joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400934b0
Capabilities:
Get thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r14, rdx
mov rsi, rcx
mov eax, 0xffffffff
mov qword [rcx], rax
mov ecx, dword [0x140216b88]
cmp ecx, 0xffffffff
je 0x140093592
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
je 0x140093592
mov eax, dword [0x1402213a8]
mov ecx, dword [0x140216fcc]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14009359c
mov rbx, qword [0x1402213a0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x1400935e2
mov rax, qword [0x14021fb98]
inc rax
xor ecx, ecx
lea r8, [0x14021fba0]
lea edx, [rax + rcx]
movzx edi, dl
lea rdx, [rdi + rdi*2]
cmp dword [r8 + rdx*8], 0
jne 0x1400935ef
lea rax, [r8 + rdx*8]
mov dword [rax], 1
mov qword [rax + 8], r14
mov qword [0x14021fb98], rdi
mov dword [rsi], edi
mov eax, dword [rax + 0x10]
mov dword [rsi + 4], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [rsi]
cmp eax, 0xffffffff
je 0x140093604
cmp eax, 0x100
jge 0x140093607
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.140093380
jmp 0x1400934e4
lea rcx, [0x1402213a8]
call fcn.140100680
cmp dword [0x1402213a8], 0xffffffff
jne 0x140093509
mov ecx, 8
call fcn.140100528
mov rbx, rax
mov rcx, rax
call fcn.1400e44f0
mov qword [0x1402213a0], rbx
lea rcx, [0x1402213a8]
call fcn.140100718
jmp 0x140093509
mov rcx, rbx
call fcn.1400e4500
jmp 0x140093521
inc rcx
cmp rcx, 0x100
jne 0x140093534
jmp 0x140093566
int3
int3
Function at 0x1400a94c0
Capabilities:
Get thread local storage value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r14, r8
mov r12, rdx
mov r13, rcx
lea r15, [rcx + 0x18]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x1400a96a1
mov r8, qword [r13 + 0x28]
test r8, r8
je 0x1400a963f
mov rax, r12
shr rax, 0x20
lea edx, [r12*8]
add rdx, 8
xor rdx, rax
movabs rbx, 0x9ddfea08eb382d69
imul rdx, rbx
mov rcx, rdx
shr rcx, 0x2f
xor rdx, rax
xor rdx, rcx
imul rdx, rbx
mov rcx, rdx
shr rcx, 0x2f
xor rcx, rdx
imul rcx, rbx
mov rax, r8
shr rax, 1
movabs rdx, 0x5555555555555555
and rdx, rax
mov rax, r8
sub rax, rdx
movabs rdx, 0x3333333333333333
mov rbx, rax
and rbx, rdx
shr rax, 2
and rax, rdx
add rax, rbx
mov rdx, rax
shr rdx, 4
add rdx, rax
movabs rax, 0xf0f0f0f0f0f0f0f
and rax, rdx
movabs rdi, 0x101010101010101
imul rdi, rax
shr rdi, 0x38
cmp rdi, 1
ja 0x1400a96ae
lea rbx, [r8 - 1]
and rbx, rcx
mov rax, qword [r13 + 0x20]
mov rax, qword [rax + rbx*8]
test rax, rax
je 0x1400a963f
mov rsi, qword [rax]
test rsi, rsi
je 0x1400a963f
lea r9, [r8 - 1]
mov rax, qword [rsi + 8]
cmp rax, rcx
jne 0x1400a9626
cmp qword [rsi + 0x10], r12
jne 0x1400a9637
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov rdi, qword [0x140222850]
cmp rdi, 1
jbe 0x1400a9658
mov rcx, rdi
call fcn.1400f3470
mov rbx, rax
mov rcx, rdi
mov rdx, r14
call fcn.1400f34b0
mov rcx, qword [r14 + 0x28]
mov rdx, r12
call qword [rcx + reloc.OLEAUT32.dll_VariantClear]
mov rcx, rdi
mov rdx, rbx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.1400f34b0
cmp edi, 1
ja 0x1400a96ca
and rax, r9
cmp rax, rbx
jne 0x1400a963f
mov rsi, qword [rsi]
test rsi, rsi
jne 0x1400a95c7
mov rcx, r15
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
lea rcx, [0x140222850]
call fcn.140084520
test al, al
je 0x1400a96e0
mov qword [0x140222858], 0
lea rbx, [0x140222850]
lea rdi, [0x140222858]
mov rcx, rdi
xor edx, edx
call fcn.1400934b0
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.1400845c0
jmp 0x1400a95ec
mov rcx, r15
