joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425c70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rcx
mov r9, qword [rcx]
test r9, r9
je 0x425ccb
mov r10, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
cmp rcx, r10
jae 0x425ccb
movzx eax, byte [r9 + rcx]
cmp eax, 0x49
je 0x425ce6
cmp eax, 0x42
jne 0x425ccb
lea r11, [rcx + 1]
mov qword [rsi + 0x10], r11
cmp r11, r10
jae 0x425d96
cmp byte [r9 + r11], 0x5f
jne 0x425d96
lea rax, [rcx + 2]
mov qword [rsi + 0x10], rax
xor eax, eax
jmp 0x425dfe
mov rcx, rsi
xor edx, edx
call fcn.00421690
mov edi, eax
add dil, dil
mov eax, edi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
inc rcx
mov qword [rsi + 0x10], rcx
mov rcx, rsi
xor edx, edx
call fcn.00421690
test al, al
jne 0x425e91
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x425d22
lea rdx, [0x0046830b]
mov r8d, 1
call fcn.00417810
test al, al
jne 0x425e91
mov rax, qword [rsi]
mov dil, 1
test rax, rax
je 0x425cda
xor r14d, r14d
lea rbx, [0x004686c0]
nop word [rax + rax]
mov rcx, qword [rsi + 0x10]
cmp rcx, qword [rsi + 8]
jae 0x425d54
cmp byte [rax + rcx], 0x45
je 0x425eb3
sub r14, 1
jb 0x425d79
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x425d79
mov r8d, 2
mov rdx, rbx
call fcn.00417810
test al, al
jne 0x425e91
mov rcx, rsi
call fcn.00422e90
test al, al
jne 0x425e91
mov rax, qword [rsi]
test rax, rax
jne 0x425d40
jmp 0x425cda
xor eax, eax
mov edi, 0x3e
nop dword [rax]
mov r8b, 1
cmp r11, r10
jae 0x425e58
movzx edx, byte [r9 + r11]
cmp dl, 0x5f
je 0x425df2
lea ebx, [rdx - 0x30]
cmp bl, 0xa
jb 0x425ddc
lea ebx, [rdx - 0x61]
cmp bl, 0x1a
jae 0x425dcb
add dl, 0xa9
jmp 0x425dda
lea ebx, [rdx - 0x41]
cmp bl, 0x1a
jae 0x425e58
add dl, 0xe3
mov ebx, edx
inc r11
mov qword [rsi + 0x10], r11
mul rdi
jo 0x425e58
movzx edx, bl
add rax, rdx
jae 0x425da0
jmp 0x425e58
inc r11
mov qword [rsi + 0x10], r11
inc rax
je 0x425e58
cmp rax, rcx
jae 0x425e55
mov ecx, dword [rsi + 0x18]
inc ecx
cmp ecx, 0x1f4
ja 0x425eab
cmp qword [rsi + 0x20], 0
je 0x425ea4
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsi + 0x10], rax
mov dword [rsi + 0x18], ecx
mov rcx, rsi
call fcn.00425c70
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
jmp 0x425cdc
mov r8b, 1
xor edi, edi
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x425e99
lea rax, str.invalid_syntaxrecursion_limit_reached
lea rdx, [0x00468680]
test r8b, r8b
cmovne rdx, rax
xor r8b, 1
movzx eax, r8b
lea r8, [rax + rax*8]
add r8, 0x10
call fcn.00417810
test al, al
je 0x425e99
mov dil, 2
jmp 0x425cda
mov qword [rsi], 0
mov byte [rsi + 8], dil
xor edi, edi
jmp 0x425cda
mov dil, 1
xor r8d, r8d
jmp 0x425e5a
inc rcx
mov qword [rsi + 0x10], rcx
jmp 0x425cda
Function at 0x429510
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov ecx, dword [0x004611b8]
test ecx, ecx
je 0x429604
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x429544
mov rdi, rax
cmp qword [rax + 8], 0
je 0x429544
add rdi, 0x10
jmp 0x4295fa
mov ecx, dword [0x004611b8]
test ecx, ecx
je 0x429617
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x4295f8
mov rsi, rax
test rax, rax
jne 0x4295c7
mov qword [rsp + 0x28], 0
lea rax, [0x004611a0]
mov qword [rsp + 0x20], rax
movzx eax, byte [0x00477190]
mov ecx, 0x18
mov edx, 8
call fcn.00415bd0
test rax, rax
je 0x42963a
mov rsi, rax
mov rax, qword [rsp + 0x30]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rsi], xmm0
mov ecx, dword [0x004611b8]
test ecx, ecx
je 0x42962a
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
lea rdi, [rsi + 0x10]
mov rcx, qword [rsi + 0x10]
cmp qword [rsi + 8], 0
mov qword [rsi + 8], 1
mov qword [rsi + 0x10], 0
je 0x4295fa
test rcx, rcx
je 0x4295fa
lock dec qword [rcx]
jne 0x4295fa
call fcn.00429690
jmp 0x4295fa
xor edi, edi
mov rax, rdi
add rsp, 0x38
pop rdi
pop rsi
ret
lea rcx, [0x004611a0]
call fcn.004298d0
mov ecx, eax
jmp 0x429526
lea rcx, [0x004611a0]
call fcn.004298d0
mov ecx, eax
jmp 0x429554
lea rcx, [0x004611a0]
call fcn.004298d0
mov ecx, eax
jmp 0x4295bf
mov ecx, 8
mov edx, 0x18
call fcn.00416100
ud2
Function at 0x4298d0
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
cmp qword [rcx], 0
je 0x429955
mov dword [rsp + 0x2c], 0
lea rbx, [rsi + 0x10]
lea r8, [rsp + 0x2c]
mov rcx, rbx
xor edx, edx
xor r9d, r9d
call sub.KERNEL32.dll_InitOnceBeginInitialize
mov dword [rsp + 0x28], eax
cmp eax, 1
jne 0x429996
cmp dword [rsp + 0x2c], 0
je 0x42997a
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x4299b0
mov edi, eax
inc eax
mov dword [rsi + 0x18], eax
mov rax, qword [0x00477108]
nop
mov qword [rsi + 8], rax
lock cmpxchg qword [0x00477108], rsi
jne 0x429930
mov byte [0x00477100], 1
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
jmp 0x42998c
call sub.KERNEL32.dll_TlsAlloc
mov dword [rsp + 0x28], eax
cmp eax, 0xffffffff
je 0x4299fc
mov ecx, eax
inc ecx
xor eax, eax
lock cmpxchg dword [rsi + 0x18], ecx
jne 0x42997f
mov edi, dword [rsp + 0x28]
jmp 0x42998c
mov edi, dword [rsi + 0x18]
jmp 0x42998a
mov edi, eax
mov ecx, dword [rsp + 0x28]
call sub.KERNEL32.dll_TlsFree
dec edi
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x30]
call fcn.00429a60
ud2
mov rcx, rbx
mov edx, 4
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
lea rax, str.out_of_TLS_indexes
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
lea rax, str.Index_out_of_bounds
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rdx, str.library_std_src_syswindows_thread_local_key.rs
lea rcx, [rsp + 0x30]
call fcn.00416df0
ud2
lea rax, str.out_of_TLS_indexes
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
lea rax, str.Index_out_of_bounds
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x30]
call fcn.00429ab0
ud2

Function at 0x429fb0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov ecx, dword [0x004611d8]
test ecx, ecx
je 0x42a04f
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x429fd9
mov rsi, rax
cmp byte [rax + 8], 0
jne 0x42a03e
mov ecx, dword [0x004611d8]
test ecx, ecx
je 0x42a062
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x42a044
mov rsi, rax
test rax, rax
jne 0x42a038
movzx eax, byte [0x00477190]
mov ecx, 0x10
mov edx, 8
call fcn.00415bd0
test rax, rax
je 0x42a085
mov rsi, rax
lea rax, [0x004611c0]
mov qword [rsi], rax
mov byte [rsi + 8], 0
mov ecx, dword [0x004611d8]
test ecx, ecx
je 0x42a075
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
mov word [rsi + 8], 1
add rsi, 9
jmp 0x42a046
xor esi, esi
mov rax, rsi
add rsp, 0x20
pop rsi
ret
lea rcx, [0x004611c0]
call fcn.004298d0
mov ecx, eax
jmp 0x429fc5
lea rcx, [0x004611c0]
call fcn.004298d0
mov ecx, eax
jmp 0x429fe5
lea rcx, [0x004611c0]
call fcn.004298d0
mov ecx, eax
jmp 0x42a030
mov ecx, 8
mov edx, 0x10
call fcn.00416100
ud2
Function at 0x42a7a0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
