joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003994
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov edi, dword [rsp + 0x68]
lea ebx, [rdx + 0x3b7]
mov r11d, r9d
mov r10, r8
mov r9d, dword [rsp + 0x60]
mov esi, edx
add r9d, 0xffffdcd9
lea eax, [rdi + 0x234]
cmp ebx, eax
je 0x140003b9d
xor r11d, 0xc17
lea eax, [rbx - 0x6c9]
cmp r11d, eax
jl 0x140003bac
mov eax, dword [r8 + 0x94]
cmp dword [r8 + 0x158], eax
jb 0x140003a0c
mov ecx, dword [r8 + 0xb8]
add ecx, 0x4b272bca
add ecx, dword [r8 + 0x50]
add dword [r8 + 0x60], ecx
jmp 0x140003a22
mov eax, dword [r8 + 0xb8]
add eax, dword [r8 + 0x70]
xor eax, 0x1148d
or dword [0x140012150], eax
mov rax, qword [section..data]
cmp dword [rax + 0xbc], 0x17a6b
je 0x140003a43
lea rax, [0x1400070b0]
mov qword [r8 + 0xe0], rax
xor r11d, r11d
mov rax, qword [0x1400120f0]
mov r8d, dword [r11 + rax]
add r11, 4
mov rax, qword [section..data]
mov ecx, dword [rax + 0x148]
mov eax, dword [r10 + 4]
sub ecx, 0x13dbca
add dword [r10 + 0x11c], ecx
sub eax, dword [r10 + 0x100]
xor dword [r10 + 0xf8], eax
mov eax, dword [r10 + 0x74]
sub eax, dword [r10 + 0xa8]
add dword [r10 + 4], eax
mov rax, qword [section..data]
imul r8d, dword [r10 + 0x60]
mov ecx, dword [rax + 0x74]
xor ecx, dword [rax + 0xc]
mov eax, dword [r10 + 0x40]
xor ecx, 1
imul eax, ecx
mov edx, r8d
shr edx, 8
mov dword [r10 + 0x40], eax
mov rax, qword [section..data]
movsxd rcx, dword [rax + 0x90]
mov rax, qword [r10 + 0xe8]
mov byte [rcx + rax], dl
mov rax, qword [section..data]
inc dword [rax + 0x90]
movsxd rcx, dword [r10 + 0x90]
mov rax, qword [r10 + 0xe8]
mov byte [rcx + rax], r8b
mov ecx, 0xce66ee
inc dword [r10 + 0x90]
mov eax, dword [0x14001201c]
sub dword [r10 + 0x15c], eax
mov eax, dword [r10 + 0x24]
sub dword [r10 + 0x128], eax
mov eax, dword [r10 + 0x158]
sub eax, 0x1d196f
or dword [r10 + 0xc], eax
mov rax, qword [section..data]
sub ecx, dword [rax + 0xac]
sub ecx, dword [r10 + 0x78]
add dword [0x140012128], ecx
mov eax, dword [r10 + 0xc]
sub dword [0x14001201c], eax
mov edx, dword [r10 + 0x148]
mov eax, dword [r10 + 0x3c]
add edx, 0xffec23f3
add edx, dword [r10 + 0x98]
imul eax, edx
mov dword [r10 + 0x3c], eax
cmp r11, 0x9a8
jl 0x140003a46
lea r8d, [rdi - 0x2405]
xor r9d, 0x29f0
lea eax, [rbx - 0x38e]
xor r8d, 0x28c4
lea ecx, [rdi + 0x25d]
mov dword [rsp + 0x20], eax
mov rdx, r10
call fcn.140003308
jmp 0x140003bac
mov eax, dword [r8 + 0x40]
imul eax, r9d
xor dword [r8 + 0x15c], eax
mov rbx, qword [rsp + 0x40]
lea eax, [rsi + 0x29]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140004828
Capabilities:
Encode data using xor

Disassembly:
add r9d, 0xffffd4fd
lea r10d, [r8 - 0x8b8]
lea eax, [rcx - 0x29eb]
lea r8d, [r9 + 0x29eb]
cmp eax, r8d
jge 0x140004884
add dword [rdx + 0x48], 0xffffdec4
mov rax, qword [section..data]
mov ecx, dword [rdx + 0x98]
cmp dword [rax + 0x50], ecx
jbe 0x140004871
mov eax, dword [rdx + 4]
add eax, 0x242b0
xor dword [rdx + 0x140], eax
jmp 0x14000487b
add dword [0x140012058], 0x3cf
and dword [rdx + 0x124], 0
