joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002c1e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
movzx r9d, byte [rdx + 0x38]
movzx r8d, byte [rdx + 0x3a]
test r8b, r8b
setne al
cmp r9b, 1
ja 0x14002c262
invalid
test r8b, r8b
jne 0x14002c23a
movzx esi, byte [rdx + 0x10]
lea r8d, [rsi - 5]
cmp r8b, 1
ja 0x14002c23a
mov r10, qword [rdx]
mov r8, qword [rdx + 8]
xor r11d, r11d
test r9b, r9b
test cl, cl
jne 0x14002c231
cmp sil, 6
je 0x14002c231
mov r11d, 2
cmp r8, 1
jbe 0x14002c417
cmp r11, r8
jne 0x14002c375
xor r8d, r8d
test r9b, r9b
jne 0x14002c267
movzx r9d, byte [rdx + 0x10]
lea r10, [0x140059ec8]
movsxd r9, dword [r10 + r9*4]
add r9, r10
jmp r9
mov r9, qword [rdx + 0x20]
add r9, 4
jmp 0x14002c26a
xor eax, eax
xor r8d, r8d
xor r9d, r9d
movzx r11d, r8b
movzx edi, al
lea r10, [r11 + rdi]
add r10, r9
mov rax, qword [rdx + 8]
cmp r10, rax
ja 0x14002c417
mov rsi, qword [rdx]
lea r8, [rsi + r10]
movzx edx, byte [rdx + 0x10]
cmp r10, rax
jne 0x14002c29a
xor r11d, r11d
jmp 0x14002c319
add r9, rdi
add r9, r11
sub r9, rax
inc r9
lea rdi, [rax + rsi]
dec rdi
xor r11d, r11d
cmp dl, 3
jae 0x14002c2e0
nop word cs:[rax + rax]
cmp byte [rdi], 0x5c
je 0x14002c2fb
inc r9
dec rdi
cmp r9, 1
jne 0x14002c2c0
jmp 0x14002c319
movzx ebx, byte [rdi]
cmp ebx, 0x2f
je 0x14002c2fb
cmp ebx, 0x5c
je 0x14002c2fb
inc r9
dec rdi
cmp r9, 1
jne 0x14002c2e0
jmp 0x14002c319
neg r9
add r10, r9
inc r10
cmp r10, rax
ja 0x14002c417
add rsi, r10
mov r11d, 1
mov r8, rsi
sub rax, r10
je 0x14002c35c
mov r9b, 9
cmp rax, 2
je 0x14002c347
cmp rax, 1
jne 0x14002c35f
cmp byte [r8], 0x2e
jne 0x14002c35f
xor r9d, r9d
cmp dl, 3
setae r9b
lea r9d, [r9 + r9*2]
add r9d, 7
jmp 0x14002c35f
cmp byte [r8], 0x2e
jne 0x14002c35f
cmp byte [r8 + 1], 0x2e
sete r9b
sete cl
xor r9b, 9
jmp 0x14002c35f
mov r9b, 0xa
add r11, rax
mov qword [rcx], r11
mov dword [rcx], ebx
mov byte [rcx + 8], r9b
mov qword [rcx + 0x10], r8
mov qword [rcx + 0x18], rax
pop rbx
pop rdi
pop rsi
ret
add r8, r10
lea rsi, [r10 + r11]
inc rsi
cmp rsi, r8
sete r8b
movzx r10d, byte [r10 + r11]
test r8b, 1
jne 0x14002c407
cmp r10b, 0x2e
jne 0x14002c407
movzx r8d, byte [rsi]
cmp r8b, 0x5c
sete r10b
cmp r8b, 0x2f
sete r8b
or r8b, r10b
or al, dl
jmp 0x14002c23d
mov r9, qword [rdx + 0x20]
mov r10, qword [rdx + 0x30]
xor byte [rbp - 0x73], cl
pop rdx
add dword [rbp - 0x7b], ecx
ror byte [rbp + 0xf], cl
fimul dword [rbp + 1]
fimul dword [rbp + 1]
invalid
add r9, 8
jmp 0x14002c26a
cmp r10b, 0x2e
sete r10b
and r8b, r10b
jmp 0x14002c23d
ud2
Function at 0x140030180
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x140058060]
test ecx, ecx
je 0x1400301aa
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x1400301c3
add rax, 8
jmp 0x140030258
lea rcx, [0x140058048]
call fcn.14002abc0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x1400301a1
je 0x140030256
xor edi, edi
test rsi, rsi
je 0x1400301df
cmp byte [rsi], 0
mov byte [rsi], 0
movzx eax, byte [rsi + 1]
cmove eax, edi
mov edi, eax
movzx eax, byte [0x1428c8100]
mov edx, 0x10
xor ecx, ecx
call fcn.1400321e0
test rax, rax
je 0x140030280
mov rbx, rax
mov rsi, rax
lea rax, [0x140058048]
mov qword [rsi], rax
mov byte [rsi + 8], dil
mov ecx, dword [0x140058060]
test ecx, ecx
je 0x140030260
dec ecx
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
mov ecx, dword [0x140058060]
test ecx, ecx
je 0x140030270
dec ecx
add rbx, 8
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
test rdi, rdi
je 0x140030251
mov rcx, qword [0x1428c80c8]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
mov rax, rbx
jmp 0x140030258
