joyce8/EMBER2024-capa huggingface dataset:
Function at 0x61c4bdf0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x61cb28a0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x61cb2880]
test rbx, rbx
je 0x61c4be44
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x61c4be3b
test rsi, rsi
je 0x61c4be3b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x61c4be20
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x61cb28a0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax

Function at 0x61c4c060
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x61c4c0a0
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov ecx, dword [rax + 0xc]
mov r8d, ecx
cmp r8, rdx
ja 0x61c4c097
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x61c4c0a2
add rax, 0x28
cmp rax, r9
jne 0x61c4c084
xor eax, eax
repz ret

Function at 0x61c4c160
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rbx
sub rsp, 0x28
cmp word [0x61c40000], 0x5a4d
lea rbx, [0x61c40000]
mov rsi, rcx
je 0x61c4c184
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov rcx, rbx
call fcn.61c4c020
test eax, eax
je 0x61c4c17b
sub rsi, rbx
mov rcx, rbx
mov rdx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.61c4c060
Function at 0x61c4ca50
Capabilities:
Check mutex on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x80]
mov r14, rcx
movsxd r12, edx
mov r13, r8
call sub.msvcrt.dll_strlen
mov rsi, rax
lea ebx, [rax + 0xf]
lea eax, [rax + 0x52]
cdqe
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.61c4cc10
sub rsp, rax
movsxd rdi, esi
movabs rax, 0x656d68732d636367
lea r15, [rsp + 0x20]
lea rcx, [rsp + 0x2f]
mov r8, rdi
mov rdx, r14
mov qword [rsp + 0x20], rax
mov eax, 0x326d
mov dword [rsp + 0x28], 0x64742d6d
mov word [rsp + 0x2c], ax
lea r14d, [rsi + 0x50]
mov byte [rsp + 0x2e], 0x2d
movsxd rbx, ebx
call sub.msvcrt.dll_memcpy
lea rax, [r15 + rdi + 0x10]
movabs rdx, 0x6161616161616161
xor ecx, ecx
mov r8, r15
mov qword [rax], rdx
mov qword [rax + 8], rdx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], rdx
mov qword [rax + 0x20], rdx
mov qword [rax + 0x28], rdx
mov qword [rax + 0x30], rdx
mov qword [rax + 0x38], rdx
movsxd rax, r14d
xor edx, edx
mov byte [rsp + rax + 0x20], 0
mov byte [rsp + rbx + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov byte [rsp + rbx + 0x20], 0x2d
mov rdi, rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x61c4cb39
int3
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindAtomA]
test ax, ax
jne 0x61c4cbd8
mov rcx, r12
call sub.msvcrt.dll_malloc
lea r9d, [rsi + 0x10]
mov rbx, rax
mov r10d, 0x40
bt rbx, r10
jae 0x61c4cb74
mov r11d, r14d
sub r11d, r10d
movsxd r11, r11d
mov byte [r15 + r11], 0x41
sub r10d, 1
jne 0x61c4cb60
mov dword [rbp - 0x54], r9d
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_AddAtomA]
test ax, ax
mov r9d, dword [rbp - 0x54]
je 0x61c4cbd5
lea r8d, [rsi + 0x51]
movzx ecx, ax
mov rdx, r15
call fcn.61c4c9d0
cmp rax, rbx
mov rsi, rax
je 0x61c4cbf0
mov rcx, rbx
call sub.msvcrt.dll_free
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rsi
lea rsp, [rbp - 0x48]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
int3
lea r9d, [rsi + 0x10]
lea r8d, [rsi + 0x51]
movzx ecx, ax
mov rdx, r15
call fcn.61c4c9d0
mov rsi, rax
jmp 0x61c4cbaf
xor edx, edx
mov r8, r12
mov rcx, rbx
call sub.msvcrt.dll_memset
test r13, r13
je 0x61c4cbaf
mov rcx, rbx
call r13
jmp 0x61c4cbaf

Function at 0x61c4da80
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [0x61cb2958]
test rbx, rbx
je 0x61c4dab0
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [rbx], eax
mov rax, qword [0x61cb2958]
test rax, rax
je 0x61c4dad4
cmp dword [rax], 0xffffffff
je 0x61c4daf5
add rsp, 0x20
pop rbx
ret
lea r8, [0x61c4cd30]
lea rcx, str._pthread_tls_shmem
mov edx, 4
call fcn.61c51da0
mov qword [0x61cb2958], rax
mov rbx, rax
jmp 0x61c4da91
lea r8, [0x61c4cd30]
lea rcx, str._pthread_tls_shmem
mov edx, 4
call fcn.61c51da0
mov qword [0x61cb2958], rax
jmp 0x61c4daa5
call sub.msvcrt.dll_abort
nop
nop dword [rax + rax]
Function at 0x61c4e0e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rcx, qword [0x61cb2960]
test rcx, rcx
je 0x61c4e232
cmp dword [rcx], 1
je 0x61c4e102
call fcn.61c4e070
mov rax, qword [0x61cb2958]
test rax, rax
je 0x61c4e255
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x61c4e130
mov rax, rbx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
call fcn.61c4d8e0
cmp qword [0x61cb6040], 0
mov rsi, rax
je 0x61c4e122
test rax, rax
je 0x61c4e122
mov dword [rax + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, 1
mov dword [rsi + 0x70], eax
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rsi + 0x30], rax
movabs rax, 0x1feedbab1
mov rbx, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsi + 0x38], 0xffffffffffffffff
mov qword [rsi + 0x60], 0
mov qword [rsi + 0x68], rax
mov dword [rsi + 0xb8], 0
mov qword [rsi + 0x28], 0
call rbx
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rdi, rax
call rbx
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
lea r9, [rsi + 0x28]
mov dword [rsp + 0x20], 0
mov r8, rbp
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x61c4e29d
mov rcx, qword [rsi + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [rsi + 0xc0], eax
movzx eax, byte [rsi + 0x40]
mov dword [rsi + 0xbc], 0
and eax, 0xffffffcf
or eax, 0x10
mov byte [rsi + 0x40], al
mov rax, qword [0x61cb2958]
test rax, rax
je 0x61c4e279
mov rdx, rsi
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x61c4e29d
mov rbx, rsi
jmp 0x61c4e122
lea rcx, str._pthread_tls_once_shmem
xor r8d, r8d
mov edx, 4
call fcn.61c51da0
mov qword [0x61cb2960], rax
mov rcx, rax
jmp 0x61c4e0f8
lea r8, [0x61c4cd30]
lea rcx, str._pthread_tls_shmem
mov edx, 4
call fcn.61c51da0
mov qword [0x61cb2958], rax
jmp 0x61c4e112
lea r8, [0x61c4cd30]
lea rcx, str._pthread_tls_shmem
mov edx, 4
call fcn.61c51da0
mov qword [0x61cb2958], rax
jmp 0x61c4e21b
call sub.msvcrt.dll_abort
nop
nop word cs:[rax + rax]
lea rcx, str._pthread_key_dest_shmem
xor r8d, r8d
mov edx, 8
jmp fcn.61c51da0
Function at 0x61c4e2b0
Capabilities:
Check mutex on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rcx, qword [0x61cb2960]
test rcx, rcx
je 0x61c4e232
cmp dword [rcx], 1
je 0x61c4e102
call fcn.61c4e070
mov rax, qword [0x61cb2958]
test rax, rax
je 0x61c4e255
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x61c4e130
mov rax, rbx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
call fcn.61c4d8e0
cmp qword [0x61cb6040], 0
mov rsi, rax
