joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140006dd4
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.1400084a0
nop
cmp dword [0x140014f90], 1
je 0x140006d80
mov dword [0x140014f8c], 1
mov byte [0x140014f88], r12b
test ebx, ebx
jne 0x140006d6c
mov rcx, qword [0x140015990]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140006d59
mov rcx, qword [0x140015988]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x140006cf8
call fcn.140005fec
cmp qword [rdi], rax
jne 0x140006cf8
jmp 0x140006cde
cmp rdi, rsi
jb 0x140006d59
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.140005fec
mov qword [rdi], rax
call rbx
mov rcx, qword [0x140015990]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x140015988]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x140006d37
cmp r13, rax
je 0x140006d57
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x140006cde
lea rdx, [0x14000d398]
lea rcx, [0x14000d380]
call fcn.140006b28
lea rdx, [0x14000d3a8]
lea rcx, [0x14000d3a0]
call fcn.140006b28
nop
test r12d, r12d
je 0x140006d8f
mov ecx, 8
call fcn.1400083a0
test r12d, r12d
jne 0x140006dba
mov dword [0x140014f90], 1
lea ecx, [r12 + 8]
call fcn.1400083a0
mov ecx, r15d
call fcn.140006abc
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
jmp 0x140006c48

Function at 0x140006de0
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x140006c48
Function at 0x14000acd0
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.140005fec
xor ebx, ebx
mov rdi, rax
cmp qword [0x140015670], rbx
jne 0x14000add6
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x14000aeab
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000aeab
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x140015670], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x140015678], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x140015680], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x140015690], rax
test rax, rax
je 0x14000adcd
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x140015688], rax
jmp 0x14000addd
mov rax, qword [0x140015688]
jmp 0x14000ade4
mov rax, qword [0x140015688]
mov r11, qword [0x140015690]
cmp rax, rdi
je 0x14000ae4c
cmp r11, rdi
je 0x14000ae4c
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x140015690]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x14000ae4c
test rax, rax
je 0x14000ae4c
call rsi
test rax, rax
je 0x14000ae46
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14000ae46
test byte [rsp + 0x38], 1
jne 0x14000ae4c
bts ebp, 0x15
jmp 0x14000ae8a
mov rcx, qword [0x140015678]
cmp rcx, rdi
je 0x14000ae8a
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14000ae8a
call rax
mov rbx, rax
test rax, rax
je 0x14000ae8a
mov rcx, qword [0x140015680]
cmp rcx, rdi
je 0x14000ae8a
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14000ae8a
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140015670]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14000aeab
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x14000aead
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140009690
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x48
movdqa xmmword [rsp + 0x30], xmm9
movdqa xmmword [rsp + 0x20], xmm8
movdqa xmmword [rsp + 0x10], xmm7
movdqa xmmword [rsp], xmm6
cmp r8, 0x80
jb 0x1400098ad
movdqu xmm4, xmmword [rdx]
movdqu xmm3, xmmword [rdx + 0x10]
movdqu xmm2, xmmword [rdx + 0x20]
movdqu xmm1, xmmword [rdx + 0x30]
not ecx
movd xmm0, ecx
pxor xmm0, xmm4
add rdx, 0x40
add r8, 0xffffffffffffffc0
movabs rax, 0x154442bd4
movq xmm4, rax
movdqa xmm5, xmmword [0x1401841e0]
nop word cs:[rax + rax]
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm4, 0
movdqa xmm7, xmm0
pclmulqdq xmm7, xmm5, 0x11
movdqu xmm0, xmmword [rdx]
pxor xmm0, xmm6
pxor xmm0, xmm7
movdqu xmm6, xmmword [rdx + 0x10]
movdqu xmm7, xmmword [rdx + 0x20]
movdqu xmm8, xmmword [rdx + 0x30]
movdqa xmm9, xmm3
pclmulqdq xmm9, xmm4, 0
pxor xmm9, xmm6
pclmulqdq xmm3, xmm5, 0x11
pxor xmm3, xmm9
movdqa xmm6, xmm2
pclmulqdq xmm6, xmm4, 0
pxor xmm6, xmm7
pclmulqdq xmm2, xmm5, 0x11
pxor xmm2, xmm6
movdqa xmm6, xmm1
pclmulqdq xmm6, xmm4, 0
pxor xmm6, xmm8
pclmulqdq xmm1, xmm5, 0x11
pxor xmm1, xmm6
add rdx, 0x40
add r8, 0xffffffffffffffc0
cmp r8, 0x3f
ja 0x140009700
movabs rax, 0x1751997d0
movq xmm4, rax
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm4, 0
movdqa xmm5, xmmword [0x1401841f0]
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm6
pxor xmm0, xmm3
movdqa xmm3, xmm0
pclmulqdq xmm3, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm3
pxor xmm0, xmm2
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm2
pxor xmm0, xmm1
cmp r8, 0x10
jb 0x14000982a
nop word cs:[rax + rax]
movdqu xmm1, xmmword [rdx]
add r8, 0xfffffffffffffff0
add rdx, 0x10
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm2
cmp r8, 0xf
ja 0x140009800
movdqa xmm1, xmmword [0x1401841f0]
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pxor xmm1, xmm1
pxor xmm2, xmm2
pblendw xmm2, xmm0, 3
movabs rax, 0x163cd6124
movq xmm3, rax
pclmulqdq xmm3, xmm2, 0
psrldq xmm0, 4
pxor xmm0, xmm3
pxor xmm2, xmm2
pblendw xmm2, xmm0, 3
pclmulqdq xmm2, xmmword [0x140184200], 0x10
pblendw xmm2, xmm1, 0xfc
movabs rax, 0x1db710641
movq xmm1, rax
pclmulqdq xmm1, xmm2, 0
pxor xmm1, xmm0
pextrd ecx, xmm1, 1
not ecx
test r8, r8
je 0x1400098cb
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
add rsp, 0x48
jmp fcn.140009220
mov eax, ecx
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x14001a7b0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x14001a7f2
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 3
jbe 0x14001a7fa
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x14001a80b
jmp 0x14001a822
xor r10d, r10d
jmp 0x14001a8ad
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x14001a822
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x14001a839
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x14001a859
add r11, r8
jmp 0x14001a98a
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x14001a922
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x14001a8d0
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 3
jbe 0x14001a940
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x14001a952
jmp 0x14001a96c
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x14001a96c
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x14001a986
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x140024930
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rsi, rdx
cmp dword [rcx], 2
jne 0x1400249c6
movdqu xmm0, xmmword [rcx + 8]
pshufd xmm1, xmm0, 0x44
pxor xmm1, xmmword [0x140185cc0]
movdqa xmmword [rsp + 0x30], xmm1
pshufd xmm1, xmm0, 0xee
pxor xmm1, xmmword [0x140185cd0]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmmword [rsp + 0x50], xmm0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov rdi, qword [rsi]
xor eax, eax
test rdi, rdi
setne al
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.14001a7b0
test rdi, rdi
je 0x140024a55
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x30]
jmp 0x140024a6e
mov rdx, qword [rsi]
xor ecx, ecx
test rdx, rdx
setne cl
movabs rax, 0xcbf29ce484222325
xor rax, rcx
movabs rcx, 0x1efac7090aef4a21