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x140058048]
call fcn.14002abc0
mov ecx, eax
jmp 0x14003021b
lea rcx, [0x140058048]
call fcn.14002abc0
mov ecx, eax
jmp 0x14003022f
ud2
Function at 0x140031560
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x488
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 2
mov qword [rsp + 0x38], 0
mov r8d, 0x200
mov ebx, 2
xor r14d, r14d
mov esi, 0xffffffff
xor r15d, r15d
cmp r8, 0x201
jae 0x1400315f0
jmp 0x1400315cf
jae 0x140031693
cmp r8, 0x201
jae 0x1400315f0
mov edi, 0x200
lea r12, [rsp + 0x88]
mov r13, r8
jmp 0x140031619
sub r8, r15
mov rax, r14
sub rax, r15
cmp r8, rax
ja 0x140031677
cmp r14, rsi
mov r15d, 0xffffffff
cmovb r15, r14
mov qword [rsp + 0x38], r15
mov rdi, r15
mov r12, rbx
mov r13, r15
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, r12
mov edx, r13d
call sub.KERNEL32.dll_GetWindowsDirectoryW
mov ebp, eax
test eax, eax
jne 0x14003163e
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x140031723
mov r8d, ebp
cmp r13, r8
jne 0x1400315c0
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x1400317e1
add r13, r13
cmp r13, rsi
cmovae r13, rsi
mov r8, r13
cmp r8, 0x201
jb 0x1400315cf
jmp 0x1400315f0
lea rcx, [rsp + 0x28]
mov rdx, r15
call fcn.14004aa10
mov r14, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
jmp 0x1400315fe
cmp rdi, r8
jb 0x1400317e1
lea r14, [rsp + 0x50]
mov rcx, r14
mov rdx, r12
call fcn.14002fdc0
mov rax, qword [rsp + 0x40]
mov rdx, qword [rax]
mov r8, qword [rax + 8]
mov rcx, r14
call fcn.14002c790
mov rax, qword [rsp + 0x48]
cmp byte [rax], 0
jne 0x1400316e1
lea rdx, [0x1428c1eb8]
lea rcx, [rsp + 0x50]
mov r8d, 3
call fcn.14002d8c0
movabs rdi, 0x8000000000000000
mov rdx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x60]
lea rcx, [rsp + 0x70]
call fcn.1400310f0
mov rsi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
cmp rsi, rdi
jne 0x140031751
mov rcx, rdi
mov rdx, rbx
call fcn.140028d90
mov rax, qword [rsp + 0x20]
mov qword [rax], rdi
jmp 0x140031796
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 8], rax
movabs rax, 0x8000000000000000
or rax, 1
mov qword [rcx], rax
test r14, r14
jne 0x1400317b9
jmp 0x1400317cc
mov r14, qword [rsp + 0x80]
mov rcx, rbx
call sub.KERNEL32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x140031778
mov rax, qword [rsp + 0x20]
mov qword [rax], rsi
mov qword [rax + 8], rbx
mov qword [rax + 0x10], r14
jmp 0x140031796
mov rax, qword [rsp + 0x20]
mov qword [rax], rdi
test rsi, rsi
je 0x140031796
mov rcx, qword [0x1428c80c8]
xor edx, edx
mov r8, rbx
call sub.KERNEL32.dll_HeapFree
cmp qword [rsp + 0x50], 0
je 0x1400317b1
mov r8, qword [rsp + 0x58]
mov rcx, qword [0x1428c80c8]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
cmp qword [rsp + 0x28], 0
je 0x1400317cc
mov r8, qword [rsp + 0x30]
mov rcx, qword [0x1428c80c8]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
nop
add rsp, 0x488
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2
Function at 0x140031ae0
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x448
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 2
mov qword [rsp + 0x40], 0
mov r14d, 0x200
mov eax, 2
mov qword [rsp + 0x28], rax
xor r13d, r13d
mov esi, 0xffffffff
xor ebx, ebx
cmp r14, 0x201
jae 0x140031b60
jmp 0x140031b4f
jae 0x140031bfd
cmp r14, 0x201
jae 0x140031b60
mov edi, 0x200
lea r15, [rsp + 0x48]
mov r12, r14
jmp 0x140031b8a
sub r14, rbx
mov rax, r13
sub rax, rbx
cmp r14, rax
ja 0x140031bd9
cmp r13, rsi
mov ebx, 0xffffffff
cmovb rbx, r13
mov qword [rsp + 0x40], rbx
mov rdi, rbx
mov r15, qword [rsp + 0x28]
mov r12, rbx
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, r15
mov edx, r12d
call sub.KERNEL32.dll_GetSystemDirectoryW
mov ebp, eax
test eax, eax
jne 0x140031bab
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x140031c28
mov r14d, ebp
cmp r12, r14
jne 0x140031b40
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x140031c26
add r12, r12
cmp r12, rsi
cmovae r12, rsi
mov r14, r12
cmp r14, 0x201
jb 0x140031b4f
jmp 0x140031b60
lea rcx, [rsp + 0x30]
mov rdx, rbx
mov r8, r14
call fcn.14004aa10
mov r13, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x28], rax
jmp 0x140031b6e
cmp rdi, r14
jb 0x140031c26
test ebp, ebp
je 0x140031c52
lea rdi, [r14 + r14]
movzx eax, byte [0x1428c8100]
xor ecx, ecx
mov rdx, rdi
call fcn.1400321e0
mov rbx, rax
mov rsi, r14
test rax, rax
jne 0x140031c5b
ud2
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 8], rax
movabs rax, 0x8000000000000000
mov qword [rcx], rax
test r13, r13
jne 0x140031c7e
jmp 0x140031c91
mov ebx, 2
xor edi, edi
xor esi, esi
mov rcx, rbx
mov rdx, r15
mov r8, rdi
call sub.msvcrt.dll_memcpy
mov rax, qword [rsp + 0x20]
mov qword [rax], rsi
mov qword [rax + 8], rbx
mov qword [rax + 0x10], r14
test r13, r13
je 0x140031c91
mov r8, qword [rsp + 0x38]
mov rcx, qword [0x1428c80c8]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
nop
add rsp, 0x448
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140032ed0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x140058080]
test ecx, ecx
je 0x140032efa
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x140032f13
add rax, 8
jmp 0x140032fc8
lea rcx, [0x140058068]
call fcn.14002abc0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x140032ef1
je 0x140032f2f
test rsi, rsi
je 0x140032f36
mov rdi, qword [rsi]
mov qword [rsi], 0
test rdi, rdi
je 0x140032f38
mov rdi, qword [rsi + 8]
jmp 0x140032f38
xor eax, eax
jmp 0x140032fc8
xor edi, edi
movzx eax, byte [0x1428c8100]
mov edx, 0x10
xor ecx, ecx
call fcn.1400321e0
test rax, rax
je 0x140032ff0
mov rbx, rax
mov rsi, rax
lea rax, [0x140058068]
mov qword [rsi], rax
mov qword [rsi + 8], rdi
mov ecx, dword [0x140058080]
test ecx, ecx
je 0x140032fd0
dec ecx
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
mov ecx, dword [0x140058080]
test ecx, ecx
je 0x140032fe0
dec ecx
add rbx, 8
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
test rdi, rdi
je 0x140032fc5
mov rax, qword [rdi + 8]
test rax, rax
je 0x140032fb4
lock dec qword [rax]
jne 0x140032fb4
mov rcx, rdi
add rcx, 8
call case.0x14002ca41.216
mov rcx, qword [0x1428c80c8]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
mov rax, rbx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x140058068]
call fcn.14002abc0
mov ecx, eax
jmp 0x140032f74
lea rcx, [0x140058068]
call fcn.14002abc0
mov ecx, eax
jmp 0x140032f88
ud2

Function at 0x140033590
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
call sub.KERNEL32.dll_GetSystemInfo
mov ecx, dword [rsp + 0x40]
xor eax, eax
test rcx, rcx
sete al
lea rdx, [0x1428c2148]
cmovne rdx, rcx
add rsp, 0x58
ret

Function at 0x1400339f0
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov r8, rdx
mov rdx, rcx
movabs rdi, 0x8000000000000000
lea rcx, [rsp + 0x28]
call fcn.1400313f0
mov rax, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
cmp rax, rdi
je 0x140033a55
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x40]
mov r8b, 1
call fcn.14002b750
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
cmp rbx, rdi
jne 0x140033a60
mov rax, rsi
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
mov rcx, rsi
xor edx, edx
call sub.KERNEL32.dll_CreateDirectoryW
test eax, eax
je 0x140033a88
test rbx, rbx
je 0x140033ab0
mov rcx, qword [0x1428c80c8]
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapFree
xor eax, eax
jmp 0x140033a58
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
test rbx, rbx
je 0x140033a58
mov rcx, qword [0x1428c80c8]
xor edx, edx
mov r8, rsi
mov rsi, rax
call sub.KERNEL32.dll_HeapFree
jmp 0x140033a55
xor eax, eax
jmp 0x140033a58
Function at 0x140034870
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0xa0
mov rsi, rcx
movups xmm0, xmmword [0x1428c2048]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.ntdll.dll_NtWriteFile
cmp eax, 0x103
jne 0x1400348da
mov rcx, rsi
mov edx, 0xffffffff
call sub.KERNEL32.dll_WaitForSingleObject
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x14003490d
test eax, eax
js 0x1400348ee
mov rdx, qword [rsp + 0x68]
xor eax, eax
add rsp, 0xa0
pop rsi
ret
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa0
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, [0x1428c20a8]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x80], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x88], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x70]
call fcn.14002ac90
mov rcx, rax
call fcn.14002ad40
mov ecx, 7
int 0x29
ud2
Function at 0x140035040
Capabilities:
Create thread

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rbx, r8
mov r14, rdx
mov rdi, rcx
movzx eax, byte [0x1428c8100]
mov edx, 0x10
xor ecx, ecx
call fcn.1400321e0
test rax, rax
je 0x140035110
mov rsi, rax
mov qword [rax], r14
mov qword [rax + 8], rbx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x140035120]
xor ebx, ebx
xor ecx, ecx
mov rdx, rdi
mov r9, rax
call sub.KERNEL32.dll_CreateThread
mov rdx, rax
test rax, rax
jne 0x140035103
mov rdi, qword [rsi]
mov rbx, qword [rsi + 8]
mov rax, qword [rbx]
test rax, rax
je 0x1400350bb
mov rcx, rdi
call rax
cmp qword [rbx + 8], 0
je 0x1400350de
cmp qword [rbx + 0x10], 0x11
jb 0x1400350cd
mov rdi, qword [rdi - 8]
mov rcx, qword [0x1428c80c8]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [0x1428c80c8]
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapFree
call sub.KERNEL32.dll_GetLastError
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov ebx, 1
mov rax, rbx
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
ud2
Function at 0x14003cc70
Capabilities:
Encode data using xor
Encrypt data using salsa20 or chacha
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rsi, rdx
mov rdi, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x20
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
cmp eax, 0xc0000000
jb 0x14003ccc1
mov ebx, eax
lea rcx, [rsp + 0x20]
mov edx, 0x20
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x14003cd11
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x50], xmm1
movaps xmmword [rsp + 0x40], xmm0
mov rax, qword [0x1428c80f8]
test rax, rax
je 0x14003cd46
lea rbx, [rsp + 0x70]
test eax, 0x4000
jne 0x14003cd57
movaps xmm0, xmmword [rsp + 0x40]
movaps xmm1, xmmword [rsp + 0x50]
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x80], xmm1
xorps xmm0, xmm0
movaps xmmword [rsp + 0x90], xmm0
jmp 0x14003cd6b
and ebx, 0x7fffffff
je 0x14003ccc1
movzx eax, byte [0x1428c8100]
mov edx, 4
xor ecx, ecx
call fcn.1400321e0
test rax, rax
je 0x14003cdad
mov dword [rax], ebx
mov rcx, qword [0x1428c80c8]
xor edx, edx
mov r8, rax
call sub.KERNEL32.dll_HeapFree
jmp 0x14003cd81
call fcn.140035470
lea rbx, [rsp + 0x70]
test eax, 0x4000
je 0x14003cced
lea r8, [0x1428c2570]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.14001dff0
movaps xmm0, xmmword [rbx]
movaps xmm1, xmmword [rbx + 0x10]
movaps xmm2, xmmword [rbx + 0x20]
movaps xmmword [rdi + 0x20], xmm2
movaps xmmword [rdi + 0x10], xmm1
movaps xmmword [rdi], xmm0
mov qword [rdi + 0x40], 0
mov rax, 0xffffffffffffff00
add rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov rdx, rsi
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
jmp fcn.14001bd50
ud2
Function at 0x14003ef00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
movaps xmmword [rsp + 0x30], xmm6
mov ecx, dword [0x140058100]
test ecx, ecx
je 0x14003ef2c
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x14003ef45
add rax, 8
jmp case.0x14003e6a9.36
lea rcx, [0x1400580e8]
call fcn.14002abc0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x14003ef23
je 0x14003efde
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
mov edx, 0x10
call sub.bcryptprimitives.dll_ProcessPrng
movaps xmm6, xmmword [rsp + 0x20]
movzx eax, byte [0x1428c8100]
mov edx, 0x18
xor ecx, ecx
call fcn.1400321e0
test rax, rax
je 0x14003f00d
mov rbx, rax
mov rsi, rax
lea rax, [0x1400580e8]
mov qword [rsi], rax
movups xmmword [rsi + 8], xmm6
mov ecx, dword [0x140058100]
test ecx, ecx
je 0x14003efed
dec ecx
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
mov ecx, dword [0x140058100]
test ecx, ecx
je case.0x14003e6a9.35
dec ecx
add rbx, 8
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
test rdi, rdi
je 0x14003efd9
mov rcx, qword [0x1428c80c8]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
mov rax, rbx
jmp case.0x14003e6a9.36
xor eax, eax
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x1400580e8]
call fcn.14002abc0
mov ecx, eax
jmp 0x14003efa3
lea rcx, [0x1400580e8]
call fcn.14002abc0
mov ecx, eax
jmp 0x14003efb7
ud2

Function at 0x140040660
Capabilities:
Set registry value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x70
mov r14, r9
mov rdi, r8
mov rbx, rdx
mov r15, rcx
movzx eax, byte [0x1428c8100]
mov edx, 4
xor ecx, ecx
call fcn.1400321e0
test rax, rax
je 0x14004073d
mov rsi, rax
mov eax, dword [r14]
mov dword [rsi], eax
mov r14, qword [r15]
add rdi, rbx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rdi
mov word [rsp + 0x48], 0
mov dword [rsp + 0x50], 1
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x38]
call fcn.14003c270
mov rbx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x28], 4
mov rcx, r14
mov rdx, rbx
xor r8d, r8d
mov r9d, 4
call sub.ADVAPI32.dll_RegSetValueExW
mov edi, eax
cmp qword [rsp + 0x58], 0
je 0x14004070a
mov rcx, qword [0x1428c80c8]
xor edx, edx
mov r8, rbx
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [0x1428c80c8]
xor ebx, ebx
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapFree
mov rax, rdi
shl rax, 0x20
or rax, 2
test edi, edi
cmovne rbx, rax
mov rax, rbx
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
ud2
Function at 0x140041d10
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov rax, rdx
mov rsi, rcx
lea rdx, [rsp + 0x24]
mov rcx, rax
call sub.shell32.dll_CommandLineToArgvW
test rax, rax
je 0x140041e66
mov rdi, rax
mov qword [rsp + 0x40], rsi
movsxd r13, dword [rsp + 0x24]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 8
mov qword [rsp + 0x38], 0
test r13, r13
je 0x140041e3c
shl r13, 3
mov esi, 8
xor ebp, ebp
lea rbx, [rsp + 0x48]
lea r14, [rsp + 0x80]
xor r15d, r15d
jmp 0x140041db9
mov rax, qword [rsp + 0x70]
mov qword [rsi + rbp + 0x10], rax
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [rsi + rbp], xmm0
inc r15
mov qword [rsp + 0x38], r15
add rbp, 0x18
