joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401434c0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rax, qword [rcx + 0x30]
mov eax, dword [rax]
test al, 1
jne 0x1401435d8
mov dil, 1
cmp qword [rsi + 0x48], 0
jne 0x1401435cf
mov eax, dword [0x14035c0b0]
mov ecx, dword [0x14034fed0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1401435e6
mov ecx, dword [0x1403411e0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14014354a
mov rcx, qword [0x14035c0a0]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x14035c0a8]
jne 0x14014354a
mov rax, qword [rax + rcx]
test rax, rax
je 0x14014354a
mov rcx, qword [rax + 0x10]
mov qword [rsi + 0x70], rcx
mov eax, dword [rax + 8]
mov dword [rsi + 0x68], eax
mov eax, dword [0x14035c080]
mov ecx, dword [0x14034fed0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140143628
mov ecx, dword [0x1403411e0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1401435cf
mov rcx, qword [0x14035c070]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x14035c078]
jne 0x1401435cf
mov rax, qword [rax + rcx]
test rax, rax
je 0x1401435cf
mov rcx, qword [rax + 0x20]
mov qword [rsi + 0x48], rcx
movups xmm0, xmmword [rax + 0x48]
mov rcx, qword [rax + 0x58]
mov qword [rsi + 0x60], rcx
movups xmmword [rsi + 0x50], xmm0
mov dil, 1
cmp byte [rax + 0x7c], 0
mov cl, 1
jne 0x1401435cc
cmp qword [rax + 0x60], 0
setne cl
mov byte [rsi + 0x7c], cl
mov eax, edi
add rsp, 0x28
pop rdi
pop rsi
ret
cmp r8b, 2
je 0x14014366a
xor edi, edi
jmp 0x1401435cf
lea rcx, [0x14035c0b0]
call fcn.14016f8b4
cmp dword [0x14035c0b0], 0xffffffff
jne 0x14014350a
xorps xmm0, xmm0
movups xmmword [0x14035c0a0], xmm0
lea rcx, [0x14035c0a0]
xor edx, edx
call fcn.140041af0
lea rcx, [0x14035c0b0]
call fcn.14016ef8c
jmp 0x14014350a
lea rcx, [0x14035c080]
call fcn.14016f8b4
cmp dword [0x14035c080], 0xffffffff
jne 0x14014356f
xorps xmm0, xmm0
movups xmmword [0x14035c070], xmm0
lea rcx, [0x14035c070]
xor edx, edx
call fcn.140041af0
lea rcx, [0x14035c080]
call fcn.14016ef8c
jmp 0x14014356f
cmp qword [rsi + 0x30], 0
jne 0x1401435e2
mov rdi, rcx
add rdi, 0x70
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x140143697
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
jmp 0x1401434d7
mov rcx, rdi
call fcn.140047ff0
jmp 0x140143689
Function at 0x140145280
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rdi, r8
mov rsi, rcx
mov rax, qword [0x14033f038]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov byte [rcx], 0
mov rax, qword [0x1403428e0]
and rax, r8
cmp rax, qword [0x1403428c8]
je 0x140145492
mov qword [rsi + 0x10], rdi
test byte [0x140341290], 0x19
je 0x1401452e8
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rcx, [rsp + 0x50]
mov qword [rcx + 0x18], rax
xorps xmm0, xmm0
movaps xmmword [rcx], xmm0
movups xmmword [rcx + 9], xmm0
call fcn.1401b25f0
mov rdi, qword [rsi + 0x10]
test rdi, rdi
je 0x14014530a
mov al, byte [rdi]
test al, 1
je 0x14014530a
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140171860
mov rax, rsi
add rsp, 0x78
pop rdi
pop rsi
ret
mov eax, dword [0x14035aad8]
mov ecx, dword [0x14034fed0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14014544a
mov ecx, dword [0x1403411e0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1401452f3
mov rcx, qword [0x14035aac8]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x14035aad0]
jne 0x1401452f3
mov rax, qword [rax + rcx]
test rax, rax
je 0x1401452f3
mov eax, eax
cmp eax, 1
jne 0x1401452f3
mov byte [rsi], 1
mov dword [rsi + 4], 0
mov ecx, 2
call fcn.1400735d0
test byte [0x140341290], 0x19
je 0x1401452f3
mov rax, qword [0x1403411f8]
lea rcx, [0x14003b7a0]
cmp rax, rcx
jne 0x140145482
lea rdi, [rsp + 0x50]
mov qword [rdi], 0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rdi]
movabs rcx, 0x8637bd05af6
cmp rax, rcx
jg 0x1401453d9
imul rax, rax, 0xf4240
cqo
idiv qword [0x140354790]
jmp 0x1401453fb
mov rcx, qword [0x140354790]
cqo
idiv rcx
imul r8, rax, 0xf4240
imul rax, rdx, 0xf4240
cqo
idiv rcx
add rax, r8
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
lea rdx, [0x140341290]
lea r8, str.ScopedMayLoadLibraryAtBackgroundPriority_:_Priority_Increased
mov cl, 0x42
xor r9d, r9d
call fcn.1401b9550
jmp 0x1401452f3
lea rcx, [0x14035aad8]
call fcn.14016f8b4
cmp dword [0x14035aad8], 0xffffffff
jne 0x14014532f
lea rcx, [0x14035aac8]
xor edx, edx
call fcn.140041af0
lea rcx, [0x14035aad8]
call fcn.14016ef8c
jmp 0x14014532f
lea rcx, [rsp + 0x50]
call qword [case.0x140211850.0]
jmp 0x140145400
mov rcx, rdi
call fcn.140156f20
jmp 0x1401452b5
Function at 0x140146e10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
movabs rdi, 0x7fffffffffffffff
mov dword [rsp + 0x20], 1
mov edx, 0x3e8
mov r8d, 0x989680
mov r9d, 0x32
call fcn.14009a730
mov rcx, rax
lea rax, [rsi + rdi]
add rax, 2
cmp rax, 2
jb 0x140146eca
movabs rdx, 0x20c49ba5e353f7cf
mov rax, rsi
imul rdx
mov rax, rdx
shr rdx, 0x3f
sar rax, 7
add rax, rdx
cmp rax, 0xffffffff80000001
mov rdx, 0xffffffff80000000
cmovge rdx, rax
mov eax, 0x7fffffff
cmp rdx, rax
cmovge rdx, rax
mov rax, qword [rcx]
mov rax, qword [rax + 0x28]
lea r8, [0x1400ab550]
cmp rax, r8
jne 0x140146ed7
xor eax, eax
test edx, edx
cmovg eax, edx
cmp edx, 0x7fffffff
mov edx, 0x7ffffffe
cmovne edx, eax
mov rcx, qword [rcx + 0x18]
mov r8d, 1
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400a0920
lea rax, [rdi + 1]
test rsi, rsi
cmovns rax, rdi
jmp 0x140146e70
mov r8, qword [case.0x140211850.0]
add rsp, 0x28
pop rdi
pop rsi
jmp r8
mov rdx, rcx
lea rcx, str.Microsoft.WatsonUploader.Transport.Timing.HitRoundTrip
jmp 0x140146e10

Function at 0x140146ef0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movabs r9, 0x7fffffffffffffff
mov rax, qword [rdx]
lea rdx, [rax + r9]
add rdx, 2
cmp rdx, 2
jb 0x140146f7e
movabs rdx, 0x20c49ba5e353f7cf
imul rdx
mov r8, rdx
mov rax, rdx
shr rax, 0x3f
sar r8, 7
add r8, rax
cmp r8, 0xffffffff80000001
mov rdx, 0xffffffff80000000
cmovge rdx, r8
mov eax, 0x7fffffff
cmp rdx, rax
cmovge rdx, rax
mov rax, qword [rcx]
mov rax, qword [rax + 0x28]
lea r8, [0x1400ab550]
cmp rax, r8
jne 0x140146f8b
xor eax, eax
test edx, edx
cmovg eax, edx
cmp edx, 0x7fffffff
mov edx, 0x7ffffffe
cmovne edx, eax
mov rcx, qword [rcx + 0x18]
mov r8d, 1
jmp fcn.1400a0920
lea r8, [r9 + 1]
test rax, rax
cmovns r8, r9
jmp 0x140146f29
mov r8, qword [case.0x140211850.0]
jmp r8

Function at 0x14014a1d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
sub rsp, 0x30
mov esi, edx
lea eax, [r8 + 1]
movsxd r9, eax
mov dword [rsp + 0x20], 1
mov edx, 1
call fcn.1400cea30
mov rcx, qword [rax]
mov r8, qword [rcx + 0x28]
lea rcx, [0x1400ab550]
cmp r8, rcx
jne 0x14014a22c
xor ecx, ecx
test esi, esi
cmovg ecx, esi
cmp esi, 0x7fffffff
mov edx, 0x7ffffffe
cmovne edx, ecx
mov rcx, qword [rax + 0x18]
mov r8d, 1
add rsp, 0x30
pop rsi
jmp fcn.1400a0920
mov r9, qword [case.0x140211850.0]
mov rcx, rax
mov edx, esi
mov rax, r8
add rsp, 0x30
pop rsi
jmp r9

Function at 0x14014a390
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
sub rsp, 0x30
mov esi, edx
lea eax, [r8 + 1]
movsxd r9, eax
mov dword [rsp + 0x20], 1
mov edx, 1
call fcn.1400c9f80
mov rcx, qword [rax]
mov r8, qword [rcx + 0x28]
lea rcx, [0x1400ab550]
cmp r8, rcx
jne 0x14014a3ec
xor ecx, ecx
test esi, esi
cmovg ecx, esi
cmp esi, 0x7fffffff
mov edx, 0x7ffffffe
cmovne edx, ecx
mov rcx, qword [rax + 0x18]
mov r8d, 1
add rsp, 0x30
pop rsi
jmp fcn.1400a0920
mov r9, qword [case.0x140211850.0]
mov rcx, rax
mov edx, esi
mov rax, r8
add rsp, 0x30
pop rsi
jmp r9
Function at 0x14014b070
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
sub rsp, 0x48
movaps xmmword [rsp + 0x30], xmm6
mov rax, qword [0x14033f038]
xor rax, rsp
mov qword [rsp + 0x28], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rcx, [rsp + 0x20]
mov qword [rcx], rax
mov edx, 8
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x14014b0e5
movabs rax, 0x1fffffffffffff
and rax, qword [rsp + 0x20]
cvtsi2sd xmm0, rax
mov edx, 0xffffffcb
call fcn.140192eac
movapd xmm6, xmm0
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140171860
movapd xmm0, xmm6
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
int3

Function at 0x14014b0f0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test rdx, rdx
je 0x14014b12c
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x14014b136
add rdi, rbx
sub rsi, rbx
jne 0x14014b10a
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
int3
Function at 0x140152a40
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov eax, dword [rdx]
mov dword [rcx], eax
mov eax, 1
lock xadd dword [0x14035d30c], eax
mov dword [rcx + 4], eax
mov eax, dword [0x14035d308]
mov ecx, dword [0x14034fed0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140152b29
mov ecx, dword [0x1403411e0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140152bad
mov rcx, qword [0x14035d2f8]
shl rcx, 4
mov qword [rax + rcx], rsi
mov ecx, dword [0x14035d300]
mov rdx, qword [0x14035d2f8]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov eax, dword [0x14035d320]
mov ecx, dword [0x14034fed0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140152b6b
lea rdi, [rsi + 4]
mov ecx, dword [0x1403411e0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140152bc0
mov rcx, qword [0x14035d310]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [0x14035d318]
mov rdx, qword [0x14035d310]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rax, rsi
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x14035d308]
call fcn.14016f8b4
cmp dword [0x14035d308], 0xffffffff
jne 0x140152a82
xorps xmm0, xmm0
movups xmmword [0x14035d2f8], xmm0
lea rcx, [0x14035d2f8]
xor edx, edx
call fcn.140041af0
lea rcx, [0x14035d308]
call fcn.14016ef8c
jmp 0x140152a82
lea rcx, [0x14035d320]
call fcn.14016f8b4
cmp dword [0x14035d320], 0xffffffff
jne 0x140152ae1
xorps xmm0, xmm0
movups xmmword [0x14035d310], xmm0
lea rcx, [0x14035d310]
xor edx, edx
call fcn.140041af0
lea rcx, [0x14035d320]
