joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008a240
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
xor edx, edx
jmp 0x14008a258
movzx esi, byte [rbx + rdx]
inc rdx
imul eax, eax, 0x1000193
xor eax, esi
cmp rcx, rdx
jg 0x14008a249
ret

Function at 0x14030d520
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
movsxd r12, dword [rdx]
mov rbp, rdx
movzx edx, byte [r8]
mov rdi, rcx
mov rbx, r8
test dl, dl
je 0x14030d57c
mov rsi, r8
mov eax, edx
lea r8, [0x14076bea0]
xor r9d, r9d
nop dword [rax]
movzx ecx, al
test byte [r8 + rcx], 6
jne 0x14030d55e
cmp al, 0x5f
jne 0x14030d56e
movzx eax, byte [rsi + 1]
add rsi, 1
add r9d, 1
test al, al
jne 0x14030d550
movzx eax, dl
test byte [r8 + rax], 4
je 0x14030d5f8
mov byte [rdi + r12], 0x22
movzx edx, byte [rbx]
lea eax, [r12 + 1]
mov r9d, 1
test dl, dl
jne 0x14030d5a6
jmp 0x14030d5e8
movzx edx, byte [rbx + 1]
add rbx, 1
mov eax, ecx
test dl, dl
je 0x14030d5ca
movsxd r8, eax
lea ecx, [rax + 1]
mov byte [rdi + r8], dl
cmp byte [rbx], 0x22
jne 0x14030d598
movsxd rcx, ecx
add rbx, 1
add eax, 2
mov byte [rdi + rcx], 0x22
movzx edx, byte [rbx]
test dl, dl
jne 0x14030d5a6
test r9d, r9d
jne 0x14030d5e8
movsxd rdx, eax
mov byte [rdi + rdx], 0
mov dword [rbp], eax
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
movsxd rdx, eax
add eax, 1
mov byte [rdi + rdx], 0x22
jmp 0x14030d5cf
mov dword [rsp + 0x2c], 0x3b
cmp r9d, 1
jle 0x14030d640
lea r8, [rsp + 0x2c]
mov edx, r9d
mov rcx, rbx
call fcn.14030d400
cmp dword [rsp + 0x2c], 0x3b
jne 0x14030d57c
cmp byte [rsi], 0
jne 0x14030d57c
movzx edx, byte [rbx]
mov eax, r12d
test dl, dl
je 0x14030d5cf
xor r9d, r9d
jmp 0x14030d5a6
cmp byte [rsi], 0
setne al
xor r9d, 1
and r9d, 1
or al, r9b
jne 0x14030d57c
mov eax, r12d
xor r9d, r9d
jmp 0x14030d5a6
Function at 0x14031ba40
Capabilities:
Create thread

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
xor edi, edi
movzx ebp, byte [rcx + 0x5b]
sub ebp, 1
mov byte [rcx + 0x58], 1
mov rsi, rcx
test ebp, ebp
jg 0x14031ba77
jmp 0x14031bab5
lea rax, [rbx + rbx*2]
lea rax, [rbx + rax*4]
cmp qword [rsi + rax*8 + 0x60], 0
je 0x14031bac0
add edi, 1
cmp edi, ebp
je 0x14031bac0
movzx eax, byte [rsi + 0x5a]
lea eax, [rdi + rax + 1]
cdq
idiv ebp
movsxd rbx, edx
lea rax, [rbx + rbx*2]
lea rax, [rbx + rax*4]
shl rax, 3
lea r12, [rsi + rax + 0x60]
mov eax, dword [rsi + rax + 0x68]
test eax, eax
je 0x14031ba60
mov rcx, r12
call fcn.14030fd20
test eax, eax
je 0x14031ba60
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
xor r12d, r12d
nop dword [rax + rax]
cmp ebp, edi
je 0x14031bb40
lea rdx, [rsi + 0x60]
mov rax, r12
mov rcx, qword [r12 + 0x28]
movdqu xmm0, xmmword [rsi + 0x38]
sub rax, rdx
movabs rdx, 0x4ec4ec4ec4ec4ec5
sar rax, 3
imul rax, rdx
mov byte [rsi + 0x5a], al
mov rax, qword [rsi + 0x48]
movups xmmword [r12 + 0x20], xmm0
mov qword [r12 + 0x30], rax
mov qword [rsi + 0x38], 0
mov dword [rsi + 0x48], 0
test rcx, rcx
je 0x14031bb68
mov qword [rsi + 0x40], rcx
call qword [0x1404421f8]
mov dword [rsi + 0x54], eax
mov r8, r12
lea rdx, [0x14031ba20]
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.14030fc30
movsxd rbp, ebp
lea rdx, [rsi + 0x38]
lea rax, [rbp + rbp*2]
lea rax, [rbp + rax*4]
lea rcx, [rsi + rax*8 + 0x60]
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.14031b7a0
cmp qword [rsi + 0x40], 0
je 0x14031bb1d
movsxd rcx, dword [rsi + 0x54]
call fcn.14030ef00
mov qword [rsi + 0x40], rax
test rax, rax
