joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140168f20
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x20
xor ebp, ebp
cmp dword [rcx + 0x24], 0xcc
mov rdi, rcx
je 0x140168f4e
mov rax, qword [rcx + 0x220]
call qword [rax]
mov dword [rdi + 0xa8], ebp
mov dword [rdi + 0x24], 0xcc
mov rax, qword [rdi + 0x220]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rsi
cmp dword [rax + 0x10], ebp
je 0x140169003
nop
nop
mov ecx, dword [rdi + 0xa8]
cmp ecx, dword [rdi + 0x8c]
jae 0x140168fd3
nop
mov rax, qword [rdi + 0x10]
test rax, rax
je 0x140168fa2
mov dword [rax + 8], ecx
mov rcx, qword [rdi + 0x10]
mov eax, dword [rdi + 0x8c]
mov dword [rcx + 0xc], eax
mov rax, qword [rdi + 0x10]
mov rcx, rdi
call qword [rax]
mov rax, qword [rdi + 0x228]
mov ebx, dword [rdi + 0xa8]
lea r8, [rdi + 0xa8]
xor r9d, r9d
xor edx, edx
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
mov ecx, dword [rdi + 0xa8]
cmp ecx, ebx
je 0x14016902d
cmp ecx, dword [rdi + 0x8c]
jb 0x140168f80
mov rax, qword [rdi + 0x220]
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
mov r11, qword [rdi + 0x220]
mov rcx, rdi
call qword [r11]
mov dword [rdi + 0xa8], ebp
mov rax, qword [rdi + 0x220]
cmp dword [rax + 0x10], ebp
jne 0x140168f70
cmp dword [rdi + 0x5c], ebp
mov eax, 1
setne bpl
add ebp, 0xcd
mov dword [rdi + 0x24], ebp
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
xor eax, eax
jmp 0x140169018
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x24], 0xca
mov rbx, rcx
jne 0x140169146
call fcn.14016d7e0
cmp dword [rbx + 0x58], 0
je 0x14016913f
mov dword [rbx + 0x24], 0xcf
mov eax, 1
add rsp, 0x20
pop rbx
ret
mov dword [rbx + 0x24], 0xcb
mov eax, dword [rbx + 0x24]
cmp eax, 0xcb
jne 0x1401691d3
mov rax, qword [rbx + 0x240]
cmp dword [rax + 0x20], 0
je 0x1401691ba
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14016916f
mov rcx, rbx
call qword [rax]
mov rax, qword [rbx + 0x240]
mov rcx, rbx
call qword [rax]
test eax, eax
je 0x1401691b2
cmp eax, 2
je 0x1401691ba
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140169161
cmp eax, 3
je 0x140169197
cmp eax, 1
jne 0x140169161
add dword [rcx + 8], 1
mov rcx, qword [rbx + 0x10]
mov eax, dword [rcx + 0xc]
cmp dword [rcx + 8], eax
jl 0x140169161
mov eax, dword [rbx + 0x1a4]
add dword [rcx + 0xc], eax
jmp 0x140169161
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov eax, dword [rbx + 0xac]
mov rcx, rbx
mov dword [rbx + 0xb4], eax
add rsp, 0x20
pop rbx
jmp 0x140168f20
cmp eax, 0xcc
je 0x1401691f5
mov rax, qword [rbx]
mov dword [rax + 0x28], socket
mov rcx, qword [rbx]
mov eax, dword [rbx + 0x24]
mov dword [rcx + 0x2c], eax
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x140168f20
Function at 0x140169110
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x20
xor ebp, ebp
cmp dword [rcx + 0x24], 0xcc
mov rdi, rcx
je 0x140168f4e
mov rax, qword [rcx + 0x220]
call qword [rax]
mov dword [rdi + 0xa8], ebp
mov dword [rdi + 0x24], 0xcc
mov rax, qword [rdi + 0x220]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rsi
cmp dword [rax + 0x10], ebp
je 0x140169003
nop
nop
mov ecx, dword [rdi + 0xa8]
cmp ecx, dword [rdi + 0x8c]
