joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005d4a0
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x1402a7978]
xor rax, rsp
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x14005d539
mov qword [rsp + 0x50], rdi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword gs:[0x58]
mov edi, eax
mov eax, 4
mov dword [rsp + 0x24], 0
mov rdx, qword [rcx]
mov ecx, dword [rax + rdx]
cmp dword [0x140308a4c], ecx
jle 0x14005d520
lea rcx, [0x140308a4c]
call fcn.1401568cc
cmp dword [0x140308a4c], 0xffffffff
jne 0x14005d520
lea rcx, [0x1401ae860]
call fcn.140156e18
lea rcx, [0x140308a4c]
call fcn.140156860
lea rax, [0x1402a9348]
mov dword [rsp + 0x20], edi
test edi, edi
mov qword [rsp + 0x28], rax
mov rdi, qword [rsp + 0x50]
jne 0x14005d54e
mov eax, ebx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140156510
add rsp, 0x40
pop rbx
ret
lea rdx, [0x140273148]
lea rcx, [rsp + 0x20]
call fcn.14005d2f0
int3

Function at 0x14005d560
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [0x140308cd0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14005d599
mov rdx, qword [rax + 8]
mov r8, rbx
add rsp, 0x20
pop rbx
jmp fcn.140062330
xor edx, edx
mov r8, rbx
add rsp, 0x20
pop rbx
jmp fcn.140062330

Function at 0x14005d5b0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
sub rsp, 0x28
mov rbx, rcx
mov rdi, rdx
mov ecx, dword [0x140308cd0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor r8d, r8d
test rax, rax
je 0x14005d5e0
mov r9, qword [rax + 8]
jmp 0x14005d5e3
mov r9, r8
cmp rdi, 0x3fc
ja 0x14005d607
test r9, r9
je 0x14005d607
mov rax, r8
cmp qword [r9 + rax*8], 0
je 0x14005d615
inc r8d
inc rax
cmp rax, 2
jl 0x14005d5f4
mov rcx, rbx
add rsp, 0x28
pop rdi
pop rbx
jmp fcn.140019930
movzx eax, byte [rbx + rdi]
mov byte [rbx], al
movsxd rax, r8d
mov qword [r9 + rax*8], rbx
add rsp, 0x28
pop rdi
pop rbx
ret

Function at 0x14005d830
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1402a7978]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
test rcx, rcx
je 0x14005d8aa
mov rax, qword [rcx]
lea rdx, [rsp + 0x20]
call qword [rax + reloc.WS2_32.dll_htonl]
mov ecx, dword [0x140308cd0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14005d86d
mov rdx, qword [rax + 8]
jmp 0x14005d86f
xor edx, edx
mov r9, qword [rsp + 0x28]
mov r8, qword [rsp + 0x20]
cmp r9, 0x3fc
ja 0x14005d8a2
test rdx, rdx
je 0x14005d8a2
mov ecx, 6
mov eax, ecx
nop
cmp qword [rdx + rax*8], 0
je 0x14005d8bc
inc ecx
inc rax
cmp rax, 8
jl 0x14005d890
mov rcx, r8
call fcn.140019930
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140156510
add rsp, 0x48
ret
movzx eax, byte [r8 + r9]
mov byte [r8], al
movsxd rax, ecx
mov qword [rdx + rax*8], r8
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140156510
add rsp, 0x48
ret
Function at 0x14005de70
Capabilities:
Set socket configuration

Disassembly:
mov r11, rsp
push rsi
push rdi
push r14
push r15
sub rsp, 0x58
mov rax, qword [0x1402a7978]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor r15d, r15d
mov rdi, r9
mov r14, rdx
mov rsi, rcx
cmp rcx, 0xffffffffffffffff
je 0x14005e031
mov qword [r11 + 0x18], rbx
test r8b, r8b
je 0x14005def8
movzx eax, byte [rdx]
test al, 8
je 0x14005def8
lea rcx, [0x1402a9358]
mov dword [r11 - 0x48], r15d
or al, 8
mov qword [r11 - 0x38], rcx
mov byte [rdx], al
lea r9, [r11 - 0x48]
mov edx, 0xffff
mov qword [r11 - 0x40], r15
mov rcx, rsi
mov dword [rsp + 0x20], 4
