joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140020ccc
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edx, ecx
mov esi, 0x104
mov ecx, esi
call fcn.14002a750
mov ecx, esi
mov rdx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor ebp, ebp
movsxd rbx, eax
test eax, eax
je 0x140020d15
lea ecx, [rbp + 0x5c]
cmp word [rdi + rbx*2 - 2], cx
je 0x140020d15
mov word [rdi + rbx*2], cx
inc ebx
sub esi, ebx
mov ecx, esi
call fcn.14002a890
mov rsi, qword [rsp + 0x40]
movsxd rax, ebx
mov rbx, qword [rsp + 0x30]
mov word [rdi + rax*2], bp
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140020d3c
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x380]
sub rsp, 0x480
or rbx, 0xffffffffffffffff
xor edi, edi
test rcx, rcx
je 0x140020e9e
cmp word [rcx], di
je 0x140020e9e
mov rdx, rcx
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call sub.msvcrt.dll_wcsncpy
lea rcx, [rsp + 0x20]
mov word [rbp + 0x128], di
call sub.msvcrt.dll_wcslen
mov rdx, rax
cdqe
lea rcx, [rsp + rax*2 + 0x1e]
lea eax, [rdx - 2]
cmp eax, 1
ja 0x140020ddb
cmp word [rsp + 0x22], 0x3a
jne 0x140020ddb
cmp edx, 2
jne 0x140020dc2
lea rdx, [0x14007f7f8]
lea rcx, [rsp + 0x20]
call sub.msvcrt.dll_wcscat
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x140020e9e
jmp 0x140020e76
cmp word [rcx], 0x5c
je 0x140020de7
cmp word [rcx], 0x2f
jne 0x140020df0
mov word [rcx], di
sub rcx, 2
jmp 0x140020ddb
lea rdx, [rbp + 0x130]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rcx, rax
cmp rax, rbx
je 0x140020e37
test byte [rbp + 0x130], 0x10
je 0x140020e1c
mov rbx, 0xfffffffffffffffe
jmp 0x140020e2f
mov ebx, dword [rbp + 0x14c]
mov eax, dword [rbp + 0x150]
shl rbx, 0x20
or rbx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x140020e9e
movzx ecx, word [rsp + 0x20]
movzx eax, word [rsp + 0x22]
cmp cx, 0x5c
jne 0x140020e4c
cmp ax, cx
je 0x140020e62
cmp cx, 0x2f
jne 0x140020e57
cmp ax, cx
je 0x140020e62
cmp cx, 0x2e
jne 0x140020e9e
cmp ax, cx
jne 0x140020e9e
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140020e7f
test al, 0x10
je 0x140020e9e
mov rbx, 0xfffffffffffffffe
jmp 0x140020e9e
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov rcx, rbx
mov rbx, 0xfffffffffffffffe
cmp eax, 1
cmova rcx, rbx
mov rbx, rcx
lea r11, [rsp + 0x480]
mov rax, rbx
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140020eb8
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x230
xor ebx, ebx
test rcx, rcx
je 0x140020f42
mov rdx, rcx
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call sub.msvcrt.dll_wcsncpy
lea rcx, [rsp + 0x20]
mov word [rsp + 0x228], bx
call sub.msvcrt.dll_wcslen
lea rcx, [rsp + 0x20]
lea rcx, [rcx + rax*2]
lea rax, [rsp + 0x20]
cmp rcx, rax
jbe 0x140020f2e
lea rdx, [rcx - 2]
movzx eax, word [rdx]
sub ax, 0x20
cmp ax, 0x3c
ja 0x140020f2e
movabs r8, 0x1000000000008001
bt r8, rax
jae 0x140020f2e
lea rax, [rsp + 0x20]
mov rcx, rdx
cmp rdx, rax
ja 0x140020f00
mov word [rcx], bx
lea rcx, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cdqe
jmp 0x140020f44
xor eax, eax
add rsp, 0x230
pop rbx
ret

