joyce8/EMBER2024-capa huggingface dataset:
Function at 0x210137dc0
Capabilities:
Read file on windows

Disassembly:
push rbp
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0x80]
mov rbx, rcx
test byte [0x210273880], 1
jne 0x210137eb0
mov edx, dword [rcx + 0x14]
test edx, edx
js 0x210137eea
mov esi, 0x94
lea r12, [rbp - 0x40]
mov edx, dword [rbx + 8]
xor r9d, r9d
xor r8d, r8d
mov rcx, r12
mov qword [rbp - 0x40], 0
mov qword [rbp - 0x38], 0
mov qword [rbp - 0x30], 0
mov qword [rbp - 0x28], 0
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x18], 0
mov qword [rbp - 0x10], 0
mov qword [rbp - 8], 0
call method.pinfo.init_int__unsigned_int__void_
cmp qword [rbp - 0x18], 0
je 0x210137ea0
mov ecx, 0x58
call method.cygthread.operator_new_unsigned_long_
mov rcx, rax
lea rax, str.commune
mov qword [rcx + 0x28], rax
lea rax, [sym.commune_process_void_]
mov qword [rcx + 0x30], rax
mov dword [rcx + 0x38], esi
mov qword [rcx + 0x40], rbx
mov qword [rcx + 0x50], 0
call method.cygthread.create__
cmp byte [rbp - 0x28], 0
je 0x210137ea0
cmp qword [rbp - 0x18], 0
je 0x210137ea0
mov rcx, r12
call method.pinfo.release__
nop
lea rsp, [rbp + 8]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop rbp
ret
mov eax, dword [rcx + 8]
lea r9, str.pid__d_wants_some_information
lea r12, [rbp - 0x40]
mov edx, 0x800
lea r8, str.void_talktome_siginfo_t_
lea rcx, [0x210273880]
mov esi, 0x94
mov dword [rsp + 0x20], eax
call method.strace.prntf_unsigned_int__char_const__char_const__..._
mov eax, dword [rbx + 0x14]
test eax, eax
jns 0x210137dfb
lea r13, [rbp - 0x44]
lea r12, [rbp - 0x40]
mov qword [rsp + 0x20], 0
mov rcx, qword [0x210262ce0]
mov r9, r13
mov r8d, 8
mov rdx, r12
call sym.ReadFile
test eax, eax
je 0x210137ea0
cmp dword [rbp - 0x44], 8
jne 0x210137ea0
mov r8, qword [rbp - 0x40]
lea eax, [r8 + 0x95]
mov rsi, rax
add rax, 0xf
shr rax, 4
shl rax, 4
call fcn.21021b550
mov rcx, qword [0x210262ce0]
movdqu xmm0, xmmword [rbx]
movdqu xmm1, xmmword [rbx + 0x10]
movdqu xmm2, xmmword [rbx + 0x20]
movdqu xmm3, xmmword [rbx + 0x30]
movdqu xmm4, xmmword [rbx + 0x40]
movdqu xmm5, xmmword [rbx + 0x50]
sub rsp, rax
mov eax, dword [rbx + 0x90]
mov r9, r13
movaps xmmword [rsp + 0x30], xmm0
movdqu xmm0, xmmword [rbx + 0x60]
lea rdx, [rsp + 0xc4]
lea rdi, [rsp + 0x30]
movaps xmmword [rsp + 0x40], xmm1
movdqu xmm1, xmmword [rbx + 0x70]
movaps xmmword [rsp + 0x50], xmm2
movdqu xmm2, xmmword [rbx + 0x80]
mov qword [rsp + 0x20], 0
movaps xmmword [rsp + 0x60], xmm3
mov dword [rsp + 0xc0], eax
mov qword [rsp + 0x60], rdx
movaps xmmword [rsp + 0x70], xmm4
movaps xmmword [rsp + 0x80], xmm5
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0xa0], xmm1
movaps xmmword [rsp + 0xb0], xmm2
call sym.ReadFile
test eax, eax
je 0x210137ea0
mov eax, dword [rbp - 0x44]
cmp rax, qword [rbp - 0x40]
jne 0x210137ea0
mov rdx, qword [rsp + 0x60]
mov rbx, rdi
mov byte [rdx + rax], 0
jmp 0x210137dfb
Function at 0x21013af70
Capabilities:
Check processdebugflags

