joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140014030
Capabilities:
Get thread local storage value
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rdi, [0x1400183a8]
mov rbx, rcx
mov rcx, rdi
mov esi, edx
call sym.pthread_mutex_lock
mov rcx, rbx
call sym.__pthread_get_pointer
test rax, rax
je 0x1400140a8
cmp qword [rax + 0x1d8], rbx
jne 0x1400140a8
test byte [rax + 0x40], 0xc
jne 0x1400140a8
mov edx, dword [rax + 0xbc]
test edx, edx
jne 0x1400140a8
mov rax, qword [rax + 0x28]
sub rax, 1
cmp rax, 0xfffffffffffffffd
ja 0x1400140a8
mov rcx, rdi
call sym.pthread_mutex_unlock
test esi, esi
je 0x1400140c0
lea edx, [rsi - 2]
cmp edx, 0x15
ja 0x1400140c8
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp sym.pthread_cancel
mov rcx, rdi
call sym.pthread_mutex_unlock
mov eax, 3
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor eax, eax
jmp 0x1400140b5
mov eax, 0x16
jmp 0x1400140b5

Function at 0x140014260
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov esi, ecx
mov rdi, rdx
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x1400183b8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x1400142d0
cmp esi, 1
ja 0x1400142dd
lea rbp, [rbx + 0x38]
mov rcx, rbp
call sym.pthread_mutex_lock
test rdi, rdi
je 0x1400142a4
mov eax, dword [rbx + 0x44]
and eax, 1
mov dword [rdi], eax
mov eax, dword [rbx + 0x44]
mov rcx, qword [rbx + 0x1d8]
and eax, 0xfffffffe
or eax, esi
mov dword [rbx + 0x44], eax
call sym.test_cancel_locked
mov rcx, rbp
call sym.pthread_mutex_unlock
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
call sym.__pthread_self_lite.part.0
mov rbx, rax
test rax, rax
jne 0x140014286
mov eax, 0x16
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x1400142f0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov esi, ecx
mov rdi, rdx
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x1400183b8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140014368
mov ebp, esi
and ebp, 0xfffffffd
jne 0x140014375
lea r12, [rbx + 0x38]
mov rcx, r12
call sym.pthread_mutex_lock
test rdi, rdi
je 0x140014338
mov eax, dword [rbx + 0x44]
and eax, 2
mov dword [rdi], eax
mov eax, dword [rbx + 0x44]
mov rcx, qword [rbx + 0x1d8]
and eax, 0xfffffffd
or eax, esi
mov dword [rbx + 0x44], eax
call sym.test_cancel_locked
mov rcx, r12
call sym.pthread_mutex_unlock
mov eax, ebp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call sym.__pthread_self_lite.part.0
mov rbx, rax
test rax, rax
jne 0x140014318
mov ebp, 0x16
mov eax, ebp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x140014620
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rsi, rcx
mov rbp, rdx
test rcx, rcx
je 0x140014740
lea rdi, [0x1400183a8]
mov rcx, rdi
call sym.pthread_mutex_lock
mov rcx, rsi
call sym.__pthread_get_pointer
mov rcx, rdi
mov rbx, rax
call sym.pthread_mutex_unlock
test rbx, rbx
je 0x140014740
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x140014740
lea rdx, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x140014740
test byte [rbx + 0x44], 4
jne 0x140014750
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x1400183b8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140014770
cmp rsi, qword [rax + 0x1d8]
je 0x140014798
mov eax, dword [rbx + 0xbc]
mov rcx, qword [rbx + 0x28]
test eax, eax
je 0x1400146cb
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400146da
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x28]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x1400146ee
call rsi
mov qword [rbx + 0x30], 0
lea rcx, [rbx + 0x38]
test rbp, rbp
je 0x140014788
mov rax, qword [rbx + 8]
mov qword [rbp], rax
call sym.pthread_mutex_destroy
lea rcx, [rbx + 0x68]
call sym.pthread_spin_destroy
cmp eax, 1
je 0x14001479f
cmp qword [rbx + 0x1d0], 0
mov qword [rbx + 0x68], 0xffffffffffffffff
je 0x140014760
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov eax, 3
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov eax, 0x16
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, rbx
call sym.push_pthread_mem.part.0
xor eax, eax
jmp 0x140014736
call sym.__pthread_self_lite.part.0
test rax, rax
jne 0x1400146a6
jmp 0x1400146b3
call sym.pthread_mutex_destroy
jmp 0x140014710
mov eax, 0x24
jmp 0x140014745
call sym.replace_spin_keys.part.0
nop
nop word cs:[rax + rax]
Function at 0x1400147b0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
lea rbp, [0x1400183a8]
mov rsi, rcx
mov rcx, rbp
mov rdi, rdx
call sym.pthread_mutex_lock
mov rcx, rsi
call sym.__pthread_get_pointer
mov rbx, rax
test rax, rax
je 0x1400148d0
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x1400148d0
lea rdx, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x1400148d0
test byte [rbx + 0x44], 4
jne 0x1400148f0
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x1400183b8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140014930
mov rdx, qword [rax + 0x1d8]
cmp rsi, rdx
je 0x140014968
mov edx, dword [rbx + 0xbc]
mov rcx, qword [rbx + 0x28]
test edx, edx
jne 0x140014857
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140014910
mov rcx, qword [rbx + 0x28]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14001486b
call rsi
mov qword [rbx + 0x30], 0
lea rcx, [rbx + 0x38]
test rdi, rdi
je 0x140014948
mov rax, qword [rbx + 8]
mov qword [rdi], rax
call sym.pthread_mutex_destroy
lea rcx, [rbx + 0x68]
call sym.pthread_spin_destroy
cmp eax, 1
je 0x14001497a
cmp qword [rbx + 0x1d0], 0
mov qword [rbx + 0x68], 0xffffffffffffffff
je 0x140014958
mov rcx, rbp
call sym.pthread_mutex_unlock
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, rbp
call sym.pthread_mutex_unlock
mov eax, 3
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, rbp
call sym.pthread_mutex_unlock
mov eax, 0x16
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov eax, dword [rbx + 0xbc]
test eax, eax
jne 0x140014853
mov rcx, rbp
call sym.pthread_mutex_unlock
mov eax, 0x10
jmp 0x1400148be
call sym.__pthread_self_lite.part.0
xor edx, edx
test rax, rax
jne 0x140014825
jmp 0x14001482c
call sym.pthread_mutex_destroy
jmp 0x14001488c
mov rcx, rbx
call sym.push_pthread_mem.part.0
jmp 0x1400148b4
mov rcx, rbp
call sym.pthread_mutex_unlock
mov eax, 0x24
jmp 0x1400148be
call sym.replace_spin_keys.part.0
nop
Function at 0x417960
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x417b06
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.004372c0
xorps xmm15, xmm15
mov r14, qword [0x0058d3c0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x4179cb
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x4179e7
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
call fcn.00451780
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
sub rbx, rcx
test rbx, rbx
jbe 0x417a0b
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x417a1f
cmp rbx, 0x1000
jae 0x4179d5
jmp 0x417a89
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x417a31
xor edx, edx
jmp 0x417a80
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.004372c0
xorps xmm15, xmm15
mov r14, qword [0x0058d3c0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x417a15
jmp 0x417a00
call fcn.00467b20
xorps xmm15, xmm15
mov r14, qword [0x0058d3c0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.0043b9e0
lea rax, [0x004b26c0]
mov ebx, 0x18
call fcn.0043c2e0
mov rax, qword [rsp + 0x38]
call fcn.0043bfe0
lea rax, [0x004b2780]
mov ebx, 0x19
call fcn.0043c2e0
mov rax, qword [rsp + 0x30]
nop
call fcn.0043bfe0
call fcn.0043bc40
call fcn.0043ba60
lea rax, [0x004b49c1]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.0043a1a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463f80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00417960
Function at 0x417b40
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x417d6a
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00437360
xorps xmm15, xmm15
mov r14, qword [0x0058d3c0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x417bb9
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x417be0
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rax, rcx
call fcn.00451780
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
sub rbx, rcx
mov rcx, rax
mov rax, qword [rsp + 0x68]
test rbx, rbx
jbe 0x417c05
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x417c19
cmp rbx, 0x1000
jae 0x417bc3
nop dword [rax]
jmp 0x417c94
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x417c2d
xor esi, esi
jmp 0x417c8a
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00437360
xorps xmm15, xmm15
mov r14, qword [0x0058d3c0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x417c0f
jmp 0x417bf4
call fcn.00467b20
xorps xmm15, xmm15
mov r14, qword [0x0058d3c0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x417d0c
call fcn.0043b9e0
lea rax, [0x004b2b4f]
mov ebx, 0x19
call fcn.0043c2e0
mov rax, qword [rsp + 0x68]
call fcn.0043bfe0
lea rax, [0x004b2780]
mov ebx, 0x19
call fcn.0043c2e0
mov eax, dword [rsp + 0x34]
call fcn.0043bfe0
call fcn.0043bc40
call fcn.0043ba60
lea rax, [0x004af75c]
mov ebx, 0xd
call fcn.0043a1a0
cmp eax, 0x5af
je 0x417cb7
call fcn.0043b9e0
lea rax, [0x004b2b4f]
mov ebx, 0x19
call fcn.0043c2e0
mov rax, qword [rsp + 0x38]
call fcn.0043bfe0
lea rax, [0x004b2780]
mov ebx, 0x19
nop
call fcn.0043c2e0
mov eax, dword [rsp + 0x34]
call fcn.0043bfe0
call fcn.0043bc40
call fcn.0043ba60
lea rax, [0x004b42d5]
mov ebx, 0x1f
call fcn.0043a1a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463f80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00417b40
Function at 0x422fc0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4230be
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 8], 0
jmp 0x423000
mov rax, qword [rsp + 0x50]
mov rcx, rdx
mov rbx, qword [rsp + 0x58]
nop
cmp qword [rsp + 8], rbx
jae 0x4230af
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov rax, rcx
call fcn.00423b20
nop dword [rax]
test rax, rax
je 0x4230af
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
lea rcx, [0x00423100]
mov qword [rsp + 0x10], rcx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rbx, [rsp + 0x10]
mov qword [rsp], rbx
call fcn.00463e40
xorps xmm15, xmm15
mov r14, qword [0x0058d3c0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x60]
test rdx, rdx
jne 0x42309d
xor eax, eax
jmp 0x4230a7
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x60]
test al, al
je 0x422ff2
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00463f80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00422fc0

Function at 0x45c1c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45c279
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rdx, [0x0045c2c0]
mov qword [rsp + 0x10], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x28], rdx
mov rdx, r14
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00463e40
xorps xmm15, xmm15
mov r14, qword [0x0058d3c0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463f80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0045c1c0
Function at 0x466020
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x402f8f