Function at 0x1400212f0
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rax, qword [0x1400a7f30]
xor r13d, r13d
mov rsi, r8
mov r15, rdx
mov rdi, rcx
mov r14d, r13d
test rax, rax
jne 0x140021342
lea r8, [fcn.140021464]
lea edx, [rax + 0x10]
mov ecx, 0x260
call fcn.1400296d0
mov qword [0x1400a7f30], rax
mov rdx, rdi
mov rcx, rax
call fcn.140029608
mov rbx, rax
test rax, rax
je 0x140021443
test r15, r15
lea rbp, [0x14007f58c]
cmovne rbp, r15
test rsi, rsi
je 0x140021372
cmp word [rsi], r13w
jne 0x140021379
lea rsi, [0x14007f7d8]
mov rcx, rbp
call sub.msvcrt.dll_wcslen
mov rcx, rsi
mov r12, rax
call sub.msvcrt.dll_wcslen
mov rcx, qword [0x1400a5390]
add eax, 2
xor edx, edx
add eax, r12d
movsxd r8, eax
add r8, r8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r15, rax
test rax, rax
je 0x14002142c
mov rdx, rbp
mov rcx, rax
call sub.msvcrt.dll_wcscpy
test r12d, r12d
je 0x1400213d9
movsxd rax, r12d
cmp word [rbp + rax*2 - 2], 0x5c
je 0x1400213d9
lea rdx, [0x14007f7f8]
mov rcx, r15
call sub.msvcrt.dll_wcscat
mov rdx, rsi
mov rcx, r15
call sub.msvcrt.dll_wcscat
lea rdx, [rbx + 0xc]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rbx], rax
cmp rax, 0xffffffffffffffff
je 0x140021400
mov dword [rbx + 8], r13d
jmp 0x140021412
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x140021415
mov dword [rbx + 8], 1
mov r14, rbx
mov rcx, qword [0x1400a5390]
mov r8, r15
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test r14, r14
jne 0x140021443
mov rcx, qword [0x1400a7f30]
cmp rdi, 0xffffffffffffffff
cmove rdi, rbx
mov rdx, rdi
call fcn.14002953c
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rax, r14
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x140022f28
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1400a8a60], eax
add rsp, 0x28
ret
Function at 0x1400289c0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov esi, 0x40
mov ecx, esi
call fcn.14002a750
mov rdx, rbx
mov rcx, rax
mov rdi, rax
call fcn.14006d778
or rdx, 0xffffffffffffffff
inc rdx
cmp word [rdi + rdx*2], 0
jne 0x1400289f0
sub esi, edx
mov ecx, esi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.14002a890

Function at 0x1400293a4
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x1400a8000]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rax, rax
jne 0x140029425
mov r8, qword [0x1400a7ff8]
mov rcx, qword [0x1400a5390]
lea edx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x1400a8000]
mov rdx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [0x1400a7ff0]
jmp 0x140029411
mov rdx, qword [rbx + 0x18]
test rdx, rdx
je 0x14002940e
mov rcx, qword [rbx + 0x10]
add rcx, rdi
call rdx
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1400293fc
lea rcx, [0x140029308]
mov rdx, rdi
call fcn.14006ddf4
mov rbx, qword [rsp + 0x30]
lea rax, [rdi + rsi]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14002943c
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebx, ecx
mov rbp, r8
mov rdi, rdx
and ecx, 7
je 0x140029466
mov eax, 8
sub eax, ecx
add ebx, eax
mov rcx, qword [0x1400a7ff8]
test rcx, rcx
jne 0x1400294a9
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rcx, qword [0x1400a5390]
movsxd r8, ebx
mov edx, 8
mov dword [0x1400a8000], eax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x1400a8000]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, qword [0x1400a7ff8]
mov rsi, rcx
movsxd rax, ebx
add rcx, rax
mov qword [0x1400a7ff8], rcx
mov ecx, dword [0x1400a8000]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r9, qword [0x1400a7ff8]
mov rcx, qword [0x1400a5390]
mov r8, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, dword [0x1400a8000]
mov rdx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test rdi, rdi
jne 0x1400294fd
test rbp, rbp
je 0x140029524
lea rcx, [0x1400a7ff0]
mov edx, 0x28
call fcn.14002a0d8
mov qword [rax], rsi
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rbp
test rdi, rdi
je 0x140029524
lea rcx, [rbx + rsi]
call rdi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rax, rsi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14002a180
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
xor r8d, r8d
mov edx, 0x1000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov qword [0x1400a8d60], rax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1400a2968], eax
call fcn.14002abc0
add rsp, 0x28
ret
Function at 0x14002a2e0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov ecx, dword [0x1400a2968]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsp + 0x30]
add rsp, 0x48
ret