jae 0x140168fd3
nop
mov rax, qword [rdi + 0x10]
test rax, rax
je 0x140168fa2
mov dword [rax + 8], ecx
mov rcx, qword [rdi + 0x10]
mov eax, dword [rdi + 0x8c]
mov dword [rcx + 0xc], eax
mov rax, qword [rdi + 0x10]
mov rcx, rdi
call qword [rax]
mov rax, qword [rdi + 0x228]
mov ebx, dword [rdi + 0xa8]
lea r8, [rdi + 0xa8]
xor r9d, r9d
xor edx, edx
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
mov ecx, dword [rdi + 0xa8]
cmp ecx, ebx
je 0x14016902d
cmp ecx, dword [rdi + 0x8c]
jb 0x140168f80
mov rax, qword [rdi + 0x220]
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
mov r11, qword [rdi + 0x220]
mov rcx, rdi
call qword [r11]
mov dword [rdi + 0xa8], ebp
mov rax, qword [rdi + 0x220]
cmp dword [rax + 0x10], ebp
jne 0x140168f70
cmp dword [rdi + 0x5c], ebp
mov eax, 1
setne bpl
add ebp, 0xcd
mov dword [rdi + 0x24], ebp
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
xor eax, eax
jmp 0x140169018
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x24], 0xca
mov rbx, rcx
jne 0x140169146
call fcn.14016d7e0
cmp dword [rbx + 0x58], 0
je 0x14016913f
mov dword [rbx + 0x24], 0xcf
mov eax, 1
add rsp, 0x20
pop rbx
ret
mov dword [rbx + 0x24], 0xcb
mov eax, dword [rbx + 0x24]
cmp eax, 0xcb
jne 0x1401691d3
mov rax, qword [rbx + 0x240]
cmp dword [rax + 0x20], 0
je 0x1401691ba
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14016916f
mov rcx, rbx
call qword [rax]
mov rax, qword [rbx + 0x240]
mov rcx, rbx
call qword [rax]
test eax, eax
je 0x1401691b2
cmp eax, 2
je 0x1401691ba
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140169161
cmp eax, 3
je 0x140169197
cmp eax, 1
jne 0x140169161
add dword [rcx + 8], 1
mov rcx, qword [rbx + 0x10]
mov eax, dword [rcx + 0xc]
cmp dword [rcx + 8], eax
jl 0x140169161
mov eax, dword [rbx + 0x1a4]
add dword [rcx + 0xc], eax
jmp 0x140169161
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov eax, dword [rbx + 0xac]
mov rcx, rbx
mov dword [rbx + 0xb4], eax
add rsp, 0x20
pop rbx
jmp 0x140168f20
cmp eax, 0xcc
je 0x1401691f5
mov rax, qword [rbx]
mov dword [rax + 0x28], socket
mov rcx, qword [rbx]
mov eax, dword [rbx + 0x24]
mov dword [rcx + 0x2c], eax
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x140168f20
Function at 0x14016cde0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov rbx, rcx
mov qword [rcx + 8], rsi
call fcn.140142dd0
mov edx, 0x98
mov rcx, rbx
mov dword [rsp + 0x38], eax
call fcn.14016d910
test rax, rax
mov rdi, rax
jne 0x14016ce37
mov rcx, rbx
call fcn.140009eb0
mov r11, qword [rbx]
mov dword [r11 + 0x28], getservbyport
mov rcx, qword [rbx]
mov dword [rcx + 0x2c], esi
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx]
mov dword [rdi + 0x5c], 0x3b9aca00
lea rax, [fcn.14016b890]
lea rcx, str.JPEGMEM
mov qword [rdi], rax
lea rax, [0x14016ba30]
mov qword [rdi + 8], rax
lea rax, [0x14016bb30]
mov qword [rdi + 0x10], rax
lea rax, [0x14016bd20]
mov qword [rdi + 0x18], rax
lea rax, [0x14016bf00]
mov qword [rdi + 0x20], rax
lea rax, [0x14016bfa0]
mov qword [rdi + 0x28], rax
lea rax, [0x14016c040]
mov qword [rdi + 0x30], rax
lea rax, [0x14016c770]
mov qword [rdi + 0x38], rax
lea rax, [0x14016c9d0]
mov qword [rdi + 0x40], rax
lea rax, [fcn.14016cc40]
mov qword [rdi + 0x48], rax
lea rax, [0x14016cd90]
mov qword [rdi + 0x50], rax
mov eax, dword [rsp + 0x38]
mov dword [rdi + 0x58], eax
mov qword [rdi + 0x68], rsi
mov qword [rdi + 0x78], rsi
mov qword [rdi + 0x60], rsi
mov qword [rdi + 0x70], rsi
mov qword [rdi + 0x80], rsi
mov qword [rdi + 0x88], rsi
mov dword [rdi + 0x90], 0x98
mov qword [rbx + 8], rdi
call fcn.140128440
test rax, rax
je 0x14016cf42
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, str._ld_c
mov rcx, rax
mov byte [rsp + 0x30], 0x78
call fcn.1401243d0
test eax, eax
jle 0x14016cf42
movzx eax, byte [rsp + 0x30]
cmp al, 0x6d
je 0x14016cf2f
cmp al, 0x4d
je 0x14016cf2f
mov eax, dword [rsp + 0x38]
jmp 0x14016cf39
mov eax, dword [rsp + 0x38]
imul eax, eax, 0x3e8
imul eax, eax, 0x3e8
mov dword [rdi + 0x58], eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140175560
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rdi
push r12
push r13
push r15
sub rsp, 0x30
cmp dword [rcx + 0x70], 1
mov r15, qword [rcx + 0x270]
mov rdi, rcx
jne 0x140175590
mov ebx, 0x1fe
mov dword [r15 + 0x38], 1
jmp 0x140175596
xor ebx, ebx
mov dword [r15 + 0x38], ebx
mov rax, qword [rcx + 8]
mov r9d, dword [rcx + 0x90]
lea r8d, [rbx + 0x100]
mov edx, 1
call qword [rax + reloc.WS2_32.dll_recv]
mov r12d, dword [r15 + 0x28]
xor r13d, r13d
movsxd rcx, ebx
mov qword [r15 + 0x30], rax
cmp dword [rdi + 0x90], r13d
mov qword [rsp + 0x68], rcx
jle 0x1401756ea
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r14
lea r14, [r15 + 0x3c]
xor ebp, ebp
nop
nop
nop
mov edi, dword [r14]
mov eax, r12d
cdq
idiv edi
test rcx, rcx
mov r12d, eax
je 0x14017560d
mov rax, qword [r15 + 0x30]
add qword [rax + rbp], 0xff
mov rax, qword [r15 + 0x30]
lea ecx, [rdi + rdi - 2]
xor r9d, r9d
mov r11, qword [rax + rbp]
lea eax, [rdi + 0xfe]
xor r8d, r8d
cdq
idiv ecx
xor esi, esi
mov r10d, eax
nop
cmp r8d, r10d
jle 0x14017565e
mov ecx, r9d
lea ebx, [rdi + rdi - 2]
imul ecx, ecx, 0x1fe
add ecx, 0x1fe
add r9d, 1
lea eax, [rcx + rdi + 0xfe]
cdq
idiv ebx
cmp r8d, eax
mov r10d, eax
jg 0x140175642
movzx eax, r9b
add rsi, 1
add r8d, 1
imul r12b
cmp rsi, 0xff
mov byte [rsi + r11 - 1], al
jle 0x140175630
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1401756bd
mov ecx, 1
lea rdx, [r11 - 1]
nop
movzx eax, byte [r11]
add rcx, 1
sub rdx, 1
cmp rcx, 0xff
mov byte [rdx + 1], al
movzx eax, byte [r11 + 0xff]
mov byte [r11 + rcx + 0xfe], al
jle 0x140175690
mov rcx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x60]
add r13d, 1
add r14, 4
add rbp, 8
cmp r13d, dword [rax + 0x90]
jl 0x1401755f0
mov r14, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r13
pop r12
pop rdi
pop rbx
ret

Function at 0x140179f60
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x20
mov rsi, rcx
add rcx, 0x30
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [rsi + 0x20], 0
jne 0x140179ffe
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rdi
mov rdi, qword [rsi + 0x28]
lea rcx, [rdi + 8]
mov ebx, 1
mov qword [rsp + 0x40], r12
mov dword [rsi + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp qword [rdi + 0x30], 0