jne 0x14031bb1d
mov eax, 7
jmp 0x14031baaa

Function at 0x14031e2a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
xor ebp, ebp
lea rbx, [0x14076bfa0]
mov eax, dword [rcx + 0x28]
mov r12, rcx
mov rdi, rdx
mov rsi, r8
test eax, eax
jle 0x14031e334
nop dword [rax + rax]
mov r10d, ebp
xor r10d, 1
cmp ebp, 2
cmovge r10d, ebp
movsxd r9, r10d
shl r9, 5
add r9, qword [r12 + 0x20]
test rsi, rsi
je 0x14031e30e
mov r8, qword [r9]
xor ecx, ecx
jmp 0x14031e2fd
movzx edx, byte [rbx + rdx]
cmp byte [rbx + rax], dl
jne 0x14031e348
add rcx, 1
movzx eax, byte [r8 + rcx]
movzx edx, byte [rsi + rcx]
cmp eax, edx
jne 0x14031e2f0
test eax, eax
jne 0x14031e2f9
mov rcx, qword [r9 + 0x18]
xor r8d, r8d
mov rdx, rdi
add rcx, 0x20
call fcn.140316550
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x14031e336
add ebp, 1
cmp dword [r12 + 0x28], ebp
jg 0x14031e2c8
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
test r10d, r10d
jne 0x14031e32a
mov rcx, rsi
mov eax, 0x6d
lea r8, str.main
jmp 0x14031e378
cdqe
movzx edx, byte [rbx + rdx]
cmp byte [rbx + rax], dl
jne 0x14031e32a
movzx eax, byte [r8 + 1]
add r8, 1
add rcx, 1
movzx edx, byte [rcx]
cmp eax, edx
jne 0x14031e360
test eax, eax
jne 0x14031e36b
jmp 0x14031e30e
Function at 0x140324a00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov r15d, dword [rsp + 0xb0]
mov rsi, qword [rcx + 0x10]
mov rbp, qword [rsp + 0xb8]
mov r12d, dword [rsp + 0xc0]
mov rdi, rcx
mov r13d, edx
mov rcx, qword [rcx]
mov dword [rsp + 0x3c], r9d
lea edx, [r15*8 + 0x30]
mov r14d, r8d
movsxd rdx, edx
call fcn.14030f620
mov rbx, rax
test rax, rax
je 0x140324b40
mov byte [rax + 0x29], r15b
mov edx, dword [rsi + 0x90]
cmp r12d, 1
mov r10d, 0x3f
mov qword [rax], 0
adc r10d, 0
mov qword [rax + 8], rbp
mov qword [rax + 0x18], 0
mov dword [rax + 0x24], 0
mov dword [rax + 0x20], edx
cmp edx, dword [rsi + 0x94]
jge 0x140324b20
lea eax, [rdx + 1]
mov edi, dword [rsp + 0x3c]
mov dword [rsi + 0x90], eax
movsxd rax, edx
lea rcx, [rax + rax*2]
mov rax, qword [rsi + 0x88]
lea rax, [rax + rcx*8]
xor ecx, ecx
mov byte [rax], r10b
mov word [rax + 2], cx
mov dword [rax + 4], r13d
mov dword [rax + 8], r14d
mov dword [rax + 0xc], edi
mov qword [rax + 0x10], 0
mov byte [rax + 1], 0
mov r9d, 0xfffffff0
mov r8, rbx
mov rcx, rsi
call fcn.14031ddc0
movsxd rax, dword [rsi + 0x90]
test eax, eax
jle 0x140324b0d
mov rdx, qword [rsi + 0x88]
lea rax, [rax + rax*2]
and r12d, 0x2e
lea rax, [rdx + rax*8]
mov word [rax - 0x16], r12w
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov eax, dword [rsp + 0x3c]
mov edx, r10d
mov r9d, r14d
mov r8d, r13d
mov rcx, rsi
mov dword [rsp + 0x20], eax
call fcn.140322ee0
mov edx, eax
jmp 0x140324ad9
test byte [rbp + 4], 0x10
je 0x140324b0d
mov rcx, qword [rdi]
mov rdx, rbp
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.140314ee0
Function at 0x140325c30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rsi, qword [rdx + 0x28]
mov r12, rcx
mov rbx, rdx
mov edi, r8d
test rsi, rsi
je 0x140325cf0
mov rcx, rsi
call sub.msvcrt.dll_strlen
mov r9d, eax
and r9d, 0x3fffffff
je 0x140325cc0
test edi, edi
je 0x140325cd0
mov edx, dword [r12 + 0x90]
cmp edx, dword [r12 + 0x94]
jge 0x140325d80
lea eax, [rdx + 1]
mov dword [r12 + 0x90], eax
movsxd rax, edx
lea rcx, [rax + rax*2]
mov rax, qword [r12 + 0x88]
lea rax, [rax + rcx*8]
mov dword [rax + 4], edi
mov dword [rax + 8], r9d
mov dword [rax + 0xc], 0
mov qword [rax + 0x10], 0
mov dword [rax], 0x5c
