pthread_spin_destroy
cmp eax, 1
je 0x140019af6
cmp qword [r12 + 0x1d0], 0
mov qword [r12 + 0x68], 0xffffffffffffffff
je 0x140019ad0
lea rcx, [0x1400b2168]
call sym.pthread_mutex_unlock
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop r12
ret
lea rcx, [0x1400b2168]
call sym.pthread_mutex_unlock
mov eax, 3
add rsp, 0x30
pop rbx
pop rsi
pop r12
ret
lea rcx, [0x1400b2168]
call sym.pthread_mutex_unlock
mov eax, 0x16
add rsp, 0x30
pop rbx
pop rsi
pop r12
ret
mov eax, dword [r12 + 0xbc]
test eax, eax
jne 0x1400199ce
lea rcx, [0x1400b2168]
call sym.pthread_mutex_unlock
mov eax, 0x10
jmp 0x140019a41
call sym.__pthread_self_lite.part.0
xor edx, edx
test rax, rax
je 0x1400199a4
jmp 0x14001999d
mov rcx, r12
call sym.push_pthread_mem.part.0
jmp 0x140019a33
lea rcx, [0x1400b2168]
call sym.pthread_mutex_unlock
mov eax, 0x24
jmp 0x140019a41
call sym.replace_spin_keys.part.0
nop
nop dword [rax]

Function at 0x14001cf30
Capabilities:
Read file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov r9, qword [rcx + 0x40]
mov rsi, rdx
mov rbx, rcx
mov edx, 1
mov rcx, rsi
call sym.fread
mov edx, 0xffffffff
test rax, rax
jle 0x14001cf5c
movzx edx, byte [rsi + rax - 1]
mov dword [rbx + 0x48], edx
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x14001dbd0
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x30
cmp byte [0x1400b4eb0], 0
jne 0x14001dcda
mov byte [global_terminating], 1
call dbg.__cxa_current_exception_type
test rax, rax
je 0x14001dcb0
mov r12, qword [rax + 8]
xor eax, eax
lea r9, [rsp + 0x2c]
cmp byte [r12], 0x2a
mov dword [rsp + 0x2c], 0xffffffff
sete al
xor r8d, r8d
xor edx, edx
add r12, rax
mov rcx, r12
call dbg.__cxa_demangle
mov ecx, 2
mov rbx, qword [dbg.__acrt_iob_func]
mov r13, rax
call rbx
mov edx, 1
lea rcx, str.terminate_called_after_throwing_an_instance_of_
mov r8d, 0x30
mov r9, rax
call sym.fwrite
mov edx, dword [rsp + 0x2c]
mov ecx, 2
test edx, edx
je 0x14001dca1
call rbx
mov rcx, r12
mov rdx, rax
call sym.fputs
mov ecx, 2
call rbx
mov r8d, 2
mov edx, 1
lea rcx, [0x1400b6951]
mov r9, rax
call sym.fwrite
mov eax, dword [rsp + 0x2c]
test eax, eax
jne 0x14001dc9c
mov rcx, r13
call sym.free
call dbg.__cxa_rethrow
call rbx
mov rcx, r13
mov rdx, rax
call sym.fputs
jmp 0x14001dc6b
mov ecx, 2
call qword [dbg.__acrt_iob_func]
mov r8d, 0x2d
mov edx, 1
lea rcx, str.terminate_called_without_an_active_exception_n
mov r9, rax
call sym.fwrite
call sym.abort
mov ecx, 2
call qword [dbg.__acrt_iob_func]
mov r8d, 0x1d
mov edx, 1
lea rcx, str.terminate_called_recursively_n
mov r9, rax
call sym.fwrite
call sym.abort
sub rdx, 1
mov rcx, rax
jne 0x14001dd6f
call dbg.__cxa_begin_catch
mov rcx, rax
mov rax, qword [rax]
call qword [rax + 0x10]
mov ecx, 2
mov r12, rax
call rbx
mov r9, rax
mov r8d, 0xb
mov edx, 1
lea rcx, str.__what__:
call sym.fwrite
mov ecx, 2
call rbx
mov rdx, rax
mov rcx, r12
call sym.fputs
mov ecx, 2
call rbx
mov rdx, rax
mov ecx, 0xa
call sym.fputc
call dbg.__cxa_end_catch
jmp 0x14001dcd5
call dbg.__cxa_begin_catch
call dbg.__cxa_end_catch
jmp 0x14001dcd5

Function at 0x140077210
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
jmp 0x140077237
call rbp
cmp dword [rax], 4
jne 0x140077254
mov rcx, rdi
call dbg.std::__basic_file<char>::fd()
mov r8d, ebx
mov rdx, rsi
mov ecx, eax
call sym.read
movsxd r12, eax
cmp eax, 0xffffffff
je 0x140077230
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x14008a750
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov rdi, rcx
test rax, rax
je 0x14008a778
xor ecx, ecx
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov ebx, 4
lea rsi, [rsp + 0x2c]
