joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003fdb0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14003fdbd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14003fdcd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14003fdb5
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x14003fde5
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14003fdd2
sub eax, 3
jb 0x14003fdff
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14003fe36
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x14003fe26
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14003fe24
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14003fe13
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.14003fd72
jmp 0x14003fdbd
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x31400
mov dl, 0x17
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14003fe82
cmp rsi, rcx
jae 0x14003fe8a
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14003fe69
cmp al, 0x8f
ja 0x14003fe69
cmp byte [rsi - 2], 0xf
je 0x14003fe6f
sub al, 0xe8
cmp al, 1
ja 0x14003fe53
cmp rsi, rcx
jae 0x14003fe8a
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14003fe59
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14003fe8a
lodsb al, byte [rsi]
jmp 0x14003fe69
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x3c000]
mov eax, dword [rdi]
or eax, eax
je 0x14003fee7
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x401dc]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14003fe97
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14003fee1
mov qword [rbx], rax
add rbx, 8
jmp 0x14003feb7
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14003ff21
cmp al, 0xef
ja 0x14003ff13
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14003fef3
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x14003ff02
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x237]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14003ff75
sub rsp, 0xffffffffffffff80
jmp 0x14001de5c
Function at 0x140017e84
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [0x14005c2b0]
test rax, rax
je 0x140017ece
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140017ece
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140017ece
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140017ece
cmp dword [rcx + 0x84], 0xe
jbe 0x140017ece
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140017ed0
xor al, al
add rsp, 0x28
ret

Function at 0x1400270f8
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140026f24

Function at 0x140033880
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400338a8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400338a8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140002538
Capabilities:
Delete registry value

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x140
mov qword [rsp + 0x110], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
movzx esi, dx
mov ebx, ecx
lea rcx, [rax - 0x30]
call fcn.140009380
nop
lea rcx, [rsp + 0x58]
call fcn.140009380
nop
lea rcx, [rsp + 0x30]
call fcn.140009380
nop
lea rdx, [rsp + 0x118]
mov ecx, ebx
call fcn.140001c5c
lea rdx, [rsp + 0x58]
mov ecx, 3
call fcn.140001c5c
lea rdx, [rsp + 0x30]
mov ecx, 4
call fcn.140001c5c
lea rcx, [rsp + 0x80]
call fcn.140009380
nop
lea rcx, [rsp + 0x30]
call fcn.140009be0
mov rdi, rax
lea rcx, [rsp + 0x58]
call fcn.140009be0
mov rbx, rax
lea rcx, [rsp + 0x118]
call fcn.140009be0
mov r8, rax
mov qword [rsp + 0x20], rdi
mov r9, rbx
lea rdx, str._hs_hs_hs
lea rcx, [rsp + 0x80]
call fcn.1400094d0
xor edi, edi
mov qword [rsp + 0x160], rdi
lea rcx, [rsp + 0x80]
call fcn.140009be0
mov rdx, rax
lea rax, [rsp + 0x160]
mov qword [rsp + 0x20], rax
lea r9d, [rdi + 2]
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, edi
je 0x140002674
lea rcx, [rsp + 0x80]
call fcn.1400093f0
nop
lea rcx, [rsp + 0x30]
call fcn.1400093f0
nop
lea rcx, [rsp + 0x58]
call fcn.1400093f0
nop
lea rcx, [rsp + 0x118]
call fcn.1400093f0
xor al, al
jmp 0x1400027ae
mov rdx, qword [rsp + 0x160]
lea rcx, [rsp + 0xa8]
call fcn.140009364
nop
lea rcx, [rsp + 0xe8]
call fcn.140009380
nop
lea rdx, [rsp + 0xe8]
mov ecx, 5
call fcn.140001c5c
lea rcx, [rsp + 0xc0]
call fcn.140009380
nop
movzx ebx, si
lea rcx, [rsp + 0xe8]
call fcn.140009be0
mov rdx, rax
mov r8d, ebx
lea rcx, [rsp + 0xc0]
call fcn.1400094d0
lea rcx, [rsp + 0xc0]
call fcn.140009be0
mov rdx, rax
mov rcx, qword [rsp + 0x160]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp eax, edi
je 0x14000274d
lea rcx, [rsp + 0xc0]
call fcn.1400093f0
nop
lea rcx, [rsp + 0xe8]
call fcn.1400093f0
nop
lea rcx, [rsp + 0xa8]
call fcn.1400092d8
nop
lea rcx, [rsp + 0x80]
call fcn.1400093f0
nop
lea rcx, [rsp + 0x30]
call fcn.1400093f0
nop
lea rcx, [rsp + 0x58]
call fcn.1400093f0
nop
jmp 0x14000279e
lea rcx, [rsp + 0xc0]
call fcn.1400093f0
nop
lea rcx, [rsp + 0xe8]
call fcn.1400093f0
nop
lea rcx, [rsp + 0xa8]
call fcn.1400092d8
nop
lea rcx, [rsp + 0x80]
call fcn.1400093f0
nop
lea rcx, [rsp + 0x30]
call fcn.1400093f0
nop
lea rcx, [rsp + 0x58]
call fcn.1400093f0
nop
mov dil, 1
lea rcx, [rsp + 0x118]
call fcn.1400093f0
mov al, dil
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1400027cc
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0xa0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov ebx, ecx
call qword [sym.imp.KERNEL32.dll_GetVersion]
movzx edx, al
shr ax, 8
movzx r8d, al
cmp edx, 5
jb 0x140002921
cmp edx, 5
jne 0x140002809
cmp r8d, 1
jb 0x140002921
lea rcx, [rsp + 0x38]
call fcn.140009380
nop
lea rdx, [rsp + 0x38]
mov ecx, ebx
call fcn.140001c5c
and qword [rsp + 0xc8], 0
lea rcx, [rsp + 0x38]
call fcn.140009be0
mov rdx, rax
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14000286e
lea rcx, [rsp + 0x38]
call fcn.1400093f0
xor al, al
jmp 0x140002923
mov rdx, qword [rsp + 0xc8]
lea rcx, [rsp + 0x88]
call fcn.140009364
nop
lea rcx, [rsp + 0x60]
call fcn.140009380
nop
lea rdx, [rsp + 0x60]
mov ecx, 2
call fcn.140001c5c
mov dword [rsp + 0xb8], 1
mov dword [rsp + 0xc0], 4
lea rcx, [rsp + 0x60]
call fcn.140009be0
mov rdx, rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp dword [rsp + 0xb8], 0
setne bl
lea rcx, [rsp + 0x60]
call fcn.1400093f0
nop
lea rcx, [rsp + 0x88]
call fcn.1400092d8
nop
lea rcx, [rsp + 0x38]
call fcn.1400093f0
mov al, bl
jmp 0x140002923
xor al, al
add rsp, 0xa0
pop rbx
ret
Function at 0x1400086e0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push rbx
push rdi
push r12
sub rsp, 0x20
mov ebx, dword [rcx + 8]
mov qword [rsp + 0x50], r13
movsxd r13, dword [rcx + 0xc]
mov qword [rsp + 0x58], r14
mov rdi, r8
mov r12, rcx
movzx eax, bl
test bl, bl
je 0x140008766
lea r10, [rcx + 0x14]
lea r8, [rdx + 3]
lea r9, [rdi + 1]
sub rdx, rdi
mov rcx, rax
nop dword [rax]
movzx eax, byte [r8 - 3]
add r9, 4
inc r10
xor al, byte [r10 - 5]
add r8, 4
mov byte [r9 - 5], al
movzx eax, byte [rdx + r9 - 4]
xor al, byte [r10 - 1]
mov byte [r9 - 4], al
movzx eax, byte [r8 - 5]
xor al, byte [r10 + 3]
mov byte [r9 - 3], al
movzx eax, byte [r10 + 7]
xor al, byte [r8 - 4]
sub rcx, 1
mov byte [r9 - 2], al
jne 0x140008720
lea r14, str.cw
cmp r13d, 1
jbe 0x140008841
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
lea rsi, [r12 + 0x24]
lea ebp, [r13 - 1]
nop word [rax + rax]
test ebx, ebx
je 0x1400087da
lea rcx, [rdi + 2]
mov rdx, rbx
nop dword [rax + rax]
movzx eax, byte [rcx - 2]
add rcx, 4
sub rdx, 1
movzx eax, byte [rax + r14]
mov byte [rcx - 6], al
movzx eax, byte [rcx - 5]
movzx eax, byte [rax + r14]
mov byte [rcx - 5], al
movzx eax, byte [rcx - 4]
movzx eax, byte [rax + r14]
mov byte [rcx - 4], al
movzx eax, byte [rcx - 3]
movzx eax, byte [rax + r14]
mov byte [rcx - 3], al
jne 0x1400087a0
mov r8d, ebx
xor edx, edx
mov rcx, rdi
call fcn.140007ec0
mov edx, ebx
mov rcx, rdi
call fcn.140007f90
test ebx, ebx
je 0x140008829
mov rdx, rsi
lea rcx, [rdi + 2]
mov r8, rbx
nop
movzx eax, byte [rdx - 4]
add rcx, 4
inc rdx
xor byte [rcx - 6], al
movzx eax, byte [rdx - 1]
xor byte [rcx - 5], al
movzx eax, byte [rdx + 3]
xor byte [rcx - 4], al
movzx eax, byte [rdx + 7]
xor byte [rcx - 3], al
sub r8, 1
jne 0x140008800
add rsi, 0x10
sub rbp, 1
jne 0x140008790
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
test ebx, ebx
je 0x14000888a
lea rcx, [rdi + 2]
mov rdx, rbx
nop dword [rax]
movzx eax, byte [rcx - 2]
add rcx, 4
sub rdx, 1
movzx eax, byte [rax + r14]
mov byte [rcx - 6], al
movzx eax, byte [rcx - 5]
movzx eax, byte [rax + r14]
mov byte [rcx - 5], al
movzx eax, byte [rcx - 4]
movzx eax, byte [rax + r14]
mov byte [rcx - 4], al
movzx eax, byte [rcx - 3]
movzx eax, byte [rax + r14]
mov byte [rcx - 3], al
jne 0x140008850
mov r8d, ebx
xor edx, edx
mov rcx, rdi
call fcn.140007ec0
mov r14, qword [rsp + 0x58]
mov r11, r13
mov r13, qword [rsp + 0x50]
test ebx, ebx
je 0x1400088e9
add r11, r11
lea rcx, [rdi + 2]
mov r8, rbx
lea rdx, [r12 + r11*8 + 0x14]
nop word [rax + rax]
movzx eax, byte [rdx - 4]
add rcx, 4
inc rdx
xor byte [rcx - 6], al
movzx eax, byte [rdx - 1]
xor byte [rcx - 5], al
movzx eax, byte [rdx + 3]
xor byte [rcx - 4], al
movzx eax, byte [rdx + 7]
xor byte [rcx - 3], al
sub r8, 1
jne 0x1400088c0
add rsp, 0x20
pop r12
pop rdi
pop rbx
ret
Function at 0x140008900
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push rbx
push rdi
push r12
sub rsp, 0x20
mov ebx, dword [rcx + 8]
mov qword [rsp + 0x48], rsi
movsxd rsi, dword [rcx + 0xc]
mov rax, rsi
mov qword [rsp + 0x50], r13
mov rdi, r8
mov r12, rcx
test ebx, ebx
je 0x140008986
add rax, rax
lea r10, [rdx + 3]
inc r8
lea r9, [rcx + rax*8 + 0x14]
mov rcx, rbx
sub rdx, rdi
nop dword [rax]
movzx eax, byte [r10 - 3]
add r8, 4
inc r9
xor al, byte [r9 - 5]
add r10, 4
mov byte [r8 - 5], al
movzx eax, byte [rdx + r8 - 4]
xor al, byte [r9 - 1]
mov byte [r8 - 4], al
movzx eax, byte [r10 - 5]
xor al, byte [r9 + 3]
mov byte [r8 - 3], al
movzx eax, byte [r9 + 7]
xor al, byte [r10 - 4]
sub rcx, 1
mov byte [r8 - 2], al
jne 0x140008940
lea r13, [0x1400179d0]
test ebx, ebx
je 0x1400089da
lea rcx, [rdi + 2]
mov rdx, rbx
nop dword [rax + rax]
movzx eax, byte [rcx - 2]
add rcx, 4
sub rdx, 1
movzx eax, byte [rax + r13]
mov byte [rcx - 6], al
movzx eax, byte [rcx - 5]
movzx eax, byte [rax + r13]
mov byte [rcx - 5], al
movzx eax, byte [rcx - 4]
movzx eax, byte [rax + r13]
mov byte [rcx - 4], al
movzx eax, byte [rcx - 3]
movzx eax, byte [rax + r13]
mov byte [rcx - 3], al
jne 0x1400089a0
mov r8d, ebx
mov dl, 1
mov rcx, rdi
call fcn.140007ec0
dec esi
movsxd rax, esi
je 0x140008aa9
add rax, rax
mov qword [rsp + 0x40], rbp
lea rbp, [r12 + rax*8 + 0x14]
nop
test ebx, ebx
je 0x140008a39
mov rdx, rbp
lea rcx, [rdi + 2]
mov r8, rbx
nop
movzx eax, byte [rdx - 4]
add rcx, 4
inc rdx
xor byte [rcx - 6], al
movzx eax, byte [rdx - 1]
xor byte [rcx - 5], al
movzx eax, byte [rdx + 3]
xor byte [rcx - 4], al
movzx eax, byte [rdx + 7]
xor byte [rcx - 3], al
sub r8, 1
jne 0x140008a10
mov edx, ebx
mov rcx, rdi
call fcn.140008160
test ebx, ebx
je 0x140008a8a
lea rcx, [rdi + 2]
mov rdx, rbx
nop
movzx eax, byte [rcx - 2]
add rcx, 4
sub rdx, 1
movzx eax, byte [rax + r13]
mov byte [rcx - 6], al
movzx eax, byte [rcx - 5]
movzx eax, byte [rax + r13]
mov byte [rcx - 5], al
movzx eax, byte [rcx - 4]
movzx eax, byte [rax + r13]
mov byte [rcx - 4], al
movzx eax, byte [rcx - 3]
movzx eax, byte [rax + r13]
mov byte [rcx - 3], al
jne 0x140008a50
mov r8d, ebx
mov dl, 1
mov rcx, rdi
call fcn.140007ec0
sub rbp, 0x10
add esi, 0xffffffff
jne 0x140008a00
mov rbp, qword [rsp + 0x40]
mov r13, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
test ebx, ebx
je 0x140008af9
lea rdx, [r12 + 0x14]
lea rcx, [rdi + 2]
mov r8, rbx
nop word [rax + rax]
movzx eax, byte [rdx - 4]
add rcx, 4
inc rdx
xor byte [rcx - 6], al
movzx eax, byte [rdx - 1]
xor byte [rcx - 5], al
movzx eax, byte [rdx + 3]
xor byte [rcx - 4], al
movzx eax, byte [rdx + 7]
xor byte [rcx - 3], al
sub r8, 1
jne 0x140008ad0
add rsp, 0x20
pop r12
pop rdi
pop rbx
ret
Function at 0x140008b10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x10], rdx
push rsi
push rdi
push r12
sub rsp, 0x90
mov esi, r8d
mov rdi, rdx
mov r12, rcx
test rcx, rcx
jne 0x140008b44
mov eax, 0xf0000002
add rsp, 0x90
pop r12
pop rdi
pop rsi
ret
mov qword [rsp + 0xc0], rbx
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0x80], r13
mov qword [rsp + 0x78], r14
mov r14, qword [rsp + 0xd0]
mov qword [rsp + 0x70], r15
mov r15d, dword [rcx + 0x198]
lea r13d, [r15 + r8]
mov ebx, r13d
and r13d, 0xf
shr ebx, 4
mov dword [rsp + 0x20], r13d
mov ebp, ebx
shl ebp, 4
mov dword [rsp + 0xb0], ebp
cmp dword [r14], ebp
jae 0x140008ba3
mov eax, 0xf0000002
jmp 0x140008d13
lea rdx, [rcx + 0x118]
lea rcx, [rsp + 0x48]
mov r8d, r15d
call fcn.14000a048
lea rax, [rsp + r15 + 0x48]
mov qword [rsp + 0x30], rax
mov r9, rax
test ebx, ebx
je 0x140008cd9
mov r13, qword [rsp + 0xc8]
mov rbp, qword [rsp + 0xb8]
mov r14, rax
mov eax, ebx
xor ecx, ecx
lea rdi, [r13 + 1]
neg r14
mov qword [rsp + 0x28], rax
nop
lea ebx, [rcx + 0x10]
cmp ecx, ebx
jae 0x140008c17
lea rdx, [r14 + r9]
add rdx, rbp
nop
cmp ecx, esi
jae 0x140008c17
movzx eax, byte [rdx]
inc ecx
inc r9
mov byte [r9 - 1], al
inc rdx
cmp ecx, ebx
jb 0x140008c00
lea rdx, [rsp + 0x48]
mov r8, r13
mov rcx, r12
call fcn.140008900
lea rdx, [r12 + 0x1a0]
lea rcx, [rsp + 0x38]
mov r8d, 0x10
call fcn.14000a048
lea rcx, [rsp + 0x39]
mov edx, 4
nop dword [rax]
movzx eax, byte [rcx - 1]
add rdi, 4
add rcx, 4
xor byte [rdi - 5], al
movzx eax, byte [rcx - 4]
xor byte [rdi - 4], al
movzx eax, byte [rcx - 3]
xor byte [rdi - 3], al
movzx eax, byte [rcx - 2]
xor byte [rdi - 2], al
sub rdx, 1
jne 0x140008c50
lea r8d, [rdx + 0x10]
lea rcx, [r12 + 0x1a0]
lea rdx, [rsp + 0x48]
call fcn.14000a048
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x48]
mov r8d, r15d
call fcn.14000a048
mov r9, qword [rsp + 0x30]
add r13, 0x10
add r14, 0x10
sub qword [rsp + 0x28], 1
mov ecx, ebx
jne 0x140008bf0
mov ebp, dword [rsp + 0xb0]
mov r13d, dword [rsp + 0x20]
mov rdi, qword [rsp + 0xb8]
mov r14, qword [rsp + 0xd0]
movsxd rax, ebp
cmp ebp, esi
jae 0x140008cf1
sub esi, ebp
lea rdx, [rax + rdi]
mov rcx, r9
mov r8d, esi
call sub.msvcrt.dll_memcpy
lea rdx, [rsp + 0x48]
lea rcx, [r12 + 0x118]
mov r8d, r13d
call fcn.14000a048
mov dword [r12 + 0x198], r13d
mov dword [r14], ebp
xor eax, eax
mov r14, qword [rsp + 0x78]
mov r13, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x88]
mov rbx, qword [rsp + 0xc0]
mov r15, qword [rsp + 0x70]
add rsp, 0x90
pop r12
pop rdi
pop rsi
ret
Function at 0x140008d50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
test rcx, rcx
jne 0x140008d82
mov eax, 0xf0000002
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
movsxd rdx, dword [rcx + 0x198]
test edx, edx
je 0x140008e3e
cmp dword [r8], 0x10
jb 0x140008d6d
cmp edx, 0x10
jae 0x140008db8
mov r8d, 0x10
lea rcx, [rcx + rdx*8 + 0x118]
sub r8d, edx
xor edx, edx
shl r8, 3
call fcn.14000b45c
lea rdx, [rbx + 0x118]
lea rcx, [rsp + 0x20]
mov r8d, 0x10
call fcn.14000a048
lea rdx, [rbx + 0x1a0]
lea rcx, [rsp + 0x30]
mov r8d, 0x10
call fcn.14000a048
xor r11d, r11d
lea ecx, [r11 + 4]
nop dword [rax]
movzx eax, byte [rsp + r11 + 0x30]
add r11, 4
xor byte [rsp + r11 + 0x1c], al
movzx eax, byte [rsp + r11 + 0x2d]
xor byte [rsp + r11 + 0x1d], al
movzx eax, byte [rsp + r11 + 0x2e]
xor byte [rsp + r11 + 0x1e], al
movzx eax, byte [rsp + r11 + 0x2f]
xor byte [rsp + r11 + 0x1f], al
sub rcx, 1
jne 0x140008df0
lea rdx, [rsp + 0x20]
mov r8, rsi
mov rcx, rbx
call fcn.1400086e0
mov dword [rdi], 0x10
jmp 0x140008e44
xor r11d, r11d
mov dword [r8], r11d
mov rcx, rbx
call fcn.14000a07c
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
xor eax, eax
add rsp, 0x40
pop rdi
ret
Function at 0x140008e70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x10], rdx
push rsi
push r12
push r14
sub rsp, 0x90
mov esi, r8d
mov r14, rdx
mov r12, rcx
test rcx, rcx
jne 0x140008ea6
mov eax, 0xf0000002
add rsp, 0x90
pop r14
pop r12
pop rsi
ret
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x78], r13
mov qword [rsp + 0x70], r15
mov r15d, dword [rcx + 0x198]
lea r13d, [r15 + r8]
mov edi, r13d
and r13d, 0xf
shr edi, 4
mov dword [rsp + 0x20], r13d
mov ebp, edi
shl ebp, 4
cmp dword [rax], ebp
jae 0x140008ef5
mov eax, 0xf0000002
jmp 0x14000907e
lea rdx, [rcx + 0x118]
lea rcx, [rsp + 0x48]
mov r8d, r15d
mov qword [rsp + 0xc0], rbx
call fcn.14000a048
lea rax, [rsp + r15 + 0x48]
mov qword [rsp + 0x30], rax
mov rbx, rax
test edi, edi
je 0x140009035
mov r13, qword [rsp + 0xb8]
mov r14, rax
mov eax, edi
xor ecx, ecx
mov qword [rsp + 0x28], rax
neg r14
nop dword [rax]
lea edi, [rcx + 0x10]
cmp ecx, edi
jae 0x140008f66
lea rdx, [r14 + rbx]
add rdx, r13
nop
cmp ecx, esi
jae 0x140008f66
movzx eax, byte [rdx]
inc ecx
inc rbx
mov byte [rbx - 1], al
inc rdx
cmp ecx, edi
jb 0x140008f50
lea rdx, [r12 + 0x1a0]
lea rcx, [rsp + 0x38]
mov r8d, 0x10
call fcn.14000a048
xor r11d, r11d
lea ecx, [r11 + 4]
nop word [rax + rax]
movzx eax, byte [rsp + r11 + 0x38]
add r11, 4
xor byte [rsp + r11 + 0x44], al
movzx eax, byte [rsp + r11 + 0x35]
xor byte [rsp + r11 + 0x45], al
movzx eax, byte [rsp + r11 + 0x36]
xor byte [rsp + r11 + 0x46], al
movzx eax, byte [rsp + r11 + 0x37]
xor byte [rsp + r11 + 0x47], al
sub rcx, 1
jne 0x140008f90
mov r8, qword [rsp + 0xc8]
lea rdx, [rsp + 0x48]
mov rcx, r12
call fcn.1400086e0
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x48]
mov r8d, r15d
call fcn.14000a048
mov rdx, qword [rsp + 0xc8]
mov rbx, qword [rsp + 0x30]
lea rcx, [r12 + 0x1a0]
mov r8d, 0x10
call fcn.14000a048
add qword [rsp + 0xc8], 0x10
add r14, 0x10
sub qword [rsp + 0x28], 1
mov ecx, edi
jne 0x140008f40
mov r13d, dword [rsp + 0x20]
mov r14, qword [rsp + 0xb8]
movsxd rax, ebp
cmp ebp, esi
jae 0x14000904d
sub esi, ebp
lea rdx, [rax + r14]
mov rcx, rbx
mov r8d, esi
call sub.msvcrt.dll_memcpy
lea rdx, [rsp + 0x48]
lea rcx, [r12 + 0x118]
mov r8d, r13d
call fcn.14000a048
mov rax, qword [rsp + 0xd0]
mov rbx, qword [rsp + 0xc0]
mov dword [r12 + 0x198], r13d
mov dword [rax], ebp
xor eax, eax
mov r13, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x88]
mov r15, qword [rsp + 0x70]
add rsp, 0x90
pop r14
pop r12
pop rsi
ret
Function at 0x14000a12c
Capabilities:
Allocate thread local storage
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
xor edi, edi
mov ebx, edi
mov dword [rsp + 0x50], ebx
cmp ebx, 0x43f
ja 0x14000a1b7
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
cmp rax, rdi
je 0x14000a1af
mov qword [rsp + 0x58], rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x10
lea r8, [rsp + 0x30]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp eax, edi
je 0x14000a1a7
cmp qword [rsp + 0x58], 0x10
jne 0x14000a1a7
cmp dword [rsp + 0x30], 0x65ab8e71
jne 0x14000a1a7
mov dword [0x140017bac], ebx
mov al, 1
jmp 0x14000a1e2
jmp 0x14000a1af
inc ebx
mov dword [rsp + 0x50], ebx
jmp 0x14000a143
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ecx, eax
or eax, 0xffffffff
lock cmpxchg dword [0x140017bac], ecx
or ebx, 0xffffffff
cmp eax, ebx
je 0x14000a1d7
call qword [sym.imp.KERNEL32.dll_TlsFree]
mov ecx, dword [0x140017bac]
cmp ecx, ebx
setne al
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x14000a264
Capabilities:
Terminate thread

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TerminateThread]
neg eax
sbb eax, eax
not eax
and eax, 0xf0000010
add rsp, 0x28
ret

Function at 0x14000a28c
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov eax, dword [0x140017bac]
mov rdi, qword [rcx + 0x10]
mov rsi, rcx
mov ebx, 0xf0000010
cmp eax, 0xffffffff
jne 0x14000a2bb
call fcn.14000a12c
test al, al
je 0x14000a2e5
test rdi, rdi
jne 0x14000a2df
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsi + 8], eax
jne 0x14000a2e5
mov ecx, dword [0x140017bac]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rax, rax
je 0x14000a2e5
mov byte [rdi + 4], 1
xor ebx, ebx
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14000a300
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [0x140017bac]
xor ebx, ebx
cmp eax, 0xffffffff
jne 0x14000a318
call fcn.14000a12c
mov ecx, dword [0x140017bac]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp rax, rbx
je 0x14000a32d
lea rbx, [rax + 4]
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x14000a33c
Capabilities:
Create thread
Resume thread
Terminate thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x30
mov eax, dword [0x140017bac]
mov ebx, r9d
mov r13, r8
mov r14d, edx
mov rsi, rcx
mov edi, 0xf0000010
cmp eax, 0xffffffff
jne 0x14000a382
call fcn.14000a12c
test al, al
je 0x14000a468
cmp ebx, 0xfffffffe
je 0x14000a3a4
cmp ebx, 0xffffffff
je 0x14000a3a4
test ebx, ebx
je 0x14000a3a4
cmp ebx, 1
je 0x14000a3a4
cmp ebx, 2
je 0x14000a3a4
mov edi, 0xf000000c
jmp 0x14000a468
mov ecx, 0x18
call fcn.140009fdc
mov ecx, 0x10
mov r12, rax
call fcn.140009fdc
mov rbp, rax
test r12, r12
je 0x14000a458
test rax, rax
je 0x14000a458
and qword [rax + 8], 0
mov rcx, qword [rsp + 0x70]
mov dword [rax], 0x65ab8e71
mov byte [rax + 4], 0
mov qword [r12 + 8], rcx
lea rcx, [rsi + 8]
mov qword [rsp + 0x28], rcx
lea r8, [0x14000a1f8]
mov rdx, r14
xor ecx, ecx
mov r9, r12
mov qword [r12], r13
mov qword [r12 + 0x10], rax
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi], rax
test rax, rax
je 0x14000a458
test ebx, ebx
je 0x14000a433
mov edx, ebx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
je 0x14000a444
mov rcx, qword [rsi]
xor edi, edi
mov qword [rsi + 0x10], rbp
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x14000a468
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
call fcn.14000a07c
mov rcx, rbp
call fcn.14000a07c
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov eax, edi
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop r13
pop r12
ret