movups xmm0, xmmword [0x0046acc0]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.ntdll.dll_NtWriteFile
cmp eax, 0x103
jne 0x42a811
mov rcx, rdi
mov edx, 0xffffffff
call sub.KERNEL32.dll_WaitForSingleObject
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x42a847
test eax, eax
js 0x42a822
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x42a83a
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov byte [rsp + 0x5c], 0
mov dword [rsp + 0x58], 0
lea rax, [0x0046ad28]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.00428b80
mov rcx, rax
call fcn.00428c80
mov ecx, 7
int 0x29
ud2

Function at 0x42ad20
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov ecx, dword [0x00461198]
test ecx, ecx
je 0x42addd
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x42ad50
cmp qword [rax + 8], 0
je 0x42ad50
add rax, 0x10
jmp 0x42add7
mov ecx, dword [0x00461198]
test ecx, ecx
je 0x42adf0
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x42add5
mov rsi, rax
test rax, rax
jne 0x42adbb
movzx eax, byte [0x00477190]
mov ecx, 0x20
mov edx, 8
call fcn.00415bd0
test rax, rax
je 0x42ae13
mov rsi, rax
lea rax, [0x00461180]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x00461198]
test ecx, ecx
je 0x42ae03
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
mov qword [rsi + 8], 1
lea rax, [rsi + 0x10]
mov qword [rsi + 0x10], 0
mov byte [rsi + 0x18], 0
jmp 0x42add7
xor eax, eax
add rsp, 0x20
pop rsi
ret
lea rcx, [0x00461180]
call fcn.004298d0
mov ecx, eax
jmp 0x42ad35
lea rcx, [0x00461180]
call fcn.004298d0
mov ecx, eax
jmp 0x42ad60
lea rcx, [0x00461180]
call fcn.004298d0
mov ecx, eax
jmp 0x42adb3
mov ecx, 8
mov edx, 0x20
call fcn.00416100
ud2
Function at 0x42ed20
Capabilities:
Read file via mapping

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x88
mov rax, r8
mov rdi, rcx
mov dword [rsp + 0x60], 0
mov word [rsp + 0x64], 0
mov dword [rsp + 0x40], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], 7
mov byte [rsp + 0x60], 1
lea r8, [rsp + 0x40]
mov rcx, rdx
mov rdx, rax
call fcn.00447b00
mov rsi, rdx
test rax, rax
je 0x42ede3
mov eax, esi
and eax, 3
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x42edd7
test rax, rax
je 0x42edd7
mov rax, rsi
dec rsi
mov rbx, qword [rax - 1]
mov r14, qword [rax + 7]
mov rcx, rbx
call qword [r14]
cmp qword [r14 + 8], 0
je 0x42edc6
cmp qword [r14 + 0x10], 0x11
jb 0x42edb5
mov rbx, qword [rbx - 8]
mov rcx, qword [0x004770f8]
xor edx, edx
mov r8, rbx
call fcn.0045f0e4
mov rcx, qword [0x004770f8]
xor edx, edx
mov r8, rsi
call fcn.0045f0e4
mov qword [rdi], 0
jmp 0x42ef57
lea rcx, [rsp + 0x40]
mov rdx, rsi
call fcn.00447d60
cmp dword [rsp + 0x40], 2
jne 0x42ee75
mov rax, qword [rsp + 0x48]
mov ecx, eax
and ecx, 3
lea rdx, [rcx - 2]
cmp rdx, 2
jb 0x42ee56
test rcx, rcx
je 0x42ee56
lea rbx, [rax - 1]
mov r14, qword [rax - 1]
mov r15, qword [rax + 7]
mov rcx, r14
call qword [r15]
cmp qword [r15 + 8], 0
je 0x42ee45
cmp qword [r15 + 0x10], 0x11
jb 0x42ee34
mov r14, qword [r14 - 8]
mov rcx, qword [0x004770f8]
xor edx, edx
mov r8, r14
call fcn.0045f0e4
mov rcx, qword [0x004770f8]
xor edx, edx
mov r8, rbx
call fcn.0045f0e4
mov qword [rdi], 0
mov rcx, rsi
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp sub.KERNEL32.dll_CloseHandle
mov r12, qword [rsp + 0x78]
test rsi, rsi
je 0x42eec7
mov qword [rsp + 0x40], 0
call sub.KERNEL32.dll_GetCurrentProcess
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov rcx, rax
mov rdx, rsi
mov r8, rax
call sub.KERNEL32.dll_DuplicateHandle
test eax, eax
je 0x42ef43
mov rbx, qword [rsp + 0x40]
jmp 0x42eec9
xor ebx, ebx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rbx
xor edx, edx
mov r8d, 2
xor r9d, r9d
call sub.KERNEL32.dll_CreateFileMappingA
test rax, rax
je 0x42ef32
mov r14, rax
mov qword [rsp + 0x20], r12
mov rcx, rax
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call sub.KERNEL32.dll_MapViewOfFile
mov r15, rax
mov rcx, r14
call sub.KERNEL32.dll_CloseHandle
test r15, r15
je 0x42ef32
mov qword [rdi + 8], rbx
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], r12
mov qword [rdi], 1
jmp 0x42ef4f
mov qword [rdi], 0
mov rcx, rbx
call sub.KERNEL32.dll_CloseHandle
jmp 0x42ef4f
call sub.KERNEL32.dll_GetLastError
mov qword [rdi], 0
mov rcx, rsi
call sub.KERNEL32.dll_CloseHandle
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x44bbf0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov ecx, dword [0x004611f8]
test ecx, ecx
je 0x44bce4
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x44bc24
mov rdi, rax
cmp qword [rax + 8], 0
je 0x44bc24
add rdi, 0x10
jmp 0x44bcda
mov ecx, dword [0x004611f8]
test ecx, ecx
je 0x44bcf7
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x44bcd8
mov rsi, rax
test rax, rax
jne 0x44bca7
mov qword [rsp + 0x28], 0
lea rax, [0x004611e0]
mov qword [rsp + 0x20], rax
movzx eax, byte [0x00477190]
mov ecx, 0x18
mov edx, 8
call fcn.00415bd0
test rax, rax
je 0x44bd1a
mov rsi, rax
mov rax, qword [rsp + 0x30]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rsi], xmm0
mov ecx, dword [0x004611f8]
test ecx, ecx
je 0x44bd0a
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
lea rdi, [rsi + 0x10]
mov rcx, qword [rsi + 0x10]
cmp qword [rsi + 8], 0
mov qword [rsi + 8], 1
mov qword [rsi + 0x10], 0
je 0x44bcda
test rcx, rcx
je 0x44bcda
lock dec qword [rcx]
jne 0x44bcda
call fcn.0044bd50
jmp 0x44bcda
xor edi, edi
mov rax, rdi
add rsp, 0x38
pop rdi
pop rsi
ret
lea rcx, [0x004611e0]
call fcn.004298d0
mov ecx, eax
jmp 0x44bc06
lea rcx, [0x004611e0]
call fcn.004298d0
mov ecx, eax
jmp 0x44bc34
lea rcx, [0x004611e0]
call fcn.004298d0
mov ecx, eax
jmp 0x44bc9f
mov ecx, 8
mov edx, 0x18
call fcn.00416100
ud2

Function at 0x44c980
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
sub rsp, 0x80
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
mov edx, 0x10
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x44c9b6
mov rax, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
add rsp, 0x80
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x40], rax
lea rax, [0x00449070]
mov qword [rsp + 0x48], rax
lea rax, str.fallback_RNG_broken:
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 1
mov qword [rsp + 0x70], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 1
lea rdx, str.library_std_src_syswindows_rand.rs
lea rcx, [rsp + 0x50]
call fcn.00416df0
ud2
Function at 0x451b40
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x30
mov ecx, dword [0x00461218]
test ecx, ecx
je 0x451c39
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x451b70
cmp qword [rax + 8], 0
je 0x451b70
add rax, 0x10
jmp 0x451c33
mov ecx, dword [0x00461218]
test ecx, ecx
je 0x451c4c
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x451c13
mov rsi, rax
test rax, rax
jne 0x451be3
movzx eax, byte [0x00477190]
mov ecx, 0x20
mov edx, 8
call fcn.00415bd0
test rax, rax
je 0x451c72
mov rsi, rax
lea rax, [0x00461200]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x00461218]
test ecx, ecx
je 0x451c5f
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x451c17
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
jmp 0x451c1f
xor eax, eax
jmp 0x451c33
call fcn.0044c980
mov rcx, rax
mov qword [rsi + 8], 1
lea rax, [rsi + 0x10]
mov qword [rsi + 0x10], rcx
mov qword [rsi + 0x18], rdx
add rsp, 0x30
pop rsi
ret
lea rcx, [0x00461200]
call fcn.004298d0
mov ecx, eax
jmp 0x451b55
lea rcx, [0x00461200]
call fcn.004298d0
mov ecx, eax
jmp 0x451b80
lea rcx, [0x00461200]
call fcn.004298d0
mov ecx, eax
jmp 0x451bdb
mov ecx, 8
mov edx, 0x20
call fcn.00416100
ud2

Function at 0x452dad
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xd0
mov rsi, rcx
mov ecx, dword [0x00461240]
test ecx, ecx
je 0x452eeb
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x452de8
mov rbx, rax
cmp qword [rax + 8], 0
je 0x452de8
add rbx, 0x10
jmp 0x452edd
mov ecx, dword [0x00461240]
test ecx, ecx
je 0x452efe
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x452e7b
mov rbx, rax
test rax, rax
jne 0x452e56
mov al, byte [0x00477190]
mov ecx, 0x60
mov edx, 8
call fcn.00415bd0
test rax, rax
je 0x452f24
mov rbx, rax
lea rax, [0x00461228]
mov qword [rbx], rax
mov qword [rbx + 8], 0
mov ecx, dword [0x00461240]
test ecx, ecx
je 0x452f11
dec ecx
mov rdx, rbx
call sub.KERNEL32.dll_TlsSetValue
lea rax, [rbx + 8]
test rsi, rsi
je 0x452e7f
lea rcx, [rsi + 8]
cmp qword [rsi], 0
mov qword [rsi], 0
lea rsi, [0x0046cca8]
cmovne rsi, rcx
jmp 0x452e86
xor ebx, ebx
jmp 0x452edd
lea rsi, [0x0046cca8]
lea rdx, [rsp + 0x80]
mov ecx, 0xa
mov rdi, rdx
rep movsq qword [rdi], qword [rsi]
lea r8, [rsp + 0x28]
mov ecx, 0xb
mov rdi, r8
mov rsi, rax
rep movsq qword [rdi], qword [rsi]
mov qword [rbx + 8], 1
add rbx, 0x10
mov ecx, 0xa
mov rdi, rbx
mov rsi, rdx
rep movsq qword [rdi], qword [rsi]
cmp qword [r8], 0
je 0x452edd
cmp dword [rsp + 0x38], 2
je 0x452edd
lea rcx, [rsp + 0x38]
call fcn.00403466
mov rax, rbx
add rsp, 0xd0
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x00461228]
call fcn.004298d0
mov ecx, eax
jmp 0x452dca
lea rcx, [0x00461228]
call fcn.004298d0
mov ecx, eax
jmp 0x452df8
lea rcx, [0x00461228]
call fcn.004298d0
mov ecx, eax
jmp 0x452e4e
mov ecx, 8
mov edx, 0x60
call fcn.00416100
ud2
Function at 0x45387d
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x4538b3
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 3
jbe 0x4538bb
mov esi, dword [rdx]
mov r9d, 4
jmp 0x4538c0
xor r10d, r10d
jmp 0x45396e
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x4538e3
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x4538fa
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x45391a
add r11, r8
jmp 0x453a3e
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x4539e2
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x453990
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 3
jbe 0x4539f4
mov r9d, dword [rdx + r10]
mov r8d, 4
jmp 0x4539fa
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x453a20
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x453a3a
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x45728a
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov ecx, dword [0x00461260]
test ecx, ecx
je 0x457357
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x4572be
mov rdi, rax
cmp qword [rax + 8], 0
je 0x4572be
add rdi, 8
jmp 0x45734d
mov ecx, dword [0x00461260]
test ecx, ecx
je 0x45736a
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x45734b
mov rsi, rax
test rax, rax
jne 0x457328
mov al, byte [0x00477190]
mov ecx, 0x10
mov edx, 8
call fcn.00415bd0
test rax, rax
je 0x45738d
mov rsi, rax
lea rax, [0x00461248]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x00461260]
test ecx, ecx
je 0x45737d
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
lea rdi, [rsi + 8]
call fcn.0045723f
mov rcx, qword [rsi + 8]
mov qword [rsi + 8], rax
test rcx, rcx
je 0x45734d
lock dec qword [rcx]
jne 0x45734d
call fcn.00452576
jmp 0x45734d
xor edi, edi
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x00461248]
call fcn.004298d0
mov ecx, eax
jmp 0x4572a0
lea rcx, [0x00461248]
call fcn.004298d0
mov ecx, eax
jmp 0x4572ce
lea rcx, [0x00461248]
call fcn.004298d0
mov ecx, eax
jmp 0x457320
mov ecx, 8
mov edx, 0x10
call fcn.00416100
ud2
Function at 0x459210
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx]
mov rdx, rax
xor rdx, 3
lock cmpxchg qword [rcx], rdx
jne 0x459217
test al, 1
je 0x459236
test al, 2
jne 0x45924b
xor rax, 3
add rsp, 0x28
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x0046e1a8]
mov edx, 0x23
jmp 0x45925e
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x0046e1e8]
mov edx, 0x25
call fcn.00417b30
ud2
Function at 0x45fff0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rsi, rcx
mov ecx, dword [0x004777a4]
mov rdi, rdx
mov rbp, r8
test ecx, ecx
jle 0x460110
mov rax, qword [0x004777a8]
xor ebx, ebx
add rax, 0x18
mov rdx, qword [rax]
cmp rsi, rdx
jb 0x46003c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rsi, rdx
jb 0x4600f6
add ebx, 1
add rax, 0x28
cmp ebx, ecx
jne 0x460020
mov rcx, rsi
call fcn.00460c30
test rax, rax
mov r12, rax
je 0x460148
movsxd rbx, ebx
lea rbx, [rbx + rbx*4]
shl rbx, 3
mov r13, rbx
add r13, qword [0x004777a8]
mov qword [r13 + 0x20], rax
mov dword [r13], 0
call fcn.00460d80
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
lea rdx, [rsp + 0x20]
mov qword [r13 + 0x18], rax
mov rax, qword [0x004777a8]
mov rcx, qword [rax + rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x46012b
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x4600ef
sub eax, 0x40
and eax, 0xffffffbf
je 0x4600ef
add rbx, qword [0x004777a8]
mov rcx, qword [rsp + 0x20]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov r9, rbx
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x460117
add dword [0x004777a4], 1
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sub.ntdll.dll_memcpy
xor ebx, ebx
jmp 0x460047
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.0045ff80
mov rax, qword [0x004777a8]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.0045ff80
lea rcx, str.Address__p_has_no_image_section
mov rdx, rsi
call fcn.0045ff80
nop
nop dword [rax + rax]

Function at 0x4608a0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00477a80]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x00477a60]
test rbx, rbx
je 0x4608f4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x4608eb
test rsi, rsi
je 0x4608eb
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x4608d0
lea rcx, [0x00477a80]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]