jmp 0x1400048c6
mov eax, r9d
or eax, 0x2662
cmp r10d, eax
jl 0x1400048c6
mov ecx, dword [rdx + 0x94]
mov eax, ecx
xor eax, r9d
imul eax, r9d
cmp ecx, eax
ja 0x1400048c6
lea r8d, [r9 + r9]
mov rax, qword [section..data]
inc ecx
sub dword [rax + 0x5c], r8d
mov eax, dword [rdx + 0x94]
xor eax, r9d
imul eax, r9d
cmp ecx, eax
jbe 0x1400048a8
lea eax, [r10 + 0xb8]
ret

Function at 0x140004d8c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov r10, qword [rsp + 0x38]
lea rax, [0x140007bb0]
add r9d, 0xfffff94a
mov qword [0x1400120f0], rax
mov ebx, r9d
lea r11d, [r8 + 0x4cd]
mov edi, ecx
xor ebx, 0x46c
xor edi, 0x15f
xor esi, esi
mov eax, dword [r10 + 0x94]
dec eax
xor dword [r10 + 0x5c], eax
mov rax, qword [r10 + 0xe0]
mov r8d, dword [rsi + rax]
add rsi, 4
mov eax, dword [r10 + 0x158]
xor eax, 0x1d196f
sub dword [0x140012138], eax
mov eax, dword [0x140012158]
add eax, 0xffec2436
xor dword [0x140012014], eax
mov rax, qword [section..data]
mov ecx, dword [rax + 0x78]
xor ecx, dword [0x1400120c8]
xor ecx, 0xdf7676
or dword [r10 + 0x170], ecx
mov rax, qword [0x1400120f8]
movsxd rcx, dword [r10 + 0x90]
imul r8d, dword [r10 + 0x60]
mov edx, r8d
shr edx, 8
mov byte [rcx + rax], dl
inc dword [r10 + 0x90]
mov eax, dword [r10 + 0xd0]
add dword [r10 + 0x158], eax
mov rax, qword [0x1400120f8]
movsxd rcx, dword [r10 + 0x90]
mov byte [rcx + rax], r8b
inc dword [r10 + 0x90]
mov eax, dword [r10 + 0x170]
xor eax, dword [r10 + 0x11c]
xor eax, 0xf568a
mov dword [r10 + 0x11c], eax
mov rax, qword [section..data]
mov ecx, dword [rax + 0x78]
mov eax, dword [0x14001201c]
add eax, 0xff319912
add ecx, eax
mov eax, dword [r10 + 0x50]
xor dword [r10 + 0x70], ecx
add dword [r10 + 0x5c], eax
cmp rsi, 0x9930
jl 0x140004dcf
lea eax, [rbx + 0x389]
mov esi, 0x129
cmp r9d, eax
je 0x140004f5b
mov eax, r11d
xor eax, 0xab6
cmp r11d, eax
jl 0x140004f5b
mov eax, r9d
xor eax, esi
cmp edi, eax
jle 0x140004f5b
lea eax, [r11 + 0x266]
cmp edi, eax
je 0x140004f0a
mov rax, qword [section..data]
mov ecx, dword [rax + 0x78]
sub ecx, 0xce61a6
mov dword [r10 + 0x60], ecx
jmp 0x140004f5b
mov eax, r11d
imul eax, ebx
cmp r9d, eax
jle 0x140004f5b
mov eax, dword [r10 + 0x128]
mov edi, 0x2272
mov ebx, dword [0x1400120c4]
xor eax, edi
cmp ebx, eax
jae 0x140004f5b
mov edx, dword [r10 + 0xfc]
add ebx, 4
mov r8, qword [section..data]
add edx, 0x273d
add edx, r11d
xor dword [r8 + 0x94], edx
mov ecx, dword [r10 + 0x128]
xor ecx, edi
cmp ebx, ecx
jb 0x140004f2d
mov rbx, qword [rsp + 8]
xor r9d, esi
mov rsi, qword [rsp + 0x10]
mov eax, r9d
mov rdi, qword [rsp + 0x18]
ret
Function at 0x140004f74
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov ebx, dword [rsp + 0x28]
lea edi, [rdx + 0xe]
mov r11d, ebx
mov r10d, r8d
xor r11d, 0x256c
xor r10d, 0x2639
xor esi, esi
mov r9, rcx
mov rax, qword [section..data]
mov ecx, dword [rax + 0x140]
mov edx, dword [rax + 0x40]
add ecx, 0x9fd04
mov eax, dword [0x140012150]
add edx, ecx
imul eax, edx
mov dword [0x140012150], eax
mov rax, qword [r9 + 0xe0]
