joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005d39c
Capabilities:
Query or enumerate registry key

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xd0
mov qword [rsp + 0xc0], 0xfffffffffffffffe
movabs rax, 0xffffe7a3dd31c000
add rax, rcx
mov qword [rsp + 0xa0], rax
xor edi, edi
mov r15, rdi
mov r13, rdi
mov qword [r11 - 0x80], rdi
mov r14, rdi
mov qword [r11 - 0x78], rdi
mov qword [r11 - 0x70], rdi
mov dword [rsp + 0x68], edi
lea rbx, str.P5_n_
mov rcx, qword [str.P5_n_]
cmp rcx, rbx
je 0x14005d421
test byte [rcx + 0x1c], 4
je 0x14005d421
cmp byte [rcx + 0x19], 5
jb 0x14005d421
mov edx, 0xa3
lea r8, [0x140008ef8]
mov rcx, qword [rcx + 0x10]
call fcn.14000ffa8
mov r9d, 0x20019
xor r8d, r8d
lea r12, [0x14000adf0]
mov rdx, r12
mov rcx, 0xffffffff80000002
call fcn.14007ac98
mov rsi, rax
mov qword [rsp + 0xa8], rax
cmp rax, rdi
jne 0x14005d495
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, qword [str.P5_n_]
cmp rcx, rbx
je 0x14005d48e
test byte [rcx + 0x1c], 4
je 0x14005d48e
cmp byte [rcx + 0x19], 3
jb 0x14005d48e
mov edx, 0xa4
mov qword [rsp + 0x20], r12
mov r9d, eax
lea r8, [0x140008ef8]
mov rcx, qword [rcx + 0x10]
call fcn.140058098
nop
mov eax, edi
jmp 0x14005d82c
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x68]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
lea rax, [rsp + 0x110]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov r12d, eax
mov dword [rsp + 0x128], eax
cmp eax, edi
je 0x14005d536
mov rcx, qword [str.P5_n_]
cmp rcx, rbx
je 0x14005d805
test byte [rcx + 0x1c], 4
je 0x14005d805
cmp byte [rcx + 0x19], 2
jb 0x14005d805
mov edx, 0xa5
lea rax, [0x14000adf0]
mov qword [rsp + 0x20], rax
mov r9d, r12d
lea r8, [0x140008ef8]
mov rcx, qword [rcx + 0x10]
call fcn.140058098
jmp 0x14005d805
mov eax, dword [rsp + 0x110]
inc eax
mov dword [rsp + 0x110], eax
mov ecx, eax
add rcx, rcx
mov eax, 0xffffffff
cmp rcx, rax
jbe 0x14005d560
mov r12d, 0x216
jmp 0x14005d805
mov ecx, ecx
call fcn.140076a54
mov r15, rax
mov qword [rsp + 0x78], rax
cmp rax, rdi
jne 0x14005d5ac
mov rcx, qword [str.P5_n_]
cmp rcx, rbx
je 0x14005d5a1
test byte [rcx + 0x1c], 4
je 0x14005d5a1
cmp byte [rcx + 0x19], 2
jb 0x14005d5a1
mov edx, 0xa6
lea r8, [0x140008ef8]
mov rcx, qword [rcx + 0x10]
call fcn.14000ffa8
mov r12d, 8
jmp 0x14005d805
mov eax, dword [rsp + 0x110]
mov dword [rsp + 0x120], eax
mov eax, edi
Function at 0x140012fd0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xor eax, eax
mov r10, rdx
test ecx, ecx
jle 0x14001303d
mov qword [rsp], rbx
lea rbx, [0x14015b7c0]
mov r11d, ecx
nop dword [rax + rax]
movzx r8d, word [r10]
lea r10, [r10 + 2]
lea ecx, [r8 - 0x61]
cmp ecx, 0x1a
sbb cx, cx
and cx, 0x20
sub r8w, cx
mov ecx, eax
shr eax, 8
movzx r9d, r8w
xor rcx, r9
shr r9, 8
movzx edx, cl
mov ecx, dword [rbx + rdx*4]
