joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800080ec
Capabilities:
Read .ini file

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
lea rbp, [rsp - 0x37]
sub rsp, 0x100
mov rax, qword [0x18001c010]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x48], rdx
mov qword [rbp - 0x79], r8
mov rcx, qword [rdx + 0x10]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, 9
jb 0x1800082ea
mov r9, rdx
cmp qword [rdx + 0x18], 0x10
jb 0x18000814c
mov r9, qword [rdx]
mov qword [rsp + 0x30], 9
lea rax, str.data.ini
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x71]
call fcn.1800130a4
nop
xor edx, edx
lea r8d, [rdx + 0x64]
lea rcx, [rbp - 0x49]
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp - 0x71]
cmp qword [rbp - 0x59], 0x10
cmovae rax, qword [rbp - 0x71]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18000819a
mov rdx, qword [rdi]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x64
lea r9, [rbp - 0x49]
xor r8d, r8d
lea rcx, str.data
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
and qword [rsi + 0x10], 0
and qword [rsi + 0x18], 0
lea rax, [rbp - 0x49]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x1800081d3
lea rdx, [rbp - 0x49]
mov rcx, rsi
call fcn.180012a44
nop
mov r12d, 0x1000
mov rdx, qword [rbp - 0x59]
cmp rdx, 0x10
jb 0x18000822a
inc rdx
mov rcx, qword [rbp - 0x71]
mov rax, rcx
cmp rdx, r12
jb 0x180008225
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180008225
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180014950
movdqa xmm0, xmmword [0x180017b60]
movdqu xmmword [rbp - 0x61], xmm0
mov byte [rbp - 0x71], 0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x18000826d
mov rcx, qword [rbx]
inc rdx
cmp rdx, r12
jb 0x180008268
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800082dc
mov rcx, r8
call fcn.180014950
and qword [rbx + 0x10], 0
mov qword [rbx + 0x18], recv
mov byte [rbx], 0
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x1800082af
inc rdx
mov rcx, qword [rdi]
cmp rdx, r12
jb 0x1800082aa
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800082e3
mov rcx, r8
call fcn.180014950
and qword [rdi + 0x10], 0
mov qword [rdi + 0x18], recv
mov byte [rdi], 0
mov rax, rsi
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.180014930
add rsp, 0x100
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.180002904
int3
Function at 0x18000c0e8
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x280
mov rax, qword [0x18001c010]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rdi, rcx
mov qword [rsp + 0x20], rcx
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x18000c12f
mov rcx, rdi
call fcn.18000f9e0
xor eax, eax
jmp 0x18000c1a4
mov dword [rsp + 0x30], 0x238
xor edx, edx
mov r8d, 0x234
lea rcx, [rsp + 0x34]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
mov rcx, rdi
cmp qword [rdi + 0x18], 8
jb 0x18000c164
mov rcx, qword [rdi]
lea rdx, [rsp + 0x5c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov rcx, rbx
test eax, eax
je 0x18000c190
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x18000c157
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18000c123
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rsp + 0x38]
mov rcx, rdi
call fcn.18000f9e0
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.180014930
mov rbx, qword [rsp + 0x298]
add rsp, 0x280
pop rdi
ret
Function at 0x18000e7e0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x28
cmp edx, 1
jne 0x18000e801
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor r8d, r8d
lea rcx, [0x18000c6c0]
xor edx, edx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthread]
mov eax, 1
add rsp, 0x28
ret

Function at 0x18000e80c
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r8, rcx
mov r9, rax
mov r10d, 0x3d
mov dl, byte [r9]
mov ecx, dword [r8]
not dl
xor dl, cl
mov byte [r9], dl
inc r9
sub r10, 1
jne 0x18000e81c
mov byte [r8 + 0x41], r10b
ret

Function at 0x18000e838
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov r8b, byte [rax + r9]
mov edx, dword [rcx]
not r8b
add dl, r9b
xor dl, r8b
mov byte [rax + r9], dl
inc r9
cmp r9, 0x4a
jb 0x18000e83f
mov byte [rcx + 0x4e], 0
ret

Function at 0x18000e884
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r8, rcx
mov r9, rax
mov r10d, 0x23
mov dl, byte [r9]
mov ecx, dword [r8]
not dl
xor dl, cl
mov byte [r9], dl
inc r9
sub r10, 1
jne 0x18000e894
mov byte [r8 + 0x27], r10b
ret

Function at 0x18000e8b0
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov r8b, byte [rax + r9]
mov edx, dword [rcx]
not r8b
add dl, r9b
xor dl, r8b
mov byte [rax + r9], dl
inc r9
cmp r9, 0xc
jb 0x18000e8b7
mov byte [rcx + 0x10], 0
ret

Function at 0x18000e8d8
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r8, rcx
mov r9, rax
mov r10d, 0x30
mov dl, byte [r9]
mov ecx, dword [r8]
not dl
xor dl, cl
mov byte [r9], dl
inc r9
sub r10, 1
jne 0x18000e8e8
mov byte [r8 + 0x34], r10b
ret

Function at 0x18000e928
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov r8b, byte [rax + r9]
mov edx, dword [rcx]
not r8b
add dl, r9b
xor dl, r8b
mov byte [rax + r9], dl
inc r9
cmp r9, 0xb
jb 0x18000e92f
mov byte [rcx + 0xf], 0
ret

Function at 0x18000e974
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov r8b, byte [rax + r9]
mov edx, dword [rcx]
not r8b
add dl, r9b
xor dl, r8b
mov byte [rax + r9], dl
inc r9
cmp r9, 0x10
jb 0x18000e97b
mov byte [rcx + 0x14], 0
ret

Function at 0x18000e99c
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r8, rcx
mov r9, rax
mov r10d, recv
mov dl, byte [r9]
mov ecx, dword [r8]
not dl
xor dl, cl
mov byte [r9], dl
inc r9
sub r10, 1
jne 0x18000e9ac
mov byte [r8 + 0xf], r10b
ret

Function at 0x18000e9c8
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r8, rcx
mov r9, rax
mov r10d, socket
mov dl, byte [r9]
mov ecx, dword [r8]
not dl
xor dl, cl
mov byte [r9], dl
inc r9
sub r10, 1
jne 0x18000e9d8
mov byte [r8 + 0x18], r10b
ret

Function at 0x18000e9f4
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov r8b, byte [rax + r9]
mov edx, dword [rcx]
not r8b
add dl, r9b
xor dl, r8b
mov byte [rax + r9], dl
inc r9
cmp r9, 0x16
jb 0x18000e9fb
mov byte [rcx + 0x1a], 0
ret
Function at 0x18000eaac
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov r8b, byte [rax + r9]
mov edx, dword [rcx]
not r8b
add dl, r9b
xor dl, r8b
mov byte [rax + r9], dl
inc r9
cmp r9, 0x18
jb 0x18000eab3
mov byte [rcx + 0x1c], 0
ret

Function at 0x18000ead4
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r8, rcx
mov r9, rax
mov r10d, 0x1c
mov dl, byte [r9]
mov ecx, dword [r8]
not dl
xor dl, cl
mov byte [r9], dl
inc r9
sub r10, 1
jne 0x18000eae4
mov byte [r8 + 0x20], r10b
ret

Function at 0x18000eb6c
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov r8b, byte [rax + r9]
mov edx, dword [rcx]
not r8b
add dl, r9b
xor dl, r8b
mov byte [rax + r9], dl
inc r9
cmp r9, 0x19
jb 0x18000eb73
mov byte [rcx + 0x1d], 0
ret
Function at 0x140026010
Capabilities:
Encode data using xor

Disassembly:
test r8d, r8d
je 0x140026118
xchg rbp, rbx
mov qword [rsp + 0x10], rbp
xchg rbx, rbp
mov qword [rsp + 0x18], rbp
nop
sub rsp, 8
mov qword [rsp], rsi
sub rsp, 0x20
xchg rdi, rcx
mov qword [rsp + 0x30], rcx
xchg rcx, rdi
mov rbx, rdx
mov rdi, rcx
mov esi, r8d
sub rdi, rdx
xchg r9, rcx
mov rbp, r9
xchg r9, rcx
neg rdi
add rdi, 0xffffffffffffff10
neg rdi
dec rsi
shr rsi, 1
shr rsi, 2
shr rsi, 1
inc rsi
nop dword [rax]
xchg r11, rbx
movups xmm0, xmmword [r11]
xchg r11, rbx
mov rdx, rbp
xchg rsi, rbx
mov rcx, rsi
xchg rsi, rbx
call fcn.1400267c0
mov ecx, 0x7bb542f9
xor ecx, 0x61542bc3
add ecx, 0x58ace1a0
xor ecx, 0xe8b68f2
xor ecx, 0x1e13b6ed
xor ecx, 0x449e2212
xor ecx, 0x2788b6c7
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdi + rbx]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x1400260c7
sub rdi, 0x10
xchg rbp, r14
movups xmmword [r14 + 0xf0], xmm0
xchg r14, rbp
sub rsi, 1
jne 0x140026076
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
xchg r8, rbp
mov r8, qword [rsp + 0x40]
xchg rbp, r8
add rsp, 0x20
nop
mov rsi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140026130
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rsi
mov qword [rsp + 8], rsi
xchg rbx, rsi
xchg rsi, rbp
mov qword [rsp + 0x10], rsi
xchg rbp, rsi
xchg rdi, rsi
mov qword [rsp + 0x18], rdi
xchg rsi, rdi
push rdi
sub rsp, 0x20
mov edi, r8d
xchg rdx, rcx
mov rbx, rcx
xchg rdx, rcx
lea r9, [rcx + 0xf0]
xchg rsi, rdx
mov rdx, rcx
xchg rsi, rdx
test r8d, r8d
je 0x140026219
dec rdi
shr rdi, 4
inc rdi
nop dword [rax]
nop word [rax + rax]
xchg r10, rax
mov r10, rbx
xchg r10, rax
sub r9, rbx
mov edx, 0x76c4a259
xor edx, 0x4625e3c4
add edx, 0x11650dd6
sub edx, 0x2f67f7c7
xor edx, 0x54132bb3
xor edx, 0x44228d59
add edx, 0x114c172b
xor edx, 0x143c0861
nop dword [rax + rax]
movzx ecx, byte [r9 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x1400261d0
xchg rdx, rcx
mov rcx, rsi
xchg rdx, rcx
xchg r15, rcx
mov r15, rbx
xchg r15, rcx
call fcn.1400262c0
xchg rbx, r13
mov r9, r13
xchg rbx, r13
neg rbx
add rbx, 0xfffffffffffffff0
neg rbx
sub rdi, 1
jne 0x140026192
xchg r9, r11
movups xmm0, xmmword [r11]
xchg r9, r11
mov rbx, qword [rsp + 0x30]
xchg rbp, r8
mov r8, qword [rsp + 0x38]
xchg r8, rbp
xchg rsi, rbp
movups xmmword [rbp + 0xf0], xmm0
xchg rbp, rsi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140027960
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
xchg rbp, rbx
mov qword [rsp + 8], rbp
xchg rbx, rbp
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x10
xchg r8, rbx
mov r8, rdx
xchg rbx, r8
xchg rcx, r11
mov r10, r11
xchg rcx, r11
test r8b, 0xf
je 0x1400279af
xor al, al
xchg rbx, r11
mov r11, qword [rsp + 0x20]
xchg rbx, r11
add rsp, 0x10
nop
mov rdi, qword [rsp]
add rsp, 8
ret
xor edx, edx
test r8d, r8d
je 0x140027a6b
movdqa xmm2, xmmword [rsp]
nop
xchg r14, rdx
movdqu xmm1, xmmword [r14 + rbx]
xchg rdx, r14
test edx, edx
jne 0x1400279e3
xchg r10, r15
movdqu xmm2, xmmword [r15 + 0x200]
xchg r15, r10
movdqa xmm0, xmm1
lea rax, [r10 + 0x1c0]
pxor xmm0, xmmword [r10 + 0x1d0]
mov ecx, 0x7233309e
xor ecx, 0x684cd5d5
add ecx, 0x4e5ccec5
xor ecx, 0x15cdd6d1
sub ecx, 0x5d5771d4
xor ecx, 0x53ef072d
sub ecx, 0x32c054e2
add ecx, 0x563e1776
sub ecx, 0x6fd4ba47
nop dword [rax + rax]
aesdec xmm0, xmmword [rax]
lea rax, [rax - 0x10]
sub rcx, 1
jne 0x140027a31
aesdeclast xmm0, xmmword [r10 + 0x1e0]
pxor xmm0, xmm2
movdqa xmm2, xmm1
movups xmmword [rdx + r9], xmm0
neg edx
add edx, 0xfffffff0
neg edx
cmp edx, r8d
jb 0x1400279c0
xchg rbx, rbp
mov rbp, qword [rsp + 0x20]
xchg rbx, rbp
mov al, 0x65
add al, 3
xor al, 0x1e
sub al, 0x52
add al, 1
sub al, 0x24
add rsp, 0x10
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140028900
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
nop
push r13
mov qword [rsp], rdi
sub rsp, 0x20
cmp byte [r8 + 0x19], 0
mov rbx, r8
mov rdi, rdx
xchg r10, rcx
mov rsi, r10
xchg rcx, r10
jne 0x140028989
nop
mov r8, qword [rbx + 0x10]
mov rdx, rdi
xchg rsi, rcx
mov rsi, rcx
xchg rcx, rsi
call fcn.140028900
xchg r13, rcx
mov r13, rbx
xchg r13, rcx
mov edx, 0x76ff9e37
xor edx, 0x700e0287
add edx, 0x2ac8c88
add edx, 0x53202584
xor edx, 0x34d328ec
xor edx, 0x1e9a1c3f
sub edx, 0x76f77a3f
mov rbx, qword [rbx]
call fcn.1401fccd8
cmp byte [rbx + 0x19], 0
je 0x140028930
xchg rsi, rbx
mov rsi, qword [rsp + 0x30]
xchg rbx, rsi
xchg rdi, rsi
mov rdi, qword [rsp + 0x38]
xchg rdi, rsi
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x1400298f0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rdx
mov qword [rsp + 8], rdx
xchg rbx, rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, r10
mov rdi, r10
xchg r10, rcx
xor ebx, ebx
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x140029977
mov rdx, qword [rdi + 0x28]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x140029954
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140029a46
mov rcx, r8
call fcn.1401fccd8
xchg rcx, rbx
mov qword [rdi + 0x18], rcx
xchg rcx, rbx
xchg r13, rbx
mov qword [rdi + 0x20], r13
xchg rbx, r13
xchg rbx, r15
mov qword [rdi + 0x28], r15
xchg rbx, r15
xchg r9, rcx
mov r9, qword [rdi + 8]
xchg rcx, r9
xchg r15, rax
mov r15, qword [rcx + 8]
xchg r15, rax
mov qword [rax], rbx
mov rcx, qword [rcx]
test rcx, rcx
je 0x1400299ef
nop dword [rax + rax]
mov rbx, qword [rcx]
mov edx, 0x1e09ddcc
xor edx, 0x41ecee29
sub edx, 0x15ffe00c
add edx, 0x5d8309e
xor edx, 0x193b5e1
sub edx, 0x3ee11838
xor edx, 0x522a9c13
add edx, 0x217b039e
sub edx, 0x7ee288d3
call fcn.1401fccd8
xchg rcx, rsi
mov rsi, rbx
xchg rsi, rcx
test rbx, rbx
jne 0x1400299a0
mov rcx, qword [rdi + 8]
mov edx, 0x4e0b61f1
xor edx, 0x29f422b2
xor edx, 0x7554771b
xor edx, 0x4be8d1ad
sub edx, 0x2dc9f747
xor edx, 0x2d5eabed
add edx, 0x24573fe8
add edx, 0x934eeb2
sub edx, 0x33b373c5
xchg rbx, r9
mov r9, qword [rsp + 0x30]
xchg rbx, r9
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
jmp fcn.1401fccd8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14002cb10
Capabilities:
Access peb ldr_data
Check os version
Get number of processors

Disassembly:
mov qword [rsp + 0x10], rbx
xchg rcx, rsi
mov qword [rsp + 0x18], rcx
xchg rsi, rcx
mov qword [rsp + 0x20], rdi
nop
mov qword [rsp - 8], r14
sub rsp, 8
sub rsp, 0x30
xchg r11, rcx
mov rsi, r11
xchg r11, rcx
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 0x60]
mov r14d, dword [0x7ffe026c]
xor ebx, ebx
mov qword [rsp + 0x40], rbx
neg rcx
add rcx, 0xffffffffffffff38
neg rcx
xchg r8, rbx
mov qword [rsp + 0x28], r8
xchg rbx, r8
mov dword [rsp + 0x20], 0x22a1527c
xor dword [rsp + 0x20], 0x445cc5d5
xor dword [rsp + 0x20], 0x1c1e5f99
sub dword [rsp + 0x20], 0x29e4136e
add dword [rsp + 0x20], 0x2c48ce46
sub dword [rsp + 0x20], 0x51953155
xor dword [rsp + 0x20], 0xacbc257
sub dword [rsp + 0x20], 0x217893dc
lea r9, [rsp + 0x40]
lea rdx, [rbx - 1]
lea r8d, [rbx + 7]
call fcn.14002b740
test eax, eax
js 0x14002cbdd
cmp qword [rsp + 0x40], rbx
je 0x14002cbdd
lea eax, [rbx + 1]
jmp 0x14002cd11
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x30]
cmp dword [rcx + 0x70], 2
jbe 0x14002cc21
mov eax, 0x368e7bc0
xor eax, 0x4e3ee12b
sub eax, 0x624cf9a
sub eax, 0x598a94a8
xor eax, 0x1dac41df
xor eax, 0x12f029ec
add eax, 0x184cabcd
sub eax, 0x2eaa0a65
jmp 0x14002cd11
cmp dword [rcx + 0x74], ebx
jbe 0x14002cc4d
mov eax, 0x55132dd2
xor eax, 0x37e9b1bd
add eax, 0x1675ad41
add eax, 0x52268dd
sub eax, 0x216abbe8
sub eax, 0x5d27f6a2
jmp 0x14002cd11
cmp byte [rdi + 2], bl
je 0x14002cc79
mov eax, 0x7deb34f6
sub eax, 0x62587f2e
add eax, 0x2357e30e
add eax, 0xcba4d80
xor eax, 0x6513ac20
xor eax, 0x2eb74a72
jmp 0x14002cd11
cmp r14d, 0xa
jb 0x14002ccca
mov ax, word [0x7ffe0260]
cmp word [rdi + 0x120], ax
je 0x14002ccca
mov eax, 0x6826b72f
sub eax, 0x2577bf16
add eax, 0x23865342
sub eax, 0xfb7c4c2
sub eax, 0x1bcfa06d
xor eax, 0x59290876
xor eax, 0x66390be1
add eax, 0x4c37e59e
sub eax, 0x51f5cb51
jmp 0x14002cd11
lea rcx, [rsi + 0xb8]
mov edx, 0x4f93efac
sub edx, 0x4edbe8d2
add edx, 0x1a0103ae
add edx, 0x62f58c6d
sub edx, 0x19fe02e0
sub edx, 0x16635839
xor edx, 0x2d0dbc41
xor edx, 0xf9d91e04
call fcn.14002c0a0
jmp 0x14002cd0f
mov eax, ebx
xchg rdi, rbx
mov rdi, qword [rsp + 0x48]
xchg rdi, rbx
xchg r15, rsi
mov r15, qword [rsp + 0x50]
xchg rsi, r15
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14002db00
Capabilities:
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
cmp byte [rcx + 6], 0
je 0x14002db3b
xor eax, eax
add rsp, 0x20
push rax
push rdx
push rax
push rcx
push rdx
push rcx
push rax
push rax
xchg qword [rsp + 0x40], rbx
pop rax
pop rax
pop rcx
pop rdx
pop rcx
pop rax
pop rdx
pop rax
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
cmp byte [rcx + 1], 0
je 0x14002db7e
mov eax, 0x3f2ff778
sub eax, 0x15b6964c
sub eax, 0xa3eaf7
sub eax, 0x32b186e
add eax, 0x437a15c
add eax, 0x4c00ad4e
sub eax, 0x75e2ac6e
add rsp, 0x20
nop
mov rbx, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
cmp byte [rcx], 0
je 0x14002dbbb
mov eax, 0x1eee51a5
xor eax, 0x35fe5779
xor eax, 0x52a9c529
xor eax, 0x3fd6ee43
xor eax, 0x47135683
sub eax, 0x17c7b31
add rsp, 0x20
nop
xchg qword [rsp], rbx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
cmp byte [rcx + 4], 0
je 0x14002dbf3
mov eax, 0x5f4f97b9
sub eax, 0x1f6fa7c
xor eax, 0x1f1c31b2
xor eax, 0x6659f6de
xor eax, 0x7870d599
sub eax, 0x5c6d8fc1
add rsp, 0x20
push rax
xchg qword [rsp + 8], rbx
pop rax
add rsp, 8
ret
mov edx, 0x755cb7a5
sub edx, 0x56d40409
add edx, 0x2fe82af2
xor edx, 0x7c4e66c5
add edx, 0x4ab379be
sub edx, 0x7b306fd7
add edx, 0xeed861c
add edx, 0x10debd68
sub edx, 0x218e05b2
mov ecx, dword [rcx + 0xc]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
int3
Function at 0x140033bd0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
nop
push 0x33b5263a
mov qword [rsp], rsi
sub rsp, 0x20
cmp byte [r8 + 0x19], 0
xchg r15, r8
mov rbx, r15
xchg r15, r8
xchg rdx, rsi
mov rdx, rsi
xchg rdx, rsi
mov rbp, rcx
jne 0x140033ca7
xchg rdi, r12
mov qword [rsp + 0x30], r12
xchg r12, rdi
nop dword [rax]
nop dword [rax + rax]
xchg r14, r8
mov r14, qword [rbx + 0x10]
xchg r14, r8
xchg rbx, rdx
mov rbx, rsi
xchg rbx, rdx
xchg r15, rcx
mov r15, rbp
xchg rcx, r15
call fcn.140033bd0
xchg rdi, rbx
mov rbx, rdi
xchg rbx, rdi
mov rbx, qword [rbx]
lea rcx, [rdi + 0x20]
call fcn.14004cd10
mov edx, 0xec40ce8
add edx, 0x6354df12
sub edx, 0xf4921b
xor edx, 0x7be6626c
xor edx, 0x21583d0a
xor edx, 0x1c09a010
xor edx, 0x3607ca5e
add edx, 0x1b9a247a
xor edx, 0x1d2e9121
xchg rcx, rdi
mov rdi, rcx
xchg rdi, rcx
call fcn.1401fccd8
cmp byte [rbx + 0x19], 0
je 0x140033c1f
mov rdi, qword [rsp + 0x30]
xchg rbx, r9
mov r9, qword [rsp + 0x38]
xchg rbx, r9
xchg r13, rbp
mov r13, qword [rsp + 0x40]
xchg r13, rbp
add rsp, 0x20
push rax
push rdx
push rbx
push rcx
push rax
push rcx
push rax
xchg qword [rsp + 0x38], rsi
pop rax
pop rcx
pop rax
pop rcx
pop rbx
pop rdx
pop rax
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140033cf0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
xchg rbp, r8
mov qword [rsp + 0x18], r8
xchg rbp, r8
nop
mov qword [rsp - 8], rsi
sub rsp, 8
sub rsp, 0x20
cmp byte [r8 + 0x19], 0
xchg rbx, rdi
mov rdi, r8
xchg rbx, rdi
xchg r12, rdx
mov rsi, r12
xchg rdx, r12
xchg rcx, r12
mov rbp, r12
xchg r12, rcx
jne 0x140033dc7
mov qword [rsp + 0x30], rdi
nop dword [rax]
nop dword [rax + rax]
xchg r8, rdx
mov rdx, qword [rbx + 0x10]
xchg r8, rdx
mov rdx, rsi
xchg rbp, rcx
mov rbp, rcx
xchg rbp, rcx
call fcn.140033cf0
xchg rbx, rdi
mov rbx, rdi
xchg rdi, rbx
mov rbx, qword [rbx]
lea rcx, [rdi + 0x20]
call fcn.14004cd10
mov edx, 0x3ea2d5c6
xor edx, 0x33642823
xor edx, 0x78f9d893
sub edx, 0x1af70936
add edx, 0xcdac85c
xor edx, 0x53116de3
add edx, 0x2d581a60
sub edx, 0x618ba38f
xchg rcx, rdi
mov rdi, rcx
xchg rcx, rdi
call fcn.1401fccd8
cmp byte [rbx + 0x19], 0
je 0x140033d45
xchg rdi, r8
mov r8, qword [rsp + 0x30]
xchg rdi, r8
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
push rdx
push rbx
push rcx
push rcx
push rax
push rbx
xchg qword [rsp + 0x30], rsi
add rsp, 0x38
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140035a50
Capabilities:
Encode data using xor

Disassembly:
xchg rcx, rdx
mov qword [rsp + 8], rdx
xchg rcx, rdx
nop
mov qword [rsp - 8], rbx
sub rsp, 8
nop
push 0x7c99b778
mov qword [rsp], rsi
nop
push 0x169fa520
mov qword [rsp], rdi
nop
mov qword [rsp - 8], r12
sub rsp, 8
nop
mov qword [rsp - 8], r13
sub rsp, 8
nop
mov qword [rsp - 8], r14
sub rsp, 8
push r14
mov qword [rsp], r15
sub rsp, 0x30
xchg r15, r8
mov r8, rdx
xchg r8, r15
xchg r14, rcx
mov rcx, r14
xchg r14, rcx
movabs rsi, 0xfffffff59ba7bc9
xor rsi, 0x5b8e3373
add rsi, 0x43c3fd0d
xor rsi, 0x78117f61
xor rsi, 0x72572b4
xor rsi, 0x3b52368a
add rsi, 0xb6c5621
xor rsi, 0xcf1fd9
add rsi, 0x7fffffff
add rsi, 0x723a34a0
cmp rdx, rsi
ja 0x140035cd2
xchg r14, r12
mov r14, qword [rcx + 8]
xchg r12, r14
sub r12, qword [rcx]
sar r12, 3
sar r12, 1
mov rcx, qword [rcx + 0x10]
sub rcx, qword [r14]
sar rcx, 2
sar rcx, 2
xchg rcx, rdx
mov rcx, rdx
xchg rdx, rcx
shr rdx, 1
xchg rsi, r12
mov rax, r12
xchg r12, rsi
sub rax, rdx
cmp rcx, rax
ja 0x140035b54
lea rsi, [rdx + rcx]
cmp rsi, r15
cmovb rsi, r15
xchg r13, rsi
mov qword [rsp + 0x88], r13
xchg rsi, r13
xchg rbx, rsi
mov rdx, rbx
xchg rsi, rbx
xchg r13, rcx
mov r13, r14
xchg r13, rcx
call fcn.1400538e0
xchg rcx, rax
mov r13, rcx
xchg rcx, rax
mov qword [rsp + 0x28], rax
xchg rdx, r12
mov rbx, rdx
xchg r12, rdx
shl rbx, 3
shl rbx, 1
add rbx, rax
xchg rbx, rbp
mov qword [rsp + 0x20], rbp
xchg rbx, rbp
xchg rdi, r10
mov r10, r15
xchg r10, rdi
sub rdi, r12
mov qword [rsp + 0x78], rbx
je 0x140035c00
nop word [rax + rax]
mov byte [rbx], 0x47
sub byte [rbx], 9
xor byte [rbx], 0x1c
add byte [rbx], 0x2f
sub byte [rbx], 0x14
sub byte [rbx], 0x3d
lea rcx, [rbx + 8]
xor edx, edx
call fcn.14004bac0
nop
nop
add rbx, 0x77d42d2f
sub rbx, 0x77d42d1f
mov qword [rsp + 0x78], rbx
sub rdi, 1
jne 0x140035bc4
xchg r8, rdi
mov rdi, qword [r14 + 8]
xchg rdi, r8
xchg r13, rbx
mov rdx, rbx
xchg rbx, r13
mov rcx, qword [r14]
cmp rcx, r8
je 0x140035c55
xor r9d, r9d
movzx eax, byte [rcx]
mov byte [rdx], al
xchg rsi, rax
mov rsi, qword [rcx + 8]
xchg rsi, rax
xchg r10, rax
mov qword [rdx + 8], r10
xchg r10, rax
mov byte [rcx], r9b
xchg r14, r9
mov qword [rcx + 8], r14
xchg r14, r9
lea rdx, [rdx + 0x10]
sub rcx, 0xfffffffffffffff0
cmp rcx, r8
jne 0x140035c22
xchg rbx, r9
mov rbx, rsi
xchg rbx, r9
xchg rcx, r15
mov r8, rcx
xchg r15, rcx
xchg r10, rdx
mov r10, r13
xchg rdx, r10
mov rcx, r14
add rsp, 0x30
push rax
push rdx
push rbx
push rbx
xchg qword [rsp + 0x20], r15
pop rbx
pop rbx
pop rdx
pop rax
add rsp, 8
push rax
push rdx
xchg qword [rsp + 0x10], r14
pop rdx
pop rax
add rsp, 8
nop
mov r13, qword [rsp]
add rsp, 8
nop
add rsp, 8
xchg qword [rsp - 8], r12
push rbx
push rax
push rax
push rbx
push rdx
xchg qword [rsp + 0x28], rdi
pop rdx
pop rbx
pop rax
pop rax
pop rbx
add rsp, 8
nop
mov rsi, qword [rsp]
add rsp, 8
nop
mov rbx, qword [rsp]
add rsp, 8
jmp fcn.140052a50
call fcn.14002f9e0
int3
Function at 0x140035d50
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rsi
mov qword [rsp + 8], rsi
xchg rsi, rbx
nop
push 0x212b775c
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, r10
mov r10, rdx
xchg rdi, r10
xchg rbx, rdx
mov rdx, rcx
xchg rbx, rdx
test rdx, rdx
je 0x140035dbc
nop word [rax + rax]
mov byte [rbx], 0x2b
add byte [rbx], 0x41
xor byte [rbx], 9
xor byte [rbx], 0x31
add byte [rbx], 9
xor byte [rbx], 0x30
sub byte [rbx], 0x10
xor byte [rbx], 0x28
sub byte [rbx], 0x75
lea rcx, [rbx + 8]
xor edx, edx
call fcn.14004bac0
nop
sub rbx, 0xfffffffffffffff0
sub rdi, 1
jne 0x140035d8b
xchg rdx, rbx
mov rax, rdx
xchg rdx, rbx
xchg rbx, r11
mov r11, qword [rsp + 0x30]
xchg rbx, r11
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
ret