imul rax, rcx
test rdx, rdx
je 0x140024b66
mov r9, qword [rsi + 0x10]
test r9, r9
je 0x140024be8
mov rcx, qword [rsi + 8]
movabs rdx, 0x100000001b3
mov r10, r9
and r10, 7
je 0x140024b73
mov r11, rax
mov r8, rcx
nop word cs:[rax + rax]
movzx eax, byte [r8]
inc r8
xor rax, r11
imul rax, rdx
mov r11, rax
dec r10
jne 0x140024a30
cmp r9, 8
jae 0x140024b7c
jmp 0x140024be8
movzx eax, byte [rsi + 8]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.14001a7b0
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x60]
shl r9, 0x38
or r9, qword [rsp + 0x68]
mov rax, qword [rsp + 0x48]
mov r8, qword [rsp + 0x30]
add r8, rcx
rol rcx, 0xd
xor rax, r9
xor rcx, r8
rol r8, 0x20
mov rdx, qword [rsp + 0x38]
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rax, r8
xor rcx, rdx
rol rdx, 0x20
xor r8, r9
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
xor rdx, 0xff
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
add rdx, rax
shl rax, 0x10
xor rax, rdx
shr rax, 0x2b
add rdx, rcx
shr rcx, 0x2f
xor rcx, rax
mov rax, rdx
shr rax, 0x20
xor rax, rdx
xor rax, rcx
jmp 0x140024be8
movzx edx, byte [rsi + 8]
xor rax, rdx
imul rax, rcx
jmp 0x140024be8
mov r8, rcx
cmp r9, 8
jb 0x140024be8
add rcx, r9
nop
movzx r9d, byte [r8]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 1]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 2]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 3]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 4]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 5]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 6]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 7]
add r8, 8
xor rax, r9
imul rax, rdx
cmp r8, rcx
jne 0x140024b80
and eax, 0x7fff
add rsp, 0x78
pop rdi
pop rsi
ret
Function at 0x14002c8e0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x14002c900
test al, 1
je 0x14002ca66
test al, 2
jne 0x14002ca66
test al, 8
jne 0x14002c944
mov rdi, qword [rsi + 0x20]
xor ecx, ecx
call fcn.1400e70e0
test rax, rax
je 0x14002c95e
movups xmm6, xmmword [rax + 0x20]
mov qword [rax + 0x20], 1
mov qword [rax + 0x28], rdi
jmp 0x14002c961
test al, 0x10
je 0x14002c9c4
mov rax, qword [rsi + 0x60]
test rax, rax
je 0x14002ca66
mov rcx, qword [rsi + 0x68]
call qword [rax + 0x10]
jmp 0x14002c9c4
xorps xmm6, xmm6
lea rdi, [rsi + 0x28]
mov rcx, qword [rsi + 0x28]
add rcx, 0xfffffffffffffffe
cmp rcx, 3
mov eax, 1
cmovb rax, rcx
cmp rax, 1
je 0x14002c9a5
test rax, rax
jne 0x14002c9ad
mov r8, qword [rsi + 0x30]
test r8, r8
je 0x14002c9ad
cmp qword [rsi + 0x38], 0
je 0x14002c9ad
mov rcx, qword [0x1401ee100]
xor edx, edx
call fcn.140104a84
jmp 0x14002c9ad
mov rcx, rdi
call fcn.14002c6e0
mov qword [rdi], 4
xor ecx, ecx
call fcn.1400e70e0
test rax, rax
je 0x14002c9c4
movups xmmword [rax + 0x20], xmm6
mov rax, 0xffffffffffffffc0
lock xadd qword [rsi], rax
cmp rax, 0x3f
jbe 0x14002ca66
and rax, 0xffffffffffffffc0
cmp rax, 0x40
jne 0x14002ca24
mov rcx, qword [rsi + 0x28]
add rcx, 0xfffffffffffffffe
cmp rcx, 3
mov eax, 1
cmovb rax, rcx
cmp rax, 1
je 0x14002ca30
test rax, rax
jne 0x14002ca39
mov r8, qword [rsi + 0x30]
test r8, r8
je 0x14002ca39
cmp qword [rsi + 0x38], 0
je 0x14002ca39
mov rcx, qword [0x1401ee100]
xor edx, edx
call fcn.140104a84
jmp 0x14002ca39
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rdi
pop rsi
ret
lea rcx, [rsi + 0x28]
call fcn.14002c6e0
mov rax, qword [rsi + 0x60]
test rax, rax
je 0x14002ca49
mov rcx, qword [rsi + 0x68]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1401ee100]
xor edx, edx
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rdi
pop rsi
jmp fcn.140104a84
ud2