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
nop
call fcn.00409a20
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463f80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x402f60
cmp byte [0x0058d1ef], 0
je 0x466035
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x463080
jmp 0x402f60

Function at 0x466040
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x409e8f
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x28], rbx
call fcn.00409f80
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
mov rbx, qword [rsp + 0x28]
xor rbx, rax
xor rbx, qword [0x0058d4a0]
movabs rdx, 0xa0761d6478bd642f
xor rbx, rdx
mov rax, rcx
call fcn.00409f60
mov rbx, rax
movabs rax, 0x1d8e4e27c47d124b
nop dword [rax]
call fcn.00409f60
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463f80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x409e20
cmp byte [0x0058d1ef], 0
je 0x466075
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x0058d7e0]
aesenc xmm0, xmmword [0x0058d7f0]
aesenc xmm0, xmmword [0x0058d800]
movq rax, xmm0
ret
jmp 0x409e20

Function at 0x466080
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x409f2f
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x28], rbx
call fcn.00409fc0
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
mov rbx, qword [rsp + 0x28]
xor rbx, rax
xor rbx, qword [0x0058d4a0]
movabs rdx, 0xa0761d6478bd642f
xor rbx, rdx
mov rax, rcx
call fcn.00409f60
mov rbx, rax
movabs rax, 0x1d8e4e27c47d1247
nop dword [rax]
call fcn.00409f60
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463f80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x409ec0
cmp byte [0x0058d1ef], 0
je 0x4660b6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x0058d7e0]
aesenc xmm0, xmmword [0x0058d7f0]
aesenc xmm0, xmmword [0x0058d800]
movq rax, xmm0
ret
jmp 0x409ec0

Function at 0x467aa0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x30
mov rcx, 0xfffffffffffffff4
mov qword [rsp], rcx
mov rax, qword [sym.imp.kernel32.dll_GetStdHandle]
call rax
mov rcx, rax
mov qword [rsp], rcx
lea rdx, [0x0058d760]
mov qword [rsp + 8], rdx
lea r8d, [0x0058d204]
mov qword [rsp + 0x10], r8
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.kernel32.dll_WriteFile]
call rax
call fcn.00465f60
add rsp, 0x30
ret
Function at 0x467fe0
Capabilities:
Allocate thread local storage

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x468010
mov rcx, 0x28
jmp 0x46801b
shl rcx, 3
add rcx, 0x1480
mov qword [0x0058d3c0], rcx
ret
Function at 0x48b980
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48bbd4
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
mov qword [rsp + 0x70], rax
xor ecx, ecx
xor edx, edx
xor esi, esi
xor edi, edi
xor r8d, r8d
jmp 0x48b9c3
dec rbx
mov r10, rbx
neg rbx
sar rbx, 0x3f
and ebx, 1
add rax, rbx
mov rbx, r10
mov rcx, r9
test rbx, rbx
je 0x48bba8
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rax
mov byte [rsp + 0x46], r8b
movzx r9d, byte [rax]
mov byte [rsp + 0x47], r9b
cmp r9b, 0x20
jbe 0x48baf0
cmp r9b, 0x22
je 0x48ba07
cmp r9b, 0x5c
jne 0x48bb05
lea r9, [rcx + 1]
jmp 0x48bb60
mov qword [rsp + 0x48], rcx
mov r8, rcx
shr rcx, 0x3f
lea r9, [r8 + rcx]
sar r9, 1
mov rax, rdi
mov rbx, rsi
mov rcx, rdx
mov rdi, r9
call fcn.0048b8e0
mov rdx, qword [rsp + 0x48]
bt edx, 0
jb 0x48baa7
movzx edx, byte [rsp + 0x46]
test dl, dl
je 0x48ba98
mov r8, qword [rsp + 0x50]
cmp r8, 1
jle 0x48ba91
mov r9, qword [rsp + 0x58]
cmp byte [r9 + 1], 0x22
jne 0x48ba8c
inc rbx
cmp rcx, rbx
jae 0x48ba7e
mov edi, 1
lea rsi, [0x0049b480]
call fcn.0044c940
movzx edx, byte [rsp + 0x46]
mov r8, qword [rsp + 0x50]
mov r9, qword [rsp + 0x58]
mov byte [rbx + rax - 1], 0x22
lea rsi, [r9 + 1]
dec r8
jmp 0x48baa2
mov rsi, r9
jmp 0x48baa2
mov rsi, qword [rsp + 0x58]
jmp 0x48baa2
mov r8, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
xor edx, 1
jmp 0x48bad9
inc rbx
cmp rcx, rbx
jae 0x48bac5
mov edi, 1
lea rsi, [0x0049b480]
nop dword [rax + rax]
call fcn.0044c940
mov byte [rbx + rax - 1], 0x22
mov r8, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
movzx edx, byte [rsp + 0x46]
xor r9d, r9d
mov rdi, rax
mov rax, rsi
mov rsi, rbx
mov rbx, r8
mov r8d, edx
mov rdx, rcx
jmp 0x48bb60
cmp r9b, 9
je 0x48bb00
cmp r9b, 0x20
jne 0x48bb05
nop dword [rax]
test r8b, r8b
je 0x48bb6c
mov rax, rdi
mov rbx, rsi
mov rdi, rcx
mov rcx, rdx
call fcn.0048b8e0
inc rbx
cmp rcx, rbx
jae 0x48bb2f
mov edi, 1
lea rsi, [0x0049b480]
call fcn.0044c940
movzx r10d, byte [rsp + 0x47]
mov byte [rbx + rax - 1], r10b
mov rsi, rbx
mov rdx, rcx
xor r9d, r9d
mov rdi, rax
movzx r8d, byte [rsp + 0x46]
mov rbx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x58]
nop word [rax + rax]
nop
cmp rbx, 1
jae 0x48b9aa
jmp 0x48bbc7
mov rax, rdi
mov rbx, rsi
mov rdi, rcx
mov rcx, rdx
call fcn.0048b8e0
mov rsi, qword [rsp + 0x50]
dec rsi
mov rdx, rsi
neg rsi
sar rsi, 0x3f
and esi, 1
mov r8, qword [rsp + 0x58]
lea rdi, [rsi + r8]
mov rsi, rdx
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov rax, rdi
mov rbx, rsi
mov rdi, rcx
mov rcx, rdx
call fcn.0048b8e0
xor edi, edi
xor esi, esi
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov eax, 1
xor ecx, ecx
call fcn.004666a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop
call fcn.00463f80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0048b980
Function at 0x1400047e4
Capabilities:
Identify system language via api

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x1400128b8]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea r14, str.en_US
mov rsi, rcx
mov qword [rcx], r14
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
mov word [rsp + 0x30], ax
mov ebx, 0x10
mov r9d, ebx
lea rdx, [0x140008110]
lea rax, [0x140004df0]
mov r8d, 0x1b3
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call sub.api_ms_win_crt_private_l1_1_0.dll__o_bsearch
xor ebp, ebp
test rax, rax
jne 0x14000485f
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400048e5
cmp dword [rax + 0xc], 0x7c
jne 0x14000486c
cmp word [rax + 8], 0x7f
jne 0x14000484f
mov r8, qword [rax]
or rcx, 0xffffffffffffffff
inc rcx
cmp word [r8 + rcx*2], bp
jne 0x140004873
inc rcx
cmp rcx, 0x7ffffffe
jbe 0x140004890
mov word [rsp + 0x38], bp
jmp 0x1400048d7
lea rax, [rsp + 0x38]
mov r9d, ebp
sub r8, rax
lea rdx, [rsp + 0x38]
lea rax, [rbx - 0x10]
add rax, rcx
je 0x1400048c0
movzx eax, word [r8 + rdx]
test ax, ax
je 0x1400048c0
mov word [rdx], ax
add rdx, 2
sub rbx, 1
jne 0x1400048a0
test rbx, rbx
jne 0x1400048cf
sub rdx, 2
mov r9d, 0x8007007a
mov word [rdx], bp
test r9d, r9d
jns 0x1400048e1
mov ecx, 0x7a
jmp 0x140004854
test ecx, ecx
jne 0x1400048f1
mov rcx, qword [rsp + 0x78]
call fcn.14000494c
jmp 0x14000492a
mov rbx, rbp
mov rdi, rbp
mov rdx, qword [rdi + r14]
lea rcx, [rsp + 0x38]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcsicmp]
test eax, eax
je 0x14000491c
inc rbx
add rdi, 0x30
cmp rdi, 0x750
jb 0x1400048f7
jmp 0x14000492a
lea rax, [rbx + rbx*2]
shl rax, 4
add rax, r14
mov qword [rsi], rax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400050e0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x140005104
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140012e60], eax
call fcn.1400056f0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140012e60], 0
jne case.default.0x14000515a
mov ecx, 1
call fcn.1400056f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
invalid