mov r8d, 0x80
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
lea rcx, [rsp + 0x38]
setne dl
call fcn.14005dde0
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
mov rcx, rdi
mov ebx, eax
setne dl
call fcn.14005dde0
test ebx, ebx
je 0x14005e02d
mov rcx, qword gs:[0x58]
mov edx, dword [0x140308a4c]
mov qword [rsp + 0x50], rbp
mov ebp, 4
add rbp, qword [rcx]
cmp edx, dword [rbp]
jle 0x14005df6e
lea rcx, [0x140308a4c]
call fcn.1401568cc
mov edx, dword [0x140308a4c]
cmp edx, 0xffffffff
jne 0x14005df6e
lea rcx, [0x1401ae860]
call fcn.140156e18
lea rcx, [0x140308a4c]
call fcn.140156860
mov edx, dword [0x140308a4c]
mov rcx, qword [rdi + 8]
mov rax, qword [0x1402a9350]
cmp qword [rcx + 8], rax
jne 0x14005df87
cmp dword [rdi], 0x2733
je 0x14005dfd2
cmp edx, dword [rbp]
jle 0x14005dfb9
lea rcx, [0x140308a4c]
call fcn.1401568cc
cmp dword [0x140308a4c], 0xffffffff
jne 0x14005dfb9
lea rcx, [0x1401ae860]
call fcn.140156e18
lea rcx, [0x140308a4c]
call fcn.140156860
mov rdx, qword [rdi + 8]
mov rax, qword [0x1402a9350]
cmp qword [rdx + 8], rax
jne 0x14005e006
cmp dword [rdi], 0x4d5
jne 0x14005e006
lea r8, [rsp + 0x30]
mov dword [rsp + 0x30], r15d
mov edx, 0x8004667e
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
and byte [r14], 0xfc
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
mov rcx, rdi
mov ebx, eax
setne dl
call fcn.14005dde0
mov rbp, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140156510
add rsp, 0x58
pop r15
pop r14
pop rdi
pop rsi
ret
mov eax, ebx
jmp 0x14005e00d
mov eax, r15d
jmp 0x14005e015
Function at 0x14005e040
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x78
mov rax, qword [0x1402a7978]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rcx, qword [rcx + 8]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x50], rax
lea r9, [rsp + 0x44]
xor eax, eax
mov byte [rsp + 0x40], 0
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x48], 1
lea r8d, [rax + 1]
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.WS2_32.dll_WSASend]
mov rax, qword gs:[0x58]
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x140308a4c], eax
jle 0x14005e0df
lea rcx, [0x140308a4c]
call fcn.1401568cc
cmp dword [0x140308a4c], 0xffffffff
jne 0x14005e0df
lea rcx, [0x1401ae860]
call fcn.140156e18
lea rcx, [0x140308a4c]
call fcn.140156860
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x40
jne 0x14005e0f1
mov edx, 0x2746
jmp 0x14005e0fd
cmp eax, 0x4d2
jne 0x14005e107
mov edx, 0x274d
lea rcx, [rsp + 0x58]
call fcn.140062430
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140156510
add rsp, 0x78
ret

Function at 0x14005e470
Capabilities:
Send data
Send data on socket

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rax, qword [0x1402a7978]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, qword [rsp + 0xa0]
mov r11, r9
mov rax, qword [rcx + 8]
mov r10, r8
mov rsi, rcx
lock inc dword [rax + 0x30]
cmp byte [rsp + 0x98], 0
je 0x14005e4c0
mov rcx, qword [rcx + 8]
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
call fcn.14005dcf0
jmp 0x14005e558
mov rcx, qword [rdx]
cmp rcx, 0xffffffffffffffff
jne 0x14005e4e0
mov rcx, qword [rsi + 8]
xor r9d, r9d
mov r8d, 0x2719
mov rdx, rdi
call fcn.14005dcf0
jmp 0x14005e558
xor eax, eax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], eax
mov r8d, r11d
mov eax, dword [rsp + 0x90]
mov rdx, r10
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
call qword [sym.imp.WS2_32.dll_WSASend]
mov ebx, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test ebx, ebx
mov rbx, qword [rsp + 0x50]
je 0x14005e54c
cmp eax, 0x3e5
je 0x14005e54c
mov r9d, dword [rsp + 0x40]
mov r8d, eax
mov rcx, qword [rsi + 8]
mov rdx, rdi
call fcn.14005dcf0
jmp 0x14005e558
mov rcx, qword [rsi + 8]
mov rdx, rdi
call fcn.14005dc60
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140156510
add rsp, 0x58
pop rdi
pop rsi
ret

Function at 0x1400604d0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rdi, rdx
mov ecx, dword [0x140308cd0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400604f7
mov r8, qword [rax + 8]
jmp 0x1400604fa
xor r8d, r8d
cmp rdi, 0x3fc
ja 0x140060522
test r8, r8
je 0x140060522
mov ecx, 2
mov eax, ecx
nop
cmp qword [r8 + rax*8], 0
je 0x140060534
inc ecx
inc rax
cmp rax, 4
jl 0x140060510
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140019930
movzx eax, byte [rbx + rdi]
mov byte [rbx], al
movsxd rax, ecx
mov qword [r8 + rax*8], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140085be0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rax, qword [rcx]
mov rsi, rcx
mov rdi, qword [0x140308e80]
movd xmm3, dword [rax + 0x40]
movd xmm0, dword [rax + 0x48]
movd xmm1, dword [rax + 0x44]
movd xmm2, dword [rax + 0x4c]
cvtdq2ps xmm3, xmm3
cvtdq2ps xmm1, xmm1
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm2, xmm2
addss xmm0, xmm3
movss dword [rsp + 0x30], xmm3
addss xmm2, xmm1
movss dword [rsp + 0x34], xmm1
comiss xmm3, xmm0
movss dword [rsp + 0x38], xmm0
movss dword [rsp + 0x3c], xmm2
jb 0x140085c47
movss dword [rsp + 0x38], xmm3
comiss xmm1, xmm2
jb 0x140085c52
movss dword [rsp + 0x3c], xmm1
mov ecx, dword [rdi + 0x5c]
mov r8d, dword [rdi + 0x58]
cmp r8d, ecx
jne 0x140085c88
inc r8d
test ecx, ecx
je 0x140085c70
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x140085c75
mov eax, 8
cmp eax, r8d
lea rcx, [rdi + 0x58]
cmovg r8d, eax
mov edx, r8d
call fcn.14003f1f0
movsxd rdx, dword [rdi + 0x58]
mov rcx, rdi
mov rax, qword [rdi + 0x60]
add rdx, rdx
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rax + rdx*8], xmm0
inc dword [rdi + 0x58]
movups xmmword [rdi + 0x88], xmm0
call fcn.140046ce0
mov rcx, qword [rsi]
movss xmm2, dword [0x1402761f4]
movzx eax, byte [rcx + 0x60]
movd xmm0, eax
movzx eax, byte [rcx + 0x61]
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm2
movss dword [rsp + 0x30], xmm0
movd xmm0, eax
movzx eax, byte [rcx + 0x62]
cvtdq2ps xmm0, xmm0
movd xmm1, eax
movzx eax, byte [rcx + 0x63]
mulss xmm0, xmm2
cvtdq2ps xmm1, xmm1
movss dword [rsp + 0x34], xmm0
mulss xmm1, xmm2
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rsp + 0x38], xmm1
movd xmm1, dword [rcx + 0x5c]
mulss xmm0, xmm2
cvtdq2ps xmm1, xmm1
movss dword [rsp + 0x3c], xmm0
movd xmm0, dword [rcx + 0x58]
cvtdq2ps xmm0, xmm0
movss dword [rsp + 0x54], xmm1
movd xmm1, dword [rcx + 0x54]
movss dword [rsp + 0x50], xmm0
movd xmm0, dword [rcx + 0x50]
lea rcx, [rsp + 0x30]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [rsp + 0x58], xmm0
movss dword [rsp + 0x5c], xmm1
call fcn.14001a8c0
movss xmm0, dword [0x140276284]
lea r8, [rsp + 0x50]
mov rcx, qword [0x140308e80]
lea rdx, [rsp + 0x58]
mov r9d, eax
movss dword [rsp + 0x20], xmm0
call fcn.140049650
mov rcx, qword [0x140308e80]
mov eax, dword [rcx + 0x58]
sub eax, 1
mov dword [rcx + 0x58], eax
jne 0x140085d92
mov rax, qword [rcx + 0x38]
add rax, 0x1c
jmp 0x140085d9e
dec eax
cdqe
shl rax, 4
add rax, qword [rcx + 0x60]
movups xmm0, xmmword [rax]
movups xmmword [rcx + 0x88], xmm0
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
jmp fcn.140046ce0
add rcx, 8
jmp 0x140085be0
Function at 0x140089660
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14008968f
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x140089687
mov rax, qword [rcx]
xor edx, edx
call rax
nop
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x1400896d8
mov ecx, dword [0x140308cd0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400896c8
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400896c8
xor ecx, ecx
xor eax, eax
cmp qword [rdx + rax*8], 0
je 0x1400896e3
inc ecx
inc rax
cmp rax, 2
jl 0x1400896b6
mov rcx, rbx
call fcn.140019930
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x28]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140089710
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1402a7978]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov ecx, dword [0x140308ce8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x140089818
call fcn.140086cf0
mov ebx, eax
mov dword [rsp + 0x34], 0
mov eax, 4
mov rcx, qword gs:[0x58]
mov rdx, qword [rcx]
mov ecx, dword [rax + rdx]
cmp dword [0x140308a4c], ecx
jle 0x140089792
lea rcx, [0x140308a4c]
call fcn.1401568cc
cmp dword [0x140308a4c], 0xffffffff
jne 0x140089792
lea rcx, [0x1401ae860]
call fcn.140156e18
lea rcx, [0x140308a4c]
call fcn.140156860
mov dword [rsp + 0x30], ebx
lea rax, [0x1402a9348]
mov qword [rsp + 0x38], rax
test ebx, ebx
jne 0x140089837
lea rax, [0x140308b10]
mov qword [rsp + 0x20], rax
lea rcx, [0x140308b18]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [rsp + 0x28], 1
mov rax, qword [0x1402cbfe0]
test rax, rax
jne 0x1400897fb
lea ecx, [rbx + 0x20]
call fcn.140156530
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
mov rcx, rax
call fcn.140088120
nop
mov qword [0x1402cbfe0], rax
mov rdx, rax
mov ecx, dword [0x140308ce8]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
lea rcx, [0x140308b18]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x140308ce8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140156510
add rsp, 0x50
pop rbx
ret
lea rdx, str.static_mutex
lea rcx, [rsp + 0x30]
call fcn.14005d2f0
int3
Function at 0x14008dcd0
Capabilities:
Set socket configuration

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
mov rax, qword [0x1402a7978]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r15d, r9d
mov r14, r8
mov rbx, rdx
mov r13, rcx
mov ebp, dword [rsp + 0xd0]
mov r8d, dword [rsp + 0xd8]
mov rdi, qword [rsp + 0xe0]
cmp qword [r14], 0xffffffffffffffff
je 0x14008dd86
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x140308a48], eax
jle 0x14008dd62
lea rcx, [0x140308a48]
call fcn.1401568cc
cmp dword [0x140308a48], 0xffffffff
jne 0x14008dd62
lea rcx, [0x1401ae870]
call fcn.140156e18
lea rcx, [0x140308a48]
call fcn.140156860
mov dword [rsp + 0x38], 1
lea rax, [0x1402a9368]
mov qword [rsp + 0x40], rax
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rdi], xmm0
movups xmmword [rbx], xmm0
jmp 0x14008df03
mov dword [rsp + 0x28], 1
xor r12d, r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
mov edx, ebp
mov ecx, r15d
call qword [sym.imp.WS2_32.dll_WSASocketW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
sete dl
mov rcx, rdi
call fcn.14005dde0
cmp rsi, 0xffffffffffffffff
je 0x14008dde6
cmp r15d, 0x17
jne 0x14008dde6
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x48]
lea edx, [r15 + 0x12]
lea r8d, [r15 + 4]
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_setsockopt]
nop
cmp rsi, 0xffffffffffffffff
jne 0x14008ddf4
movups xmm0, xmmword [rdi]
jmp 0x14008df00
mov rdx, qword [r13 + 8]
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rdx + 0x28]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
lea r13, [0x1402a9358]
test rax, rax
jne 0x14008de7c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
mov eax, 4
mov rcx, qword gs:[0x58]
mov rdx, qword [rcx]
mov ecx, dword [rax + rdx]
cmp dword [0x140308a4c], ecx
jle 0x14008de69
lea rcx, [0x140308a4c]
call fcn.1401568cc
cmp dword [0x140308a4c], 0xffffffff
jne 0x14008de69
lea rcx, [0x1401ae860]
call fcn.140156e18
lea rcx, [0x140308a4c]
call fcn.140156860
mov dword [rsp + 0x38], r15d
lea rax, [0x1402a9348]
mov qword [rsp + 0x40], rax
jmp 0x14008de86
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x40], r13
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rdi], xmm0
cmp dword [rdi], 0
je 0x14008debc
movups xmmword [rbx], xmm0
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], r13
mov byte [rsp + 0x30], 0
lea r9, [rsp + 0x38]
mov r8b, 1
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.14005de70
jmp 0x14008df03
mov qword [rsp + 0x38], 0xffffffffffffffff
mov qword [r14], rsi
sub ebp, 1
je 0x14008dee0
cmp ebp, 1
je 0x14008ded9
mov byte [r14 + 8], 0
jmp 0x14008dee5
mov byte [r14 + 8], 0x20
jmp 0x14008dee5
mov byte [r14 + 8], select
lea rcx, [r14 + 0x10]
call fcn.14008f2c0
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x40], r13
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rdi], xmm0
movups xmmword [rbx], xmm0
mov rax, rbx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140156510
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140097140
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rbp
push rsi
push r14
push r15
sub rsp, 0x1a8
mov rax, qword [0x1402a7978]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov r14, qword [rsp + 0x1f0]
lea r8, [rsp + 0x70]
mov qword [rsp + 0x60], rdx
movabs rax, 0xc1644e940d420f52
mov qword [rsp + 0x70], rax
mov rsi, rdx
movabs rax, 0xbf1b19fa94262b62
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x78], rax
mov rcx, 0xffffffff80000001
movaps xmm0, xmmword [rsp + 0x70]
movabs rax, 0x84360fc359044001
mov qword [rsp + 0x70], rax
mov rbp, r9
movabs rax, 0xbf1b19faf342463e
xor r15d, r15d
mov qword [rsp + 0x78], rax
xorps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x50], xmm0
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x1400971fa
xorps xmm0, xmm0
lea rdx, [0x14026d779]
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r15
xor r8d, r8d
mov qword [rsi + 0x18], r15
jmp 0x140097351
mov rax, qword [0x140308b68]
mov dword [rsp + 0x60], 0x104
test rax, rax
jne 0x1400972ec
mov rax, qword gs:[0x60]
mov qword [rsp + 0x1d0], rbx
mov qword [rsp + 0x1a0], rdi
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov ebx, dword [rcx + r11 + 0x88]
add rbx, r11
cmp rbx, r11
je 0x1400972b7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400972b7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r11]
add rcx, r11
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1400972b2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x140097290
cmp r8d, 0x57949ea7
je 0x1400972bc
test r9d, r9d
jne 0x140097270
mov rax, qword [rax]
jmp 0x140097240
mov ecx, dword [rbx + 0x24]
mov rdi, qword [rsp + 0x1a0]
add rcx, r11
movzx r10d, word [rcx + r9*2]
mov r9d, dword [rbx + 0x1c]
mov rbx, qword [rsp + 0x1d0]
add r9, r11
mov eax, dword [r9 + r10*4]
add rax, r11
mov qword [0x140308b68], rax
lea rdx, [rsp + 0x60]
mov r9d, 1
mov qword [rsp + 0x30], rdx
mov r8, r14
lea rdx, [rsp + 0x80]
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x28], rdx
mov rdx, rbp
mov qword [rsp + 0x20], r15
call rax
xorps xmm0, xmm0
lea rax, [rsp + 0x80]
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r15
mov r8, 0xffffffffffffffff
mov qword [rsi + 0x18], r15
nop word [rax + rax]
inc r8
cmp byte [rax + r8], r15b
jne 0x140097340
lea rdx, [rsp + 0x80]
mov rcx, rsi
call fcn.14000bef0
mov rax, rsi
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140156510
add rsp, 0x1a8
pop r15
pop r14
pop rsi
pop rbp
ret
Function at 0x1400b6790
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xa0
mov rax, qword [0x1402a7978]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, rcx
mov qword [rcx], 0
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 1
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x1400b6826
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [rsp + 0x20], 8
mov r9d, 1
xor r8d, r8d
lea rdx, str.Crypto_RNG
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x1400b6826
mov dword [rsp + 0x20], 0x28
lea r9d, [rax + 1]
xor r8d, r8d
lea rdx, str.Crypto_RNG
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x1400b684a
mov rax, rbx
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140156510
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa0
pop rdi
ret
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, str.CryptAcquireContext
lea rcx, [rsp + 0x30]
call fcn.140009040
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.1400b6900
lea rdx, [0x1402a3f00]
lea rcx, [rsp + 0x50]
call fcn.140158bbc
int3

Function at 0x1400b6d00
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x1402a7978]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, r8
mov rdi, rdx
mov ecx, dword [0x1402d6f10]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x1402d4ec8], ecx
jg 0x1400b6ddf
mov eax, ebx
cmp rbx, rax
jne 0x1400b6da1
xor ecx, ecx
mov eax, ecx
test rbx, rbx
setne al
test ebx, ebx
setne cl
cmp eax, ecx
jne 0x1400b6da1
mov r8, rdi
mov edx, ebx
mov rcx, qword [0x1402d4ec0]
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x1400b6e22
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140156510
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rdi
ret
mov ecx, 0x5b6
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, str.GenerateBlock_size
lea rcx, [rsp + 0x20]
call fcn.140009040
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.1400b6900
lea rdx, [0x1402a3f00]
lea rcx, [rsp + 0x40]
call fcn.140158bbc
nop
lea rcx, [0x1402d4ec8]
call fcn.1401568cc
cmp dword [0x1402d4ec8], 0xffffffff
jne 0x1400b6d4c
lea rcx, [0x1402d4ec0]
call fcn.1400b6790
lea rcx, [0x1401af4a0]
call fcn.140156e18
nop
lea rcx, [0x1402d4ec8]
call fcn.140156860
jmp 0x1400b6d4c
lea rdx, [0x1401b4940]
lea rcx, [rsp + 0x20]
call fcn.140009040
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.1400b6900
lea rdx, [0x1402a3f00]
lea rcx, [rsp + 0x40]
call fcn.140158bbc
int3