joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400206a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov ecx, dword [0x140045088]
test ecx, ecx
je 0x1400206cf
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x1400206e8
mov rdi, rax
cmp qword [rax], 0
je 0x1400206e8
add rdi, 8
jmp 0x1400207bf
lea rcx, dbg.destroy_value_core::cell::RefCell_core::option::Option_std::sys_common::thread_info::ThreadInfo___
call dbg.init
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x1400206bd
mov ecx, dword [0x140045088]
test ecx, ecx
je 0x1400207a0
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x1400207bd
mov rsi, rax
test rax, rax
jne 0x140020772
mov rcx, qword [0x1400570e8]
test rcx, rcx
jne 0x140020733
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x1400207d9
mov rcx, rax
mov qword [0x1400570e8], rax
mov r8d, 0x20
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x1400207d9
mov rsi, rax
mov qword [rax], 0
lea rax, dbg.destroy_value_core::cell::RefCell_core::option::Option_std::sys_common::thread_info::ThreadInfo___
mov qword [rsi + 0x18], rax
mov ecx, dword [0x140045088]
test ecx, ecx
je 0x1400207c9
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
lea rdi, [rsi + 8]
cmp qword [rsi], 0
mov rcx, qword [rsi + 0x10]
mov qword [rsi], 1
xorps xmm0, xmm0
movups xmmword [rsi + 8], xmm0
je 0x1400207bf
test rcx, rcx
je 0x1400207bf
lock dec qword [rcx]
jne 0x1400207bf
call dbg.drop_slow<std::thread::Inner>
jmp 0x1400207bf
lea rcx, dbg.destroy_value_core::cell::RefCell_core::option::Option_std::sys_common::thread_info::ThreadInfo___
call dbg.init
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x140020707
xor edi, edi
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, dbg.destroy_value_core::cell::RefCell_core::option::Option_std::sys_common::thread_info::ThreadInfo___
call dbg.init
mov ecx, eax
jmp 0x14002076a
mov ecx, 0x20
mov edx, 8
call dbg.handle_alloc_error
ud2

Function at 0x140020d70
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rcx
mov rsi, qword [rcx + 0x18]
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x140020d98
dec ecx
mov edx, 1
call sub.KERNEL32.dll_TlsSetValue
cmp qword [rdi], 0
jne 0x140020db2
jmp 0x140020dca
mov rcx, rsi
call dbg.init
mov ecx, eax
mov edx, 1
call sub.KERNEL32.dll_TlsSetValue
cmp qword [rdi], 0
je 0x140020dca
mov rax, qword [rdi + 0x10]
test rax, rax
je 0x140020dca
lock dec qword [rax]
jne 0x140020dca
mov rcx, qword [rdi + 0x10]
call dbg.drop_slow<std::thread::Inner>
mov rcx, qword [0x1400570e8]
xor edx, edx
mov r8, rdi
call fcn.140042ef4
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x140020de6
dec ecx
jmp 0x140020df0
mov rcx, rsi
call dbg.init
mov ecx, eax
xor edx, edx
add rsp, 0x28
pop rdi
pop rsi
jmp sub.KERNEL32.dll_TlsSetValue
Function at 0x140022480
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rcx
mov rsi, qword [rcx]
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x140022497
dec ecx
jmp 0x1400224a1
mov rcx, rsi
call dbg.init
mov ecx, eax
mov edx, 1
call sub.KERNEL32.dll_TlsSetValue
mov rcx, qword [0x1400570e8]
xor edx, edx
mov r8, rdi
call fcn.140042ef4
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x1400224c7
dec ecx
jmp 0x1400224d1
mov rcx, rsi
call dbg.init
mov ecx, eax
xor edx, edx
add rsp, 0x28
pop rdi
pop rsi
jmp sub.KERNEL32.dll_TlsSetValue

Function at 0x1400225d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov ecx, dword [0x1400450a8]
test ecx, ecx
je 0x140022697
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x1400225fd
mov rsi, rax
cmp qword [rax], 0
jne 0x140022691
mov ecx, dword [0x1400450a8]
test ecx, ecx
je 0x1400226b9
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x1400226d6
mov rsi, rax
test rax, rax
jne 0x140022687
mov rcx, qword [0x1400570e8]
test rcx, rcx
jne 0x140022648
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x1400226f1
mov rcx, rax
mov qword [0x1400570e8], rax
mov r8d, 0x18
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x1400226f1
mov rsi, rax
mov qword [rax], 0
lea rax, dbg.destroy_value_core::cell::Cell_usize__
mov qword [rsi + 0x10], rax
mov ecx, dword [0x1400450a8]
test ecx, ecx
je 0x1400226e1
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
movaps xmm0, xmmword [0x140046650]
movups xmmword [rsi], xmm0
add rsi, 8
jmp 0x1400226d8
lea rcx, dbg.destroy_value_core::cell::Cell_usize__
call dbg.init
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x1400225f0
jmp 0x1400225fd
lea rcx, dbg.destroy_value_core::cell::Cell_usize__
call dbg.init
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x14002261c
xor esi, esi
mov rax, rsi
add rsp, 0x20
pop rsi
ret
lea rcx, dbg.destroy_value_core::cell::Cell_usize__
call dbg.init
mov ecx, eax
jmp 0x14002267f
mov ecx, 0x18
mov edx, 8
call dbg.handle_alloc_error
ud2

Function at 0x140022780
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rcx
mov rsi, qword [rcx + 0x10]
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x140022798
dec ecx
jmp 0x1400227a2
mov rcx, rsi
call dbg.init
mov ecx, eax
mov edx, 1
call sub.KERNEL32.dll_TlsSetValue
mov rcx, qword [0x1400570e8]
xor edx, edx
mov r8, rdi
call fcn.140042ef4
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x1400227c8
dec ecx
jmp 0x1400227d2
mov rcx, rsi
call dbg.init
mov ecx, eax
xor edx, edx
add rsp, 0x28
pop rdi
pop rsi
jmp sub.KERNEL32.dll_TlsSetValue
Function at 0x140025240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
movzx ebx, byte [rdx + 0x39]
xor r15d, r15d
cmp bl, 1
setne dl
mov eax, 0
sbb eax, eax
mov r14, rcx
or al, dl
movzx ecx, al
cmp cl, 0xff
je 0x140025273
test ecx, ecx
jne 0x1400252c2
movzx r15d, byte [rdi + 0x38]
cmp al, 0xff
je 0x140025280
test ecx, ecx
jne 0x1400252c2
mov rcx, rdi
call dbg.include_cur_dir
movzx r10d, al
test bl, bl
jne 0x1400252c9
lea rax, [rdi + 0x10]
xor esi, esi
cmp byte [rdi + 0x10], 6
cmove rax, rsi
je case.0x1400252b6.2
movzx ecx, byte [rax]
mov esi, 6
lea rdx, [0x14002543c]
movsxd rcx, dword [rdx + rcx*4]
add rcx, rdx
jmp rcx
mov rsi, qword [rax + 0x10]
add rsi, 4
jmp case.0x1400252b6.2
xor r10d, r10d
test bl, bl
je 0x140025290
xor esi, esi
movzx eax, r15b
lea rcx, [r10 + rax]
add rcx, rsi
mov rdx, qword [rdi + 8]
cmp rdx, rcx
jb 0x14002541e
mov r11, qword [rdi]
lea r9, [r11 + rcx]
movzx r8d, byte [rdi + 0x10]
cmp rdx, rcx
jne 0x1400252fb
xor edi, edi
jmp 0x140025378
add rsi, r10
add rsi, rax
sub rsi, rdx
inc rsi
lea rax, [rdx + r11]
dec rax
xor edi, edi
cmp r8b, 3
jae 0x140025340
nop word cs:[rax + rax]
cmp byte [rax], 0x5c
je 0x14002535b
inc rsi
dec rax
cmp rsi, 1
jne 0x140025320
jmp 0x140025378
movzx ebx, byte [rax]
cmp ebx, 0x2f
je 0x14002535b
cmp ebx, 0x5c
je 0x14002535b
inc rsi
dec rax
cmp rsi, 1
jne 0x140025340
jmp 0x140025378
neg rsi
add rcx, rsi
inc rcx
cmp rdx, rcx
jb 0x14002542c
add r11, rcx
mov edi, 1
mov r9, r11
sub rdx, rcx
je 0x1400253a2
mov al, 9
cmp rdx, 2
je 0x1400253a6
cmp rdx, 1
jne 0x1400253b6
cmp byte [r9], 0x2e
jne 0x1400253b6
xor eax, eax
cmp r8b, 3
setae al
lea eax, [rax + rax*2]
add eax, 7
jmp 0x1400253b6
mov al, 0xa
jmp 0x1400253b6
cmp byte [r9], 0x2e
jne 0x1400253b6
cmp byte [r9 + 1], 0x2e
sete al
xor al, 9
add rdi, rdx
mov qword [r14], rdi
mov qword [r14 + 8], r9
mov qword [r14 + 0x10], rdx
mov byte [r14 + 0x18], al
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rcx, qword [rax + 0x10]
mov rax, qword [rax + 0x20]
lea rdx, [rax + 1]
test rax, rax
cmove rdx, rax
lea rsi, [rcx + rdx]
add rsi, 8
jmp case.0x1400252b6.2
mov rcx, qword [rax + 0x10]
mov rax, qword [rax + 0x20]
lea rdx, [rax + 1]
test rax, rax
cmove rdx, rax
lea rsi, [rcx + rdx]
add rsi, 2
jmp case.0x1400252b6.2
mov esi, 2
jmp case.0x1400252b6.2
lea r8, [0x14004f2e0]
call dbg.slice_start_index_len_fail
ud2
lea r8, [0x14004f2f8]
call dbg.slice_start_index_len_fail
ud2
Function at 0x1400439d0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop dword [rax]

Function at 0x140043a40
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x1400571f4]
mov rbx, rcx
test esi, esi
jle 0x140043b70
mov rax, qword [0x1400571f8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x140043a8b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140043b15
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140043a70
mov rcx, rbx
call dbg.__mingw_GetSectionForAddress
mov rdi, rax
test rax, rax
je 0x140043b92
mov rax, qword [0x1400571f8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call dbg._GetPEImageBase
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1400571f8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140043b77
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140043b0e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140043b20
add dword [0x1400571f4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1400571f8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140043b0e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
nop dword [rax]
xor esi, esi
jmp 0x140043a98
mov rax, qword [0x1400571f8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call dbg.__report_error
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call dbg.__report_error
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140044100
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x140057260]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140057240]
test rbx, rbx
je 0x14004415c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x140044153
test rsi, rsi
je 0x140044153
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140044138
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x140044370
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140044388
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x140044390
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x1400443a0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r8d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
test r8w, r8w
je 0x1400443ed
lea ecx, [r8 - 1]
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp rdx, r8
jb 0x1400443e4
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x1400443ef
add rax, 0x28
cmp rax, r9
jne 0x1400443d0
xor eax, eax
ret

Function at 0x1400443f0
Capabilities:
Parse pe header

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
call sym.strlen
cmp rax, 8
ja 0x140044480
mov rdx, qword [0x140050f90]
xor ebx, ebx
cmp word [rdx], 0x5a4d
jne 0x14004446e
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x14004446e
cmp word [rax + 0x18], 0x20b
jne 0x14004446e
movzx edx, word [rax + 0x14]
lea rbx, [rax + rdx + 0x18]
movzx edx, word [rax + 6]
test dx, dx
je 0x140044480
lea eax, [rdx - 1]
lea rax, [rax + rax*4]
lea rdi, [rbx + rax*8 + 0x28]
jmp 0x140044459
add rbx, 0x28
cmp rbx, rdi
je 0x140044480
mov r8d, 8
mov rdx, rsi
mov rcx, rbx
call sym.strncmp
test eax, eax
jne 0x140044450
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor ebx, ebx
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x140044490
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140050f90]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400444b0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400444b8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400444b0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14004450d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140044504
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400444b0
add rax, 0x28
cmp rax, r9
jne 0x1400444f0
xor eax, eax
ret

Function at 0x140044510
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140050f90]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14004452f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140044538
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14004452f
movzx ecx, word [rax + 6]
mov eax, ecx
ret
Function at 0x140044550
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x140050f90]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x140044570
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x140044578
ret
cmp word [rdx + 0x18], 0x20b
jne 0x140044570
movzx eax, word [rdx + 0x14]
movzx r8d, word [rdx + 6]
lea rax, [rdx + rax + 0x18]
test r8w, r8w
je 0x1400445c0
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x1400445b7
test rcx, rcx
je 0x140044570
sub rcx, 1
add rax, 0x28
cmp rax, rdx
jne 0x1400445a8
xor eax, eax
ret

Function at 0x1400445d0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140050f90]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x1400445ef
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x1400445f8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x140044610
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140050f90]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140044630
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140044638
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140044630
sub rcx, rdx
movzx r9d, word [r8 + 6]
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
test r9w, r9w
je 0x140044630
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
mov rax, r8
cmp rcx, r8
jb 0x140044684
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x140044690
add rdx, 0x28
cmp r9, rdx
jne 0x140044670
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x1400446a0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x140050f90]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x1400446c2
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x1400446d0
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400446c2
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x1400446c2
movzx edx, word [r8 + 0x14]
movzx r10d, word [r8 + 6]
lea rdx, [r8 + rdx + 0x18]
test r10w, r10w
je 0x1400446c2
lea r8d, [r10 - 1]
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop word cs:[rax + rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x140044725
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x140044738
add rdx, 0x28
cmp rdx, r10
jne 0x140044710
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x140044747
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x140044757
mov edx, dword [rax + 0xc]
test edx, edx
je 0x14004472e
test ecx, ecx
jg 0x140044740
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret

Function at 0x1400447f0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movdqu xmm1, xmmword [rdx]
movdqu xmm0, xmmword [r8]
sub r8, 0x10
pxor xmm1, xmm0
movdqu xmm0, xmmword [r8]
sub r8, 0x10
aesdec xmm1, xmm0
sub cl, 1
cmp cl, 1
jne 0x140044801
movdqu xmm0, xmmword [r8]
aesdeclast xmm1, xmm0
movdqu xmmword [r9], xmm1
ret
Function at 0x140044830
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movdqu xmm1, xmmword [rdx]
movdqu xmm0, xmmword [r8]
add r8, 0x10
pxor xmm1, xmm0
movdqu xmm0, xmmword [r8]
add r8, 0x10
aesenc xmm1, xmm0
sub cl, 1
cmp cl, 1
jne 0x140044841
movdqu xmm0, xmmword [r8]
aesenclast xmm1, xmm0
movdqu xmmword [r9], xmm1
ret

Function at 0x140044870
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movdqu xmm1, xmmword [rcx]
movdqu xmmword [rdx], xmm1
add rdx, 0x10
aeskeygenassist xmm2, xmm1, 1
call fcn.1400448ec
aeskeygenassist xmm2, xmm1, 2
call fcn.1400448ec
aeskeygenassist xmm2, xmm1, 4
call fcn.1400448ec
aeskeygenassist xmm2, xmm1, 8
call fcn.1400448ec
aeskeygenassist xmm2, xmm1, 0x10
call fcn.1400448ec
aeskeygenassist xmm2, xmm1, 0x20
call fcn.1400448ec
aeskeygenassist xmm2, xmm1, 0x40
call fcn.1400448ec
aeskeygenassist xmm2, xmm1, 0x80
call fcn.1400448ec
aeskeygenassist xmm2, xmm1, 0x1b
call fcn.1400448ec
aeskeygenassist xmm2, xmm1, 0x36
call fcn.1400448ec
jmp 0x140044919
ret

Function at 0x140044920
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movdqu xmm1, xmmword [rcx]
movdqu xmm3, xmmword [rcx + 0x10]
movdqu xmmword [rdx], xmm1
movdqa xmm5, xmm3
aeskeygenassist xmm2, xmm3, 1
call fcn.140044a1a
shufpd xmm5, xmm1, 0
movdqu xmmword [rdx + 0x10], xmm5
movdqa xmm6, xmm1
shufpd xmm6, xmm3, 1
movdqu xmmword [rdx + 0x20], xmm6
aeskeygenassist xmm2, xmm3, 2
call fcn.140044a1a
movdqu xmmword [rdx + 0x30], xmm1
movdqa xmm5, xmm3
aeskeygenassist xmm2, xmm3, 4
call fcn.140044a1a
shufpd xmm5, xmm1, 0
movdqu xmmword [rdx + 0x40], xmm5
movdqa xmm6, xmm1
shufpd xmm6, xmm3, 1
movdqu xmmword [rdx + 0x50], xmm6
aeskeygenassist xmm2, xmm3, 8
call fcn.140044a1a
movdqu xmmword [rdx + 0x60], xmm1
movdqa xmm5, xmm3
aeskeygenassist xmm2, xmm3, 0x10
call fcn.140044a1a
shufpd xmm5, xmm1, 0
movdqu xmmword [rdx + 0x70], xmm5
movdqa xmm6, xmm1
shufpd xmm6, xmm3, 1
movdqu xmmword [rdx + 0x80], xmm6
aeskeygenassist xmm2, xmm3, 0x20
call fcn.140044a1a
movdqu xmmword [rdx + 0x90], xmm1
movdqa xmm5, xmm3
aeskeygenassist xmm2, xmm3, 0x40
call fcn.140044a1a
shufpd xmm5, xmm1, 0
movdqu xmmword [rdx + 0xa0], xmm5
movdqa xmm6, xmm1
shufpd xmm6, xmm3, 1
movdqu xmmword [rdx + 0xb0], xmm6
aeskeygenassist xmm2, xmm3, 0x80
call fcn.140044a1a
movdqu xmmword [rdx + 0xc0], xmm1
jmp 0x140044a59
ret
Function at 0x140044a60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movdqu xmm1, xmmword [rcx]
movdqu xmm3, xmmword [rcx + 0x10]
movdqu xmmword [rdx], xmm1
movdqu xmmword [rdx + 0x10], xmm3
aeskeygenassist xmm2, xmm3, 1
call fcn.140044b59
movdqu xmmword [rdx + 0x20], xmm1
aeskeygenassist xmm2, xmm1, 0
call fcn.140044b82
movdqu xmmword [rdx + 0x30], xmm3
aeskeygenassist xmm2, xmm3, 2
call fcn.140044b59
movdqu xmmword [rdx + 0x40], xmm1
aeskeygenassist xmm2, xmm1, 0
call fcn.140044b82
movdqu xmmword [rdx + 0x50], xmm3
aeskeygenassist xmm2, xmm3, 4
call fcn.140044b59
movdqu xmmword [rdx + 0x60], xmm1
aeskeygenassist xmm2, xmm1, 0
call fcn.140044b82
movdqu xmmword [rdx + 0x70], xmm3
aeskeygenassist xmm2, xmm3, 8
call fcn.140044b59
movdqu xmmword [rdx + 0x80], xmm1
aeskeygenassist xmm2, xmm1, 0
call fcn.140044b82
movdqu xmmword [rdx + 0x90], xmm3
aeskeygenassist xmm2, xmm3, 0x10
call fcn.140044b59
movdqu xmmword [rdx + 0xa0], xmm1
aeskeygenassist xmm2, xmm1, 0
call fcn.140044b82
movdqu xmmword [rdx + 0xb0], xmm3
aeskeygenassist xmm2, xmm3, 0x20
call fcn.140044b59
movdqu xmmword [rdx + 0xc0], xmm1
aeskeygenassist xmm2, xmm1, 0
call fcn.140044b82
movdqu xmmword [rdx + 0xd0], xmm3
aeskeygenassist xmm2, xmm3, 0x40
call fcn.140044b59
movdqu xmmword [rdx + 0xe0], xmm1
jmp 0x140044bab
ret

Function at 0x140044bb0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 1
test r8, r8
je 0x140044bd4
xor eax, eax
mov r9, rcx
mov cl, byte [r9]
xor cl, byte [rdx]
or al, cl
inc r9
inc rdx
dec r8
jne 0x140044bbf
movzx eax, al
ret
Function at 0x1411d44d9
Capabilities:
Execute anti-debugging instructions

Disassembly:
push r14
rdtsc
push r15
push r10
cwd
pushfq
btr r8w, r9w
shr di, cl
or dh, al
push r11
stc
push rbx
bsr dx, sp
push r9
movabs rdx, 0
push rdx
movzx rdi, r11w
shl r8d, cl
test dil, r9b
mov rbp, qword [rsp + 0x90]
add al, r9b
btc r11d, r9d
xor ebp, 0x4f19044a
cdqe
bswap di
btc r8w, 0xa
ror ebp, 2
cbw
stc
bswap ebp
btr r11w, 0x17
ror r11d, 0xe1
bt r11w, 0xaf
add ebp, 0x12001d32
add rbp, rdx
movabs rax, 0x100000000
rcl dil, cl
sal r8w, cl
lea rbp, [rbp + rax]
mov r8, rsp
sbb al, 0xdb
sub rsp, 0x180
and rsp, 0xfffffffffffffff0
clc
test r8b, 0xc7
mov rdi, rbp
sbb al, r8b
movabs rax, 0
movsx r11, sp
sub rdi, rax
not r11
movzx ax, r12b
lea r11, [0x1410e39f7]
cmp rbp, 0x33981d31
adc ah, 0xaf
sub rbp, 4
btr rax, 0x69
adc ax, 0x40c6
mov eax, dword [rbp + riz]
cmp r11b, dil
xor eax, edi
ror eax, 3
test bx, r10w
add eax, 0x10de685f
stc
not eax
bswap eax
cmc
push rdi
adc di, 0x5a84
shl dil, 0x87
xor dword [rsp], eax
pop rdi
stc
cmp bpl, bl
movsxd rax, eax
clc
test r11d, r12d
add r11, rax
jmp 0x1411d7856
push r12
bswap bp
mov bp, r14w
not bp
push rsi
mov bpl, r11b
push r8
mov r8w, 0x195c
movsx rdx, r14w
push rdi
push rax
rdtsc
push rcx
rdtsc
jmp 0x1410e3935
push rbp
mov bp, 0x51c3
push rdx
cwd
push r13
jmp 0x14115bcff
jmp r11
Function at 0x10001182
Capabilities:
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x790]
sub esp, 0x810
mov eax, dword [0x10017060]
xor eax, ebp
mov dword [ebp + 0x78c], eax
push ebx
xor ebx, ebx
cmp dword [0x1001ac08], ebx
je 0x10001253
lea eax, [ebp - 0x78]
push eax
mov dword [ebp - 0x78], ebx
call fcn.10003a45
push eax
push 0x80000001
call dword [0x1001300c]
test eax, eax
jne 0x10001253
push 0x7ff
lea eax, [ebp - 0x73]
push ebx
push eax
mov dword [ebp - 0x7c], 0x800
mov dword [ebp - 0x80], 1
mov byte [ebp - 0x74], bl
call fcn.100048c0
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push str.mwfffp
push dword [ebp - 0x78]
call dword [0x10013014]
test eax, eax
jne 0x1000124a
push esi
mov esi, dword [0x10013094]
push edi
lea eax, [ebp - 0x74]
push eax
xor edi, edi
call esi
test eax, eax
jle 0x10001232
xor byte [ebp + edi - 0x74], 0x5f
lea eax, [ebp - 0x74]
push eax
inc edi
call esi
cmp edi, eax
jl 0x10001222
lea edi, [ebp - 0x74]
call fcn.100016dd
push str.mwfffp
push dword [ebp - 0x78]
call dword [0x10013010]
pop edi
pop esi
push dword [ebp - 0x78]
call dword [0x10013008]
mov ecx, dword [ebp + 0x78c]
xor eax, eax
xor ecx, ebp
inc eax
pop ebx
call fcn.10004727
add ebp, 0x790
leave
ret