joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140340930
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
push r15
push rbp
sub rsp, 0x30
mov rbp, rcx
mov qword [rsp + 0x28], 0
mov r15d, 1
xor r14d, r14d
lea rdx, [0x141a4faa0]
mov eax, 1
xchg dword [rdx], eax
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x24]
test eax, eax
je 0x140340998
mov eax, 0x66666667
imul r15d
sar edx, 2
lea r8d, [rdx + rdx*4]
add r8d, r8d
cmp r8d, r15d
jne 0x140340998
mov eax, 1
cmp r15d, 0x2710
cmovg r14d, eax
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x24]
test eax, eax
je 0x1403409ac
inc r15d
cmp r15d, 0x7ffffff
jl 0x14034094e
mov eax, dword [rsp + 0x24]
test eax, eax
je 0x1403409c6
mov dword [rsp + 0x20], 0x98
lea rcx, [rsp + 0x20]
call fcn.1403ab9a0
mov eax, dword [0x141a4faa4]
test eax, eax
jne 0x140340a01
cmp dword [0x141940830], 1
je 0x140340b45
cmp dword [0x141a4fa9c], 0
je 0x140340afd
mov dword [0x141a4faa4], 1
cmp dword [0x141940830], 1
je 0x140340ade
mov ecx, dword [0x141a4fa98]
mov dword [0x141a4faa0], 0
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140340a2c
mov qword [rbp], rax
xor eax, eax
add rsp, 0x30
pop rbp
pop r15
pop r14
ret
mov ecx, 0x88
xor edx, edx
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x28]
call fcn.14035a450
test eax, eax
je 0x140340a58
mov qword [rbp], 0
add rsp, 0x30
pop rbp
pop r15
pop r14
ret
mov r10, qword [rsp + 0x28]
mov r9d, 0x80
mov rax, qword [0x1419407e0]
mov qword [r10 + 0x80], rax
lea rax, [0x140000000]
mov rdx, rax
mov rcx, rax
mov r8, rax
movups xmm0, xmmword [rax + r9 + 0x1940750]
movups xmmword [r10 + r9 - 0x10], xmm0
movups xmm1, xmmword [rdx + r9 + 0x1940740]
movups xmmword [r10 + r9 - 0x20], xmm1
movups xmm2, xmmword [rcx + r9 + 0x1940730]
movups xmmword [r10 + r9 - 0x30], xmm2
movups xmm3, xmmword [r8 + r9 + 0x1940720]
movups xmmword [r10 + r9 - 0x40], xmm3
sub r9, 0x40
jne 0x140340a71
mov rdx, qword [rsp + 0x28]
mov ecx, dword [0x141a4fa98]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rax, qword [rsp + 0x28]
jmp 0x140340a1c
mov ecx, 2
mov rdx, r15
call fcn.14045030c
mov ecx, 0x16
mov rdx, r14
call fcn.14045030c
jmp 0x140340a01
mov dword [0x141a4fa9c], 1
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x141a4fa98], eax
cmp eax, 0xffffffff
jne 0x140340b28
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1403409ea
lea rcx, [0x1403408b0]
call fcn.14043def0
lea rcx, [0x140340870]
call fcn.14043def0
jmp 0x1403409ea
mov ecx, 2
mov edx, 1
call fcn.14045030c
mov r15, rax
mov ecx, 0x16
mov edx, 1
call fcn.14045030c
mov r14, rax
jmp 0x1403409dd
Function at 0x140340b70
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
push r15
push rbp
sub rsp, 0x30
mov rbp, rcx
mov qword [rsp + 0x28], 0