nop dword [rax]
mov ecx, dword [rdi + 0x10]
mov r8d, ebx
mov rdx, rsi
call sym.read
test eax, eax
jle 0x14008a7c0
cdqe
add rsi, rax
sub rbx, rax
jne 0x14008a790
mov eax, dword [rsp + 0x2c]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp eax, 0xffffffff
jne 0x14008a7cc
call rbp
cmp dword [rax], 4
je 0x14008a790
lea rcx, str.random_device_could_not_be_read
call dbg.std::__throw_runtime_error(char const*)
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x140002274
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400022be
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400022be
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400022be
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400022be
cmp dword [rcx + 0x84], 0xe
jbe 0x1400022be
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400022c0
xor al, al
add rsp, 0x28
ret
Function at 0x140001c30
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, dword [0x1400175b0]
syscall
ret

Function at 0x140001c3c
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, dword [0x1400175ac]
syscall
ret

Function at 0x140002728
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.140002590
Function at 0x10000bae0
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
push r13
sub rsp, 0xb0
xor ebx, ebx
mov dword [rsp + 0x20], ebx
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
mov r12d, ebx
xor eax, eax
lock cmpxchg qword [0x100011df8], rdi
je 0x10000bb40
cmp rax, rdi
jne 0x10000bb33
mov r12d, 1
jmp 0x10000bb40
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10000bb19
mov eax, dword [0x100011df0]
cmp eax, 1
jne 0x10000bb55
lea ecx, [rax + 0x1e]
call sub.msvcrt.dll__amsg_exit
jmp 0x10000bbbc
mov eax, dword [0x100011df0]
cmp eax, ebx
jne 0x10000bbb2
mov dword [0x100011df0], 1
lea r13, [0x100001448]
lea rdi, [0x100001430]
mov qword [rsp + 0x30], rdi
mov eax, ebx
mov dword [rsp + 0x24], ebx
cmp rdi, r13
jae 0x10000bba4
cmp eax, ebx
jne 0x10000bba4
mov rcx, qword [rdi]
cmp rcx, rbx
je 0x10000bb99
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x10000bb82
cmp eax, ebx
je 0x10000bbbc
mov eax, 0xff
jmp 0x10000bd04
mov dword [0x1000115d4], 1
mov eax, dword [0x100011df0]
cmp eax, 1
jne 0x10000bbe4
lea rdx, [0x100001428]
lea rcx, [0x1000013f0]
call sub.msvcrt.dll__initterm
mov dword [0x100011df0], 2
cmp r12d, ebx
jne 0x10000bbf3
mov rax, rbx
xchg qword [0x100011df8], rax
cmp qword [0x100011e10], rbx
je 0x10000bc1b
lea rcx, [0x100011e10]
call fcn.10000c0cc
cmp eax, ebx
je 0x10000bc1b
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x100011e10]
mov rcx, qword [sym.imp.msvcrt.dll__wcmdln]
cmp qword [rcx], rbx
jne 0x10000bc31
mov eax, 0xff
jmp 0x10000bd04
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
cmp word [rcx], 0x20
ja 0x10000bcb6
cmp word [rcx], bx
je 0x10000bc4c
cmp edx, ebx
jne 0x10000bcb6
cmp word [rcx], bx
je 0x10000bc62
cmp word [rcx], 0x20
ja 0x10000bc62
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x10000bc4c
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x100000000]
call fcn.100002d14
mov dword [0x1000115d0], eax
cmp dword [0x1000115b4], ebx
jne 0x10000bca0
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1000115d4], ebx
jne 0x10000bcb4
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1000115d0]
jmp 0x10000bd04
cmp word [rcx], 0x22
jne 0x10000bcc9
mov eax, ebx
cmp edx, ebx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x10000bc3d
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r12, qword [r11 + 0x20]
mov rsp, r11
pop r13
ret
sub rsp, 0x28
call fcn.10014e000
add rsp, 0x28
jmp 0x10000bae0
Function at 0x141e37e10
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x141e37e1d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x141e37e2d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x141e37e15
lea eax, [rcx + 1]
jmp 0x141e37e3b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x141e37e4e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x141e37e34
sub eax, 3
jb 0x141e37e6e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x141e37ebd
sar eax, 1
movsxd rbp, eax
jb 0x141e37ea4
jmp 0x141e37e7c
add ebx, ebx
jne 0x141e37e7a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x141e37ea4
inc ecx
add ebx, ebx
jne 0x141e37e8a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x141e37ea4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x141e37e9d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x141e37e8c
add ecx, 2
jmp 0x141e37ea9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.141eda000
jmp 0x141e37e1d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x12d600
mov dl, 0x22
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x141e37f09
cmp rsi, rcx
jae 0x141e37f11
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x141e37ef0
cmp al, 0x8f
ja 0x141e37ef0
cmp byte [rsi - 2], 0xf
je 0x141e37ef6
sub al, 0xe8
cmp al, 1
ja 0x141e37eda
cmp rsi, rcx
jae 0x141e37f11
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x141e37ee0
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x141e37f11
lodsb al, byte [rsi]
jmp 0x141e37ef0
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x1e33000]
mov eax, dword [rdi]
or eax, eax
je 0x141e37f7a
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x1e4bccc]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x141e37f1e
jns 0x141e37f53
movzx rdx, word [rdi]
add rdi, 2
jmp 0x141e37f5d
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x141e37f74
mov qword [rbx], rax
add rbx, 8
jmp 0x141e37f3e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x141e37fd2
sub rsp, 0xffffffffffffff80
jmp section.UPX0
Function at 0x140003730
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14000378d
lea rbx, [0x1400bf3c0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140003774
cmp r10, 2
jb 0x140003774
cmp byte [r9], r8b
jne 0x140003774
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140003750
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x1400037cf
lea rbx, [0x1400bf3c0]
cmp r8b, 0x23
jne 0x1400037b3
cmp byte [r9], r8b
jne 0x1400037b3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x1400037a0
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140003910
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x14000392a
mov qword [r8], 0
lea rdx, [0x1400befc4]
call fcn.1400037e0
mov rbx, rax
test rax, rax
jne 0x14000394a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x140003a21
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140003a21
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140003a21
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140003a21
cmp rdi, 0xffffffffffffffff
je 0x140003a21
mov rax, qword [0x1406e5340]
test rax, rax
je 0x1400039be
inc dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x140003a21
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x140003a0e
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1406e5340]
test rax, rax
je 0x140003a03
dec dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140003a2a
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x140003a1c
mov qword [r14], rdi
mov rax, rsi
jmp 0x140003a2c
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret