joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5463d7
Capabilities:
Encrypt data using speck

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov ebx, edx
mov rsi, rcx
mov rcx, qword [rcx + 8]
mov rax, qword [rcx + 0x30]
test rax, rax
je 0x54641d
movabs rcx, 0xcac778cad4cf761c
sub rsi, rcx
add rcx, rsi
add rcx, 0x10
movzx edx, bl
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp rax
mov al, byte [rcx + 0x10]
cmp al, 0x18
jae 0x54644c
cmp al, 0x16
jne 0x5464b2
add rsi, 0x10
mov rdx, qword [rcx + 0x18]
mov rcx, rsi
mov r8d, ebx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.00546133
jne 0x5464b2
mov r12, rsi
add r12, 0x10
je 0x5464b2
mov r14, qword [r12]
test r14, r14
jle 0x5464b2
movabs r15, 0x46abc81e7917027e
dec r14
xor edi, edi
mov rax, qword [rcx + 0x18]
mov rdx, qword [rax + 8]
mov ecx, 0x10
call fcn.00546387
add rax, r15
add rax, r12
sub rax, r15
mov rcx, qword [rsi + 8]
mov rdx, qword [rcx + 0x18]
mov rcx, qword [rdx]
imul rcx, rdi
add rcx, rax
mov r8d, ebx
call fcn.00546133
cmp r14, rdi
je 0x5464b2
inc rdi
mov rcx, qword [rsi + 8]
jmp 0x54646f
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x549ca0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x138
mov rdi, rdx
mov r12, rcx
call qword [0x0215b5d0]
test rax, rax
jne 0x549de3
lea rbx, [rsp + 0x30]
mov r8d, 0xfa
mov rcx, rbx
xor edx, edx
call fcn.005f4c10
mov byte [rbx], 0x5f
mov esi, 1
mov qword [rsp + 0x28], rdi
mov al, byte [rdi + rsi - 1]
test al, al
je 0x549d07
mov byte [rsp + rsi + 0x30], al
inc rsi
cmp rsi, 0xf5
jne 0x549cea
mov esi, 0xf5
movabs r13, 0x39cc3609ecb74d40
movabs rbp, 0x310975bb64926db0
mov byte [rsp + rsi + 0x30], 0x40
xor ebx, ebx
movabs r14, 0xcccccccccccccccd
mov rdi, rbp
not rdi
movabs r15, 0x6666666666666667
cmp rbx, 0x32
ja 0x549df7
lea rcx, [rbx*4]
xor eax, eax
cmp rbx, 2
seta al
inc rax
cmp rbx, 0x19
mov edx, 3
cmovae rax, rdx
add rsi, r13
add rsi, rax
sub rsi, r13
mov byte [rsp + rsi + 0x31], 0
mov rax, rcx
mul r14
shr edx, 2
and edx, 0xfffffffe
lea eax, [rdx + rdx*4]
mov edx, ecx
sub edx, eax
mov eax, edx
not al
and al, 0x6c
and dl, 3
or dl, al
xor dl, 0x5c
mov byte [rsp + rsi + 0x30], dl
add rsi, rbp
add rsi, rdi
mov rax, rcx
imul r15
mov rax, rdx
shr rax, 0x3f
sar rdx, 2
add rdx, rax
add rcx, 9
cmp rcx, 0x12
mov rcx, rdx
ja 0x549d75
mov rcx, r12
lea rdx, [rsp + 0x30]
call qword [0x0215b5d0]
xor ecx, ecx
test rax, rax
sete cl
add rbx, rcx
test rax, rax
je 0x549d3c
add rsp, 0x138
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x28]
call fcn.00549c47
int3
Function at 0x54b13f
Capabilities:
Encode data using xor

Disassembly:
push rsi
test rcx, rcx
je 0x54b1be
mov r8, qword [rcx]
movabs rax, 0x643812b8e1884ab0
mov rdx, rax
not rdx
add rdx, r8
add rdx, rax
js 0x54b1be
movabs r9, 0xb0b643600b7eb311
xor r11d, r11d
mov r10, r9
not r10
xor edx, edx
movzx eax, byte [rcx + r11 + 0x10]
add rax, rdx
mov rdx, rax
shl rdx, 0xa
add rdx, rax
mov rax, rdx
shr rax, 6
mov rsi, rax
not rsi
and rsi, r9
and rax, r10
or rax, rsi
mov rsi, rdx
not rsi
and rsi, r9
and rdx, r10
or rdx, rsi
xor rdx, rax
inc r11
cmp r8, r11
jne 0x54b175
lea rcx, [rdx + rdx*8]
jmp 0x54b1c0
xor ecx, ecx
mov rax, rcx
shr rax, 0xb
mov rdx, rax
not rdx
and rdx, rcx
not rcx
and rcx, rax
or rcx, rdx
mov rax, rcx
shl rax, 0xf
add rax, rcx