mov r15d, 1
xor r14d, r14d
lea rdx, [0x141a4faa0]
mov eax, 1
xchg dword [rdx], eax
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x24]
test eax, eax
je 0x140340bd8
mov eax, 0x66666667
imul r15d
sar edx, 2
lea r8d, [rdx + rdx*4]
add r8d, r8d
cmp r8d, r15d
jne 0x140340bd8
mov eax, 1
cmp r15d, 0x2710
cmovg r14d, eax
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x24]
test eax, eax
je 0x140340bec
inc r15d
cmp r15d, 0x7ffffff
jl 0x140340b8e
mov eax, dword [rsp + 0x24]
test eax, eax
je 0x140340c06
mov dword [rsp + 0x20], 0x98
lea rcx, [rsp + 0x20]
call fcn.1403ab9a0
mov eax, dword [0x141a4faa4]
test eax, eax
jne 0x140340c41
cmp dword [0x141940830], 1
je 0x140340db9
cmp dword [0x141a4fa9c], 0
je 0x140340d71
mov dword [0x141a4faa4], 1
cmp dword [0x141940830], 1
je 0x140340d52
mov ecx, dword [0x141a4fa98]
mov dword [0x141a4faa0], 0
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r14, rax
mov qword [rsp + 0x28], r14
test r14, r14
je 0x140340ca5
mov qword [rbp], r14
cmp dword [0x141940830], 1
je 0x140340c7d
xor eax, eax
add rsp, 0x30
pop rbp
pop r15
pop r14
ret
mov ecx, 2
mov edx, 1
call fcn.14045030c
mov ecx, 0x16
mov edx, 1
mov qword [r14 + 0x68], rax
call fcn.14045030c
mov qword [r14 + 0x70], rax
jmp 0x140340c71
mov ecx, 0x88
xor edx, edx
lea r8, [rsp + 0x28]
call fcn.14035a450
test eax, eax
je 0x140340ccc
mov qword [rbp], 0
add rsp, 0x30
pop rbp
pop r15
pop r14
ret
mov r10, qword [rsp + 0x28]
mov r9d, 0x80
mov rax, qword [0x1419407e0]
mov qword [r10 + 0x80], rax
lea rax, [0x140000000]
mov rdx, rax
mov rcx, rax
mov r8, rax
movups xmm0, xmmword [rax + r9 + 0x1940750]
movups xmmword [r10 + r9 - 0x10], xmm0
movups xmm1, xmmword [rdx + r9 + 0x1940740]
movups xmmword [r10 + r9 - 0x20], xmm1
movups xmm2, xmmword [rcx + r9 + 0x1940730]
movups xmmword [r10 + r9 - 0x30], xmm2
movups xmm3, xmmword [r8 + r9 + 0x1940720]
movups xmmword [r10 + r9 - 0x40], xmm3
sub r9, 0x40
jne 0x140340ce5
mov rdx, qword [rsp + 0x28]
mov ecx, dword [0x141a4fa98]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov r14, qword [rsp + 0x28]
jmp 0x140340c64
mov ecx, 2
mov rdx, r15
call fcn.14045030c
mov ecx, 0x16
mov rdx, r14
call fcn.14045030c
jmp 0x140340c41
mov dword [0x141a4fa9c], 1
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x141a4fa98], eax
cmp eax, 0xffffffff
jne 0x140340d9c
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140340c2a
lea rcx, [0x1403408b0]
call fcn.14043def0
lea rcx, [0x140340870]
call fcn.14043def0
jmp 0x140340c2a
mov ecx, 2
mov edx, 1
call fcn.14045030c
mov r15, rax
mov ecx, 0x16
mov edx, 1
call fcn.14045030c
mov r14, rax
jmp 0x140340c1d
Function at 0x1403426e0
Capabilities:
Encode data using base64
Parse credit card information