mov r8, rsi
jmp 0x140325cd8
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
mov r8, rsi
mov edx, 0xffffffff
mov rcx, r12
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp fcn.14031ddc0
mov r13, qword [rcx]
movsx ecx, word [rdx + 0x46]
add ecx, 1
movsxd rcx, ecx
call fcn.14030ef00
mov rsi, rax
test rax, rax
je 0x140325db8
xor edx, edx
xor ecx, ecx
cmp word [rbx + 0x46], 0
jle 0x140325db0
nop dword [rax]
mov rax, rdx
shl rax, 5
add rax, qword [rbx + 8]
test byte [rax + 0x1c], 0x20
jne 0x140325d40
movzx r8d, byte [rax + 0x19]
movsxd rax, ecx
add ecx, 1
mov byte [rsi + rax], r8b
movsx eax, word [rbx + 0x46]
add rdx, 1
cmp eax, edx
jg 0x140325d20
movsxd rcx, ecx
mov rdx, rsi
lea rax, [rsi + rcx]
nop word cs:[rax + rax]
mov byte [rax], 0
cmp rdx, rax
je 0x140325d71
sub rax, 1
cmp byte [rax], 0x41
jle 0x140325d60
mov qword [rbx + 0x28], rsi
jmp 0x140325c51
mov edx, 0x5c
mov r8d, edi
mov rcx, r12
mov dword [rsp + 0x3c], r9d
mov dword [rsp + 0x20], 0
call fcn.140322ee0
mov r9d, dword [rsp + 0x3c]
mov edx, eax
jmp 0x140325cb9
mov byte [rax], 0
jmp 0x140325d71
mov rcx, r13
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp fcn.14030e3e0
Function at 0x140383030
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
movzx eax, byte [rdx]
mov r12, rdx
mov r15, rcx
mov edx, eax
cmp al, 0xaf
jne 0x140383055
movzx edx, byte [r12 + 2]
cmp dl, 0xb0
je 0x140383170
cmp dl, 0x89
je 0x140383080
mov rdx, r12
mov rcx, r15
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.140389890
mov rdx, qword [r12 + 0x20]
mov rdx, qword [rdx + 0x20]
mov ebx, dword [rdx]
cmp ebx, 1
je 0x140383063
mov dword [r8], 0
cmp al, 0x89
je 0x140383180
mov eax, dword [r15 + 0x38]
lea r13d, [rax + 1]
add eax, ebx
mov dword [r15 + 0x38], eax
test ebx, ebx
jle 0x140383153
xor r14d, r14d
lea rdi, [0x1403217f0]
lea rbp, [rsp + 0x30]
lea rsi, [0x140307c70]
jmp 0x140383105
mov rcx, rbp
mov dword [rsp + 0x2c], r8d
mov qword [rsp + 0x20], rdx
call fcn.14032aeb0
cmp word [rsp + 0x54], 0
mov rdx, qword [rsp + 0x20]
mov r8d, dword [rsp + 0x2c]
jne 0x140383142
mov rcx, r15
add r14d, 1
call fcn.140388020
cmp r14d, ebx
je 0x140383153
movsxd rax, r14d
lea r8d, [r13 + r14]
shl rax, 5
add rax, qword [r12 + 0x20]
cmp byte [r15 + 0x23], 0
mov rdx, qword [rax + 8]
je 0x1403830f4
mov eax, 2
mov qword [rsp + 0x38], rdi
mov word [rsp + 0x54], ax
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x58], 0
test rdx, rdx
jne 0x1403830d0
mov rcx, r15
add r14d, 1
call fcn.1403890e0
cmp r14d, ebx
jne 0x140383105
mov eax, r13d
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rdx, qword [r12 + 0x20]
mov ebx, dword [rdx]
jmp 0x14038308b
mov rdx, r12
mov rcx, r15
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.140382bb0
Function at 0x1403c61c0
Capabilities:
Reference sql statements

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rax, str.SELECT_parentnode_FROM__Q._q_parent_WHERE_nodeno_1
movsxd rdi, edx
mov qword [rsp + 0x40], rax
mov rbx, rcx
mov rbp, r8
cmp qword [rcx + rdi*8 + 0x28], 0
mov rsi, rdi
lea r12, [rdi + 4]
mov r13, r9
lea rax, str.SELECT_nodeno_FROM__Q._q_rowid_WHERE_rowid_1
mov qword [rsp + 0x48], rax
je 0x1403c6260
mov ecx, dword [rbx + 0x40]
test ecx, ecx
je 0x1403c6218
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov r12, qword [rbx + rdi*8 + 0x28]
mov r8, rbp
mov edx, 1
mov rcx, r12
call fcn.140338180
mov rcx, r12
call fcn.14039e330
cmp eax, 0x65
je 0x1403c6280
cmp eax, 0x64