mov r8d, dword [rsi + rax]
add rsi, 4
mov eax, dword [r9 + 0xa8]
sub eax, dword [r9 + 0x118]
add dword [r9 + 0x78], eax
movsxd rcx, dword [r9 + 0x90]
imul r8d, dword [r9 + 0x60]
mov rax, qword [r9 + 0xe8]
mov edx, r8d
shr edx, 8
mov byte [rcx + rax], dl
inc dword [r9 + 0x90]
movsxd rcx, dword [r9 + 0x90]
mov rax, qword [r9 + 0xe8]
mov byte [rcx + rax], r8b
inc dword [r9 + 0x90]
mov rdx, qword [section..data]
mov ecx, dword [rdx + 0xb8]
add ecx, 0xfff0b9cf
add ecx, dword [r9 + 0xcc]
xor dword [rdx + 0xd0], ecx
mov rax, qword [section..data]
mov ecx, dword [rax + 0x170]
sub ecx, dword [r9 + 0x148]
xor ecx, 0xfffb7ac0
sub dword [r9 + 0xcc], ecx
mov eax, dword [0x14001209c]
mov rcx, qword [section..data]
add eax, 0xe505371b
add dword [rcx + 4], eax
mov eax, 0x19173a
sub eax, dword [0x14001204c]
add dword [0x140012084], eax
mov eax, dword [r9 + 0x140]
xor eax, dword [0x1400120a4]
sub eax, 0x2aa95
or dword [r9 + 0xbc], eax
mov rax, qword [section..data]
mov ecx, dword [rax + 0x50]
xor ecx, dword [r9 + 0x40]
mov eax, dword [r9 + 0x98]
add ecx, 0xca798
imul eax, ecx
mov dword [r9 + 0x98], eax
mov eax, dword [r9 + 0x15c]
sub eax, 0xe43e0
or dword [r9 + 0xc], eax
cmp rsi, 0xb598
jl 0x140004fa3
mov eax, dword [r9 + 0x170]
mov edx, dword [rsp + 0x30]
sub eax, 0xbe79d
mov dword [0x140012070], eax
lea eax, [rbx + 0x484]
cmp edx, eax
jg 0x14000516a
lea eax, [rdx - 0x104]
cmp r11d, eax
jl 0x14000516a
mov ebx, dword [0x140012094]
mov eax, dword [r9 + 0xd0]
add ebx, 0xffffd610
mov ecx, dword [r9 + 0x15c]
or eax, ebx
cmp ecx, eax
je 0x14000516a
mov r8d, dword [0x14001206c]
mov eax, dword [0x140012168]
xor eax, dword [r9 + 4]
cmp r10d, eax
jbe 0x14000515b
mov eax, edi
or eax, r11d
and eax, edx
or r8d, eax
mov dword [0x14001206c], r8d
mov eax, dword [r9 + 0xd0]
inc ecx
or eax, ebx
cmp ecx, eax
jne 0x14000513b
mov rbx, qword [rsp + 8]
lea eax, [r10 + 0x29eb]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
Function at 0x140005e8c
Capabilities:
Create pipe

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov ebx, dword [rsp + 0xa0]
lea r12d, [rcx - 0x4c8]
add ebx, 0xfffffe6d
lea ecx, [rdx + 0xcd]
mov eax, ebx
mov dword [rsp + 0x90], ecx
mov r14d, edx
mov dword [rsp + 0x88], ebx
mov r15d, edx
lea ebp, [r8 + 0x4cb]
xor eax, 0x44b
lea r8d, [rdx - 0x35e]
xor r14d, 0xe46
mov dword [rsp + 0x80], r8d
xor r15d, 0xc87
mov rsi, r9
cmp ecx, eax
jne 0x1400060c5
lea eax, [rbp - 0x416]
cmp r12d, eax
jl 0x140005fa5
mov rax, qword [section..data]
mov ecx, dword [rax + 0x70]
add ecx, 0x1eedfaba
cmp dword [r9 + 0x5c], 0x12984
mov dword [r9 + 0x28], ecx
jae 0x140005f44
sub ecx, dword [r9 + 0x11c]
sub ecx, 0x699
mov dword [r9 + 0x28], ecx
jmp 0x140005f5b
mov eax, dword [0x140012158]
mov ecx, dword [r9 + 0x74]
add eax, 0xb7b1
add ecx, eax
mov dword [0x140012158], ecx
lea eax, [r8 + 0x6b6]
xor r12d, 0x548
lea rcx, [0x140012010]
xor r15d, 0xa1c
mov qword [rsp + 0x28], rcx
lea r8d, [rbp - 0x1d1]
xor r8d, 0xda8
mov dword [rsp + 0x20], eax
mov ecx, r15d
lea r9d, [rbp - 0x1d1]
