joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140048270
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rcx
mov rdx, qword [rcx]
mov qword [rsp + 0x50], rdx
mov rax, rcx
add rax, 8

Function at 0x1400484e2
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
call fcn.14011be70
mov rax, qword [rsp + 0x30]
mov al, byte [rax + 0x60]
mov cl, 0x43
xor cl, 0x43
cmp al, cl
jne 0x140048528
mov rcx, qword [rsp + 0x28]
call fcn.14011c120
nop
add rsp, 0x38
ret
Function at 0x140048530
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rcx
mov r8, qword [rcx]
mov rax, r8
add rax, 0xffffffffffffffff
mov qword [rsp + 0x50], rax
mov rdx, rax
xor rdx, 0xffffffffffffffff
mov rcx, r8
and rcx, rdx
xor r8, 0xffffffffffffffff
mov rdx, rax
and rdx, r8
or rcx, rdx
cmp rcx, 0
setl dl
movabs rcx, 0xf20c72909b8b4482
movabs r8, 0xdf38d6f6474bb7d
xor rcx, r8
cmp rax, rcx
setg cl
xor dl, 0xff
mov al, cl
xor al, dl
and al, cl
test al, 1
jne 0x1400485b9
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
add rcx, 8
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
jmp 0x1400485c3
call fcn.14000f24b
jmp 0x140048784
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x28], rax
cmp rax, rcx
jl 0x140048777
mov rax, qword [rsp + 0x28]
movabs rcx, 0x6676520689ee5c60
movabs rdx, 0x6676520689ee5c60
xor rcx, rdx
cmp rax, rcx
jl 0x1400486cb
mov eax, dword [0x140274418]
xor eax, 0x2f0d35b
mov ecx, dword [0x14027441c]
xor ecx, 0x92beb65b
mov edx, 0x8b850aa6
xor edx, 0x72eedfcc
sub eax, edx
sub eax, ecx
add eax, 0xf96bd56a
mov ecx, 0xaa7f07c6
xor ecx, 0x14002c4c
and ecx, eax
xor ecx, 0xffffffff
add eax, 0xbe7f2b8a
add eax, 1
add eax, ecx
xor eax, 0x1cbf6e13
mov ecx, 0xdf6afdd
xor edx, edx
div ecx
cmp eax, 0x2b2b582a
jae 0x140048789
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x140274420]
imul eax, dword [0x140274424]
mov r8d, 0xdda764f
xor edx, edx
div r8d
mov rdx, qword [rsp + 0x48]
or eax, 0xf944bcd3
mov r8d, 0x6b390852
xor r8d, 0x6b390852
mov r9d, 0x98b0d01c
xor r9d, 0xf16effea
sub r8d, r9d
add eax, r8d
cmp rcx, qword [rdx]
setl cl
mov byte [rsp + 0x27], cl
cmp eax, 0xb0509a61
je 0x140048789
mov al, byte [rsp + 0x27]
test al, 1
jne 0x1400486d8
jmp 0x1400486cb
mov rcx, rdx
call fcn.1400292ad
jmp 0x140048784
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx]
add rcx, 8
shl rax, 3
add rcx, rax
call fcn.1400484e2
mov rcx, qword [rsp + 0x28]
mov rax, rcx
add rax, 0xffffffffffffffff
movabs rdx, 0x6a0ddab81340843
movabs r8, 0xf95f22547ecbf7bc
xor rdx, r8
mov r8, rax
xor r8, rdx
mov rdx, rcx
and rdx, r8
movabs r8, 0xd976d9989c0c8ee7
movabs r9, 0x2689266763f37118
xor r8, r9
mov r9, rcx
xor r9, r8
mov r8, rax
and r8, r9
or rdx, r8
cmp rdx, 0
