joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140028fa8
Capabilities:
Encode data using xor
Get thread local storage value

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x50], rcx
mov eax, dword [0x1402733c8]
xor edx, edx
div dword [0x1402733cc]
mov ecx, 0xde0ab414
xor ecx, 0x370b038b
sub eax, ecx
mov ecx, eax
xor ecx, 0x770c297
mov edx, 0xeeb951cd
xor edx, 0xe9c9935a
mov r8d, 0x68c720f0
xor r8d, 0x9738df0f
xor edx, r8d
and eax, edx
shl eax, 1
sub eax, ecx
xor eax, 0x59c0952d
cmp eax, 0xf316b5c0
ja 0x140028f9f
mov eax, dword [0x1402733d0]
xor eax, 0x9f736484
xor eax, dword [0x1402733d4]
or eax, 0xf0c42dad
sub eax, 0x77cab5e5
imul eax, eax, 0x6a15215c
mov dword [rsp + 0x34], eax
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, rax
mov eax, dword [rsp + 0x34]
mov qword [rsp + 0x38], rcx
mov rcx, qword [rcx + 0x40]
mov qword [rsp + 0x40], rcx
cmp rcx, 0
sete cl
mov byte [rsp + 0x4f], cl
cmp eax, 0x4356cac4
jb 0x140028e9e
mov al, byte [rsp + 0x4f]
test al, 1
jne 0x140028f24
jmp 0x140028f0b
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
call rax
test al, 1
jne 0x140028f24
jmp 0x140028f9a
mov rax, qword [0x140298088]
mov qword [rsp + 0x28], rax
cmp rax, 0
je 0x140028f53
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
call rax
test al, 1
jne 0x140028f53
jmp 0x140028f9a
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x50]
add rcx, 0x38
mov rdx, rax
add rdx, 0x10
mov qword [rsp + 0x20], rdx
mov rdx, qword [rax + 0x10]
xor eax, eax
mov r8b, al
call fcn.140028560
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x50]
call fcn.140028c90
mov rax, qword [rsp + 0x38]
mov byte [rax + 0x60], 1
add rsp, 0x58
ret
shr dword [rdi*2 - 0x1091644], 1
invalid
sub rsp, 0x68
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x40], rax
mov rax, rcx
add rax, 0x10
mov qword [rsp + 0x48], rax
cmp qword [rcx + 0x10], 0
jne 0x140028ff1
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x28]
cmp rax, 0
setne al
cmp rcx, 0
setne cl
and al, cl
test al, 1
jne 0x140029018
jmp 0x140029049
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
add rcx, 0x28
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x50]
call fcn.140027fe0
mov rcx, qword [rsp + 0x38]
add rsp, 0x68
jmp 0x140028e40
Function at 0x1400292ad
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
movabs rcx, 0x37fb0065e3968c84
movabs rax, 0x37fb0065e3968cc4
xor rcx, rax
movabs rdx, 0xdf712a2271dc349b
movabs rax, 0xdf712a2271dc3493
xor rdx, rax
call fcn.140029060
mov rcx, rax
mov rax, qword [str.p__]
mov qword [rcx], rax
lea rax, [0x140281eee]
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 0
lea rax, [0x140281eb0]
mov qword [rcx + 0x20], rax
mov rax, rsp
mov qword [rax + 0x20], 0x5f1b804d
lea rdx, [0x140281eee]
lea r8, [0x140281ecc]
lea r9, [0x140281ed5]
call fcn.140028fa8
nop
add rsp, 0x28
ret
Function at 0x140029870
Capabilities:
Get thread local storage value

Disassembly:
push rbp
sub rsp, 0x1a0
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x110], xmm8
movaps xmmword [rbp + 0x100], xmm7
movaps xmmword [rbp + 0xf0], xmm6
Function at 0x14002b270
Capabilities:
Encode data using xor
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov rax, qword [rcx]
mov qword [rsp + 0x40], rax
mov qword [rcx], rdx
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rax, qword [rsp + 0x40]
cmp rax, 0
je 0x14002b435
mov rax, qword [rsp + 0x40]
mov rcx, rax
add rcx, 0xfffffffffffffff0
mov qword [rsp + 0x30], rcx
mov rax, qword [rax - 0x10]
mov qword [rsp + 0x38], rax
cmp rax, 0x10
jb 0x14002b379
mov r8, qword [rsp + 0x38]
mov ecx, dword [0x140273508]
or ecx, dword [0x14027350c]
mov eax, ecx
and eax, 0x7bf2bf7a
mov edx, 0xa655434a
xor edx, 0xdda7fc30
xor ecx, edx
or eax, ecx
mov ecx, 0x96397d8c
xor ecx, 0xa2a20094
xor eax, ecx
add eax, 0xbda3be5d
cmp eax, 0x1d220eb9
je 0x14002b43a
mov rax, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
mov ecx, dword [0x140273510]
xor ecx, 0x59dcf241
or ecx, dword [0x140273514]
add ecx, 0x1dc50f42
xor ecx, 0xae3fae48
mov r8d, ecx
and r8d, 0xcbb46f22
mov r9d, 0xa2086fe0
xor r9d, 0x5df7901f
xor r8d, r9d
add ecx, 0xcbb46f22
add ecx, 1
add ecx, r8d
mov dword [rsp + 0x24], ecx
mov r8, qword [rax]
mov ecx, 1
call fcn.1400200e0
mov rcx, qword [rsp + 0x40]
call fcn.140020296
mov eax, dword [rsp + 0x24]
cmp eax, 0x73b479a4
jbe 0x14002b3b8
jmp 0x14002b435
fdivr qword [rdx + 0x3c]
adc ecx, ebp
jne 0x14002b440
invalid
invalid

Function at 0x14002b970
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rcx
mov rax, qword [rcx + 8]
mov qword [rsp + 0x30], rax
cmp rax, 0
je 0x14002b9da
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
movabs rcx, 0x37d37ef14c66598d
movabs rdx, 0x77d37ef14c66598d
xor rcx, rdx
and rax, rcx
cmp rax, 0
jne 0x14002b9da
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0x30]
mov rcx, rax
add rcx, 0x68
call fcn.1400190f0
mov ecx, dword [0x140273538]
mov edx, dword [0x14027353c]
mov eax, ecx
xor eax, edx
xor edx, 0xffffffff
and ecx, edx
shl ecx, 1
sub ecx, eax
and ecx, 0x84718b3d
mov eax, ecx
or eax, eax
mov edx, 0x51b5081
xor edx, 0xfae4af7e
xor eax, edx
mov edx, 0xffffffff
xor edx, 0xd8ad5a2f
mov r8d, 0x65c9e84
xor r8d, 0xdef1c4ab
mov r9d, 0x78f139ec
xor r9d, 0x870ec613
xor r8d, r9d
and edx, r8d
xor eax, 0xffffffff
mov r8d, 0xc0251310
xor r8d, 0x3fdaecef
xor edx, r8d
and eax, edx
mov edx, 0xd3aa5c7b
xor edx, 0xb070654
or ecx, edx
xor ecx, 0xffffffff
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
and eax, 0x4c1cfccf
cmp eax, 0x1e37c4a8
je 0x14002bac8
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x140273540]
xor edx, edx
div dword [0x140273544]
add eax, 0x22646246
add eax, 0xf20a9d64
sub eax, 0x22646246
mov r8d, 0x3bdd13d3
xor edx, edx
div r8d
mov rdx, qword [rsp + 0x20]
xor eax, 0xff62c19a
mov r8, qword [rdx]
mov qword [rcx], r8
mov rdx, qword [rdx + 8]
mov qword [rcx + 8], rdx
cmp eax, 0xb25480de
jbe 0x14002bac8
add rsp, 0x38
ret
fldcw word [rdi]
fcom qword [rbp - 0x5d17]
jmp qword [rsi + 0x66]
Function at 0x14002fd01
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
call fcn.14007394a
mov rax, qword [rsp + 0x30]
cmp byte [rax + 0x60], 0
jne 0x14002fd3e
mov rcx, qword [rsp + 0x28]
call fcn.140073ab9
nop
add rsp, 0x38
ret
Function at 0x140030eb0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x30], rcx
mov rax, rcx
add rax, 8
mov qword [rsp + 0x38], rax
mov rax, qword [rcx + 8]
mov qword [rsp + 0x40], rax
cmp rax, 0
je 0x14003100a
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
movabs rdx, 0x4000000000000000
mov rax, rcx
and rax, rdx
xor rax, 0xffffffffffffffff
movabs rdx, 0x4000000000000000
and rcx, rdx
movabs rdx, 0x7ba7a7693927a697
movabs r8, 0x84585896c6d85968
xor rdx, r8
xor rcx, rdx
and rax, rcx
xor rax, 0xffffffffffffffff
cmp rax, 0
jne 0x14003100a
mov eax, dword [str.__3m:]
xor eax, 0xae5282a6
xor eax, dword [0x14027378c]
mov edx, 0x41b52b1c
xor edx, 0x41b52b1d
mov ecx, eax
add ecx, edx
xor eax, 0xffffffff
or eax, 0x714c1a54
add eax, ecx
or eax, 0x8f2a7bd9
mov r8d, 0xffffffff
xor r8d, 0x560b80d1
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0x560b80d1
or eax, 0x560b80d1
imul eax, edx
add eax, ecx
cmp eax, 0xebe4701e
je 0x14003103a
mov eax, dword [0x140273790]
imul eax, dword [0x140273794]
xor ecx, ecx
sub ecx, eax
mov eax, 0x3221594c
xor eax, 0x3221594c
mov edx, 0x49ed64d8
xor edx, 0x8c03495a
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov ecx, 0xd0da921f
xor ecx, 0x6e172004
or eax, ecx
xor eax, 0x2a480b7a
mov dword [rsp + 0x2c], eax
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0x40]
mov rcx, rax
add rcx, 0x68
call fcn.1400190f0
mov eax, dword [rsp + 0x2c]
cmp eax, 0x462a97e3
jbe 0x14003103a
jmp 0x14003100a
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
movabs rdx, 0x8740813c2ee81839
movabs r8, 0x8740813c2ee81839
xor rdx, r8
mov qword [rcx], rdx
mov qword [rax], 0
add rsp, 0x48
ret
sub eax, 0xe9c6cfb4
push rdx
invalid

Function at 0x1400327dc
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x30], rax
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, rax
mov rax, qword [rsp + 0x30]
add rcx, 0x60
mov qword [rsp + 0x38], rcx
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x40], rax
cmp rax, 0
je 0x140032843
mov rax, qword [0x140298090]
mov qword [rsp + 0x28], rax
cmp rax, 0
je 0x140032843
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
call rax
mov rax, qword [rsp + 0x38]
cmp byte [rax], 0
je 0x140032872
mov rax, qword [rsp + 0x38]
mov byte [rax], 0
call fcn.140032883
mov rax, qword [rsp + 0x38]
mov al, byte [rax]
mov cl, 0xe
xor cl, 0xe
cmp al, cl
jne 0x14003287d
mov ecx, 1
call qword [0x1402980a0]
nop
add rsp, 0x48
ret

Function at 0x140032883
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1402980b0]
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov rcx, rax
add rcx, 0x10
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 0x38]
xor eax, eax
mov r8b, al
add rsp, 0x28
jmp fcn.140028560
Function at 0x1400328c0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x88
mov qword [rsp + 0x68], rcx
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x60], rax
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x78], rax
add rax, 0x60
mov qword [rsp + 0x70], rax
mov rax, qword [rcx + 0x10]
mov rcx, qword [rcx + 0x18]
call rax
mov rcx, qword [rsp + 0x78]
xor eax, eax
cmp byte [rcx + 0x60], 0
mov byte [rsp + 0x87], al
je 0x140032942
mov rax, qword [rsp + 0x70]
mov cl, 0x94
xor cl, 0x94
mov byte [rax], cl
call fcn.1400327dc
call fcn.140032883
mov rax, qword [rsp + 0x70]
mov al, byte [rax]
mov byte [rsp + 0x87], al
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x70]
mov dl, byte [rsp + 0x87]
mov byte [rsp + 0x4f], dl
mov dl, 0xb
xor dl, 0xb
mov byte [rax], dl
mov rax, qword [rcx]
add rcx, 8
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov rcx, rax
add rcx, 0xffffffffffffffff
mov qword [rsp + 0x40], rcx
cmp rax, 0
jle 0x140032a98
mov rdx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov rcx, rax
add rcx, 8
mov r8, rdx
shl r8, 4
add rcx, r8
add rax, 8
shl rdx, 4
add rax, rdx
add rax, 8
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
mov qword [rsp + 0x38], rcx
cmp rax, 0
je 0x1400329e2
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call rax
jmp 0x1400329e9
mov rax, qword [rsp + 0x38]
call rax
mov eax, dword [0x140273898]
xor edx, edx
div dword [0x14027389c]
mov ecx, 0x871781b5
xor edx, edx
div ecx
imul eax, eax, 0x7686e5f5
mov ecx, 0x6fbdb863
xor ecx, 0xc9bf0657
sub eax, ecx
cmp eax, 0xb0d0de5f
ja 0x140032b19
mov rcx, qword [rsp + 0x70]
mov eax, dword [0x1402738a0]
xor edx, edx
div dword [0x1402738a4]
xor eax, 0x1c73ae99
xor edx, edx
sub edx, eax
mov eax, 0xc8d70e1b
xor eax, 0xc8d70e1b
mov r8d, 0x57462de6
xor r8d, 0x7131f843
sub eax, r8d
add edx, eax
mov eax, 0x45430e1c
xor eax, 0x45430e1c
sub eax, edx
sub eax, 0xf15ad728
cmp byte [rcx], 0
sete cl
mov byte [rsp + 0x2f], cl
cmp eax, 0x1604bc73
jbe 0x140032b19
mov rax, qword [rsp + 0x40]
mov cl, byte [rsp + 0x2f]
test cl, 1
mov qword [rsp + 0x58], rax
jne 0x14003296f
jmp 0x140032aa3
mov rax, qword [rsp + 0x70]
mov cl, byte [rsp + 0x4f]
mov byte [rax], cl
mov eax, dword [0x1402738a8]
xor edx, edx
div dword [0x1402738ac]
mov ecx, 0xc6602409
xor edx, edx
div ecx
sub eax, 0xb281d3f6
add eax, 0xf9731969
add eax, 0xb281d3f6
or eax, 0x2a0a7824
cmp eax, 0x2197829a
jbe 0x140032b22
mov eax, dword [0x1402738b0]
mov edx, dword [0x1402738b4]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
sub eax, 0xfae4a89a
or eax, 0xfaf296b0
mov ecx, 0x69b234f7
xor edx, edx
div ecx
cmp eax, 0xda61824c
ja 0x140032b22
invalid
add rsp, 0x88
ret
add cl, byte [rbp - 0x26]
invalid
je 0x140032af4
out 0xe9, al
scasb al, byte [rdi]
invalid
jmp 0x1400328c0
Function at 0x140032b2b
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x88
mov qword [rsp + 0x68], rcx
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x60], rax
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x78], rax
add rax, 0x60
mov qword [rsp + 0x70], rax
mov rax, qword [rcx + 0x10]
mov rcx, qword [rcx + 0x18]
call rax
mov rcx, qword [rsp + 0x78]
xor eax, eax
cmp byte [rcx + 0x60], 0
mov byte [rsp + 0x87], al
je 0x140032942
mov rax, qword [rsp + 0x70]
mov cl, 0x94
xor cl, 0x94
mov byte [rax], cl
call fcn.1400327dc
call fcn.140032883
mov rax, qword [rsp + 0x70]
mov al, byte [rax]
mov byte [rsp + 0x87], al
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x70]
mov dl, byte [rsp + 0x87]
mov byte [rsp + 0x4f], dl
mov dl, 0xb
xor dl, 0xb
mov byte [rax], dl
mov rax, qword [rcx]
add rcx, 8
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov rcx, rax
add rcx, 0xffffffffffffffff
mov qword [rsp + 0x40], rcx
cmp rax, 0
jle 0x140032a98
mov rdx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov rcx, rax
add rcx, 8
mov r8, rdx
shl r8, 4
add rcx, r8
add rax, 8
shl rdx, 4
add rax, rdx
add rax, 8
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
mov qword [rsp + 0x38], rcx
cmp rax, 0
je 0x1400329e2
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call rax
jmp 0x1400329e9
mov rax, qword [rsp + 0x38]
call rax
mov eax, dword [0x140273898]
xor edx, edx
div dword [0x14027389c]
mov ecx, 0x871781b5
xor edx, edx
div ecx
imul eax, eax, 0x7686e5f5
mov ecx, 0x6fbdb863
xor ecx, 0xc9bf0657
sub eax, ecx
cmp eax, 0xb0d0de5f
ja 0x140032b19
mov rcx, qword [rsp + 0x70]
mov eax, dword [0x1402738a0]
xor edx, edx
div dword [0x1402738a4]
xor eax, 0x1c73ae99
xor edx, edx
sub edx, eax
mov eax, 0xc8d70e1b
xor eax, 0xc8d70e1b
mov r8d, 0x57462de6
xor r8d, 0x7131f843
sub eax, r8d
add edx, eax
mov eax, 0x45430e1c
xor eax, 0x45430e1c
sub eax, edx
sub eax, 0xf15ad728
cmp byte [rcx], 0
sete cl
mov byte [rsp + 0x2f], cl
cmp eax, 0x1604bc73
jbe 0x140032b19
mov rax, qword [rsp + 0x40]
mov cl, byte [rsp + 0x2f]
test cl, 1
mov qword [rsp + 0x58], rax
jne 0x14003296f
jmp 0x140032aa3
mov rax, qword [rsp + 0x70]
mov cl, byte [rsp + 0x4f]
mov byte [rax], cl
mov eax, dword [0x1402738a8]
xor edx, edx
div dword [0x1402738ac]
mov ecx, 0xc6602409
xor edx, edx
div ecx
sub eax, 0xb281d3f6
add eax, 0xf9731969
add eax, 0xb281d3f6
or eax, 0x2a0a7824
cmp eax, 0x2197829a
jbe 0x140032b22
mov eax, dword [0x1402738b0]
mov edx, dword [0x1402738b4]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
sub eax, 0xfae4a89a
or eax, 0xfaf296b0
mov ecx, 0x69b234f7
xor edx, edx
div ecx
cmp eax, 0xda61824c
ja 0x140032b22
invalid
add rsp, 0x88
ret
add cl, byte [rbp - 0x26]
invalid
je 0x140032af4
out 0xe9, al
scasb al, byte [rdi]
invalid
jmp 0x1400328c0
Function at 0x140032b47
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
call fcn.1400750f0
mov rax, qword [rsp + 0x30]
cmp byte [rax + 0x60], 0
jne 0x140032b84
mov rcx, qword [rsp + 0x28]
call fcn.140075276
nop
add rsp, 0x38
ret
Function at 0x1400359b0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x58], rcx
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
add rax, 0x60
mov qword [rsp + 0x68], rax