Disassembly:
push r12
push r13
push r14
push r15
push rbp
sub rsp, 0x170
mov r13, rdx
mov rax, qword [0x14194d6d8]
mov r15, r9
xor rax, rsp
mov r12, r8
mov qword [rsp + 0x160], rax
mov r14, rcx
xor bpl, bpl
test r13, r13
jle 0x140342868
xor r9d, r9d
lea rdx, [r12 + r15]
xor eax, eax
mov r11, qword [rax + r14]
mov r10, qword [rax + r14 + 8]
cmp r12, r11
ja 0x14034273f
cmp rdx, r11
ja 0x140342899
cmp r12, r11
jb 0x14034274b
add r11, r10
cmp r12, r11
jb 0x140342899
inc r9
add rax, 0x10
cmp r9, r13
jb 0x140342723
mov rcx, r12
xor edx, edx
mov r8, r15
mov byte [rsp + 0x40], bpl
lea rax, [r13 - 1]
mov qword [rsp + 0x38], r12
mov r12, rax
mov qword [rsp + 0x30], r15
mov r15, rdx
mov qword [rsp + 0x48], rbx
mov rbp, rcx
mov qword [rsp + 0x50], rsi
mov rbx, r8
mov qword [rsp + 0x58], rdi
mov rdx, qword [r14]
mov rdi, qword [r14 + 8]
test rbx, rbx
jle 0x140342812
cmp rbx, rdi
cmovl rdi, rbx
cmp r15, r12
jne 0x1403427ee
mov rsi, rbx
cmp rbx, rdi
jg 0x1403427c9
cmp rbx, 1
jne 0x1403427bc
mov dil, byte [rdx]
mov byte [rbp], dil
jmp 0x1403427fc
mov rcx, rbp
mov r8, rbx
call fcn.1404407e0
jmp 0x1403427fc
mov rcx, rbp
mov r8, rdi
call fcn.1404407e0
mov edx, 0x20
lea rcx, [rbp + rdi]
neg rdi
add rdi, rbx
mov r8, rdi
call fcn.14042ad60
jmp 0x1403427fc
mov rcx, rbp
mov r8, rdi
mov rsi, rdi
call fcn.14042ae90
inc r15
add rbp, rsi
sub rbx, rsi
add r14, 0x10
cmp r15, r13
jl 0x14034278d
mov bpl, byte [rsp + 0x40]
mov r12, qword [rsp + 0x38]
mov r15, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
test bpl, bpl
je 0x140342868
mov rcx, r12
mov r8, r15
mov rdx, qword [rsp + 0x20]
call fcn.14042ae90
cmp r15, 0x100
jbe 0x140342868
mov rcx, qword [rsp + 0x20]
call fcn.14035a530
test eax, eax
je 0x140342868
mov ecx, 0x29
xor edx, edx
call fcn.140383960
mov rcx, qword [rsp + 0x160]
mov qword [rsp + 0x160], 0
xor rcx, rsp
cmp rcx, qword [0x14194d6d8]
jne 0x1403428f0
add rsp, 0x170
pop rbp
pop r15
pop r14
pop r13
pop r12
ret
mov qword [rsp + 0x28], r15
mov bpl, 1
cmp r15, 0x100
ja 0x1403428b8
lea rcx, [rsp + 0x60]
mov qword [rcx - 0x40], rcx
jmp 0x14034275a
mov rcx, r15
xor edx, edx
lea r8, [rsp + 0x20]
call fcn.14035a450
test eax, eax
je 0x1403428e1
mov ecx, 0x29
xor edx, edx
call fcn.140383960
mov rcx, qword [rsp + 0x20]
jmp 0x14034275a
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x1403428cb
jmp 0x14034275a
call fcn.14043dac0
nop
nop dword [rax]
nop dword [rax]
Function at 0x14034d400
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov r10, rdx
cmp qword [rcx + 0x20], 0
jne 0x14034d3d5
cmp qword [r10 + 0x20], 0
jg 0x14034d3d8
mov r10, rcx
mov ecx, 1
mov r8, qword [r10 + 0x20]
test r8, r8
jle 0x14034d5c7
mov rax, r8
mov r11d, 1
xor r9d, r9d
shr rax, 3
je 0x14034d508
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r15
mov r15, rax
mov qword [rsp + 0x20], rbp
movsxd r9, r9d
lea r14, [r9 + r9*2]
inc r9d
shl r14, 6
mov eax, dword [r10 + r14 + 0xd8]
cdq
xor eax, edx
sub eax, edx
movsxd r13, eax
mov eax, dword [r10 + r14 + 0xc0]
cdq
xor eax, edx
sub eax, edx
movsxd r12, eax
mov eax, dword [r10 + r14 + 0xa8]
cdq
xor eax, edx
sub eax, edx
movsxd r11, eax
mov eax, dword [r10 + r14 + 0x90]
cdq
xor eax, edx
sub eax, edx
movsxd rdi, eax
mov eax, dword [r10 + r14 + 0x78]
cdq
xor eax, edx
sub eax, edx
movsxd rsi, eax
mov eax, dword [r10 + r14 + 0x60]
cdq
xor eax, edx
sub eax, edx
movsxd rbp, eax
mov eax, dword [r10 + r14 + 0x48]
cdq
xor eax, edx
sub eax, edx
movsxd rbx, eax
mov eax, dword [r10 + r14 + 0x30]
cdq
xor eax, edx
sub eax, edx
movsxd rax, eax
imul rcx, rax
imul rcx, rbx
imul rcx, rbp
imul rcx, rsi
imul rcx, rdi
imul rcx, r11
imul rcx, r12
imul rcx, r13
cmp r9, r15
jb 0x14034d42b
shl r9d, 3
movsxd r11, r9d
mov rbx, qword [rsp + 0x58]
inc r11
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x48]
mov r12, qword [rsp + 0x40]
mov r13, qword [rsp + 0x38]
mov r14, qword [rsp + 0x30]
mov r15, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x20]
cmp r11, r8
ja 0x14034d5c7
sub r8, r11
lea rdx, [0x140000000]
inc r8
dec r8d
movzx eax, byte [rdx + r8 + 0x5947c0]
lea rax, [rdx + rax + 0x34d534]
jmp rax
mov rax, rcx
add rsp, 0x68
ret
Function at 0x1403848a0
Capabilities:
Link many functions at runtime