xor ecx, eax
mov eax, ecx
shr ecx, 8
xor r9, rax
movzx eax, r9b
mov eax, dword [rbx + rax*4]
xor eax, ecx
sub r11, 1
jne 0x140012ff0
mov rbx, qword [rsp]
add rsp, 8
ret
Function at 0x14001b3b0
Capabilities:
Accept command line arguments

Disassembly:
push rdi
push r13
sub rsp, 0x68
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r15
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
lea rcx, [0x14011b550]
mov rbx, rax
call fcn.1400924a0
xor r13d, r13d
xor r14d, r14d
mov r15d, 1
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x40], r14
cmp dword [rsp + 0x20], r15d
jle 0x14001b55b
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x60], r12
lea r12, [rbx + 8]
nop word [rax + rax]
mov rbp, qword [r12]
xor esi, esi
xor edi, edi
mov qword [rsp + 0x28], rsi
xor eax, eax
mov qword [rsp + 0x30], rdi
test rbp, rbp
je 0x14001b4c8
cmp word [rbp], ax
je 0x14001b4c8
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rbp + rbx*2], ax
jne 0x14001b456
inc ebx
test ebx, ebx
jle 0x14001b47f
mov edx, ebx
lea rcx, [rsp + 0x28]
call fcn.140019590
mov eax, dword [rsp + 0x34]
mov edi, dword [rsp + 0x30]
mov rsi, qword [rsp + 0x28]
mov edx, edi
add edi, ebx
mov dword [rsp + 0x30], edi
cmp edi, eax
jle 0x14001b49e
lea rcx, [rsp + 0x28]
call fcn.1400191f0
mov edi, dword [rsp + 0x30]
mov rsi, qword [rsp + 0x28]
movsxd r8, ebx
mov rdx, rbp
add r8, r8
mov rcx, rsi
call fcn.140032f10
test edi, edi
je 0x14001b4c8
lea eax, [rdi - 1]
test eax, eax
jle 0x14001b4c8
cmp word [rsi], 0x2f
jne 0x14001b4c8
mov eax, 0x2d
mov word [rsi], ax
movsxd rbx, r14d
lea r14d, [rbx + 1]
mov dword [rsp + 0x40], r14d
cmp r14d, dword [rsp + 0x44]
jle 0x14001b4f1
mov edx, ebx
lea rcx, [rsp + 0x38]
call fcn.1400190f0
mov r14d, dword [rsp + 0x40]
mov r13, qword [rsp + 0x38]
shl rbx, 4
xor eax, eax
add rbx, r13
mov qword [rbx], rax
mov dword [rbx + 8], edi
test edi, edi
jne 0x14001b509
mov dword [rbx + 0xc], eax
jmp 0x14001b527
xor r8d, r8d
mov edx, edi
mov rcx, rbx
call fcn.140018ec0
mov rcx, qword [rbx]
mov rdx, rsi
movsxd r8, edi
add r8, r8
call sub.VCRUNTIME140.dll_memcpy
test rsi, rsi
je 0x14001b534
mov rcx, rsi
call fcn.140044390
inc r15d
add r12, 8
cmp r15d, dword [rsp + 0x20]
jl 0x14001b430
mov r12, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x88]
lea rcx, [rsp + 0x38]
call fcn.140015f60
mov r15, qword [rsp + 0x50]
mov edi, eax
mov rbx, r13
test r14d, r14d
je 0x14001b58b
mov rcx, qword [rbx]
test rcx, rcx
je 0x14001b581
call fcn.140044390
add rbx, 0x10
sub r14d, 1
jne 0x14001b574
mov r14, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x80]
test r13, r13
je 0x14001b5a5
mov rcx, r13
call fcn.140044390
mov eax, edi
add rsp, 0x68
pop r13
pop rdi
ret
Function at 0x14001bfd0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, qword [rcx]
test rsi, rsi
je 0x14001c0ca
mov eax, 0xffffffff
lock xadd dword [rsi + 0x48], eax
cmp eax, 1
jne 0x14001c0ca
mov rcx, qword [rsi + 0x38]
mov qword [rsp + 0x38], rbx
test rcx, rcx
mov qword [rsp + 0x40], rbp
lea rbx, [rsi + 0x18]
mov qword [rsp + 0x48], rdi
cmovne rbx, rcx
mov edi, dword [rsi + 0x40]
test edi, edi
je 0x14001c035
nop word [rax + rax]
mov rcx, rbx
call fcn.14001bfd0
add rbx, 8
sub edi, 1
jne 0x14001c020
mov rcx, qword [rsi + 0x38]
mov rbp, qword [rsp + 0x40]
test rcx, rcx
je 0x14001c044
call fcn.140044390
mov ecx, dword [0x140166f08]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor edi, edi
mov rbx, rax
test rax, rax
jne 0x14001c088
lea ecx, [rax + 0x18]
call fcn.140013490
mov rbx, rax
test rax, rax
je 0x14001c076
mov qword [rax], rdi
mov qword [rax + 8], rdi
mov dword [rax + 0x10], edi
jmp 0x14001c079
mov rbx, rdi
mov ecx, dword [0x140166f08]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp dword [rbx + 0x10], 0x20
jl 0x14001c0b2
mov rdx, qword [rbx]
test rdx, rdx
je 0x14001c0a2
lea rcx, [0x140166f10]
call fcn.14001f010
mov rax, qword [rbx + 8]
mov qword [rbx], rax
mov qword [rbx + 8], rdi
mov dword [rbx + 0x10], edi
jmp 0x14001c0b6
mov rdi, qword [rbx + 8]
mov qword [rsi], rdi
inc dword [rbx + 0x10]
mov rdi, qword [rsp + 0x48]
mov qword [rbx + 8], rsi
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret

Function at 0x14001cb70
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
lea rcx, [0x140166fd0]
jmp fcn.14001e7d0

Function at 0x14001d850
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edi, ecx
mov ecx, dword [0x140166fd0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14001d8a1
lea ecx, [rax + 0xc]
call fcn.140013490
mov rbx, rax
test rax, rax
je 0x14001d88f
mov qword [rax], rsi
mov dword [rax + 8], esi
jmp 0x14001d892
mov rbx, rsi
mov ecx, dword [0x140166fd0]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp dword [rbx + 8], 0x40
jl 0x14001d8c2
mov edx, dword [rbx]
test edx, edx
je 0x14001d8b9
lea rcx, [0x140166fd8]
call fcn.14001ef30
mov eax, dword [rbx + 4]
mov dword [rbx], eax
mov qword [rbx + 4], rsi
test edi, edi
jne 0x14001d8cb
mov rcx, rsi
jmp 0x14001d8ee
mov rcx, rdi
lea rdx, [0x1401670e8]
mov rax, rdi
shr rax, 0xe
and ecx, 0x3fff
mov rax, qword [rdx + rax*8]
lea rcx, [rcx + rcx*2]
lea rcx, [rax + rcx*8]
and qword [rcx], 0xfffffffffc000000
mov dword [rcx + 0x10], esi
mov eax, dword [rbx + 4]
mov rsi, qword [rsp + 0x38]
mov qword [rcx + 8], rax
inc dword [rbx + 8]
mov dword [rbx + 4], edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14001db60
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
movss xmm0, dword [0x14011dd30]
jmp fcn.1400cb620
Function at 0x14001f070
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov r14, rcx
mov rcx, qword [rcx + 0x38]
test rcx, rcx
mov edi, dword [r14 + 0x40]
lea rbx, [r14 + 0x18]
cmovne rbx, rcx
test edi, edi
je 0x14001f0b5
nop
mov rcx, rbx
call fcn.14001bfd0
add rbx, 8
sub edi, 1
jne 0x14001f0a0
mov rcx, qword [r14 + 0x38]
test rcx, rcx
je 0x14001f0bf
call fcn.140044390
mov ecx, dword [0x140166f08]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor edi, edi
mov rbx, rax
test rax, rax
jne 0x14001f103
lea ecx, [rax + 0x18]
call fcn.140013490
mov rbx, rax
test rax, rax
je 0x14001f0f1
mov qword [rax], rdi
mov qword [rax + 8], rdi
mov dword [rax + 0x10], edi
jmp 0x14001f0f4
mov rbx, rdi
mov ecx, dword [0x140166f08]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp dword [rbx + 0x10], 0x20
jl 0x14001f12d
mov rdx, qword [rbx]
test rdx, rdx
je 0x14001f11d
lea rcx, [0x140166f10]
call fcn.14001f010
mov rax, qword [rbx + 8]
mov qword [rbx], rax
mov qword [rbx + 8], rdi
mov dword [rbx + 0x10], edi
jmp 0x14001f131
mov rdi, qword [rbx + 8]
mov rsi, qword [rsp + 0x38]
mov qword [r14], rdi
inc dword [rbx + 0x10]
mov rdi, qword [rsp + 0x40]
mov qword [rbx + 8], r14
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r14
ret
Function at 0x140022950
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rdi
push r12
sub rsp, 0x50
movsxd rdi, dword [rcx + 8]
mov rbx, rdx
mov r12, rcx
test edi, edi
jne 0x140022976
xor eax, eax
add rsp, 0x50
pop r12
pop rdi
pop rbx
ret
mov rcx, qword [rcx]
xor eax, eax
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], r13
xor r13d, r13d
mov qword [rsp + 0x30], r14
xor r14d, r14d
mov qword [rsp + 0x28], r15
cmp dword [rcx + 8], eax
je 0x1400229b5
mov rcx, qword [rcx]
test rcx, rcx
je 0x1400229b5
mov rax, qword [rcx]
lea rdx, [rsp + 0x70]
call qword [rax + 0x38]
mov rax, qword [rax]
cmp rax, qword [rbx]
mov r15, rdi
setne al
xor esi, esi
mov byte [rsp + 0x70], al
nop dword [rax]
nop dword [rax + rax]
movsxd rbp, r14d
inc rsi
inc r14d
cmp rsi, r15
jge 0x140022a3b
mov rdx, qword [rsp + 0x78]
mov rbx, rsi
shl rbx, 4
movzx edi, al
nop dword [rax]
mov rcx, qword [r12]
xor eax, eax
cmp dword [rcx + rbx + 8], eax
je 0x140022a1b
mov rcx, qword [rcx + rbx]
test rcx, rcx
je 0x140022a1b
mov rax, qword [rcx]
lea rdx, [rsp + 0x88]
call qword [rax + 0x38]
mov rdx, qword [rsp + 0x78]
mov rax, qword [rax]
xor ecx, ecx
cmp rax, qword [rdx]
setne cl
cmp edi, ecx
jne 0x140022a36
inc r14d
inc rsi
add rbx, 0x10
cmp rsi, r15
jl 0x1400229f0
movzx eax, byte [rsp + 0x70]
mov edi, r14d
sub edi, ebp
test al, al
je 0x140022a75
cmp r13d, ebp
je 0x140022a70
mov rdx, rbp
movsxd rcx, r13d
shl rdx, 4
add rdx, qword [r12]
shl rcx, 4
add rcx, qword [r12]
movsxd r8, edi
shl r8, 4
call fcn.1401112ee
movzx eax, byte [rsp + 0x70]
add r13d, edi
jmp 0x140022aec
mov rbx, rbp
shl rbx, 4
add rbx, qword [r12]
test edi, edi
je 0x140022aec
mov eax, dword [rbx + 8]
test eax, eax