mov edx, r12d
call fcn.140002d80
jmp 0x1400060c5
mov eax, dword [r9 + 0x50]
mov r13d, r14d
sub eax, 0x26ea
cmp r14d, eax
jne 0x1400060c5
mov rcx, qword [section..data]
mov eax, r14d
sub eax, dword [rsi + 0xc8]
imul eax, dword [rsi + 0x154]
cmp r14d, eax
jae 0x1400060a9
mov eax, dword [rcx + 0x18]
xor eax, 0x273d
sub eax, dword [rsi + 0x15c]
cmp dword [rsi + 0xf4], eax
jae 0x1400060a9
mov ecx, dword [rcx + 0xd0]
add ecx, dword [0x14001206c]
imul ecx, r8d
imul edx, ebp, 0x2639
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
mov eax, dword [rsp + 0xa0]
lea ebx, [rbp + 0x29eb]
mov r8d, dword [0x14001212c]
add eax, 0xffffdbfb
mov edx, dword [rsi + 0xfc]
or r8d, r15d
mov r9d, dword [rsp + 0x88]
sub edx, 0x2d24
or edx, dword [rsi + 0xf4]
add r9d, r15d
imul r11d, eax, 0x23f7
sub r8d, 0x2662
mov eax, dword [rsp + 0x80]
sub eax, dword [0x14001217c]
imul r10d, eax, 0x220e
mov eax, dword [rsi + 0x128]
sub eax, dword [rsp + 0x90]
imul ecx, eax, 0x220e
movsxd rdi, r12d
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], r11d
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], r10d
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov rcx, qword [section..data]
mov r8d, dword [rsp + 0x80]
mov eax, dword [rsi + 0x50]
add r13d, 4
sub eax, 0x26ea
cmp r13d, eax
je 0x140005fc1
mov ebx, dword [rsp + 0x88]
lea eax, [rbx + 0x3f0]
mov rbx, qword [rsp + 0x98]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140001480
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x14008e8a0]
mov dword [rax], 1
mov rax, qword [0x14008e8b0]
mov dword [rax], 1
mov rax, qword [0x14008e8c0]
mov dword [rax], 1
mov rax, qword [0x14008e890]
mov dword [rax], 1
mov rax, qword [0x14008e720]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400014de
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x14000150a
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x140001530
cmp eax, 0x20b
je 0x140001557
jmp 0x140001586
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x140001543
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x14000158b
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x140001572
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x14000158b
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140003c90
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
sub rsp, 0x28
xor r8d, r8d
mov r13, rcx
mov r12, rdx
test rdx, rdx
je 0x140003cb1
mov rcx, rdx
call sym.strlen
mov r8, rax
mov rcx, r12
mov r9, r13
mov edx, 1
call sym.fwrite
mov rcx, r13
add rsp, 0x28
pop r12
pop r13
jmp sym.fflush

Function at 0x14000b380
Capabilities:
Write file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
lea r13, [0x1400950a0]
mov rsi, rdx
mov rbx, rcx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test rsi, rsi
jle 0x14000b40f
lea rcx, [0x140029280]
xor r14d, r14d
lea r12, [rsp + 0x20]
call sym.__emutls_get_address
mov rbp, qword [sym.__acrt_iob_func]
mov rdi, rax
jmp 0x14000b3dd
add r14, 1
add rbx, 0x10
cmp rsi, r14
je 0x14000b416
mov ecx, 1
