joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400cdb20
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x1400cdb2b
je 0x1400cdb36
call 0x1400cdb85
mov bl, 0xc7
lahf
pop rsi
jne 0x1400cdb16
call 0x1400cdb2e
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x1400cdb16
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x1400cdb64
je 0x1400cdba2
invalid
je 0x1400cdbb3
jne 0x1400cdb16
lea rax, [0x1400cda3c]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x1400c979d]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x1400cdc54
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x1400cdcad
je 0x1400cdcb3
call 0x1400cdca4
fild qword [rdi - 0x7c]
jmp 0x17500a426
jne 0x1400cdc76
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x1400cdc36
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret
Function at 0x1400cdb4c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x1400cdb2b
je 0x1400cdb36
call 0x1400cdb85
mov bl, 0xc7
lahf
pop rsi
jne 0x1400cdb16
call 0x1400cdb2e
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x1400cdb16
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x1400cdb64
je 0x1400cdba2
invalid
je 0x1400cdbb3
jne 0x1400cdb16
lea rax, [0x1400cda3c]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x1400c979d]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x1400cdc54
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x1400cdcad
je 0x1400cdcb3
call 0x1400cdca4
fild qword [rdi - 0x7c]
jmp 0x17500a426
jne 0x1400cdc76
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x1400cdc36
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret
Function at 0x1400cdb85
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x1400cdb2b
je 0x1400cdb36
call 0x1400cdb85
mov bl, 0xc7
lahf
pop rsi
jne 0x1400cdb16
call 0x1400cdb2e
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x1400cdb16
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x1400cdb64
je 0x1400cdba2
invalid
je 0x1400cdbb3
jne 0x1400cdb16
lea rax, [0x1400cda3c]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x1400c979d]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x1400cdc54
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x1400cdcad
je 0x1400cdcb3
call 0x1400cdca4
fild qword [rdi - 0x7c]
jmp 0x17500a426
jne 0x1400cdc76
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x1400cdc36
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret

Function at 0x140103410
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdi, qword [0x140297820]
cmp rdi, 1
jbe 0x140103475
mov ecx, dword [0x1402910c8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140103456
movsxd rcx, dword [rdi]
shl rcx, 4
mov qword [rax + rcx], 0
mov ecx, dword [rdi + 4]
movsxd rdx, dword [rdi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
lea rcx, [rsi + 8]
call fcn.140072110
mov rcx, qword [rsi]
test rcx, rcx
je 0x14010346d
lock dec dword [rcx + 8]
je 0x1401034ca
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x140297820]
call fcn.14008f690
test al, al
je 0x1401034be
mov qword [0x140297828], 0
lea rbx, [0x140297820]
lea rdi, [0x140297828]
mov rcx, rdi
xor edx, edx
call fcn.1400721e0
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.14008f670
jmp 0x140103427
mov rdi, qword [0x140297820]
jmp 0x140103427
add rcx, 8
add rcx, 0xfffffffffffffff8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.14009a4a0
Function at 0x140117000
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, r8
mov rsi, rdx
mov bl, byte [rbp + 0x68]
test byte [r9 + 8], 1
jne 0x140117053
mov al, byte [rbp + 0x60]
movzx edx, bl
mov rbx, qword [rcx]
mov dword [rsp + 0x28], edx
mov byte [rsp + 0x20], al
mov rdx, rsi
mov r8, rdi
call qword [rbx + 0x30]
mov rax, rsi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov rax, qword [r9 + 0x30]
lea rcx, [rbp - 0x20]
mov qword [rcx], rax
mov qword [rbp - 8], rax
lock inc dword [rax + 8]
lea rdx, [0x1402951a8]
call fcn.14009f658
mov r14, rax
mov eax, 0xffffffff
mov rcx, qword [rbp - 8]
lock xadd dword [rcx + 8], eax
test eax, eax
jne 0x140117091
mov rcx, qword [rbp - 8]
mov rax, qword [rcx]
call qword [rax + 8]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r15, [rbp - 0x20]
mov qword [r15 + 0x10], rax
movaps xmm0, xmmword [0x140257270]
movaps xmmword [r15], xmm0
mov rax, qword [r14]
xor bl, 1
movzx ebx, bl
mov rcx, r14
mov rdx, r15
call qword [rax + rbx*8 + 0x28]
movzx r9d, byte [r15 + 0x17]
test r9b, r9b
mov rcx, qword [r15]
mov r8, qword [r15 + 8]
mov rax, r9
cmovs rax, r8
test rax, rax
je 0x140117148
test r9b, r9b
mov rbx, r15
cmovs rbx, rcx
test rdi, rdi
je 0x140117136
mov al, byte [rbx]
movzx eax, al
mov rcx, qword [rdi + 0x30]
cmp rcx, qword [rdi + 0x38]
je 0x14011713a
lea rdx, [rcx + 1]
mov qword [rdi + 0x30], rdx
mov byte [rcx], al
cmp eax, 0xffffffff
jne 0x14011710b
xor edi, edi
mov r9b, byte [rbp - 9]
mov rcx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x18]
inc rbx
test r9b, r9b
mov rax, r15
cmovs rax, rcx
movzx edx, r9b
cmovs rdx, r8
add rdx, rax
cmp rbx, rdx
jne 0x1401170e6
jmp 0x140117148
xor edi, edi
jmp 0x140117117
mov r8, qword [rdi]
mov rcx, rdi
mov edx, eax
call qword [r8 + 0x60]
jmp 0x140117104
shr r9b, 7
mov qword [rsi], rdi
test r9b, r9b
je 0x140117043
call fcn.1400c9cac
jmp 0x140117043

Function at 0x140119fc0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x40
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov eax, dword [0x14029bff0]
mov ecx, dword [0x140293330]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14011a05b
lea rcx, [0x14029bfe8]
call fcn.1400a0960
test rax, rax
jne 0x14011a03a
mov ecx, 4
call fcn.1400c9cbc
mov dword [rax], 0
lea rdx, [rsp + 0x28]
mov qword [rdx], rax
lea rsi, [rsp + 0x30]
mov rcx, rsi
call fcn.14011a0b0
mov rcx, qword [rsi]
mov qword [rsi], 0
test rcx, rcx
jne 0x14011a09f
lea rsi, [0x14029bfe8]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400ccfe0
mov rcx, rsi
add rsp, 0x40
pop rsi
jmp fcn.1400a0960
lea rcx, [0x14029bff0]
call fcn.1400c9d58
cmp dword [0x14029bff0], 0xffffffff
jne 0x140119ff5
mov qword [0x14029bfe8], 0
lea rcx, [0x14029bfe8]
lea rdx, [0x140128b10]
call fcn.1400721e0
lea rcx, [0x14029bff0]
call fcn.1400c9cf8
jmp 0x140119ff5
call fcn.1400c9cac
jmp 0x14011a03a
Function at 0x14011de02
Capabilities:
Access peb ldr_data

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov rcx, qword [rcx]
test rcx, rcx
jne 0x14011ded9
mov rax, qword [rsi + 0x28]
cmp rax, 0x60
mov edi, 0x60
cmova rdi, rax
mov rcx, rdi
call qword [rsi + 0x48]
mov rdx, rax
xor r8d, r8d
mov qword [rax], r8
mov qword [rax + 8], 0x18
mov qword [rax + 0x10], rdi
lock add qword [rsi + 0x10], rdi
lea rcx, [rax + 0x18]
mov qword [rax + 8], 0x60
mov qword [rax + 0x18], rsi
mov edi, dword [0x140293330]
mov rax, qword gs:[0x58]
mov rax, qword [rax + rdi*8]
lea rax, [rax + 0x120]
mov qword [rdx + 0x20], rax
mov qword [rdx + 0x28], rdx
lea rax, [rdx + 0x60]
mov qword [rdx + 0x40], rax
mov rax, qword [rdx + 0x10]
add rax, rdx
mov qword [rdx + 0x48], rax
mov qword [rdx + 0x30], r8
xorps xmm0, xmm0
movups xmmword [rdx + 0x50], xmm0
mov rax, qword [rsi]
mov qword [rdx + 0x38], rax
lock cmpxchg qword [rsi], rcx
jne 0x14011de9b
mov eax, dword [0x140293330]
mov rdx, qword gs:[0x58]
mov rax, qword [rdx + rax*8]
mov qword [rax + 0x128], rcx
mov rdx, qword [rsi + 0x20]
mov qword [rax + 0x120], rdx
mov qword [rsi + 8], rcx
mov rax, rcx
add rsp, 0x28
pop rdi
pop rsi
ret
mov eax, dword [0x140293330]
mov rdx, qword gs:[0x58]
mov rax, qword [rdx + rax*8]
lea rax, [rax + 0x120]
cmp qword [rcx + 8], rax
je 0x14011dea6
mov rcx, qword [rcx + 0x20]
jmp 0x14011de0e

Function at 0x140120990
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x14029ba28]
mov ecx, dword [0x140293330]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1401209c5
lea rcx, [0x14029ba20]
add rsp, 0x28
jmp fcn.1400a0960
lea rcx, [0x14029ba28]
call fcn.1400c9d58
cmp dword [0x14029ba28], 0xffffffff
jne 0x1401209b5
mov qword [0x14029ba20], 0
lea rcx, [0x14029ba20]
xor edx, edx
call fcn.1400721e0
lea rcx, [0x14029ba28]
call fcn.1400c9cf8
jmp 0x1401209b5

Function at 0x140120a80
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov rcx, qword [rcx + 0x30]
lea rdx, [rsi + 0x18]
mov rax, qword [rcx]
call qword [rax + 0x90]
mov byte [rsi + 0xde9], 1
mov rcx, qword [rsi + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x50]
test rax, rax
je 0x140120b20
mov eax, dword [0x14029b0b0]
mov ecx, dword [0x140293330]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140120ae4
lea rcx, [0x14029b0a8]
mov rdx, rsi
add rsp, 0x20
pop rsi
jmp fcn.140098d50
lea rcx, [0x14029b0b0]
call fcn.1400c9d58
cmp dword [0x14029b0b0], 0xffffffff
jne 0x140120ad0
mov qword [0x14029b0a8], 0
lea rcx, [0x14029b0a8]
xor edx, edx
call fcn.1400721e0
lea rcx, [0x14029b0b0]
call fcn.1400c9cf8
jmp 0x140120ad0
add rsp, 0x20
pop rsi
ret
Function at 0x140127ac6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rsi, rcx
test r8d, r8d
jne 0x140127af0
movabs rax, 0x100000001
mov qword [rsi], rax
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov edi, r8d
mov dword [rsi], 0
test dl, 1
jne 0x140127b11
xor ebx, ebx
movzx edx, dx
shr edx, 1
inc ebx
mov r14d, edx
test dl, 1
je 0x140127b00
jmp 0x140127b17
movzx r14d, dx
xor ebx, ebx
bsr eax, r14d
xor eax, 0x1f
mov ecx, 0x20
sub ecx, eax
imul ecx, edi
cmp ecx, 0xde3
jg 0x140127be9
mov ecx, 1
mov ebp, ecx
lea ecx, [rbp + rbp]
cmp ebp, edi
jle 0x140127b39
xor r8d, r8d
sar ebp, 2
movzx r9d, dx
jne 0x140127ba1
xor ebp, ebp
mov rdx, r9
mov dword [rsi], 0
test rdx, rdx
je 0x140127b7c
xor eax, eax
mov ecx, edx
and ecx, 0xfffffff
mov dword [rsi + rax*4 + 4], ecx
shr rdx, 0x1c
inc rax
test rdx, rdx
jne 0x140127b61
mov word [rsi], ax
test r8b, 1
jne 0x140127c0b
test ebp, ebp
jne 0x140127bee
imul ebx, edi
mov rcx, rsi
mov edx, ebx
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
jmp fcn.1401274ec
xor r8d, r8d
mov r10d, 1
mov rdx, r9
imul rdx, rdx
test ebp, edi
jne 0x140127bc4
sar ebp, 1
je 0x140127b54
mov rcx, rdx
shr rcx, 0x20
jne 0x140127b54
jmp 0x140127bad
mov ecx, eax
or cl, 0x20
mov r11, rdx
shr r11, cl
test r11, r11
mov ecx, 1
cmove rcx, r9
movzx r8d, r8b
cmovne r8d, r10d
imul rdx, rcx
jmp 0x140127bb5
call fcn.140191a82
mov rcx, rsi
call fcn.1401eef28
test ebp, edi
je 0x140127c05
mov rcx, rsi
mov edx, r14d
call fcn.1401277ae
sar ebp, 1
je 0x140127b8a
jmp 0x140127bee
mov rcx, rsi
mov edx, r14d
call fcn.1401277ae
jmp 0x140127b86

Function at 0x140129c50
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rcx
mov eax, dword [0x14029ba18]
mov ecx, dword [0x140293330]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140129cbd
mov ecx, dword [0x1402910c8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, 0xffffffff
and rax, 0xfffffffffffffffc
je 0x140129cb1
movsxd rdx, dword [0x14029ba10]
shl rdx, 4
mov esi, dword [rax + rdx + 8]
cmp esi, dword [0x14029ba14]
jne 0x140129cb1
mov rax, qword [rax + rdx]
test rax, rax
jne 0x140129cf9
mov dword [rdi], ecx
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x14029ba18]
call fcn.1400c9d58
cmp dword [0x14029ba18], 0xffffffff
jne 0x140129c7a
mov qword [0x14029ba10], 0
lea rcx, [0x14029ba10]
xor edx, edx
call fcn.1400721e0
lea rcx, [0x14029ba18]
call fcn.1400c9cf8
jmp 0x140129c7a
mov ecx, dword [rax]
jmp 0x140129cb1

Function at 0x14012cc20
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1402910c8]
cmp ecx, 0xffffffff
je 0x14012cc45
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
dec eax
cmp eax, 2
setb al
add rsp, 0x28
ret
xor eax, eax
jmp 0x14012cc40
Function at 0x140140fcf
Capabilities:
Clear file content

Disassembly:
push rsi
push rdi
sub rsp, 0x178
mov rdi, rcx
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0x170], rax
xor esi, esi
xor edx, edx
xor r8d, r8d
call fcn.14013b0ed
test rax, rax
jne 0x14014100e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov sil, 1
test eax, eax
je 0x14014102a
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400ccfe0
mov eax, esi
add rsp, 0x178
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.1400ac390
test al, al
je 0x140141080
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_file_io_win.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0xfc
mov r9d, 2
call fcn.14014efd0
lea rcx, [rsp + 0x40]
lea rdx, [0x14025f3fe]
mov r8d, 0xc
call fcn.1400a7acb
mov rcx, rsi
call fcn.1401412f0
xor esi, esi
jmp 0x14014100e

Function at 0x140145a48
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [rcx + 8]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x140145a7f
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x140145a7f
movzx edx, word [rax + rcx + 0x14]
cmp edx, 0xf0
jne 0x140145a7f
movzx eax, word [rax + rcx + 0x18]
cmp eax, 0x20b
sete al
ret
xor eax, eax
jmp 0x140145a7e