Function at 0x14002d1c0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test rcx, rcx
je 0x14002d26f
mov rbx, rdx
mov rdi, rcx
lea rsi, [rcx + 0x10]
mov rcx, rsi
call sub.kernel32.dll_AcquireSRWLockExclusive
movzx eax, byte [rdi + 0x18]
test al, al
jne 0x14002d406
cmp dword [rdi + 0x58], 0x3b9aca00
je 0x14002d2d4
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call sub.kernel32.dll_QueryPerformanceCounter
test eax, eax
je 0x14002d401
mov r14, qword [rsp + 0x20]
mov rcx, qword [0x1401ee0e0]
test rcx, rcx
jne 0x14002d259
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call sub.kernel32.dll_QueryPerformanceFrequency
test eax, eax
je 0x14002d401
mov rcx, qword [rsp + 0x20]
mov qword [0x1401ee0e0], rcx
test rcx, rcx
je 0x14002d406
mov rax, r14
or rax, rcx
shr rax, 0x20
je 0x14002d279
mov rax, r14
xor edx, edx
div rcx
jmp 0x14002d280
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov eax, r14d
xor edx, edx
div ecx
imul r8, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
mov rdx, rax
or rdx, rcx
shr rdx, 0x20
je 0x14002d2a4
xor edx, edx
div rcx
mov rcx, rax
jmp 0x14002d2aa
xor edx, edx
div ecx
mov ecx, eax
add rcx, r8
mov rax, rcx
shr rax, 9
movabs rdx, 0x44b82fa09b5a53
mul rdx
shr rdx, 0xb
imul eax, edx, 0x3b9aca00
sub ecx, eax
mov qword [rdi + 0x50], rdx
mov dword [rdi + 0x58], ecx
cmp dword [rdi + 0x48], 0x3b9aca00
jne 0x14002d306
lea rcx, [rdi + 0x20]
cmp qword [rcx], 0
je 0x14002d3f0
add qword [rdi + 0x28], rbx
cmp dword [rdi + 0x38], 0x3b9aca00
jne 0x14002d3f0
call fcn.14002d410
jmp 0x14002d3f0
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call sub.kernel32.dll_QueryPerformanceCounter
test eax, eax
je 0x14002d401
mov r14, qword [rsp + 0x20]
mov rcx, qword [0x1401ee0e0]
test rcx, rcx
jne 0x14002d362
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call sub.kernel32.dll_QueryPerformanceFrequency
test eax, eax
je 0x14002d401
mov rcx, qword [rsp + 0x20]
mov qword [0x1401ee0e0], rcx
test rcx, rcx
je 0x14002d406
mov rax, r14
or rax, rcx
shr rax, 0x20
je 0x14002d378
mov rax, r14
xor edx, edx
div rcx
jmp 0x14002d37f
mov eax, r14d
xor edx, edx
div ecx
imul r8, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
mov rdx, rax
or rdx, rcx
shr rdx, 0x20
je 0x14002d3a3
xor edx, edx
div rcx
mov rcx, rax
jmp 0x14002d3a9
xor edx, edx
div ecx
mov ecx, eax
add rcx, r8
mov rax, rcx
shr rax, 9
movabs rdx, 0x44b82fa09b5a53
mul rdx
shr rdx, 0xb
imul rax, rdx, 0x3b9aca00
sub rcx, rax
cmp rdx, qword [rdi + 0x40]
jb 0x14002d3f0
jne 0x14002d3db
cmp dword [rdi + 0x48], ecx
ja 0x14002d3f0
mov dword [rdi + 0x48], 0x3b9aca00
lea rcx, [rdi + 0x20]
cmp qword [rcx], 0
jne 0x14002d2eb
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.140104ae4
call sub.kernel32.dll_GetLastError
ud2
Function at 0x140040f50
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0xc8
mov rdi, rcx
mov ecx, dword [0x140183110]
test ecx, ecx
je 0x140041123
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jb 0x140040f85
mov rsi, rax
cmp qword [rax + 8], 0
jne 0x140041158
mov ecx, dword [0x140183110]
test ecx, ecx
je 0x14004115e
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x14004117b
mov rsi, rax
test rax, rax
jne 0x14004101a
movzx eax, byte [0x1401ee110]
mov rcx, qword [0x1401ee100]
test rcx, rcx
jne 0x140040fd7
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x14004119d
mov rcx, rax
mov qword [0x1401ee100], rax
mov r8d, 0x60
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x14004119d
mov rsi, rax
lea rax, [0x1401830f8]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x140183110]
test ecx, ecx
je 0x14004118a
dec ecx