je 0x1403c62b0
mov rcx, r12
call fcn.140371e70
mov edx, dword [rbx + 0x40]
test edx, edx
jne 0x1403c6206
mov dword [rbx + 0x40], eax
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rdx, qword [rsp + rdi*8 + 0x40]
mov r9, qword [rcx + 0x10]
mov r8, qword [rcx + 8]
call fcn.1403ba270
mov qword [rbx + r12*8 + 8], rax
jmp 0x1403c61ff
test esi, esi
lea rdx, str.__parent
mov r9, r13
mov r8, rbp
lea rax, str.__rowid
mov rcx, rbx
cmove rax, rdx
lea rdx, str.Mapping___lld_____lld__missing_from__s_table
mov qword [rsp + 0x20], rax
call fcn.1403556a0
jmp 0x1403c623f
xor edx, edx
mov rcx, r12
call fcn.140316ba0
mov rcx, rax
call fcn.1403109d0
mov rdi, rax
test r12, r12
je 0x1403c62d2
mov rcx, r12
call fcn.140316b40
cmp r13, rdi
je 0x1403c623f
test esi, esi
lea rdx, str.__parent
mov r9, rdi
mov r8, rbp
lea rax, str.__rowid
mov qword [rsp + 0x30], r13
mov rcx, rbx
cmove rax, rdx
mov qword [rsp + 0x28], rbp
lea rdx, str.Found___lld_____lld__in__s_table__expected___lld_____lld_
mov qword [rsp + 0x20], rax
call fcn.1403556a0
jmp 0x1403c623f
Function at 0x1403e15c0
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.1403ec910
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.1403ec910
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]

Function at 0x1403e1630
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x50
movsxd rbx, dword [0x1407dbdd4]
mov r12, rcx
test ebx, ebx
jle 0x1403e1760
mov rax, qword [0x1407dbdd8]
xor ecx, ecx
add rax, 0x18
nop word [rax + rax]
mov rdx, qword [rax]
cmp rdx, r12
ja 0x1403e167c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x1403e1703
add ecx, 1
add rax, 0x28
cmp ecx, ebx
jne 0x1403e1660
mov rcx, r12
call fcn.1403e1fd0
mov rsi, rax
test rax, rax
je 0x1403e1782
mov rax, qword [0x1407dbdd8]
lea rbx, [rbx + rbx*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rsi
mov dword [rax], 0
call fcn.1403e2100
mov ecx, dword [rsi + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x1407dbdd8]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.DLL_VirtualQuery]
test rax, rax
je 0x1403e1767
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x1403e16fc
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x1403e1710
add dword [0x1407dbdd4], 1
add rsp, 0x50
pop rbx
pop rsi
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rbx, qword [0x1407dbdd8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.DLL_VirtualProtect]
test eax, eax
jne 0x1403e16fc
call qword [sym.imp.KERNEL32.DLL_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.1403e15c0
nop dword [rax]
xor ebx, ebx
jmp 0x1403e1687
mov rax, qword [0x1407dbdd8]
mov edx, dword [rsi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.1403e15c0
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.1403e15c0
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x1403e1c40
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x1407dbe40]
call qword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov rbx, qword [0x1407dbe20]
test rbx, rbx
je 0x1403e1c94
mov rdi, qword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x1403e1c8b
test r12, r12
je 0x1403e1c8b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1403e1c70
lea rcx, [0x1407dbe40]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
Function at 0x1403e1fd0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14076cd60]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1403e1ff0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1403e1ff8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1403e1ff0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x1403e2045