Function at 0x14014689e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
test r8, r8
je 0x14014699e
mov r11, qword [rcx + 8]
movsxd rcx, dword [r11 + 0x3c]
cmp dword [r11 + rcx + 0x84], 0
je 0x14014699e
add rcx, r11
xor eax, eax
cmp word [rcx + 0x14], 0x78
jb 0x1401469c6
add rcx, 0x88
je 0x1401469c6
mov r10d, dword [rcx]
test r10, r10
je 0x14014699e
add r10, r11
je 0x14014699e
cmp rdx, 0xffff
jbe 0x1401469c0
mov eax, dword [r10 + 0x18]
mov ecx, dword [r10 + 0x20]
lea r9, [r11 + rcx]
test rcx, rcx
cmove r9, rcx
lea rcx, [rax*4]
test rcx, rcx
je 0x14014699e
lea rax, [r9 + rax*4]
mov r14b, byte [rdx]
inc rdx
mov rsi, r9
mov rdi, rax
sub rdi, rsi
mov rcx, rdi
sar rcx, 2
shr rdi, 0x3f
add rdi, rcx
and rdi, 0xfffffffffffffffe
mov ecx, dword [rsi + rdi*2]
lea rbx, [r11 + rcx]
test rcx, rcx
cmove rbx, rcx
test r14b, r14b
je 0x140146976
mov rcx, rdx
mov ebp, r14d
cmp bpl, byte [rbx]
jne 0x140146978
inc rbx
mov bpl, byte [rcx]
inc rcx
test bpl, bpl
jne 0x140146963
xor ebp, ebp
lea rdi, [rsi + rdi*2]
movzx ecx, bpl
movzx ebx, byte [rbx]
mov ebp, ecx
sub ebp, ebx
lea r15, [rdi + 4]
test ebp, ebp
cmovg rsi, r15
cmp ecx, ebx
cmovs rax, rdi
je 0x1401469a2
cmp rsi, rax
jne 0x140146932
xor eax, eax
jmp 0x1401469c6
mov eax, dword [r10 + 0x24]
add r11, rax
test rax, rax
cmove r11, rax
sub rdi, r9
sar rdi, 1
movzx edx, word [r11 + rdi]
add dx, word [r10 + 0x10]
mov word [r8], dx
mov al, 1
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14016efc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, r8
mov r14, rdx
mov r15b, byte [rbp + 0x78]
test byte [r9 + 8], 1
jne 0x14016f01f
movzx eax, word [rbp + 0x70]
movzx edx, r15b
mov rbx, qword [rcx]
mov dword [rsp + 0x28], edx
mov word [rsp + 0x20], ax
mov rdx, r14
mov r8, rdi
call qword [rbx + 0x30]
mov rax, r14
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rax, qword [r9 + 0x30]
lea rcx, [rbp - 0x20]
mov qword [rcx], rax
mov qword [rbp - 8], rax
lock inc dword [rax + 8]
lea rdx, [0x1402951b8]
call fcn.14009f658
mov r12, rax
mov eax, 0xffffffff
mov rcx, qword [rbp - 8]
lock xadd dword [rcx + 8], eax
test eax, eax
jne 0x14016f059
mov rax, qword [rcx]
call qword [rax + 8]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r13, [rbp - 0x20]
mov qword [r13 + 0x10], rax
movaps xmm0, xmmword [0x140257270]
movaps xmmword [r13], xmm0
mov rax, qword [r12]
xor r15b, 1
movzx esi, r15b
mov rcx, r12
mov rdx, r13
call qword [rax + rsi*8 + 0x28]
movzx ebx, byte [r13 + 0x17]
test bl, bl
mov rcx, qword [r13]
mov r8, qword [r13 + 8]
mov rax, rbx
cmovs rax, r8
test rax, rax
je 0x14016f111
test bl, bl
mov rsi, rcx
cmovns rsi, r13
test rdi, rdi
je 0x14016f100
movzx eax, word [rsi]
mov rcx, qword [rdi + 0x30]
cmp rcx, qword [rdi + 0x38]
je 0x14016f104
lea rdx, [rcx + 2]
mov qword [rdi + 0x30], rdx
mov word [rcx], ax
cmp ax, 0xffff
jne 0x14016f0d6
xor edi, edi
mov bl, byte [rbp - 9]
mov rcx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x18]
add rsi, 2
test bl, bl
mov rax, r13
cmovs rax, rcx
movzx edx, bl
cmovs rdx, r8
lea rax, [rax + rdx*2]
cmp rsi, rax
jne 0x14016f0b1
jmp 0x14016f111
xor edi, edi
jmp 0x14016f0e1
mov rbx, qword [rdi]
mov rcx, rdi
mov edx, eax
call qword [rbx + 0x60]
jmp 0x14016f0ce
shr bl, 7
mov qword [r14], rdi
test bl, bl
je 0x14016f00b
call fcn.1400c9cac
jmp 0x14016f00b