add r13, 0xfffffffffffffff8
je 0x140041e3c
mov r12, qword [rdi + r15*8]
mov rcx, r12
call sub.msvcrt.dll_wcslen
lea rax, [r12 + rax*2]
mov qword [rsp + 0x80], r12
mov qword [rsp + 0x88], rax
mov word [rsp + 0x90], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 1
mov qword [rsp + 0x58], 0
mov rcx, rbx
mov rdx, r14
call fcn.140042af0
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x70], rax
movups xmm0, xmmword [rsp + 0x48]
movaps xmmword [rsp + 0x60], xmm0
cmp r15, qword [rsp + 0x28]
jne 0x140041d90
lea rcx, [rsp + 0x28]
call fcn.140042760
mov rsi, qword [rsp + 0x30]
jmp 0x140041d90
mov rcx, rdi
call sub.KERNEL32.dll_LocalFree
test rax, rax
jne 0x140041e4e
call sub.KERNEL32.dll_GetLastError
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov qword [rcx + 0x10], rax
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rcx], xmm0
jmp 0x140041e7d
mov qword [rsi], 0
mov qword [rsi + 8], 8
mov qword [rsi + 0x10], 0
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140042dc0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x1400580c0]
test ecx, ecx
je 0x140042dea
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x140042e03
add rax, 8
jmp 0x140042e9a
lea rcx, [0x1400580a8]
call fcn.14002abc0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x140042de1
je 0x140042e98
test rsi, rsi
je 0x140042e1f
cmp dword [rsi], 0
mov dword [rsi], 0
je 0x140042e1f
mov rdi, qword [rsi + 4]
jmp 0x140042e21
xor edi, edi
movzx eax, byte [0x1428c8100]
mov edx, 0x10
xor ecx, ecx
call fcn.1400321e0
test rax, rax
je 0x140042ec2
mov rbx, rax
mov rsi, rax
lea rax, [0x1400580a8]
mov qword [rsi], rax
mov qword [rsi + 8], rdi
mov ecx, dword [0x1400580c0]
test ecx, ecx
je 0x140042ea2
dec ecx
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
mov ecx, dword [0x1400580c0]
test ecx, ecx
je 0x140042eb2
dec ecx
add rbx, 8
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
test rdi, rdi
je 0x140042e93
mov rcx, qword [0x1428c80c8]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
mov rax, rbx
jmp 0x140042e9a
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x1400580a8]
call fcn.14002abc0
mov ecx, eax
jmp 0x140042e5d
lea rcx, [0x1400580a8]
call fcn.14002abc0
mov ecx, eax
jmp 0x140042e71
ud2
Function at 0x140042ed0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
jmp 0x140046ed0
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x140058120]
test ecx, ecx
je 0x140046efa
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x140046f13
add rax, 8
jmp 0x140046faa
lea rcx, [0x140058108]
call fcn.14002abc0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x140046ef1
je 0x140046f2f
test rsi, rsi
je 0x140046f33
mov rdi, qword [rsi]
mov qword [rsi], 0
test rdi, rdi
je 0x140046f35
mov rdi, qword [rsi + 8]
jmp 0x140046f35
xor eax, eax
jmp 0x140046faa
xor edi, edi
movzx eax, byte [0x1428c8100]
mov edx, 0x10
xor ecx, ecx
call fcn.1400321e0
test rax, rax
je 0x140046fd2
mov rbx, rax
mov rsi, rax
lea rax, [0x140058108]
mov qword [rsi], rax
mov qword [rsi + 8], rdi
mov ecx, dword [0x140058120]
test ecx, ecx
je 0x140046fb2
dec ecx
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
mov ecx, dword [0x140058120]
test ecx, ecx
je 0x140046fc2
dec ecx
add rbx, 8
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
test rdi, rdi
je 0x140046fa7
mov rcx, qword [0x1428c80c8]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
mov rax, rbx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x140058108]
call fcn.14002abc0
mov ecx, eax
jmp 0x140046f71
lea rcx, [0x140058108]
call fcn.14002abc0
mov ecx, eax
jmp 0x140046f85
ud2