je 0x140022a93
mov rcx, qword [rbx]
mov r8, rcx
jmp 0x140022a98
mov r8, qword [rbx]
xor ecx, ecx
test rcx, rcx
je 0x140022aa2
mov rax, qword [rcx]
jmp 0x140022ab1
test eax, eax
je 0x140022ad1
test r8, r8
je 0x140022ad1
mov rax, qword [r8]
mov rcx, r8
xor edx, edx
call qword [rax]
mov rcx, qword [rbx]
test rcx, rcx
je 0x140022aca
xor r8d, r8d
xor edx, edx
call fcn.140047220
mov qword [rbx], rax
mov dword [rbx + 8], 0
mov rcx, qword [rbx]
test rcx, rcx
je 0x140022ade
call fcn.140044390
add rbx, 0x10
sub edi, 1
jne 0x140022a84
movzx eax, byte [rsp + 0x70]
xor al, 1
mov byte [rsp + 0x70], al
cmp rsi, r15
jl 0x1400229d0
mov r14, qword [rsp + 0x30]
mov eax, r15d
mov r15, qword [rsp + 0x28]
sub eax, r13d
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov dword [r12 + 8], r13d
mov r13, qword [rsp + 0x38]
add rsp, 0x50
pop r12
pop rdi
pop rbx
ret
Function at 0x140023350
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
lea rax, [0x140129170]
mov rsi, rcx
mov qword [rcx], rax
mov rdi, rdx
add rcx, 8
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov edx, 0xfa0
lea rcx, [rsi + 8]
call qword [sym.imp.KERNEL32.dll_SetCriticalSectionSpinCount]
xor r13d, r13d
mov qword [rsi + 0x58], rdi
lea rcx, [rsp + 0x20]
mov dword [rsi + 0x30], r13d
mov dword [rsi + 0x40], r13d
mov dword [rsi + 0x50], r13d
call fcn.1400befc0
mov edx, dword [rax + 0x10]
test edx, edx
mov eax, 0x10000
cmove edx, eax
lea ecx, [rdx + 0x1fffff]
neg edx
mov eax, edx
and rcx, rax
call fcn.1400bcd90
mov rcx, rsi
mov qword [rsi + 0x38], rax
call fcn.14002f450
mov ecx, eax
call fcn.1400bcd90
mov qword [rsi + 0x48], rax
test rax, rax
je 0x1400233f6
cmp qword [rsi + 0x38], r13
jne 0x140023409
lea rcx, str.Memory_pools_allocations_failed__exiting..._n
call sub.KERNEL32.dll_OutputDebugStringW
mov cl, 1
call fcn.1400cad70
test byte [rsi + 0x38], 0xf
jne 0x140023415
test byte [rsi + 0x48], 0xf
je 0x140023428
lea rcx, str.OS_allocations_must_be_aligned_to_a_value_multiple_of_16__exiting..._n
call sub.KERNEL32.dll_OutputDebugStringW
mov cl, 1
call fcn.1400cad70
mov r15d, r13d
lea r12, [0x1401592a0]
lea rdx, [0x14016fa88]
nop dword [rax]
movsxd rax, r15d
mov edi, r13d
imul rbx, rax, 0x4020
mov eax, dword [r12]
add rbx, rdx
add eax, 0x10
mov edx, dword [r12 + 4]
mov qword [rbx], r13
mov qword [rbx + 8], r13
mov dword [rbx + 0x10], eax
mov dword [rbx + 0x4018], edx
test edx, edx
je 0x1400234b3
mov ebp, dword [rbx + 0x10]
mov rcx, rsi
mov r14d, dword [rsi + 0x50]
add ebp, r14d
call fcn.14002f450
cmp ebp, eax
ja 0x140023492
mov eax, r14d
mov dword [rsi + 0x50], ebp
add rax, qword [rsi + 0x48]
jmp 0x140023495
mov rax, r13
lea rcx, [rax + 0x10]
mov qword [rax], r13
mov qword [rax + 8], rcx
mov ecx, edi
inc edi
mov qword [rbx + rcx*8 + 0x18], rax
mov edx, dword [rbx + 0x4018]
cmp edi, edx
jb 0x140023470
cmp edx, 0x800
jae 0x1400234df
mov eax, edx
mov r8d, 0x800
sub r8d, edx
add rax, 3
shl r8, 3
xor edx, edx
lea rcx, [rbx + rax*8]
call sub.VCRUNTIME140.dll_memset
mov edx, dword [rbx + 0x4018]
mov eax, dword [rbx + 0x10]
inc r15d
imul eax, edx
add r12, 8
lea rdx, [0x14016fa88]
add eax, 0x4000
mov dword [rbx + 0x401c], eax
cmp r15d, 0xe
jb 0x140023440
lea r11, [rsp + 0xa0]
mov rax, rsi
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400294b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
xor r12d, r12d
mov r15d, r8d
mov rsi, rdx
mov r14, rcx
test rdx, rdx
je 0x1400294dc
mov ebp, dword [rdx + 0x28]
jmp 0x1400294df
mov ebp, r12d
call fcn.14001d930
mov rdi, rax
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
jne 0x140029522
lea ecx, [rax + 0x18]
call fcn.140013490
mov rbx, rax
test rax, rax
je 0x140029514
mov qword [rax], r12
mov qword [rax + 8], r12
mov dword [rax + 0x10], r12d
jmp 0x140029517
mov rbx, r12
mov ecx, dword [rdi]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, qword [rbx + 8]
test rcx, rcx
jne 0x140029594
mov rax, qword [rbx]
test rax, rax
je 0x140029547
mov edx, 0x20
mov qword [rbx + 8], rax
mov dword [rbx + 0x10], edx
mov rcx, rax
mov qword [rbx], r12
jmp 0x140029597
lea rcx, [rdi + 8]
call fcn.14001e780
mov qword [rbx + 8], rax
test rax, rax
jne 0x140029586
xor edx, edx
mov ecx, 0x2000
call fcn.140046150
mov qword [rbx + 8], rax
mov edx, 0x1f
nop
lea rcx, [rax + 0x100]
mov qword [rax], rcx
mov rax, rcx
sub rdx, 1
jne 0x140029570
mov qword [rcx], r12
mov rcx, qword [rbx + 8]
mov edx, 0x20
mov dword [rbx + 0x10], edx
jmp 0x140029597
mov edx, dword [rbx + 0x10]
mov rax, qword [rcx]
mov qword [rbx + 8], rax
lea eax, [rdx - 1]
mov dword [rbx + 0x10], eax
lea rax, [0x14011dad0]
mov rbx, qword [rsp + 0x58]
mov qword [rcx], rax
lea eax, [rbp + 1]
mov rbp, qword [rsp + 0x60]
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x50], r12
mov dword [rcx + 8], 0xff
mov dword [rcx + 0xc], eax
lea rax, [0x14012b8f0]
mov qword [rcx], rax
mov rax, r14
mov byte [rcx + 0x28], r12b
mov qword [rcx + 0x30], r12
mov qword [r14], rcx
mov qword [r14 + 8], rsi
mov dword [r14 + 0x10], r15d
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140032bf0
Capabilities:
Print debug messages

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x450
mov rax, qword [0x1401664b8]
xor rax, rsp
mov qword [rsp + 0x440], rax
xor r12d, r12d
lea r14, [rsp + 0x40]
mov ebx, r12d
lea rbp, [r11 + 0x10]
mov rdi, rcx
mov esi, 0x400
call fcn.14001b5b0
mov qword [rsp + 0x28], rbp
lea rdx, [rsp + 0x40]
mov r9, rdi
mov qword [rsp + 0x20], r12
mov r8d, 0x200
mov r15, rax
mov rcx, qword [rax]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vswprintf]
test eax, eax
mov ebp, 0xffffffff
cmovs eax, ebp
cmp eax, 0x200