Disassembly:
push r13
push r14
sub rsp, 0x28
cmp dword [0x141a58480], 0
je 0x1403848c0
mov eax, dword [0x141a58484]
add rsp, 0x28
pop r14
pop r13
ret
lea rcx, str.libicaf.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r14, rax
test r14, r14
je 0x14038494d
mov rcx, r14
lea rdx, str.for_rtl_ICAF_THIS_ORIGINAL_IMAGE
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
mov rcx, r14
lea rdx, str.for_rtl_ICAF_THIS_IMAGE
mov qword [0x141a58438], r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r14
lea rdx, str.for_rtl_ICAF_THIS_TEAM_ID
mov qword [0x141a58440], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r14
lea rdx, str.for_rtl_ICAF_ABORT
mov qword [0x141a58448], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r14
lea rdx, str.for_rtl_ICAF_PROBABLY_ABORT
mov qword [0x141a58450], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x141a58458], rax
jmp 0x140384954
mov r13, qword [0x141a58438]
test r13, r13
je 0x14038496e
mov dword [0x141a58488], 1
call r13
mov dword [0x141a58484], eax
jmp 0x140384974
mov eax, dword [0x141a58484]
mov dword [0x141a58480], 1
add rsp, 0x28
pop r14
pop r13
ret

Function at 0x140384990
Capabilities:
Link many functions at runtime

Disassembly:
push rdi
push r12
sub rsp, 0x28
cmp dword [0x141a58480], 0
jne 0x140384a59
lea rcx, str.libicaf.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r12, rax
test r12, r12
je 0x140384a31
mov rcx, r12
lea rdx, str.for_rtl_ICAF_THIS_ORIGINAL_IMAGE
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov rcx, r12
lea rdx, str.for_rtl_ICAF_THIS_IMAGE
mov qword [0x141a58438], rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r12
lea rdx, str.for_rtl_ICAF_THIS_TEAM_ID
mov qword [0x141a58440], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r12
lea rdx, str.for_rtl_ICAF_ABORT
mov qword [0x141a58448], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r12
lea rdx, str.for_rtl_ICAF_PROBABLY_ABORT
mov qword [0x141a58450], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x141a58458], rax
jmp 0x140384a38
mov rdi, qword [0x141a58438]
test rdi, rdi
je 0x140384a4f
mov dword [0x141a58488], 1
call rdi
mov dword [0x141a58484], eax
mov dword [0x141a58480], 1
mov rax, qword [0x141a58440]
test rax, rax
je 0x140384a6e
add rsp, 0x28
pop r12
pop rdi
jmp rax
xor eax, eax
add rsp, 0x28
pop r12
pop rdi
ret
Function at 0x140384a80
Capabilities:
Link many functions at runtime

Disassembly:
push rdi
push r12
sub rsp, 0x28
cmp dword [0x141a58480], 0
jne 0x140384b49
lea rcx, str.libicaf.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r12, rax
test r12, r12
je 0x140384b21
mov rcx, r12
lea rdx, str.for_rtl_ICAF_THIS_ORIGINAL_IMAGE
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov rcx, r12
lea rdx, str.for_rtl_ICAF_THIS_IMAGE
mov qword [0x141a58438], rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r12
lea rdx, str.for_rtl_ICAF_THIS_TEAM_ID
mov qword [0x141a58440], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r12
lea rdx, str.for_rtl_ICAF_ABORT
mov qword [0x141a58448], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r12
lea rdx, str.for_rtl_ICAF_PROBABLY_ABORT
mov qword [0x141a58450], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x141a58458], rax
jmp 0x140384b28
mov rdi, qword [0x141a58438]
test rdi, rdi
je 0x140384b3f
mov dword [0x141a58488], 1
call rdi
mov dword [0x141a58484], eax
mov dword [0x141a58480], 1
mov rax, qword [0x141a58448]
test rax, rax
je 0x140384b5e
add rsp, 0x28
pop r12
pop rdi
jmp rax
xor eax, eax
add rsp, 0x28
pop r12
pop rdi
ret