call fcn.14016ef8c
jmp 0x140152ae1
test rsi, rsi
je 0x140152abc
call fcn.140001120
jmp 0x140152a98
test rdi, rdi
je 0x140152b1f
call fcn.140001120
jmp 0x140152afb

Function at 0x140152be0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov byte [rcx], dl
mov rdi, qword [0x14035be50]
cmp rdi, 1
jbe 0x140152c2f
mov ecx, dword [0x1403411e0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140152c74
mov rcx, qword [rdi]
shl rcx, 4
mov qword [rax + rcx], rsi
mov ecx, dword [rdi + 8]
mov rdx, qword [rdi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x14035be50]
call fcn.14006d330
test al, al
je 0x140152c80
xorps xmm0, xmm0
movups xmmword [0x14035be58], xmm0
lea rbx, [0x14035be50]
lea rdi, [0x14035be58]
mov rcx, rdi
xor edx, edx
call fcn.140041af0
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.14006d410
jmp 0x140152bf9
test rsi, rsi
je 0x140152c24
call fcn.140001120
jmp 0x140152c0b
mov rdi, qword [0x14035be50]
jmp 0x140152bf9
Function at 0x140153010
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, qword [0x14035be50]
cmp rsi, 1
jbe 0x140153059
mov ecx, dword [0x1403411e0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140153052
mov rcx, qword [rsi]
shl rcx, 4
mov qword [rax + rcx], 0
mov ecx, dword [rsi + 8]
mov rdx, qword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x14035be50]
call fcn.14006d330
test al, al
je 0x14015309e
xorps xmm0, xmm0
movups xmmword [0x14035be58], xmm0
lea rdi, [0x14035be50]
lea rsi, [0x14035be58]
mov rcx, rsi
xor edx, edx
call fcn.140041af0
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
mov r9, rdi
call fcn.14006d410
jmp 0x140153023
mov rsi, qword [0x14035be50]
jmp 0x140153023

Function at 0x1401530b0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x14035d308]
mov ecx, dword [0x14034fed0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140153177
mov ecx, dword [0x1403411e0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140153113
mov rcx, qword [0x14035d2f8]
shl rcx, 4
mov qword [rax + rcx], 0
mov ecx, dword [0x14035d300]
mov rdx, qword [0x14035d2f8]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov eax, dword [0x14035d320]
mov ecx, dword [0x14034fed0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1401531b9
mov ecx, dword [0x1403411e0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140153172
mov rcx, qword [0x14035d310]
shl rcx, 4
mov qword [rax + rcx], 0
mov ecx, dword [0x14035d318]
mov rdx, qword [0x14035d310]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
ret
lea rcx, [0x14035d308]
call fcn.14016f8b4
cmp dword [0x14035d308], 0xffffffff
jne 0x1401530d9
xorps xmm0, xmm0
movups xmmword [0x14035d2f8], xmm0
lea rcx, [0x14035d2f8]
xor edx, edx
call fcn.140041af0
lea rcx, [0x14035d308]
call fcn.14016ef8c
jmp 0x1401530d9
lea rcx, [0x14035d320]
call fcn.14016f8b4
cmp dword [0x14035d320], 0xffffffff
jne 0x140153138
xorps xmm0, xmm0
movups xmmword [0x14035d310], xmm0
lea rcx, [0x14035d310]
xor edx, edx
call fcn.140041af0
lea rcx, [0x14035d320]
call fcn.14016ef8c
jmp 0x140153138

Function at 0x140153290
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdi, qword [0x14035bdf0]
cmp rdi, 1
jbe 0x1401532b9
mov rcx, rdi
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.140073660
lea rcx, [0x14035bdf0]
call fcn.14006d330
test al, al
je 0x1401532fe
xorps xmm0, xmm0
movups xmmword [0x14035bdf8], xmm0
lea rbx, [0x14035bdf0]
lea rdi, [0x14035bdf8]
mov rcx, rdi
xor edx, edx
call fcn.140041af0
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.14006d410
jmp 0x1401532a7
mov rdi, qword [0x14035bdf0]
jmp 0x1401532a7
Function at 0x140157120
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov eax, dword [0x14035d308]
mov ecx, dword [0x14034fed0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140157191
mov ecx, dword [0x1403411e0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, 0xffffffff
and rax, 0xfffffffffffffffc
je 0x140157182
mov rdx, qword [0x14035d2f8]
shl rdx, 4
mov r8d, dword [rax + rdx + 8]
cmp r8d, dword [0x14035d300]
jne 0x140157182
mov rax, qword [rax + rdx]
test rax, rax
jne 0x14015718d
mov dword [rsi], ecx
mov rax, rsi
add rsp, 0x20
pop rsi
ret
mov ecx, dword [rax]
jmp 0x140157182
lea rcx, [0x14035d308]
call fcn.14016f8b4
cmp dword [0x14035d308], 0xffffffff
jne 0x140157149
xorps xmm0, xmm0
movups xmmword [0x14035d2f8], xmm0
lea rcx, [0x14035d2f8]
xor edx, edx
call fcn.140041af0
lea rcx, [0x14035d308]
call fcn.14016ef8c
jmp 0x140157149
Function at 0x14015a6f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
mov rax, qword [rcx]
mov rdx, qword [rcx + 8]
sub rdx, rax
je 0x14015a72c
mov r8, rdx
shr r8, 2
xor r9d, r9d
lea r10, [0x140311e40]
movzx r11d, r8b
movzx esi, byte [rax + r9]
xor esi, r11d
shr r8d, 8
xor r8d, dword [r10 + rsi*4]
inc r9
cmp rdx, r9
jne 0x14015a70e
jmp 0x14015a72f
xor r8d, r8d
cmp r8d, dword [rcx + 0x18]
sete al
pop rsi
ret

Function at 0x14015a930
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov edi, r8d
mov rbx, rdx
mov rsi, rcx
cmp dword [0x14035b9d0], 0
mov r8, qword [rcx]
je 0x14015a962
mov rcx, qword [rsi + 0x28]
mov rdx, rbx
mov r9d, edi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.14003f150
movsxd rax, edi
mov rcx, rbx
mov rdx, r8
mov r8, rax
call fcn.1401730b0
test rbx, rbx
je 0x14015a993
mov ecx, dword [rsi + 0x4c]
mov r8d, edi
mov rdx, rbx
call fcn.14008e580
mov ebx, eax
mov dword [rsi + 0x4c], ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
xor ebx, ebx
test edi, edi
jne 0x14015a988
lea rcx, [0x14035b9d8]
lea rdx, [0x140131340]
xor ebx, ebx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
jmp 0x14015a988

Function at 0x14015a9c0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov esi, ecx
mov rax, qword [0x14033f038]
xor rax, rsp
mov qword [rsp + 0x28], rax
movabs r14, 0xaaaaaaaaaaaaaaaa
movsxd rbx, edx
movsxd rax, ecx
sub rbx, rax
inc rbx
mov rax, 0xffffffffffffffff
xor edx, edx
div rbx
mov rdi, rdx
lea rcx, [rsp + 0x20]
mov qword [rcx], r14
mov edx, 8
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x14015aa68
mov r15, 0xfffffffffffffffe
sub r15, rdi
lea rdi, [rsp + 0x20]
mov rax, qword [rsp + 0x20]
cmp rax, r15
ja 0x14015aa52
xor edx, edx
div rbx
add esi, edx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140171860
mov eax, esi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov qword [rsp + 0x20], r14
mov rcx, rdi
mov edx, 8
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x14015aa26
int3
Function at 0x14015b350
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xb8
mov esi, r8d
mov rbx, rdx
mov r14, rcx
mov rax, qword [0x14033f038]
xor rax, rsp
mov qword [rsp + 0xb0], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r15, [rsp + 0x50]
mov qword [r15 + 0x50], rax
movaps xmm0, xmmword [0x140301d60]
movaps xmmword [r15 + 0x40], xmm0
movaps xmmword [r15 + 0x30], xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
lea rdx, str.WriteAtCurrentPos
lea r8, str....._base_files_file_win.cc
lea r12, [rsp + 0x30]
mov rcx, r12
mov r9d, 0x99
call fcn.14004f270
xor edi, edi
mov rcx, r15
mov rdx, r12
xor r8d, r8d
call fcn.1400cd290
test esi, esi
js 0x14015b43e
lea r15, [rsp + 0x30]
mov dword [r15], 0xaaaaaaaa
mov rcx, qword [r14]
mov qword [rsp + 0x20], 0
mov rdx, rbx
mov r8d, esi
mov r9, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sbb edi, edi
or edi, dword [r15]
lea rcx, [rsp + 0x50]
call fcn.1400cd300
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140171860
mov eax, edi
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov edi, 0xffffffff
jmp 0x14015b411
Function at 0x14015b880
Capabilities:
Read file via mapping

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
movaps xmmword [rsp + 0x80], xmm6
mov rsi, rdx
mov rax, qword [0x14033f038]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rax, qword [rcx]
inc rax
cmp rax, 1
ja 0x14015b8e8
mov byte [rsi], 0
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140171860
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rbx, r9
test r9, r9
je 0x14015b8b9
mov rdi, r8
mov rax, r8
add rax, rbx
jb 0x14015b8b9
mov r14, rcx
cmp rax, qword [rcx + 0x10]
ja 0x14015b8b9
mov rax, qword [0x14035aa08]
lea r9, [rbx + 0xffff]
and r9, 0xffffffffffff0000
cmp r9, rbx
jb 0x14015b8b9
mov rdx, rax
movabs rcx, 0xaaaaaaaaaaaaaaaa
add rdx, r9
cmovae rcx, rdx
jb 0x14015b8b9
movabs rdx, 0x7ffffffff
cmp rcx, rdx
ja 0x14015b8b9
mov qword [rsp + 0x30], r9
mov r9, qword [rsp + 0x30]
lock cmpxchg qword [0x14035aa08], rcx
jne 0x14015ba1c
call fcn.140087dd0
mov r15, rax
neg r15
and r15, rdi
mov r12, rdi
sub r12, r15
xor eax, eax
cmp dword [r14 + 8], 0
setne al
movaps xmm6, xmmword [0x140301d60]
movups xmmword [rsi], xmm6
movups xmmword [rsi + 0x10], xmm6
add rbx, r12
mov rcx, qword [r14]
mov r13, r15
shr r13, 0x20
lea ebp, [rax + rax]
add ebp, 4
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x38], rcx
mov edx, ebp
mov r8d, r13d
mov r9d, r15d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r14, rax
test rax, rax
je 0x14015ba3a
lea rbx, [rsp + 0x40]
movaps xmmword [rbx + 0x20], xmm6
movaps xmmword [rbx + 0x10], xmm6
movaps xmmword [rbx], xmm6
mov r8d, 0x30
mov rcx, r14
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
mov rcx, qword [rbx + 0x18]
sub rcx, r14
add rcx, qword [rbx + 8]
test rax, rax
cmove rcx, rax
mov byte [rsi], 1
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], r14
test rdi, rdi
je 0x14015b8bc
sub rcx, r12
jb 0x14015ba7d
add r14, r12
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], r14
jmp 0x14015b8bc
mov r8, rax
add r8, r9
cmovae rcx, r8
jb 0x14015b8b9
cmp rcx, rdx
jbe 0x14015b951
jmp 0x14015b8b9
call fcn.14014b620
mov qword [rsp + 0x20], rbx
mov rcx, qword [rsp + 0x38]
mov edx, ebp
mov r8d, r13d
mov r9d, r15d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r14, rax
test rax, rax
jne 0x14015b9bf
call fcn.14014b620
mov byte [rsi], 0
mov rax, qword [rsp + 0x30]
lock sub qword [0x14035aa08], rax
jmp 0x14015b8bc
int3