call rbp
movdqu xmm0, xmmword [rbx]
xor r8d, r8d
mov rdx, r12
mov rcx, rax
movaps xmmword [rsp + 0x20], xmm0
call sym.writeWindows__system_u9067
cmp byte [rdi], 0
je 0x14000b3d0
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rbp, qword [sym.__acrt_iob_func]
mov ecx, 1
call rbp
mov r8d, 1
mov edx, 1
lea rcx, [0x14002a3f9]
mov r9, rax
call sym.fwrite
mov ecx, 1
call rbp
mov rcx, rax
call sym.fflush
mov rcx, r13
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x14000d8a0
Capabilities:
Hash data using sha256

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa8
movaps xmmword [rsp + 0x90], xmm6
xor eax, eax
movdqa xmm0, xmmword [0x14002a6c0]
mov rbx, rcx
lea r12, [rsp + 0x20]
mov ecx, 0xd
mov rsi, rdx
mov rdi, r12
mov qword [r8], 0
mov r13, r8
rep stosq qword [rdi], rax
mov qword [r8 + 8], 0
mov rcx, qword [0x14008e700]
mov qword [r8 + 0x10], 0
mov qword [r8 + 0x18], 0
movups xmmword [rsp + 0x28], xmm0
movdqa xmm0, xmmword [0x14002a6d0]
movups xmmword [rsp + 0x38], xmm0
call sym.__emutls_get_address
cmp byte [rax], 0
mov rdi, rax
jne 0x14000d99d
test rsi, rsi
jle 0x14000d97f
mov eax, 0x40
movq xmm6, qword [0x14002a6e0]
mov r8, rsi
lea rbp, [rsp + 0x48]
cmp rsi, rax
cmovle rax, rsi
xor ecx, ecx
xor edx, edx
pxor xmm0, xmm0
cvtsi2sd xmm0, rax
ucomisd xmm0, xmm0
jnp 0x14000d9c0
movapd xmm1, xmm0
subsd xmm0, xmm0
andpd xmm1, xmm6
andpd xmm0, xmm6
mulsd xmm0, qword [0x14002a6f0]
comisd xmm1, xmm0
jae 0x14000d9c0
call sym.raiseOverflow
cmp byte [rdi], 0
jne 0x14000d99d
mov rdx, r13
mov rcx, r12
call sym.finish__69num68isplay77onitors_u410
cmp byte [rdi], 0
jne 0x14000d99d
mov edx, 0x68
mov rcx, r12
call sym.burnMem__OOZOOZOOZOOZOOZOnimbleZpkgs50Znimcrypto4548O54O484553c5453515754525056df57494950a4953a57e5356f48b49a54495354dca49b515
nop
movaps xmm6, xmmword [rsp + 0x90]
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rdx, [r12 + rdx + 0x28]
lea r11, [rbx + rcx]
cmp eax, 8
jb 0x14000dab0
mov r9, qword [r11]
mov qword [rdx], r9
mov r9d, eax
mov r10, qword [r11 + r9 - 8]
mov qword [rdx + r9 - 8], r10
lea r10, [rdx + 8]
and r10, 0xfffffffffffffff8
sub rdx, r10
sub r11, rdx
add edx, eax
and edx, 0xfffffff8
cmp edx, 8
jb 0x14000da17
and edx, 0xfffffff8
xor r9d, r9d
mov r14d, r9d
add r9d, 8
mov r15, qword [r11 + r14]
mov qword [r10 + r14], r15
cmp r9d, edx
jb 0x14000da03
lea r14, [rax + rcx]
mov rdx, rax
xor rcx, r14
xor rdx, r14
test rcx, rdx
js 0x14000d975
mov r15, r8
mov rdx, rax
sub r15, rax
xor r8, r15
xor rdx, r15
not r8
or r8, rdx
jns 0x14000d975
add eax, dword [rsp + 0x20]
mov dword [rsp + 0x20], eax
jae 0x14000da57
add dword [rsp + 0x24], 1
test al, 0x3f
jne 0x14000da77
lea rcx, [rsp + 0x28]
mov r8d, 0x40
mov rdx, rbp
call sym.sha256Transform__OOZOOZOOZOOZOOZOnimbleZpkgs50Znimcrypto4548O54O484553c5453515754525056df57494950a4953a57e5356f48b49a54495354d
cmp byte [rdi], 0
jne 0x14000d99d
test r15, r15
jle 0x14000d97a
mov edx, dword [rsp + 0x20]
mov eax, 0x40
and edx, 0x3f
sub rax, rdx
cmp rax, r15
cmovg rax, r15
test r14, r14
