joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005bc10
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x140169448]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14005bc44
movsxd rcx, dword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 4]
jne 0x14005bc44
mov rax, qword [rax + rcx]
add rsp, 0x20
pop rsi
ret
xor eax, eax
jmp 0x14005bc3e

Function at 0x14005d6f0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x140169448]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14005d72e
movsxd rcx, dword [rsi]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rsi + 4]
movsxd rdx, dword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
test rdi, rdi
je 0x14005d727
call fcn.140006690
jmp 0x14005d70e

Function at 0x140075f50
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
push rdi
mov r9, qword [rcx]
mov r10, qword [rcx + 8]
mov r8, r10
sub r8, r9
je 0x140075fdf
mov rax, r8
shr rax, 2
mov rdx, r9
not rdx
add rdx, r10
jne 0x140075f77
xor edx, edx
jmp 0x140075fbc
mov r10, r8
and r10, 0xfffffffffffffffe
xor edx, edx
lea r11, [0x14011ff10]
nop word [rax + rax]
movzx esi, al
movzx edi, byte [r9 + rdx]
xor edi, esi
shr eax, 8
xor eax, dword [r11 + rdi*4]
movzx esi, al
movzx edi, byte [r9 + rdx + 1]
xor edi, esi
shr eax, 8
xor eax, dword [r11 + rdi*4]
add rdx, 2
cmp r10, rdx
jne 0x140075f90
test r8b, 1
je 0x140075fd9
movzx edi, al
movzx edx, byte [r9 + rdx]
xor edx, edi
lea rdi, [0x14011ff10]
shr eax, 8
xor eax, dword [rdi + rdx*4]
mov dword [rcx + 0x18], eax
pop rdi
pop rsi
ret
xor eax, eax
jmp 0x140075fd9
Function at 0x140076d10
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov qword [rcx], rdx
mov rdi, qword [0x14016c568]
cmp rdi, 1
jbe 0x140076d60
mov ecx, dword [0x140169448]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140076da6
movsxd rcx, dword [rdi]
shl rcx, 4
mov qword [rax + rcx], rsi
mov ecx, dword [rdi + 4]
movsxd rdx, dword [rdi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x14016c568]
call fcn.14004b9f0
test al, al
je 0x140076db2
mov qword [0x14016c570], 0
lea rbx, [0x14016c568]
lea rdi, [0x14016c570]
mov rcx, rdi
xor edx, edx
call fcn.140043450
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.14004b960
jmp 0x140076d2a
test rsi, rsi
je 0x140076d55
call fcn.140006690
jmp 0x140076d3c
mov rdi, qword [0x14016c568]
jmp 0x140076d2a

Function at 0x140079250
Capabilities:
Get thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [0x140170350]
cmp rbx, 1
jbe 0x1400792a4
mov ecx, dword [0x140169448]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400792ea
movsxd rcx, dword [rbx]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rbx + 4]
movsxd rdx, dword [rbx]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x140170350]
call fcn.14004b9f0
test al, al
je 0x1400792f6
mov qword [0x140170358], 0
lea r14, [0x140170350]
lea rbx, [0x140170358]
mov rcx, rbx
xor edx, edx
call fcn.140043450
mov rcx, r14
mov rdx, rbx
xor r8d, r8d
mov r9, r14
call fcn.14004b960
jmp 0x14007926c
test rdi, rdi
je 0x140079297
call fcn.140006690
jmp 0x14007927e
mov rbx, qword [0x140170350]
jmp 0x14007926c

Function at 0x140079310
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, qword [0x140170350]
cmp rsi, 1
jbe 0x140079359
mov ecx, dword [0x140169448]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140079352
movsxd rcx, dword [rsi]
shl rcx, 4
mov qword [rax + rcx], 0
mov ecx, dword [rsi + 4]
movsxd rdx, dword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x140170350]
call fcn.14004b9f0
test al, al
je 0x14007939f
mov qword [0x140170358], 0
lea rdi, [0x140170350]
lea rsi, [0x140170358]
mov rcx, rsi
xor edx, edx
call fcn.140043450
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
mov r9, rdi
call fcn.14004b960
jmp 0x140079323
mov rsi, qword [0x140170350]
jmp 0x140079323
Function at 0x140079ca0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov eax, dword [0x140171a68]
mov ecx, dword [0x140169930]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140079d05
mov ecx, dword [0x140169448]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140079d41
movsxd rcx, dword [0x140171a60]
shl rcx, 4
mov qword [rax + rcx], rsi
mov ecx, dword [0x140171a64]
movsxd rdx, dword [0x140171a60]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x20
pop rsi
ret
lea rcx, [0x140171a68]
int3
test rsi, rsi
je 0x140079cff
call fcn.140006690
jmp 0x140079cdb

Function at 0x140079d70
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov eax, dword [rdx]
mov dword [rcx], eax
mov eax, 1
lock xadd dword [0x140171a4c], eax
mov dword [rcx + 4], eax
mov eax, dword [0x140171a48]
mov ecx, dword [0x140169930]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140079e59
mov ecx, dword [0x140169448]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140079edf
movsxd rcx, dword [0x140171a40]
shl rcx, 4
mov qword [rax + rcx], rsi
mov ecx, dword [0x140171a44]
movsxd rdx, dword [0x140171a40]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov eax, dword [0x140171a58]
mov ecx, dword [0x140169930]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140079e9c
lea rdi, [rsi + 4]
mov ecx, dword [0x140169448]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140079ef2
movsxd rcx, dword [0x140171a50]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [0x140171a54]
movsxd rdx, dword [0x140171a50]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rax, rsi
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x140171a48]
int3
lea rcx, [0x140171a58]
int3
test rsi, rsi
je 0x140079dec
call fcn.140006690
jmp 0x140079dc8
test rdi, rdi
je 0x140079e4f
call fcn.140006690
jmp 0x140079e2b

Function at 0x140079f10
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov byte [rcx], dl
mov rdi, qword [0x1401703c0]
cmp rdi, 1
jbe 0x140079f5f
mov ecx, dword [0x140169448]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140079fa5
movsxd rcx, dword [rdi]
shl rcx, 4
mov qword [rax + rcx], rsi
mov ecx, dword [rdi + 4]
movsxd rdx, dword [rdi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x1401703c0]
call fcn.14004b9f0
test al, al
je 0x140079fb1
mov qword [0x1401703c8], 0
lea rbx, [0x1401703c0]
lea rdi, [0x1401703c8]
mov rcx, rdi
xor edx, edx
call fcn.140043450
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.14004b960
jmp 0x140079f29
test rsi, rsi
je 0x140079f54
call fcn.140006690
jmp 0x140079f3b
mov rdi, qword [0x1401703c0]
jmp 0x140079f29
Function at 0x140079fc0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, qword [0x1401703c0]
cmp rsi, 1
jbe 0x14007a009
mov ecx, dword [0x140169448]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14007a002
movsxd rcx, dword [rsi]
shl rcx, 4
mov qword [rax + rcx], 0
mov ecx, dword [rsi + 4]
movsxd rdx, dword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x1401703c0]
call fcn.14004b9f0
test al, al
je 0x14007a04f
mov qword [0x1401703c8], 0
lea rdi, [0x1401703c0]
lea rsi, [0x1401703c8]
mov rcx, rsi
xor edx, edx
call fcn.140043450
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
mov r9, rdi
call fcn.14004b960
jmp 0x140079fd3
mov rsi, qword [0x1401703c0]
jmp 0x140079fd3

Function at 0x14007a060
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x140171a48]
mov ecx, dword [0x140169930]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14007a127
mov ecx, dword [0x140169448]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14007a0c3
movsxd rcx, dword [0x140171a40]
shl rcx, 4
mov qword [rax + rcx], 0
mov ecx, dword [0x140171a44]
movsxd rdx, dword [0x140171a40]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov eax, dword [0x140171a58]
mov ecx, dword [0x140169930]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14007a16a
mov ecx, dword [0x140169448]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14007a122
movsxd rcx, dword [0x140171a50]
shl rcx, 4
mov qword [rax + rcx], 0
mov ecx, dword [0x140171a54]
movsxd rdx, dword [0x140171a50]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
ret
lea rcx, [0x140171a48]
int3
lea rcx, [0x140171a58]
int3

Function at 0x14007a4c0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov edi, dword [0x140171950]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test esi, esi
jne 0x14007a4ed
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14007a4e3
Function at 0x14007f7fd
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x14007f81b
je 0x14007f826
call 0x14007f875
mov bl, 0xc7
lahf
pop rsi
jne 0x14007f806
call 0x14007f81e
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x14007f806
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x14007f854
je 0x14007f892
invalid
je 0x14007f8a3
jne 0x14007f806
lea rax, [0x14007f72c]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x14007b48d]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x14007f944
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x14007f99d
je 0x14007f9a3
call 0x14007f994
fild qword [rdi - 0x7c]
jmp 0x174fbc116
jne 0x14007f966
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x14007f926
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret
Function at 0x14007f810
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x14007f81b
je 0x14007f826
call 0x14007f875
mov bl, 0xc7
lahf
pop rsi
jne 0x14007f806
call 0x14007f81e
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x14007f806
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x14007f854
je 0x14007f892
invalid
je 0x14007f8a3
jne 0x14007f806
lea rax, [0x14007f72c]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x14007b48d]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x14007f944
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x14007f99d
je 0x14007f9a3
call 0x14007f994
fild qword [rdi - 0x7c]
jmp 0x174fbc116
jne 0x14007f966
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x14007f926
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret
Function at 0x14007f83c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x14007f81b
je 0x14007f826
call 0x14007f875
mov bl, 0xc7
lahf
pop rsi
jne 0x14007f806
call 0x14007f81e
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x14007f806
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x14007f854
je 0x14007f892
invalid
je 0x14007f8a3
jne 0x14007f806
lea rax, [0x14007f72c]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x14007b48d]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x14007f944
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x14007f99d
je 0x14007f9a3
call 0x14007f994
fild qword [rdi - 0x7c]
jmp 0x174fbc116
jne 0x14007f966
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x14007f926
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret
Function at 0x14007f875
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x14007f81b
je 0x14007f826
call 0x14007f875
mov bl, 0xc7
lahf
pop rsi
jne 0x14007f806
call 0x14007f81e
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x14007f806
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x14007f854
je 0x14007f892
invalid
je 0x14007f8a3
jne 0x14007f806
lea rax, [0x14007f72c]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x14007b48d]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x14007f944
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x14007f99d
je 0x14007f9a3
call 0x14007f994
fild qword [rdi - 0x7c]
jmp 0x174fbc116
jne 0x14007f966
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x14007f926
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret

Function at 0x1400ac3a0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdi, qword [0x14016c578]
cmp rdi, 1
jbe 0x1400ac405
mov ecx, dword [0x140169448]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400ac3e6
movsxd rcx, dword [rdi]
shl rcx, 4
mov qword [rax + rcx], 0
mov ecx, dword [rdi + 4]
movsxd rdx, dword [rdi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
lea rcx, [rsi + 8]
call fcn.140043380
mov rcx, qword [rsi]
test rcx, rcx
je 0x1400ac3fd
lock dec dword [rcx + 8]
je 0x1400ac45a
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x14016c578]
call fcn.14004b9f0
test al, al
je 0x1400ac44e
mov qword [0x14016c580], 0
lea rbx, [0x14016c578]
lea rdi, [0x14016c580]
mov rcx, rdi
xor edx, edx
call fcn.140043450
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.14004b960
jmp 0x1400ac3b7
mov rdi, qword [0x14016c578]
jmp 0x1400ac3b7
add rcx, 8
add rcx, 0xfffffffffffffff8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.140043280
Function at 0x1400b8b70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, r8
mov rsi, rdx
mov bl, byte [rbp + 0x68]
test byte [r9 + 8], 1
jne 0x1400b8bc3
mov al, byte [rbp + 0x60]
movzx edx, bl
mov rbx, qword [rcx]
mov dword [rsp + 0x28], edx
mov byte [rsp + 0x20], al
mov rdx, rsi
mov r8, rdi
call qword [rbx + 0x30]
mov rax, rsi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov rax, qword [r9 + 0x30]
lea rcx, [rbp - 0x20]
mov qword [rcx], rax
mov qword [rbp - 8], rax
lock inc dword [rax + 8]
lea rdx, [0x14016b748]
call fcn.140061bc2
mov r14, rax
mov eax, 0xffffffff
mov rcx, qword [rbp - 8]
lock xadd dword [rcx + 8], eax
test eax, eax
jne 0x1400b8c01
mov rcx, qword [rbp - 8]
mov rax, qword [rcx]
call qword [rax + 8]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r15, [rbp - 0x20]
mov qword [r15 + 0x10], rax
movaps xmm0, xmmword [0x14011b490]
movaps xmmword [r15], xmm0
mov rax, qword [r14]
xor bl, 1
movzx ebx, bl
mov rcx, r14
mov rdx, r15
call qword [rax + rbx*8 + 0x28]
movzx r9d, byte [r15 + 0x17]
test r9b, r9b
mov rcx, qword [r15]
mov r8, qword [r15 + 8]
mov rax, r9
cmovs rax, r8
test rax, rax
je 0x1400b8cb8
test r9b, r9b
mov rbx, r15
cmovs rbx, rcx
test rdi, rdi
je 0x1400b8ca6
mov al, byte [rbx]
movzx eax, al
mov rcx, qword [rdi + 0x30]
cmp rcx, qword [rdi + 0x38]
je 0x1400b8caa
lea rdx, [rcx + 1]
mov qword [rdi + 0x30], rdx
mov byte [rcx], al
cmp eax, 0xffffffff
jne 0x1400b8c7b
xor edi, edi
mov r9b, byte [rbp - 9]
mov rcx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x18]
inc rbx
test r9b, r9b
mov rax, r15
cmovs rax, rcx
movzx edx, r9b
cmovs rdx, r8
add rdx, rax
cmp rbx, rdx
jne 0x1400b8c56
jmp 0x1400b8cb8
xor edi, edi
jmp 0x1400b8c87
mov r8, qword [rdi]
mov rcx, rdi
mov edx, eax
call qword [r8 + 0x60]
jmp 0x1400b8c74
shr r9b, 7
mov qword [rsi], rdi
test r9b, r9b
je 0x1400b8bb3
call fcn.14007c098
jmp 0x1400b8bb3
Function at 0x1400d0410
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor edx, edx
jmp 0x1400d0418
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r15d, edx
mov rsi, rcx
mov rax, qword [0x140166028]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [rcx + 0x60], 0
je 0x1400d0476
mov edi, dword [rsi + 0x5c]
test r15b, r15b
je 0x1400d0456
mov dword [rsi + 0x5c], 0xffffffff
mov byte [rsi + 0x60], 0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14007ed30
mov eax, edi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movabs r14, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x58], r14
mov eax, dword [rsi + 0x58]
test eax, eax
mov edi, 1
cmovg edi, eax
xor ebp, ebp
mov rcx, qword [rsi + 0x40]
call fcn.14007daa0
cmp eax, 0xffffffff
je 0x1400d04f3
mov byte [rsp + rbp + 0x58], al
inc rbp
cmp rdi, rbp
jne 0x1400d0494
mov byte [rsp + 0x57], 0xaa
cmp byte [rsi + 0x61], 0
je 0x1400d04fd
mov al, byte [rsp + 0x58]
mov byte [rsp + 0x57], al
test r15b, r15b
je 0x1400d04d0
movzx edi, byte [rsp + 0x57]
mov dword [rsi + 0x5c], edi
jmp 0x1400d0456
mov edi, edi
test rdi, rdi
jle 0x1400d05a2
mov rdx, qword [rsi + 0x40]
dec rdi
mov eax, edi
movzx ecx, byte [rsp + rax + 0x58]
call fcn.14007da48
cmp eax, 0xffffffff
jne 0x1400d04d2
mov edi, 0xffffffff
jmp 0x1400d0456
lea rax, [rsp + 0x48]
mov qword [rax], r14
lea r12, [rsp + 0x40]
mov qword [r12], r14
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov r13d, dword [rdx]
movzx ebp, word [rdx + 4]
movzx r14d, word [rdx + 6]
lea r9, [rsp + rdi + 0x58]
mov rax, qword [rcx]
mov qword [rsp + 0x38], r12
lea rbx, [rsp + 0x58]
mov qword [rsp + 0x30], rbx
lea rbx, [rsp + 0x57]
mov qword [rsp + 0x28], rbx
lea rbx, [rsp + 0x48]
mov qword [rsp + 0x20], rbx
lea r8, [rsp + 0x58]
call qword [rax + 0x18]
cmp eax, 1
jne 0x1400d058b
mov rax, qword [rsi + 0x50]
mov dword [rax], r13d
mov word [rax + 4], bp
mov word [rax + 6], r14w
cmp rdi, 8
je 0x1400d04f3
mov rcx, qword [rsi + 0x40]
call fcn.14007daa0
cmp eax, 0xffffffff
je 0x1400d04f3
mov byte [rsp + rdi + 0x58], al
inc rdi
jmp 0x1400d050e
cmp eax, 2
je 0x1400d04f3
cmp eax, 3
je 0x1400d04b9
jmp 0x1400d04c1
movzx edi, byte [rsp + 0x57]
jmp 0x1400d0456