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x58
movabs rax, 0xacbf4682af00fa64
mov qword [rcx + 8], rax
mov rbx, rcx
mov esi, r9d
mov rax, qword [0x21023d810]
mov byte [rcx + 0x28], 0
mov qword [rcx + 0x18], rax
mov rax, qword [0x21023d808]
mov qword [rcx + 0x30], 0
mov qword [rcx + 0x20], rax
mov eax, dword [0x210319990]
mov qword [rcx + 0x38], 0
mov dword [rcx + 0x2c], eax
mov rax, qword gs:[0x30]
mov rax, qword [rax + 8]
mov dword [rcx + 4], edx
mov word [rcx + 0x10], r8w
mov rax, qword [rax - 0x21f8]
mov qword [rcx + 0x68], rax
mov rcx, qword [0x21034b1a0]
xor eax, eax
test byte [rcx + 0x10], 2
je 0x21013affe
mov eax, edx
mov edx, 0xcccccccd
imul rax, rdx
shr rax, 0x22
mov dword [rbx], eax
mov rax, qword [0x21025fe30]
mov dword [rbx + 0x60], 0x288
mov qword [rbx + 0x48], rax
test byte [0x210273880], 1
jne 0x21013b120
test sil, sil
jne 0x21013b090
mov qword [rbx + 0x50], 0
cmp r8w, 3
je 0x21013b100
mov edi, 0x101018
call sym.GetCurrentProcess
mov rsi, rax
call sym.GetCurrentProcess
mov r12, rax
call sym.GetCurrentProcess
mov dword [rsp + 0x20], edi
lea r9, [rbx + 0x50]
mov r8, rsi
mov dword [rsp + 0x30], 0
mov rcx, rax
mov rdx, r12
mov dword [rsp + 0x28], 1
call sym.DuplicateHandle
test eax, eax
je 0x21013b178
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop r12
ret
xor r9d, r9d
xor r8d, r8d
lea rcx, [0x2102d1ca0]
xor edx, edx
call sym.CreateEventA
or byte [rbx + 0x28], 2
mov qword [rbx + 0x40], rax
test byte [0x210273880], 1
je 0x21013b160
mov rax, qword [rbx + 0x40]
mov edx, 0x800
lea r9, str.subproc_ready__p
lea r8, str.child_info::child_info_unsigned_int__child_info_types__bool_
lea rcx, [0x210273880]
mov edi, 0x101018
mov qword [rsp + 0x20], rax
call method.strace.prntf_unsigned_int__char_const__char_const__..._
cmp word [rbx + 0x10], 3
mov qword [rbx + 0x50], 0
jne 0x21013b03c
mov rcx, qword [0x21034b1a0]
movzx eax, byte [rcx + 0x10]
and eax, 4
cmp al, 1
sbb edi, edi
and edi, 0xfffffc00
add edi, 0x101458
jmp 0x21013b03c
call sym.GetCurrentProcess
mov r9d, 4
lea r8, [rsp + 0x4c]
mov qword [rsp + 0x20], 0
mov rcx, rax
mov edx, 0x1f
call sym.NtQueryInformationProcess
test eax, eax
jns 0x21013b1a0
test sil, sil
jne 0x21013b090
test byte [0x210273880], 1
jne 0x21013b0b9
cmp word [rbx + 0x10], 3
mov qword [rbx + 0x50], 0
jne 0x21013b037
jmp 0x21013b0f9
lea r9, str.couldnt_create_handle_to_myself_for_child___E
lea r8, str.child_info::child_info_unsigned_int__child_info_types__bool_
mov edx, 0x8000
lea rcx, [0x210273880]
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop r12
jmp method.strace.prntf_unsigned_int__char_const__char_const__..._
mov eax, dword [rsp + 0x4c]
test eax, eax
je 0x21013b14a
or byte [rbx + 0x28], 1
jmp 0x21013b14a
Function at 0x21013bd00
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x60], r8
mov rbx, rcx
mov qword [rsp + 0x68], r9
test rdx, rdx
je 0x21013bd42
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
test byte [rcx + 0x28], 8
je 0x21013bd68
test byte [0x210273880], 1
jne 0x21013bd90
call sym.GetCurrentProcess
mov edx, 0x800000
mov rcx, rax
call sym.TerminateProcess
mov eax, dword [rbx + 0x2c]
test eax, eax
jle 0x21013bd5b
call sym.GetCurrentProcess
mov edx, 0x2000000
mov rcx, rax
call sym.TerminateProcess
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov qword [rsp + 0x20], rax
mov r9, rdx
lea r8, str.bool_child_info_fork::abort_const_char__..._
mov edx, 0x8000
lea rcx, [0x210273880]
call method.strace.vprntf_unsigned_int__char_const__char_const__char_
jmp 0x21013bd30
mov qword [rsp + 0x20], rax
mov r9, rdx
lea r8, str.bool_child_info_fork::abort_const_char__..._
mov edx, 0x40
lea rcx, [0x210273880]
call method.strace.vprntf_unsigned_int__char_const__char_const__char_
jmp 0x21013bd30

Function at 0x21013c920
Capabilities:
Write file on windows

Disassembly:
push r13
mov eax, 0x4048
push r12
call fcn.21021b550
sub rsp, rax
lea r13, [rsp + 0x40]
mov qword [rsp + 0x4068], rdx
mov rdx, rcx
mov qword [rsp + 0x4070], r8
mov rcx, r13
lea r8, [rsp + 0x4068]
mov qword [rsp + 0x4078], r9
mov qword [rsp + 0x38], r8
call sym.__small_vsprintf
mov ecx, 0xfffffff4
mov r12d, eax
call sym.GetStdHandle
mov r8d, r12d
lea r9, [rsp + 0x34]
mov rdx, r13
mov qword [rsp + 0x20], 0
mov rcx, rax
call sym.WriteFile
mov ecx, 0xfffffff4
call sym.GetStdHandle
mov rcx, rax
mov r12, rax
call sym.GetFileType
cmp eax, 3
je 0x21013c9b2
mov rcx, r12
call sym.FlushFileBuffers
nop
add rsp, 0x4048
pop r12
pop r13
ret
Function at 0x2101415a0
Capabilities:
Print debug messages

Disassembly:
push rbp
push r13
push r12
sub rsp, 0x20
lea rbp, [rsp + 0x20]
lea eax, [r9 + 0x17]
cdqe
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.21021b550
sub rsp, rax
mov r9, r8
mov r8d, edx
lea r13, [rsp + 0x2c]
lea rdx, str._x__s
mov rcx, r13
lea r12, [rsp + 0x20]
call sym.__small_sprintf
mov rcx, r13
call sym.msys_2.0.dll_strlen
lea rdx, str.cYg_08x
mov rcx, r12
lea r8, [rax + 1]
call sym.__small_sprintf
mov rcx, r12
mov byte [rsp + 0x2b], 0x20
call sym.OutputDebugStringA
nop
mov rsp, rbp
pop r12
pop r13
pop rbp
ret

Function at 0x210141620
Capabilities:
Print debug messages

Disassembly:
push r12
push rbx
sub rsp, 0x48
cmp byte [rcx], 3
mov ebx, edx
je 0x210141640
add rsp, 0x48
pop rbx
pop r12
ret
call sym.IsDebuggerPresent
test eax, eax
je 0x21014162e
lea r12, [rsp + 0x20]
mov r9d, ebx
mov r8d, 0xfffffffd
lea rdx, str.cYg_8x__x
mov rcx, r12
call sym.__small_sprintf
mov rcx, r12
call sym.OutputDebugStringA
nop
add rsp, 0x48
pop rbx
pop r12
ret
Function at 0x210141bb0
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
lea r14, [0x210273840]
mov rdi, r8
mov r13, r9
mov rbx, rcx
mov esi, edx
call sym.GetLastError
lea rdx, str.smallprint_buf
mov rcx, r14
mov r12d, eax
call method.muto.init_char_const_
mov edx, 0xffffffff
mov rcx, rax
call method.muto.acquire_unsigned_int_
mov rax, qword [0x210273820]
test rax, rax
je 0x210141d80
mov byte [rax + 0x7fff], 0
mov ecx, r12d
call sym.SetLastError
mov rax, qword [rbp + 0x70]
mov r9, r13
mov r8, rdi
mov rdx, qword [0x210273820]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call method.strace.vsprntf_char__char_const__char_const__char_
mov r13, qword [0x210273820]
mov edi, eax
cmp byte [r13 + 0x7fff], 0
jne 0x210141e2d
test esi, 0x8000
jne 0x210141ca0
test byte [rbx], 1
jne 0x210141d11
mov rax, qword gs:[0x30]
mov rdx, qword [rax + 8]
mov rcx, r14
sub rdx, 0x3200
call method.muto.release__cygtls_
mov ecx, r12d
call sym.SetLastError
nop
lea rsp, [rbp + 8]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov ecx, 0xfffffff4
lea r15, [rbp - 4]
call sym.GetStdHandle
mov rdx, r13
mov r9, r15
mov r8d, edi
mov qword [rsp + 0x20], 0
mov rcx, rax
call sym.WriteFile
mov ecx, 0xfffffff4
call sym.GetStdHandle
mov rcx, rax
mov r13, rax
call sym.GetFileType
cmp eax, 3
jne 0x210141e20
mov ecx, 0xfffffff4
call sym.GetStdHandle
mov rcx, rax
call sym.GetFileType
cmp eax, 2
jne 0x210141db0
test byte [rbx], 1
je 0x210141c60
mov r13, qword [0x210273820]
lea eax, [rdi + 0x17]
mov rbx, rsp
cdqe
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.21021b550
lea rdx, str._x__s
sub rsp, rax
mov r9, r13
mov r8d, esi
lea rdi, [rsp + 0x4c]
lea r15, [rsp + 0x40]
mov rcx, rdi
call sym.__small_sprintf
mov rcx, rdi
call sym.msys_2.0.dll_strlen
lea rdx, str.cYg_08x
mov rcx, r15
lea r8, [rax + 1]
call sym.__small_sprintf
mov byte [rsp + 0x4b], 0x20
mov rcx, r15
call sym.OutputDebugStringA
mov rsp, rbx
jmp 0x210141c60
call sym.GetProcessHeap
mov r8d, 0x8000
xor edx, edx
mov rcx, rax
call sym.HeapAlloc
mov qword [0x210273820], rax
test rax, rax
je 0x210141c85
jmp 0x210141c0b
mov qword [rsp + 0x30], 0
lea r9, [0x2102d1ce0]
mov r8d, 3
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0
lea rcx, str.CONOUT_
mov dword [rsp + 0x20], 3
call sym.CreateFileA
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x210141d01
mov rdx, qword [0x210273820]
mov r9, r15
mov r8d, edi
mov rcx, rax
mov qword [rsp + 0x20], 0
call sym.WriteFile
mov rcx, r13
call sym.CloseHandle
jmp 0x210141d01
mov rcx, r13
call sym.FlushFileBuffers
jmp 0x210141ce6
lea rcx, str.array_bound_exceeded__d_n
mov edx, 0x107
call sym.small_printf
mov ecx, 1
call sym.ExitProcess
Function at 0x210141e70
Capabilities:
Print debug messages

Disassembly:
push r13
push r12
push rbx
sub rsp, 0xa0
cmp byte [rcx], 0
mov r12, rcx
mov ebx, edx
je 0x210141e98
add rsp, 0xa0
pop rbx
pop r12
pop r13
ret
call sym.IsDebuggerPresent
test eax, eax
je 0x210141e86
movzx edx, bl
lea r13, [rsp + 0x30]
mov r9, r12
mov r8d, 0xffffffff
mov dword [rsp + 0x20], edx
mov rcx, r13
lea rdx, str.cYg_8x__lx__d
call sym.__small_sprintf
mov rcx, r13
call sym.OutputDebugStringA
cmp byte [r12], 0
je 0x210141e86
cmp qword [0x21024fce8], 0
je 0x210141fa0
call sym.GetCurrentProcessId
mov rdx, qword [0x21024fce8]
lea r13, [rsp + 0x50]
mov r9d, dword [rdx + 8]
mov dword [rsp + 0x20], eax
test r9d, r9d
jne 0x210141f06
mov r9d, 1
mov r8d, dword [rdx]
mov rcx, r13
lea rdx, str._pid__d__ppid__d__windows_pid__u_
call sym.__small_sprintf
mov rax, qword [0x21024fce8]
lea rbx, [rax + 0x18]
xor r8d, r8d
mov rcx, r12
mov edx, 1
lea r9, [0x2102a97d0]
call method.strace.prntf_unsigned_int__char_const__char_const__..._
mov qword [rsp + 0x28], r13
xor r8d, r8d
mov rcx, r12
mov qword [rsp + 0x20], rbx
lea r9, str.Program_name:__W__s
mov edx, 1
call method.strace.prntf_unsigned_int__char_const__char_const__..._
xor r8d, r8d
mov rcx, r12
mov edx, 1
lea rax, [0x21034b16c]
lea r9, str.OS_version:___Windows__s
mov qword [rsp + 0x20], rax
call method.strace.prntf_unsigned_int__char_const__char_const__..._
xor r8d, r8d
mov edx, 1
mov rcx, r12
lea r9, [0x2102a97d0]
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x210141e86
call sym.GetCurrentProcessId
lea r13, [rsp + 0x50]
lea rdx, str._windows_pid__u_
mov r8d, eax
mov rcx, r13
lea rbx, [0x210307940]
call sym.__small_sprintf
jmp 0x210141f23

Function at 0x2101441a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
xor r8d, r8d
lea rbx, [0x2102aa140]
nop dword [rax + rax]
movzx eax, byte [rcx + r8]
movzx r9d, byte [rdx + r8]
cmp al, r9b
je 0x2101441d4
movzx r10d, al
movzx r11d, al
movsx r10d, byte [rbx + r10]
xor r10d, r11d
cmp r10d, r9d
jne 0x2101441e8
add r8, 1
test al, al
jne 0x2101441b0
mov eax, 1
pop rbx
ret
xor eax, eax
pop rbx
ret
Function at 0x2101441f0
Capabilities:
Get file attributes

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0xf8
lea rbp, [rsp + 0xf0]
xor r9d, r9d
xor r8d, r8d
mov r14d, 1
movabs r13, 0xfffffffbffffffbe
lea rsi, [rbp - 0x80]
mov qword [rbp + 0x58], rdx
xor edx, edx
mov rbx, rcx
sub rsp, 0x630
lea rdi, [rbp - 0x70]
lea r12, [rbp - 0x60]
lea r15, [rsp + 0x60]
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0xc
mov dword [rsp + 0x30], 0x62a
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rsi
call sym.NtQueryDirectoryFile
mov r11d, eax
test eax, eax
js 0x21014438d
nop dword [rax]
mov eax, dword [r15]
test eax, eax
je 0x210144310
add r14d, 1
add r15, rax
cmp r14d, 2
je 0x210144288
mov eax, dword [r15 + 8]
lea rcx, [rbp - 0x30]
mov rdx, r12
mov qword [rbp - 0x28], rbx
mov dword [rbp - 0x30], 0x30
mov word [rbp - 0x6e], ax
mov word [rbp - 0x70], ax
lea rax, [r15 + 0xc]
mov qword [rbp - 0x68], rax
mov dword [rbp - 0x18], 0
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x10], 0
mov qword [rbp - 8], 0
call sym.NtQueryAttributesFile
mov r8d, eax
lea eax, [rax + 0x3fffffcc]
cmp eax, 0x22
jbe 0x210144378
test byte [0x210273880], 1
jne 0x2101443e3
mov r11d, 0xc0000101
jmp 0x21014435e
mov dword [rsp + 0x50], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x48], 0
mov rcx, rbx
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0xc
mov dword [rsp + 0x30], 0x62a
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rsi
call sym.NtQueryDirectoryFile
test eax, eax
jns 0x210144288
xor r11d, r11d
mov eax, r11d
lea rsp, [rbp + 8]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
bt r13, rax
jb 0x2101442f8
mov eax, dword [r15]
add r15, rax
jmp 0x210144288
test byte [0x210273880], 1
je 0x21014435e
mov rcx, qword [rbp + 0x58]
xor edx, edx
mov dword [rbp - 0x84], eax
call method.path_conv.get_nt_native_path__UNICODE_STRING_
mov r11d, dword [rbp - 0x84]
mov edx, 0x40
lea r9, str.Checking_if_directory__S_is_empty_failed__status___y
mov qword [rsp + 0x20], rax
lea r8, str.NTSTATUS_check_dir_not_empty_HANDLE__path_conv_
lea rcx, [0x210273880]
mov dword [rsp + 0x28], r11d
call method.strace.prntf_unsigned_int__char_const__char_const__..._
mov r11d, dword [rbp - 0x84]
jmp 0x21014435e
mov rcx, qword [rbp + 0x58]
xor edx, edx
mov dword [rbp - 0x84], r8d
call method.path_conv.get_nt_native_path__UNICODE_STRING_
mov qword [rsp + 0x28], rdi
mov edx, 0x40
mov r8d, dword [rbp - 0x84]
mov qword [rsp + 0x20], rax
lea r9, str.Directory__S_not_empty__found_file___S___query_status___y
lea rcx, [0x210273880]
mov dword [rsp + 0x30], r8d
lea r8, str.NTSTATUS_check_dir_not_empty_HANDLE__path_conv_
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x210144305
Function at 0x210149fa0
Capabilities:
Get file attributes
Set file attributes

Disassembly:
mov edx, 1
jmp sym._unlink_nt_path_conv__bool_
Function at 0x210157fa0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x188
xor r9d, r9d
mov r8d, 0x138
mov ecx, 2
lea rdx, [rsp + 0x40]
call sym.NtQuerySystemInformation
test eax, eax
js 0x210157ff0
mov ecx, dword [0x21034b048]
mov r9d, dword [0x21034b024]
xor edx, edx
mov r8d, dword [rsp + 0x6c]
mov rax, rcx
div r9
xor edx, edx
mov rcx, rax
mov rax, r8
div rcx
add rsp, 0x188
ret
mov r8d, eax
mov edx, 0x73
lea rcx, str._usr_src_MSYS2_packages_msys2_runtime_src_msys2_runtime_winsup_cygwin_sysconf.cc
mov dword [rsp + 0x3c], eax
call sym.seterrno_from_nt_status_char_const__int__int_
test byte [0x210273880], 1
mov eax, dword [rsp + 0x3c]
jne 0x21015801e
mov rax, 0xffffffffffffffff
jmp 0x210157fe8
mov dword [rsp + 0x20], eax
lea r9, str.NtQuerySystemInformation:_status__y___E
lea r8, str.long_int_get_avphys_int_
mov edx, 0x40
lea rcx, [0x210273880]
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x210158015

Function at 0x210158050
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x70
mov rax, qword [0x21034b1a0]
mov esi, ecx
lea r12, [rsp + 0x30]
test byte [rax + 0x11], 1
jne 0x2101580c0
mov r8d, 0x40
xor r9d, r9d
mov rdx, r12
xor ecx, ecx
call sym.NtQuerySystemInformation
mov r8, 0xffffffffffffffff
test eax, eax
js 0x2101580b4
cmp esi, 9
je 0x2101581d0
cmp esi, 0xa
jne 0x2101580c0
mov rax, qword [rsp + 0x60]
xor r8d, r8d
test al, 1
je 0x2101581b8
add r8d, 1
shr rax, 1
jne 0x2101580a0
movsxd r8, r8d
mov rax, r8
add rsp, 0x70
pop rbx
pop rsi
pop r12
ret
mov rax, qword gs:[0x30]
mov rax, qword [rax + 8]
mov rcx, r12
mov eax, dword [rax - 0x2cc8]
mov dword [rsp + 0x30], eax
mov rax, qword gs:[0x30]
mov rax, qword [rax + 8]
mov eax, dword [rax - 0x2cc4]
mov dword [rsp + 0x2c], 0x8000
mov dword [rsp + 0x34], eax
call method.tmp_pathbuf.c_get__
lea r8, [rsp + 0x2c]
mov ecx, 4
mov rdx, rax
mov rbx, rax
call fcn.21022ccf0
mov r8, 0xffffffffffffffff
test eax, eax
je 0x210158178
mov edx, dword [rsp + 0x2c]
xor r8d, r8d
test edx, edx
jne 0x21015813a
jmp 0x210158178
mov ecx, dword [rbx + 4]
add rbx, rcx
sub edx, ecx
je 0x210158178
cmp dword [rbx], 4
jne 0x210158130
movzx ecx, word [rbx + 8]
test cx, cx
je 0x210158130
xor eax, eax
jmp 0x210158165
cmp esi, 0xa
jne 0x21015815d
movzx r9d, byte [rbx + 0x21]
add r8, r9
add eax, 1
cmp ax, cx
je 0x210158130
cmp esi, 9
jne 0x210158150
movzx r9d, byte [rbx + 0x20]
add r8, r9
jmp 0x21015815d
mov edx, dword [rsp + 0x30]
mov rax, qword gs:[0x30]
mov rax, qword [rax + 8]
mov dword [rax - 0x2cc8], edx
mov edx, dword [rsp + 0x34]
mov rax, qword gs:[0x30]
mov rax, qword [rax + 8]
mov dword [rax - 0x2cc4], edx
mov rax, r8
add rsp, 0x70
pop rbx
pop rsi
pop r12
ret
shr rax, 1
jne 0x2101580a0
jmp 0x2101580b1
movzx r8d, byte [rsp + 0x68]
mov rax, r8
add rsp, 0x70
pop rbx
pop rsi
pop r12
ret
Function at 0x2101581f0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
sub rsp, 0x68
xor r9d, r9d
xor ecx, ecx
mov r8d, 0x40
lea rdx, [rsp + 0x20]
call sym.NtQuerySystemInformation
test eax, eax
js 0x210158240
mov ecx, dword [0x21034b048]
mov r9d, dword [0x21034b024]
xor edx, edx
mov r8d, dword [rsp + 0x2c]
mov rax, rcx
div r9
xor edx, edx
mov rcx, rax
mov rax, r8
div rcx
add rsp, 0x68
ret
mov rax, 0xffffffffffffffff
jmp 0x210158232

Function at 0x2101586b0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
sub rsp, 0x68
xor r9d, r9d
xor ecx, ecx
mov r8d, 0x40
lea rdx, [rsp + 0x20]
call sym.NtQuerySystemInformation
test eax, eax
js 0x210158700
mov ecx, dword [0x21034b048]
mov r9d, dword [0x21034b024]
xor edx, edx
mov r8d, dword [rsp + 0x2c]
mov rax, rcx
div r9
xor edx, edx
mov rcx, rax
mov rax, r8
div rcx
add rsp, 0x68
ret
mov rax, 0xffffffffffffffff
jmp 0x2101586f2

Function at 0x210158710
Capabilities:
Get system information on windows

Disassembly:
mov ecx, 0xc
jmp sym.get_avphys_int_
Function at 0x21015b990
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [rcx + 0xc]
call sym.TlsGetValue
mov qword [rbx + 0x20], rax
add rsp, 0x20
pop rbx
ret

Function at 0x21015b9b0
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call sym.TlsAlloc
mov dword [rbx + 0xc], eax
mov ecx, eax
cmp eax, 0xffffffff
je 0x21015b9d5
mov rdx, qword [rbx + 0x20]
add rsp, 0x20
pop rbx
jmp sym.TlsSetValue
lea rcx, str.pthread_key::recreate_key_from_buffer____failed_to_reallocate_Tls_storage
call sym.api_fatal
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x21015bac0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r12
push rbx
sub rsp, 0x28
cmp qword [rcx + 0x18], 0
mov rbx, rcx
je 0x21015bb05
mov ecx, dword [rcx + 0xc]
call sym.TlsGetValue
mov r12, rax
test rax, rax
je 0x21015bb05
mov ecx, dword [rbx + 0xc]
xor edx, edx
call sym.TlsSetValue
mov rcx, r12
call qword [rbx + 0x18]
mov ecx, dword [rbx + 0xc]
call sym.TlsGetValue
test rax, rax
je 0x21015bb05
mov byte [0x21032c5f8], 1
add rsp, 0x28
pop rbx
pop r12
ret

Function at 0x21015c970
Capabilities:
Suspend thread

Disassembly:
cmp byte [rcx + 0x70], 0
jne 0x21015c980
ret
mov rdx, qword gs:[0x30]
mov rax, qword [rdx + 8]
mov rax, qword [rax - 0x1c08]
test rax, rax
je 0x21015c9b0
cmp rcx, rax
je 0x21015c976
mov rcx, qword [rcx + 0x10]
jmp sym.SuspendThread
mov rax, qword [rdx + 8]
lea r8, [0x21032c4c0]
mov dword [0x21032c4c8], 0
sub rax, 0x3200
mov qword [0x21032c540], rax
mov rax, qword [rdx + 8]
mov qword [rax - 0x1c08], r8
cmp rcx, r8
jne 0x21015c99e
jmp 0x21015c976

Function at 0x21015c9f0
Capabilities:
Resume thread

Disassembly:
cmp byte [rcx + 0x70], 0
jne 0x21015ca00
ret
mov rcx, qword [rcx + 0x10]
jmp sym.ResumeThread

Function at 0x21015ce00
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x20
lea rax, sym.pthread_key::pthread_key__
mov dword [rcx + 8], 0xdf0df047
mov rbx, rcx
mov qword [rcx], rax
mov qword [rcx + 0x18], rdx
call sym.TlsAlloc
mov dword [rbx + 0xc], eax
cmp eax, 0xffffffff
jne 0x21015ce40
mov dword [rbx + 8], 0
add rsp, 0x20
pop rbx
ret
mov eax, 1
lock xadd dword [0x21032c600], eax
test eax, eax
je 0x21015ce68
mov rcx, qword [0x21032c608]
mov r8d, 0x24
xor edx, edx
call sym.cygwait_void___LARGE_INTEGER__unsigned_int_
nop dword [rax]
mov rax, qword [0x21032c610]
mov qword [rbx + 0x10], rax
lock cmpxchg qword [0x21032c610], rbx
cmp qword [rbx + 0x10], rax
jne 0x21015ce68
lock sub dword [0x21032c600], 1
je 0x21015ce31
mov rcx, qword [0x21032c608]
add rsp, 0x20
pop rbx
jmp sym.SetEvent