js 0x14000daf8
cmp rsi, r14
jle 0x14000daf8
mov rcx, r14
mov r8, r15
jmp 0x14000d948
test al, 4
jne 0x14000dae0
test eax, eax
je 0x14000da17
movzx r9d, byte [r11]
mov byte [rdx], r9b
test al, 2
je 0x14000da17
mov r9d, eax
movzx r10d, word [r11 + r9 - 2]
mov word [rdx + r9 - 2], r10w
jmp 0x14000da17
mov r9d, dword [r11]
mov dword [rdx], r9d
mov r9d, eax
mov r10d, dword [r11 + r9 - 4]
mov dword [rdx + r9 - 4], r10d
jmp 0x14000da17
lea rdx, [rsi - 1]
mov rcx, r14
call sym.raiseIndexError2
jmp 0x14000d97a
Function at 0x140015a10
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov r8, rbx
mov rdx, qword [rbp + 0x20]
mov rcx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x140016642
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x140095748]
test eax, eax
je 0x1400166da
lea rax, [0x140095720]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x140095750]
mov qword [rbp - 8], rax
jmp 0x1400166be
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x1400166b2
cmp qword [rbp - 0x10], 0
je 0x1400166b2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140016678
lea rax, [0x140095720]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x1400166db
nop
add rsp, 0x30
pop rbp
ret

Function at 0x1400167e0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x140016808
mov eax, 0
jmp 0x140016856
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140016831
mov eax, 0
jmp 0x140016856
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x140016851
mov eax, 0
jmp 0x140016856
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x14001685c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x1400168da
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x1400168d1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x1400168d1
mov rax, qword [rbp - 8]
jmp 0x1400168ef
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x1400168a4
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x14001e244
Capabilities:
Print debug messages

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x90
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
cmp qword [rbp + 0x10], 0
je 0x14001e38e
mov rcx, qword [rbp + 0x10]
call sym.pthread_spin_destroy
cmp eax, 1
jne 0x14001e381
movabs rax, 0x6c6320726f727245
movabs rdx, 0x7520676e696e6165
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rdx
movabs rax, 0x6b5f6e6970732070
movabs rdx, 0x20726f6620737965
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rdx
movabs rax, 0x20646165726874
mov edx, 0
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rdx
mov qword [rbp - 0x40], 0
mov qword [rbp - 0x38], 0
mov qword [rbp - 0x30], 0
mov qword [rbp - 0x28], 0
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x18], 0
mov qword [rbp - 0x10], 0
mov word [rbp - 8], 0
mov byte [rbp - 6], 0
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call rax
mov ecx, eax
lea rax, [rbp - 0x70]
add rax, 0x27
mov r8d, 0xa
mov rdx, rax
mov rax, qword [sym.imp.msvcrt.dll__ultoa]
call rax
mov dword [rbp - 4], 0x27
jmp 0x14001e337
