joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140074b50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rsi, rdx
cmp dword [rcx], 2
jne 0x140074be6
movdqu xmm0, xmmword [rcx + 8]
pshufd xmm1, xmm0, 0x44
pxor xmm1, xmmword [str.uespemosarenegylmodnarodsetybdet________________]
movdqa xmmword [rsp + 0x30], xmm1
pshufd xmm1, xmm0, 0xee
pxor xmm1, xmmword [0x140139920]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmmword [rsp + 0x50], xmm0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov rdi, qword [rsi]
xor eax, eax
test rdi, rdi
setne al
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.140041cf0
test rdi, rdi
je 0x140074c75
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x30]
jmp 0x140074c8e
mov rdx, qword [rsi]
xor ecx, ecx
test rdx, rdx
setne cl
movabs rax, 0xcbf29ce484222325
xor rax, rcx
movabs rcx, 0x1efac7090aef4a21
imul rax, rcx
test rdx, rdx
je 0x140074d86
mov r9, qword [rsi + 0x10]
test r9, r9
je 0x140074e08
mov rcx, qword [rsi + 8]
movabs rdx, 0x100000001b3
mov r10, r9
and r10, 7
je 0x140074d93
mov r11, rax
mov r8, rcx
nop word cs:[rax + rax]
movzx eax, byte [r8]
inc r8
xor rax, r11
imul rax, rdx
mov r11, rax
dec r10
jne 0x140074c50
cmp r9, 8
jae 0x140074d9c
jmp 0x140074e08
movzx eax, byte [rsi + 8]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.140041cf0
mov rax, qword [rsp + 0x40]
mov r9, qword [rsp + 0x60]
shl r9, 0x38
or r9, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x48]
xor rcx, r9
mov r8, qword [rsp + 0x30]
add r8, rax
mov rdx, qword [rsp + 0x38]
add rdx, rcx
rol rax, 0xd
xor rax, r8
rol rcx, 0x10
rol r8, 0x20
xor rcx, rdx
add rdx, rax
rol rax, 0x11
add r8, rcx
xor rax, rdx
rol rcx, 0x15
xor rcx, r8
rol rdx, 0x20
xor r8, r9
xor rdx, 0xff
add r8, rax
rol rax, 0xd
add rdx, rcx
xor rax, r8
rol rcx, 0x10
xor rcx, rdx
rol r8, 0x20
add rdx, rax
add r8, rcx
rol rax, 0x11
xor rax, rdx
rol rcx, 0x15
rol rdx, 0x20
xor rcx, r8
add r8, rax
rol rax, 0xd
add rdx, rcx
xor rax, r8
rol rcx, 0x10
xor rcx, rdx
rol r8, 0x20
add rdx, rax
add r8, rcx
rol rax, 0x11
xor rax, rdx
rol rcx, 0x15
rol rdx, 0x20
xor rcx, r8
add r8, rax
rol rax, 0xd
add rdx, rcx
xor rax, r8
shl rcx, 0x10
xor rcx, rdx
add rdx, rax
shr rax, 0x2f
shr rcx, 0x2b
xor rcx, rax
mov rax, rdx
shr rax, 0x20
xor rax, rdx
xor rax, rcx
jmp 0x140074e08
movzx edx, byte [rsi + 8]
xor rax, rdx
imul rax, rcx
jmp 0x140074e08
mov r8, rcx
cmp r9, 8
jb 0x140074e08
add rcx, r9
nop
movzx r9d, byte [r8]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 1]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 2]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 3]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 4]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 5]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 6]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 7]
add r8, 8
xor rax, r9
imul rax, rdx
cmp r8, rcx
jne 0x140074da0
and eax, 0x7fff
add rsp, 0x78
pop rdi
pop rsi
ret
Function at 0x1400cddc0
Capabilities:
Get remote cert context via schannel

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, rcx
lea rcx, [rdx + 0xf0]
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x28]
mov edx, 0x53
call sub.secur32.dll_QueryContextAttributesW
test eax, eax
je 0x1400cde27
movabs rdi, 0x8000000000000000
mov rdx, rax
shl rdx, 0x20
or rdx, 2
mov qword [rsp + 0x40], 1
mov qword [rsp + 0x48], rdx
cmp eax, 0x8009030e
jne 0x1400cde53
lea rcx, [rsp + 0x48]
call fcn.14003ea60
jmp 0x1400cde89
mov rbx, qword [rsp + 0x28]
mov r15, qword [rbx + 8]
mov edi, dword [rbx + 0x10]
test rdi, rdi
je 0x1400cde6d
movzx eax, byte [0x1401ba120]
xor ecx, ecx
mov rdx, rdi
call fcn.14010f230
test rax, rax
je 0x1400cdea0
mov r14, rax
jmp 0x1400cde73
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], 2
call fcn.14003ea60
jmp 0x1400cde89
mov r14d, 1
mov rcx, r14
mov rdx, r15
mov r8, rdi
call sub.msvcrt.dll_memcpy
mov rcx, rbx
call sub.crypt32.dll_CertFreeCertificateContext
mov qword [rsi], rdi
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, 1
mov rdx, rdi
call fcn.140012d00
ud2
Function at 0x1400cfc50
Capabilities:
Get remote cert context via schannel

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, rcx
lea rcx, [rdx + 0x1f0]
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x28]
mov edx, 0x53
call sub.secur32.dll_QueryContextAttributesW
test eax, eax
je 0x1400cfcb7
movabs rdi, 0x8000000000000000
mov rdx, rax
shl rdx, 0x20
or rdx, 2
mov qword [rsp + 0x40], 1
mov qword [rsp + 0x48], rdx
cmp eax, 0x8009030e
jne 0x1400cfce3
lea rcx, [rsp + 0x48]
call fcn.14003ea60
jmp 0x1400cfd19
mov rbx, qword [rsp + 0x28]
mov r15, qword [rbx + 8]
mov edi, dword [rbx + 0x10]
test rdi, rdi
je 0x1400cfcfd
movzx eax, byte [0x1401ba120]
xor ecx, ecx
mov rdx, rdi
call fcn.14010f230
test rax, rax
je 0x1400cfd30
mov r14, rax
jmp 0x1400cfd03
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], 2
call fcn.14003ea60
jmp 0x1400cfd19
mov r14d, 1
mov rcx, r14
mov rdx, r15
mov r8, rdi
call sub.msvcrt.dll_memcpy
mov rcx, rbx
call sub.crypt32.dll_CertFreeCertificateContext
mov qword [rsi], rdi
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, 1
mov rdx, rdi
call fcn.140012d00
ud2
Function at 0x1400e2840
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae 0x1400e2865
cmp rax, rcx
je 0x1400e286b
cmp rdx, 4
jae 0x1400e286f
xor eax, eax
xor r8d, r8d
jmp 0x1400e2900
pop rbp
jmp fcn.1400179b0
xor eax, eax
pop rbp
ret
mov r8d, edx
and r8d, 0x1c
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x14013a3d0]
movdqa xmm3, xmmword [0x14013a3e0]
pxor xmm1, xmm1
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x1400e2890
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x1400e2917
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x1400e2900
pop rbp
ret
Function at 0x1400e3a40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov r10, qword [rcx]
test r10, r10
je 0x1400e3ac1
mov r11, qword [rcx + 8]
mov r8, qword [rcx + 0x10]
cmp r8, r11
jae 0x1400e3ac1
movzx eax, byte [r10 + r8]
cmp eax, 0x49
mov rbx, rcx
je 0x1400e3ada
cmp eax, 0x42
jne 0x1400e3ac1
lea rsi, [r8 + 1]
mov qword [rcx + 0x10], rsi
cmp rsi, r11
jae 0x1400e3b8c
cmp byte [r10 + rsi], 0x5f
jne 0x1400e3b8c
lea rax, [r8 + 2]
mov qword [rcx + 0x10], rax
xor eax, eax
cmp rax, r8
jae 0x1400e3c0b
mov edx, dword [rcx + 0x18]
inc edx
cmp edx, 0x1f4
jbe 0x1400e3c68
mov sil, 1
xor r9d, r9d
jmp 0x1400e3c10
xor edx, edx
call fcn.1400df190
mov esi, eax
add sil, sil
mov eax, esi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
inc r8
mov qword [rcx + 0x10], r8
xor edx, edx
call fcn.1400df190
test al, al
jne 0x1400e3c4e
mov rdx, rbx
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x1400e3b19
lea rdx, [0x14016c83b]
mov r8d, 1
call fcn.140017e90
mov rdx, rbx
test al, al
jne 0x1400e3c4e
mov rax, qword [rdx]
mov sil, 1
test rax, rax
je 0x1400e3acd
xor r14d, r14d
lea rdi, [0x140172728]
nop
mov rcx, qword [rdx + 0x10]
cmp rcx, qword [rdx + 8]
jae 0x1400e3b44
cmp byte [rax + rcx], 0x45
je 0x1400e3ca1
sub r14, 1
jb 0x1400e3b6c
mov rcx, qword [rdx + 0x20]
test rcx, rcx
je 0x1400e3b6c
mov r8d, 2
mov rdx, rdi
call fcn.140017e90
mov rdx, rbx
test al, al
jne 0x1400e3c4e
mov rcx, rdx
call fcn.1400e09f0
test al, al
jne 0x1400e3c4e
mov rdx, rbx
mov rax, qword [rbx]
test rax, rax
jne 0x1400e3b30
jmp 0x1400e3acd
xor eax, eax
mov edi, 0x3e
nop word cs:[rax + rax]
mov r9b, 1
cmp rsi, r11
jae 0x1400e3c0e
movzx edx, byte [r10 + rsi]
cmp dl, 0x5f
je 0x1400e3bf2
lea r14d, [rdx - 0x30]
cmp r14b, 0xa
jb 0x1400e3bdb
lea r14d, [rdx - 0x61]
cmp r14b, 0x1a
jae 0x1400e3bcb
add dl, 0xa9
jmp 0x1400e3bd8
lea r14d, [rdx - 0x41]
cmp r14b, 0x1a
jae 0x1400e3c0e
add dl, 0xe3
mov r14d, edx
inc rsi
mov qword [rcx + 0x10], rsi
mul rdi
jo 0x1400e3c0e
movzx edx, r14b
add rax, rdx
jae 0x1400e3ba0
jmp 0x1400e3c0e
inc rsi
mov qword [rcx + 0x10], rsi
cmp rax, 0xffffffffffffffff
je 0x1400e3c0e
inc rax
cmp rax, r8
jb 0x1400e3aa5
mov r9b, 1
xor esi, esi
mov rax, qword [rcx + 0x20]
test rax, rax
je 0x1400e3c56
mov ecx, r9d
xor cl, 1
movzx ecx, cl
lea r8, [rcx + rcx*8]
add r8, 0x10
lea rcx, str.invalid_syntaxrecursion_limit_reached_for___::closureshim_as__mut_const___dyn___unsafe_extern__
lea rdx, [0x14016cb70]
test r9b, r9b
cmovne rdx, rcx
mov rcx, rax
call fcn.140017e90
mov rcx, rbx
test al, al
je 0x1400e3c56
mov sil, 2
jmp 0x1400e3acd
mov qword [rcx], 0
mov byte [rcx + 8], sil
xor esi, esi
jmp 0x1400e3acd
cmp qword [rcx + 0x20], 0
je 0x1400e3c61
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
movaps xmmword [rbp - 0x10], xmm1
movaps xmmword [rbp - 0x20], xmm0
mov qword [rcx + 0x10], rax
mov dword [rcx + 0x18], edx
mov rsi, rcx
call fcn.1400e3a40
movaps xmm0, xmmword [rbp - 0x20]
movaps xmm1, xmmword [rbp - 0x10]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
jmp 0x1400e3acf
inc rcx
mov qword [rdx + 0x10], rcx
jmp 0x1400e3acd
Function at 0x1400e5c90
Capabilities:
Get client handle via schannel
Get outbound credentials handle via credssp

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xd8
movabs rax, 0x8000000000000000
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0xc8], xmm0
movups xmmword [rsp + 0xb8], xmm0
movups xmmword [rsp + 0xa8], xmm0
movups xmmword [rsp + 0x98], xmm0
mov dword [rsp + 0x88], 4
mov dword [rsp + 0xd0], 0x400010
cmp qword [rcx + 0x18], rax
jne 0x1400e5d43
cmp qword [rcx + 0x30], rax
jne 0x1400e5d5f
mov r14, qword [rcx + 0x10]
lea rsi, [r14*8]
test r14, r14
je 0x1400e5db3
add rax, 0xfffffffffffffff8
cmp rsi, rax
ja 0x1400e5e99
mov rbx, qword [rcx + 8]
movzx eax, byte [0x1401ba120]
xor ecx, ecx
mov rdx, rsi
call fcn.14010f230
test rax, rax
je 0x1400e5e9e
mov rdi, rax
mov rcx, rax
mov rdx, rbx
mov r8, rsi
call sub.msvcrt.dll_memcpy
jmp 0x1400e5dbb
mov edx, dword [rcx + 0x28]
mov dword [rsp + 0xb0], edx
mov rdx, qword [rcx + 0x20]
mov qword [rsp + 0xb8], rdx
cmp qword [rcx + 0x30], rax
je 0x1400e5cf0
mov rdx, qword [rcx + 0x40]
test rdx, rdx
je 0x1400e5d93
mov r9, qword [rcx + 0x38]
xor r8d, r8d
lea r10, [0x14019abc0]
xor r11d, r11d
nop dword [rax]
movzx esi, byte [r9 + r11]
or r8d, dword [r10 + rsi*4]
inc r11
cmp rdx, r11
jne 0x1400e5d80
jmp 0x1400e5d96
xor r8d, r8d
mov dword [rsp + 0xc0], r8d
mov r14, qword [rcx + 0x10]
lea rsi, [r14*8]
test r14, r14
jne 0x1400e5d05
xor r14d, r14d
mov edi, 8
mov dword [rsp + 0x8c], r14d
mov qword [rsp + 0x90], rdi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
lea rdx, [0x14016cf0b]
xor ecx, ecx
mov r8d, 2
xor r9d, r9d
call sub.secur32.dll_AcquireCredentialsHandleA
test eax, eax
je 0x1400e5e47
mov ebx, eax
shl rbx, 0x20
or rbx, 2
mov r14d, 1
test rsi, rsi
je 0x1400e5e34
mov rcx, qword [0x1401ba0e0]
xor edx, edx
mov r8, rdi
call fcn.1401336c4
mov rax, r14
mov rdx, rbx
add rsp, 0xd8
pop rbx
pop rdi
pop rsi
pop r14
ret
mov qword [rsp + 0x68], 1
mov qword [rsp + 0x70], 1
movaps xmm0, xmmword [rsp + 0x50]
movups xmmword [rsp + 0x78], xmm0
movzx eax, byte [0x1401ba120]
mov edx, 0x20
xor ecx, ecx
call fcn.14010f230
test rax, rax
je 0x1400e5eab
mov rbx, rax
movups xmm0, xmmword [rsp + 0x68]
movups xmm1, xmmword [rsp + 0x78]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
xor r14d, r14d
test rsi, rsi
jne 0x1400e5e23
jmp 0x1400e5e34
call fcn.140012d20
mov ecx, 8
mov rdx, rsi
