joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004388
Capabilities:
Access peb ldr_data

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xc8
mov esi, ecx
mov rax, qword gs:[0x60]
mov rdi, qword [rax + 0x18]
lea rbx, [rdi + 0x20]
mov r14, qword [rbx]
mov rcx, qword [r14 + 0x50]
movzx edx, word [r14 + 0x48]
call fcn.1000467b
cmp eax, esi
je 0x10004464
cmp rbx, qword [rdi + 0x28]
mov rbx, r14
jne 0x100043a7
lea rax, str.Module_not_found__n
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], 1
mov qword [rsp + 0x78], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x80], xmm0
lea rax, str.stdoutlibrary_std_srciomod.rs
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 6
mov rax, qword [0x1007d038]
cmp rax, 3
je 0x10004425
mov rax, qword [0x1007d038]
cmp rax, 3
jne 0x10004553
call fcn.1003cde0
test rax, rax
je 0x100045ad
mov rsi, rax
mov rax, qword [0x1007d040]
cmp rax, rsi
jne 0x1000446d
mov eax, dword [0x1007d048]
inc eax
jne 0x1000448b
lea rcx, str.lock_count_overflow_in_reentrant_mutexlibrary_std_src_sync_reentrant_lock.rs
lea r8, [0x10073c60]
mov edx, 0x26
call fcn.1002af10
mov rax, qword [r14 + 0x20]
jmp 0x10004546
mov cl, 1
xor eax, eax
lock cmpxchg byte [0x1007d04c], cl
jne 0x1000459c
mov qword [0x1007d040], rsi
mov eax, 1
mov dword [0x1007d048], eax
lea rax, [0x1007d040]
lea rbx, [rsp + 0x30]
mov qword [rbx], rax
lea rsi, [rsp + 0x38]
mov qword [rsi], rbx
and qword [rsi + 8], 0
lea rdx, [0x10073020]
lea r8, [rsp + 0x68]
mov rcx, rsi
call fcn.10029fa0
mov rdi, qword [rsp + 0x40]
test al, al
je 0x10004509
test rdi, rdi
jne 0x10004518
lea rax, str.a_formatting_trait_implementation_returned_an_error_when_the_underlying_stream_did_not
lea rcx, [rsp + 0x98]
mov qword [rcx], rax
mov qword [rcx + 8], 1
mov qword [rcx + 0x10], 8
xorps xmm0, xmm0
movups xmmword [rcx + 0x18], xmm0
lea rdx, [0x10073968]
call fcn.100290d0
jmp 0x10004636
test rdi, rdi
je 0x10004516
mov rcx, rdi
call fcn.1003af30
xor edi, edi
mov rcx, qword [rsp + 0x30]
dec dword [rcx + 8]
jne 0x1000453b
mov qword [rcx], 0
xor eax, eax
xchg byte [rcx + 0xc], al
cmp al, 2
jne 0x1000453b
add rcx, 0xc
call sub.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressSingle
test rdi, rdi
jne 0x100045d6
xor eax, eax
add rsp, 0xc8
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rax, [0x1007d040]
lea rdx, [rsp + 0x98]
mov qword [rdx], rax
lea rcx, [0x1007d038]
lea rax, [rsp + 0x30]
mov qword [rdx + 8], rax
lea r8, [rsp + 0x38]
mov qword [r8], rdx
lea rax, str.library_std_src_synconce.rs
mov qword [rsp + 0x20], rax
lea r9, [0x10073bd0]
mov dl, 1
call fcn.1003c440
jmp 0x10004425
lea rcx, [0x1007d04c]
call fcn.1003ffb0
jmp 0x1000447f
lea rax, [0x10073258]
mov qword [rsp + 0x20], rax
lea rcx, [0x100731f0]
lea r9, [0x10072a90]
lea r8, [rsp + 0x30]
mov edx, 0x46
call fcn.1002ad50
mov qword [rsp + 0x30], rdi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rax, [0x1003d4d0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
lea rax, str.failed_printing_to_:
lea rcx, [rsp + 0x98]
mov qword [rcx], rax
mov eax, 2
mov qword [rcx + 8], rax
and qword [rcx + 0x20], 0
lea rdx, [0x100594f0]
mov qword [rsp + 0x50], rdx
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], rax
lea rdx, str.library_std_srcio_stdio.rs
call fcn.100290d0
ud2
Function at 0x1000467b
Capabilities:
Hash data using djb2

Disassembly:
mov eax, 0x1505
xor r8d, r8d
cmp r8, rdx
jae 0x100046b7
mov r9b, byte [rcx + r8]
test r9b, r9b
jne 0x10004696
inc r8
jmp 0x10004683
lea r10d, [r9 - 0x20]
cmp r9b, 0x61
movzx r9d, r9b
movzx r10d, r10b
cmovb r10d, r9d
imul r9d, eax, 0x21
movzx eax, r10b
add eax, r9d
jmp 0x10004691
ret
Function at 0x1001b79c
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x10064048]
test ecx, ecx
je 0x1001b7b5
dec ecx
add rsp, 0x28
jmp fcn.10061224
lea rcx, [0x10064030]
call fcn.1003aca0
mov ecx, eax
jmp 0x1001b7ac

Function at 0x1001b7c5
Capabilities:
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rdx
mov rax, rcx
mov ecx, dword [rcx + 0x18]
test ecx, ecx
je 0x1001b7e6
dec ecx
mov rdx, rsi
add rsp, 0x20
pop rsi
jmp fcn.1006121c
mov rcx, rax
call fcn.1003aca0
mov ecx, eax
jmp 0x1001b7d9
Function at 0x10020a1c
Capabilities:
Read file via mapping

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x88
lea rax, [rsp + 0x40]
and dword [rax], 0
mov rsi, rcx
xorps xmm0, xmm0
movups xmmword [rax + 8], xmm0
mov dword [rax + 0x18], 7
and qword [rax + 0x1c], 0
and word [rax + 0x24], 0
mov byte [rax + 0x20], 1
mov rcx, rax
call fcn.1005a350
mov rcx, rax
call fcn.10020ca1
test rax, rax
je 0x10020aa3
mov rdi, rdx
lea rbx, [rsp + 0x40]
mov rcx, rbx
call fcn.10058010
cmp dword [rbx], 2
jne 0x10020aac
mov rcx, qword [rsp + 0x48]
call fcn.1001b73e
and qword [rsi], 0
mov rcx, rdi
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.100613fc
and qword [rsi], 0
jmp 0x10020b96
mov r12, qword [rsp + 0x78]
test rdi, rdi
je 0x10020af2
lea rbx, [rsp + 0x40]
and qword [rbx], 0
call sub.KERNEL32.dll_GetCurrentProcess
and dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 2
and dword [rsp + 0x20], 0
mov rcx, rax
mov rdx, rdi
mov r8, rax
mov r9, rbx
call sub.KERNEL32.dll_DuplicateHandle
test eax, eax
je 0x10020af8
mov rdx, qword [rsp + 0x40]
jmp 0x10020af4
xor edx, edx
xor ecx, ecx
jmp 0x10020b0c
call sub.KERNEL32.dll_GetLastError
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov ecx, 1
call fcn.10020ca1
test rax, rax
je 0x10020b8a
mov rbx, rdx
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
mov rcx, rdx
xor edx, edx
mov r8d, 2
xor r9d, r9d
call sub.KERNEL32.dll_CreateFileMappingA
test rax, rax
je 0x10020b7c
mov r14, rax
mov qword [rsp + 0x20], r12
mov rcx, rax
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call sub.KERNEL32.dll_MapViewOfFile
mov r15, rax
mov rcx, r14
call fcn.100613fc
test r15, r15
je 0x10020b7c
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], r12
mov qword [rsi], 1
jmp 0x10020b8e
and qword [rsi], 0
mov rcx, rbx
call fcn.100613fc
jmp 0x10020b8e
and qword [rsi], 0
mov rcx, rdi
call fcn.100613fc
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x1002613d
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x100640e8]
test ecx, ecx
je 0x10026156
dec ecx
add rsp, 0x28
jmp fcn.10061224
lea rcx, [0x100640d0]
call fcn.1003aca0
mov ecx, eax
jmp 0x1002614d

Function at 0x10028e0e
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
movaps xmmword [rsp + 0x30], xmm6
call fcn.1002613d
cmp rax, 1
jbe 0x10028e2e
mov rsi, rax
add rsi, 8
jmp 0x10028e9a
je 0x10028e98
xorps xmm0, xmm0
lea rsi, [rsp + 0x20]
movaps xmmword [rsi], xmm0
mov edx, 0x10
mov rcx, rsi
call sub.bcryptprimitives.dll_ProcessPrng
movaps xmm6, xmmword [rsi]
call fcn.10026110
mov rsi, rax
mov rbx, rax
lea rax, [0x100640d0]
mov qword [rsi], rax
movups xmmword [rsi + 8], xmm6
call fcn.1002613d
mov rdi, rax
mov ecx, dword [0x100640e8]
test ecx, ecx
je 0x10028eaa
dec ecx
add rsi, 8
mov rdx, rbx
call fcn.1006121c
test rdi, rdi
je 0x10028e9a
mov edx, 8
mov rcx, rdi
call fcn.1000d450
jmp 0x10028e9a
xor esi, esi
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x100640d0]
call fcn.1003aca0
mov ecx, eax
jmp 0x10028e78
Function at 0x1002c620
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rax, rdx
mov rsi, qword [rbp + 0x70]
mov rdi, qword [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x1002c6a0
cmp r11, r10
ja 0x1002c717
cmp r10, rdx
ja 0x1002c729
add r11, r9
xor r15d, r15d
nop dword [rax + rax]
cmp r14, r15
je 0x1002c6a2
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x1002c680
jmp 0x1002c704
ja 0x1002c6aa
mov r11, r10
cmp rax, r8
jne 0x1002c64e
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x1002c6e0
mov rdi, r8
sub ecx, edx
jns 0x1002c6fb
jmp 0x1002c706
cmp r8, rsi
je 0x1002c738
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x1002c706
xor al, 1
cmp rdi, rsi
jne 0x1002c6c0
jmp 0x1002c706
xor eax, eax
and al, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.1002ae80
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.10029a50
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.1002aef0
int3

Function at 0x1002e3b8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
cmp r8, qword [rsp + 0x70]
jne 0x1002e42b
mov r10b, byte [rcx + 0x100]
mov al, byte [rcx + 0x101]
inc r10b
movzx r10d, r10b
xor r11d, r11d
cmp r8, r11
je 0x1002e422
lea esi, [r10 + r11]
mov byte [rcx + 0x100], sil
movzx esi, sil
mov bl, byte [rcx + rsi]
add al, bl
mov byte [rcx + 0x101], al
movzx edi, al
mov bpl, byte [rcx + rdi]
mov byte [rcx + rsi], bpl
mov byte [rcx + rdi], bl
add bl, byte [rcx + rsi]
mov sil, byte [rdx + r11]
movzx edi, bl
xor sil, byte [rcx + rdi]
mov byte [r9 + r11], sil
inc r11
jmp 0x1002e3de
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
lea rcx, str.assertion_failed:_input.len____output.len__C:UsersUser.cargo_registry_srcindex.crates.io_6f17d22bba15001f_rust_crypto_0.2.36_src_rc4.rs
lea r8, [0x100712a0]
mov edx, 0x2d
call fcn.10029dc0
int3

Function at 0x10037be0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rdx, rcx
cmp rdx, 0x20
jae 0x10037bf3
pop rbp
jmp fcn.1002c9b0