add dword [rbp - 4], 1
mov eax, dword [rbp - 4]
cdqe
movzx eax, byte [rbp + rax - 0x70]
test al, al
je 0x14001e34d
mov eax, dword [rbp - 4]
cmp eax, 0x69
jbe 0x14001e333
mov eax, dword [rbp - 4]
cmp eax, 0x69
ja 0x14001e36c
mov eax, dword [rbp - 4]
cdqe
mov byte [rbp + rax - 0x70], 0xa
mov eax, dword [rbp - 4]
add eax, 1
cdqe
mov byte [rbp + rax - 0x70], 0
lea rax, [rbp - 0x70]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rax
call sym.abort
mov rax, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x18]
mov qword [rax], rdx
jmp 0x14001e38f
nop
add rsp, 0x90
pop rbp
ret
Function at 0x14001f3ab
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [sym.imp.KERNEL32.dll_TlsAlloc]
call rax
mov dword [0x140029510], eax
mov eax, dword [0x140029510]
cmp eax, 0xffffffff
jne 0x14001f3d2
call sym.abort
nop
add rsp, 0x20
pop rbp
ret

Function at 0x14001f585
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xffffffffffffffff
lea rax, [sym.pthread_tls_init]
mov rdx, rax
lea rax, [0x1400961d0]
mov rcx, rax
call sym._pthread_once_raw
mov eax, dword [0x140029510]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
je 0x14001f5d8
mov rax, qword [rbp - 0x10]
jmp 0x14001f738
call sym.pop_pthread_mem
mov qword [rbp - 0x10], rax
mov rax, qword [sym.__dyn_tls_pthread]
test rax, rax
je 0x14001f5f4
cmp qword [rbp - 0x10], 0
jne 0x14001f5fe
mov eax, 0
jmp 0x14001f738
mov rax, qword [rbp - 0x10]
mov dword [rax + 0x44], 1
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call rax
mov rdx, qword [rbp - 0x10]
mov dword [rdx + 0x70], eax
mov r9d, 0
mov r8d, 0
mov edx, 1
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateEventA]
call rax
mov rdx, qword [rbp - 0x10]
mov qword [rdx + 0x30], rax
mov rax, qword [rbp - 0x10]
mov qword [rax + 0x38], 0xffffffffffffffff
mov rax, qword [rbp - 0x10]
lea rcx, [rax + 0x68]
mov rax, qword [rbp - 8]
mov rdx, rax
call sym.replace_spin_keys
mov rax, qword [rbp - 0x10]
mov dword [rax + 0xb8], 0
mov rax, qword [rbp - 0x10]
mov qword [rax + 0x28], 0
mov rax, qword [rbp - 0x10]
lea rdi, [rax + 0x28]
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov rsi, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call rax
mov rbx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, rdi
mov r8, rsi
mov rdx, rbx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DuplicateHandle]
call rax
test eax, eax
jne 0x14001f6d9
call sym.abort
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x28]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetThreadPriority]
call rax
mov rdx, qword [rbp - 0x10]
mov dword [rdx + 0xc0], eax
mov rax, qword [rbp - 0x10]
mov dword [rax + 0xbc], 0
mov rax, qword [rbp - 0x10]
movzx edx, byte [rax + 0x40]
and edx, 0xffffffcf
or edx, 0x10
mov byte [rax + 0x40], dl
mov eax, dword [0x140029510]
mov rdx, qword [rbp - 0x10]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
test eax, eax
jne 0x14001f734
call sym.abort
mov rax, qword [rbp - 0x10]
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret