joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001df10
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov dword [rbp + 0x18], edx
lea rax, [0x1400be200]
mov rcx, rax
call fcn.140019e7c
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov eax, dword [rax]
cmp eax, 0xbab1f0ed
jne 0x14001df4c
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov eax, dword [rax + 4]
test eax, eax
jg 0x14001df8c
mov ecx, 2
mov rax, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
call rax
mov rcx, rax
mov dword [rsp + 0x20], 0x28
lea r9, str..._.._.._mingw_w64_libraries_winpthreads_src_rwlock.c
lea r8, str.___rwlock_t__rwl___valid__LIFE_RWLOCK______rwlock_t__rwl___busy___0_
lea rax, str.Assertion_failed:___s___file__s__line__d_n
mov rdx, rax
call fcn.140017400
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov edx, dword [rax + 4]
sub edx, 1
mov dword [rax + 4], edx
lea rax, [0x1400be200]
mov rcx, rax
call fcn.140019efb
mov eax, dword [rbp + 0x18]
add rsp, 0x30
pop rbp
ret

Function at 0x1400236d0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
call rcx
nop
jmp 0x1400bb860
Function at 0x1400832e0
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
mov rcx, qword [rdi]
call sub.api_ms_win_crt_stdio_l1_1_0.dll__fileno
mov ecx, eax
mov r8d, ebx
mov rdx, rsi
call sub.api_ms_win_crt_stdio_l1_1_0.dll__read
movsxd rbp, eax
cmp eax, 0xffffffff
je 0x140083328
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call r12
cmp dword [rax], 4
je 0x1400832fa
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x1400bb6e0
Capabilities:
Set console window title

Disassembly:
sub rsp, 0x28
call fcn.14000b727
lea rcx, str.Keylogger
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
call fcn.140001845
test al, al
je 0x1400bb704
call fcn.14000192f
xor eax, eax
add rsp, 0x28
ret

Function at 0x1400bb860
Capabilities:
Write file on windows

Disassembly:
call fcn.1400baf90
call fcn.1400bb1e0
mov rbx, qword [rax]
test byte [rbx + 0x50], 1
je 0x1400bb827
mov rbx, qword [rbx]
lea r12, [rsp + 0x20]
mov rdx, rbp
xor ecx, ecx
mov r8, r12
call fcn.1400232c0
mov rdx, qword [rbx - 0x90]
mov r9, rsi
mov r8, rbx
mov rcx, r12
call fcn.1400233b0
test al, al
jne 0x1400bb845
lea rbx, [0x1400c8300]
mov r9, rsi
xor r8d, r8d
mov rcx, r12
mov rdx, rbx
call fcn.1400233b0
test al, al
je 0x1400bb84a
mov ecx, 8
call fcn.1400baf20
lea r8, [0x140089500]
mov rdx, rbx
mov rcx, rax
mov rax, qword [0x1400c5ea0]
add rax, 0x10
mov qword [rcx], rax
call fcn.1400bb4a0
add rbx, 0x90
jmp 0x1400bb7b6
call fcn.1400bb450
mov rcx, rdi
call fcn.1400236d0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov rcx, rax
call fcn.1400baf90
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov rcx, rax
mov rax, rdx
sub rax, 1
jne 0x1400bb8fc
call fcn.1400baf90
mov rcx, rax
mov rax, qword [rax]
call qword [rax + 0x10]
mov ecx, 2
mov rbx, rax
call rsi
mov r9, rax
mov r8d, 0xb
mov edx, 1
lea rcx, str.__what__:
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov ecx, 2
call rsi
mov rdx, rax
mov rcx, rbx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputs
mov ecx, 2
call rsi
mov rdx, rax
mov ecx, 0xa
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
call fcn.1400bb0c0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov rcx, rdi
call fcn.1400178f0
call fcn.1400bb450
call fcn.1400baf90
call fcn.1400bb0c0
jmp 0x1400bb8ea
Function at 0x1400bb880
Capabilities:
Write file on windows

Disassembly:
call fcn.1400baf90
call fcn.1400bb1e0
mov rbx, qword [rax]
test byte [rbx + 0x50], 1
je 0x1400bb827
mov rbx, qword [rbx]
lea r12, [rsp + 0x20]
mov rdx, rbp
xor ecx, ecx
mov r8, r12
call fcn.1400232c0
mov rdx, qword [rbx - 0x90]
mov r9, rsi
mov r8, rbx
mov rcx, r12
call fcn.1400233b0
test al, al
jne 0x1400bb845
lea rbx, [0x1400c8300]
mov r9, rsi
xor r8d, r8d
mov rcx, r12
mov rdx, rbx
call fcn.1400233b0
test al, al
je 0x1400bb84a
mov ecx, 8
call fcn.1400baf20
lea r8, [0x140089500]
mov rdx, rbx
mov rcx, rax
mov rax, qword [0x1400c5ea0]
add rax, 0x10
mov qword [rcx], rax
call fcn.1400bb4a0
add rbx, 0x90
jmp 0x1400bb7b6
call fcn.1400bb450
mov rcx, rdi
call fcn.1400236d0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov rcx, rax
call fcn.1400baf90
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov rcx, rax
mov rax, rdx
sub rax, 1
jne 0x1400bb8fc
call fcn.1400baf90
mov rcx, rax
mov rax, qword [rax]
call qword [rax + 0x10]
mov ecx, 2
mov rbx, rax
call rsi
mov r9, rax
mov r8d, 0xb
mov edx, 1
lea rcx, str.__what__:
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov ecx, 2
call rsi
mov rdx, rax
mov rcx, rbx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputs
mov ecx, 2
call rsi
mov rdx, rax
mov ecx, 0xa
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
call fcn.1400bb0c0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov rcx, rdi
call fcn.1400178f0
call fcn.1400bb450
call fcn.1400baf90
call fcn.1400bb0c0
jmp 0x1400bb8ea
Function at 0x140001210
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rax, qword [0x140007008]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov r14, rdx
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x1400012e7
lea rdx, str.Tool_helper_cannot_be_created
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001f90
mov rcx, rax
lea rdx, [0x140002160]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1400012b2
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1400012ad
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400013c4
mov rcx, r8
call fcn.1400022f0
xor al, al
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140002290
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
mov rdx, r14
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
jne 0x140001310
lea rdx, str.Tool_helper_cannot_retrieve_the_first_entry_of_process_list
jmp 0x14000125b
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [r14 + rax + 0x2c], 0
jne 0x140001320
mov rcx, rbx
mov rsi, qword [rbx + 0x18]
cmp rsi, 0x10
jb 0x14000133b
mov rcx, qword [rbx]
mov r8, qword [rbx + 0x10]
cmp r8, rax
jne 0x140001351
lea rdx, [r14 + 0x2c]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140001378
mov rdx, r14
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140001310
test rbp, rbp
je 0x140001278
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001278
test rbp, rbp
je 0x14000138a
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rbx + 0x18]
cmp rsi, 0x10
jb 0x1400013bd
lea rdx, [rsi + 1]
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1400013b8
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400013c4
mov rcx, r8
call fcn.1400022f0
mov al, 1
jmp 0x1400012b4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x1400013d0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x140007008]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edx, edx
mov rsi, rcx
lea ecx, [rdx + 0xf]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x14000148e
mov qword [rsp + 0x170], rbx
lea rcx, [rsp + 0x4c]
mov r8, rsi
sub r8, rcx
nop dword [rax]
movzx edx, byte [rcx]
movzx eax, byte [rcx + r8]
sub edx, eax
jne 0x140001443
inc rcx
test eax, eax
jne 0x140001430
test edx, edx
jne 0x140001474
mov r8d, dword [rsp + 0x28]
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140001474
mov edx, 9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140001422
mov rbx, qword [rsp + 0x170]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140002290
mov rsi, qword [rsp + 0x178]
add rsp, 0x160
pop rdi
ret
Function at 0x140716058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1407161df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140716089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14071606f
add dl, dl
jne 0x140716096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407160f6
xor eax, eax
add dl, dl
jne 0x1407160a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407161ad
add dl, dl
jne 0x1407160b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407160c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407160d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407160dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1407160ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14071607e
mov eax, 1
add dl, dl
jne 0x140716106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140716113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407160fb
sub eax, ebx
mov ebx, 1
jne 0x14071614c
mov ecx, 1
add dl, dl
jne 0x14071612e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14071613b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140716123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14071607e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140716168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140716175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14071615d
cmp eax, 0x7d00
jae 0x14071619b
cmp eax, 0x500
jb 0x140716196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14071607e
cmp eax, 0x7f
ja 0x14071619e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14071607e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1407161d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14071607e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x401f8c
Capabilities:
Parse pe header

Disassembly:
push rbp
sub rsp, 0x160
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xf0], rcx
mov qword [rbp + 0xf8], rdx
mov rax, qword [rbp + 0xf0]
mov qword [rbp + 0xd0], rax
mov rax, qword [rbp + 0xd0]
mov qword [rbp + 0xc8], rax
mov rax, qword [rbp + 0xc8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x401fe0
mov eax, 0
jmp 0x402165
mov rax, qword [rbp + 0xc8]
mov eax, dword [rax + 0x3c]
cdqe
mov rdx, qword [rbp + 0xd0]
add rax, rdx
mov qword [rbp + 0xc0], rax
mov rax, qword [rbp + 0xc0]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x402017
mov eax, 0
jmp 0x402165
mov rdx, qword [rbp + 0xc0]
lea rax, [rbp - 0x60]
add rdx, 0x18
mov ecx, 0xf0
mov r8, rcx
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov eax, dword [rbp + 0x10]
mov edx, eax
mov rax, qword [rbp + 0xd0]
add rax, rdx
mov qword [rbp + 0xb8], rax
mov rax, qword [rbp + 0xb8]
mov eax, dword [rax + 0x20]
mov edx, eax
mov rax, qword [rbp + 0xd0]
add rax, rdx
mov qword [rbp + 0xb0], rax
mov rax, qword [rbp + 0xb8]
mov eax, dword [rax + 0x1c]
mov edx, eax
mov rax, qword [rbp + 0xd0]
add rax, rdx
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0xb8]
mov eax, dword [rax + 0x24]
mov edx, eax
mov rax, qword [rbp + 0xd0]
add rax, rdx
mov qword [rbp + 0xa0], rax
mov dword [rbp + 0xdc], 0
mov rax, qword [rbp + 0xb8]
mov eax, dword [rax + 0x14]
cmp dword [rbp + 0xdc], eax
jae 0x402160
mov eax, dword [rbp + 0xdc]
lea rdx, [rax*4]
mov rax, qword [rbp + 0xb0]
add rax, rdx
mov eax, dword [rax]
mov edx, eax
mov rax, qword [rbp + 0xd0]
add rax, rdx
mov qword [rbp + 0x98], rax
mov eax, dword [rbp + 0xdc]
lea rdx, [rax + rax]
mov rax, qword [rbp + 0xa0]
add rax, rdx
movzx eax, word [rax]
movzx eax, ax
lea rdx, [rax*4]
mov rax, qword [rbp + 0xa8]
add rax, rdx
mov eax, dword [rax]
mov edx, eax
mov rax, qword [rbp + 0xd0]
add rax, rdx
mov qword [rbp + 0x90], rax
mov rdx, qword [rbp + 0x98]
mov rax, qword [rbp + 0xf8]
mov rcx, rax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x402154
mov rax, qword [rbp + 0x90]
jmp 0x402165
add dword [rbp + 0xdc], 1
jmp 0x4020ad
mov eax, 0
add rsp, 0x160
pop rbp
ret
Function at 0x40bf60
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x00506664]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x40c0e8
mov rax, qword [0x00506668]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x40bfac
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x40c035
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x40bf90
mov rcx, rbx
call fcn.0040cc00
test rax, rax
mov r12, rax
je 0x40c11d
mov rax, qword [0x00506668]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call fcn.0040cd30
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x00506668]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x40c100
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x40c02e
sub eax, 0x40
and eax, 0xffffffbf
jne 0x40c090
add dword [0x00506664], 1
cmp edi, 8
jae 0x40c063
test dil, 4
jne 0x40c0d4
test edi, edi
je 0x40c058
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x40c0ef
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x40c058
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x40c07c
jmp 0x40c058
add rsi, qword [0x00506668]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x40c02e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.004db1e0
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x40c058
xor esi, esi
jmp 0x40bfb7
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x40c058
mov rax, qword [0x00506668]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call fcn.004db1e0
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.004db1e0
nop
nop dword [rax]