jae 0x140032c80
cmp eax, ebp
jne 0x140032cda
nop dword [rax + rax]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
movsxd rdi, esi
lea rcx, [rdi + rdi]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
mov r14, rax
test rax, rax
je 0x140032cf2
mov r9, qword [rsp + 0x490]
lea rax, [rsp + 0x498]
mov rcx, qword [r15]
mov r8, rdi
mov qword [rsp + 0x28], rax
mov rdx, rbx
mov qword [rsp + 0x20], r12
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vswprintf]
test eax, eax
cmovs eax, ebp
cmp eax, esi
cmovge eax, ebp
add esi, esi
cmp eax, ebp
je 0x140032c80
cdqe
mov rcx, r14
mov word [r14 + rax*2], r12w
call sub.KERNEL32.dll_OutputDebugStringW
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.14010f320
add rsp, 0x450
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140032d80
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
cmp r8d, 0x10
jbe 0x140032da2
lea rcx, str.Alignment___16_is_not_supported_n
call sub.KERNEL32.dll_OutputDebugStringW
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsi + 0x30], eax
je 0x140032dc1
call fcn.1400cb6b0
jmp 0x140032ef5
xor ebp, ebp
lea r10, [0x14016fa88]
mov edx, ebp
nop dword [rax]
movsxd rax, edx
imul rax, rax, 0x4020
add rax, r10
mov r9d, dword [rax]
mov r8d, dword [rax + 0x4018]
cmp r9d, r8d
jae 0x140032df6
mov ecx, dword [rax + 0x10]
sub ecx, 0x10
cmp edi, ecx
jbe 0x140032e58
inc edx
cmp edx, 0xe
jb 0x140032dd0
mov eax, dword [rsi + 0x40]
lea ecx, [rdi + 0x10]
add eax, 0xf
mov r8d, 0x200000
and eax, 0xfffffff0
mov edx, edi
add ecx, eax
mov dword [rsi + 0x40], eax
cmp ecx, r8d
ja 0x140032ed3
mov rbx, qword [rsi + 0x38]
mov dword [rsi + 0x40], ecx
mov ecx, eax
add rbx, rcx
mov eax, edi
mov qword [rbx], rax
mov rax, qword [rsi + 0x38]
add rax, 0x10
add rcx, rax
mov qword [rbx + 8], rcx
lea rcx, str.Malloc_Size_d_LargeMemoryPoolOffset_d__n
mov r8d, dword [rsi + 0x40]
call fcn.140032bf0
mov rax, qword [rbx + 8]
jmp 0x140032ef7
mov edx, ebp
test r8d, r8d
je 0x140032e73
nop
mov ecx, edx
mov rbx, qword [rax + rcx*8 + 0x18]
cmp qword [rbx], rbp
je 0x140032e99
inc edx
cmp edx, r8d
jb 0x140032e60
mov edx, edi
lea rcx, str.AllocateFromPool_run_out_of_memory_allocating__u_bytes_for__u_allocations_n
call fcn.140032bf0
lea rcx, str.Please_increase_MaxNumAllocations_for_that_pool__exiting..._n
call sub.KERNEL32.dll_OutputDebugStringW
mov cl, 1
call fcn.1400cad70
mov rax, rbp
jmp 0x140032ef7
cmp dword [rax + 4], edx
mov r8d, edi
cmovae edx, dword [rax + 4]
inc dword [rax + 0xc]
mov dword [rax + 4], edx
lea edx, [r9 + 1]
cmp dword [rax + 8], edx
mov dword [rax], edx
cmovae edx, dword [rax + 8]
mov dword [rax + 8], edx
mov edx, 0xfe
mov rcx, qword [rbx + 8]
mov qword [rbx], r8
call sub.VCRUNTIME140.dll_memset
mov rbp, qword [rbx + 8]
mov rax, rbp
jmp 0x140032ef7
sub r8d, eax