Function at 0x14002a330
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov ecx, dword [0x1400a2968]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x28], rax
movsxd rax, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x10]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
cmp qword [rax], 0
jne 0x14002a396
movsxd rax, dword [rsp + 0x20]
add rax, 0xa
mov r8, rax
xor edx, edx
mov rcx, qword [0x1400a8d60]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rsp + 0x40]
mov qword [rcx], rax
jmp 0x14002a3c1
movsxd rax, dword [rsp + 0x20]
add rax, 0xa
mov r9, rax
mov rax, qword [rsp + 0x40]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x1400a8d60]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rcx, qword [rsp + 0x40]
mov qword [rcx], rax
movsxd rax, dword [rsp + 0x20]
xor edx, edx
mov ecx, 2
div rcx
movsxd rcx, dword [rsp + 0x48]
mov rdx, qword [rsp + 0x28]
add rcx, qword [rdx]
mov r8d, eax
mov rdx, rcx
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call fcn.14002ac90
movsxd rax, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 0x10], rax
add rsp, 0x38
ret

Function at 0x14002a480
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov ecx, dword [0x1400a2968]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x10]
add rax, 2
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x10], rax
add rsp, 0x38
ret

Function at 0x14002a4b0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov ecx, dword [0x1400a2968]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
add rsp, 0x38
ret

Function at 0x14002a4e0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov ecx, dword [0x1400a2968]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
add rsp, 0x38
ret

Function at 0x14002a570
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [0x1400a2968]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x10], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x20]
add rax, qword [rcx + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
add rsp, 0x38
ret
Function at 0x14002a610
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
cmp dword [0x1400a2968], 0xffffffff
jne 0x14002a63f
call fcn.14002a180
mov ecx, dword [0x1400a2968]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, rax
lea rcx, [0x14002a5c0]
call fcn.14006ddf4
jmp 0x14002a670
mov ecx, dword [0x1400a2968]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x14002a670
call fcn.14002abc0
mov ecx, dword [0x1400a2968]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, rax
lea rcx, [0x14002a5c0]
call fcn.14006ddf4
add rsp, 0x28
ret

Function at 0x14002a750
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x48
mov ecx, dword [0x1400a2968]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x28], rax
cmp dword [rsp + 0x58], 0xffffffff
jne 0x14002a780
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x10]
mov dword [rsp + 0x58], eax
movsxd rax, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x10]
lea rax, [rcx + rax*2]
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 8]
sub rcx, 4
cmp rax, rcx
jl 0x14002a7f2
mov eax, dword [rsp + 0x20]
add eax, 0x4000
cdqe
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 8]
add rax, 0xa
mov r9, rax
mov rax, qword [rsp + 0x28]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x1400a8d60]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rcx, qword [rsp + 0x28]
mov qword [rcx], rax
jmp 0x14002a850
mov rax, qword [rsp + 0x28]
cmp qword [rax + 8], 0x100000
jle 0x14002a850
cmp dword [rsp + 0x20], 0x100000
jge 0x14002a813
mov dword [rsp + 0x20], 0x100000
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 8]
add rax, 0xa
mov r9, rax
mov rax, qword [rsp + 0x28]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x1400a8d60]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rcx, qword [rsp + 0x28]
mov qword [rcx], rax
movsxd rax, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x28]
add rax, qword [rcx]
mov qword [rsp + 0x30], rax
movsxd rax, dword [rsp + 0x58]
movsxd rcx, dword [rsp + 0x50]
lea rax, [rax + rcx*2]
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 0x10], rax
mov rax, qword [rsp + 0x30]
add rsp, 0x48
ret

Function at 0x14002a890
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [0x1400a2968]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov eax, dword [rsp + 0x40]
shl eax, 1
cdqe
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx + 0x10]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x10], rax
add rsp, 0x38
ret
Function at 0x14002a8d0
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [0x1400a2968]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x10], rax
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx]
xor edx, edx
mov word [rcx + rax], dx
add rsp, 0x38
ret

Function at 0x14002ab20
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov ecx, dword [0x1400a2968]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
cmp qword [rsp + 0x40], rax
jb 0x14002ab7b
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x20]
add rax, qword [rcx + 0x10]
cmp qword [rsp + 0x40], rax
ja 0x14002ab7b
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
inc rax
jmp 0x14002ab7d
xor eax, eax
add rsp, 0x38
ret

Function at 0x14002ab90
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [0x1400a2968]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx]
lea rax, [rcx + rax - 1]
add rsp, 0x38
ret

Function at 0x14002abc0
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x38
mov r8d, 0x18
xor edx, edx
mov rcx, qword [0x1400a8d60]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x20], rax
mov r8d, 0x10
xor edx, edx
mov rcx, qword [0x1400a8d60]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rsp + 0x20]
mov qword [rcx], rax
mov rax, qword [rsp + 0x20]
mov qword [rax + 8], 0x10
mov rax, qword [rsp + 0x20]
mov qword [rax + 0x10], 0
mov rdx, qword [rsp + 0x20]
mov ecx, dword [0x1400a2968]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x38
ret
Function at 0x140033d68
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov dword [rax + 0x10], edx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x10
movsxd r10, ecx
xor edi, edi
xor ecx, ecx
mov eax, r10d
mov r14, r9
mov r11d, edx
mov rbx, r10
imul eax, edx
movsxd rbp, eax
test edx, edx
jle 0x140033df2
lea eax, [r10*2 - 1]
mov r15, rbx
mov rdx, r9
movsxd rsi, eax
shl r15, 2
mov r9d, r11d
movsxd rax, ecx
add edi, r10d
lea rcx, [rax + rsi]
movss xmm0, dword [r8 + rcx*4]
addss xmm0, dword [r8 + rax*4]
movss dword [rdx], xmm0
movss xmm1, dword [r8 + rax*4]
subss xmm1, dword [r8 + rcx*4]
lea ecx, [rdi + rdi]
movss dword [rdx + rbp*4], xmm1
add rdx, r15
dec r9
jne 0x140033dbc
cmp r10d, 2
jl 0x140033f79
je 0x140033f29
xor r9d, r9d
xor eax, eax
test r11d, r11d
jle 0x140033f13
mov rsi, r11
mov r11, qword [rsp + 0x60]
xor edi, edi
cmp rbx, 2
jle 0x140033efb
movsxd rdx, eax
lea eax, [rax + r10*2]
lea r12, [r11 + 4]
movsxd rcx, eax