Function at 0x40c870
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00506940]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x00506920]
test rbx, rbx
je 0x40c8c4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x40c8bb
test rsi, rsi
je 0x40c8bb
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x40c8a0
lea rcx, [0x00506940]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x40cc00
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x004e45e0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x40cc6d
mov rcx, r8
call fcn.0040cae0
test eax, eax
je 0x40cc6d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x40cc6d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x40cc64
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x40cc6f
add rax, 0x28
cmp rax, r9
jne 0x40cc50
xor eax, eax
add rsp, 0x28
ret

Function at 0x40cf80
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x40cfb0
mov rdx, rbx
mov ecx, eax
mov dword [rsi], eax
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.004182e0
add rsp, 0x28
pop rbx
pop rsi
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
add byte [rax], al
test ebx, ebx
add byte [rbp - 0xa], dh
int1
invalid
add bh, bh
push rax
sbb byte [rax - 0x7d], cl
rcr byte [rax], 0x48
mov dword [rsp + 0x28], eax
ror dword [rax - 0x73], cl
and al, 0x28
test byte [rdi], ch
add eax, dword [rax]
add byte [rax - 0x75], cl
add bh, bh
push rax
sbb byte [rax - 0x7d], cl
rcr byte [rax], 0x48
inc dword [rax]
add byte [rcx], al
add byte [rbx + 0xf], dh
invalid
or al, 0x24
sbb ch, al
add byte [rax - 0x75], cl
add edi, edi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x40], rbx
invalid
pop rsp
and al, 0x40
adc ch, al
invalid
add byte [rax], al
invalid
sub al, 0x43
sal byte [rbp + 0x1a], 0xe8
ror byte [rdi], 0x84
rol dword [rcx], 0
add dword [rax], eax

Function at 0x40cfe0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov ebx, ecx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, ebx
mov esi, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, esi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rbx
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x40d010
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x40d025
xor eax, eax
add rsp, 0x28
ret
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x40d360
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x40d391
xor edx, edx
mov ecx, eax
mov dword [0x00506990], eax
call fcn.004182e0
test eax, eax
sete al
movzx eax, al
mov dword [0x004dc078], eax
add rsp, 0x28
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40d37e
Function at 0x40d4a0
Capabilities:
Set thread local storage value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov edi, 1
mov rax, qword [rdx]
mov rbp, qword [rcx + 0x10]
mov r12, qword [rcx + 0x18]
test rax, rax
mov rsi, rcx
mov rbx, rdx
mov r15, r8
je 0x40d5a0
mov r13, qword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x40d4fc
mov qword [0x00506998], r14
mov rax, qword [rbx]
add edi, 1
mov rax, qword [rax]
test rax, rax
mov qword [rbx], rax
je 0x40d5a0
mov r9, rsi
mov r8, qword [rsi]
mov edx, 0xa
mov ecx, 1
mov r14, qword [rax + 0x30]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rbx
call rbp
test eax, eax
jne 0x40d5c0
test r14, r14
je 0x40d54f
mov qword [rsp + 0x20], rbx
mov r9, rsi
mov r8, qword [rsi]
mov edx, 0xa
mov ecx, 1
call r14
cmp eax, 7
je 0x40d5e5
cmp eax, 8
jne 0x40d5c0
mov rax, qword [rbx]
mov r14, qword [rax]
mov eax, dword [0x004dc078]
test eax, eax
js 0x40d590
test eax, eax
je 0x40d4e0
mov rdx, r14
mov ecx, dword [0x00506990]
call r13
test eax, eax
jne 0x40d4e7
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40d4e7
call fcn.0040d3a0
mov eax, dword [0x004dc078]
jmp 0x40d55f
mov qword [rsp + 0x28], r12
mov r9, rsi
mov r8, qword [rsi]
mov edx, 0x1a
mov qword [rsp + 0x20], rbx
mov ecx, 1
call rbp
test eax, eax
je 0x40d5e0
mov eax, 2
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov eax, 5
mov dword [r15], edi
jmp 0x40d5c5

Function at 0x40d5f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov eax, dword [0x004dc078]
test eax, eax
mov rbx, rcx
js 0x40d670
test eax, eax
jne 0x40d623
mov rax, qword [0x00506998]
mov qword [0x00506998], rbx
mov qword [rbx], rax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov edi, dword [0x00506990]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rsi
mov ebp, eax
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, ebp
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov qword [rbx], rdi
mov rdx, rbx
mov ecx, dword [0x00506990]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x40d61a
mov rax, rsi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
call fcn.0040d3a0
mov eax, dword [0x004dc078]
jmp 0x40d605

Function at 0x40d680
Capabilities:
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [0x004dc078]
mov rbx, qword [rcx]
test eax, eax
js 0x40d6c2
test eax, eax
jne 0x40d6a3
mov qword [0x00506998], rbx
add rsp, 0x20
pop rbx
ret
mov rdx, rbx
mov ecx, dword [0x00506990]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x40d69d
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
call fcn.0040d3a0
mov eax, dword [0x004dc078]
jmp 0x40d692
Function at 0x40d790
Capabilities:
Get thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x40
mov eax, dword [0x004dc078]
test eax, eax
mov rbx, rcx
js 0x40d810
test eax, eax
mov rsi, qword [0x00506998]
jne 0x40d826
test rsi, rsi
mov qword [rsp + 0x38], rsi
je 0x40d801
lea rdi, [rsp + 0x38]
mov rax, rsi
mov rax, qword [rax + 0x30]
test rax, rax
je 0x40d7ef
mov qword [rsp + 0x20], rdi
mov r9, rbx
mov r8, qword [rbx]
mov edx, 1
mov ecx, 1
call rax
cmp eax, 6
je 0x40d850
cmp eax, 8
jne 0x40d883
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
test rax, rax
mov qword [rsp + 0x38], rax
jne 0x40d7c1
mov eax, 5
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
call fcn.0040d3a0
mov eax, dword [0x004dc078]
mov rsi, qword [0x00506998]
test eax, eax
je 0x40d7af
mov esi, dword [0x00506990]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, edi
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x40d7af
mov rax, qword [rsp + 0x38]
lea r8, [rsp + 0x34]
mov rdx, rdi
mov rcx, rbx
mov qword [rbx + 0x10], 0
mov qword [rsp + 0x38], rsi
mov qword [rbx + 0x18], rax
call fcn.0040d2b0
cmp eax, 7
jne 0x40d806
mov rcx, rdi
call fcn.0040d430
mov eax, 3
jmp 0x40d806

Function at 0x40d9d0
Capabilities:
Get thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
cmp qword [rcx + 0x10], 0
mov rbx, rcx
je 0x40da20
mov edx, dword [0x004dc078]
test edx, edx
js 0x40da30
test edx, edx
mov rsi, qword [0x00506998]
jne 0x40da46
mov qword [rsp + 0x28], rsi
lea rsi, [rsp + 0x28]
mov rcx, rbx
lea r8, [rsp + 0x24]
mov rdx, rsi
call fcn.0040d4a0
cmp eax, 7
jne 0x40da69
mov rcx, rsi
call fcn.0040d430
nop dword [rax]
call fcn.0040d790
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
call fcn.0040d3a0
mov edx, dword [0x004dc078]
mov rsi, qword [0x00506998]
test edx, edx
je 0x40d9f6
mov esi, dword [0x00506990]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, edi
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x40d9f6
call sub.msvcrt.dll_abort
nop
nop