je 0x140179fdb
nop
test ebx, ebx
je 0x140179fdb
mov rcx, qword [rdi + 0x30]
mov rcx, qword [rcx + 0x58]
call qword [sym.imp.KERNEL32.dll_SetEvent]
test ebx, ebx
mov r11, qword [rdi + 0x30]
mov rax, qword [r11 + 0x60]
mov qword [rdi + 0x30], rax
jle 0x140179fd5
sub ebx, 1
cmp rax, 0
jne 0x140179fb0
lea rcx, [rdi + 8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
lea rcx, [rsi + 0x30]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x14017a1e0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rsi
mov rax, rdx
mov rdi, rcx
lea rcx, [0x1401c8e78]
mov qword [rdi], rcx
xor ebp, ebp
mov qword [rdi + 8], rbp
or edx, 0xffffffff
mov rcx, rax
call fcn.14007b6e0
mov qword [rdi + 0x18], rax
mov qword [rdi + 0x28], rbp
lea rsi, [rdi + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
nop
mov qword [rdi + 0x58], rbp
mov byte [rdi + 0x68], bpl
lea ecx, [rbp + 0x38]
call fcn.14011ecf0
mov rbx, rax
test rax, rax
je 0x14017a264
mov qword [rax], rsi
lea rcx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov qword [rbx + 0x30], rbp
jmp 0x14017a267
mov rbx, rbp
mov qword [rdi + 0x28], rbx
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi + 0x58], rax
lea rax, [rdi + 0x10]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 4
mov r9, rdi
lea r8, [0x14017a070]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rdi + 8], rax
mov dword [rdi + 0x20], ebp
lea rax, [0x14018fa3b]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
mov r9, qword [rdi + 0x18]
lea r8, str.created
lea rdx, str.__16.16s__s__lx_:__s
lea rcx, [0x14023eaf8]
call fcn.140002fd0
nop
mov rax, rdi
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x14017a5a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov ecx, dword [0x14023eb18]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x14017a696
lea ecx, [rax + 0x70]
call fcn.14011ecf0
mov rdi, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14017a682
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rcx, [0x1401c8e78]
mov qword [rdi], rcx
mov qword [rdi + 8], rax
mov dword [rdi + 0x10], ebx
or edx, 0xffffffff
lea rcx, str.Native
call fcn.14007b6e0
mov qword [rdi + 0x18], rax
mov qword [rdi + 0x28], 0
lea rcx, [rdi + 0x30]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
nop
mov qword [rdi + 0x58], 0
mov byte [rdi + 0x68], 0
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi + 0x58], rax
mov dword [rdi + 0x20], 4
lea rax, [0x14018fa3b]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
mov r9, qword [rdi + 0x18]
lea r8, str.created
lea rdx, str.__16.16s__s__lx_:__s
lea rcx, [0x14023eaf8]
call fcn.140002fd0
nop
jmp 0x14017a684
xor edi, edi
mov rdx, rdi
mov ecx, dword [0x14023eb18]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rax, rdi
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x14017a750
Capabilities:
Terminate thread

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x150
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rbx, rcx
lea rsi, [rcx + 0x30]
mov qword [rax + 8], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
cmp byte [rbx + 0x68], 0
je 0x14017a7ad
mov r9d, 0x74
lea r8, str..winThreading.cxx
