joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e0bd0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x88
movdqa xmmword [rsp + 0x70], xmm13
movdqa xmmword [rsp + 0x60], xmm12
movdqa xmmword [rsp + 0x50], xmm11
movdqa xmmword [rsp + 0x40], xmm10
movdqa xmmword [rsp + 0x30], xmm9
movdqa xmmword [rsp + 0x20], xmm8
movdqa xmmword [rsp + 0x10], xmm7
movdqa xmmword [rsp], xmm6
movdqu xmm0, xmmword [rcx]
movdqu xmm3, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rcx + 0x20]
movdqu xmm1, xmmword [rcx + 0x30]
movd xmm4, r8d
pxor xmm4, xmm0
add rdx, 0xffffffffffffffc0
add rcx, 0x40
cmp rdx, 0x40
jb 0x1400e0d05
movabs rax, 0x154442bd4
movq xmm9, rax
movdqa xmm8, xmmword [0x1401eab50]
nop word cs:[rax + rax]
nop dword [rax]
movdqa xmm6, xmm4
pclmulqdq xmm6, xmm9, 0
movdqa xmm12, xmm3
pclmulqdq xmm12, xmm9, 0
movdqa xmm11, xmm2
pclmulqdq xmm11, xmm9, 0
movdqa xmm10, xmm1
pclmulqdq xmm10, xmm9, 0
movdqa xmm0, xmm4
pclmulqdq xmm0, xmm8, 0x11
movdqa xmm5, xmm3
pclmulqdq xmm5, xmm8, 0x11
movdqa xmm7, xmm2
pclmulqdq xmm7, xmm8, 0x11
movdqa xmm13, xmm1
pclmulqdq xmm13, xmm8, 0x11
movdqu xmm4, xmmword [rcx]
pxor xmm4, xmm6
pxor xmm4, xmm0
movdqu xmm3, xmmword [rcx + 0x10]
pxor xmm3, xmm12
pxor xmm3, xmm5
movdqu xmm2, xmmword [rcx + 0x20]
pxor xmm2, xmm11
pxor xmm2, xmm7
movdqu xmm1, xmmword [rcx + 0x30]
pxor xmm1, xmm10
pxor xmm1, xmm13
add rdx, 0xffffffffffffffc0
add rcx, 0x40
cmp rdx, 0x3f
ja 0x1400e0c60
movabs rax, 0x1751997d0
movq xmm0, rax
movdqa xmm5, xmm4
pclmulqdq xmm5, xmm0, 0
pxor xmm5, xmm3
movdqa xmm3, xmmword [0x1401eab60]
pclmulqdq xmm4, xmm3, 0x11
pxor xmm4, xmm5
movdqa xmm5, xmm4
pclmulqdq xmm5, xmm0, 0
pxor xmm5, xmm2
pclmulqdq xmm4, xmm3, 0x11
pxor xmm4, xmm5
movdqa xmm2, xmm4
pclmulqdq xmm2, xmm0, 0
pxor xmm2, xmm1
pclmulqdq xmm4, xmm3, 0x11
pxor xmm4, xmm2
cmp rdx, 0x10
jb 0x1400e0d94
movdqu xmm1, xmmword [rcx]
movdqa xmm2, xmm4
pclmulqdq xmm2, xmm0, 0
pxor xmm2, xmm1
pclmulqdq xmm4, xmm3, 0x11
pxor xmm4, xmm2
add rcx, 0x10
add rdx, 0xfffffffffffffff0
cmp rdx, 0xf
ja 0x1400e0d6a
movdqa xmm0, xmmword [0x1401eab60]
pclmulqdq xmm0, xmm4, 1
psrldq xmm4, 8
pxor xmm4, xmm0
pxor xmm0, xmm0
pxor xmm1, xmm1
pblendw xmm1, xmm4, 3
psrldq xmm4, 4
movabs rax, 0x163cd6124
movq xmm2, rax
pclmulqdq xmm2, xmm1, 0
pxor xmm2, xmm4
pxor xmm1, xmm1
pblendw xmm1, xmm2, 3
pclmulqdq xmm1, xmmword [0x1401eab70], 0x10
pblendw xmm1, xmm0, 0xfc
movabs rax, 0x1db710641
movq xmm0, rax
pclmulqdq xmm0, xmm1, 0
pxor xmm0, xmm2
pextrd eax, xmm0, 1
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
movaps xmm12, xmmword [rsp + 0x60]
movaps xmm13, xmmword [rsp + 0x70]
add rsp, 0x88
ret
Function at 0x1400f0150
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xc0
mov esi, r9d
mov r14, r8
mov r12, rdx
mov r15, rcx
mov rax, qword [0x14021b038]
xor rax, rsp
mov qword [rsp + 0xb8], rax
movabs r13, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x60]
mov qword [rdi + 0x50], r13
movaps xmm0, xmmword [0x1401e90c0]
movaps xmmword [rdi + 0x40], xmm0
movaps xmmword [rdi + 0x30], xmm0
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
lea rdx, str.Read
lea r8, str..._.._base_files_file_win.cc
lea rbx, [rsp + 0x40]
mov rcx, rbx
mov r9d, 0x3e
call fcn.1400e8370
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.1400f4950
test esi, esi
js 0x1400f0285
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], 0
call fcn.1400f43b0
test al, al
jne 0x1400f028c
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r12
lea r9, [rsp + 0x2c]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [r15]
mov qword [rsp + 0x20], rbx
mov rdx, r14
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400f0272
mov esi, dword [rsp + 0x2c]
lea rcx, [rsp + 0x30]
call fcn.1400f4420
lea rcx, [rsp + 0x60]
call fcn.1400f49b0
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.140111870
mov eax, esi
add rsp, 0xc0
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x26
setne sil
neg esi
jmp 0x1400f0239
mov esi, 0xffffffff
jmp 0x1400f0243
mov r9d, esi
lea rdx, str.File::Read
lea rcx, [rsp + 0x30]
mov r8, r15
call fcn.140177030
jmp 0x1400f01ff
Function at 0x1400f02b0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov r14d, r9d
mov r15, r8
mov r13, rdx
mov r12, rcx
mov rax, qword [0x14021b038]
xor rax, rsp
mov qword [rsp + 0xc0], rax
movabs rbp, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x60]
mov qword [rsi + 0x50], rbp
movaps xmm0, xmmword [0x1401e90c0]
movaps xmmword [rsi + 0x40], xmm0
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rdx, str.Write
lea r8, str..._.._base_files_file_win.cc
lea rdi, [rsp + 0x40]
mov rcx, rdi
mov r9d, 0x73
call fcn.1400e8370
xor ebx, ebx
mov rcx, rsi
mov rdx, rdi
xor r8d, r8d
call fcn.1400f4950
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], 0
call fcn.1400f43b0
test al, al
jne 0x1400f03cc
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r13
lea rsi, [rsp + 0x2c]
mov dword [rsi], 0xaaaaaaaa
mov rcx, qword [r12]
mov qword [rsp + 0x20], rdi
mov rdx, r15
mov r8d, r14d
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sbb ebx, ebx
or ebx, dword [rsi]
lea rcx, [rsp + 0x30]
call fcn.1400f4420
lea rcx, [rsp + 0x60]
call fcn.1400f49b0
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140111870
mov eax, ebx
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movsxd r9, r14d
lea rdx, str.File::Write
lea rcx, [rsp + 0x30]
mov r8, r12
call fcn.140177030
jmp 0x1400f0356

Function at 0x1400f03f0
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov qword [rcx], 0
test rdx, rdx
je 0x1400f0437
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x1400f0451
lea rax, [rdi + 1]
cmp rax, 2
jb 0x1400f042f
mov qword [rsi], rdi
call fcn.1400e8390
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [rsi + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp rax, rdi
je 0x1400f0467
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.1400e8390
mov rcx, qword [rsi]
call fcn.1400f0600
mov qword [rsi], 0
jmp 0x1400f041d
int3
Function at 0x1400f2c50
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x190
mov rax, qword [0x14021b038]
xor rax, rsp
mov qword [rsp + 0x188], rax
mov eax, dword [0x140223f98]
mov ecx, dword [0x14021ef3c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400f2cb3
mov rax, qword [0x140223f90]
mov esi, dword [rax]
mov rcx, qword [rsp + 0x188]
xor rcx, rsp
call fcn.140111870
mov eax, esi
add rsp, 0x190
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x140223f98]
call fcn.140110b10
cmp dword [0x140223f98], 0xffffffff
jne 0x1400f2c8d
lea rsi, [rsp + 0x6c]
mov r8d, 0x118
mov rcx, rsi
xor edx, edx
call fcn.140114200
mov dword [rsi - 4], 0x11c
lea rsi, [rsp + 0x68]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
lea rdi, [rsp + 0x2c]
mov dword [rdi], 0
mov ecx, dword [rsi + 4]
mov edx, dword [rsi + 8]
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
mov ecx, 0x80
call fcn.1401109bc
mov rsi, rax
mov edi, dword [rdi]
mov eax, dword [0x140223fd0]
mov ecx, dword [0x14021ef3c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400f2d73
lea r8, [0x140223fa0]
lea rdx, [rsp + 0x68]
mov rcx, rsi
mov r9d, edi
call fcn.140077030
mov qword [0x140223f90], rsi
lea rcx, [0x140223f98]
call fcn.140110ba8
jmp 0x1400f2c8d
lea rcx, [0x140223fd0]
call fcn.140110b10
cmp dword [0x140223fd0], 0xffffffff
jne 0x1400f2d44
xorps xmm0, xmm0
lea rbx, [rsp + 0x30]
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movaps xmm0, xmmword [rbx]
movaps xmm1, xmmword [rbx + 0x10]
movaps xmm2, xmmword [rbx + 0x20]
movups xmmword [0x140223fc0], xmm2
movups xmmword [0x140223fb0], xmm1
movups xmmword [0x140223fa0], xmm0
lea rcx, [0x140223fd0]
call fcn.140110ba8
jmp 0x1400f2d44

Function at 0x1400f2e10
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
xor eax, eax
test r8d, r8d
sete al
xor ebx, ebx
test edx, edx
sete bl
xor ecx, ecx
mov edx, ebx
mov r8d, eax
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi], 0
test rax, rax
je 0x1400f2ea7
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x1400f2e91
lea rax, [rdi + 1]
cmp rax, 2
jb 0x1400f2e6e
mov qword [rsi], rdi
call fcn.1400e8390
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsi]
mov byte [rsi + 8], 1
inc rax
cmp rax, 1
jbe 0x1400f2eab
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.1400e8390
mov rcx, qword [rsi]
call fcn.1400f0600
mov qword [rsi], 0
jmp 0x1400f2e5c
mov byte [rsi + 8], 1
int3
Function at 0x1400f3740
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
movapd xmmword [rsp + 0x40], xmm6
mov rsi, rcx
mov rax, qword [0x14021b038]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x20]
call fcn.1400f05e0
mov qword [rsp + 0x28], 0
mov rcx, qword [rsp + 0x20]
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryThreadCycleTime]
movsd xmm0, qword [0x140224060]
xorpd xmm6, xmm6
ucomisd xmm0, xmm6
jne 0x1400f379d
jnp 0x1400f3802
ucomisd xmm0, xmm6
jne 0x1400f37a9
jnp 0x1400f392c
movsd xmm1, qword [rsp + 0x28]
unpcklps xmm1, xmmword [0x1401e3dd0]
subpd xmm1, xmmword [0x1401e3de0]
movapd xmm2, xmm1
unpckhpd xmm2, xmm1
addsd xmm2, xmm1
divsd xmm2, xmm0
mulsd xmm2, qword [0x1401f7710]
cvttsd2si rax, xmm2
mov qword [rsi], rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140111870
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rbx, qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov r12d, eax
call rbx
mov rcx, rax
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x140224070]
mov ecx, dword [0x14021ef3c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400f3933
mov eax, dword [0x140224080]
mov ecx, dword [0x14021ef3c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400f396d
rdtsc
mov r14, rax
mov r15, rdx
xor edi, edi
lea rbx, [rsp + 0x30]
mov qword [rbx], rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rbp, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov qword [rbx], rdi
lea rdi, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub rbp, qword [0x140224078]
movq xmm1, rbp
punpckldq xmm1, xmmword [0x1401e3dd0]
subpd xmm1, xmmword [0x1401e3de0]
haddpd xmm1, xmm1
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rdi]
divsd xmm1, xmm0
xorpd xmm0, xmm0
movsd xmm2, qword [0x1401f7708]
ucomisd xmm2, xmm1
ja 0x1400f379d
shl r15, 0x20
or r14, r15
sub r14, qword [0x140224068]
movq xmm0, r14
punpckldq xmm0, xmmword [0x1401e3dd0]
subpd xmm0, xmmword [0x1401e3de0]
haddpd xmm0, xmm0
divsd xmm0, xmm1
movsd qword [0x140224060], xmm0
jmp 0x1400f379d
xor eax, eax
jmp 0x1400f37db
lea rcx, [0x140224070]
call fcn.140110b10
cmp dword [0x140224070], 0xffffffff
jne 0x1400f384c
rdtsc
shl rdx, 0x20
or rdx, rax
mov qword [0x140224068], rdx
lea rcx, [0x140224070]
call fcn.140110ba8
jmp 0x1400f384c
lea rcx, [0x140224080]
call fcn.140110b10
cmp dword [0x140224080], 0xffffffff
jne 0x1400f3871
lea rbx, [rsp + 0x30]
mov qword [rbx], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbx]
mov qword [0x140224078], rax
lea rcx, [0x140224080]
call fcn.140110ba8
jmp 0x1400f3871
Function at 0x1400fccf0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov edi, dword [0x140229568]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test esi, esi
jne 0x1400fcd1d
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400fcd13
Function at 0x1400ff860
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test rdx, rdx
je 0x1400ff898
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
mov rbx, rsi
cmp rsi, r14
jae 0x1400ff8a2
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x1400ff8a9
add rdi, rbx
sub rsi, rbx
jne 0x1400ff87a
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov ebx, 0xffffffff
jmp 0x1400ff882
int3

Function at 0x1401007d0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x14021eb08]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140100804
movsxd rcx, dword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 4]
jne 0x140100804
mov rax, qword [rax + rcx]
add rsp, 0x20
pop rsi
ret
xor eax, eax
jmp 0x1401007fe

Function at 0x140100810
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x14021eb08]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14010084e
movsxd rcx, dword [rsi]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rsi + 4]
movsxd rdx, dword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
test rdi, rdi
je 0x140100847
call fcn.14009c960
jmp 0x14010082e

Function at 0x1401012c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, ecx
test r8, r8
je 0x1401012ec
xor ecx, ecx
lea r9, [0x140200b20]
movzx r10d, al
movzx r11d, byte [rdx + rcx]
xor r11d, r10d
shr eax, 8
xor eax, dword [r9 + r11*4]
add rcx, 1
cmp r8, rcx
jne 0x1401012d0
ret
Function at 0x140102d40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
movzx eax, byte [rcx + 0x4f]
test al, al
js 0x140102dd8
test rax, rax
jne 0x140102dc7
cmp dword [rsi + 0x50], 0
jne 0x140102dc7
mov byte [rsi + 0x54], 0
mov rax, qword [rsi + 0x10]
mov qword [rsi + 8], rax
cmp rax, qword [rsi + 0x18]
je 0x140102db5
lea rdi, [rsi + 0x20]
movabs r14, 0x100003600
lea rcx, [rax + 1]
mov qword [rsi + 0x10], rcx
movzx edx, byte [rax]
mov rcx, rdi
xor r8d, r8d
call fcn.1400e4000
cmp rax, 0xffffffffffffffff
jne 0x140102da7
cmp dword [rsi + 0x58], 1
jne 0x140102df4
jmp 0x140102de1
mov rax, qword [rsi + 0x10]
mov qword [rsi + 8], rax
cmp rax, qword [rsi + 0x18]
jne 0x140102d83
mov byte [rsi + 0x54], 1
xor ebx, ebx
mov eax, ebx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.140193e00
mov rax, qword [rsi + 0x40]
jmp 0x140102d58
mov rax, qword [rsi + 8]
movzx eax, byte [rax]
cmp rax, 0x20
ja 0x140102df4
bt r14, rax
jb 0x140102da7
mov rax, qword [rsi + 0x10]
mov bl, 1
nop word [rax + rax]
cmp rax, qword [rsi + 0x18]
je 0x140102dbb
movzx edx, byte [rax]
mov rcx, rdi
xor r8d, r8d
call fcn.1400e4000
cmp rax, 0xffffffffffffffff
jne 0x140102dbb
cmp dword [rsi + 0x58], 1
mov rax, qword [rsi + 0x10]
je 0x140102e2e
add rax, 1
mov qword [rsi + 0x10], rax
jmp 0x140102e00
movzx ecx, byte [rax]
cmp rcx, 0x20
ja 0x140102e24
bt r14, rcx
jae 0x140102e24
jmp 0x140102dbb
Function at 0x1401070b0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, qword [0x140229b98]
cmp rsi, 1
jbe 0x1401070d3
mov rcx, rsi
xor edx, edx
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140100810
lea rcx, [0x140229b98]
call fcn.14008ba60
test al, al
je 0x140107119
mov qword [0x140229ba0], 0
lea rdi, [0x140229b98]
lea rsi, [0x140229ba0]
mov rcx, rsi
xor edx, edx
call fcn.14009cb70
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
mov r9, rdi
call fcn.14008bb00
jmp 0x1401070c3
mov rsi, qword [0x140229b98]
jmp 0x1401070c3

Function at 0x1401071b0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, qword [0x140229fb0]
cmp rsi, 1
jbe 0x1401071d3
mov rcx, rsi
xor edx, edx
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140100810
lea rcx, [0x140229fb0]
call fcn.14008ba60
test al, al
je 0x140107219
mov qword [0x140229fb8], 0
lea rdi, [0x140229fb0]
lea rsi, [0x140229fb8]
mov rcx, rsi
xor edx, edx
call fcn.14009cb70
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
mov r9, rdi
call fcn.14008bb00
jmp 0x1401071c3
mov rsi, qword [0x140229fb0]
jmp 0x1401071c3

Function at 0x14010bdc0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x14022a008]
mov ecx, dword [0x14021ef3c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14010bdf5
lea rcx, [0x14022a000]
add rsp, 0x28
jmp fcn.1401007d0
lea rcx, [0x14022a008]
call fcn.140110b10
cmp dword [0x14022a008], 0xffffffff
jne 0x14010bde5
mov qword [0x14022a000], 0
lea rcx, [0x14022a000]
xor edx, edx
call fcn.14009cb70
lea rcx, [0x14022a008]
call fcn.140110ba8
jmp 0x14010bde5

Function at 0x14010ff20
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x14022a558]
mov ecx, dword [0x14021ef3c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14010ff86
lea rcx, [0x14022a550]
xor edx, edx
call fcn.140100810
mov eax, dword [0x14022a568]
mov ecx, dword [0x14021ef3c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14010ffc2
lea rcx, [0x14022a560]
xor edx, edx
add rsp, 0x28
jmp fcn.140100810
lea rcx, [0x14022a558]
call fcn.140110b10
cmp dword [0x14022a558], 0xffffffff
jne 0x14010ff45
mov qword [0x14022a550], 0
lea rcx, [0x14022a550]
xor edx, edx
call fcn.14009cb70
lea rcx, [0x14022a558]
call fcn.140110ba8
jmp 0x14010ff45
lea rcx, [0x14022a568]
call fcn.140110b10
cmp dword [0x14022a568], 0xffffffff
jne 0x14010ff74
mov qword [0x14022a560], 0
lea rcx, [0x14022a560]
xor edx, edx
call fcn.14009cb70
lea rcx, [0x14022a568]
call fcn.140110ba8
jmp 0x14010ff74
Function at 0x140110010