Function at 0x140384b70
Capabilities:
Link many functions at runtime

Disassembly:
push r12
push r13
sub rsp, 0x28
cmp dword [0x141a58480], 0
jne 0x140384c3b
lea rcx, str.libicaf.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r13, rax
test r13, r13
je 0x140384c12
mov rcx, r13
lea rdx, str.for_rtl_ICAF_THIS_ORIGINAL_IMAGE
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
mov rcx, r13
lea rdx, str.for_rtl_ICAF_THIS_IMAGE
mov qword [0x141a58438], r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r13
lea rdx, str.for_rtl_ICAF_THIS_TEAM_ID
mov qword [0x141a58440], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r13
lea rdx, str.for_rtl_ICAF_ABORT
mov qword [0x141a58448], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r13
lea rdx, str.for_rtl_ICAF_PROBABLY_ABORT
mov qword [0x141a58450], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x141a58458], rax
jmp 0x140384c19
mov r12, qword [0x141a58438]
test r12, r12
je 0x140384c31
mov dword [0x141a58488], 1
call r12
mov dword [0x141a58484], eax
mov dword [0x141a58480], 1
mov eax, dword [0x141a58488]
add rsp, 0x28
pop r13
pop r12
ret
Function at 0x140385ce0
Capabilities:
Query environment variable

Disassembly:
push r13
sub rsp, 0x30
lea rcx, [0x141a58474]
call fcn.140340e60
mov eax, dword [0x141a58478]
test eax, eax
jne 0x140385d84
mov ecx, 0x1001
xor edx, edx
mov dword [0x141a58478], 1
lea r8, [rsp + 0x20]
call fcn.14035a450
mov r13, qword [rsp + 0x20]
lea rcx, str.FORT0
mov rdx, r13
mov r8d, 0x105
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov eax, eax
test rax, rax
jbe 0x140385d45
cmp rax, 0x105
jb 0x140385d4f
test r13, r13
je 0x140385d4f
mov byte [r13], 0
mov r13, qword [rsp + 0x20]
cmp byte [r13], 0
je 0x140385d7c
mov ecx, 2
call fcn.14046f6f0
mov rcx, r13
lea rdx, [0x14059ced0]
mov r8, rax
call fcn.14046fa78
mov r13, qword [rsp + 0x20]
mov rcx, r13
call fcn.14035a530
mov dword [0x141a58474], 0
add rsp, 0x30
pop r13
ret

Function at 0x140385da0
Capabilities:
Link many functions at runtime

Disassembly:
push r13
push r14
push r15
sub rsp, 0x20
mov r15, rcx
cmp dword [0x141a58480], 0
jne 0x140385e70
lea rcx, str.libicaf.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r14, rax
test r14, r14
je 0x140385e47
mov rcx, r14
lea rdx, str.for_rtl_ICAF_THIS_ORIGINAL_IMAGE
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
mov rcx, r14
lea rdx, str.for_rtl_ICAF_THIS_IMAGE
mov qword [0x141a58438], r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r14
lea rdx, str.for_rtl_ICAF_THIS_TEAM_ID
mov qword [0x141a58440], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r14
lea rdx, str.for_rtl_ICAF_ABORT
mov qword [0x141a58448], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r14
lea rdx, str.for_rtl_ICAF_PROBABLY_ABORT
mov qword [0x141a58450], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x141a58458], rax
jmp 0x140385e4e
mov r13, qword [0x141a58438]
test r13, r13
je 0x140385e66
mov dword [0x141a58488], 1
call r13
mov dword [0x141a58484], eax
mov dword [0x141a58480], 1
mov rax, qword [0x141a58450]
test rax, rax
je 0x140385e8b
mov rcx, r15
add rsp, 0x20
pop r15
pop r14
pop r13
jmp rax
add rsp, 0x20
pop r15
pop r14
pop r13
ret
Function at 0x140388b30
Capabilities:
Link many functions at runtime