nop
pop rbp
jmp fcn.100295e0
Function at 0x10038ad0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov r10, qword [rcx]
test r10, r10
je 0x10038b54
mov r11, qword [rcx + 8]
mov r8, qword [rcx + 0x10]
cmp r8, r11
jae 0x10038b54
movzx eax, byte [r10 + r8]
cmp eax, 0x49
mov rbx, rcx
je 0x10038b6d
cmp eax, 0x42
jne 0x10038b54
lea rsi, [r8 + 1]
mov qword [rcx + 0x10], rsi
mov r9b, 1
cmp rsi, r11
jae 0x10038c9d
cmp byte [r10 + rsi], 0x5f
jne 0x10038c2c
lea rax, [r8 + 2]
mov qword [rcx + 0x10], rax
xor eax, eax
cmp rax, r8
jae 0x10038c9d
mov edx, dword [rcx + 0x18]
inc edx
cmp edx, 0x1f4
jbe 0x10038cf7
mov dil, 1
xor r9d, r9d
jmp 0x10038c9f
xor edx, edx
call fcn.100346b0
mov esi, eax
add sil, sil
mov eax, esi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
inc r8
mov qword [rcx + 0x10], r8
xor edx, edx
call fcn.100346b0
test al, al
jne 0x10038cdd
mov rdx, rbx
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x10038bac
lea rdx, [0x10071f63]
mov r8d, 1
call fcn.10029ac0
mov rdx, rbx
test al, al
jne 0x10038cdd
mov rax, qword [rdx]
mov sil, 1
test rax, rax
je 0x10038b60
xor r14d, r14d
lea rdi, [0x100722b9]
nop word cs:[rax + rax]
mov rcx, qword [rdx + 0x10]
cmp rcx, qword [rdx + 8]
jae 0x10038be4
cmp byte [rax + rcx], 0x45
je 0x10038d30
sub r14, 1
jb 0x10038c0c
mov rcx, qword [rdx + 0x20]
test rcx, rcx
je 0x10038c0c
mov r8d, 2
mov rdx, rdi
call fcn.10029ac0
mov rdx, rbx
test al, al
jne 0x10038cdd
mov rcx, rdx
call fcn.10035f40
test al, al
jne 0x10038cdd
mov rdx, rbx
mov rax, qword [rbx]
test rax, rax
jne 0x10038bd0
jmp 0x10038b60
xor eax, eax
mov r14d, 0x3e
nop word cs:[rax + rax]
movzx edx, byte [r10 + rsi]
cmp dl, 0x5f
je 0x10038c8d
lea edi, [rdx - 0x30]
cmp dil, 0xa
jb 0x10038c6f
lea edi, [rdx - 0x61]
cmp dil, 0x1a
jae 0x10038c61
add dl, 0xa9
jmp 0x10038c6d
lea edi, [rdx - 0x41]
cmp dil, 0x1a
jae 0x10038c9d
add dl, 0xe3
mov edi, edx
inc rsi
mov qword [rcx + 0x10], rsi
mul r14
jo 0x10038c9d
movzx edx, dil
xor edi, edi
add rax, rdx
jb 0x10038c9f
cmp rsi, r11
jb 0x10038c40
jmp 0x10038c9f
inc rsi
mov qword [rcx + 0x10], rsi
inc rax
jne 0x10038b2f
xor edi, edi
mov rax, qword [rcx + 0x20]
test rax, rax
je 0x10038ce5
mov ecx, r9d
xor cl, 1
movzx ecx, cl
lea r8, [rcx + rcx*8]
add r8, 0x10
lea rcx, str.invalid_syntaxrecursion_limit_reached_for_______::closureshim_as__mut_const___dyn___unsafe_extern__
lea rdx, [0x10072298]
test r9b, r9b
cmovne rdx, rcx
mov rcx, rax
call fcn.10029ac0
mov rcx, rbx
test al, al
je 0x10038ce5
mov sil, 2
jmp 0x10038b60
mov qword [rcx], 0
mov byte [rcx + 8], dil
xor esi, esi
jmp 0x10038b60
cmp qword [rcx + 0x20], 0
je 0x10038cf0
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
movaps xmmword [rbp - 0x10], xmm1
movaps xmmword [rbp - 0x20], xmm0
mov qword [rcx + 0x10], rax
mov dword [rcx + 0x18], edx
mov rsi, rcx
call fcn.10038ad0
movaps xmm0, xmmword [rbp - 0x20]
movaps xmm1, xmmword [rbp - 0x10]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
jmp 0x10038b62
inc rcx
mov qword [rdx + 0x10], rcx
jmp 0x10038b60
Function at 0x1003aca0
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov rsi, rcx
cmp qword [rcx], 0
je 0x1003ad35
mov rax, qword [0x10081030]
mov dword [rbp], 0
lea rbx, [rsi + 0x10]
mov r8, rbp
mov rcx, rbx
xor edx, edx
xor r9d, r9d
call sub.KERNEL32.dll_InitOnceBeginInitialize
mov dword [rbp - 4], eax
cmp eax, 1
jne 0x1003ad74
cmp dword [rbp], 0
je 0x1003ad58
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x1003ad89
mov edi, eax
mov rax, qword [0x1007d0b8]
nop word cs:[rax + rax]
mov qword [rsi + 8], rax
lock cmpxchg qword [0x1007d0b8], rsi
jne 0x1003ad10
mov eax, edi
inc eax
mov dword [rsi + 0x18], eax
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
jmp 0x1003ad69
call sub.KERNEL32.dll_TlsAlloc
mov dword [rbp + 4], eax
cmp eax, 0xffffffff
je 0x1003adcb
mov ecx, eax
inc ecx
xor eax, eax
lock cmpxchg dword [rsi + 0x18], ecx
jne 0x1003ad5d
mov edi, dword [rbp + 4]
jmp 0x1003ad69
mov edi, dword [rsi + 0x18]
jmp 0x1003ad67
mov edi, eax
mov ecx, dword [rbp + 4]
call sub.KERNEL32.dll_TlsFree
dec edi
mov eax, edi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov qword [rbp - 0x38], 0
lea rcx, [rbp - 4]
lea rdx, [rbp - 0x38]
call fcn.1003ba60
mov rcx, rbx
mov edx, 4
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
lea rax, str.out_of_TLS_indexes
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
mov qword [rbp - 0x28], 8
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rdx, str.library_std_src_syspalwindows_thread_local_key.rs
lea rcx, [rbp - 0x38]
call fcn.100290d0
lea rax, str.out_of_TLS_indexes
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
mov qword [rbp - 0x28], 8
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 4]
lea rdx, [rbp - 0x38]
call fcn.1003bab0
int3

Function at 0x1003b530
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov rsi, rcx
movups xmm0, xmmword [0x10074488]
movaps xmmword [rbp], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov rax, rbp
mov qword [rsp + 0x20], rax
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.ntdll.dll_NtWriteFile
cmp eax, 0x103
jne 0x1003b59f
mov rcx, rsi
mov edx, 0xffffffff
call sub.KERNEL32.dll_WaitForSingleObject
mov eax, dword [rbp]
cmp eax, 0x103
je 0x1003b5cb
test eax, eax
js 0x1003b5ab
mov rdx, qword [rbp + 8]
xor eax, eax
jmp 0x1003b5c1
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa8
pop rsi
pop rbp
ret
mov dword [rbp + 0x18], 0
mov byte [rbp + 0x1c], 0
lea rax, [0x100744e8]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 1
lea rax, [rbp + 0x20]
mov qword [rbp - 0x20], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
lea rcx, [rbp + 0x18]
lea rdx, [rbp - 0x30]
call fcn.1003ae60
mov rcx, rax
call fcn.1003af10
mov ecx, 7
int 0x29
ud2
Function at 0x1003c7b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov ecx, dword [0x10064108]
test ecx, ecx
je 0x1003c881
dec ecx
call fcn.10061224
cmp rax, 1
jbe 0x1003c7e1
add rax, 8
jmp 0x1003c878
je 0x1003c876
movzx eax, byte [0x1007d0c0]
mov edx, 0x10
xor ecx, ecx
call fcn.1005bce0
test rax, rax
je 0x1003c8b4
mov rbx, rax
mov rsi, rax
lea rax, [0x100640f0]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x10064108]
test ecx, ecx
je 0x1003c894
dec ecx
call fcn.10061224
mov rdi, rax
mov ecx, dword [0x10064108]
test ecx, ecx
je 0x1003c8a4
dec ecx
add rbx, 8
mov rdx, rsi
call fcn.1006121c
test rdi, rdi
je 0x1003c871
mov rax, qword [rdi + 8]
test rax, rax
je 0x1003c864
lock dec qword [rax]
jne 0x1003c864
mov rcx, qword [rdi + 8]
call fcn.1003c360
mov edx, 8
mov rcx, rdi
call fcn.1000d450
mov rax, rbx
jmp 0x1003c878
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea rcx, [0x100640f0]
call fcn.1003aca0
mov ecx, eax
jmp 0x1003c7cd
lea rcx, [0x100640f0]
call fcn.1003aca0
mov ecx, eax
jmp 0x1003c827
lea rcx, [0x100640f0]
call fcn.1003aca0
mov ecx, eax
jmp 0x1003c83b
mov ecx, 8
mov edx, 0x10
call fcn.1000db50
int3

Function at 0x1003cde0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov ecx, dword [0x100640c8]
test ecx, ecx
je 0x1003ce8e
dec ecx
call fcn.10061224
cmp rax, 1
jbe 0x1003ce0e
add rax, 8
jmp 0x1003ce85
je 0x1003ce83
movzx eax, byte [0x1007d0c0]
mov edx, 0x10
xor ecx, ecx
call fcn.1005bce0
test rax, rax
je 0x1003cec1
mov rbx, rax
mov rsi, rax
lea rax, [0x100640b0]
mov qword [rsi], rax
mov byte [rsi + 8], 0
mov ecx, dword [0x100640c8]
test ecx, ecx
je 0x1003cea1
dec ecx
call fcn.10061224
mov rdi, rax
mov ecx, dword [0x100640c8]
test ecx, ecx
je 0x1003ceb1
dec ecx
add rbx, 8
mov rdx, rsi
call fcn.1006121c
test rdi, rdi
je 0x1003ce7e
mov edx, 8
mov rcx, rdi
call fcn.1000d450
mov rax, rbx
jmp 0x1003ce85
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea rcx, [0x100640b0]
call fcn.1003aca0
mov ecx, eax
jmp 0x1003cdfd
lea rcx, [0x100640b0]
call fcn.1003aca0
mov ecx, eax
jmp 0x1003ce4c
lea rcx, [0x100640b0]
call fcn.1003aca0
mov ecx, eax
jmp 0x1003ce60
mov ecx, 8
mov edx, 0x10
call fcn.1000db50
int3
Function at 0x1003d2d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov ecx, dword [0x100640a8]
invalid
insd dword [rdi], dx
add al, byte [rax]
test ecx, ecx
je 0x1003d386
invalid
wait
add byte [rax], al
invalid
dec ecx
call fcn.10061224
cmp rax, 1
clc
add dword [rsi + 6], esi
add rax, 8
jmp 0x1003d37d
je 0x1003d37b
movzx eax, byte [0x1007d0c0]
mov edx, 0x18
xor ecx, ecx
call fcn.1005bce0
jmp 0xffffffff954bd316
invalid
je 0x1003d3b9
mov rbx, rax
mov rsi, rax
mov esi, eax
lea rax, [0x10064090]
mov qword [rsi], rax
mov qword [rsi + 8], 0
add byte [rax], al
add byte [rax], al
mov byte [rsi + 0x10], 0
mov ecx, dword [0x100640a8]
test ecx, ecx
je 0x1003d399
dec ecx
call fcn.10061224
mov rdi, rax
mov ecx, dword [0x100640a8]
test ecx, ecx
je 0x1003d3a9
dec ecx
add rbx, 8
mov rdx, rsi
call fcn.1006121c
invalid
add al, byte ds:[rax]
test rdi, rdi
je 0x1003d376
mov edx, 8
mov rcx, rdi
call fcn.1000d450
mov rax, rbx
jmp 0x1003d37d
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea rcx, [0x10064090]
call fcn.1003aca0
mov ecx, eax
jmp case.0x1003d51c.310
lea rcx, [0x10064090]
call fcn.1003aca0
mov ecx, eax
jmp case.0x1003d51c.295
lea rcx, [0x10064090]
call fcn.1003aca0
mov ecx, eax
jmp case.0x1003d51c.299
mov ecx, 8
mov edx, 0x18
call fcn.1000db50
int3
Function at 0x10040110
Capabilities:
Read file via mapping

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov rax, r8
mov rsi, rcx
mov dword [rbp - 0x48], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x30], 7
mov qword [rbp - 0x2c], 0
mov word [rbp - 0x24], 0
mov byte [rbp - 0x28], 1
lea r8, [rbp - 0x48]
mov rcx, rdx
mov rdx, rax
call fcn.10057dc0
mov rdi, rdx
test rax, rax
je 0x10040181
mov rcx, rdi
call fcn.1003af30
mov qword [rsi], 0
jmp 0x100402a7
lea rcx, [rbp - 0x48]
mov rdx, rdi
call fcn.10058010
cmp dword [rbp - 0x48], 2
jne 0x100401bc
mov rcx, qword [rbp - 0x40]
call fcn.1003af30
mov qword [rsi], 0
mov rcx, rdi
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
jmp fcn.100613fc
mov r12, qword [rbp - 0x10]
test rdi, rdi
je 0x1004020a
mov qword [rbp - 0x48], 0
call sub.KERNEL32.dll_GetCurrentProcess
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rbp - 0x48]
mov rcx, rax
mov rdx, rdi
mov r8, rax
call sub.KERNEL32.dll_DuplicateHandle
test eax, eax
je 0x10040286
mov rbx, qword [rbp - 0x48]
jmp 0x1004020c
xor ebx, ebx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rbx
xor edx, edx
mov r8d, 2
xor r9d, r9d
call sub.KERNEL32.dll_CreateFileMappingA
test rax, rax
je 0x10040275
mov r14, rax
mov qword [rsp + 0x20], r12
mov rcx, rax
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call sub.KERNEL32.dll_MapViewOfFile
mov r15, rax
mov rcx, r14
call fcn.100613fc
test r15, r15
je 0x10040275
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], r12
mov qword [rsi], 1
jmp 0x1004029f
mov qword [rsi], 0
mov rcx, rbx
call fcn.100613fc
jmp 0x1004029f
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
lea rcx, [rax + 2]
call fcn.1003af30
mov qword [rsi], 0
mov rcx, rdi
call fcn.100613fc
nop
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
Function at 0x10059910
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov rsi, r9
mov rdi, r8
mov qword [rbp - 0x18], rdx
mov qword [rbp - 0x10], rcx
add rsi, r8
mov qword [rbp - 0x40], r8
mov qword [rbp - 0x38], rsi
mov byte [rbp - 0x30], 0x81
mov byte [rbp - 0x24], 0x81
mov r14b, 0x81
lea r8, [0x10067bac]
jmp 0x1005996f

Function at 0x10059fe0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov rsi, rcx
movups xmm0, xmmword [0x10074488]
movaps xmmword [rbp], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov rax, rbp
mov qword [rsp + 0x20], rax
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.ntdll.dll_NtReadFile
cmp eax, 0x103
jne 0x1005a048
mov rcx, rsi
mov edx, 0xffffffff
call sub.KERNEL32.dll_WaitForSingleObject
mov eax, dword [rbp]
cmp eax, 0xc0000011
jne 0x1005a055
xor edx, edx
xor eax, eax
jmp 0x1005a07e
cmp eax, 0x103
je 0x1005a088
test eax, eax
js 0x1005a068
invalid
mov rdx, qword [rbp + 8]
xor eax, eax
shr bl, 0x16
mov dword [rbp + 0x18], 0
mov byte [rbp + 0x1c], 0
lea rax, [0x100744e8]
movsb byte [rdi], byte [rsi]
add dword [rax], eax