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov eax, dword [0x14022a578]
mov ecx, dword [0x14021ef3c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14011004d
lea rcx, [0x14022a570]
mov rdx, rsi
add rsp, 0x20
pop rsi
jmp fcn.140100810
lea rcx, [0x14022a578]
call fcn.140110b10
cmp dword [0x14022a578], 0xffffffff
jne 0x140110039
mov qword [0x14022a570], 0
lea rcx, [0x14022a570]
xor edx, edx
call fcn.14009cb70
lea rcx, [0x14022a578]
call fcn.140110ba8
jmp 0x140110039
Function at 0x140144c00
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r14, rdx
mov rbp, rcx
mov rbx, qword [rcx + 0x10]
cmp rbx, qword [rcx + 0x18]
je 0x140144c3c
mov rax, qword [r14]
mov qword [rbx], rax
add qword [rbp + 0x10], 8
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r15, qword [rbp]
mov rdi, qword [rbp + 8]
mov rax, rdi
sub rax, r15
jbe 0x140144c99
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r12, rax
neg r12
shl rax, 3
mov r15, rdi
sub r15, rax
sub rbx, rdi
je 0x140144c88
mov rcx, r15
mov rdx, rdi
mov r8, rbx
call fcn.140113df0
mov rdi, qword [rbp + 8]
add rbx, r15
mov qword [rbp + 0x10], rbx
lea rax, [rdi + r12*8]
mov qword [rbp + 8], rax
jmp 0x140144c20
mov rax, rbx
sub rax, r15
mov rcx, rax
sar rcx, 2
test rax, rax
mov r13d, 1
cmovne r13, rcx
mov rax, r13
shr rax, 0x3d
jne 0x140144d30
mov r12, r13
shr r12, 2
lea rcx, [r13*8]
call fcn.1401109bc
lea r9, [rax + r12*8]
lea r8, [rax + r13*8]
mov r10, r9
sub rbx, rdi
je 0x140144d03
lea r10, [r9 + rbx]
sar rbx, 3
shl rbx, 3
lea rcx, [rax + r12*8]
xor edx, edx
mov rsi, qword [rdi + rdx]
mov qword [rcx + rdx], rsi
add rdx, 8
cmp rbx, rdx
jne 0x140144cf2
mov qword [rbp], rax
mov qword [rbp + 8], r9
mov qword [rbp + 0x10], r10
mov qword [rbp + 0x18], r8
mov rbx, r10
test r15, r15
je 0x140144c20
mov rcx, r15
call fcn.1401109f8
mov rbx, qword [rbp + 0x10]
jmp 0x140144c20
call fcn.140124830
int3

Function at 0x140144d40
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r14, rdx
mov rbp, rcx
mov rbx, qword [rcx + 8]
cmp rbx, qword [rcx]
je 0x140144d7f
mov r15, rbx
mov rax, qword [r14]
mov qword [r15 - 8], rax
add qword [rbp + 8], 0xfffffffffffffff8
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rdi, qword [rbp + 0x10]
mov rax, qword [rbp + 0x18]
cmp rdi, rax
jae 0x140144dd1
sub rax, rdi
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
lea r12, [rax + rcx]
inc r12
sar r12, 1
lea r15, [rdi + r12*8]
mov r8, rdi
sub r8, rbx
je 0x140144dc3
sub r15, r8
mov rcx, r15
mov rdx, rbx
call fcn.140113df0
mov rdi, qword [rbp + 0x10]
mov qword [rbp + 8], r15
lea rax, [rdi + r12*8]
mov qword [rbp + 0x10], rax
jmp 0x140144d62
sub rax, rbx
mov rcx, rax
sar rcx, 2
test rax, rax
mov r13d, 1
cmovne r13, rcx
mov rax, r13
shr rax, 0x3d
jne 0x140144e63
lea r12, [r13 + 3]
shr r12, 2
lea rcx, [r13*8]
call fcn.1401109bc
lea r15, [rax + r12*8]
lea r8, [rax + r13*8]
mov r9, r15
sub rdi, rbx
je 0x140144e39
lea r9, [r15 + rdi]
sar rdi, 3
shl rdi, 3
lea rcx, [rax + r12*8]
xor edx, edx
mov rsi, qword [rbx + rdx]
mov qword [rcx + rdx], rsi
add rdx, 8
cmp rdi, rdx
jne 0x140144e28
mov qword [rbp], rax
mov qword [rbp + 8], r15
mov qword [rbp + 0x10], r9
mov qword [rbp + 0x18], r8
test rbx, rbx
je 0x140144d62
mov rcx, rbx
call fcn.1401109f8
mov r15, qword [rbp + 8]
jmp 0x140144d62
call fcn.140124830
int3