Disassembly:
push rsi
push rdi
sub rsp, 0x28
cmp dword [0x141a58480], 0
jne 0x140388bf8
lea rcx, str.libicaf.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rdi, rdi
je 0x140388bd0
mov rcx, rdi
lea rdx, str.for_rtl_ICAF_THIS_ORIGINAL_IMAGE
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
mov rcx, rdi
lea rdx, str.for_rtl_ICAF_THIS_IMAGE
mov qword [0x141a58438], rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rdi
lea rdx, str.for_rtl_ICAF_THIS_TEAM_ID
mov qword [0x141a58440], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rdi
lea rdx, str.for_rtl_ICAF_ABORT
mov qword [0x141a58448], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rdi
lea rdx, str.for_rtl_ICAF_PROBABLY_ABORT
mov qword [0x141a58450], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x141a58458], rax
jmp 0x140388bd7
mov rsi, qword [0x141a58438]
test rsi, rsi
je 0x140388bee
mov dword [0x141a58488], 1
call rsi
mov dword [0x141a58484], eax
mov dword [0x141a58480], 1
cmp dword [0x141a58488], 0
je 0x140388c15
mov rax, qword [0x141a58458]
test rax, rax
je 0x140388c15
add rsp, 0x28
pop rdi
pop rsi
jmp rax
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x1403aaef0
Capabilities:
Clear file content

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
push rbp
sub rsp, 0x48
mov rbx, rcx
mov qword [rsp + 0x40], 0
mov rdx, qword [rbx + 0x88]
mov rbp, qword [rbx + 0x80]
test rdx, rdx
je 0x1403aaf24
sub rbp, rdx
jmp 0x1403aaf2b
mov rax, qword [rbx + 0x78]
sub rbp, rax
mov r15, rbp
add r15, qword [rbx + 0x200]
movsx edi, byte [rbx + 0x27c]
cmp edi, 1
je 0x1403aafc5
cmp edi, 3
je 0x1403aafc5
test rbp, rbp
je 0x1403aafbe
test rdx, rdx
jne 0x1403aaf58
mov rdx, qword [rbx + 0x78]
cmp dword [rbx + 0x238], 0xb
jne 0x1403aaf99
mov eax, edi
and eax, 0xfffffffe
cmp eax, 4
jne 0x1403aaf99
mov rax, qword [rbx + 0x78]
mov qword [rbx + 0x80], rax
cmp edi, 5
je 0x1403ab415
mov rcx, rbx
mov r8, rbp
mov r9d, 1
call fcn.1403aac70
mov r15, qword [rbx + 0x200]
jmp 0x1403aafaf
mov rcx, rbx
mov r8, rbp
call fcn.1403d1590
cmp eax, 0xffffffff
je 0x1403ab53e
xor eax, eax
test eax, eax
jne 0x1403ab397
movsx edi, byte [rbx + 0x27c]
and byte [rbx + 0x294], 0xbf
lea edx, [rdi - 1]
cmp edx, 7
ja 0x1403ab3a8
lea rsi, [0x140000000]
movzx eax, word [rsi + rdx*2 + 0x59d500]
lea rax, [rsi + rax + 0x3aafea]
jmp rax
add rsp, 0x48
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov ecx, 8
mov edx, 2
lea r8, str.for_wseq.c
mov r9d, 0x110c
call fcn.140383960
test byte [rbx + 0x295], 8
je 0x1403ab402
mov rcx, qword [rbx + 0x1a0]
xor ebp, ebp
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x1403ab528
and byte [rbx + 0x295], 0xf7
test ebp, ebp
je 0x1403ab402
mov eax, ebp
add rsp, 0x48
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
xor eax, eax
add rsp, 0x48
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov rcx, rbx
mov r8, rbp
call fcn.1403d1590
cmp eax, 0xffffffff
je 0x1403ab42c
xor eax, eax
jmp 0x1403aaf90
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 0x1a8], eax
mov eax, 0x26
jmp 0x1403aaf90
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 0x1a8], eax
mov ebp, 0x26
jmp 0x1403ab3e4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 0x1a8], eax
mov eax, 0x26
jmp 0x1403aafaf
Function at 0x1403abb00
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rdi
push r12
push r13
push r15
push rbp
sub rsp, 0x28
mov r13, r9
mov r12, r8
mov rdi, rdx
mov rbp, rcx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov r9, rax
test r9, r9
je 0x1403abbe4
mov rdx, r9
mov rcx, rdx
and rdx, 0xfffffffffffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x1403abb58
mov rax, rdx
add rdx, rcx
call fcn.14042af70
mov r15, rax
test rbp, rbp
je 0x1403abbd5
cmp r15, r13
ja 0x1403abb9d
mov rcx, rbp
mov rdx, r9
mov r8, r15
call fcn.14042ae90
cmp r15, r13
jae 0x1403abb8e
add rbp, r15
sub r13, r15
mov rcx, rbp
mov edx, 0x20
mov r8, r13
call fcn.14042ad60
test r12, r12
je 0x1403abbbd
mov dword [r12], 0
jmp 0x1403abbbd
mov rcx, rbp
mov rdx, r9
mov r8, r13
call fcn.14042ae90
test r12, r12
je 0x1403abbb8
mov dword [r12], 0xffffffff
mov ebx, 0x2fd
test rdi, rdi
je 0x1403abbc5
mov dword [rdi], r15d
mov eax, ebx
add rsp, 0x28
pop rbp
pop r15
pop r13
pop r12
pop rdi
pop rbx
ret
test r12, r12
je 0x1403abbbd
mov dword [r12], 0
jmp 0x1403abbbd
test rbp, rbp
je 0x1403abbf9
mov rcx, rbp
mov edx, 0x20
mov r8, r13
call fcn.14042ad60
test r12, r12
je 0x1403abc06
mov dword [r12], 1
test rdi, rdi
je 0x1403abc11
mov dword [rdi], 0
mov eax, 0x2fd
add rsp, 0x28
pop rbp
pop r15
pop r13
pop r12
pop rdi
pop rbx
ret
Function at 0x1403b89a0
Capabilities:
Query environment variable