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
lea rax, [rsi + 8]
test rdi, rdi
je 0x14004103f
lea rdx, [rdi + 8]
cmp qword [rdi], 0
mov qword [rdi], 0
lea rcx, [0x1401b7388]
cmovne rcx, rdx
jmp 0x140041046
lea rcx, [0x1401b7388]
movups xmm0, xmmword [rcx + 0x40]
movaps xmmword [rsp + 0x60], xmm0
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
movups xmm2, xmmword [rcx + 0x20]
movups xmm3, xmmword [rcx + 0x30]
movaps xmmword [rsp + 0x50], xmm3
movaps xmmword [rsp + 0x40], xmm2
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov rcx, qword [rax + 0x50]
mov qword [rsp + 0xc0], rcx
movups xmm0, xmmword [rax + 0x40]
movaps xmmword [rsp + 0xb0], xmm0
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmm2, xmmword [rax + 0x20]
movups xmm3, xmmword [rax + 0x30]
movaps xmmword [rsp + 0xa0], xmm3
movaps xmmword [rsp + 0x90], xmm2
movaps xmmword [rsp + 0x80], xmm1
movaps xmmword [rsp + 0x70], xmm0
mov qword [rsi + 8], 1
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [rsi + 0x50], xmm0
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movaps xmm2, xmmword [rsp + 0x40]
movaps xmm3, xmmword [rsp + 0x50]
movups xmmword [rsi + 0x40], xmm3
movups xmmword [rsi + 0x30], xmm2
movups xmmword [rsi + 0x20], xmm1
movups xmmword [rsi + 0x10], xmm0
cmp qword [rsp + 0x70], 0
je 0x140041158
mov rax, qword [rsp + 0x80]
cmp rax, 2
je 0x140041158
lea rcx, [rsp + 0x88]
test rax, rax
je 0x140041145
mov rax, qword [rsp + 0x88]
lock dec qword [rax]
jne 0x140041158
call fcn.1400bb660
jmp 0x140041158
lea rcx, [0x1401830f8]
call fcn.1400e0040
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jae 0x140040f77
jmp 0x140040f85
mov rax, qword [rsp + 0x88]
lock dec qword [rax]
jne 0x140041158
call fcn.140026aa0
add rsi, 0x10
jmp 0x14004117d
lea rcx, [0x1401830f8]
call fcn.1400e0040
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jne 0x140040fa4
xor esi, esi
mov rax, rsi
add rsp, 0xc8
pop rdi
pop rsi
ret
lea rcx, [0x1401830f8]
call fcn.1400e0040
mov ecx, eax
jmp 0x140041012
ud2
Function at 0x140045da0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xde8
movdqa xmmword [rsp + 0xdd0], xmm10
movdqa xmmword [rsp + 0xdc0], xmm9
movdqa xmmword [rsp + 0xdb0], xmm8
movaps xmmword [rsp + 0xda0], xmm7
movdqa xmmword [rsp + 0xd90], xmm6
mov qword [rsp + 0xc30], rdx
mov r15, rcx
movzx eax, byte [rcx + 0x1d0]
test eax, eax
mov qword [rsp + 0xb8], rcx
je 0x140045e35
cmp eax, 3
jne 0x14004be0c
lea rsi, [r15 + 0x1c8]
movzx eax, byte [r15 + 0x1c8]
test eax, eax
je 0x14004602d
cmp eax, 3
jne 0x14004be0c
mov rbx, qword [r15 + 0x1c0]
jmp 0x140048653
lea rcx, [rsp + 0x230]
mov r8d, 0x198
mov rdx, r15
call sub.msvcrt.dll_memcpy
mov rbp, qword [rsp + 0x388]
test rbp, rbp
je 0x140046039
mov r13b, 1
xor r12d, r12d
mov rbx, rbp
mov rbx, qword [r15 + 0x1b8]
jmp 0x140048644
mov rax, qword [rsp + 0x330]
mov qword [rsp + 0x130], rax
movdqu xmm0, xmmword [rsp + 0x320]
movdqa xmmword [rsp + 0x120], xmm0
cmp byte [rsp + 0x3a3], 0
mov qword [rsp + 0x78], rbp
je 0x140046bcc
mov rax, qword [section..data]
cmp rax, 2
jne 0x1400485ce
mov r12, qword [0x140183008]
lock inc qword [r12]
jle 0x14004be0c
lea rdx, [0x1401b4e52]
lea rcx, [rsp + 0x7c0]
mov r8d, 8
call fcn.1400e4940
movzx esi, byte [rsp + 0x7d8]
cmp sil, 2
jne 0x140046322
mov rbx, qword [rsp + 0x7c0]
test sil, sil
je 0x1400477f5
mov r13, qword [rsp + 0x7d0]
mov r13, qword [rsp + 0x7d0]
test r13, r13
je 0x1400485c6
lea rax, [rbx + r13]
mov rdx, rbx
jmp 0x14004782c
xor r13d, r13d
jmp 0x14004633b
call fcn.1400a04d0
mov r12, qword [0x140183008]
lock inc qword [r12]
jg 0x140046091
jmp 0x14004be0c