mov rax, rdi
mov r11, rbp
sub r11, rdx
sub rax, rdx
lea r15, [r8 + rcx*4]
add r11, rdi
lea rax, [rax*4 + 4]
lea rcx, [r8 - 4]
lea rcx, [rcx + rdx*4]
shl r11, 2
lea rdx, [rbx - 3]
sub rax, r8
sub r11, r8
mov r13, rbp
add rax, r14
shr rdx, 1
neg r13
add r11, r14
inc rdx
mov rbx, rax
add rcx, 8
sub r15, 8
lea rax, [rcx + r11]
movss xmm0, dword [rcx]
addss xmm0, dword [r15 - 4]
movss dword [rax + r13*4], xmm0
movss xmm0, dword [rcx + 4]
movss xmm3, dword [rcx]
subss xmm3, dword [r15 - 4]
subss xmm0, dword [r15]
movaps xmm1, xmm3
movss dword [rcx + rbx], xmm0
movss xmm2, dword [rcx + 4]
mulss xmm1, dword [r12 - 4]
addss xmm2, dword [r15]
movaps xmm0, xmm2
mulss xmm0, dword [r12]
subss xmm1, xmm0
movss dword [rax], xmm1
mulss xmm3, dword [r12]
mulss xmm2, dword [r12 - 4]
add r12, 8
addss xmm3, xmm2
movss dword [rcx + r11 + 4], xmm3
dec rdx
jne 0x140033e78
mov r11, qword [rsp + 0x60]
mov rbx, r10
add r9d, r10d
add rdi, rbx
lea eax, [r9 + r9]
dec rsi
jne 0x140033e1a
mov r11d, dword [rsp + 0x48]
mov eax, r10d
and eax, 0x80000001
jge 0x140033f24
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
je 0x140033f79
dec r10d
test r11d, r11d
jle 0x140033f79
movsxd rax, r10d
movsxd rcx, r10d
mov r9, rbx
lea rdx, [r14 + rax*4]
lea rax, [r8 + rcx*4]
shl r9, 2
mov ecx, r11d
shl rbx, 3
movss xmm0, dword [rax]
addss xmm0, xmm0
movss dword [rdx], xmm0
movss xmm1, dword [rax + 4]
add rax, rbx
addss xmm1, xmm1
xorps xmm1, xmmword [0x14007ff30]
movss dword [rdx + rbp*4], xmm1
add rdx, r9
dec rcx
jne 0x140033f4d
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x10
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140035514
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov dword [rsp + 0x10], edx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r10, ecx
xor edi, edi
mov r14, r8
mov ebx, r10d
mov r11, r10
imul ebx, edx
mov dword [rsp + 0x70], ebx
test edx, edx
jle 0x14003559b
lea eax, [r10 + r10]
mov r12, r10
mov r13, r10
movsxd rsi, eax
shl r12, 2
shl r13, 3
dec rsi
movsxd rbp, ebx
mov r15d, edx
lea rsi, [r9 + rsi*4]
movss xmm0, dword [r8 + rbp*4]
lea eax, [rdi + rdi]
add edi, r10d
addss xmm0, dword [r8]
movsxd rcx, eax
movss dword [r9 + rcx*4], xmm0
movss xmm0, dword [r8]
subss xmm0, dword [r8 + rbp*4]
add r8, r12
movss dword [rsi], xmm0
add rsi, r13
dec r15
jne 0x140035567
cmp r10d, 2
jl 0x14003572f
je 0x1400356e2
test edx, edx
jle 0x1400356cc
mov rdi, r10
mov r8, r10
mov rcx, r14
shl rdi, 3
neg r8
xor ebp, ebp
mov r13d, edx
mov rdx, qword [rsp + 0x90]
shl r8, 2
sub rcx, r9
lea r12, [rdi + r9]
movsxd rsi, ebx
lea rax, [r10 + r10]
lea r15, [r9 - 4]
cmp r10d, 2
jle 0x1400356ac
lea rax, [rdx + 4]
mov rdi, r12
mov qword [rsp + 0x18], rax
mov rax, rsi
mov rbx, qword [rsp + 0x18]
sub rax, rbp