call fcn.1400e4500
jmp 0x1400a94ed
mov rbx, rcx
cmp rcx, r8
jb 0x1400a95aa
mov rax, rcx
xor edx, edx
div r8
mov rbx, rdx
jmp 0x1400a95aa
cmp rax, r8
jb 0x1400a9632
xor edx, edx
div r8
mov rax, rdx
jmp 0x1400a9632
mov rdi, qword [0x140222850]
jmp 0x1400a95ec
Function at 0x1400aa860
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
mov eax, dword [0x140221ef0]
mov ecx, dword [0x140216fcc]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400aa8c3
cmp rdi, rsi
je 0x1400aa8b9
mov eax, 0xffffffff
lea rcx, [0x140221af0]
movzx edx, byte [rdi]
movzx ebx, al
xor ebx, edx
shr eax, 8
xor eax, dword [rcx + rbx*4]
inc rdi
cmp rsi, rdi
jne 0x1400aa89f
not eax
jmp 0x1400aa8bb
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x140221ef0]
call fcn.140100680
cmp dword [0x140221ef0], 0xffffffff
jne 0x1400aa88e
lea rbx, [0x140221af0]
mov r8d, 0x400
mov rcx, rbx
mov dl, 0xaa
call fcn.140103d70
xor eax, eax
mov r8d, 0xedb88320
mov edx, eax
shr edx, 1
mov ecx, eax
and ecx, 1
neg ecx
and ecx, r8d
xor ecx, edx
shr ecx, 1
and edx, 1
neg edx
and edx, r8d
xor edx, ecx
shr edx, 1
and ecx, 1
neg ecx
and ecx, r8d
xor ecx, edx
shr ecx, 1
and edx, 1
neg edx
and edx, r8d
xor edx, ecx
shr edx, 1
and ecx, 1
neg ecx
and ecx, r8d
xor ecx, edx
shr ecx, 1
and edx, 1
neg edx
and edx, r8d
xor edx, ecx
shr edx, 1
and ecx, 1
neg ecx
and ecx, r8d
xor ecx, edx
shr ecx, 1
and edx, 1
neg edx
and edx, r8d
xor edx, ecx
mov dword [rbx], edx
inc rax
add rbx, 4
cmp rax, 0x100
jne 0x1400aa8f7
lea rcx, [0x140221ef0]
call fcn.140100718
jmp 0x1400aa88e

Function at 0x1400acc70
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x1400acc85
mov dword [rsi], eax
cmp eax, 0xffffffff
setne al
add rsp, 0x20
pop rsi
ret

Function at 0x1400afb70
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
sub rsp, 0x28
cmp qword [0x140221fb0], 0
jne 0x1400afbad
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x1400afba0
mov dword [rdi], eax
mov dword [0x140221fb8], eax
mov qword [0x140221fb0], rsi
cmp eax, 0xffffffff
setne al
add rsp, 0x28
pop rdi
pop rsi
ret
int3

Function at 0x1400b2b20
Capabilities:
Create thread

Disassembly:
push rsi
sub rsp, 0x40
mov rsi, rcx
mov rax, qword [0x140213038]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x1400b2bc0]
xor ecx, ecx
xor edx, edx
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi + 8], rax
test rax, rax
je 0x1400b2b79
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1401013e0
nop
add rsp, 0x40
pop rsi
ret
lea rdx, str..._.._third_party_crashpad_crashpad_util_thread_thread_win.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x1b
call fcn.1401765c0
mov rcx, rsi
call fcn.1401764f0
lea rdx, [0x1401ecf86]
mov r8d, ntohl
mov rcx, rax
call fcn.1400cf4f0
mov rcx, rsi
call fcn.140176500
jmp 0x1400b2b65
Function at 0x1400c01a0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdi, qword [0x140222860]
cmp rdi, 1
jbe 0x1400c01c9
mov rcx, rdi
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1400f34b0
lea rcx, [0x140222860]
call fcn.140084520
test al, al
je 0x1400c020f
mov qword [0x140222868], 0
lea rbx, [0x140222860]
lea rdi, [0x140222868]
mov rcx, rdi
xor edx, edx
call fcn.1400934b0
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.1400845c0
jmp 0x1400c01b7
mov rdi, qword [0x140222860]
jmp 0x1400c01b7
Function at 0x1400e0ab0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xb8
mov esi, r9d
mov r14, r8
mov r12, rdx
mov r15, rcx
mov rax, qword [0x140213038]
xor rax, rsp
mov qword [rsp + 0xb0], rax
movaps xmm0, xmmword [0x1401d9dd0]
lea rdi, [rsp + 0x60]
movaps xmmword [rdi + 0x40], xmm0
movaps xmmword [rdi + 0x30], xmm0
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
lea rdx, str.Read
lea r8, str..._.._base_files_file_win.cc
lea rbx, [rsp + 0x40]
mov rcx, rbx
mov r9d, 0x3e
call fcn.1400d95e0
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.1400e5a80
test esi, esi
js 0x1400e0bdd
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
call fcn.1400e5320
test al, al
jne 0x1400e0be4
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r12
lea r9, [rsp + 0x2c]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [r15]
mov qword [rsp + 0x20], rbx
mov rdx, r14
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400e0bca
mov esi, dword [rsp + 0x2c]
lea rcx, [rsp + 0x30]
call fcn.1400e5390
lea rcx, [rsp + 0x60]
call fcn.1400e5c10
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1401013e0
mov eax, esi
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x26
setne sil
neg esi
jmp 0x1400e0b93
mov esi, 0xffffffff
jmp 0x1400e0b9d
mov r9d, esi
lea rdx, str.File::Read
lea rcx, [rsp + 0x30]
mov r8, r15
call fcn.140170ec0
jmp 0x1400e0b59

Function at 0x1400e0c00
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc0
mov r14d, r9d
mov r15, r8
mov rbp, rdx
mov r12, rcx
mov rax, qword [0x140213038]
xor rax, rsp
mov qword [rsp + 0xb8], rax
movaps xmm0, xmmword [0x1401d9dd0]
lea rsi, [rsp + 0x60]
movaps xmmword [rsi + 0x40], xmm0
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rdx, str.Write
lea r8, str..._.._base_files_file_win.cc
lea rbx, [rsp + 0x40]
mov rcx, rbx
mov r9d, 0x73
call fcn.1400d95e0
xor edi, edi
mov rcx, rsi
mov rdx, rbx
xor r8d, r8d
call fcn.1400e5a80
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
call fcn.1400e5320
test al, al
jne 0x1400e0d14
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rbp
lea rsi, [rsp + 0x2c]
mov dword [rsi], 0xaaaaaaaa
mov rcx, qword [r12]
mov qword [rsp + 0x20], rbx
mov rdx, r15
mov r8d, r14d
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sbb edi, edi
or edi, dword [rsi]
lea rcx, [rsp + 0x30]
call fcn.1400e5390
lea rcx, [rsp + 0x60]
call fcn.1400e5c10
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.1401013e0
mov eax, edi
add rsp, 0xc0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
movsxd r9, r14d
lea rdx, str.File::Write
lea rcx, [rsp + 0x30]
mov r8, r12
call fcn.140170ec0
jmp 0x1400e0ca0
Function at 0x1400e0d40
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov qword [rcx], 0
test rdx, rdx
je 0x1400e0d87
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x1400e0da1
lea rax, [rdi + 1]
cmp rax, 2
jb 0x1400e0d7f
mov qword [rsi], rdi
call fcn.1400d9600
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [rsi + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp rax, rdi
je 0x1400e0db7
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.1400d9600
mov rcx, qword [rsi]
call fcn.1400e0e60
mov qword [rsi], 0
jmp 0x1400e0d6d
int3
Function at 0x1400e1e00
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
cmp dword [0x14021f9f0], 0
je 0x1400e1e32
mov r8, qword [rsi]
mov rcx, qword [rsi + 0x28]
mov rdx, rdi
mov r9d, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1400d24c0
mov rdx, qword [rsi]
movsxd r8, ebx
mov rcx, rdi
call fcn.140103960
mov ecx, dword [rsi + 0x4c]
mov r8d, ebx
mov rdx, rdi
call fcn.1400e18d0
mov dword [rsi + 0x4c], eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400e3850
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
xor eax, eax
test r8d, r8d
sete al
xor ebx, ebx
test edx, edx
sete bl
xor ecx, ecx
mov edx, ebx
mov r8d, eax
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi], 0
test rax, rax
je 0x1400e38e7
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x1400e38d1
lea rax, [rdi + 1]
cmp rax, 2
jb 0x1400e38ae
mov qword [rsi], rdi
call fcn.1400d9600
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsi]
mov byte [rsi + 8], 1
inc rax
cmp rax, 1
jbe 0x1400e38eb
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.1400d9600
mov rcx, qword [rsi]
call fcn.1400e0e60
mov qword [rsi], 0
jmp 0x1400e389c
mov byte [rsi + 8], 1
int3
Function at 0x1400e4120
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
movapd xmmword [rsp + 0x40], xmm6
mov rsi, rcx
mov rax, qword [0x140213038]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x20]
call fcn.1400e0e40
mov qword [rsp + 0x28], 0
mov rcx, qword [rsp + 0x20]
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryThreadCycleTime]
movsd xmm0, qword [0x14021d660]
xorpd xmm6, xmm6
ucomisd xmm0, xmm6
jne 0x1400e417d
jnp 0x1400e41e2
ucomisd xmm0, xmm6
jne 0x1400e4189
jnp 0x1400e430c
movsd xmm1, qword [rsp + 0x28]
unpcklps xmm1, xmmword [0x1401d9df0]
subpd xmm1, xmmword [0x1401d9e00]
movapd xmm2, xmm1
unpckhpd xmm2, xmm1
addsd xmm2, xmm1
divsd xmm2, xmm0
mulsd xmm2, qword [0x1401ee720]
cvttsd2si rax, xmm2
mov qword [rsi], rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1401013e0
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rbx, qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov r12d, eax
call rbx
mov rcx, rax
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x14021d670]
mov ecx, dword [0x140216fcc]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400e4313
mov eax, dword [0x14021d680]
mov ecx, dword [0x140216fcc]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400e434d
rdtsc
mov r14, rax
mov r15, rdx
xor edi, edi
lea rbx, [rsp + 0x30]
mov qword [rbx], rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rbp, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov qword [rbx], rdi
lea rdi, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub rbp, qword [0x14021d678]
movq xmm1, rbp
punpckldq xmm1, xmmword [0x1401d9df0]
subpd xmm1, xmmword [0x1401d9e00]
haddpd xmm1, xmm1
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rdi]
divsd xmm1, xmm0
xorpd xmm0, xmm0
movsd xmm2, qword [0x1401ee718]
ucomisd xmm2, xmm1
ja 0x1400e417d
shl r15, 0x20
or r14, r15
sub r14, qword [0x14021d668]
movq xmm0, r14
punpckldq xmm0, xmmword [0x1401d9df0]
subpd xmm0, xmmword [0x1401d9e00]
haddpd xmm0, xmm0
divsd xmm0, xmm1
movsd qword [0x14021d660], xmm0
jmp 0x1400e417d
xor eax, eax
jmp 0x1400e41bb
lea rcx, [0x14021d670]
call fcn.140100680
cmp dword [0x14021d670], 0xffffffff
jne 0x1400e422c
rdtsc
shl rdx, 0x20
or rdx, rax
mov qword [0x14021d668], rdx
lea rcx, [0x14021d670]
call fcn.140100718
jmp 0x1400e422c
lea rcx, [0x14021d680]
call fcn.140100680
cmp dword [0x14021d680], 0xffffffff
jne 0x1400e4251
lea rbx, [rsp + 0x30]
mov qword [rbx], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbx]
mov qword [0x14021d678], rax
lea rcx, [0x14021d680]
call fcn.140100718
jmp 0x1400e4251
Function at 0x1400f2450
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test rdx, rdx
je 0x1400f2488
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
mov rbx, rsi
cmp rsi, r14
jae 0x1400f2492
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x1400f2499
add rdi, rbx
sub rsi, rbx
jne 0x1400f246a
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov ebx, 0xffffffff
jmp 0x1400f2472
int3

Function at 0x1400f3470
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x140216b88]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400f34a4
movsxd rcx, dword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 4]
jne 0x1400f34a4
mov rax, qword [rax + rcx]
add rsp, 0x20
pop rsi
ret
xor eax, eax
jmp 0x1400f349e

Function at 0x1400f34b0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x140216b88]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400f34ee
movsxd rcx, dword [rsi]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rsi + 4]
movsxd rdx, dword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
test rdi, rdi
je 0x1400f34e7
call fcn.140093380
jmp 0x1400f34ce

Function at 0x1400f4130
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, ecx
test r8, r8
je 0x1400f415c
xor ecx, ecx
lea r9, [0x1401f7ba0]
movzx r10d, al
movzx r11d, byte [rdx + rcx]
xor r11d, r10d
shr eax, 8
xor eax, dword [r9 + r11*4]
add rcx, 1
cmp r8, rcx
jne 0x1400f4140
ret
Function at 0x1400f5d40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
movzx eax, byte [rcx + 0x4f]
test al, al
js 0x1400f5dc0
test rax, rax
jne 0x1400f5daf
cmp dword [rsi + 0x50], 0
jne 0x1400f5daf
mov byte [rsi + 0x54], 0
mov rax, qword [rsi + 0x10]
mov qword [rsi + 8], rax
cmp rax, qword [rsi + 0x18]
je 0x1400f5da7
lea rdi, [rsi + 0x20]
lea rcx, [rax + 1]
mov qword [rsi + 0x10], rcx
movzx edx, byte [rax]
mov rcx, rdi
xor r8d, r8d
call fcn.1400d5040
cmp rax, 0xffffffffffffffff
jne 0x1400f5d99
cmp dword [rsi + 0x58], 1
jne 0x1400f5de3
jmp 0x1400f5dc6
mov rax, qword [rsi + 0x10]
mov qword [rsi + 8], rax
cmp rax, qword [rsi + 0x18]
jne 0x1400f5d75
mov byte [rsi + 0x54], 1
xor ebx, ebx
jmp 0x1400f5e2c
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp 0x14018d160
mov rax, qword [rsi + 0x40]
jmp 0x1400f5d54
mov rax, qword [rsi + 8]
movzx eax, byte [rax]
cmp rax, 0x20
ja 0x1400f5de3
movabs rcx, 0x100003600
bt rcx, rax
jb 0x1400f5d99
mov rax, qword [rsi + 0x10]
mov bl, 1
cmp rax, qword [rsi + 0x18]
je 0x1400f5e2c
movabs r14, 0x100003600
nop dword [rax]
movzx edx, byte [rax]
mov rcx, rdi
xor r8d, r8d
call fcn.1400d5040
cmp rax, 0xffffffffffffffff
jne 0x1400f5e2c
cmp dword [rsi + 0x58], 1
je 0x1400f5e38
mov rax, qword [rsi + 0x10]
add rax, 1
mov qword [rsi + 0x10], rax
cmp rax, qword [rsi + 0x18]
jne 0x1400f5e00
mov eax, ebx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rax, qword [rsi + 0x10]
movzx ecx, byte [rax]
cmp rcx, 0x20
ja 0x1400f5e1e
bt r14, rcx
jae 0x1400f5e1e
jmp 0x1400f5e2c
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
mov rax, qword [0x140213038]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov word [rsp + 0x20], 0
mov byte [rsp + 0x22], 0
mov rax, qword [rcx + 0x10]
mov rcx, qword [rcx + 0x18]
cmp rax, rcx
je 0x14018d1c2
mov edx, dword [rsi + 0x58]
movabs rdi, 0x100003600
cmp edx, 1
jne 0x14018d1c2
movzx ebx, byte [rax]
cmp rbx, 0x20
ja 0x14018d1c2
bt rdi, rbx
jae 0x14018d1c2
inc rax
mov qword [rsi + 0x10], rax
cmp rcx, rax
jne 0x14018d19f
mov rax, rcx
cmp byte [rsi + 0x54], 0
sete dil
lea rbx, [rsp + 0x20]
test dil, 1
je 0x14018d1ff
mov rdx, rcx
mov rcx, rax
mov byte [rsi + 0x54], 1
mov qword [rsi + 8], rcx
cmp rcx, rdx
je 0x14018d264
mov rax, rcx
inc rax
mov qword [rsi + 0x10], rax
xor edi, edi
test byte [rsi + 0x50], 1
mov rcx, rdx
je 0x14018d1cf
jmp 0x14018d24a
mov byte [rsi + 0x54], 0
mov qword [rsi + 8], rax
cmp rax, rcx
je 0x14018d238
mov r8b, byte [rax]
mov rcx, rsi
mov rdx, rbx
call fcn.14018d270
test al, al
je 0x14018d244
mov rax, qword [rsi + 0x10]
inc rax
mov qword [rsi + 0x10], rax
cmp rax, qword [rsi + 0x18]
jne 0x14018d20c
mov rcx, rax
cmp qword [rsi + 8], rax
jne 0x14018d24a
test byte [rsi + 0x50], 2
jne 0x14018d24a
mov rdx, qword [rsi + 0x18]
jmp 0x14018d1db
mov rax, qword [rsi + 0x10]
jmp 0x14018d22f
mov sil, 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1401013e0
mov eax, esi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
xor esi, esi
jmp 0x14018d24d
Function at 0x1400f6c10
Capabilities:
Set thread local storage value

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rax, qword [0x140213038]
xor rax, rsp
mov qword [rsp + 0x38], rax
test rcx, rcx
je 0x1400f6e82
mov rsi, rcx
mov byte [rsp + 0x37], 0xaa
lea r14, [rcx + 0x718]
lea rbx, [rcx + 8]
mov edi, 1
xor ebp, ebp
mov r15, qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
mov r12d, 0x40
mov rcx, rbx
call r15
test al, al
jne 0x1400f6c92
jmp 0x1400f6e61
pause
dec eax
jne 0x1400f6c71
add ebp, edi
add edi, edi
cmp edi, 0x40
cmovge edi, r12d
cmp ebp, 0x3e8
jl 0x1400f6c62
mov rcx, rbx
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov rax, qword [r14]
mov rdi, qword [rax]
test rdi, rdi
je 0x1400f6e38
mov byte [rsp + 0x37], 0
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400f6cbe
mov rdx, rcx
not rdx
cmp qword [rdi + 8], rdx
jne 0x1400f6e85
bswap rcx
mov qword [rax], rcx
inc word [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
xorps xmm6, xmm6
movups xmmword [rdi + 0x2d8], xmm6
movups xmmword [rdi + 0x2c8], xmm6
movups xmmword [rdi + 0x2b8], xmm6
movups xmmword [rdi + reloc.SHELL32.dll_IsUserAnAdmin], xmm6
movups xmmword [rdi + 0x298], xmm6
mov qword [rdi + 0x2e8], 0
xor r14d, r14d
mov r8d, 0x291
mov rcx, rdi
xor edx, edx
call fcn.140103d70
mov qword [rdi + 0x2f0], rsi
movups xmmword [rdi + 0x2f8], xmm6
mov ebp, 1
lea rbx, [0x140216b98]
mov r12d, 0x40
mov rcx, rbx
call r15
test al, al
jne 0x1400f6d6b
jmp 0x1400f6e70
pause
dec eax
jne 0x1400f6d44
add r14d, ebp
add ebp, ebp
cmp ebp, 0x40
cmovge ebp, r12d
cmp r14d, 0x3e8
jl 0x1400f6d35
lea rcx, [0x140216b98]
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov qword [rdi + 0x300], 0
mov rax, qword [0x140216ba0]
mov qword [0x140216ba0], rdi
mov qword [rdi + 0x2f8], rax
test rax, rax
je 0x1400f6d97
mov qword [rax + 0x300], rdi
lea rcx, [0x140216b98]
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
add rsi, 0x10
mov eax, 0xa
jmp 0x1400f6dc7
mov dword [rdi + rax - 2], 0
add rax, 0x10
add rsi, 0x28
cmp rax, 0x29a
je 0x1400f6e05
cmp qword [rsi], 0
je 0x1400f6daf
mov ecx, dword [rsi + 0x18]
cmp ecx, 0x10000
jae 0x1400f6e7f
mov word [rdi + rax], cx
cmp ecx, 0x80
jbe 0x1400f6df7
cmp ecx, 0x100
ja 0x1400f6dfe
mov byte [rdi + rax - 1], 0x40
jmp 0x1400f6db7
mov byte [rdi + rax - 1], 0x80
jmp 0x1400f6db7
mov byte [rdi + rax - 1], 0x20
jmp 0x1400f6db7
mov ecx, dword [0x140221510]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1401013e0
mov rax, rdi
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rax, [rsp + 0x37]
mov qword [rsp + 0x20], rax
mov r9d, 0x308
mov rcx, r14
mov rdx, rsi
mov r8d, 2
call fcn.1400cea80
mov rdi, rax
jmp 0x1400f6cc8
mov eax, edi
test edi, edi
jg 0x1400f6c71
jmp 0x1400f6c79
mov eax, ebp
test ebp, ebp
jg 0x1400f6d44
jmp 0x1400f6d4d
int3
int3
call 0x140131100
int3