Function at 0x14017ead0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
mov r8, qword [rcx]
mov r9, qword [rcx + 8]
sub r9, r8
je 0x14017eb0a
mov rdx, r9
shr rdx, 2
xor eax, eax
lea r10, [0x140263af0]
movzx r11d, dl
movzx esi, byte [r8 + rax]
xor esi, r11d
shr edx, 8
xor edx, dword [r10 + rsi*4]
inc rax
cmp r9, rax
jne 0x14017eaed
jmp 0x14017eb0c
xor edx, edx
cmp edx, dword [rcx + 0x18]
sete al
pop rsi
ret
Function at 0x1401e09a5
Capabilities:
Encode data using xor

Disassembly:
push rsi
test rdx, rdx
je 0x1401e09e9
movzx r10d, byte [rdx]
mov r11d, r10d
shl r11d, 5
sub r11d, r10d
sub r11d, r10d
test r10d, r10d
je 0x1401e09ec
inc rdx
movsx r10d, r10b
mov eax, r11d
shl eax, 5
mov esi, r11d
shr esi, 3
add esi, eax
add esi, r10d
xor r11d, esi
mov r10b, byte [rdx]
inc rdx
test r10b, r10b
jne 0x1401e09c4
jmp 0x1401e09ec
xor r11d, r11d
mov eax, r11d
shl eax, 5
mov r10d, r11d
shr r10d, 3
add r10d, eax
xor r10d, r11d
test r8, r8
je 0x1401e0a2e
mov al, byte [r8]
test al, al
je 0x1401e0a2e
inc r8
movsx eax, al
mov edx, r10d
shl edx, 5
mov esi, r10d
shr esi, 3
add esi, eax
add esi, edx
xor r10d, esi
mov al, byte [r8]
inc r8
test al, al
jne 0x1401e0a0e
mov edx, r10d
shl edx, 5
mov eax, r10d
shr eax, 3
add eax, edx
xor eax, r10d
test r9, r9
je 0x1401e0a6d
mov dl, byte [r9]
test dl, dl
je 0x1401e0a6d
inc r9
movsx r8d, dl
mov esi, eax
shl esi, 5
mov edx, eax
shr edx, 3
add edx, r8d
add edx, esi
xor eax, edx
mov dl, byte [r9]
inc r9
test dl, dl
jne 0x1401e0a4e
xor edx, edx
div dword [rcx + 8]
mov eax, edx
pop rsi
ret

Function at 0x1401f0af2
Capabilities:
Delete directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1a0
mov rdi, rcx
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0x198], rax
cmp byte [rcx + 0x17], 0
jns 0x1401f0b1a
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, eax
test eax, eax
je 0x1401f0b48
test esi, esi
setne bl
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.1400ccfe0
mov eax, ebx
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.1400ac390
test al, al
je 0x1401f0b26
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rcx, [rsp + 0x58]
mov r8d, 0x2f
mov r9d, 2
call fcn.14014efd0
lea rcx, [rsp + 0x68]
lea rdx, str.RemoveDirectory
mov r8d, 0x10
call fcn.1400a7acb
mov rbx, rax
movzx eax, byte [rdi + 0x17]
test al, al
mov rcx, qword [rdi]
cmovns rcx, rdi
lea rdx, [rsp + 0x30]
mov qword [rdx], rcx
cmovs rax, qword [rdi + 8]
mov qword [rdx + 8], rax
lea rdi, [rsp + 0x40]
mov rcx, rdi
call fcn.14008ddb0
movzx r8d, byte [rdi + 0x17]
test r8b, r8b
jns 0x1401f0bd6
mov r8, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
mov rcx, rbx
mov rdx, rdi
call fcn.1400a7acb
cmp byte [rsp + 0x57], 0
jns 0x1401f0bf2
mov rcx, qword [rsp + 0x40]
call fcn.1400c9cac
lea rcx, [rsp + 0x58]
call fcn.1401412f0
jmp 0x1401f0b26