call fcn.140012d00
lea r14, [rsp + 0x78]
mov ecx, 8
mov edx, 0x20
call fcn.140012d60
ud2
Function at 0x1400e9450
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov rdi, rcx
mov esi, dword [0x140136130]
test esi, esi
je 0x1400e94f9
dec esi
mov ecx, esi
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x1400e94f0
je 0x1400e9499
test rdi, rdi
je 0x1400e949d
mov rbx, qword [rdi]
mov qword [rdi], 0
test rbx, rbx
je 0x1400e949f
mov rbx, qword [rdi + 8]
jmp 0x1400e949f
xor eax, eax
jmp 0x1400e94f0
xor ebx, ebx
movzx eax, byte [0x1401ba120]
mov edx, 0x10
xor ecx, ecx
call fcn.14010f230
test rax, rax
je 0x1400e951a
mov qword [rax], rbx
mov dword [rax + 8], esi
mov ecx, esi
mov rbx, rax
call sub.kernel32.dll_TlsGetValue
mov rdi, rax
mov ecx, esi
mov rsi, rbx
mov rdx, rbx
call sub.kernel32.dll_TlsSetValue
test rdi, rdi
je 0x1400e94ed
mov rcx, qword [0x1401ba0e0]
xor edx, edx
mov r8, rdi
call fcn.1401336c4
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea rcx, [0x140136118]
call fcn.1400e96f0
mov esi, eax
mov ecx, esi
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x1400e947d
jmp 0x1400e94f0
mov ecx, 8
mov edx, 0x10
call fcn.140012d60
int3

Function at 0x1400e9530
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov esi, dword [0x140136150]
test esi, esi
je 0x1400e95d8
dec esi
mov ecx, esi
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x1400e95cf
je 0x1400e95cd
movzx eax, byte [0x1401ba120]
mov edx, 0x10
xor ecx, ecx
call fcn.14010f230
test rax, rax
je 0x1400e95f9
mov qword [rax], 0
mov dword [rax + 8], esi
mov ecx, esi
mov rbx, rax
call sub.kernel32.dll_TlsGetValue
mov rdi, rax
mov ecx, esi
mov rsi, rbx
mov rdx, rbx
call sub.kernel32.dll_TlsSetValue
test rdi, rdi
je 0x1400e95c8
mov rax, qword [rdi]
test rax, rax
je 0x1400e95b7
lock dec qword [rax]
jne 0x1400e95b7
mov rcx, qword [rdi]
call fcn.1400e7470
mov rcx, qword [0x1401ba0e0]
xor edx, edx
mov r8, rdi
call fcn.1401336c4
mov rax, rsi
jmp 0x1400e95cf
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea rcx, [0x140136138]
call fcn.1400e96f0
mov esi, eax
mov ecx, esi
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x1400e955a
jmp 0x1400e95cf
mov ecx, 8
mov edx, 0x10
call fcn.140012d60
int3
Function at 0x1400e96f0
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov rsi, rcx
cmp qword [rcx], 0
je 0x1400e9785
mov dword [rbp], 0
lea rbx, [rsi + 0x10]
mov r8, rbp
mov rcx, rbx
xor edx, edx
xor r9d, r9d
call sub.kernel32.dll_InitOnceBeginInitialize
mov dword [rbp - 4], eax
cmp eax, 1
jne 0x1400e97c4
cmp dword [rbp], 0
je 0x1400e97a8
call sub.kernel32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x1400e97e7
mov edi, eax
mov rax, qword [0x1401bd038]
mov rax, qword [0x1401ba100]
nop word cs:[rax + rax]
mov qword [rsi + 8], rax
lock cmpxchg qword [0x1401ba100], rsi
jne 0x1400e9760
mov eax, edi
inc eax
mov dword [rsi + 0x18], eax
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call sub.kernel32.dll_InitOnceComplete
jmp 0x1400e97b9
call sub.kernel32.dll_TlsAlloc
mov dword [rbp + 4], eax
cmp eax, 0xffffffff
je 0x1400e9829
mov ecx, eax
inc ecx
xor eax, eax
lock cmpxchg dword [rsi + 0x18], ecx
jne 0x1400e97ad
mov edi, dword [rbp + 4]
jmp 0x1400e97b9
mov edi, dword [rsi + 0x18]
jmp 0x1400e97b7
mov edi, eax
mov ecx, dword [rbp + 4]
call sub.kernel32.dll_TlsFree
dec edi
mov eax, edi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov qword [rbp - 0x38], 0
lea rdx, [0x14016f300]
lea r9, str.y7UEk3ALxQ4MGOVV68ZCQg94twEKUnJiuQa4NR6AzHZ3O4v
lea rcx, [rbp - 4]
lea r8, [rbp - 0x38]
call fcn.1400e9860
mov rcx, rbx
mov edx, 4
xor r8d, r8d
call sub.kernel32.dll_InitOnceComplete
lea rax, str.out_of_TLS_indexes
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
mov qword [rbp - 0x28], 8
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rdx, str.y7UEk3ALxQ4MGOVV68ZCQg94twEKUnJiuQa4NR6AzHZ3O4v
lea rcx, [rbp - 0x38]
call fcn.140017480
lea rax, str.out_of_TLS_indexes
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
mov qword [rbp - 0x28], 8
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 4]
lea rdx, [rbp - 0x38]
call fcn.1400e98a0
int3

Function at 0x1400ea220
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov esi, dword [0x1401360f0]
test esi, esi
je 0x1400ea2ae
dec esi
mov ecx, esi
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x1400ea2a5
je 0x1400ea2a3
movzx eax, byte [0x1401ba120]
mov edx, 0x18
xor ecx, ecx
call fcn.14010f230
test rax, rax
je 0x1400ea2cf
mov qword [rax], 0
mov byte [rax + 8], 0
mov dword [rax + 0x10], esi
mov ecx, esi
mov rbx, rax
call sub.kernel32.dll_TlsGetValue
mov rdi, rax
mov ecx, esi
mov rsi, rbx
mov rdx, rbx
call sub.kernel32.dll_TlsSetValue
test rdi, rdi
je 0x1400ea29e
mov rcx, qword [0x1401ba0e0]
xor edx, edx
mov r8, rdi
call fcn.1401336c4
mov rax, rsi
jmp 0x1400ea2a5
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea rcx, [0x1401360d8]
call fcn.1400e96f0
mov esi, eax
mov ecx, esi
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x1400ea246
jmp 0x1400ea2a5
mov ecx, 8
mov edx, 0x18
call fcn.140012d60
int3
Function at 0x1400ebda0
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x468
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3c8], rcx
mov qword [rbp + 0x3d0], 0
mov qword [rbp + 0x3d8], 2
fadd dword [rbx]
add byte [rax], al
add al, byte [rax]
add byte [rax], al
mov qword [rbp + 0x3e0], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3c0], rax
xor esi, esi
xor edi, edi
xor ebx, ebx
cmp r8, 0x201
jae 0x1400ebe30
jmp 0x1400ebe1f
jae 0x1400ebeeb
cmp r8, 0x201
jae 0x1400ebe30
mov r14d, 0x200
lea r15, [rbp - 0x60]
mov r12, r8
jmp 0x1400ebe87
sub r8, rbx
sub rdi, rbx
cmp r8, rdi
jbe 0x1400ebe5f
invalid
lea rcx, [rbp + 0x3d0]
mov rdx, rbx
call fcn.1400edc90
mov rsi, qword [rbp + 0x3d0]
mov rax, qword [rbp + 0x3d8]
mov qword [rbp + 0x3c0], rax
mov eax, 0xffffffff
cmp rsi, rax
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rbp + 0x3e0], rbx
mov rdi, rsi
mov r14, rbx
mov r15, qword [rbp + 0x3c0]
mov r12, rbx
xor ecx, ecx
call sub.kernel32.dll_SetLastError
mov ecx, r12d
mov rdx, r15
call sub.kernel32.dll_GetCurrentDirectoryW
mov r13d, eax
test eax, eax
jne 0x1400ebead
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x1400ebf53
mov r8d, r13d
cmp r12, r8
jne 0x1400ebe10
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x1400ebf84
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x1400ebe1f
jmp 0x1400ebe30
cmp r14, r8
jb 0x1400ebf9e
lea rcx, [rbp + 0x3a0]
mov rdx, r15
call fcn.1400ece30
movups xmm0, xmmword [rbp + 0x3a0]
movups xmm1, xmmword [rbp + 0x3b0]
mov rax, qword [rbp + 0x3c8]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
cmp qword [rbp + 0x3d0], 0
je 0x1400ebf3e
mov r8, qword [rbp + 0x3d8]
mov rcx, qword [0x1401ba0e0]
xor edx, edx
call fcn.1401336c4
nop
add rsp, 0x468
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rcx, qword [rbp + 0x3c8]
mov qword [rcx + 8], rax
movabs rax, 0x8000000000000000
add byte [rax], al
add byte [rax], al
add byte [rax], al
or byte [rax - 0x77], 1
cmp qword [rbp + 0x3d0], 0
jne 0x1400ebf29
jmp 0x1400ebf3e
lea rcx, str.aL4ZxuiD2joHfeTkYfCMSoFM1dyjFNITCe4ZtDkiAVn3IADE8oBfIxNF7ajquCTO4hetpqP9fFCyxw62wFsem9KzZpcea2X9blj9yrF8Jm3sjdJrLliji
lea r8, str.sjafQywmfl65i0nDCzjW3VwTNeQiJpVSzBihhK7BHv0UQAYvplPXE016G2OeEwjl2zVOgdnsTYEkEWO7MP
mov edx, 0x28
call fcn.140018100
jmp 0x1400ebfb3
lea rax, str.sjafQywmfl65i0nDCzjW3VwTNeQiJpVSzBihhK7BHv0UQAYvplPXE016G2OeEwjl2zVOgdnsTYEkEWO7MP
mov rcx, r8
mov ecx, eax
mov rdx, r14
mov r8, rax
call fcn.140017e20
ud2
Function at 0x14010d2a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov rsi, r9
mov rdi, r8
mov qword [rbp - 0x18], rdx
mov qword [rbp - 0x10], rcx
add rsi, r8
mov qword [rbp - 0x40], r8
mov qword [rbp - 0x38], rsi
mov byte [rbp - 0x30], 0x81

Function at 0x14010dd80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov esi, dword [0x140136110]
test esi, esi
je 0x14010de28
dec esi
mov ecx, esi
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x14010de1f
je 0x14010de1d
movzx eax, byte [0x1401ba120]
mov edx, 0x10
xor ecx, ecx
call fcn.14010f230
test rax, rax
je 0x14010de49
mov qword [rax], 0
mov dword [rax + 8], esi
mov ecx, esi
mov rbx, rax
call sub.kernel32.dll_TlsGetValue
mov rdi, rax
mov ecx, esi
mov rsi, rbx
mov rdx, rbx
call sub.kernel32.dll_TlsSetValue
test rdi, rdi
je 0x14010de18
mov rax, qword [rdi]
test rax, rax
je 0x14010de07
lock dec qword [rax]
jne 0x14010de07
mov rcx, qword [rdi]
call fcn.14010de60
mov rcx, qword [0x1401ba0e0]
xor edx, edx
mov r8, rdi
call fcn.1401336c4
mov rax, rsi
jmp 0x14010de1f
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea rcx, [0x1401360f8]
call fcn.1400e96f0
mov esi, eax
mov ecx, esi
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x14010ddaa
jmp 0x14010de1f
mov ecx, 8
mov edx, 0x10
call fcn.140012d60
int3
Function at 0x14010e280
Capabilities:
Resolve dns

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x1e8
lea rbp, [rsp + 0x80]
mov rax, rdx
mov rsi, rcx
mov rdx, qword [rdx]
mov rdi, qword [rax + 8]
movzx eax, word [rax + 0x10]
mov word [rbp + 0x166], ax
mov eax, dword [0x1401ba0f0]
cmp eax, 4
jne 0x14010e470
lea rax, [rbp + 0x166]
mov qword [rbp + 0x150], rax
cmp rdi, 0x17f
ja 0x14010e496
lea rbx, [rbp - 0x60]
mov rcx, rbx
mov r8, rdi
call sub.msvcrt.dll_memcpy
mov byte [rbp + rdi - 0x60], 0
lea rax, [rdi + 1]
cmp rdi, 0xe
ja 0x14010e318
xor edx, edx
nop word cs:[rax + rax]
cmp byte [rbp + rdx - 0x60], 0
je 0x14010e3d4
inc rdx
cmp rax, rdx
jne 0x14010e300
jmp 0x14010e43b
lea rcx, [rbp - 0x59]
and rcx, 0xfffffffffffffff8
sub rcx, rbx
je 0x14010e34e
xor edx, edx
nop word [rax + rax]
cmp byte [rbp + rdx - 0x60], 0
je 0x14010e3d4
inc rdx
cmp rcx, rdx
jne 0x14010e330
lea rdx, [rdi - 0xf]
cmp rcx, rdx
jbe 0x14010e352
jmp 0x14010e39e
lea rdx, [rdi - 0xf]
movdqa xmm0, xmmword [0x14013c220]
movabs r8, 0x8080808080808080
nop word cs:[rax + rax]
movdqu xmm1, xmmword [rbp + rcx - 0x60]
movdqa xmm2, xmm1
paddq xmm2, xmm0
pandn xmm1, xmm2
pshufd xmm2, xmm1, 0xee
por xmm2, xmm1
movq r9, xmm2
test r9, r8
jne 0x14010e39e
add rcx, 0x10
cmp rcx, rdx
jbe 0x14010e370
sub rax, rcx
je 0x14010e43b
lea r8, [rcx + rbp]
add r8, 0xffffffffffffffa0
xor edx, edx
nop word cs:[rax + rax]
cmp byte [r8 + rdx], 0
je 0x14010e3d1
inc rdx
cmp rax, rdx
jne 0x14010e3c0
jmp 0x14010e43b
add rdx, rcx
cmp rdx, rdi
jne 0x14010e43b
pxor xmm0, xmm0
movdqa xmmword [rbp + 0x120], xmm0
movdqa xmmword [rbp + 0x140], xmm0
movdqa xmmword [rbp + 0x130], xmm0
mov dword [rbp + 0x128], 1
mov qword [rbp + 0x158], 0
lea rcx, [rbp - 0x60]
lea r8, [rbp + 0x120]
lea r9, [rbp + 0x158]
xor edx, edx
call sub.ws2_32.dll_getaddrinfo
test eax, eax
je 0x14010e44f
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov ecx, 1
jmp 0x14010e467
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x14010e4a8
mov rax, qword [rbp + 0x158]
movzx ecx, word [rbp + 0x166]
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], cx
xor ecx, ecx
mov qword [rsi + 8], rax
mov qword [rsi], rcx
jmp 0x14010e4a8
mov rbx, rdx
call fcn.14010e960
mov rdx, rbx
lea rax, [rbp + 0x166]
mov qword [rbp + 0x150], rax
cmp rdi, 0x17f
jbe 0x14010e2d5
lea r9, [rbp + 0x150]
mov rcx, rsi
mov r8, rdi
call fcn.14010e9b0
nop
add rsp, 0x1e8
pop rbx
pop rdi
pop rsi
pop rbp
ret