lea rcx, str.MallocCrash_run_out_of_memory_allocating__u_bytes__free__u_bytes_n
call fcn.140032bf0
lea rcx, str.Please_increase_LARGE_MEMORYPOOL_SIZE__exiting..._n
call sub.KERNEL32.dll_OutputDebugStringW
mov cl, 1
call fcn.1400cad70
xor eax, eax
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14003fcd0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
movzx eax, word [rcx]
lea r10, [rcx + 2]
not edx
test ax, ax
je 0x14003fd49
lea r11, [0x1401597c0]
nop word [rax + rax]
movzx r9d, ax
lea r10, [r10 + 2]
mov eax, edx
shr edx, 8
xor rax, r9
shr r9, 8
movzx ecx, al
mov r8d, dword [r11 + rcx*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor r9, rax
movzx eax, r9b
mov edx, dword [r11 + rax*4]
movzx eax, word [r10 - 2]
xor edx, r8d
movzx ecx, dl
shr edx, 8
mov r8d, dword [r11 + rcx*4]
xor r8d, edx
movzx ecx, r8b
shr r8d, 8
mov edx, dword [r11 + rcx*4]
xor edx, r8d
test ax, ax
jne 0x14003fcf0
not edx
mov eax, edx
ret
Function at 0x140040330
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea rax, [0x14012c3e0]
mov qword [rcx + 8], rdx
mov qword [rcx], rax
mov rdi, rcx
mov byte [rcx + 0x10], 0
add rcx, 0x18
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov edx, 0xfa0
lea rcx, [rdi + 0x18]
call qword [sym.imp.KERNEL32.dll_SetCriticalSectionSpinCount]
lea rcx, [rdi + 0x48]
call qword [sym.imp.KERNEL32.dll_InitializeSRWLock]
xor eax, eax
mov dword [rdi + 0x7c], 0x80
mov qword [rdi + 0x50], rax
mov qword [rdi + 0x58], rax
mov qword [rdi + 0x70], rax
mov dword [rdi + 0x78], eax
mov dword [rdi + 0x84], eax
mov qword [rdi + 0x90], rax
mov dword [rdi + 0x98], eax
mov qword [rdi + 0xa0], rax
mov qword [rdi + 0xa8], rax
mov dword [rdi + 0x80], 0xffffffff
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ecx, eax
mov dword [rdi + 0x40], eax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x20
pop rdi
ret

Function at 0x1400447a0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
cmp dword [rdx], 0xffffffff
mov rdi, rdx
mov rbx, rcx
jne 0x1400447d1
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ecx, eax
mov eax, 0xffffffff
lock cmpxchg dword [rdi], ecx
cmp eax, 0xffffffff
je 0x1400447d1
call qword [sym.imp.KERNEL32.dll_TlsFree]
mov ecx, dword [rdi]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x14004483e
mov rcx, qword [rbx + 8]
mov qword [rsp + 0x38], rsi
call qword [rbx]
mov ecx, dword [0x1401ad774]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14004482b
lea rbx, [rax + 0x30]
mov qword [rsp + 0x30], rbp
movsxd rbp, dword [rbx + 8]
lea ecx, [rbp + 1]
mov dword [rbx + 8], ecx
cmp ecx, dword [rbx + 0xc]
jle 0x14004481f
mov edx, ebp
mov rcx, rbx
call fcn.140048360
mov rax, qword [rbx]
mov qword [rax + rbp*8], rsi
mov rbp, qword [rsp + 0x30]
mov ecx, dword [rdi]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret