joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003b38f
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
movabs rcx, 0x31a7553feaee4b16
movabs rax, 0x31a7553feaee4b56
xor rcx, rax
movabs rdx, 0xe9ad4ce5e26fa27e
movabs rax, 0xe9ad4ce5e26fa276
xor rdx, rax
call fcn.140029060
mov rcx, rax
mov rax, qword [str.p__]
mov qword [rcx], rax
lea rax, [0x140281eee]
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 0
lea rax, [0x140281eb0]
mov qword [rcx + 0x20], rax
mov rax, rsp
mov qword [rax + 0x20], 0x5f1b804d
lea rdx, [0x140281eee]
lea r8, [0x140281ecc]
lea r9, [0x140281ed5]
call fcn.140028fa8
nop
add rsp, 0x28
ret

Function at 0x14003b428
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
movabs rcx, 0x3dd8e428c0294810
movabs rax, 0x3dd8e428c0294850
xor rcx, rax
movabs rdx, 0xed691409fa7c2c24
movabs rax, 0xed691409fa7c2c2c
xor rdx, rax
call fcn.140029060
mov rcx, rax
mov rax, qword [0x14028cf70]
mov qword [rcx], rax
lea rax, [0x140281ec0]
mov qword [rcx + 0x10], rax
movabs rax, 0x1093e0c38503d534
movabs rdx, 0x1093e0c38503d534
xor rax, rdx
mov qword [rcx + 0x18], rax
lea rax, [0x140281eb0]
mov qword [rcx + 0x20], rax
mov rax, rsp
mov qword [rax + 0x20], 0x5f1b804d
lea rdx, [0x140281ec0]
lea r8, [0x140281ecc]
lea r9, [0x140281ed5]
call fcn.140028fa8
nop
add rsp, 0x28
ret

Function at 0x14003b4d4
Capabilities:
Encode data using xor
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], rcx
mov ecx, dword [0x1402980b0]
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov rdx, qword [rsp + 0x20]
mov rcx, rax
add rcx, 0x68
add rsp, 0x28
jmp fcn.1400190f0
Function at 0x14003b950
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
call fcn.140091c00
mov rax, qword [rsp + 0x30]
cmp byte [rax + 0x60], 0
jne 0x14003ba93
mov ecx, dword [0x140273d08]
mov eax, dword [0x140273d0c]
xor eax, 0xee8e0d1c
and ecx, eax
mov edx, ecx
xor edx, 0xffffffff
and edx, 0x5ed0d9f2
mov r8d, 0x593ad5b9
xor r8d, 0x7ea0c4b
mov eax, 0x8b2afc93
xor eax, 0x74d5036c
xor r8d, eax
mov eax, ecx
and eax, r8d
imul eax, edx
mov edx, ecx
and edx, 0x5ed0d9f2
mov r8d, 0x7150f663
xor r8d, 0x2f802f91
or ecx, r8d
imul ecx, edx
add ecx, eax
or ecx, 0x886d4166
mov eax, ecx
xor eax, 0xffffffff
and eax, 0x804d78fc
mov edx, 0xbd398313
xor edx, 0x3d74fbef
mov r8d, 0xd7832e72
xor r8d, 0x287cd18d
xor edx, r8d
and ecx, edx
or eax, ecx
mov ecx, 0x4fed67ed
xor ecx, 0x40d7dfef
cmp eax, ecx
jb 0x14003bb42
mov ecx, dword [0x140273d10]
mov edx, dword [0x140273d14]
mov eax, ecx
and eax, edx
add eax, eax
add ecx, edx
sub ecx, eax
mov edx, ecx
add edx, 0xf14f6d1c
not edx
or edx, 0xe7d1ea1b
mov eax, ecx
mov ecx, edx
lea eax, [rax + rcx - 0xeb092e3]
mov dword [rsp + 0x24], eax
mov eax, 0xd45a6ca5
mov dword [rsp + 0x20], eax
mov ecx, dword [0x1402980b0]
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov rdx, qword [rsp + 0x28]
mov ecx, dword [rsp + 0x20]
mov eax, dword [rsp + 0x24]
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
movups xmmword [rdx + 0x10], xmm0
cmp eax, ecx
je 0x14003ba22
jmp 0x14003ba93
mov eax, dword [0x140273d18]
sub eax, dword [0x140273d1c]
mov ecx, 0x445f08af
xor ecx, 0xab841ba4
sub eax, ecx
mov edx, eax
xor edx, 0xffffffff
and edx, 0x4147832
mov r8d, 0x2df5a806
xor r8d, 0x29e1d034
mov ecx, 0x2518d16a
xor ecx, 0xdae72e95
xor r8d, ecx
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0x4147832
or eax, 0x4147832
imul eax, edx
add eax, ecx
sub eax, 0x636b91b6
mov ecx, 0x4a49854e
xor ecx, 0x14a9ad45
cmp eax, ecx
je 0x14003bb4b
mov eax, dword [0x140273d20]
sub eax, dword [0x140273d24]
imul eax, eax, 0xfb737cf5
mov ecx, 0x99f02d86
xor ecx, 0xbe410cfd
xor edx, edx
div ecx
mov ecx, 0xdbb5ee01
xor ecx, 0xc7736c86
or eax, ecx
cmp eax, 0xa5d0d70d
ja 0x14003bb4b
add rsp, 0x38
ret
scasd eax, dword [rdi]
ror qword [rbx - 0x12817], 1
invalid
mov ecx, 0xe99311cc
mov al, 0xff
invalid
Function at 0x14003c5b0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rcx
mov eax, dword [0x140273d68]
mov ecx, dword [0x140273d6c]
mov edx, 0x11bdade3
xor edx, 0x4a45e2c0
xor ecx, edx
and eax, ecx
mov ecx, eax
xor ecx, 0xffffffff
mov edx, 0x4accdbe9
xor edx, 0x8ce5dc3d
and edx, ecx
mov r8d, 0xffffffff
xor r8d, 0xc62907d4
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0xc62907d4
mov r8d, 0xe1bc2201
xor r8d, 0x279525d5
or eax, r8d
imul eax, edx
add eax, ecx
sub eax, 0xe2175083
add eax, 0x654c4db3
mov ecx, 0xe28cbde2
xor ecx, 0x9bed61
add eax, ecx
sub eax, 0x5fc6dd4d
cmp eax, 0x70bf29c7
jbe 0x14003c7ad
mov eax, dword [0x140273d70]
xor eax, 0x7484658f
xor eax, dword [0x140273d74]
mov edx, eax
xor edx, 0xffffffff
and edx, 0xd3e86b00
mov r8d, 0xffffffff
xor r8d, 0xd3e86b00
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0xd3e86b00
or eax, 0xd3e86b00
imul eax, edx
add eax, ecx
mov ecx, 0x7d56ab7a
xor ecx, 0x725c9ae3
xor eax, ecx
imul eax, eax, 0x70fff0ca
mov dword [rsp + 0x38], eax
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x40]
mov eax, dword [rsp + 0x38]
cmp rcx, 0
sete cl
mov byte [rsp + 0x3f], cl
cmp eax, 0x4f27c6f9
jae 0x14003c63f
mov al, byte [rsp + 0x3f]
test al, 1
jne 0x14003c7a7
jmp 0x14003c6d5
mov rax, qword [rsp + 0x40]
mov rcx, rax
add rcx, 0xfffffffffffffff0
mov qword [rsp + 0x28], rcx
mov rax, qword [rax - 0x10]
mov qword [rsp + 0x30], rax
cmp rax, 0x10
jb 0x14003c781
mov rax, qword [rsp + 0x30]
movabs rcx, 0x7ffffffffffffff0
mov rdx, rax
and rdx, rcx
mov rcx, rax
xor rcx, 0xfffffffffffffff0
lea rcx, [rcx + rdx*2]
mov qword [rsp + 0x20], rcx
mov r8, rcx
xor r8, rax
not r8
mov rdx, rax
and rdx, r8
add rdx, rdx
sub rax, rdx
mov rdx, rcx
add rdx, rax
test rcx, rcx
setns al
or rcx, rdx
sets cl
add al, cl
inc al
test al, 1
jne 0x14003c756
jmp 0x14003c760
call fcn.14000f24b
jmp 0x14003c7a7
mov rdx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
mov qword [rdx], rcx
mov r8, qword [rax]
xor ecx, ecx
call fcn.1400200e0
jmp 0x14003c7a7
mov rax, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x28]
mov r8, qword [rax]
xor eax, eax
mov cl, al
xor cl, 1
and cl, 1
call fcn.1400200e0
mov rcx, qword [rsp + 0x40]
call fcn.140020296
nop
add rsp, 0x48
ret
fidiv word [rbp - 0x1761678]
invalid
Function at 0x14003cd90
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x98
mov qword [rsp + 0x88], rcx
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x88]
add rax, 0x60
mov qword [rsp + 0x90], rax
cmp qword [rcx], 0
jle 0x14003d26a
mov rax, qword [rsp + 0x88]
add rax, 8
mov qword [rsp + 0x78], rax
xor eax, eax
mov qword [rsp + 0x80], rax
Function at 0x14003d640
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
mov rax, rcx
add rax, 8
mov qword [rsp + 0x40], rax
mov rax, qword [rcx + 8]
mov rcx, rdx
add rcx, 8
mov qword [rsp + 0x48], rcx
cmp rax, qword [rdx + 8]
mov qword [rsp + 0x50], rax
je 0x14003d6aa
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
mov qword [rsp + 0x58], rcx
mov rax, qword [rax + 8]
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x58]
call fcn.14003c7c0
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov eax, dword [0x140273df8]
mov ecx, dword [0x140273dfc]
xor ecx, 0x57b21cdb
xor edx, edx
div ecx
xor eax, 0xad4162c7
and eax, 0x80abcc7d
imul eax, eax, 0x93cb2026
cmp eax, 0x5a5701a1
jb 0x14003d7c7
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x28]
mov r8, qword [rsp + 0x38]
mov r9, qword [rsp + 0x30]
mov ebp, dword [0x140273e00]
and ebp, dword [0x140273e04]
mov eax, ebp
xor eax, 0xafce6bc6
mov r10d, 0xffffffff
xor r10d, 0xafce6bc6
and ebp, r10d
shl ebp, 1
sub ebp, eax
mov eax, 0x4a355dc1
xor eax, 0xb5caa23e
mov r10d, ebp
xor r10d, eax
mov esi, 0xffffffff
xor esi, 0x22a2b1a5
mov r11d, 0xf662dfb
xor r11d, 0x264976e4
mov eax, 0xf485c462
xor eax, 0xb7a3b9d
xor r11d, eax
mov eax, r10d
and eax, 0x292f5b1f
and ebp, r11d
mov edi, esi
and edi, 0x292f5b1f
mov ebx, 0x3bb661bf
xor ebx, 0x1914d01a
and ebx, r11d
or eax, ebp
or edi, ebx
xor eax, edi
or r10d, esi
mov esi, 0xaf1e31c8
xor esi, 0x50e1ce37
xor r10d, esi
or r11d, 0x292f5b1f
and r10d, r11d
or eax, r10d
add eax, 0xe39a1c75
sub eax, 0x58f3716
sub eax, 0xe39a1c75
mov r9, qword [r9]
mov qword [r8], r9
mov qword [rcx], rdx
cmp eax, 0x18a5cfbd
jbe 0x14003d7c7
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
ret
movabs dword [0xffffff15e97e29fa], eax

Function at 0x14003d7d0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
call fcn.140135c00
mov rax, qword [rsp + 0x30]
cmp byte [rax + 0x60], 0
jne 0x14003d810
mov rcx, qword [rsp + 0x28]
call fcn.140135d8d
nop
add rsp, 0x38
ret
Function at 0x14003e4c0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rcx
mov ecx, dword [0x140273e88]
imul ecx, dword [0x140273e8c]
xor ecx, 0xf46dd79
add ecx, 0x4384b269
mov edx, 0xcde20612
xor edx, 0x49e5fbd4
mov eax, ecx
and eax, edx
xor ecx, 0x8407fdc6
or eax, ecx
cmp eax, 0x7a6ada9d
jbe 0x14003e5ab
mov eax, dword [0x140273e90]
xor edx, edx
div dword [0x140273e94]
sub eax, 0xc401ba3a
mov ecx, 0x76a2ab84
xor edx, edx
div ecx
or eax, eax
xor eax, 0xffffffff
mov ecx, 0x97667910
or ecx, 0x97667910
mov edx, 0x3f4a7ab8
xor edx, 0xc0b58547
xor ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
mov dword [rsp + 0x28], eax
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rax]
call fcn.140134690
mov rcx, qword [rsp + 0x20]
mov eax, dword [rsp + 0x28]
cmp byte [rcx + 0x60], 0
sete cl
mov byte [rsp + 0x2f], cl
cmp eax, 0x6c59f220
jae 0x14003e504
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x14003e59a
jmp 0x14003e5a6
mov rax, qword [rsp + 0x30]
mov qword [rax], 0
add rsp, 0x38
ret
invalid
Function at 0x14003ee70
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
call fcn.140135f20
mov rax, qword [rsp + 0x30]
mov al, byte [rax + 0x60]
mov cl, 0x6b
xor cl, 0x6b
cmp al, cl
jne 0x14003eeb8
mov rax, qword [rsp + 0x28]
mov qword [rax], 0
mov eax, dword [0x140273ee8]
add eax, dword [0x140273eec]
mov edx, 0x1b9d6ab9
xor edx, 0xa4367957
mov ecx, eax
xor ecx, edx
xor ecx, 0xffffffff
and ecx, 0xbfab13ee
shl ecx, 1
sub ecx, 0xbfab13ee
sub eax, ecx
mov ecx, eax
xor ecx, 0xf9e56300
xor ecx, 0xffffffff
or eax, 0xf9e56300
and eax, ecx
mov ecx, eax
xor ecx, 0x9b9afa59
mov edx, 0x78425dcd
xor edx, 0x87bda232
xor ecx, edx
or eax, 0x9b9afa59
and eax, ecx
cmp eax, 0x487ab2e1
jb 0x14003ef77
pop rcx
cli
invalid
mov eax, dword [0x140273ef0]
mov r8d, dword [0x140273ef4]
mov ecx, eax
xor ecx, 0xffffffff
mov edx, r8d
and edx, ecx
mov r9d, r8d
xor r9d, 0xffffffff
mov ecx, eax
and ecx, r9d
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
and eax, 0x1f3d368f
imul eax, eax, 0x71eb8bb5
mov ecx, 0xb9e0c3ed
xor edx, edx
div ecx
cmp eax, 0x6aa0faf2
ja 0x14003ef77
add rsp, 0x38
ret
jmp 0x14003ef0f
Function at 0x14003fcda
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
call fcn.1401371a0
mov rax, qword [rsp + 0x30]
mov al, byte [rax + 0x60]
mov cl, 0x22
xor cl, 0x22
cmp al, cl
jne 0x14003fd20
mov rcx, qword [rsp + 0x28]
call fcn.1401376d0
nop
add rsp, 0x38
ret
Function at 0x140040610
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x58], rcx
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x50], rax
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x68], rax
add rax, 0x60
mov qword [rsp + 0x60], rax
mov rax, qword [rcx + 0x10]
mov rcx, qword [rcx + 0x18]
call rax
mov rcx, qword [rsp + 0x68]
xor eax, eax
cmp byte [rcx + 0x60], 0
mov byte [rsp + 0x77], al
je 0x140040685
mov rax, qword [rsp + 0x60]
mov byte [rax], 0
call fcn.1400327dc
call fcn.140032883
mov rax, qword [rsp + 0x60]
mov al, byte [rax]
mov byte [rsp + 0x77], al
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x60]
mov dl, byte [rsp + 0x77]
mov byte [rsp + 0x3f], dl
mov byte [rax], 0
mov rax, qword [rcx]
add rcx, 8
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rcx, rax
add rcx, 0xffffffffffffffff
mov qword [rsp + 0x30], rcx
cmp rax, 0
jle 0x140040742
mov rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov rcx, rax
add rcx, 8
mov r8, rdx
shl r8, 4
add rcx, r8
add rax, 8
shl rdx, 4
add rax, rdx
add rax, 8
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
cmp rax, 0
je 0x14004071e
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call rax
jmp 0x140040725
mov rax, qword [rsp + 0x28]
call rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x60]
cmp byte [rcx], 0
mov qword [rsp + 0x48], rax
je 0x1400406ab
jmp 0x1400407ff
mov eax, dword [0x140273fa8]
mov edx, dword [0x140273fac]
mov ecx, 0xc43e8870
xor ecx, 0x8ee181f9
xor edx, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
or eax, eax
xor eax, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0xb035a0eb
mov edx, 0xadd8ceec
xor edx, 0x1ded6e07
mov r8d, 0x78d34c93
xor r8d, 0x872cb36c
xor edx, r8d
and ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
add eax, 0xa488c46f
imul eax, eax, 0x3f3b012c
cmp eax, 0x6c9d377e
jae 0x140040804
mov rcx, qword [rsp + 0x60]
mov eax, dword [0x140273fb0]
xor edx, edx
div dword [0x140273fb4]
mov dl, byte [rsp + 0x3f]
add eax, 0xa5125a13
imul r8d, eax, 0x73a19b38
mov eax, r8d
xor eax, 0xffffffff
and eax, 0xd42af97e
mov r9d, 0xffffffff
xor r9d, 0xd42af97e
and r8d, r9d
or eax, r8d
mov byte [rcx], dl
cmp eax, 0xe763ad83
je 0x140040804
invalid
jmp 0x1400407ff
add rsp, 0x78
ret
xor ah, ch
sti
js 0x1400407f2
lahf
invalid
jmp 0x140040610
Function at 0x14004080d
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x58], rcx
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x50], rax
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x68], rax
add rax, 0x60
mov qword [rsp + 0x60], rax
mov rax, qword [rcx + 0x10]
mov rcx, qword [rcx + 0x18]
call rax
mov rcx, qword [rsp + 0x68]
xor eax, eax
cmp byte [rcx + 0x60], 0
mov byte [rsp + 0x77], al
je 0x140040685
mov rax, qword [rsp + 0x60]
mov byte [rax], 0
call fcn.1400327dc
call fcn.140032883
mov rax, qword [rsp + 0x60]
mov al, byte [rax]
mov byte [rsp + 0x77], al
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x60]
mov dl, byte [rsp + 0x77]
mov byte [rsp + 0x3f], dl
mov byte [rax], 0
mov rax, qword [rcx]
add rcx, 8
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rcx, rax
add rcx, 0xffffffffffffffff
mov qword [rsp + 0x30], rcx
cmp rax, 0
jle 0x140040742
mov rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov rcx, rax
add rcx, 8
mov r8, rdx
shl r8, 4
add rcx, r8
add rax, 8
shl rdx, 4
add rax, rdx
add rax, 8
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
cmp rax, 0
je 0x14004071e
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call rax
jmp 0x140040725
mov rax, qword [rsp + 0x28]
call rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x60]
cmp byte [rcx], 0
mov qword [rsp + 0x48], rax
je 0x1400406ab
jmp 0x1400407ff
mov eax, dword [0x140273fa8]
mov edx, dword [0x140273fac]
mov ecx, 0xc43e8870
xor ecx, 0x8ee181f9
xor edx, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
or eax, eax
xor eax, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0xb035a0eb
mov edx, 0xadd8ceec
xor edx, 0x1ded6e07
mov r8d, 0x78d34c93
xor r8d, 0x872cb36c
xor edx, r8d
and ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
add eax, 0xa488c46f
imul eax, eax, 0x3f3b012c
cmp eax, 0x6c9d377e
jae 0x140040804
mov rcx, qword [rsp + 0x60]
mov eax, dword [0x140273fb0]
xor edx, edx
div dword [0x140273fb4]
mov dl, byte [rsp + 0x3f]
add eax, 0xa5125a13
imul r8d, eax, 0x73a19b38
mov eax, r8d
xor eax, 0xffffffff
and eax, 0xd42af97e
mov r9d, 0xffffffff
xor r9d, 0xd42af97e
and r8d, r9d
or eax, r8d
mov byte [rcx], dl
cmp eax, 0xe763ad83
je 0x140040804
invalid
jmp 0x1400407ff
add rsp, 0x78
ret
xor ah, ch
sti
js 0x1400407f2
lahf
invalid
jmp 0x140040610
Function at 0x140040c52
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
call fcn.14007acb6
mov rax, qword [rsp + 0x30]
cmp byte [rax + 0x60], 0
jne 0x140040ca3
mov ecx, dword [0x1402980b0]
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov rax, qword [rsp + 0x28]
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
add rsp, 0x38
ret
Function at 0x140042310
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
call fcn.1400bb4a0
mov rax, qword [rsp + 0x30]
cmp byte [rax + 0x60], 0
jne 0x140042443
mov eax, dword [0x1402740a8]
mov ecx, dword [str.nU0Du]
xor ecx, 0x600a447d
add eax, ecx
add eax, 0x5000f77
xor eax, 0x688b0de3
mov ecx, 0x159e279d
xor ecx, 0xba651731
sub eax, ecx
cmp eax, 0xfafdaeee
jae 0x140042448
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x1402740b0]
mov r8d, dword [0x1402740b4]
xor r8d, 0xd7c1218f
xor edx, edx
div r8d
mov edx, eax
mov r8d, 0x284d52c8
xor r8d, 0xd7b2ad37
mov eax, edx
xor eax, r8d
xor edx, 0xffffffff
and eax, edx
mov edx, 0x2c885a4b
or edx, 0x2c885a4b
xor edx, 0xffffffff
xor eax, 0xffffffff
xor edx, 0xffffffff
and eax, edx
and eax, 0xf926994e
mov edx, eax
xor edx, 0xf5759907
mov r8d, 0x6f965bfe
xor r8d, 0x9069a401
xor edx, r8d
mov r8d, 0x50fb0ab4
xor r8d, 0xa58e93b3
and r8d, edx
mov edx, 0xab3831aa
xor edx, 0xab3831a8
imul edx, r8d
mov r8d, 0x65d61248
xor r8d, 0x90a38b4f
sub edx, r8d
sub eax, edx
mov dword [rsp + 0x24], eax
mov eax, 0x54d437b
xor eax, 0x4df99d41
mov dword [rsp + 0x20], eax
call fcn.1400bb6b7
mov ecx, dword [rsp + 0x20]
mov eax, dword [rsp + 0x24]
cmp eax, ecx
jbe 0x14004237c
jmp 0x140042443
add rsp, 0x38
ret
xor al, 0x30
call 0x13f300d8a
invalid
Function at 0x140043ea0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rcx
mov ecx, dword [0x140274198]
add ecx, dword [0x14027419c]
mov eax, ecx
xor eax, 0xffffffff
mov r8d, 0x8ca2e263
xor r8d, 0x735d1d9c
mov edx, ecx
xor edx, r8d
and eax, edx
mov edx, 0xffffffff
xor edx, 0x165d151f
mov r8d, 0xffffffff
xor r8d, 0x165d151f
and edx, r8d
xor eax, 0xffffffff
xor edx, 0xffffffff
and eax, edx
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x165d151f
and ecx, edx
or eax, ecx
xor eax, 0xffffffff
or eax, 0xaf107ed5
imul eax, eax, 0x6969d3a3
cmp eax, 0x26807ea8
ja 0x140043fbc
mov eax, dword [0x1402741a0]
xor eax, 0x84dc5bc9
imul eax, dword [0x1402741a4]
xor eax, 0xfd54dcf4
imul eax, eax, 0x40b617d4
mov ecx, 0x2f1ce28a
xor ecx, 0x20267d90
xor edx, edx
div ecx
mov dword [rsp + 0x38], eax
mov eax, 0x4c905bcc
xor eax, 0x3a6074e
mov dword [rsp + 0x34], eax
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rax]
call fcn.1401a5240
mov rdx, qword [rsp + 0x28]
mov ecx, dword [rsp + 0x34]
mov eax, dword [rsp + 0x38]
cmp byte [rdx + 0x60], 0
sete dl
mov byte [rsp + 0x3f], dl
cmp eax, ecx
jae 0x140043fbc
mov al, byte [rsp + 0x3f]
test al, 1
jne 0x140043fac
jmp 0x140043fb6
mov rcx, qword [rsp + 0x40]
call fcn.1401a54d0
nop
add rsp, 0x48
ret
mov ch, 0x57
cmp byte [rsi - 0x17], ah
push rdi
invalid
Function at 0x1400455bc
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx + 8]
mov qword [rsp + 0x20], rax
cmp rax, 0
je 0x1400455f0
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0x20]
mov rcx, rax
add rcx, 0x68
call fcn.1400190f0
nop
add rsp, 0x28
ret

Function at 0x140045768
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx + 8]
mov qword [rsp + 0x20], rax
cmp rax, 0
je 0x14004579c
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0x20]
mov rcx, rax
add rcx, 0x68
call fcn.1400190f0
nop
add rsp, 0x28
ret

Function at 0x140045cd0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x58], rcx
mov rax, rcx
mov qword [rsp + 0x48], rax
mov qword [rcx], 0
mov rax, rcx
add rax, 8
mov qword [rsp + 0x50], rax
mov qword [rcx + 8], 0
mov rdx, qword [rdx]
call fcn.140045890
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
mov qword [rsp + 0x60], rax
cmp rax, 0
jle 0x140045d8b
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
add rcx, 8
mov qword [rsp + 0x28], rcx
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x28]
mov r8, qword [r8]
mov r8b, byte [r8 + rax + 8]
mov byte [rdx + rax + 8], r8b
movabs rdx, 0xca303d6e52ad3ff0
movabs r8, 0xca303d6e52ad3ff1
xor rdx, r8
add rax, rdx
cmp rax, rcx
mov qword [rsp + 0x38], rax
jne 0x140045d42
mov eax, dword [0x1402742c8]
mov ecx, dword [0x1402742cc]
xor ecx, 0xe725814
xor edx, edx
div ecx
mov edx, 0xffffffff
xor edx, 0xb52d43ca
mov ecx, eax
xor ecx, edx
and ecx, eax
mov eax, ecx
and eax, 0x1497500b
mov edx, 0x1c01f9b7
xor edx, 0x896a9bc
or ecx, edx
add eax, ecx
mov ecx, 0x8d168dd5
xor edx, edx
div ecx
mov ecx, 0x45d3ce57
xor ecx, 0x85337fb7
cmp eax, ecx
jae 0x140045e9f
mov eax, dword [0x1402742d0]
mov edx, dword [0x1402742d4]
mov r8d, 0x754f5497
xor r8d, 0x754f5496
mov ecx, eax
add ecx, r8d
xor eax, 0xffffffff
or eax, edx
add eax, ecx
mov ecx, eax
or ecx, ecx
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x28d1e321
mov r8d, 0xffffffff
xor r8d, 0x28d1e321
and ebx, esp
shr dword [rax], 1
and edx, r8d
or ecx, edx
xor ecx, 0xffffffff
or eax, 0x28d1e321
xor eax, 0xffffffff
xor ecx, 0xffffffff
xor eax, 0xffffffff
and ecx, eax
mov edx, ecx
xor edx, 0xffffffff
mov eax, 0x6e9f8344
xor eax, 0x91400fd8
and eax, edx
mov edx, 0xffffffff
xor edx, 0xffdf8c9c
and ecx, edx
or eax, ecx
mov ecx, eax
xor ecx, 0x58e59865
mov edx, 0x6352c34a
xor edx, 0x3bb75b2f
mov r8d, 0xbacc8077
xor r8d, 0x45337f88
xor edx, r8d
and eax, edx
shl eax, 1
sub eax, ecx
cmp eax, 0xa5a29fe5
ja 0x140045e9f
mov rax, qword [rsp + 0x48]
add rsp, 0x68
ret
jp 0x140045e24
psubsw mm7, qword cs:[rdi + rdi*8]
invalid
Function at 0x140046392
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
call fcn.140184430
mov rax, qword [rsp + 0x30]
cmp byte [rax + 0x60], 0
jne 0x1400463d2
mov rcx, qword [rsp + 0x28]
call fcn.140184419
nop
add rsp, 0x38
ret