joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140012800
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov qword [rsp + 0x18], 0
jmp 0x140012821
mov rax, qword [rsp + 0x18]
inc rax
mov qword [rsp + 0x18], rax
cmp qword [rsp + 0x18], 0xe3
jae 0x1400128a5
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x18]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x18]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp], eax
mov eax, dword [rsp]
and eax, 1
test eax, eax
je 0x140012870
mov dword [rsp + 4], 0x9908b0df
jmp 0x140012878
mov dword [rsp + 4], 0
mov eax, dword [rsp]
shr eax, 1
xor eax, dword [rsp + 4]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x18]
xor eax, dword [rcx + rdx*4 + 0xff8]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x18]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x140012814
jmp 0x1400128b4
mov rax, qword [rsp + 0x18]
inc rax
mov qword [rsp + 0x18], rax
cmp qword [rsp + 0x18], 0x26f
jae 0x14001293b
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x18]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x18]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 8], eax
mov eax, dword [rsp + 8]
and eax, 1
test eax, eax
je 0x140012905
mov dword [rsp + 0xc], 0x9908b0df
jmp 0x14001290d
mov dword [rsp + 0xc], 0
mov eax, dword [rsp + 8]
shr eax, 1
xor eax, dword [rsp + 0xc]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x18]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x18]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x1400128a7
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x18]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x30]
mov ecx, dword [rdx + rcx + 4]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x10], eax
mov eax, dword [rsp + 0x10]
and eax, 1
test eax, eax
je 0x140012982
mov dword [rsp + 0x14], 0x9908b0df
jmp 0x14001298a
mov dword [rsp + 0x14], 0
mov eax, dword [rsp + 0x10]
shr eax, 1
xor eax, dword [rsp + 0x14]
mov ecx, 4
imul rcx, rcx, 0x18c
mov rdx, qword [rsp + 0x30]
xor eax, dword [rdx + rcx + 4]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x18]
mov dword [rcx + rdx*4 + 4], eax
mov rax, qword [rsp + 0x30]
mov dword [rax], 0
add rsp, 0x28
ret
Function at 0x1400129d0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov qword [rsp + 8], 0x270
jmp 0x1400129f1
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 0x4e0
jae 0x140012a75
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 8]
mov eax, dword [rax + rcx*4 - 0x9bc]
and eax, 0x80000000
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov ecx, dword [rcx + rdx*4 - 0x9b8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp], eax
mov eax, dword [rsp]
and eax, 1
test eax, eax
je 0x140012a40
mov dword [rsp + 4], 0x9908b0df
jmp 0x140012a48
mov dword [rsp + 4], 0
mov eax, dword [rsp]
shr eax, 1
xor eax, dword [rsp + 4]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x1400129e4
add rsp, 0x18
ret

Function at 0x1400203d8
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x14002026b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002026b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002026b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002026b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002026b
cmp dword [rcx + 0x84], 0xe
jbe 0x14002026b
cmp dword [rcx + 0xf8], 0
je 0x14002026b
mov ecx, ebx
call fcn.14002030c
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.1400200fc
cmp dword [rbp + 0x20], 0
je 0x1400202b8
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400202c0
int3
xor r8d, r8d
xor edx, edx
jmp 0x140020204
Function at 0x140002f20
Capabilities:
Get thread local storage value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x30
mov r14, rdx
mov r13, rcx
mov rax, qword [0x140100028]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov byte [rcx], 1
mov qword [rcx + 8], 0
mov byte [rcx + 0x10], 0
mov eax, dword [0x140109788]
mov ecx, dword [0x1401036f8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400030d1
mov ecx, dword [0x140103438]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140003054
movsxd rcx, dword [0x140109780]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x140109784]
jne 0x140003054
mov rdi, qword [rax + rcx]
test rdi, rdi
je 0x140003054
movabs r12, 0x6000000000000000
movabs r15, 0xffffffffffffff
mov rax, qword [rdi]
mov rbx, rax
and rbx, r15
and rax, r12
movabs rcx, 0x4000000000000000
cmp rax, rcx
jne 0x14000301a
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140003007
mov rsi, qword [rdi]
call qword [rcx + VariantCopy]
movabs rcx, 0xff00000000000000
and rcx, rsi
or rcx, rax
mov qword [rdi], rcx
movabs rax, 0xbfffffffffffffff
lock and qword [rdi], rax
mov byte [r13 + 0x10], 1
movabs rsi, 0x8000000000000001
mov qword [r13 + 8], rbx
lea rbx, [rsp + 0x20]
mov rcx, rbx
call qword [fcn.140047460]
mov rax, qword [rbx]
lea rcx, [r14 + rsi]
cmp rcx, 2
jae 0x14000305b
add rsi, rax
cmp rsi, 1
ja 0x14000307d
cmp rax, r14
je 0x14000307d
int3
mov byte [r13], 0
jmp 0x1400030b1
xor ecx, ecx
mov rdx, rax
add rdx, r14
setns cl
movabs rdx, 0x7fffffffffffffff
add rdx, rcx
add rax, r14
cmovo rax, rdx
mov r14, rax
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14000309f
mov rsi, qword [rdi]
call qword [rcx + VariantCopy]
movabs rcx, 0xff00000000000000
and rcx, rsi
or rcx, rax
mov qword [rdi], rcx
mov rax, qword [rdi]
and rax, r12
and r14, r15
or r14, rax
mov qword [rdi], r14
inc dword [rdi + 0x14]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140069890
mov rax, r13
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x140109788]
int3
Function at 0x1400054d0
Capabilities:
Get thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov r14, r8
mov ebp, edx
mov rsi, rcx
mov ebx, dword [0x1401096c0]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test edi, edi
jne 0x1400055b5
cmp rbx, 1
je 0x140005513
mov eax, dword [rsi + 0x1518]
test eax, eax
je 0x14000551a
xor eax, eax
jmp 0x1400055aa
mov eax, 1
lock xadd dword [rsi + 0x1518], eax
cmp eax, 0x7fffffff
je 0x140005601
mov rcx, rsi
int3
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140005503
int3

Function at 0x140005b20
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
xor eax, eax
test r8d, r8d
sete al
xor ebx, ebx
test edx, edx
sete bl
xor ecx, ecx
mov edx, ebx
mov r8d, eax
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi], 0
test rax, rax
je 0x140005bdc
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140005ba9
lea rax, [rdi + 1]
cmp rax, 2
jb 0x140005b84
mov qword [rsi], rdi
call fcn.140036360
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsi]
mov byte [rsi + 8], 1
inc rax
cmp rax, 1
jbe 0x140005be0
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.140036360
mov r14, qword [rsi]
mov rcx, qword [0x1401096a8]
test rcx, rcx
je 0x140005bce
mov rax, qword [rcx]
mov rdx, r14
call qword [rax]
mov qword [rsi], 0
jmp 0x140005b72
int3
mov byte [rsi + 8], 1
int3

Function at 0x140005d80
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov qword [rcx], 0
test rdx, rdx
je 0x140005dc9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140005de7
lea rax, [rdi + 1]
cmp rax, 2
jb 0x140005dc1
mov qword [rsi], rdi
call fcn.140036360
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov word [rsi + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp rax, rdi
je 0x140005e1a
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.140036360
mov r14, qword [rsi]
mov rcx, qword [0x1401096a8]
test rcx, rcx
je 0x140005e0c
mov rax, qword [rcx]
mov rdx, r14
call qword [rax]
mov qword [rsi], 0
jmp 0x140005daf
int3
int3
Function at 0x140006f20
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, qword [0x140109628]
cmp rsi, 1
jbe 0x140006f65
mov ecx, dword [0x140103438]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140006fb7
movsxd rcx, dword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 4]
jne 0x140006fb7
mov rax, qword [rax + rcx]
test rax, rax
je 0x140006fb7
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x140109628]
int3
int3

Function at 0x14000ab90
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov ebx, r8d
mov esi, edx
mov rdi, rcx
mov rax, qword [0x140100028]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [rcx + 8], 0
je 0x14000abbf
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x14000abc2
mov rcx, qword [rdi]
mov edx, esi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x14000ac10
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [rdi + 8], 0
je 0x14000abe5
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x14000abe8
mov rcx, qword [rdi]
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14000ac1f
xor esi, esi
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140069890
mov eax, esi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
test bl, bl
je 0x14000ac64
cmp byte [rdi + 8], 0
jne 0x14000ac50
mov rcx, qword [rdi]
jmp 0x14000ac59
mov dword [rsp + 0x24], 0xaaaaaaaa
cmp byte [rdi + 8], 0
jne 0x14000ac32
mov rcx, qword [rdi]
jmp 0x14000ac3b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x14000ac64
mov esi, dword [rsp + 0x24]
jmp 0x14000ac64
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
mov edx, esi
int3
Function at 0x140027c40
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x250
mov rax, qword [0x140100028]
xor rax, rsp
mov qword [rsp + 0x248], rax
mov sil, 1
cmp qword [0x1401061f0], 0
jne 0x140027e74
mov rcx, qword [0x1401061e8]
test rcx, rcx
je 0x140027d3f
test byte [0x140101e98], 1
je 0x140027e74
cmp byte [rcx + 0x17], 0
jns 0x140027c97
mov rcx, qword [rcx]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1401061f0], rax
inc rax
cmp rax, 1
ja 0x140027e74
lea rdi, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.14006bec0
mov word [rdi], 0
mov ecx, 0x104
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x140027e72
cmp eax, 0x104
ja 0x140027e72
mov rcx, qword [0x1401061e8]
lea rdx, [rsp + 0x40]
int3
movabs r14, 0x7fffffffffffffef
mov ecx, 0x18
int3
xor esi, esi
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
call fcn.140069890
mov eax, esi
add rsp, 0x250
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14002bd40
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x138
movapd xmmword [rsp + 0x120], xmm10
movapd xmmword [rsp + 0x110], xmm9
movaps xmmword [rsp + 0x100], xmm8
movaps xmmword [rsp + 0xf0], xmm7
movaps xmmword [rsp + 0xe0], xmm6
mov rsi, rcx
mov rax, qword [0x140100028]
xor rax, rsp
mov qword [rsp + 0xd8], rax
movabs r13, 0xaaaaaaaaaaaaaaaa
test byte [0x140101f70], 0x19
jne 0x14002c52c
mov rcx, qword [rsi + 0x60]
test rcx, rcx
jne 0x14002c9b6
mov rcx, qword [rsi + 0x48]
mov rdx, rsi
int3
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, eax
mov qword [rsp + 0x90], r13
mov rax, qword [0x140103428]
lea r14, [0x140027ff0]
cmp rax, r14
jne 0x14002c8c1
lea rbx, [rsp + 0xb0]
mov qword [rbx], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbx]
movabs rcx, 0x8637bd05af7
cmp rax, rcx
jge 0x14002c671
imul rax, rax, 0xf4240
cqo
idiv qword [0x140106360]
jmp 0x14002c693
mov rcx, qword [0x140106360]
cqo
idiv rcx
imul rbp, rax, 0xf4240
imul rax, rdx, 0xf4240
cqo
idiv rcx
add rax, rbp
mov qword [rsp + 0x90], rax
lea rbp, [rsp + 0x90]
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], edi
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x48], 8
mov qword [rsp + 0x40], 0
lea rdx, [0x140101f70]
lea r8, str.WorkerThread_born
mov cl, 0x49
xor r9d, r9d
call fcn.14002f2d0
test byte [0x140101f70], 0x19
je 0x14002bdac
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, eax
mov qword [rsp + 0x90], r13
mov rax, qword [0x140103428]
cmp rax, r14
jne 0x14002c8d0
lea rbx, [rsp + 0xb0]
mov qword [rbx], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbx]
movabs rcx, 0x8637bd05af7
cmp rax, rcx
jge 0x14002c746
imul rax, rax, 0xf4240
cqo
idiv qword [0x140106360]
jmp 0x14002c768
mov rcx, qword [0x140106360]
cqo
idiv rcx
imul rbx, rax, 0xf4240
imul rax, rdx, 0xf4240
cqo
idiv rcx
add rax, rbx
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], edi
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
lea rdx, [0x140101f70]
lea r8, str.WorkerThread_active
mov cl, 0x42
xor r9d, r9d
call fcn.14002f2d0
jmp 0x14002bdac
lea rcx, [rsp + 0x90]
call rax
jmp 0x14002c69b
lea rcx, [rsp + 0x90]
call rax
jmp 0x14002c770
mov rax, qword [rcx]
call qword [rax + VariantCopy]
jmp 0x14002bdb9
Function at 0x140036d90
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdi, qword [0x140109698]
cmp rdi, 1
jbe 0x140036ded
mov ecx, dword [0x140103438]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140036dd6
movsxd rcx, dword [rdi]
shl rcx, 4
mov qword [rax + rcx], 0
mov ecx, dword [rdi + 4]
movsxd rdx, dword [rdi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rcx, qword [rsi]
test rcx, rcx
je 0x140036de5
lock sub dword [rcx + 8], 1
je 0x140036e42
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x140109698]
int3
add rcx, 8
add rcx, 0xfffffffffffffff8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.140036e60

Function at 0x140037230
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov qword [rcx], rdx
test rdx, rdx
je 0x140037246
lock inc dword [rdx + 8]
mov qword [rsi + 8], rdx
mov rdi, qword [0x140109698]
cmp rdi, 1
jbe 0x1400372d5
lea rbx, [rsi + 8]
mov ecx, dword [0x140103438]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14003736b
movsxd rcx, dword [rdi]
shl rcx, 4
mov qword [rax + rcx], rbx
mov ecx, dword [rdi + 4]
movsxd rdx, dword [rdi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rdi, qword [0x140109628]
cmp rdi, 1
jbe 0x140037322
mov ecx, dword [0x140103438]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14003737e
movsxd rcx, dword [rdi]
shl rcx, 4
mov qword [rax + rcx], rsi
mov ecx, dword [rdi + 4]
movsxd rdx, dword [rdi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x140109698]
int3
lea rcx, [0x140109628]
int3
test rbx, rbx
je 0x14003728a
call fcn.140006a80
jmp 0x140037271
test rsi, rsi
je 0x1400372ca
call fcn.140006a80
jmp 0x1400372b1

Function at 0x140038010
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov eax, dword [0x14010ad80]
mov ecx, dword [0x1401036f8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140038072
mov ecx, dword [0x140103438]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400380ae
movsxd rcx, dword [0x14010ad78]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x14010ad7c]
jne 0x1400380ae
mov rax, qword [rax + rcx]
mov qword [rsi], rax
mov rax, rsi
add rsp, 0x20
pop rsi
ret
lea rcx, [0x14010ad80]
int3
xor eax, eax
jmp 0x140038066
Function at 0x14003dbe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
sub rsp, 0x130
mov rax, qword [0x140100028]
xor rax, rsp
mov qword [rsp + 0x128], rax
mov r9, qword [rcx + 8]
mov rsi, 0xffffffffffffffff
cmp r9, r8
jbe 0x14003dd1e
mov r11, qword [rdx + 8]
cmp r11, 1
je 0x14003dd4b
test r11, r11
je 0x14003dd1b
xorps xmm0, xmm0
movaps xmmword [rsp + 0x110], xmm0
movaps xmmword [rsp + 0x100], xmm0
movaps xmmword [rsp + 0xf0], xmm0
movaps xmmword [rsp + 0xe0], xmm0
movaps xmmword [rsp + 0xd0], xmm0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
mov rdx, qword [rdx]
lea rsi, [r11 - 1]
mov r10d, r11d
and r10d, 3
cmp rsi, 3
jae 0x14003dcae
xor esi, esi
jmp 0x14003dcf0
and r11, 0xfffffffffffffffc
xor esi, esi
nop word cs:[rax + rax]
nop
movzx eax, byte [rdx + rsi]
mov byte [rsp + rax + 0x20], 1
movzx eax, byte [rdx + rsi + 1]
mov byte [rsp + rax + 0x20], 1
movzx eax, byte [rdx + rsi + 2]
mov byte [rsp + rax + 0x20], 1
movzx eax, byte [rdx + rsi + 3]
mov byte [rsp + rax + 0x20], 1
add rsi, 4
cmp r11, rsi
jne 0x14003dcc0
test r10, r10
je 0x14003dd0c
add rdx, rsi
xor eax, eax
movzx esi, byte [rdx + rax]
mov byte [rsp + rsi + 0x20], 1
add rax, 1
cmp r10, rax
jne 0x14003dcfa
mov rax, qword [rcx]
movzx ecx, byte [rax + r8]
cmp byte [rsp + rcx + 0x20], 0
jne 0x14003dd3a
mov rsi, r8
mov rcx, qword [rsp + 0x128]
xor rcx, rsp
call fcn.140069890
mov rax, rsi
add rsp, 0x130
pop rsi
ret
inc r8
cmp r9, r8
jne 0x14003dd0f
mov r8, 0xffffffffffffffff
jmp 0x14003dd1b
mov rax, qword [rdx]
mov al, byte [rax]
mov rcx, qword [rcx]
cmp byte [rcx + r8], al
jne 0x14003dd1b
inc r8
cmp r9, r8
jne 0x14003dd53
jmp 0x14003dd1e
Function at 0x14003dd70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x128
mov rax, qword [0x140100028]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov r14, qword [rcx + 8]
test r14, r14
je 0x14003ded1
add r14, 0xffffffffffffffff
cmp r14, r8
jae 0x14003df33
mov rsi, qword [rdx + 8]
cmp rsi, 1
je 0x14003deda
test rsi, rsi
je 0x14003deb1
xorps xmm0, xmm0
movaps xmmword [rsp + 0x110], xmm0
movaps xmmword [rsp + 0x100], xmm0
movaps xmmword [rsp + 0xf0], xmm0
movaps xmmword [rsp + 0xe0], xmm0
movaps xmmword [rsp + 0xd0], xmm0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
mov rax, qword [rdx]
lea rdi, [rsi - 1]
mov edx, esi
and edx, 3
cmp rdi, 3
jae 0x14003de46
xor edi, edi
jmp 0x14003de80
and rsi, 0xfffffffffffffffc
xor edi, edi
nop dword [rax]
movzx ebx, byte [rax + rdi]
mov byte [rsp + rbx + 0x20], 1
movzx ebx, byte [rax + rdi + 1]
mov byte [rsp + rbx + 0x20], 1
movzx ebx, byte [rax + rdi + 2]
mov byte [rsp + rbx + 0x20], 1
movzx ebx, byte [rax + rdi + 3]
mov byte [rsp + rbx + 0x20], 1
add rdi, 4
cmp rsi, rdi
jne 0x14003de50
test rdx, rdx
je 0x14003de9c
add rax, rdi
xor edi, edi
movzx esi, byte [rax + rdi]
mov byte [rsp + rsi + 0x20], 1
add rdi, 1
cmp rdx, rdi
jne 0x14003de8a
mov rcx, qword [rcx]
movzx eax, byte [rcx + r14]
cmp byte [rsp + rax + 0x20], 0
jne 0x14003df0c
mov rax, r14
mov r14, rax
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.140069890
mov rax, r14
add rsp, 0x128
pop rbx
pop rdi
pop rsi
pop r14
ret
mov r14, 0xffffffffffffffff
jmp 0x14003deb1
mov rax, qword [rdx]
mov al, byte [rax]
mov rdi, qword [rcx]
inc r14
mov rdx, r14
mov cl, byte [rdi + rdx - 1]
lea r14, [rdx - 1]
cmp cl, al
jne 0x14003defd
cmp rdx, 1
mov rdx, r14
jne 0x14003dee8
cmp cl, al
mov rax, 0xffffffffffffffff
cmove r14, rax
jmp 0x14003deb1
mov rax, r14
sub rax, 1
jb 0x14003df27
movzx edx, byte [rcx + r14 - 1]
cmp byte [rsp + rdx + 0x20], 0
mov r14, rax
je 0x14003deae
jmp 0x14003df0f
mov rax, 0xffffffffffffffff
jmp 0x14003deae
mov r14, r8
jmp 0x14003dda8