mov rax, qword [rcx]
mov qword [rsp + 0x70], rax
cmp rax, rdx
jle 0x140035a02
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call fcn.1400355f0
jmp 0x140035cf1
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
cmp rax, rcx
jge 0x140035cf1
mov rax, qword [rsp + 0x58]
Function at 0x140036cd6
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, 0x10
mov edx, 8
call fcn.140029060
mov qword [rsp + 0x20], rax
xor eax, eax
mov ecx, eax
call fcn.1400369c0
mov rax, qword [rsp + 0x20]
add rsp, 0x28
ret

Function at 0x140037460
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rcx
cmp rdx, 1
jge 0x140037496
mov rax, qword [rsp + 0x38]
mov qword [rax], 0
mov qword [rax + 8], 0
jmp 0x140037679
mov rdx, qword [rsp + 0x30]
mov rax, rdx
add rax, 1
xor rdx, 0xffffffffffffffff
mov rcx, rax
xor rcx, rdx
movabs r8, 0x7f6f7b6d6abae20f
movabs r9, 0x8090849295451df0
xor r8, r9
xor rcx, r8
or rax, rdx
and rax, rcx
cmp rax, 0
jge 0x1400374e0
call fcn.14000f24b
jmp 0x140037679
mov rax, qword [rsp + 0x30]
movabs rdx, 0x5568d243fa65bbcc
mov rcx, rax
sub rcx, rdx
add rcx, 9
movabs rdx, 0x16a8ea24e00824db
movabs r8, 0x43c038671a6d9f17
xor rdx, r8
add rcx, rdx
mov qword [rsp + 0x28], rcx
movabs rdx, 0x761240a89918e5a7
movabs r8, 0x89edbf5766e71a59
xor rdx, r8
sub rdx, rax
xor rdx, 0xffffffffffffffff
mov rax, rcx
xor rax, rdx
and rax, rcx
cmp rax, 0
jge 0x140037608
mov eax, dword [0x140273b18]
and eax, dword [0x140273b1c]
sub eax, 0x6c740188
add eax, 0x6d67f95f
mov ecx, 0xd3af691a
xor ecx, 0xbfdb6892
add eax, ecx
mov ecx, 0xffffffff
xor ecx, 0xdbbcb59
xor edx, edx
sub edx, 1
sub ecx, edx
sub eax, ecx
mov r8d, 0xffffffff
xor r8d, 0x47d503ac
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0x47d503ac
mov r8d, 0x1e0bdc6b
xor r8d, 0x59dedfc7
or eax, r8d
imul eax, edx
add eax, ecx
cmp eax, 0xbf308e91
ja 0x140037683
mov eax, dword [0x140273b20]
and eax, dword [0x140273b24]
imul eax, eax, 0x895d7c81
mov ecx, 0xbb1f9d4f
xor ecx, 0x229ad855
imul eax, ecx
imul eax, eax, 0xe10acd16
mov dword [rsp + 0x24], eax
call fcn.14000f24b
mov eax, dword [rsp + 0x24]
cmp eax, 0x8a8a937d
ja 0x140037683
jmp 0x140037679
mov rax, qword [rsp + 0x28]
movabs rcx, 0xc66f03c2ede94a07
movabs rdx, 0xc66f03c2ede94a07
xor rcx, rdx
cmp rax, rcx
jge 0x14003763d
mov rcx, r8
mov rdx, r8
call fcn.14001a720
jmp 0x140037679
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0x28]
mov rcx, rax
add rcx, 0x68
call fcn.140014f80
mov rdx, qword [rsp + 0x30]
mov rcx, rax
mov rax, qword [rsp + 0x38]
mov qword [rcx], rdx
mov byte [rcx + 8], 0
mov qword [rax], 0
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x40]
add rsp, 0x48
ret
push rbx
sbb eax, 0x39e95801
invalid
Function at 0x140039871
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
call fcn.140076af2
mov rax, qword [rsp + 0x30]
cmp byte [rax + 0x60], 0
jne 0x1400398ae
mov rcx, qword [rsp + 0x28]
call fcn.140076b78
nop
add rsp, 0x38
ret
Function at 0x14003a700
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], rcx
mov rax, rcx
add rax, 8
mov qword [rsp + 0x28], rax
mov rax, qword [rcx + 8]
mov qword [rsp + 0x30], rax
cmp rax, 0
je 0x14003a777
mov rcx, qword [rsp + 0x30]
movabs rax, 0x4000000000000000
and rax, qword [rcx]
movabs rcx, 0xb8d2ffebb11a862c
movabs rdx, 0xb8d2ffebb11a862c
xor rcx, rdx
cmp rax, rcx
jne 0x14003a777
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0x30]
mov rcx, rax
add rcx, 0x68
call fcn.1400190f0
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
mov qword [rcx], 0
mov qword [rax], 0
add rsp, 0x38
ret
Function at 0x14003a7a0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rcx
mov rcx, qword [rcx]
movabs rdx, 0x9fd1d98fa2dec9b2
movabs rax, 0x602e26705d21364d
xor rdx, rax
mov rax, rcx
add rax, rdx
mov qword [rsp + 0x50], rax
mov rdx, rax
xor rdx, rcx
xor rdx, 0xffffffffffffffff
mov r8, rcx
and r8, rdx
movabs rdx, 0x8973ae96e5101865
movabs r9, 0x8973ae96e5101867
xor rdx, r9
imul rdx, r8
sub rdx, rcx
mov rcx, rax
sub rcx, rdx
movabs rdx, 0x6861ae222ab313fd
movabs r8, 0x6861ae222ab313fd
xor rdx, r8
cmp rcx, rdx
setl dl
movabs rcx, 0x784f75e7ad38bd38
movabs r8, 0x87b08a1852c742c7
xor rcx, r8
cmp rax, rcx
setg al
or al, al
xor ecx, ecx
xor cl, 1
xor al, cl
mov cl, dl
xor cl, 0xff
xor dl, 0xff
and cl, dl
or al, cl
xor al, 0xff
test al, 1
jne 0x14003a87d
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
add rcx, 8
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
jmp 0x14003a925
mov eax, dword [0x140273c88]
xor edx, edx
div dword [0x140273c8c]
and eax, 0x6c32bd46
mov ecx, eax
xor ecx, 0xa1d5f26d
mov edx, 0xffffffff
xor edx, 0xa1d5f26d
and eax, edx
shl eax, 1
sub eax, ecx
add eax, 0xb0c394f
mov ecx, 0x6852b7bf
xor ecx, 0x18bcd179
cmp eax, ecx
jae 0x14003a9e4
mov ecx, dword [0x140273c90]
xor ecx, 0x42f74028
mov edx, dword [0x140273c94]
mov eax, ecx
and eax, edx
shl eax, 1
add ecx, edx
sub ecx, eax
or ecx, 0x389958ed
mov eax, 0x27592a3
xor eax, 0x1adf96d0
add ecx, eax
mov edx, 0x5a5eae10
xor edx, 0xd9e8ac4e
mov eax, ecx
and eax, edx
xor ecx, 0x83b6025e
or eax, ecx
mov dword [rsp + 0x2c], eax
call fcn.14000f24b
mov eax, dword [rsp + 0x2c]
cmp eax, 0x7d57fe0c
je 0x14003a8c2
jmp 0x14003a9df
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
cmp rax, rcx
jl 0x14003a9d2
mov rax, qword [rsp + 0x20]
cmp rax, 0
jl 0x14003a95f
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
cmp rax, qword [rcx]
jl 0x14003a96c
mov rcx, rdx
call fcn.1400292ad
jmp 0x14003a9df
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx]
add rcx, 8
shl rax, 4
add rcx, rax
call fcn.14003a700
mov rcx, qword [rsp + 0x20]
mov rax, rcx
and rax, 0xffffffffffffffff
mov rdx, rcx
or rdx, 0xffffffffffffffff
add rax, rdx
mov rdx, rax
xor rdx, rcx
cmp rdx, 0
setl dl
cmp rcx, 0
setne cl
and cl, dl
test cl, 1
mov qword [rsp + 0x38], rax
jne 0x14003a9c8
jmp 0x14003a925
call fcn.14000f24b
jmp 0x14003a9df
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
add rsp, 0x58
ret
ror byte [rcx + 0x60], 1
invalid