joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5b6630
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rbx, qword [0x0065df90]
test rbx, rbx
je 0x5b6800
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, esi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rbx, rbx
je 0x5b6800
mov rax, qword [rbx + 0x10]
lea rbp, [rsp + 0x20]
mov rdx, qword [rbx + 0x18]
lea rsi, [rsp + 0x30]
mov rcx, rbp
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rdx
call fcn.005b5eb0
lea rax, [rbx + 0x38]
mov rcx, rsi
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
xchg qword [rax], rcx
test rcx, rcx
je 0x5b66fc
mov qword [rcx + 8], rsi
lea rdx, [rcx + 0x18]
xor eax, eax
mov rcx, 0xffffffffffffffff
lock cmpxchg qword [rdx], rcx
test rax, rax
mov rcx, rax
je 0x5b66e7
call qword [sym.imp.KERNEL32.dll_SetEvent]
lea r12, [rsi + 0x10]
xor edi, edi
lock xadd qword [r12], rdi
test rdi, rdi
je 0x5b6810
mov dword [rbx + 0x28], 6
mov r8, qword [rsp + 0x30]
lea rax, [rsi + 8]
xor edx, edx
lock xadd qword [rax], rdx
test rdx, rdx
mov rcx, rdx
je 0x5b6850
add rcx, 0x10
xor eax, eax
mov rdx, 0xffffffffffffffff
lock cmpxchg qword [rcx], rdx
test rax, rax
mov rcx, rax
je 0x5b673f
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rax, qword [rbx + 0x178]
mov esi, 0xffffffff
mov rdi, qword [sym.imp.KERNEL32.dll_SetEvent]
test rax, rax
jne 0x5b677b
jmp 0x5b67c5
add r8, 8
mov eax, esi
xchg dword [r8], eax
mov rcx, qword [rdx + 0x20]
call rdi
mov rax, qword [rbx + 0x178]
test rax, rax
je 0x5b67c5
mov rdx, qword [rax]
mov r9, qword [rdx + 0x28]
mov r10, qword [rdx + 0x10]
mov qword [rdx + 0x10], rbx
mov rax, qword [r9 + 0x18]
test rax, rax
je 0x5b679b
mov rcx, qword [r9 + 0x10]
mov qword [rax + 0x10], rcx
mov rcx, qword [r9 + 0x10]
test rcx, rcx
je 0x5b67a8
mov qword [rcx + 0x18], rax
cmp r9, qword [r10 + 0x178]
mov r8, r9
jne 0x5b6760
mov rax, qword [r9 + 0x18]
mov qword [r10 + 0x178], rax
mov r8, qword [rdx + 0x28]
jmp 0x5b6760
cmp dword [rbx + 0x184], 1
jne 0x5b6800
mov rax, qword [rbx + 0x10]
mov rcx, rbp
mov rdx, qword [rbx + 0x18]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rdx
call fcn.005b5bb0
mov rax, qword [0x0065df90]
xor edx, edx
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop dword [rax]
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov r13, rax
mov rax, rdi
lock cmpxchg qword [r12], r13
test rax, rax
je 0x5b683f
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x5b66fc
mov edx, 0xffffffff
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x5b6831
mov rax, rsi
lock cmpxchg qword [r8], rdx
cmp rsi, rax
je 0x5b673f
lea rcx, [rsi + 0x18]
lock xadd qword [rcx], rdx
test rdx, rdx
je 0x5b687f
add rsi, 8
xor ecx, ecx
lock xadd qword [rsi], rcx
jmp 0x5b671f
call fcn.005b58b0
jmp 0x5b686f
Function at 0x5b9d00
Capabilities:
Get thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, qword [0x0065df88]
test rbx, rbx
je 0x5b9d62
mov esi, ecx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, edi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rbx, rbx
je 0x5b9d62
test esi, esi
je 0x5b9d47
mov rax, qword [rbx]
test rax, rax
je 0x5b9d47
mov rcx, qword [rbx + 8]
call rax
mov rdx, qword [rbx + 0x10]
mov rcx, qword [0x0065df88]
call fcn.005b9840
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor ebx, ebx
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x5b9d70
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rsi, qword [0x0065df88]
test rsi, rsi
mov rbx, rcx
mov qword [rcx], rdx
mov qword [rcx + 8], r8
je 0x5b9dd0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rsi]
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, ebp
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rsi, qword [0x0065df88]
mov rdx, rbx
mov rcx, rsi
mov qword [rbx + 0x10], rdi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.005b9840
xor edi, edi
jmp 0x5b9db0

Function at 0x5b9de0
Capabilities:
Get thread local storage value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rsi, qword [0x0065df90]
test rsi, rsi
mov rbx, rcx
je 0x5b9e42
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rsi]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, edi
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rsi, rsi
je 0x5b9e42
mov rdi, qword [rsi + 0x18]
mov rsi, qword [rsi + 0x10]
mov qword [rbx], rsi
mov qword [rbx + 8], rdi
mov rax, rbx
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea r12, [rsp + 0x40]
mov rcx, r12
call fcn.005b7260
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
test rbp, rbp
mov rsi, rbp
je 0x5b9e27
or byte [rbp + 0x194], 1
mov dword [rbp + 0x184], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r13, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rbp + 0x198], eax
call r13
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r14, rax
call r13
lea r9, [rbp + 8]
mov r8, r15
mov rdx, r14
mov rcx, rax
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x5b9ef0
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov rcx, qword [0x0065df90]
mov rdx, rbp
mov dword [rbp + 0x188], eax
call fcn.005b9840
jmp 0x5b9e27
mov rcx, r12
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rdi
call fcn.005b70c0
mov qword [rbx], 0
mov dword [rbx + 8], 0
jmp 0x5b9e2e
Function at 0x5b9f20
Capabilities:
Create thread
Resume thread

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
test rdx, rdx
mov r12, rcx
mov r14, r8
mov dword [rcx + 8], 0
mov r13, r9
je 0x5ba060
mov rbp, qword [rdx]
lea rdi, [rsp + 0x30]
mov rcx, rdi
call fcn.005b7260
mov rbx, qword [rsp + 0x30]
mov r15, qword [rsp + 0x38]
test rbx, rbx
je 0x5ba030
mov ecx, 0x20
call sub.msvcrt.dll_malloc
test rax, rax
mov rsi, rax
je 0x5ba030
test rbp, rbp
mov qword [rax], rbx
mov qword [rax + 8], r15
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], r13
je 0x5ba090
mov eax, dword [rbp + 0x18]
mov r14, qword [rbp + 0x10]
mov r13d, dword [rbp + 0x1c]
mov dword [rbx + 0x184], eax
mov eax, dword [rbp + 0x20]
test eax, eax
je 0x5ba070
mov dword [rbx + 0x28], 0
xor ecx, ecx
mov r9, rsi
mov edx, r14d
lea rax, [rbx + 0x198]
mov qword [rbx + 0x58], 0
lea r8, [0x005b9c40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 4
call qword [sym.imp.msvcrt.dll__beginthreadex]
test rax, rax
mov rbp, rax
mov qword [rbx + 8], rax
je 0x5ba0e0
mov r8d, r13d
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], r15
call fcn.005b7ed0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov qword [r12], rbx
xor eax, eax
mov qword [r12 + 8], r15
jmp 0x5ba047
mov rcx, rdi
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], r15
call fcn.005b5bb0
mov eax, 0xb
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor ebp, ebp
jmp 0x5b9f4c
mov rcx, rdi
call fcn.005b9de0
mov rax, qword [rsp + 0x30]
mov r13d, dword [rax + 0x188]
jmp 0x5b9fb6
mov dword [rbx + 0x28], 0
xor edx, edx
xor ecx, ecx
mov r9, rsi
lea rax, [rbx + 0x198]
mov qword [rbx + 0x58], 0
lea r8, [0x005b9c40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 4
call qword [sym.imp.msvcrt.dll__beginthreadex]
test rax, rax
mov rbp, rax
mov qword [rbx + 8], rax
jne 0x5ba015
nop word [rax + rax]
mov rcx, rdi
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], r15
call fcn.005b5bb0
mov rcx, rsi
call sub.msvcrt.dll_free
mov eax, 0xb
jmp 0x5ba047

Function at 0x5c0b20
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
test rcx, rcx
je 0x5c0b53
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, esi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rbx
add rsp, 0x28
pop rbx
pop rsi
ret
xor ebx, ebx
jmp 0x5c0b49
Function at 0x5c0b60
Capabilities:
Get thread local storage value

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov edi, ecx
mov rcx, qword [0x0065df90]
call fcn.005c0b20
mov rsi, rax
mov dword [rax + 0x28], 5
lea eax, [rdi - 1]
cmp eax, 1
jbe 0x5c0b98
mov ecx, 1
call sub.msvcrt.dll_exit
test byte [rsi + 0x194], 1
jne 0x5c0c12
mov rbx, qword [0x0065df88]
test rbx, rbx
je 0x5c0c07
mov r13, qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbp, qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x5c0bef
mov r8, qword [rbx]
test r8, r8
je 0x5c0bd3
mov rcx, qword [rbx + 8]
call r8
mov rdx, qword [rbx + 0x10]
mov rcx, qword [0x0065df88]
call fcn.005b9840
mov rbx, qword [0x0065df88]
test rbx, rbx
je 0x5c0c07
call r13
mov ecx, dword [rbx]
mov r14d, eax
call r12
mov ecx, r14d
mov rbx, rax
call rbp
test rbx, rbx
jne 0x5c0bc4
lea rcx, [rsi + 0x70]
mov edx, edi
call sub.msvcrt.dll_longjmp
or ecx, 0xffffffff
cmp edi, 2
jne 0x5c0c29
cmp dword [0x0065df98], 0
jne 0x5c0c2e
call qword [sym.imp.msvcrt.dll__endthreadex]
mov ecx, dword [rsi + 0x48]
jmp 0x5c0c1a
mov dword [rsp + 0x2c], ecx
call fcn.005b6630
mov ecx, dword [rsp + 0x2c]
jmp 0x5c0c23
Function at 0x5c7180
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov esi, 1
test edx, edx
mov rbx, rcx
cmovg esi, edx
cmp edx, 0x3ffffff
jg 0x5c71f8
movsxd rdx, dword [rcx]
movsxd r8, esi
shl r8, 3
test edx, edx
je 0x5c71d8
mov rax, qword [0x0064aec0]
shl rdx, 3
mov rcx, qword [rcx + 8]
call qword [rax]
mov edx, dword [rbx + 4]
mov ecx, dword [rbx + 4]
sar edx, 0x1f
xor ecx, edx
sub ecx, edx
cmp ecx, esi
jg 0x5c7228
mov qword [rbx + 8], rax
mov dword [rbx], esi
add rsp, 0x28
pop rbx
pop rsi
ret
mov rax, qword [0x0064ae80]
mov rcx, r8
call qword [rax]
mov qword [rbx + 8], rax
mov dword [rbx], esi
add rsp, 0x28
pop rbx
pop rsi
ret
mov ecx, 2
call qword [fcn.005ea490]
lea rcx, str.gmp:_overflow_in_mpz_type_n
mov r9, rax
mov r8d, 0x1a
mov edx, 1
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
nop word [rax + rax]
mov dword [rbx + 4], 0
jmp 0x5c71cb

Function at 0x5e2810
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.005ea490
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.005ea490
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]
Function at 0x5e2880
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x0065e5b4]
mov r12, rcx
mov rsi, rdx
mov rbx, r8
test edi, edi
jle 0x5e2a28
mov rax, qword [0x0065e5b8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp r12, rdx
jb 0x5e28cc
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x5e2957
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x5e28b0
mov rcx, r12
call fcn.005e35e0
mov rbp, rax
test rax, rax
je 0x5e2a62
mov rax, qword [0x0065e5b8]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call fcn.005e3710
mov ecx, dword [rbp + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x0065e5b8]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x5e2a71
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x5e2950
sub eax, 4
and eax, 0xfffffffb
jne 0x5e29e0
add dword [0x0065e5b4], 1
cmp ebx, 8
jae 0x5e2988
test bl, 4
jne 0x5e2a30
test ebx, ebx
je 0x5e2979
movzx eax, byte [rsi]
mov byte [r12], al
test bl, 2
jne 0x5e2a50
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi]
lea rcx, [r12 + 8]
and rcx, 0xfffffffffffffff8
mov qword [r12], rax
mov eax, ebx
mov rdx, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], rdx
sub r12, rcx
add ebx, r12d
sub rsi, r12
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x5e2979
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x5e29ba
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
add rdi, qword [0x0065e5b8]
mov qword [rdi + 8], rcx
mov r9, rdi
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x5e2950
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.005e2810
nop dword [rax]
xor edi, edi
jmp 0x5e28d7
mov eax, dword [rsi]
mov ebx, ebx
mov dword [r12], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r12 + rbx - 4], eax
jmp 0x5e2979
mov ebx, ebx
movzx eax, word [rsi + rbx - 2]
mov word [r12 + rbx - 2], ax
jmp 0x5e2979
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.005e2810
mov rax, qword [0x0065e5b8]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call fcn.005e2810
nop
nop dword [rax]
Function at 0x5e3250
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x0065e8a0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x0065e880]
test rbx, rbx
je 0x5e32a4
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x5e329b
test r12, r12
je 0x5e329b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x5e3280
lea rcx, [0x0065e8a0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x5e35e0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x0064aef0]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x5e3659
mov rcx, r10
call fcn.005e34b0
test eax, eax
je 0x5e3659
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x5e3656
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x5e364d
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x5e3659
add r8, 0x28
cmp r8, r9
jne 0x5e3638
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret
Function at 0x140002850
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, r8
mov rdi, rdx
nop word cs:[rax + rax]
mov eax, dword [0x141dc0348]
sub eax, dword [0x141dc034c]
or eax, 0xe7e8cd45
imul eax, eax, 0xb130a158
and eax, 0xc3133d78
cmp eax, 0xfb88550e
ja 0x140002870
test rsi, rsi
je 0x1400031b1
mov rbx, qword [rcx]
lea r12, [0x141dbb194]
mov r13, qword [sym.imp.KERNEL32.dll_HeapFree]
mov ebp, 0xd260edb1
nop word cs:[rax + rax]
mov eax, dword [0x141dc0350]
xor edx, edx
div dword [0x141dc0354]
imul eax, eax, 0x31b88947
cmp eax, 0x3206e26d
je 0x140002aa0
nop
mov r14d, dword [0x141dc0358]
imul r14d, dword [0x141dc035c]
add r14d, 0x42d2d9a6
and r14d, 0xae291845
xor r14d, 0xdf8cb7f4
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call fcn.140088720
cmp r14d, 0xb08c691a
ja 0x140002aa0
mov rcx, rdx
test rax, rax
je 0x140002980
mov eax, dword [0x141dc0368]
sub eax, dword [0x141dc036c]
add eax, 0xd165ffe7
xor eax, 0x70330063
or eax, 0x86ccf684
cmp eax, 0x69bac453
jb 0x140002927
mov r8d, ecx
and r8d, 3
mov eax, dword [str.TM._fS]
and eax, dword [0x141dc0374]
or eax, 0x24d95ea3
imul eax, eax, 0xfea621f8
cmp eax, 0x3f5fc6aa
jb 0x140002950
movsxd rax, dword [r12 + r8*4]
add rax, r12
jmp rax
mov eax, dword [0x141dc0360]
or eax, dword [0x141dc0364]
imul eax, eax, 0x21318611
cmp eax, 0x86c92c55
je 0x140002980
test rcx, rcx
je 0x1400031c7
nop word cs:[rax + rax]
mov eax, dword [0x141dc0418]
xor eax, dword [0x141dc041c]
and eax, 0x1ad119a9
imul eax, eax, 0x2152b455
and eax, 0x49be9096
cmp eax, 0xe34430c8
ja 0x1400029b0
sub rsi, rcx
jb 0x1400031d0
nop dword [rax]
mov eax, dword [0x141dc0428]
or eax, dword [0x141dc042c]
and eax, 0x2009a40
add eax, 0x85492654
cmp eax, 0x33ae1fb1
jb 0x1400029e0
mov eax, dword [0x141dc0430]
imul eax, dword [0x141dc0434]
cmp eax, 0x9db9dcc8
je 0x1400029fd
add rdi, rcx
nop word cs:[rax + rax]
mov eax, dword [0x141dc0438]
and eax, dword [0x141dc043c]
xor eax, 0xcdab4c02
add eax, 0x55231bba
and eax, 0xc1fb1c3b
cmp eax, 0xac3d5851
ja 0x140002a20
jmp 0x140003180
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call fcn.140088720
jmp 0x1400028e0
mov eax, dword [0x141dc04b0]
xor eax, dword [0x141dc04b4]
imul eax, eax, 0x10fa5a3a
cmp eax, 0x77d10ee5
je 0x140003180
test rsi, rsi
jne 0x1400028c0
jmp 0x1400031b1
xor ecx, ecx
mov rax, rcx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x141dba6e0]
jmp 0x1400031b3
ud2
Function at 0x14000d370
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
nop word [rax + rax]
mov eax, dword [0x141dc15f8]
or eax, dword [0x141dc15fc]
imul eax, eax, 0x587dc75f
cmp eax, 0x2ecd04b9
je 0x14000d380
movzx eax, byte [rsi]
xor ecx, ecx
nop
test cl, cl
jne 0x14000d3a0
cmp rax, 0x12
je 0x14000d3f0
cmp eax, 0x13
je case.0x14000d3cb.0
cmp rax, 0x10
ja case.default.0x14000d3cb
lea rcx, [0x141dbb2e4]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
xor eax, eax
nop
test al, al
jne 0x14000d3d0
mov ebx, 0x10
cmp qword [rsi + 8], 0
jne 0x14000d52a
jmp case.0x14000d3cb.0
mov eax, dword [0x141dc1608]
and eax, dword [0x141dc160c]
xor eax, 0x40000000
or eax, 0xbc9bb6db
add eax, 0x4138dc27
cmp eax, 0xf7163573
jb 0x14000d3f0
mov rsi, qword [rsi + 8]
mov rax, qword [rsi]
mov rdi, qword [rax + 0x10]
mov eax, dword [0x141dc1610]
or eax, dword [0x141dc1614]
add eax, 0x779242e4
and eax, 0x9f5c7d09
xor eax, 0xea8c22a9
cmp eax, 0xc26b4551
jbe 0x14000d576
jmp 0x14000d59b
mov eax, dword [0x141dc1648]
add eax, dword [0x141dc164c]
and eax, 0x86a00402
cmp eax, 0x7b42ef74
je case.0x14000d3cb.13
mov rcx, qword [rsi + 0x10]
nop dword [rax]
mov eax, dword [0x141dc1650]
xor edx, edx
div dword [0x141dc1654]
add eax, 0xef855fb5
xor eax, 0xd83e9874
cmp eax, 0x227bc97a
jb 0x14000d470
mov ebx, 8
jmp 0x14000d4f4
mov eax, dword [0x141dc1620]
xor eax, dword [0x141dc1624]
and eax, 0x5a6dd411
add eax, 0xf8616f27
cmp eax, 0x96cf08a7
ja case.default.0x14000d3cb
xor eax, eax
nop
test al, al
jne 0x14000d4c0
mov rcx, qword [rsi + 8]
nop dword [rax + rax]
mov eax, dword [0x141dc1628]
xor edx, edx
div dword [0x141dc162c]
or eax, 0x5feded6e
add eax, 0xf437f855
cmp eax, 0x85eb33fd
ja 0x14000d4d0
mov ebx, 0x10
test rcx, rcx
jne 0x14000d52a
jmp case.0x14000d3cb.0
mov rax, qword [rsi + 8]
nop
mov ecx, dword [0x141dc1640]
sub ecx, dword [0x141dc1644]
xor ecx, 0x2af9f839
add ecx, 0x95158752
cmp ecx, 0x7b4ee960
jb 0x14000d500
mov ebx, 0x10
test rax, rax
je case.0x14000d3cb.0
mov eax, dword [0x141dc1630]
sub eax, dword [0x141dc1634]
and eax, 0x362bef62
imul eax, eax, 0xd5c4bd64
cmp eax, 0x7e7740ee
jne 0x14000d5a2
jmp 0x14000d5df
mov eax, dword [0x141dc1600]
and eax, dword [0x141dc1604]
xor eax, 0x6351ea41
imul eax, eax, 0xf1ebe978
cmp eax, 0xb52f53d2
je case.0x14000d3cb.0
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov eax, dword [0x141dc1618]
imul eax, dword [0x141dc161c]
imul rbx, rax, 0x14712bd3
shr rbx, 0x3b
mov rcx, rsi
call rdi
cmp ebx, 0xbd793c0d
jne case.0x14000d3cb.0
mov rcx, rsi
call rdi
jmp 0x14000d576
mov eax, dword [0x141dc1638]
xor edx, edx
div dword [0x141dc163c]
mov edi, eax
not edi
or edi, 0x24468280
and edi, 0x24e6aa9b
mov r8, qword [rsi + rbx]
mov rcx, qword [0x141ddc4e0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp edi, 0xd6855207
jbe case.0x14000d3cb.0
mov r8, qword [rsi + rbx]
mov rcx, qword [0x141ddc4e0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x14000d5a2
Function at 0x140017660
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
inc rdx
mov rcx, rdx
rol rcx, 2
xor rcx, rdx
mov edx, dword [0x141dc2ae8]
imul edx, dword [0x141dc2aec]
imul edx, edx, 0xc2c49331
xor edx, 0xd04ddedd
imul edx, edx, 0x4234c7c2
cmp edx, 0xd2bfd322
ja 0x140017670
movzx ecx, cx
add rax, rcx
ret

Function at 0x140017740
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov rcx, 0xffffffffdd256472
sub rcx, rdx
xor rcx, 0x44198fa
imul rcx, rcx, 0xffffffffe86799cc
add rcx, 0xffffffffe86799cc
nop word cs:[rax + rax]
mov edx, dword [0x141dc2b00]
imul edx, dword [0x141dc2b04]
and edx, 0x46de489b
xor edx, 0x3c9ff174
add edx, 0x3f000619
cmp edx, 0x7a8ed4ff
jb 0x140017770
mov rdx, rcx
rol rdx, 4
nop
mov r8d, dword [0x141dc2b08]
or r8d, dword [0x141dc2b0c]
cmp r8d, 0xb2e24557
je 0x1400177a0
xor edx, ecx
movzx ecx, dx
add rax, rcx
ret

Function at 0x140017860
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
xor rdx, 0xffffffff87e6ab0a
mov rcx, rdx
shr rcx, 9
nop word cs:[rax + rax]
mov r8d, dword [0x141dc2b18]
and r8d, dword [0x141dc2b1c]
and r8d, 0x6da93d84
imul r8d, r8d, 0x38c66156
xor r8d, 0xc48315b5
cmp r8d, 0xa604fb80
ja 0x140017880
xor rcx, rdx
add rcx, 0xffffffffa94a4a2f
mov rdx, rcx
rol rdx, 6
nop dword [rax]
mov r8d, dword [0x141dc2b20]
and r8d, dword [0x141dc2b24]
add r8d, 0x5114815a
or r8d, 0xd53e53c5
imul r8d, r8d, 0x4a877fe6
cmp r8d, 0x639178bb
je 0x1400178c0
xor edx, ecx
movzx ecx, dx
add rax, rcx
ret

Function at 0x1400179b0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
rol r8, 7
mov rax, rcx
xor r8, rdx
add r8, 0x47e95d86
xor r8, 0xffffffffca17153b
mov rdx, r8
rol rdx, 1
xor rdx, r8
mov rcx, rdx
rol rcx, 4
xor rcx, rdx
nop
mov edx, dword [0x141dc2b40]
sub edx, dword [0x141dc2b44]
xor edx, 0xcfcc615b
imul rdx, rdx, 0xf054a49
shr rdx, 0x3b
cmp edx, 0xd8a83112
je 0x1400179e0
movzx ecx, cx
add rax, rcx
ret

Function at 0x140017a80
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
imul rcx, rdx, 0xfdd2e50
mov rdx, rcx
shr rdx, 0x14
xor rdx, rcx
mov rcx, rdx
shr rcx, 4
nop dword [rax + rax]
mov r8d, dword [0x141dc2b50]
or r8d, dword [0x141dc2b54]
or r8d, 0xcbb88943
add r8d, 0xe5ecc400
imul r8, r8, 0x5e0b0525
shr r8, 0x3e
cmp r8d, 0x19c7db78
ja 0x140017aa0
xor rcx, rdx
mov rdx, rcx
rol rdx, 7
xor edx, ecx
movzx ecx, dx
add rax, rcx
nop word cs:[rax + rax]
mov ecx, dword [0x141dc2b58]
xor ecx, dword [0x141dc2b5c]
or ecx, 0xea39a2ef
imul ecx, ecx, 0x77da2070
cmp ecx, 0xb138d030
je 0x140017af0
ret

Function at 0x140017b20
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
not rax
rol rax, 4
xor rax, rdx
mov rdx, rax
rol rdx, 5
xor rdx, rax
mov rax, rdx
rol rax, 2
xor eax, edx
movzx eax, ax
add rax, rcx
nop word cs:[rax + rax]
mov ecx, dword [0x141dc2b60]
add ecx, dword [0x141dc2b64]
and ecx, 0xf11abf60
xor ecx, 0xc59551bf
add ecx, 0x7badb259
cmp ecx, 0x579855fe
jb 0x140017b50
ret