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1403e203c
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1403e1ff0
add rax, 0x28
cmp rax, r9
jne 0x1403e2028
xor eax, eax
ret

Function at 0x1403e2050
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14076cd60]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x1403e2070
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1403e2078
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x1403e2070
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x1403e2100
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14076cd60]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x1403e2120
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x1403e2128
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret

Function at 0x1403e3c40
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, qword [0x14076cde0]
mov rax, qword [rsi]
test rax, rax
je 0x1403e3cd0
cmp qword [rax + 0x30], 0
jne 0x1403e3cf0
lea rbx, [0x140442428]
mov qword [rax + 0x30], rbx
call qword [sym.imp.KERNEL32.DLL_TlsAlloc]
mov dword [rbx], eax
mov rax, qword [rsi]
test rax, rax
je 0x1403e3ca0
cmp qword [rax + 0x30], 0
jne 0x1403e3cc0
lea rdx, [0x140442428]
mov qword [rax + 0x30], rdx
mov rax, rdx
cmp dword [rax], 0xffffffff
je 0x1403ecc20
add rsp, 0x28
pop rbx
pop rsi
ret
call fcn.1403e8b40
mov r8, rax
mov rax, qword [rsi]
cmp qword [r8 + 0x30], 0
je 0x1403e3c82
test rax, rax
jne 0x1403e3cc0
call fcn.1403e8b40
nop dword [rax]
mov rax, qword [rax + 0x30]
jmp 0x1403e3c90
call fcn.1403e8b40
cmp qword [rax + 0x30], 0
mov rax, qword [rsi]
je 0x1403e3c60
test rax, rax
jne 0x1403e3cf0
call fcn.1403e8b40
nop dword [rax]
mov rbx, qword [rax + 0x30]
jmp 0x1403e3c6b
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
mov rax, qword [pe_dos_header]
ud2
Function at 0x1403e3d00
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x98
movabs rax, 0x6c6320726f727245
movabs rdx, 0x7520676e696e6165
mov qword [rsp + 0x20], rax
movabs rax, 0x6b5f6e6970732070
mov qword [rsp + 0x28], rdx
movabs rdx, 0x20726f6620737965
mov qword [rsp + 0x30], rax
movabs rax, 0x20646165726874
mov qword [rsp + 0x38], rdx
xor edx, edx
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0
mov word [rsp + 0x88], ax
mov byte [rsp + 0x8a], 0
call qword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
lea rdx, [rsp + 0x47]
mov r8d, 0xa
mov ecx, eax
call qword [sym.imp.msvcrt.dll__ultoa]
cmp byte [rsp + 0x47], 0
je 0x1403e3e12
mov eax, 0x28
lea rcx, [rsp + 0x20]
jmp 0x1403e3dea
add rax, 1
cmp rax, 0x6b
je 0x1403e3e07
cmp byte [rcx + rax], 0
movsxd rdx, eax
jne 0x1403e3de0
cmp edx, 0x6a
je 0x1403e3e07
lea eax, [rdx + 1]
cdqe
mov byte [rsp + rdx + 0x20], 0xa
mov byte [rsp + rax + 0x20], 0
call qword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
call sub.msvcrt.dll_abort
mov eax, 0x28
mov edx, 0x27
lea rcx, [rsp + 0x20]
jmp 0x1403e3dfb
Function at 0x1403e4820
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rsi, qword [0x14076cde0]
mov rax, qword [rsi]
test rax, rax
je 0x1403e4a10
cmp qword [rax + 0x28], 0
jne 0x1403e49f8
lea rcx, [0x1407dbef8]
cmp dword [rcx], 1
mov qword [rax + 0x28], rcx
je 0x1403e4a05
call fcn.1403e3e30
mov rax, qword [rsi]
test rax, rax
je 0x1403e48a0
cmp qword [rax + 0x30], 0
jne 0x1403e48c0
lea rdx, [0x140442428]
mov qword [rax + 0x30], rdx
mov rax, rdx
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov r12, rax
test rax, rax
je 0x1403e48d4
mov rax, r12
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call fcn.1403e8b40
cmp qword [rax + 0x30], 0
mov rax, qword [rsi]
je 0x1403e4870
test rax, rax
jne 0x1403e48c0
call fcn.1403e8b40
nop dword [rax]
mov rax, qword [rax + 0x30]
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov r12, rax
test rax, rax
jne 0x1403e488e
call fcn.1403e3970
cmp qword [0x1407e0050], 0
mov rbx, rax
je 0x1403e488e
test rax, rax
je 0x1403e488e
mov dword [rax + 0x44], 1
call qword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
xor ecx, ecx
xor r9d, r9d
xor r8d, r8d
mov dword [rbx + 0x70], eax
mov edx, 1
call qword [sym.imp.KERNEL32.DLL_CreateEventA]
mov qword [rbx + 0x38], 0xffffffffffffffff
lea rcx, [rbx + 0x68]
mov qword [rbx + 0x30], rax
call fcn.1403ea9e0
cmp eax, 1
je 0x1403e4a7d
mov rbp, qword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
mov qword [rbx + 0x68], 0xffffffffffffffff
mov dword [rbx + 0xb8], 0
mov qword [rbx + 0x28], 0
call rbp
mov rdi, rax
call qword [sym.imp.KERNEL32.DLL_GetCurrentThread]
mov r12, rax
call rbp
mov dword [rsp + 0x30], 2
mov r8, rdi
mov rdx, r12
mov dword [rsp + 0x28], 0
mov rcx, rax
lea r9, [rbx + 0x28]
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.DLL_DuplicateHandle]
test eax, eax
je 0x1403ecc26
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.DLL_GetThreadPriority]
mov dword [rbx + 0xbc], 0
mov dword [rbx + 0xc0], eax
movzx eax, byte [rbx + 0x40]
and eax, 0xffffffcf
or eax, 0x10
mov byte [rbx + 0x40], al
mov rax, qword [rsi]
test rax, rax
je 0x1403e4a58
cmp qword [rax + 0x30], 0
je 0x1403e4a40
mov rax, qword [rax + 0x30]
mov ecx, dword [rax]
mov rdx, rbx
call qword [sym.imp.KERNEL32.DLL_TlsSetValue]
test eax, eax
je 0x1403ecc26
mov r12, rbx
mov rax, r12
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, qword [rax + 0x28]
cmp dword [rcx], 1
jne 0x1403e485c
mov rax, qword [rsi]
jmp 0x1403e4869
call fcn.1403e8b40
cmp qword [rax + 0x28], 0
mov rax, qword [rsi]
je 0x1403e4848
test rax, rax
jne 0x1403e49f8
call fcn.1403e8b40
mov rcx, qword [rax + 0x28]
cmp dword [rcx], 1
jne 0x1403e485c
jmp 0x1403e4861
lea rdx, [0x140442428]
mov qword [rax + 0x30], rdx
mov rax, rdx
jmp 0x1403e49ce
call fcn.1403e8b40
mov r8, rax
mov rax, qword [rsi]
cmp qword [r8 + 0x30], 0
je 0x1403e4a40
test rax, rax
jne 0x1403e49ca
call fcn.1403e8b40
jmp 0x1403e49ca
call fcn.1403e3d00
nop word cs:[rax + rax]
nop dword [rax]
mov rax, qword [0x14076cde0]
mov rdx, qword [rax]
lea rax, [0x1407dbf08]
mov qword [rdx + 0x10], rax
ret
Function at 0x1403e89c0
Capabilities:
Print debug messages

Disassembly:
push r12
push rbx
sub rsp, 0x58
mov r12, rcx
call qword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
jne 0x1403e89e0
add rsp, 0x58
pop rbx
pop r12
ret
lea rdx, [rsp + 0x48]
mov r9d, 0x400
mov r8d, eax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rdx
mov ecx, 0x1100
xor edx, edx
mov dword [rsp + 0x28], 0
call qword [sym.imp.KERNEL32.DLL_FormatMessageA]
test eax, eax
jne 0x1403e8a28
call qword [sym.imp.KERNEL32.DLL_IsDebuggerPresent]
test eax, eax
je 0x1403e89d4
int3
mov rcx, qword [rsp + 0x48]
mov rbx, qword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
call rbx
mov rcx, r12
call rbx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.DLL_LocalFree]
jmp 0x1403e8a15