setl dl
cmp rcx, 0
setne cl
and cl, dl
test cl, 1
mov qword [rsp + 0x38], rax
jne 0x14004876d
jmp 0x1400485c3
call fcn.14000f24b
jmp 0x140048784
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
add rsp, 0x58
ret
ja 0x1400487a3
pop rdx
jmp 0x14004865e
cwde
add byte [rax], al
add byte [rax - 0x77], cl
xchg esp, eax
and al, 0x80
add byte [rax], al
add byte [rax - 0x77], cl
and al, 0x78
Function at 0x140049e60
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rcx
mov eax, dword [0x1402744f8]
xor eax, 0x4e4736b4
xor edx, edx
div dword [0x1402744fc]
mov ecx, 0xb02818e5
xor ecx, 0xd59e9256
xor edx, edx
div ecx
sub eax, 0x763087fd
mov ecx, 0x5493f8d8
xor edx, edx
div ecx
mov ecx, 0x4c8bea75
xor ecx, 0xce6c53a1
cmp eax, ecx
je 0x140049f73
mov eax, dword [0x140274500]
sub eax, dword [0x140274504]
mov ecx, 0xf13b837c
xor ecx, 0xa5e92d4b
sub eax, ecx
mov r8d, 0xffffffff
xor r8d, 0xf8dc5f39
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov r8d, 0x685c4ef7
xor r8d, 0x908011ce
mov edx, eax
and edx, r8d
or eax, 0xf8dc5f39
imul eax, edx
add eax, ecx
mov ecx, 0xffffffff
xor ecx, 0x55bfa5e4
add eax, ecx
add eax, 1
mov dword [rsp + 0x28], eax
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rax]
call fcn.1401da627
mov rcx, qword [rsp + 0x20]
mov eax, dword [rsp + 0x28]
cmp byte [rcx + 0x60], 0
sete cl
mov byte [rsp + 0x2f], cl
cmp eax, 0xfcf89792
je 0x140049f73
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x140049f63
jmp 0x140049f6d
mov rcx, qword [rsp + 0x30]
call fcn.1401da77a
nop
add rsp, 0x38
ret
mov bh, 0xaa
invalid
Function at 0x14004b860
Capabilities:
Encode data using xor
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rcx
mov eax, dword [0x1402745f8]
mov ecx, dword [0x1402745fc]
or eax, eax
xor eax, 0xffffffff
or ecx, ecx
xor ecx, 0xffffffff
mov edx, 0x2214a831
xor edx, 0xddeb57ce
xor eax, edx
xor ecx, 0xffffffff
and eax, ecx
mov edx, 0xb429b0d0
xor edx, 0xd8f97695
mov ecx, eax
xor ecx, edx
xor ecx, 0xffffffff
or eax, 0x6cd0c645
and eax, ecx
xor eax, 0x29e0dccf
or eax, 0xa3131f4a
cmp eax, 0xe608a854
jae 0x14004ba38
mov ecx, dword [0x140274600]
mov eax, 0x600716d2
xor eax, 0xdcf2f794
xor ecx, eax
add ecx, dword [0x140274604]
mov edx, 0x4597099d
xor edx, 0xba68f662
mov eax, ecx
xor eax, edx
mov edx, ecx
xor edx, 0xffffffff
and eax, edx
mov edx, 0x79ff7861
xor edx, 0xbe87e3b5
mov r8d, 0xfe0a6a41
xor r8d, 0x1f595be
xor edx, r8d
mov r8d, 0xffffffff
xor r8d, 0xc7789bd4
and edx, r8d
or eax, edx
xor eax, 0xffffffff
or ecx, 0xc7789bd4
xor ecx, 0xffffffff
or eax, ecx
xor eax, 0xffffffff
or eax, 0xd17a12c9
sub eax, 0x28b84a7c
mov dword [rsp + 0x38], eax
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x30], rcx
mov rcx, qword [rax]
call fcn.1401d9b65
mov rcx, qword [rsp + 0x30]
mov eax, dword [rsp + 0x38]
cmp byte [rcx + 0x60], 0
sete cl
mov byte [rsp + 0x3f], cl
cmp eax, 0xac93533a
jb 0x14004ba38
mov al, byte [rsp + 0x3f]
test al, 1
jne 0x14004b98a
jmp 0x14004ba33
mov eax, dword [0x140274608]
mov edx, dword [0x14027460c]
mov ecx, eax
xor ecx, edx
mov r8d, 0x9bfbc86d
xor r8d, 0x64043792
xor edx, r8d
and eax, edx
shl eax, 1
sub eax, ecx
sub eax, 0x97ca1f
mov ecx, 0x4ef0c3dd
xor ecx, 0x38ab7519
sub eax, ecx
mov ecx, 0x1b5337e3
xor ecx, 0x1bc4fdfc
add eax, ecx
xor eax, 0x99f49e1f
mov ecx, 0xf8f2ff8d
xor ecx, 0xa7a1d53f
imul eax, ecx
mov ecx, 0xbe91103d
xor ecx, 0xcf418966
cmp eax, ecx
jae 0x14004ba41
mov rcx, qword [rsp + 0x40]
mov eax, dword [0x140274610]
or eax, dword [0x140274614]
xor eax, 0xfbfcff0e
add eax, 0x15ed75bc
and eax, 0x9ae44a99
mov dword [rsp + 0x2c], eax
call fcn.1401d9cf9
mov eax, dword [rsp + 0x2c]
cmp eax, 0xc054f80a
ja 0x14004b9f6
jmp 0x14004ba33
add rsp, 0x48
ret
jnp 0x14004ba5d
mov dword [rdi - 0x17], 0xfffffe7e
movabs byte [0xfffffface9066317], al
nop word [rax + rax]
push rax
Function at 0x14004ba50
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], rcx
mov eax, dword [0x140274618]
xor eax, 0x6a2ea521
mov edx, dword [0x14027461c]
mov r8d, eax
and r8d, edx
mov ecx, 0x12ca8958
xor ecx, 0x12ca895a
imul ecx, r8d
add eax, edx
sub eax, ecx
mov ecx, eax
xor ecx, 0xffffffff
mov edx, 0x9936a756
xor edx, 0x96372259
and ecx, edx
mov edx, 0xffffffff
xor edx, 0xf01850f
and eax, edx
sub eax, ecx
imul eax, eax, 0x91144d71
and eax, 0x4a37fd99
mov ecx, 0xad080ae4
xor ecx, 0xec06a67f
cmp eax, ecx
je 0x14004bce0
mov rcx, qword [rsp + 0x50]
mov eax, dword [0x140274620]
mov edx, 0xb5700ed3
xor edx, 0x6c356217
xor eax, edx
and eax, dword [0x140274624]
or eax, eax
mov edx, 0xe122d07a
xor edx, 0x1edd2f85
xor eax, edx
mov edx, 0xffffffff
xor edx, 0x53d9b462
mov r8d, 0xffffffff
xor r8d, 0x53d9b462
and edx, r8d
xor eax, 0xffffffff
xor edx, 0xffffffff
and eax, edx
mov edx, 0x97872b30
xor edx, 0x2fc99a0a
sub eax, edx
mov r8d, 0x89fb91f0
xor r8d, 0x58f12a7d
mov edx, eax
xor edx, r8d
mov r8d, 0xe67ac387
xor r8d, 0x3770780a
mov r9d, 0x11a5c6e1
xor r9d, 0xee5a391e
xor r8d, r9d
and eax, r8d
shl eax, 1
sub eax, edx
mov r8, qword [rcx]
mov rcx, r8
add rcx, 0xffffffffffffffff
mov qword [rsp + 0x38], rcx
mov rdx, rcx
xor rdx, r8
cmp rdx, 0
setl dl
cmp rcx, 0xffffffffffffffff
setg cl
and cl, dl
mov byte [rsp + 0x47], cl
cmp eax, 0x4902f73f
jbe 0x14004bac7
mov al, byte [rsp + 0x47]
test al, 1
jne 0x14004bbbd
jmp 0x14004bba0
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x50]
add rcx, 8
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rax
jmp 0x14004bbc7
call fcn.14000f24b
jmp 0x14004bcdb
mov rcx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
cmp rax, rcx
jl 0x14004bcce
mov rax, qword [rsp + 0x20]
cmp rax, 0
jl 0x14004bc01
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
cmp rax, qword [rcx]
jl 0x14004bc0e
mov rcx, rdx
call fcn.1400292ad
jmp 0x14004bcdb
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx]
add rcx, 8
shl rax, 3
add rcx, rax
call fcn.14004b860
mov rcx, qword [rsp + 0x20]
xor eax, eax
mov edx, eax
sub rdx, rcx
movabs rax, 0xefe085792537c7c4
movabs r8, 0xefe085792537c7c4
xor rax, r8
movabs r8, 0x7df6b5cffd5e421a
movabs r9, 0x82094a3002a1bde5
xor r8, r9
sub rax, r8
add rdx, rax
movabs rax, 0xe94cfb077c163693
movabs r8, 0xe94cfb077c163693
xor rax, r8
sub rax, rdx
mov rdx, rax
xor rdx, rcx
movabs r8, 0xc52379444a91dce9
movabs r9, 0xc52379444a91dce9
xor r8, r9
cmp rdx, r8
setl dl
cmp rcx, 0
setne cl
and cl, dl
test cl, 1
mov qword [rsp + 0x30], rax
jne 0x14004bcc4
jmp 0x14004bbc7
call fcn.14000f24b
jmp 0x14004bcdb
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
mov qword [rax], rcx
add rsp, 0x58
ret
loopne 0x14004bd54
movabs al, byte [0x1f0ffffffddee93a]
add byte [rax], 0
add byte [rax], al
add byte [rax - 0x75], cl
and al, 0x58
Function at 0x14004cb5e
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
call fcn.1401eda9d
mov rax, qword [rsp + 0x30]
mov al, byte [rax + 0x60]
mov cl, 0x17
Function at 0x14004d930
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rcx
mov eax, dword [0x1402746e8]
mov edx, dword [0x1402746ec]
mov ecx, eax
add ecx, 1
xor eax, 0xffffffff
or eax, edx
add eax, ecx
sub eax, 0xbfb1533b
mov ecx, 0x211b4175
xor ecx, 0x40a11c43
sub eax, ecx
mov ecx, 0x20e437df
xor edx, edx
div ecx
cmp eax, 0xc026ed9c
ja 0x14004da19
mov eax, dword [0x1402746f0]
mov edx, dword [0x1402746f4]
mov r8d, 0x2ae489d3
xor r8d, 0x2ae489d2
mov ecx, eax
add ecx, r8d
xor eax, 0xffffffff
or eax, edx
add eax, ecx
sub eax, 0x58cc19a5
mov ecx, 0xca2472ac
xor ecx, 0x3dca277e
sub eax, ecx
imul eax, eax, 0xd66d9532
mov dword [rsp + 0x28], eax
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rax]
call fcn.1401ecb10
mov rcx, qword [rsp + 0x20]
mov eax, dword [rsp + 0x28]
cmp byte [rcx + 0x60], 0
sete cl
mov byte [rsp + 0x2f], cl
cmp eax, 0x9d7e31fa
ja 0x14004da19
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x14004da09
jmp 0x14004da13
mov rcx, qword [rsp + 0x30]
call fcn.1401ecece
nop
add rsp, 0x38
ret
sti
invalid
Function at 0x14004fa70
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rcx
mov eax, dword [0x1402747f8]
xor eax, 0x7ec18b89
and eax, dword [0x1402747fc]
mov r8d, 0xffffffff
xor r8d, 0x53d0b425
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0x53d0b425
or eax, 0x53d0b425
imul eax, edx
add eax, ecx
mov edx, eax
and edx, 0x74c8a3e8
mov ecx, 0x35689549
xor ecx, 0x3568954b
imul ecx, edx
add eax, 0x74c8a3e8
sub eax, ecx
add eax, 0xf1a0624a
cmp eax, 0xbafe6e34
jae 0x14004fc81
mov ecx, dword [0x140274800]
mov edx, dword [0x140274804]
xor edx, 0xc65e6059
mov eax, ecx
and eax, edx
mov r8d, 0xb15b3f2
xor r8d, 0xf4ea4c0d
xor eax, r8d
and ecx, edx
xor ecx, 0xffffffff
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
imul eax, eax, 0xc8ffd626
mov ecx, 0x4d65b4d4
xor edx, edx
div ecx
add eax, 0x65a43213
mov ecx, 0x900e049e
xor ecx, 0xbb33b9ae
sub eax, ecx
sub eax, 0x65a43213
mov dword [rsp + 0x28], eax
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.140250f8e
mov rcx, qword [rsp + 0x20]
mov eax, dword [rsp + 0x28]
cmp byte [rcx + 0x60], 0
sete cl
mov byte [rsp + 0x2f], cl
cmp eax, 0xf1304af
je 0x14004fc81
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x14004fb8e
jmp 0x14004fb98
mov rcx, qword [rsp + 0x30]
call fcn.140250fb3
mov ecx, dword [0x140274808]
mov r8d, dword [0x14027480c]
mov eax, ecx
xor eax, 0xffffffff
mov edx, r8d
and edx, eax
mov r9d, r8d
xor r9d, 0xffffffff
mov eax, ecx
and eax, r9d
imul eax, edx
mov edx, ecx
and edx, r8d
or ecx, r8d
imul ecx, edx
add ecx, eax
mov edx, 0x442f1ac8
xor edx, 0x2d26724f
mov eax, ecx
or eax, edx
mov edx, 0x1935dfa7
xor edx, 0xe6ca2058
xor eax, edx
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x69096887
and ecx, edx
or eax, ecx
xor eax, 0xffffffff
mov ecx, 0x21490cd4
xor ecx, 0xb10f1cd5
xor edx, edx
div ecx
and eax, 0xbd1c4bb
cmp eax, 0x81f0b82a
je 0x14004fc8a
mov eax, dword [0x140274810]
add eax, dword [0x140274814]
mov ecx, 0x110a359d
xor edx, edx
div ecx
mov ecx, 0x71f1e236
xor ecx, 0xc4caa07f
sub eax, ecx
add eax, 0x7d241806
mov ecx, 0x34777e8c
xor ecx, 0x814c3cc5
add eax, ecx
and eax, eax
xor eax, 0xffffffff
mov ecx, 0xa70c55d0
and ecx, 0xa70c55d0
xor ecx, 0xffffffff
and eax, ecx
mov ecx, 0xd33c11af
xor ecx, 0x2cc3ee50
xor eax, ecx
cmp eax, 0xafa8e488
je 0x14004fc1b
add rsp, 0x38
ret
jmp 0x14004fc62
in al, 0x29
or ebx, dword [rsi - 0x7717]
jmp qword [rsi + 0x66]
Function at 0x1400505c5
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
call fcn.14025104b
mov rax, qword [rsp + 0x30]
mov al, byte [rax + 0x60]
mov cl, 0x70
xor cl, 0x70
cmp al, cl
jne 0x140050608
mov rcx, qword [rsp + 0x28]
call fcn.140251071
nop
add rsp, 0x38
ret
Function at 0x1400517a3
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
call fcn.14025112b
mov rax, qword [rsp + 0x30]
cmp byte [rax + 0x60], 0
jne 0x1400517e0
mov rcx, qword [rsp + 0x28]
call fcn.1402511d7
nop
add rsp, 0x38
ret
Function at 0x140053dc0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 0x10], rcx
mov eax, 0x10
call fcn.140271bb0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 8], rax
cmp qword [rcx], 0
jle 0x140053e50
mov rax, qword [rbp - 0x10]
add rax, 8
mov qword [rbp - 0x20], rax
xor eax, eax
mov qword [rbp - 0x18], rax
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x20]
mov qword [rbp - 0x28], rdx
mov rax, qword [rax]
add rax, 8
shl rdx, 4
add rax, rdx
mov rdx, qword [rax]
mov qword [rcx], rdx
mov rax, qword [rax + 8]
mov qword [rcx + 8], rax
sub rsp, 0x20
call fcn.14004f630
mov rax, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x10]
add rsp, 0x20
add rax, 1
cmp rax, qword [rcx]
mov qword [rbp - 0x18], rax
jl 0x140053dfe
mov r11d, dword [0x1402749f8]
mov ecx, dword [0x1402749fc]
mov eax, r11d
and eax, ecx
shl eax, 1
add r11d, ecx
sub r11d, eax
mov eax, r11d
xor eax, 0xffffffff
mov r8d, 0xffffffff
xor r8d, 0x5a17ddb2
mov edx, 0xffffffff
xor edx, 0xaa973f3a
mov ecx, eax
and ecx, 0xaa973f3a
and r11d, edx
mov r9d, r8d
and r9d, 0xaa973f3a
mov r10d, 0x25acec98
xor r10d, 0x7fbb312a
and r10d, edx
or ecx, r11d
or r9d, r10d
xor ecx, r9d
or eax, r8d
xor eax, 0xffffffff
or edx, 0xaa973f3a
and eax, edx
or ecx, eax
mov eax, ecx
xor eax, 0xffffffff
and eax, 0x39b0024c
mov edx, 0xffffffff
xor edx, 0x39b0024c
and ecx, edx
or eax, ecx
and eax, 0x7cf60585
cmp eax, 0x8de2dbc8
je 0x140053fb7
mov rdx, qword [rbp - 0x10]
mov eax, dword [0x140274a00]
mov r9d, dword [0x140274a04]
mov r10d, r9d
xor r10d, 0xffffffff
mov r8d, eax
and r8d, r10d
mov ecx, eax
or ecx, r10d
xor ecx, 0xffffffff
imul ecx, r8d
mov r8d, eax
and r8d, r9d
or eax, r9d
imul eax, r8d
add eax, ecx
mov ecx, 0x6619273
xor ecx, 0xc3ce3a7a
imul eax, ecx
mov ecx, 0x142adc6f
xor ecx, 0x55407cc3
and eax, ecx
mov ecx, 0x6144a110
xor ecx, 0x26c2a8fa
and eax, ecx
mov ecx, 0xb8f6d812
xor ecx, 0xfc1fcf33
mov rdx, qword [rdx + 8]
mov qword [rbp - 0x38], rdx
cmp rdx, 0
sete dl
mov byte [rbp - 0x29], dl
cmp eax, ecx
jae 0x140053ef0
mov al, byte [rbp - 0x29]
test al, 1
jne 0x140053fb2
jmp 0x140053f86
mov ecx, dword [0x1402980b0]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rbp - 0x38]
add rsp, 0x20
mov rcx, rax
add rcx, 0x68
sub rsp, 0x20
call fcn.1400190f0
add rsp, 0x20
mov rsp, rbp
pop rbp
ret
xchg byte [rsi], ah
cmp al, 0xf6
jmp 0x140053ef0
Function at 0x140053fc0
Capabilities:
Encode data using xor
Get thread local storage value

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x40], rcx
cmp qword [rcx], 0
jle 0x140054067
mov rax, qword [rsp + 0x40]
add rax, 8
mov qword [rsp + 0x30], rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov rax, qword [rax]
add rax, 8
imul rcx, rcx, 0x18
add rax, rcx
add rax, 8
mov rcx, qword [rax]
mov qword [rsp + 0x48], rcx
mov rax, qword [rax + 8]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x48]
call fcn.14004f630
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
movabs rdx, 0x2863d3b3950bc360
add rax, rdx
add rax, 1
movabs rdx, 0x72226f4bc42c6834
movabs r8, 0x5a41bcf85127ab54
xor rdx, r8
sub rax, rdx
cmp rax, qword [rcx]
mov qword [rsp + 0x38], rax
jl 0x140053fe8
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], rax
cmp rax, 0
je 0x14005409c
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0x20]
mov rcx, rax
add rcx, 0x68
call fcn.1400190f0
nop
add rsp, 0x58
ret
Function at 0x1400540b0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
call fcn.1402247e0
mov rax, qword [rsp + 0x30]
cmp byte [rax + 0x60], 0
jne 0x140054287
mov eax, dword [0x140274a08]
mov ecx, 0x299a832
xor ecx, 0xf3c3d869
xor eax, ecx
xor edx, edx
div dword [0x140274a0c]
mov ecx, eax
mov eax, ecx
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x1041e08c
or eax, edx
mov edx, 0x83843dda
xor edx, 0x93c5dd56
and ecx, edx
mov edx, 0x4de64d48
xor edx, 0xb219b2b7
xor ecx, edx
and eax, ecx
xor eax, 0xffffffff
mov r8d, 0xffffffff
xor r8d, 0xcfbae6a5
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
mov r8d, 0x9a1d083e
xor r8d, 0x65e2f7c1
xor ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0xcfbae6a5
or eax, 0xcfbae6a5
imul eax, edx
add eax, ecx
mov edx, eax
xor edx, 0xffffffff
and edx, 0xe51bb74
mov r8d, 0xd7107f3e
xor r8d, 0xd941c44a
mov ecx, 0xf5cd9ea8
xor ecx, 0xa326157
xor r8d, ecx
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov r8d, 0x6c12938
xor r8d, 0x890924c
mov edx, eax
and edx, r8d
or eax, 0xe51bb74
imul eax, edx
add eax, ecx
cmp eax, 0xe4987688
ja 0x14005428c
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x140274a10]
imul eax, dword [0x140274a14]
mov edx, 0x12382c49
xor edx, 0x12382c49
mov r8d, 0x578cc256
xor r8d, 0xfd62829d
sub edx, r8d
sub eax, edx
mov r9d, 0x350e3235
xor r9d, 0xbf098cdc
mov edx, 0xf7e03b84
xor edx, 0x81fc47b
xor r9d, edx
mov r8d, eax
and r8d, r9d
mov edx, eax
or edx, r9d
xor edx, 0xffffffff
imul edx, r8d
mov r8d, eax
and r8d, 0x8a07bee9
or eax, 0x8a07bee9
imul eax, r8d
add eax, edx
mov r9d, 0xffffffff
xor r9d, 0xe853993b
mov r8d, eax
and r8d, r9d
mov edx, eax
or edx, r9d
xor edx, 0xffffffff
imul edx, r8d
mov r8d, eax
and r8d, 0xe853993b
or eax, 0xe853993b
imul eax, r8d
add eax, edx
mov dword [rsp + 0x24], eax
call fcn.140224b3a
mov eax, dword [rsp + 0x24]
cmp eax, 0x145cc40f
je 0x14005428c
jmp 0x140054287
add rsp, 0x38
ret
mov bh, 0x67
xor al, 0x4c
jmp 0x1400541c5
Function at 0x1400555b0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rcx
mov eax, dword [0x140274ac8]
mov ecx, dword [0x140274acc]
mov edx, 0xd5b403c0
xor edx, 0xd894dad2
xor ecx, edx
add eax, ecx
mov ecx, 0x3e277c33
xor ecx, 0x7937540d
imul eax, ecx
and eax, eax
xor eax, 0xffffffff
mov ecx, 0x30e18dae
xor ecx, 0x413024fe
mov edx, 0x2baed97b
xor edx, 0x5a7f702b
and ecx, edx
xor ecx, 0xffffffff
xor eax, 0xffffffff
mov edx, 0x2ec85703
xor edx, 0xd137a8fc
xor ecx, edx
or eax, ecx
add eax, 0x8b8050ad
cmp eax, 0x9f0c0243
je 0x140055831
mov eax, dword [0x140274ad0]
mov ecx, 0x9ea794eb
xor ecx, 0x345340a1
xor eax, ecx
mov edx, dword [0x140274ad4]
mov r8d, eax
xor r8d, edx
xor r8d, 0xffffffff
mov ecx, edx
and ecx, r8d
shl ecx, 1
sub ecx, edx
sub eax, ecx
or eax, 0x8571d35
mov edx, 0xf8009c1f
xor edx, 0x6a9c0856
mov ecx, eax
and ecx, edx
shl ecx, 1
add eax, 0x929c9449
sub eax, ecx
mov ecx, 0x894b72bb
xor ecx, 0xfc2b7a37
xor eax, ecx
mov dword [rsp + 0x38], eax
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x40]
mov eax, dword [rsp + 0x38]
cmp rcx, 0
sete cl
mov byte [rsp + 0x3f], cl
cmp eax, 0x74de60df
je 0x140055831
mov al, byte [rsp + 0x3f]
test al, 1
jne 0x14005582b
jmp 0x1400556be
mov rax, qword [rsp + 0x40]
movabs rcx, 0x40c38c22231518ef
movabs rdx, 0x94840a125c15c12e
xor rcx, rdx
sub rax, rcx
add rax, 0xfffffffffffffff0
movabs rcx, 0x618accfd98d5f9b4
movabs rdx, 0xb5cd4acde7d52075
xor rcx, rdx
add rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
cmp rax, 0x10
jb 0x14005580a
mov rdx, qword [rsp + 0x30]
mov rcx, 0xffffffffffffffff
xor rcx, 0xfffffffffffffff0
xor eax, eax
sub rax, 1
sub rcx, rax
mov rax, rdx
sub rax, rcx
mov qword [rsp + 0x20], rax
mov rcx, rax
and rcx, rcx
xor rcx, 0xffffffffffffffff
and rcx, rdx
xor rcx, 0xffffffffffffffff
movabs r9, 0x5c59feb5f2347a53
movabs r8, 0xa3a6014a0dcb85ac
xor r9, r8
mov r8, rdx
xor r8, r9
xor rdx, 0xffffffffffffffff
or r8, rdx
mov rdx, rax
and rdx, r8
movabs r8, 0x1004aab61d686a02
movabs r9, 0xeffb5549e29795fd
xor r8, r9
xor rdx, r8
xor rcx, 0xffffffffffffffff
movabs r8, 0x35da21a5b4451b62
movabs r9, 0xca25de5a4bbae49d
xor r8, r9
xor rdx, r8
or rcx, rdx
cmp rcx, 0
setl cl
movabs rdx, 0x127ea891f96272d4
movabs r8, 0xed81576e069d8d2b
xor rdx, r8
cmp rax, rdx
setg al
and al, cl
test al, 1
jne 0x1400557df
jmp 0x1400557e9
call fcn.14000f24b
jmp 0x14005582b
mov rdx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
mov qword [rdx], rcx
mov r8, qword [rax]
xor ecx, ecx
call fcn.1400200e0
jmp 0x14005582b
mov rax, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x28]
mov r8, qword [rax]
mov ecx, 1
call fcn.1400200e0
mov rcx, qword [rsp + 0x40]
call fcn.140020296
nop
add rsp, 0x48
ret
add dword [rdi - 0x15162647], esp
std
invalid