joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1412a3058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1412a31df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1412a3089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1412a306f
add dl, dl
jne 0x1412a3096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1412a30f6
xor eax, eax
add dl, dl
jne 0x1412a30a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1412a31ad
add dl, dl
jne 0x1412a30b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1412a30c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1412a30d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1412a30dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1412a30ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1412a307e
mov eax, 1
add dl, dl
jne 0x1412a3106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1412a3113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1412a30fb
sub eax, ebx
mov ebx, 1
jne 0x1412a314c
mov ecx, 1
add dl, dl
jne 0x1412a312e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1412a313b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1412a3123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1412a307e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1412a3168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1412a3175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1412a315d
cmp eax, 0x7d00
jae 0x1412a319b
cmp eax, 0x500
jb 0x1412a3196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1412a307e
cmp eax, 0x7f
ja 0x1412a319e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1412a307e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1412a31d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1412a307e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20

Function at 0x14073dc00
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword gs:[0x60]
movabs r11, 0x73dc70
movabs r10, 0x73dc74
mov r9, qword [rax + 0x10]
xor eax, eax
movsxd rcx, dword [r9 + 0x3c]
movsxd r11, dword [r9 + r11]
add rcx, r9
mov r10d, dword [r9 + r10]
movzx r8d, word [rcx + 0x14]
add r8, rcx
cmp dword [r8 + 0x20], eax
jbe 0x14073dc66
mov edx, eax
nop dword [rax]
nop word [rax + rax]
mov ecx, dword [r8 + 0x24]
inc eax
add rcx, rdx
inc rdx
xor byte [rcx + r9], r10b
cmp eax, dword [r8 + 0x20]
jb 0x14073dc50
lea rax, [r9 + r11]
jmp rax
Function at 0x1408db058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1408db1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1408db089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408db06f
add dl, dl
jne 0x1408db096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408db0f6
xor eax, eax
add dl, dl
jne 0x1408db0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408db1ad
add dl, dl
jne 0x1408db0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408db0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408db0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408db0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1408db0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1408db07e
mov eax, 1
add dl, dl
jne 0x1408db106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408db113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1408db0fb
sub eax, ebx
mov ebx, 1
jne 0x1408db14c
mov ecx, 1
add dl, dl
jne 0x1408db12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1408db13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1408db123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1408db07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1408db168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1408db175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1408db15d
cmp eax, 0x7d00
jae 0x1408db19b
cmp eax, 0x500
jb 0x1408db196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1408db07e
cmp eax, 0x7f
ja 0x1408db19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1408db07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1408db1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1408db07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140008c80
Capabilities:
Accept command line arguments

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
movdqa xmmword [rsp + 0x50], xmm6
mov rax, qword [0x140065020]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp qword [0x140066038], 0
je 0x140008cad
xor esi, esi
jmp 0x140008dce
mov ecx, 0x30
call fcn.140029f90
mov rsi, rax
mov ecx, 0x20
call fcn.140029f90
mov qword [rsi], rax
lea rcx, [rax + 0x20]
mov qword [rsi + 0x10], rcx
mov edx, 7
movq xmm6, rdx
pslldq xmm6, 8
movdqu xmmword [rax + 0x10], xmm6
mov word [rax], 0
mov qword [rsi + 8], rcx
mov qword [rsi + 0x20], 0
mov ecx, 0x60
call fcn.140029f90
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rsi + 0x18], rax
mov qword [rsi + 0x28], 1
mov qword [0x140066038], rsi
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdi, rax
movdqu xmmword [rsp + 0x38], xmm6
mov word [rsp + 0x28], 0
mov rcx, rax
call fcn.14003bbb0
mov rbx, rax
cmp rax, 7
jbe 0x140008d5b
lea rcx, [rsp + 0x28]
mov rdx, rbx
mov r9, rdi
call fcn.14000ae40
jmp 0x140008d7a
mov qword [rsp + 0x38], rbx
mov r8, rbx
add r8, rbx
lea rcx, [rsp + 0x28]
mov rdx, rdi
call fcn.14002f370
mov word [rsp + rbx*2 + 0x28], 0
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.140008e00
mov rax, qword [rsp + 0x40]
cmp rax, 8
jb 0x140008dcb
mov rcx, qword [rsp + 0x28]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x140008dc6
mov rdx, rcx
add rdx, 0xfffffffffffffff8
mov rcx, qword [rcx - 8]
sub rdx, rcx
cmp rdx, 0x20
jae 0x140008dea
add rax, rax
add rax, 0x29
mov rdx, rax
call fcn.14002a000
mov sil, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14002a340
mov eax, esi
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
call fcn.140034cb0
ud2

Function at 0x140008e00
Capabilities:
Accept command line arguments

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rax, rdx
mov rsi, rcx
mov rcx, qword [0x140065020]
xor rcx, rsp
mov qword [rsp + 0x50], rcx
mov ecx, 7
movq xmm0, rcx
pslldq xmm0, 8
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x30], 0
lea rdi, [rsp + 0x30]
mov edx, 3
mov rcx, rax
mov r8, rdi
call fcn.140011660
cmp qword [rsp + 0x40], 0
je 0x140008e92
mov dword [rsp + 0x2c], 0
cmp qword [rsp + 0x48], 7
jbe 0x140008e69
mov rdi, qword [rsp + 0x30]
lea rdx, [rsp + 0x2c]
mov rcx, rdi
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rdi, rax
mov edx, dword [rsp + 0x2c]
mov rcx, rsi
mov r8, rax
call fcn.140008970
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, qword [rsp + 0x48]
cmp rax, 8
jb 0x140008ed6
mov rcx, qword [rsp + 0x30]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x140008ed1
mov rdx, rcx
add rdx, 0xfffffffffffffff8
mov rcx, qword [rcx - 8]
sub rdx, rcx
cmp rdx, 0x20
jae 0x140008eeb
add rax, rax
add rax, 0x29
mov rdx, rax
call fcn.14002a000
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14002a340
nop
add rsp, 0x58
pop rdi
pop rsi
ret
call fcn.140034cb0
ud2
Function at 0x14000c360
Capabilities:
Delete file

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0x80]
mov r14, rcx
mov rax, qword [0x140065020]
xor rax, rbp
mov qword [rbp], rax
call fcn.140008f00
mov rdi, rax
lea rbx, [0x14004ee91]
mov rcx, rax
mov rdx, rbx
call fcn.140009320
test al, al
jne 0x14000c3bd
lea rdx, str.vmodule
mov rcx, rdi
call fcn.140009320
test al, al
je 0x14000c4ca
cmp qword [0x140066048], 0
jne 0x14000c5cd
mov rax, qword [0x140066050]
mov qword [0x140066048], rax
mov ecx, 0x20
call fcn.140029f90
mov rsi, rax
lea rcx, str.vmodule
mov qword [rbp - 0x50], rcx
call fcn.14003b060
mov qword [rbp - 0x48], rax
lea r15, [rbp - 0x20]
lea r8, [rbp - 0x50]
mov rcx, rdi
mov rdx, r15
call fcn.140009420
mov qword [rbp - 0x60], rbx
mov rcx, rbx
call fcn.14003b060
mov qword [rbp - 0x58], rax
lea rbx, [rbp - 0x40]
lea r8, [rbp - 0x60]
mov rcx, rdi
mov rdx, rbx
call fcn.140009420
lea r9, [0x140066058]
mov rcx, rsi
mov rdx, rbx
mov r8, r15
call fcn.140012230
mov qword [0x140066050], rsi
mov rax, qword [rbp - 0x28]
cmp rax, 0x10
jb 0x14000c48b
mov rcx, qword [rbp - 0x40]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14000c486
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x14000c5d4
add rax, 0x28
mov rdx, rax
mov rcx, rbx
call fcn.14002a000
mov rax, qword [rbp - 8]
cmp rax, 0x10
jb 0x14000c4ca
mov rcx, qword [rbp - 0x20]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14000c4c5
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x14000c5d4
add rax, 0x28
mov rdx, rax
mov rcx, rbx
call fcn.14002a000
mov eax, dword [r14]
mov dword [section..data], eax
mov bl, 1
test al, 1
je 0x14000c5af
mov rcx, qword [0x1400660a8]
test rcx, rcx
je 0x14000c4fa
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x1400660a8], 0
mov rdi, qword [0x140066060]
test rdi, rdi
jne 0x14000c533
mov ecx, 0x20
call fcn.140029f90
mov rdi, rax
mov eax, 7
movq xmm0, rax
pslldq xmm0, 8
movdqu xmmword [rdi + 0x10], xmm0
mov word [rdi], 0
mov qword [0x140066060], rdi
mov rsi, qword [r14 + 8]
mov rcx, rsi
call fcn.14003bbb0
mov rbx, rax
mov rax, qword [rdi + 0x18]
cmp rax, rbx
jae 0x14000c562
mov rcx, rdi
mov rdx, rbx
mov r9, rsi
call fcn.14000ae40
cmp dword [r14 + 0x14], 0
jne 0x14000c5a8
jmp 0x14000c591
mov r15, rdi
cmp rax, 8
jb 0x14000c56e
mov r15, qword [rdi]
mov qword [rdi + 0x10], rbx
mov r8, rbx
add r8, rbx
mov rcx, r15
mov rdx, rsi
call fcn.14002f370
mov word [r15 + rbx*2], 0
cmp dword [r14 + 0x14], 0
jne 0x14000c5a8
mov rcx, qword [0x140066060]
cmp qword [rcx + 0x18], 7
jbe 0x14000c5a2
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.14000c5e0
mov ebx, eax
mov rcx, qword [rbp]
xor rcx, rbp
call fcn.14002a340
mov eax, ebx
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
int3
call fcn.140034cb0
ud2
Function at 0x14000f880
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
cmp qword [rcx], rdx
je 0x14000f903
mov rdi, rdx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
add rax, 1
cmp rax, 2
jb 0x14000f8ce
call fcn.140014640
mov r8, qword [rsp + 0x38]
mov rcx, qword [rsi]
mov rdx, rsi
mov r9, rax
call fcn.1400146c0
mov rcx, qword [rsi]
call fcn.140014650
mov qword [rsi], 0
lea rax, [rdi + 1]
cmp rax, 2
jb case.default.0x14000f8fc
mov qword [rsi], rdi
call fcn.140014640
mov r8, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
mov r9, rax
call fcn.140014680
mov ecx, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
jmp 0x1400c3ec5
cli
shr ebx, 0xd5
retf
mov ecx, 0x7f952c7f
fstp dword [rcx]
cmp al, 0xa8
xor dword [rsi], edx
lodsd eax, dword [rsi]
adc dword [rdi], esp
imul esi, dword [rdi - 6], 0x4d
not byte [rdx - 0x15]
invalid
or dword [rsp + rbx*2 + 0x3a], esi
loop 0x1400c3f47
rol ecx, cl
adc byte [rcx - 0x6b], dl
invalid
push 0xffffffffffffff8f
mov esp, 0xffd2ebef
or esp, ebp
call 0x19868ad23
mov fs, word [rbp - 0x13ba40b4]
scasd eax, dword [rdi]
stosb byte [rdi], al
xchg r15d, eax
wait
invalid

Function at 0x140010e90
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x230
mov r14, rcx
mov rax, qword [0x140065020]
xor rax, rsp
mov qword [rsp + 0x228], rax
lea rdi, [rsp + 0x20]
mov word [rdi], 0
xor ebx, ebx
lea r15, str.PROGRAMFILES
mov rsi, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rcx, qword [rbx + r15]
mov word [rsp + 0x20], 0
mov r8d, 0x104
mov rdx, rdi
call rsi
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x140010eff
mov edx, eax
mov rcx, rdi
mov r8, r14
call fcn.140010e20
test al, al
jne 0x140010f0d
add rbx, 8
cmp rbx, 0x18
jne 0x140010ecd
xor esi, esi
jmp 0x140010f10
mov sil, 1
mov rcx, qword [rsp + 0x228]
xor rcx, rsp
call fcn.14002a340
mov eax, esi
add rsp, 0x230
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140015130
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rax, qword [0x140065020]
xor rax, rsp
mov qword [rsp + 0x70], rax
cmp qword [r8 + 0x10], 0
je 0x140015187
mov r12, r8
mov ebx, edx
mov edi, ecx
bt edx, 8
jae 0x14001516c
mov eax, ebx
and eax, 0x200
jne 0x140015187
cmp edi, 2
lea rax, [0x140066680]
lea rcx, [0x140066880]
cmove rcx, rax
cmp word [rcx], 0
je 0x1400151a6
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14002a340
nop
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xorps xmm0, xmm0
lea rsi, [rsp + 0x40]
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [rsi], 0
je 0x140015187
cmp byte [0x140066670], 0
setne al
bt ebx, 8
jb 0x140015187
shr ebx, 9
and ebx, 1
or bl, al
je 0x140015187
cmp edi, 2
lea rax, str.SOFTWAREClasses
lea rsi, str.SOFTWARE
cmove rsi, rax
cmp qword [r12 + 0x18], 8
mov rdi, r12
jb 0x140015206
mov rdi, qword [r12]
mov rbp, qword [r12 + 0x10]
mov r13d, 1
xor r15d, r15d
xor eax, eax
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x2c], 0
jmp 0x1400152a2
movzx edx, word [rdi + rbx*2]
cmp dx, 0x5c
je 0x14001523f
test dx, dx
jne 0x1400152c4
lea rax, [rdi + rbx*2]
mov ebp, dword [rsi + 0x10]
lea rcx, str.WOW6432Node_
cmp ebp, 1
je 0x14001526d
cmp ebp, 2
jne 0x140015263
mov rdi, rax
lea rcx, str.WOW6432Node
jmp 0x14001526d
mov rdi, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
cmp dx, 0x5c
mov dword [rsp + 0x2c], ebp
jne 0x140015285
dec r14
cmp word [rax + 2], 0x5c
lea rax, [rax + 2]
je 0x140015277
mov r13, qword [rsi + 0x20]
mov rsi, qword [rsi + 0x18]
mov rbp, r14
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rcx
xor r15d, r15d
mov rdi, rax
jmp 0x1400152cb
mov rbx, qword [rsi + 8]
mov r14, rbp
sub r14, rbx
jb 0x1400152c4
mov rdx, qword [rsi]
mov rcx, rdi
mov r8, rbx
call fcn.1400358a0
test eax, eax
je 0x14001522c
add rsi, 0x28
inc r15
cmp r15, r13
jb 0x1400152a2
cmp dword [rsp + 0x2c], 0
je 0x140015187
cmp qword [r12 + 0x18], 8
mov rax, r12
jb 0x1400152ea
mov rax, qword [r12]
mov rdi, qword [rsp + 0x30]
sub rdi, rax
sar rdi, 1
mov rsi, qword [rsp + 0x38]
mov rcx, rsi
call fcn.14003bbb0
mov rcx, r12
mov rdx, rdi
mov r8, rsi
mov r9, rax
call fcn.140015bb0
jmp 0x140015187
Function at 0x140018fa0
Capabilities:
Hash data with crc32

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
movdqa xmmword [rsp + 0x40], xmm8
movapd xmmword [rsp + 0x30], xmm7
movapd xmmword [rsp + 0x20], xmm6
mov r14, r8
mov edi, ecx
cvtsi2sd xmm0, edx
call fcn.140037b30
mov rax, qword [r14]
mov dword [rax + 4], edi
mov rax, qword [r14]
mov rbx, qword [r14 + 8]
sub rbx, rax
sar rbx, 2
lea rcx, [rbx - 1]
cmp rcx, 3
jb 0x140019081
movapd xmm6, xmm0
add rbx, 0xfffffffffffffffd
mov esi, 8
movdqa xmm8, xmmword [0x140051860]
movapd xmm7, xmmword [0x140051870]
nop word [rax + rax]
xorps xmm0, xmm0
cvtsi2sd xmm0, edi
call fcn.140037b30
movapd xmm1, xmm6
subsd xmm1, xmm0
movq xmm2, rbx
punpckldq xmm2, xmm8
subpd xmm2, xmm7
movapd xmm3, xmm2
unpckhpd xmm3, xmm2
addpd xmm3, xmm2
divsd xmm1, xmm3
addsd xmm0, xmm1
call fcn.140036510
call fcn.14003a5d0
cvttsd2si eax, xmm0
cmp edi, eax
jl 0x14001905d
add edi, 1
mov eax, edi
mov rcx, qword [r14]
mov dword [rcx + rsi], eax
add rsi, 4
mov edi, eax
add rbx, 0xffffffffffffffff
jne 0x140019010
mov rax, qword [r14]
mov rcx, qword [r14 + 8]
sub rcx, rax
sar rcx, 2
add rcx, 0xffffffffffffffff
mov edx, dword [0x140051d40]
mov dword [rax + rcx*4], edx
mov rcx, r14
movaps xmm6, xmmword [rsp + 0x20]
movaps xmm7, xmmword [rsp + 0x30]
movaps xmm8, xmmword [rsp + 0x40]
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.1400240a0

Function at 0x14001d400
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1400650f4]
cmp ecx, 0xffffffff
je 0x14001d41e
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp rax, 1
sete al
jmp 0x14001d420
xor eax, eax
add rsp, 0x28
ret
Function at 0x14001d430
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov r14, rdx
mov r15, rcx
mov ecx, dword [0x1400650f4]
cmp ecx, 0xffffffff
je 0x14001d45d
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x14001d462
call fcn.14001d590
mov eax, dword [0x140068c68]
mov ecx, dword [0x140066110]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14001d52b
mov rbx, qword [0x140068c60]
mov rcx, rbx
call fcn.140011170
mov rcx, qword [0x140067450]
add rcx, 1
xor edx, edx
lea rax, [0x140067460]
nop word [rax + rax]
movzx edi, cl
lea rsi, [rdi + rdi*2]
cmp dword [rax + rsi*8], 0
je 0x14001d4e1
lea edi, [rcx + 1]
movzx edi, dil
lea rsi, [rdi + rdi*2]
cmp dword [rax + rsi*8], 0
je 0x14001d4e1
add rdx, 2
add rcx, 2
cmp rdx, 0x100
jb 0x14001d4b0
jmp 0x14001d506
lea rcx, [rax + rsi*8]
mov dword [rcx], 1
lea rcx, [rdi + rdi*2]
mov qword [rax + rcx*8 + 8], r14
mov qword [0x140067450], rdi
mov dword [r15], edi
mov eax, dword [rax + rcx*8 + 0x10]
mov dword [r15 + 4], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [r15]
cmp eax, 0xffffffff
je 0x14001d573
cmp eax, 0x100
jge 0x14001d57a
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
lea rcx, [0x140068c68]
call fcn.14002a160
mov eax, dword [0x140068c68]
cmp eax, 0xffffffff
jne 0x14001d487
mov ecx, 8
call fcn.140029f90
mov rbx, rax
mov rcx, rax
call fcn.140011160
mov qword [0x140068c60], rbx
lea rcx, [0x140068c68]
call fcn.14002a1d0
jmp 0x14001d487
int3
int3

Function at 0x14001d590
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
mov eax, 0x1040
call fcn.14002cda0
sub rsp, rax
lea rbp, [rsp + 0x80]
mov rax, qword [0x140065020]
xor rax, rbp
mov qword [rbp + 0xfb8], rax
mov ecx, dword [0x1400650f4]
mov dword [rbp - 0x54], ecx
cmp ecx, 0xffffffff
jne 0x14001d628
lea rcx, [rbp - 0x54]
call fcn.1400267e0
test al, al
je 0x14001d69f
mov ecx, dword [rbp - 0x54]
cmp ecx, 0xffffffff
jne 0x14001d608
lea rcx, [rbp - 0x54]
call fcn.1400267e0
test al, al
je 0x14001d6a6
cmp dword [rbp - 0x54], 0xffffffff
je 0x14001d6a6
mov ecx, 0xffffffff
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [rbp - 0x54]
mov eax, 0xffffffff
lock cmpxchg dword [0x1400650f4], ecx
mov ecx, dword [rbp - 0x54]
je 0x14001d628
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [0x1400650f4]
mov dword [rbp - 0x54], ecx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x14001d698
lea rsi, [rbp - 0x50]
xor edx, edx
mov r8d, 0x1000
mov rcx, rsi
call fcn.14002f7d0
mov ecx, dword [rbp - 0x54]
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
mov ecx, 0x1000
call fcn.14002b750
mov rdi, rax
mov r8d, 0x1000
mov rcx, rax
mov rdx, rsi
call fcn.14002f370
mov ecx, dword [rbp - 0x54]
mov rdx, rdi
call sub.KERNEL32.dll_TlsSetValue
mov rcx, qword [rbp + 0xfb8]
xor rcx, rbp
call fcn.14002a340
mov rax, rdi
add rsp, 0x1040
pop rdi
pop rsi
pop rbp
ret
int3
int3
int3
Function at 0x14001d6b0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x1400650f4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14001d6df
movsxd rcx, dword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 4]
jne 0x14001d6df
mov rax, qword [rax + rcx]
jmp 0x14001d6e1
xor eax, eax
add rsp, 0x20
pop rsi
ret

Function at 0x14001d6f0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x1400650f4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x14001d712
call fcn.14001d590
movsxd rcx, dword [rsi]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rsi + 4]
movsxd rdx, dword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x140020820
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r15, r8
mov r12, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 0xf
jbe 0x140020841
mov r15, qword [r15]
movabs rsi, 0xcbf29ce484222325
test r12, r12
mov qword [rsp + 0x20], rdx
je 0x140020876
movabs rax, 0x100000001b3
lea rdx, [r12 - 1]
mov r8d, r12d
and r8d, 7
cmp rdx, 7
jae 0x14002087e
mov rdi, r15
jmp 0x1400208f1
mov rdx, rsi
jmp 0x140020917
mov rdx, r8
sub rdx, r12
mov rdi, r15
nop word [rax + rax]
movzx ebp, byte [rdi]
xor rbp, rsi
imul rbp, rax
movzx ebx, byte [rdi + 1]
xor rbx, rbp
imul rbx, rax
movzx ebp, byte [rdi + 2]
xor rbp, rbx
imul rbp, rax
movzx ebx, byte [rdi + 3]
xor rbx, rbp
imul rbx, rax
movzx ebp, byte [rdi + 4]
xor rbp, rbx
imul rbp, rax
movzx ebx, byte [rdi + 5]
xor rbx, rbp
imul rbx, rax
movzx ebp, byte [rdi + 6]
xor rbp, rbx
imul rbp, rax
movzx esi, byte [rdi + 7]
xor rsi, rbp
imul rsi, rax
add rdi, 8
add rdx, 8
jne 0x140020890
mov rdx, rsi
test r8, r8
je 0x140020917
xor ebp, ebp
nop dword [rax + rax]
movzx edx, byte [rdi + rbp]
xor rdx, rsi
imul rdx, rax
add rbp, 1
mov rsi, rdx
cmp r8, rbp
jne 0x140020900
and rdx, qword [rcx + 0x30]
mov rdi, qword [rcx + 8]
mov r13, qword [rcx + 0x18]
mov rax, rdx
shl rax, 4
mov rbp, qword [r13 + rax]
lea r14, [rdx + rdx]
add r14, 1
mov rbx, rbp
cmp rbp, rdi
jne 0x140020958
jmp 0x140020980
mov rbx, qword [rbx]
cmp rbp, rdi
je 0x140020980
mov rax, qword [r13 + r14*8]
mov rax, qword [rax]
cmp rax, rbx
je 0x1400209b8
cmp qword [rbx + 0x20], r12
jne 0x140020950
cmp qword [rbx + 0x28], 0xf
jbe 0x140020990
mov rsi, qword [rbx + 0x10]
jmp 0x140020994
mov rax, rdi
cmp rax, rbx
jne 0x140020965
jmp 0x1400209b8
lea rsi, [rbx + 0x10]
mov rcx, rsi
mov rdx, r15
mov r8, r12
call fcn.14002f290
test eax, eax
jne 0x140020950
mov rcx, r15
mov rdx, rsi
mov r8, r12
call fcn.14002f290
test eax, eax
je 0x1400209d1
mov rax, qword [rsp + 0x20]
mov qword [rax], rdi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsp + 0x20]
mov qword [rax], rbx
jmp 0x1400209c0