je 0x61c4e122
test rax, rax
je 0x61c4e122
mov dword [rax + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, 1
mov dword [rsi + 0x70], eax
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rsi + 0x30], rax
movabs rax, 0x1feedbab1
mov rbx, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsi + 0x38], 0xffffffffffffffff
mov qword [rsi + 0x60], 0
mov qword [rsi + 0x68], rax
mov dword [rsi + 0xb8], 0
mov qword [rsi + 0x28], 0
call rbx
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rdi, rax
call rbx
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
lea r9, [rsi + 0x28]
mov dword [rsp + 0x20], 0
mov r8, rbp
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x61c4e29d
mov rcx, qword [rsi + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [rsi + 0xc0], eax
movzx eax, byte [rsi + 0x40]
mov dword [rsi + 0xbc], 0
and eax, 0xffffffcf
or eax, 0x10
mov byte [rsi + 0x40], al
mov rax, qword [0x61cb2958]
test rax, rax
je 0x61c4e279
mov rdx, rsi
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x61c4e29d
mov rbx, rsi
jmp 0x61c4e122
lea rcx, str._pthread_tls_once_shmem
xor r8d, r8d
mov edx, 4
call fcn.61c51da0
mov qword [0x61cb2960], rax
mov rcx, rax
jmp 0x61c4e0f8
lea r8, [0x61c4cd30]
lea rcx, str._pthread_tls_shmem
mov edx, 4
call fcn.61c51da0
mov qword [0x61cb2958], rax
jmp 0x61c4e112
lea r8, [0x61c4cd30]
lea rcx, str._pthread_tls_shmem
mov edx, 4
call fcn.61c51da0
mov qword [0x61cb2958], rax
jmp 0x61c4e21b
call sub.msvcrt.dll_abort
nop
nop word cs:[rax + rax]
lea rcx, str._pthread_key_dest_shmem
xor r8d, r8d
mov edx, 8
jmp fcn.61c51da0
Function at 0x61c51340
Capabilities:
Check mutex on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
mov rcx, qword [0x61cb29a8]
mov esi, edx
test rcx, rcx
je 0x61c512e2
call fcn.61c52150
cmp dword [rbx], 0xbab1f00d
jne 0x61c51309
mov eax, dword [rbx + 4]
test eax, eax
jle 0x61c51309
mov eax, dword [rbx + 4]
mov rcx, qword [0x61cb29a8]
sub eax, 1
test rcx, rcx
mov dword [rbx + 4], eax
je 0x61c512b2
call fcn.61c520b0
mov eax, esi
add rsp, 0x38
pop rbx
pop rsi
ret
lea r8, [0x61c50ed0]
lea rcx, str.mutex_global_shmem
mov edx, 0x10
call fcn.61c51da0
mov rcx, rax
mov qword [0x61cb29a8], rax
call fcn.61c520b0
mov eax, esi
add rsp, 0x38
pop rbx
pop rsi
ret
lea rcx, str.mutex_global_shmem
lea r8, [0x61c50ed0]
mov edx, 0x10
call fcn.61c51da0
mov qword [0x61cb29a8], rax
mov rcx, rax
jmp 0x61c51277
call qword [sym.imp.msvcrt.dll___iob_func]
lea r9, str.c:_crossdev_src_winpthreads_svn6233_src_mutex.c
lea rcx, [rax + 0x60]
lea r8, str._m___valid__LIFE_MUTEX____m___busy___0_
lea rdx, [0x61cae0c8]
mov dword [rsp + 0x20], 0x3a
call sub.msvcrt.dll_fprintf
mov ecx, 1
call sub.msvcrt.dll_exit
nop
lea r8, [0x61c50ed0]
lea rcx, str.mutex_global_shmem
mov edx, 0x10
jmp fcn.61c51da0
Function at 0x61c51da0
Capabilities:
Check mutex on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x80]
mov r15, rcx
movsxd r12, edx
mov r13, r8
call sub.msvcrt.dll_strlen
mov r14, rax
lea ebx, [rax + 0xf]
lea eax, [rax + 0x51]
cdqe
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.61c4cc10
sub rsp, rax
movsxd rdi, r14d
movabs rax, 0x656d68732d636367
lea rsi, [rsp + 0x20]
lea rcx, [rsp + 0x2f]
mov r8, rdi
mov rdx, r15
mov qword [rsp + 0x20], rax
mov eax, 0x326d
mov dword [rsp + 0x28], 0x64742d6d
mov word [rsp + 0x2c], ax
lea r15d, [r14 + 0x50]
mov byte [rsp + 0x2e], 0x2d
movsxd rbx, ebx
call sub.msvcrt.dll_memcpy
lea rax, [rsi + rdi + 0x10]
movabs rdx, 0x6161616161616161
xor ecx, ecx
mov r8, rsi
mov qword [rax], rdx
mov qword [rax + 8], rdx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], rdx
mov qword [rax + 0x20], rdx
mov qword [rax + 0x28], rdx
mov qword [rax + 0x30], rdx
mov qword [rax + 0x38], rdx
movsxd rax, r15d
xor edx, edx
mov byte [rsp + rax + 0x20], 0
mov byte [rsp + rbx + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov byte [rsp + rbx + 0x20], 0x2d
mov rdi, rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x61c51e89
int3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindAtomA]
test ax, ax
jne 0x61c51f22
mov rcx, r12
add r14d, 0x10
call sub.msvcrt.dll_malloc
mov r10d, 0x40
mov rbx, rax
bt rbx, r10
jae 0x61c51ec4
mov r11d, r15d
sub r11d, r10d
movsxd r11, r11d
mov byte [rsi + r11], 0x41
sub r10d, 1
jne 0x61c51eb0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_AddAtomA]
test ax, ax
je 0x61c51f1f
mov rdx, rsi
movzx ecx, ax
mov r9d, r14d
mov r8d, r15d
call fcn.61c51d20
cmp rax, rbx
mov rsi, rax
je 0x61c51f39
mov rcx, rbx
call sub.msvcrt.dll_free
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rsi
lea rsp, [rbp - 0x58]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
int3
lea r9d, [r14 + 0x10]
mov rdx, rsi
movzx ecx, ax
mov r8d, r15d
call fcn.61c51d20
mov rsi, rax
jmp 0x61c51ef9
xor edx, edx
mov r8, r12
mov rcx, rbx
call sub.msvcrt.dll_memset
test r13, r13
je 0x61c51ef9
mov rcx, rbx
call r13
jmp 0x61c51ef9
Function at 0x61c52ab0
Capabilities:
Check mutex on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
mov rcx, qword [0x61cb29c8]
mov esi, edx
test rcx, rcx
je 0x61c52a50
call fcn.61c52150
mov rcx, qword [rbx]
cmp dword [rcx], 0xbab1f0ed
jne 0x61c52a77
mov rax, qword [rbx]
mov ecx, dword [rax + 4]
test ecx, ecx
jle 0x61c52a77
mov rcx, qword [rbx]
sub dword [rcx + 4], 1
mov rcx, qword [0x61cb29c8]
test rcx, rcx
je 0x61c52a20
call fcn.61c520b0
mov eax, esi
add rsp, 0x38
pop rbx
pop rsi
ret
lea r8, [0x61c526c0]
lea rcx, str.rwl_global_shmem
mov edx, 0x10
call fcn.61c51da0
mov rcx, rax
mov qword [0x61cb29c8], rax
call fcn.61c520b0
mov eax, esi
add rsp, 0x38
pop rbx
pop rsi
ret
lea rcx, str.rwl_global_shmem
lea r8, [0x61c526c0]
mov edx, 0x10
call fcn.61c51da0
mov qword [0x61cb29c8], rax
mov rcx, rax
jmp 0x61c529d7
call qword [sym.imp.msvcrt.dll___iob_func]
lea r9, str.c:_crossdev_src_winpthreads_svn6233_src_rwlock.c
lea rcx, [rax + 0x60]
lea r8, str.___rwlock_t__rwl___valid__LIFE_RWLOCK______rwlock_t__rwl___busy___0_
lea rdx, str.Assertion_failed:___s___file__s__line__d_n
mov dword [rsp + 0x20], 0x30
call sub.msvcrt.dll_fprintf
mov ecx, 1
call sub.msvcrt.dll_exit
nop
nop
lea r8, [0x61c526c0]
lea rcx, str.rwl_global_shmem
mov edx, 0x10
jmp fcn.61c51da0

Function at 0x61c55060
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [0x61c56700]
lea rcx, str.__terminate_handler_sh
mov edx, 8
jmp fcn.61c4ca50

Function at 0x61c55080
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [0x61c56710]
lea rcx, str.__unexpected_handler_sh
mov edx, 8
jmp fcn.61c4ca50
Function at 0x414020
Capabilities:
Hash data using djb2

Disassembly:
push rbp
push r14
push r13
push r12
push rdi
push rsi
push rbx
mov rbp, rsp
sub rsp, 0x30
test rcx, rcx
mov rsi, rcx
je 0x414230
movsx eax, byte [rcx]
lea r8, [rcx + 1]
test al, al
je 0x414240
mov ecx, 0x1505
mov edx, ecx
add r8, 1
shl edx, 5
add eax, edx
add ecx, eax
movsx eax, byte [r8 - 1]
test al, al
jne 0x414051
test ecx, ecx
mov ebx, 0x10
mov edi, 1
jne 0x4141e0
lea rcx, [0x004be480]
call qword [0x004c0df0]
mov r13, qword [0x004be4a8]
lea rax, [r13 + rbx]
mov edx, dword [rax]
test edx, edx
jne 0x414100
mov ebx, edi
cmp dword [0x004be460], 0x3fc
ja 0x4141ae
mov r12d, ebx
mov rcx, rsi
call qword [0x004c1050]
shl r12, 4
add r13, r12
add r12, qword [0x004be4a8]
mov qword [r13 + 8], rax
cmp qword [r12 + 8], 0
je 0x41424f
add dword [0x004be460], 1
mov dword [r12], edi
lea rcx, [0x004be480]
call qword [0x004c0e90]
mov eax, ebx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop rbp
ret
cmp edx, edi
mov r12, qword [rax + 8]
jne 0x414119
mov rdx, r12
mov rcx, rsi
mov ebx, edi
call fcn.00425a38
test eax, eax
je 0x4140df
mov qword [rsp + 0x28], r12
mov edx, 4
xor ecx, ecx
mov r12d, edi
mov qword [rsp + 0x20], rsi
lea r9, str.hash_collision___s_vs__s_
mov r14d, 0x3fd
mov ebx, edi
lea r8, str.htab_hash
call fcn.0040b3b0
mov eax, edi
mov edx, 0x2028323f
mov r13, qword [0x004be4a8]
imul edx
mov eax, edi
sar eax, 0x1f
sar edx, 7
sub edx, eax
imul eax, edx, 0x3fb
sub r12d, eax
add r12d, 1
sub r14d, r12d
lea eax, [rbx + r14]
mov edx, ebx
sub edx, r12d
cmp ebx, r12d
cmova eax, edx
cmp edi, eax
mov ebx, eax
je 0x41409a
mov eax, eax
shl rax, 4
add rax, r13
mov edx, dword [rax]
cmp edx, edi
je 0x414210
test edx, edx
jne 0x414172
cmp dword [0x004be460], 0x3fc
jbe 0x4140aa
mov dword [rsp + 0x20], 0x3fd
lea r9, str.hash_table_is_full___lu_entries_
xor ecx, ecx
xor ebx, ebx
lea r8, str.htab_hash
mov edx, 1
call fcn.0040b3b0
jmp 0x4140df
mov eax, ecx
mov edi, ecx
imul rax, rax, 0xc0906d
shr rax, 0x20
sub edi, eax
shr edi, 1
add edi, eax
shr edi, 9
imul edi, edi, 0x3fd
sub ecx, edi
mov edi, ecx
jne 0x414270
mov edi, 1
jmp 0x414079
mov rdx, qword [rax + 8]
mov rcx, rsi
call fcn.00425a38
test eax, eax
jne 0x414172
jmp 0x4140df
xor ebx, ebx
jmp 0x4140ec
mov ebx, 0x1140
mov edi, 0x114
jmp 0x414079
lea r9, str.could_not_duplicate_string_for_hash_table
mov edx, 1
xor ecx, ecx
lea r8, str.htab_hash
xor ebx, ebx
call fcn.0040b3b0
jmp 0x4140df
mov eax, ecx
shl rax, 4
mov rbx, rax
jmp 0x414079

Function at 0x420750
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x004b7cb0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x4207bd
mov rcx, r8
call fcn.00420630
test eax, eax
je 0x4207bd
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x4207bd
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x4207b4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x4207bf
add rax, 0x28
cmp rax, r9
jne 0x4207a0
xor eax, eax
add rsp, 0x28
ret
Function at 0x1400044c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rdx + 0x26], 0
mov rbx, rcx
je 0x1400044e6
xor eax, eax
lea r8d, [rax - 0x79]
xor byte [rax + rdx], r8b
inc rax
cmp rax, 0x25
jb 0x1400044d1
mov byte [rdx + 0x26], 0
call fcn.1400042f0
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x140005890
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 8], al
je 0x1400058b3
lea edx, [rax - 0x79]
xor byte [rax + rcx], dl
inc rax
cmp rax, 7
jb 0x1400058a0
mov byte [rcx + 8], 0
lea r8, [rcx + 7]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140001700
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140009530
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x3c], 0
je 0x140009553
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x79]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x3b
jb 0x140009540
mov byte [rcx + 0x3c], 0
mov rax, rcx
ret

Function at 0x140009560
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x3e], 0
je 0x140009583
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x79]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x3d
jb 0x140009570
mov byte [rcx + 0x3e], 0
mov rax, rcx
ret

Function at 0x140009590
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x42], 0
je 0x1400095b3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x79]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x41
jb 0x1400095a0
mov byte [rcx + 0x42], 0
mov rax, rcx
ret
Function at 0x140011760
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x1400300a8]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x20], 0
movdqa xmm0, xmmword [0x140021980]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x20], 0
mov r8d, 1
lea rdx, [0x1400217e0]
lea rcx, [0x140030cc8]
call fcn.1400037a0
mov r8d, 2
lea rdx, [0x140022020]
lea rcx, [0x140030c20]
call fcn.1400037a0
mov r8d, 3
lea rdx, [0x140022024]
lea rcx, [0x140030ce8]
call fcn.1400037a0
call fcn.14000fc80
call fcn.140006720
mov edx, 6
lea rcx, str.Welcome_to_EG__n_n
call fcn.140013f40
mov edx, 6
lea rcx, str.Login_Key:__n
call fcn.140013f40
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
mov rax, qword [rbx]
movsxd rcx, dword [rax + 4]
add rcx, rbx
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
lea rdx, [0x140030c00]
mov rcx, rbx
call fcn.140011580
call fcn.140007af0
cmp al, 1
jne 0x14001194a
lea rcx, [rsp + 0x40]
call fcn.1400095c0
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0x10
jb 0x140011859
mov rax, qword [rax]
cmp r8, 1
jne 0x140011876
lea rdx, [0x140022050]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140011876
xor bl, bl
jmp 0x140011878
mov bl, 1
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x1400118b8
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400118b3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400118b3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001dbd4
test bl, bl
jne 0x14001194a
call fcn.14000eaf0
call fcn.14000b220
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
mov rax, qword [rbx]
movsxd rcx, dword [rax + 4]
add rcx, rbx
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140011580
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140011935
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011930
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140011930
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001dbd4
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14001df40
add rsp, 0x70
pop rbx
ret
mov ecx, 0x2b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x140012020
Capabilities:
Reference http user-agent string

Disassembly:
xor eax, eax
mov dword [rcx + 0x18], eax
mov qword [rcx], rax
lea rax, [0x140021a84]
mov qword [rcx + 8], rax
lea rax, str.Mozilla_5.0__compatible__MSIE_9.0__Windows_NT_6.1__Trident_5.0_
mov qword [rcx + 0x10], rax
mov rax, rcx
ret
Function at 0x140012380
Capabilities:
Initialize winhttp library

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [rcx], 0
mov rbx, rcx
je 0x140012397
xor al, al
add rsp, 0x30
pop rbx
ret
mov rcx, qword [rcx + 0x10]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 0
xor edx, edx
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
test rax, rax
mov qword [rbx], rax
setne al
add rsp, 0x30
pop rbx
ret