shl rax, 2
sub rax, r9
add rax, r14
mov qword [rsp + 0x20], rax
lea eax, [r10 - 3]
mov rdx, qword [rsp + 0x20]
shr eax, 1
inc eax
mov qword [rsp], rax
mov rax, r15
movss xmm2, dword [rdx + rax + 0xc]
add rax, 8
sub rdi, 8
movss xmm1, dword [rdx + rax]
movaps xmm3, xmm2
mulss xmm2, dword [rbx - 4]
mulss xmm3, dword [rbx]
movaps xmm0, xmm1
mulss xmm0, dword [rbx - 4]
mulss xmm1, dword [rbx]
add rbx, 8
dec qword [rsp]
addss xmm3, xmm0
subss xmm2, xmm1
movaps xmm0, xmm2
addss xmm0, dword [rcx + rax + 4]
movss dword [rax + 4], xmm0
subss xmm2, dword [rcx + rax + 4]
movaps xmm0, xmm3
movss dword [rdi], xmm2
addss xmm0, dword [rcx + rax]
movss dword [rax], xmm0
movss xmm1, dword [rcx + rax]
subss xmm1, xmm3
movss dword [rdi - 4], xmm1
jne 0x14003562a
mov rdx, qword [rsp + 0x90]
mov rdi, r10
lea rax, [r10 + r10]
shl rdi, 3
add r15, rdi
add rbp, rax
add r12, rdi
add rcx, r8
add rsi, r10
dec r13
jne 0x1400355e6
mov edx, dword [rsp + 0x78]
mov ebx, dword [rsp + 0x70]
mov eax, r10d
and eax, 0x80000001
jge 0x1400356dd
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
je 0x14003572f
dec r10d
test edx, edx
jle 0x14003572f
lea eax, [r10 + rbx]
mov rbx, r11
shl r11, 2
movsxd rcx, eax
movsxd r10, r10d
shl rbx, 3
lea r8, [r11 + r9]
lea r9, [r14 + rcx*4]
sub r10, rcx
mov ecx, edx
movss xmm0, dword [r9]
xorps xmm0, xmmword [0x14007ff30]
movss dword [r8], xmm0
mov eax, dword [r9 + r10*4]
add r9, r11
mov dword [r8 - 4], eax
add r8, rbx
dec rcx
jne 0x14003570b
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140042090
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, r8d
mov r10, rdx
lea rbx, [0x14008e130]
cmp r8d, 8
jl 0x14004215a
mov r11d, r9d
shr r11, 3
mov eax, r11d
neg eax
lea r9d, [r9 + rax*8]
nop dword [rax]
movzx eax, byte [r10 + 1]
movzx edx, byte [r10]
add r10, 8
shl edx, 8
or edx, eax
movzx eax, byte [r10 - 6]
shl edx, 8
or edx, eax
movzx eax, byte [r10 - 5]
shl edx, 8
or edx, eax
xor ecx, edx
mov r8d, ecx
mov eax, ecx
shr rax, 0x10
movzx ecx, al
mov eax, r8d
mov ecx, dword [rbx + rcx*4 + 0x1800]
shr rax, 8
movzx edx, al
mov eax, r8d
xor ecx, dword [rbx + rdx*4 + 0x1400]
shr rax, 0x18
xor ecx, dword [rbx + rax*4 + 0x1c00]
movzx eax, byte [r10 - 2]
xor ecx, dword [rbx + rax*4 + 0x400]
movzx eax, byte [r10 - 3]
xor ecx, dword [rbx + rax*4 + 0x800]
movzx eax, byte [r10 - 4]
xor ecx, dword [rbx + rax*4 + 0xc00]
movzx eax, byte [r10 - 1]
xor ecx, dword [rbx + rax*4]
movzx eax, r8b
xor ecx, dword [rbx + rax*4 + 0x1000]
dec r11
jne 0x1400420c0
test r9d, r9d
je 0x140042180
nop
movzx eax, byte [r10]
mov edx, ecx
lea r10, [r10 + 1]
shr rdx, 0x18
xor rdx, rax
mov eax, ecx
mov ecx, dword [rbx + rdx*4]
shl eax, 8
xor ecx, eax
dec r9d
jne 0x140042160
mov rbx, qword [rsp + 8]
mov eax, ecx
ret