lea rdx, str._deleteAfterRun
lea rcx, [rsp + 0x38]
call fcn.140086ab0
mov rcx, rax
call fcn.140086a30
mov eax, dword [rbx + 0x20]
cmp eax, 3
jne 0x14017a7e9
lea rdi, [0x14018fa3b]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9, qword [rbx + 0x18]
lea r8, str.already_joined
lea rdx, str.__16.16s__s__lx_:__s
lea rcx, [0x14023eaf8]
call fcn.140002fd0
jmp 0x14017a8cc
test eax, eax
jne 0x14017a82d
xor edx, edx
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rdi, [0x14018fa3b]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9, qword [rbx + 0x18]
lea r8, str.joined__not_started_
lea rdx, str.__16.16s__s__lx_:__s
lea rcx, [0x14023eaf8]
call fcn.140002fd0
jmp 0x14017a8cc
lea rdi, [0x14018fa3b]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9, qword [rbx + 0x18]
lea r8, str.joining
lea rdx, str.__16.16s__s__lx_:__s
lea rcx, [0x14023eaf8]
call fcn.140002fd0
cmp dword [rbx + 0x20], 1
jne 0x14017a89c
or edx, 0xffffffff
mov rcx, qword [rbx + 0x28]
call fcn.1400fb2b0
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9, qword [rbx + 0x18]
lea r8, str.checking
lea rdx, str.__16.16s__s__lx_:__s
lea rcx, [0x14023eaf8]
call fcn.140002fd0
cmp dword [rbx + 0x20], 1
je 0x14017a862
mov dword [rbx + 0x20], 3
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9, qword [rbx + 0x18]
lea r8, str.joined
lea rdx, str.__16.16s__s__lx_:__s
lea rcx, [0x14023eaf8]
call fcn.140002fd0
nop
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, rbx
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14017b2b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
mov edi, dword [rcx + 0x38]
mov qword [rsp + 0x40], r12
mov rbp, rcx
mov qword [rsp + 0x48], r13
nop
mov edx, dword [rbp + 0x8c]
mov ebx, dword [rbp + 0x50]
mov eax, dword [rbp + 0x94]
sub ebx, edx
sub ebx, eax
jne 0x14017b2f4
test edx, edx
jne 0x14017b303
test eax, eax
jne 0x14017b303
mov ebx, edi
jmp 0x14017b38c
cmp ebx, 0xffffffff
jne 0x14017b303
mov ebx, 0xfffffffe
jmp 0x14017b38c
mov eax, dword [rbp + 0x38]
lea ecx, [rdi + rax - 0x106]
cmp edx, ecx
jb 0x14017b38c
mov rcx, qword [rbp + 0x48]
mov r8, rdi
lea rdx, [rcx + rdi]
call fcn.14011e9b0
mov r8d, dword [rbp + 0x6c]
mov rax, qword [rbp + 0x60]
sub dword [rbp + 0x90], edi
sub dword [rbp + 0x8c], edi
sub dword [rbp + 0x7c], edi
lea rdx, [rax + r8*2]
movzx eax, word [rdx - 2]
sub rdx, 2
cmp eax, edi
jb 0x14017b350
sub eax, edi
jmp 0x14017b352
xor eax, eax
add r8d, 0xffffffff
mov word [rdx], ax
jne 0x14017b340
mov rax, qword [rbp + 0x58]
mov edx, edi
lea rcx, [rax + rdi*2]
nop
nop
nop
movzx eax, word [rcx - 2]
sub rcx, 2
cmp eax, edi
jb 0x14017b380
sub eax, edi
jmp 0x14017b382
xor eax, eax
add edx, 0xffffffff
mov word [rcx], ax
jne 0x14017b370
add ebx, edi
mov rsi, qword [rbp]
cmp dword [rsi + 8], 0
je 0x14017b44e
mov eax, dword [rbp + 0x8c]
mov r13d, dword [rbp + 0x94]
add r13, rax
mov eax, dword [rsi + 8]
add r13, qword [rbp + 0x48]
cmp eax, ebx
mov r12d, eax
cmova r12d, ebx
test r12d, r12d
je 0x14017b3f8
sub eax, r12d
mov dword [rsi + 8], eax
mov rax, qword [rsi + 0x28]
cmp dword [rax + 0x2c], 0
jne 0x14017b3e0
mov rdx, qword [rsi]
mov ecx, dword [rsi + 0x4c]
mov r8d, r12d
call fcn.14008c4f0
mov dword [rsi + 0x4c], eax
mov rdx, qword [rsi]
mov r8d, r12d
mov rcx, r13
mov ebx, r12d
call fcn.14011e9b0
add qword [rsi], rbx
add dword [rsi + 0xc], r12d
add dword [rbp + 0x94], r12d
mov r9d, dword [rbp + 0x94]
cmp r9d, 3
jb 0x14017b437
mov eax, dword [rbp + 0x8c]
mov rdx, qword [rbp + 0x48]
mov ecx, dword [rbp + 0x78]
movzx r8d, byte [rax + rdx]
add eax, 1
mov dword [rbp + 0x68], r8d
movzx eax, byte [rax + rdx]
shl r8d, cl
xor r8d, eax
and r8d, dword [rbp + 0x74]
mov dword [rbp + 0x68], r8d
cmp r9d, 0x106
jae 0x14017b44e
mov rax, qword [rbp]
cmp dword [rax + 8], 0
jne 0x14017b2d0
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x14017c570
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 8
test rdx, rdx
mov r11d, r8d
mov r10, rdx
mov r9d, ecx
jne 0x14017c589
xor eax, eax
add rsp, 8
ret
cmp r11d, 8
mov qword [rsp], rdi
not r9d
lea rdi, [0x1401c9150]
jb 0x14017c66a
mov qword [rsp + 0x10], rbx
mov rbx, r11
shr rbx, 3
nop
movzx ecx, byte [r10]
add r10, 8
add r11d, 0xfffffff8
xor cl, r9b
shr r9d, 8
movzx eax, cl
movzx ecx, byte [r10 - 7]
mov edx, dword [rdi + rax*4]
xor edx, r9d
xor cl, dl
shr edx, 8
movzx eax, cl
movzx ecx, byte [r10 - 6]
mov r8d, dword [rdi + rax*4]
xor r8d, edx
xor cl, r8b
shr r8d, 8
movzx eax, cl
movzx ecx, byte [r10 - 5]
mov edx, dword [rdi + rax*4]
xor edx, r8d
xor cl, dl
shr edx, 8
movzx eax, cl
movzx ecx, byte [r10 - 4]
mov r8d, dword [rdi + rax*4]
xor r8d, edx
xor cl, r8b
shr r8d, 8
movzx eax, cl
movzx ecx, byte [r10 - 3]
mov edx, dword [rdi + rax*4]
xor edx, r8d
xor cl, dl
shr edx, 8
movzx eax, cl
movzx ecx, byte [r10 - 2]
mov r8d, dword [rdi + rax*4]
xor r8d, edx
xor cl, r8b
shr r8d, 8
movzx eax, cl
movzx ecx, byte [r10 - 1]
mov edx, dword [rdi + rax*4]
xor edx, r8d
xor cl, dl
shr edx, 8
movzx eax, cl
mov r9d, dword [rdi + rax*4]
xor r9d, edx
sub rbx, 1
jne 0x14017c5b0
mov rbx, qword [rsp + 0x10]
test r11d, r11d
je 0x14017c691
nop
movzx ecx, byte [r10]
mov eax, r9d
add r10, 1
xor cl, r9b
shr eax, 8
movzx edx, cl
mov r9d, dword [rdi + rdx*4]
xor r9d, eax
add r11d, 0xffffffff
jne 0x14017c670
mov rdi, qword [rsp]
not r9d
mov eax, r9d
add rsp, 8
ret
Function at 0x140183470
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
sub rsp, 0x40
cmp qword [rcx + 0x10], 0
mov rbp, rcx
jne 0x1401834a0
xor edx, edx
call fcn.140091e60
mov dl, 1
mov rcx, rbp
call fcn.1401831c0
xor edx, edx
mov rcx, rbp
add rsp, 0x40
pop rbp
jmp fcn.140091f80
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
xor edx, edx
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], r12
call fcn.1401831c0
mov rcx, qword [rbp + 0x10]
lea rdx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetWindowRect]
lea r12, [rbp + 0x188]
mov rax, qword [r12 + 8]
mov qword [rsp + 0x20], r12
mov rcx, qword [rax]
mov qword [rsp + 0x28], rcx
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
mov rsi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
nop
nop
test rsi, rsi
mov rdi, qword [r12 + 8]
je 0x14018350f
cmp rsi, r12
je 0x140183514
call fcn.14011ef50
cmp rbx, rdi
je 0x1401835eb
test rsi, rsi
jne 0x140183527
call fcn.14011ef50
cmp rbx, qword [rsi + 8]
jne 0x140183532
call fcn.14011ef50
mov edx, dword [rbx + 0x18]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
mov rdi, rax
je 0x140183585
mov rcx, qword [rbp + 0x10]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_InvalidateRect]
cmp rbx, qword [rsi + 8]
jne 0x140183561
call fcn.14011ef50
mov r9, qword [rbx + 0x20]
mov rcx, qword [rbp + 0x10]
lea r8, [rsp + 0x30]
mov rdx, rdi
call fcn.140184680
lea rcx, [rbp + 0xd8]
mov rdx, rdi
call fcn.140099e30
cmp byte [rbx + 0x29], 0
je 0x140183595
call fcn.14011ef50
jmp 0x140183500
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x29], 0
jne 0x1401835c1
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x29], 0
jne 0x140183500
nop
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x29], 0
je 0x1401835b0
jmp 0x140183500
mov rax, qword [rbx + 8]
cmp byte [rax + 0x29], 0
jne 0x1401835e3
nop
nop
cmp rbx, qword [rax + 0x10]
jne 0x1401835e3
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x29], 0
je 0x1401835d0
mov rbx, rax
jmp 0x140183500
mov edx, dword [rbp + 0x78]
mov rcx, rbp
call fcn.140091d70
mov rcx, qword [rbp + 0x10]
lea r8, [rsp + 0x30]
mov rdx, rax
xor r9d, r9d
call fcn.140184680
mov r12, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x140183690
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
sub rsp, 0x70
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov r12, r8
mov r13, rcx
lea rbp, [rcx + 0x188]
mov rdi, qword [rbp + 8]
mov rax, qword [rdi + 8]
cmp byte [rax + 0x29], 0
jne 0x1401836e7
nop
cmp dword [rax + 0x18], edx
jge 0x1401836db
mov rax, qword [rax + 0x10]
jmp 0x1401836e1
mov rdi, rax
mov rax, qword [rax]
cmp byte [rax + 0x29], 0
je 0x1401836d0
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rbp
xor esi, esi
cmp rdi, qword [rbp + 8]
je 0x1401836fe
cmp edx, dword [rdi + 0x18]
jge 0x14018376b
mov qword [rsp + 0x90], rsi
mov dword [rsp + 0x40], edx
or edx, 0xffffffff
xor ecx, ecx
call fcn.14007b6e0
mov rbx, rax
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x50], xmm0
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x60]
mov rcx, rbp
call fcn.1400818f0
lea rdx, [rsp + 0x30]
mov rcx, qword [rax]
mov qword [rdx], rcx
mov rax, qword [rax + 8]
mov qword [rdx + 8], rax
mov rcx, rbx
call fcn.14011e0c0
nop
xor ecx, ecx
call fcn.14011e0c0
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
test rbp, rbp
jne 0x140183775
call fcn.14011ef50
cmp rdi, qword [rbp + 8]
jne 0x140183780
call fcn.14011ef50
mov rax, qword [rdi + 0x20]
test rax, rax
je 0x1401837ad
test r12, r12
je 0x1401837b9
mov rdx, r12
sub rdx, rax
movzx ecx, byte [rax]
cmp cl, byte [rax + rdx]
jne 0x1401837a6
add rax, 1
test cl, cl
jne 0x140183794
jmp 0x1401837b5
sbb esi, esi
sbb esi, 0xffffffff
jmp 0x1401837b5
mov rax, r12
neg rax
sbb esi, esi
test esi, esi
je 0x1401837d4
or edx, 0xffffffff
mov rcx, r12
call fcn.14007b6e0
mov rbx, rax
mov rcx, qword [rdi + 0x20]
call fcn.14011e0c0
mov qword [rdi + 0x20], rbx
mov rcx, r13
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
jmp fcn.140183470
mov rax, rcx
mov r8, rdx
add rcx, 0xffffffffffffffb0
mov edx, dword [rax + 0x158]
jmp 0x140183690