Disassembly:
push r14
push r15
sub rsp, 0x138
mov rax, qword [0x14194d6d8]
xor rax, rsp
mov qword [rsp + 0x130], rax
test rcx, rcx
je 0x1403b8ab0
mov r8d, 0x105
lea rdx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov eax, eax
test rax, rax
jbe 0x1403b89f5
cmp rax, 0x105
jae 0x1403b89eb
inc rax
jmp 0x1403b89fa
mov byte [rsp + 0x24], 0
xor r15d, r15d
jmp 0x1403b8a0c
mov byte [rsp + 0x24], 0
test rax, rax
jne 0x1403b8a06
xor eax, eax
jmp 0x1403b8a7f
movsx r15d, byte [rsp + 0x24]
cmp r15d, 0x54
je 0x1403b8a7a
cmp r15d, 0x59
je 0x1403b8a7a
cmp r15d, 0x74
je 0x1403b8a7a
cmp r15d, 0x79
je 0x1403b8a7a
test r15d, r15d
je 0x1403b89ff
je 0x1403b89ff
movzx ecx, r15b
lea r14, [rsp + 0x25]
call fcn.1404720f0
test eax, eax
je 0x1403b8a51
movsx r15d, byte [r14]
inc r14
movzx ecx, r15b
call fcn.1404720f0
test eax, eax
jne 0x1403b8a3d
test r15d, r15d
jne 0x1403b89ff
lea rdx, [0x14059dad4]
lea rcx, [rsp + 0x24]
mov dword [rcx - 4], 0
lea r8, [rsp + 0x20]
call fcn.1403b8ae0
cmp dword [rsp + 0x20], 0
je 0x1403b89ff
mov eax, 1
mov rcx, qword [rsp + 0x130]
mov qword [rsp + 0x130], 0
xor rcx, rsp
cmp rcx, qword [0x14194d6d8]
jne 0x1403b8aab
add rsp, 0x138
pop r15
pop r14
ret
call fcn.14043dac0
mov rcx, qword [rsp + 0x130]
mov qword [rsp + 0x130], 0
xor rcx, rsp
cmp rcx, qword [0x14194d6d8]
jne 0x1403b8aab
xor eax, eax
add rsp, 0x138
pop r15
pop r14
ret