joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140093150
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [0x140314d00]
call qword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov qword [rsp + 0x20], rax
mov eax, dword [rsp + 0x40]
shl eax, 1
cdqe
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx + 0x10]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x10], rax
add rsp, 0x38
ret

Function at 0x1400933a0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov ecx, dword [0x140314d00]
call qword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
cmp qword [rsp + 0x40], rax
jb 0x1400933fb
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x20]
add rax, qword [rcx + 0x10]
cmp qword [rsp + 0x40], rax
ja 0x1400933fb
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
inc rax
jmp 0x1400933fd
xor eax, eax
add rsp, 0x38
ret

Function at 0x140093410
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [0x140314d00]
call qword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov qword [rsp + 0x20], rax
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx]
lea rax, [rcx + rax - 1]
add rsp, 0x38
ret

Function at 0x140093440
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [0x140314d00]
call qword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov qword [rsp + 0x20], rax
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
add rax, qword [rcx]
add rsp, 0x38
ret

Function at 0x140093800
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x38
mov r8d, SafeArrayPutElement
xor edx, edx
mov rcx, qword [0x14031d740]
call qword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov qword [rsp + 0x20], rax
mov r8d, reloc.WS2_32.dll_recv
xor edx, edx
mov rcx, qword [0x14031d740]
call qword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov rcx, qword [rsp + 0x20]
mov qword [rcx], rax
mov rax, qword [rsp + 0x20]
mov qword [rax + 8], reloc.WS2_32.dll_recv
mov rax, qword [rsp + 0x20]
mov qword [rax + 0x10], 0
mov rdx, qword [rsp + 0x20]
mov ecx, dword [0x140314d00]
call qword [sym.imp.KERNEL32.DLL_TlsSetValue]
add rsp, 0x38
ret
Function at 0x140096350
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
mov r11d, edx
mov r10, rcx
mov r8d, 0x80000000
test rcx, rcx
je 0x1400963bf
mov qword [rsp], rbx
lea rbx, [0x1400f48d0]
test r10b, 1
je 0x1400963b3
mov ecx, r11d
mov eax, r8d
mov edx, 0x80000000
and ecx, 0x1f
xor r8d, r8d
mov r9d, dword [rbx + rcx*4]
nop dword [rax + rax]
test r9d, edx
je 0x1400963a0
lea ecx, [rdx - 1]
xor r8d, eax
test r9d, ecx
je 0x1400963b3
shr edx, 1
test al, 1
je 0x1400963af
shr eax, 1
xor eax, 0xedb88320
jmp 0x140096390
shr eax, 1
jmp 0x140096390
inc r11d
sar r10, 1
jne 0x140096370
mov rbx, qword [rsp]
mov eax, r8d
add rsp, 8
ret
Function at 0x1400b85b0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov rdi, rcx
mov qword [rcx + 8], rsi
call fcn.1400bab80
mov edx, 0xa0
mov rcx, rdi
mov dword [rsp + 0x38], eax
call fcn.1400bab50
mov rbx, rax
test rax, rax
jne 0x1400b8606
mov rcx, rdi
call fcn.1400bab90
mov rcx, qword [rdi]
mov dword [rcx + 0x28], gethostname
mov rcx, qword [rdi]
mov dword [rcx + 0x2c], esi
mov rdx, qword [rdi]
mov rcx, rdi
call qword [rdx]
mov dword [rbx + 0x5c], 0x3b9aca00
lea rax, [fcn.1400b8150]
lea rcx, str.JPEGMEM
mov qword [rbx], rax
lea rax, [fcn.1400b7f80]
mov qword [rbx + 8], rax
lea rax, [fcn.1400b8070]
mov qword [rbx + 0x10], rax
lea rax, [fcn.1400b7e90]
mov qword [rbx + 0x18], rax
lea rax, [0x1400b89d0]
mov qword [rbx + 0x20], rax
lea rax, [0x1400b8920]
mov qword [rbx + 0x28], rax
lea rax, [0x1400b8740]
mov qword [rbx + 0x30], rax
lea rax, [0x1400b7c40]
mov qword [rbx + 0x38], rax
lea rax, [0x1400b79e0]
mov qword [rbx + 0x40], rax
lea rax, [0x1400b8460]
mov qword [rbx + 0x48], rax
lea rax, [0x1400b8a80]
mov qword [rbx + 0x50], rax
mov eax, dword [rsp + 0x38]
mov dword [rbx + 0x58], eax
mov qword [rbx + 0x68], rsi
mov qword [rbx + 0x78], rsi
mov qword [rbx + 0x60], rsi
mov qword [rbx + 0x70], rsi
mov qword [rbx + 0x80], rsi
mov qword [rbx + 0x88], rsi
mov qword [rbx + 0x90], 0xa0
mov qword [rdi + 8], rbx
call qword [sym.imp.msvcrt.dll_getenv]
test rax, rax
je 0x1400b8710
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, str._ld_c
mov rcx, rax
mov byte [rsp + 0x30], 0x78
call qword [sym.imp.msvcrt.dll_sscanf]
test eax, eax
jle 0x1400b8710
movzx eax, byte [rsp + 0x30]
sub al, 0x4d
test al, 0xdf
jne 0x1400b8703
imul eax, dword [rsp + 0x38], 0x3e8
jmp 0x1400b8707
mov eax, dword [rsp + 0x38]
imul eax, eax, 0x3e8
mov dword [rbx + 0x58], eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x1400ca6f0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r15
sub rsp, 0x20
mov rdi, qword [rcx + 0x70]
mov r15, rdx
mov rsi, rcx
mov eax, dword [rdi + 0x18]
cmp eax, 0xc
jle 0x1400ca72c
mov dword [rcx + 0x60], WSACleanup
xor eax, eax
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], r14
cmp dword [rdi + 0x2c], eax
jge 0x1400ca814
nop
movzx ecx, byte [rdi + 0x50]
test cl, cl
jne 0x1400ca7e7
mov r9, qword [rsi + 0x70]
mov rax, qword [r9 + 0x40]
test rax, rax
je 0x1400ca76c
lea rdx, [rdi + 0x50]
mov r8d, 1
mov rcx, rsi
call rax
cdqe
jmp 0x1400ca782
mov r9, qword [r9 + 0x38]
mov edx, 1
lea rcx, [rdi + 0x50]
mov r8d, edx
call qword [sym.imp.msvcrt.dll_fread]
cmp rax, 1
jne 0x1400ca88a
movzx eax, byte [rdi + 0x50]
test al, al
je 0x1400ca87f
mov r9, qword [rsi + 0x70]
lea r14, [rdi + 0x51]
mov r10, qword [r9 + 0x40]
test r10, r10
je 0x1400ca7ba
movzx r8d, al
mov rdx, r14
mov rcx, rsi
call r10
cdqe
jmp 0x1400ca7d0
mov r9, qword [r9 + 0x38]
movzx r8d, al
mov edx, 1
mov rcx, r14
call qword [sym.imp.msvcrt.dll_fread]
movzx ecx, byte [rdi + 0x50]
cmp rax, rcx
jne 0x1400ca88a
movzx edx, byte [r14]
mov byte [r14], 2
jmp 0x1400ca7f5
movzx eax, byte [rdi + 0x51]
movzx edx, byte [rax + rdi + 0x50]
inc al
mov byte [rdi + 0x51], al
dec cl
movzx eax, dl
mov byte [rdi + 0x50], cl
mov ecx, dword [rdi + 0x2c]
shl eax, cl
or dword [rdi + 0x30], eax
lea eax, [rcx + 8]
mov dword [rdi + 0x2c], eax
cmp eax, dword [rdi + 0x18]
jl 0x1400ca740
movsxd rax, dword [rdi + 0x18]
lea rcx, [0x1400fa148]
movzx ecx, word [rcx + rax*2]
and ecx, dword [rdi + 0x30]
mov dword [r15], ecx
mov edx, dword [rdi + 0x18]
sub dword [rdi + 0x2c], edx
mov ecx, edx
shr dword [rdi + 0x30], cl
mov ecx, dword [rdi + 0x14]
cmp ecx, 0x1001
jge 0x1400ca85f
mov r8d, dword [rdi + 0x1c]
inc ecx
mov dword [rdi + 0x14], ecx
cmp ecx, r8d
jle 0x1400ca85f
cmp edx, 0xc
jge 0x1400ca85f
lea ecx, [r8 + r8]
mov dword [rdi + 0x1c], ecx
lea ecx, [rdx + 1]
mov dword [rdi + 0x18], ecx
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
mov dword [rsi + 0x60], WSACleanup
xor eax, eax
jmp 0x1400ca864
mov dword [rsi + 0x60], 0x66
xor eax, eax
jmp 0x1400ca864
Function at 0x1400cab60
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, qword [rcx + 0x70]
mov rsi, rdx
mov rbx, rcx
mov rax, qword [rdi + 0x40]
test rax, rax
je 0x1400cab93
lea rdx, [rsp + 0x30]
mov r8d, 1
call rax
cdqe
jmp 0x1400cabaa
mov r9, qword [rdi + 0x38]
mov edx, 1
lea rcx, [rsp + 0x30]
mov r8d, edx
call qword [sym.imp.msvcrt.dll_fread]
cmp rax, 1
jne 0x1400cac09
movzx ecx, byte [rsp + 0x30]
test cl, cl
je 0x1400cac22
lea rax, [rdi + 0x50]
mov qword [rsi], rax
mov byte [rax], cl
mov r9, qword [rbx + 0x70]
mov rax, qword [r9 + 0x40]
test rax, rax
je 0x1400cabe4
mov rdx, qword [rsi]
movzx r8d, byte [rsp + 0x30]
mov rcx, rbx
inc rdx
call rax
cdqe
jmp 0x1400cabff
mov rcx, qword [rsi]
movzx r8d, byte [rsp + 0x30]
mov r9, qword [r9 + 0x38]
inc rcx
mov edx, 1
call qword [sym.imp.msvcrt.dll_fread]
movzx ecx, byte [rsp + 0x30]
cmp rax, rcx
je 0x1400cac2d
mov dword [rbx + 0x60], 0x66
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
xor eax, eax
mov qword [rsi], rax
mov byte [rdi + 0x50], al
mov dword [rdi + 0x34], eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x20
pop rdi
ret

Function at 0x1400cad00
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, qword [rcx + 0x70]
mov rdi, rdx
mov rbx, rcx
mov rax, qword [rsi + 0x40]
test rax, rax
je 0x1400cad33
lea rdx, [rsp + 0x30]
mov r8d, 1
call rax
cdqe
jmp 0x1400cad4a
mov r9, qword [rsi + 0x38]
mov edx, 1
lea rcx, [rsp + 0x30]
mov r8d, edx
call qword [sym.imp.msvcrt.dll_fread]
cmp rax, 1
jne 0x1400cada9
movzx ecx, byte [rsp + 0x30]
test cl, cl
je 0x1400cadc2
lea rax, [rsi + 0x50]
mov qword [rdi], rax
mov byte [rax], cl
mov r9, qword [rbx + 0x70]
mov rax, qword [r9 + 0x40]
test rax, rax
je 0x1400cad84
mov rdx, qword [rdi]
movzx r8d, byte [rsp + 0x30]
mov rcx, rbx
inc rdx
call rax
cdqe
jmp 0x1400cad9f
mov rcx, qword [rdi]
movzx r8d, byte [rsp + 0x30]
mov r9, qword [r9 + 0x38]
inc rcx
mov edx, 1
call qword [sym.imp.msvcrt.dll_fread]
movzx ecx, byte [rsp + 0x30]
cmp rax, rcx
je 0x1400cadc9
mov dword [rbx + 0x60], 0x66
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rdi], 0
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x1400cb2c0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov r9, qword [rcx + 0x70]
mov rdi, rdx
mov rbx, rcx
test byte [r9], 8
jne 0x1400cb2ee
mov dword [rcx + 0x60], WSACleanup
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [r9 + 0x40]
test rax, rax
je 0x1400cb308
lea rdx, [rsp + 0x30]
mov r8d, 1
call rax
cdqe
jmp 0x1400cb31f
mov r9, qword [r9 + 0x38]
mov edx, 1
lea rcx, [rsp + 0x30]
mov r8d, edx
call qword [sym.imp.msvcrt.dll_fread]
cmp rax, 1
je 0x1400cb339
mov dword [rbx + 0x60], 0x66
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rsp + 0x30]
cmp al, 0x21
je 0x1400cb390
cmp al, 0x2c
je 0x1400cb37a
cmp al, 0x3b
je 0x1400cb364
mov dword [rdi], 0
xor eax, eax
mov dword [rbx + 0x60], 0x6b
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov dword [rdi], 4
mov eax, 1
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov dword [rdi], 2
mov eax, 1
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x38]
mov dword [rdi], 3
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x1400cb3b0
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x70]
mov rbx, rcx
test byte [rax], 8
jne 0x1400cb3d1
mov dword [rcx + 0x60], WSACleanup
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rdx, rcx
call fcn.1400cb5c0
test eax, eax
je 0x1400cb3c9
lea rdx, [rbx + 4]
mov rcx, rbx
call fcn.1400cb5c0
test eax, eax
je 0x1400cb3c9
mov r9, qword [rbx + 0x70]
mov rax, qword [r9 + 0x40]
test rax, rax
je 0x1400cb40e
lea rdx, [rsp + 0x30]
mov r8d, 3
mov rcx, rbx
call rax
cdqe
jmp 0x1400cb426
mov r9, qword [r9 + 0x38]
mov edx, 1
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 2]
call qword [sym.imp.msvcrt.dll_fread]
cmp rax, 3
je 0x1400cb44c
mov rcx, qword [rbx + 0x18]
mov dword [rbx + 0x60], 0x66
call fcn.1400cc030
mov qword [rbx + 0x18], 0
xor eax, eax
add rsp, 0x20
pop rbx
ret
movzx edx, byte [rsp + 0x30]
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rdi
mov eax, edx
mov ecx, edx
movzx edi, dl
shr eax, 4
shr dil, 3
and ecx, 7
and eax, 7
and dil, 1
inc ecx
inc eax
mov dword [rbx + 8], eax
movzx eax, byte [rsp + 0x31]
mov dword [rbx + 0xc], eax
movzx eax, byte [rsp + 0x32]
mov byte [rbx + 0x10], al
test dl, dl
jns 0x1400cb59f
mov eax, 1
xor edx, edx
shl eax, cl
mov ecx, eax
call fcn.1400cc170
mov qword [rbx + 0x18], rax
test rax, rax
jne 0x1400cb4c2
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov dword [rbx + 0x60], WSAStartup
add rsp, 0x20
pop rbx
ret
mov byte [rax + 8], dil
mov rax, qword [rbx + 0x18]
xor esi, esi
cmp dword [rax], esi
jle 0x1400cb5a7
xor edi, edi
nop word [rax + rax]
mov r9, qword [rbx + 0x70]
mov rax, qword [r9 + 0x40]
test rax, rax
je 0x1400cb501
lea rdx, [rsp + 0x30]
mov r8d, 3
mov rcx, rbx
call rax
cdqe
jmp 0x1400cb519
mov r9, qword [r9 + 0x38]
mov edx, 1
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 2]
call qword [sym.imp.msvcrt.dll_fread]
cmp rax, 3
jne 0x1400cb575
mov rax, qword [rbx + 0x18]
inc esi
add rdi, 3
mov rcx, qword [rax + 0x10]
movzx eax, byte [rsp + 0x30]
mov byte [rdi + rcx - 3], al
mov rax, qword [rbx + 0x18]
mov rcx, qword [rax + 0x10]
movzx eax, byte [rsp + 0x31]
mov byte [rcx + rdi - 2], al
mov rax, qword [rbx + 0x18]
mov rcx, qword [rax + 0x10]
movzx eax, byte [rsp + 0x32]
mov byte [rcx + rdi - 1], al
mov rax, qword [rbx + 0x18]
cmp esi, dword [rax]
jl 0x1400cb4e0
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x20
pop rbx
ret
mov rcx, qword [rbx + 0x18]
call fcn.1400cc030
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov qword [rbx + 0x18], 0
mov dword [rbx + 0x60], 0x66
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov qword [rbx + 0x18], 0
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x1400cb5c0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov r9, qword [rcx + 0x70]
mov rdi, rdx
mov rbx, rcx
mov rax, qword [r9 + 0x40]
test rax, rax
je 0x1400cb5ee
lea rdx, [rsp + 0x30]
mov r8d, 2
call rax
cdqe
jmp 0x1400cb606
mov r9, qword [r9 + 0x38]
mov edx, 1
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 1]
call qword [sym.imp.msvcrt.dll_fread]
cmp rax, 2
je 0x1400cb620
mov dword [rbx + 0x60], 0x66
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movzx edx, byte [rsp + 0x31]
movzx ecx, byte [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
shl edx, 8
mov eax, 1
or edx, ecx
mov dword [rdi], edx
add rsp, 0x20
pop rdi
ret

Function at 0x1400cb650
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov r14, rcx
mov ecx, 0x78
mov rbx, r8
mov rbp, rdx
call qword [sym.imp.msvcrt.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x1400cb694
test rbx, rbx
je 0x1400cb684
mov dword [rbx], 0x6d
xor eax, eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x40], rsi
lea r8d, [rdx + 0x78]
mov qword [rsp + 0x48], r15
call sub.msvcrt.dll_memset
xor r15d, r15d
mov edx, 0x6160
lea ecx, [r15 + 1]
mov qword [rdi + 0x48], r15
mov qword [rdi + 0x18], r15
call qword [sym.imp.msvcrt.dll_calloc]
mov rsi, rax
test rax, rax
jne 0x1400cb6ed
test rbx, rbx
je 0x1400cb795
mov rcx, rdi
mov dword [rbx], 0x6d
call qword [sym.imp.msvcrt.dll_free]
xor eax, eax
jmp 0x1400cb7e4
xor edx, edx
mov r8d, 0x6160
mov rcx, rax
call sub.msvcrt.dll_memset
mov qword [rdi + 0x70], rsi
mov qword [rsi], 8
mov qword [rsi + 0x38], r15
mov qword [rsi + 0x40], rbp
mov r9, qword [rdi + 0x70]
mov qword [rdi + 0x68], r14
mov rax, qword [r9 + 0x40]
test rax, rax
je 0x1400cb735
lea rdx, [rsp + 0x58]
mov r8d, 6
mov rcx, rdi
call rax
cdqe
jmp 0x1400cb74d
mov r9, qword [r9 + 0x38]
mov edx, 1
lea rcx, [rsp + 0x58]
lea r8d, [rdx + 5]
call qword [sym.imp.msvcrt.dll_fread]
cmp rax, 6
je 0x1400cb760
test rbx, rbx
je 0x1400cb78c
mov dword [rbx], 0x66
jmp 0x1400cb78c
lea rdx, [rsp + 0x58]
lea rcx, str.GIFVER
mov r8d, 3
mov byte [rsp + 0x5e], r15b
call qword [sym.imp.msvcrt.dll_strncmp]
test eax, eax
je 0x1400cb7a2
test rbx, rbx
je 0x1400cb78c
mov dword [rbx], 0x67
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
xor eax, eax
jmp 0x1400cb7e4
mov rcx, rdi
call fcn.1400cb3b0
test eax, eax
jne 0x1400cb7cf
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
test rbx, rbx
je 0x1400cb7cb
mov dword [rbx], 0x68
xor eax, eax
jmp 0x1400cb7e4
mov dword [rdi + 0x60], r15d
cmp byte [rsp + 0x5b], 0x39
sete al
mov byte [rsi + 0x6158], al
mov rax, rdi
mov rsi, qword [rsp + 0x40]
mov r15, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x1400cbac0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rbx, qword [rcx + 0x70]
mov rdi, rcx
mov rax, qword [rbx + 0x40]
test rax, rax
je 0x1400cbaeb
lea rdx, [rsp + 0x30]
mov r8d, 1
call rax
cdqe
jmp 0x1400cbb02
mov r9, qword [rbx + 0x38]
mov edx, 1
lea rcx, [rsp + 0x30]
mov r8d, edx
call qword [sym.imp.msvcrt.dll_fread]
cmp rax, 1
jb 0x1400cbb19
movzx ecx, byte [rsp + 0x30]
cmp ecx, 8
jle 0x1400cbb26
mov dword [rdi + 0x60], 0x66
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov eax, 1
mov dword [rbx + 8], ecx
mov byte [rbx + 0x50], 0
shl eax, cl
mov dword [rbx + 0x20], 0x1002
mov edx, 0x100
mov dword [rbx + 0xc], eax
inc eax
mov dword [rbx + 0x10], eax
inc eax
inc ecx
mov dword [rbx + 0x14], eax
mov eax, 1
mov dword [rbx + 0x18], ecx
shl eax, cl
lea rcx, [rbx + 0x2150]
mov dword [rbx + 0x1c], eax
xor eax, eax
mov qword [rbx + 0x28], rax
mov dword [rbx + 0x30], eax
movabs rax, 0x100200001002
nop word [rax + rax]
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rax
lea rcx, [rcx + 0x40]
mov qword [rcx - 0x28], rax
mov qword [rcx - 0x20], rax
mov qword [rcx - 0x18], rax
mov qword [rcx - 0x10], rax
mov qword [rcx - 8], rax
dec rdx
jne 0x1400cbb80
lea eax, [rdx + 1]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400ccd70
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
cmp dword [0x14031c8f8], 0
mov r14, rdx
mov r15, rcx
lea rbx, [0x14031c908]
jne 0x1400ccdbd
call qword [sym.imp.KERNEL32.DLL_TlsAlloc]
mov rcx, rbx
mov dword [0x14031c930], eax
call qword [sym.imp.KERNEL32.DLL_InitializeCriticalSection]
mov dword [0x14031c8f8], 1
mov ecx, dword [0x14031c930]
call qword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov rbp, rax
test rax, rax
jne 0x1400cce92
mov rcx, qword [0x140319a14]
lea edx, [rax + 8]
lea r8d, [rax + 0x28]
call qword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov rbp, rax
test rax, rax
je 0x1400ccebd
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov rax, qword [0x14031c900]
test rax, rax
je 0x1400cce0d
mov qword [rax], rbp
mov rcx, rbx
mov qword [rbp + 8], rax
mov qword [0x14031c900], rbp
call qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
call qword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
mov rdi, rax
call qword [sym.imp.KERNEL32.DLL_GetCurrentThread]
mov rbx, rax
call qword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
and dword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
lea r9, [rbp + 0x20]
mov r8, rdi
mov rcx, rax
mov rdx, rbx
mov dword [rsp + 0x20], 0x100000
call qword [sym.imp.KERNEL32.DLL_DuplicateHandle]
mov rdx, qword [rbp + 0x20]
lea rcx, [rbp + 0x18]
lea r8, [0x1400cced8]
mov r9, rbp
mov dword [rsp + 0x28], 8
or dword [rsp + 0x20], 0xffffffff
call qword [sym.imp.KERNEL32.DLL_RegisterWaitForSingleObject]
mov ecx, dword [0x14031c930]
mov rdx, rbp
call qword [sym.imp.KERNEL32.DLL_TlsSetValue]
mov rcx, qword [0x140319a14]
xor edx, edx
lea r8d, [rdx + 0x18]
call qword [sym.imp.KERNEL32.DLL_HeapAlloc]
test rax, rax
je 0x1400ccebd
mov qword [rax + 8], r15
mov qword [rax + 0x10], r14
mov rcx, qword [rbp + 0x10]
mov qword [rax], rcx
mov qword [rbp + 0x10], rax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x140f66e18
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140f66e22
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x140f66e4b
pop rbp
sub rbp, 0x33
sub rbp, 0xf66e18
sub rsp, 0x20
jmp 0x140f66e6a
mov rax, 0xf66e18
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0x38f3d656
xor byte [rax], dl
inc rax
dec rcx
jne 0x140f66e89
jmp 0x140f66ea0
invalid
Function at 0x1429a1058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1429a11df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1429a1089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1429a106f
add dl, dl
jne 0x1429a1096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1429a10f6
xor eax, eax
add dl, dl
jne 0x1429a10a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1429a11ad
add dl, dl
jne 0x1429a10b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1429a10c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1429a10d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1429a10dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1429a10ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1429a107e
mov eax, 1
add dl, dl
jne 0x1429a1106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1429a1113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1429a10fb
sub eax, ebx
mov ebx, 1
jne 0x1429a114c
mov ecx, 1
add dl, dl
jne 0x1429a112e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1429a113b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1429a1123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1429a107e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1429a1168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1429a1175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1429a115d
cmp eax, 0x7d00
jae 0x1429a119b
cmp eax, 0x500
jb 0x1429a1196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1429a107e
cmp eax, 0x7f
ja 0x1429a119e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1429a107e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1429a11d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1429a107e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20