pop rsi
ret
Function at 0x551bfb
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
mov r14, r8
cmp r8, 0x11
mov r15d, 0x10
cmovl r15, r8
mov rdi, rdx
mov rsi, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
test r8, r8
jle 0x551c55
test r15, r15
jns 0x551c43
movabs r8, 0x7fffffffffffffff
mov rcx, r15
xor edx, edx
call fcn.00547f4d
lea rdx, [rsi + 0x3e8]
mov rcx, rdi
mov r8, r15
call fcn.005f4c20
mov rax, qword [rsi + 0x408]
shl rax, 3
bswap rax
lea rdx, [rsp + 0x30]
mov qword [rdx], rax
mov rax, qword [rsi + 0x410]
shl rax, 3
bswap rax
mov qword [rdx + 8], rax
lea rcx, [rsi + 0x3f8]
lea r8, [rsi + 0x3c8]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], 0x10
mov edx, 0x10
mov r9d, 0x10
call fcn.00550f65
test r14, r14
jle 0x551cdf
xor eax, eax
mov cl, byte [rdi + rax]
mov bl, byte [rsi + rax + 0x3f8]
mov edx, ebx
not dl
and dl, 0x2b
and bl, 0xd4
or bl, dl
mov edx, ecx
not dl
and dl, 0x2b
and cl, 0xd4
or cl, dl
xor cl, bl
mov byte [rdi + rax], cl
inc rax
cmp rax, r15
jl 0x551cb0
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x5568d7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r14, rdx
mov r15, rcx
test rcx, rcx
je 0x5568fa
mov rcx, r15
call fcn.005f4bd8
mov rbx, rax
jmp 0x5568fc
xor ebx, ebx
test r14, r14
je 0x5569fa
mov rcx, r14
call fcn.005f4bd8
test rbx, rbx
sete cl
test rax, rax
sete dl
mov rsi, rbx
or rsi, rax
je 0x5569fc
xor cl, dl
jne 0x5569fc
movzx ecx, byte [r15]
movzx edx, byte [r14]
cmp cl, dl
jne 0x556a18
movabs r8, 0xab99d465b953ee99
mov edx, 1
mov ecx, 1
cmp rcx, rbx
mov r9, rbx
cmovge r9, rcx
cmp rcx, rbx
jge 0x55697b
lea rdi, [rcx + 1]
cmp byte [r15 + rcx], 0x5f
mov rcx, rdi
je 0x55695b
sete cl
movzx ecx, cl
lea r9, [rcx + rdi]
dec r9
cmp rdx, rax
jge 0x556992
cmp byte [r14 + rdx], 0x5f
jne 0x556992
inc rdx
cmp rax, rdx
jne 0x556980
mov rdx, rax
cmp r9, rbx
jge 0x5569ae
movzx edi, byte [r15 + r9]
lea ecx, [rdi - 0x41]
lea esi, [rdi + 0x20]
cmp cl, 0x1a
movzx ecx, sil
cmovae ecx, edi
jmp 0x5569b0
xor ecx, ecx
cmp rdx, rax
jge 0x5569ce
movzx esi, byte [r14 + rdx]
lea r10d, [rsi - 0x41]
lea edi, [rsi + 0x20]
cmp r10b, 0x1a
movzx edi, dil
cmovae edi, esi
jmp 0x5569d0
xor edi, edi
movzx ecx, cl
movzx edi, dil
add rcx, r8
sub rcx, rdi
sub rcx, r8
jne 0x556a09
cmp r9, rbx
jge 0x556a2d
cmp rdx, rax
jge 0x556a3a
inc r9
inc rdx
mov rcx, r9
jmp 0x556951
xor eax, eax
sub rbx, rax
jno 0x556a06
call fcn.005463cd
mov rcx, rbx
mov rax, rcx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
movabs rax, 0x7ff7ac907d5766ea
sub rcx, rax
sub rcx, rdx
add rcx, rax
jmp 0x556a09
xor ecx, ecx
cmp rdx, rax
setl cl
neg rcx
jmp 0x556a09
mov ecx, 1
jmp 0x556a09
Function at 0x55eb12
Capabilities:
Hash data using murmur3

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov r12, rdx
mov qword [rsp + 0x30], rcx
lea rbx, [rdx + 3]
test rdx, rdx
cmovns rbx, rdx
and rbx, 0xfffffffffffffffc
mov r13, rdx
sub r13, rbx
movabs rax, 0xd2b1381518b0fc7c
mov rcx, rax
not rcx
add rcx, rdx
add rcx, rax
mov qword [rsp + 0x28], rcx
xor r15d, r15d
mov ebp, 0x1df4c8b8
mov r14d, 0xe20b3747
xor esi, esi
cmp r15, rbx
jge 0x55ea04
cmp r15, r12
jl 0x55e9b3
mov rcx, r15
mov rdx, qword [rsp + 0x28]
call fcn.005482d0
mov rax, qword [rsp + 0x30]
mov edi, dword [rax + r15]
add r15, 4
jno 0x55e9c7
call fcn.005463cd
imul eax, edi, 0xcc9e2d51
imul ecx, edi, 0x16a88000
shr eax, 0x11
or eax, ecx
imul eax, eax, 0x1b873593
mov ecx, eax
not ecx
and ecx, ebp
and eax, r14d
or eax, ecx
mov ecx, esi
not ecx
and ecx, ebp
and esi, r14d
or esi, ecx
xor esi, eax
rol esi, 0xd
lea esi, [rsi + rsi*4]
add esi, 0xe6546b64
jmp 0x55e99c
test r13, r13
jle 0x55ea61
lea rdi, [r13 - 1]
xor ebp, ebp
mov rbx, r15
add rbx, rdi
jno 0x55ea1c
call fcn.005463cd
test rbx, rbx
setns al
cmp rbx, r12
setge cl
cmp al, cl
je 0x55ea31
test rbx, rbx
jns 0x55ea3e
mov rcx, rbx
mov rdx, qword [rsp + 0x28]
call fcn.005482d0
dec r13
shl ebp, 8
mov rax, qword [rsp + 0x30]
movzx eax, byte [rax + rbx]
or ebp, eax
lea rax, [rdi - 1]
inc rdi
cmp rdi, 1
mov rdi, rax
jg 0x55ea0f
jmp 0x55ea63
xor ebp, ebp
imul eax, ebp, 0xcc9e2d51
imul ecx, ebp, 0x16a88000
shr eax, 0x11
or eax, ecx
imul eax, eax, 0x1b873593
mov ecx, esi
not ecx
mov edx, 0xeb8bf3d4
and ecx, edx
mov ebp, 0x14740c2b
and esi, ebp
or esi, ecx
mov ecx, r12d
not ecx
and ecx, edx
and r12d, ebp
or r12d, ecx
xor r12d, esi
mov ecx, r12d
not ecx
and ecx, eax
not eax
and eax, r12d
or eax, ecx
mov ecx, eax
shr ecx, 0x10
mov edx, ecx
not edx
and edx, eax
not eax
and eax, ecx
or eax, edx
imul eax, eax, 0x85ebca6b
mov ecx, eax
shr ecx, 0xd
mov edx, ecx
not edx
mov ebp, 0xf62de500
and edx, ebp
and ecx, 0x21aff
or ecx, edx
mov edx, eax
not edx
and edx, ebp
and eax, 0x9d21aff
or eax, edx
xor eax, ecx
imul eax, eax, 0xc2b2ae35
mov ecx, eax
shr ecx, 0x10
mov edx, ecx
not edx
and edx, eax
not eax
and eax, ecx
or eax, edx
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
push rsi
sub rsp, 0x20
mov rsi, rcx
test rcx, rcx
je 0x55eb31
mov rdx, qword [rsi]
test rdx, rdx
jns 0x55eb33
call fcn.005491fc
mov rdx, qword [rsi]
jmp 0x55eb33
xor edx, edx
add rsi, 0x10
mov rcx, rsi
add rsp, 0x20
pop rsi
jmp 0x55e944
Function at 0x55eda3
Capabilities:
Hash data using murmur3

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
test rcx, rcx
je 0x55ece5
mov rsi, rcx
mov r15, qword [rcx]
test r15, r15
jle 0x55ece5
movabs r14, 0x7ff7ac907d5766ea
xor ebx, ebx
xor edi, edi
cmp rdi, qword [rsi]
jl 0x55ec8f
test rsi, rsi
je 0x55ec82
mov rdx, qword [rsi]
jmp 0x55ec84
xor edx, edx
dec rdx
mov rcx, rdi
call fcn.005482d0
mov al, byte [rsi + rdi + 0x10]
cmp al, 0x5f
je 0x55ecdb
lea ecx, [rax - 0x41]
lea edx, [rax + 0x20]
cmp cl, 0x1a
movzx eax, al
movzx ecx, dl
cmovae ecx, eax
movzx eax, cl
add rbx, r14
add rbx, rax
sub rbx, r14
mov rax, rbx
shl rax, 0xa
add rax, rbx
mov rcx, rax
shr rcx, 6
mov rdx, rcx
not rdx
and rdx, rax
not rax
and rax, rcx
or rax, rdx
mov rbx, rax
inc rdi
cmp r15, rdi
jne 0x55ec73
jmp 0x55ece7
xor ebx, ebx
lea rcx, [rbx + rbx*8]
mov rax, rcx
shr rax, 0xb
mov rdx, rax
not rdx
and rdx, rcx
not rcx
and rcx, rax
or rcx, rdx
mov rax, rcx
shl rax, 0xf
add rax, rcx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov al, byte [rcx + 0x18]
cmp al, 2
je 0x55edba
cmp al, 1
je 0x55edc2
test al, al
jne 0x55edca
mov rcx, rdx
jmp fcn.0055eb12
mov rcx, rdx
jmp 0x55ec42
mov rcx, rdx
jmp fcn.0055eb44
xor eax, eax
ret
Function at 0x565934
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov eax, r8d
lea r8, [rdx + 7]
test rdx, rdx
cmovns r8, rdx
cmp rdx, 8
jl 0x565b47
mov qword [rsp + 8], rdx
sar r8, 3
mov r9, 0xffffffffffffffff
movabs r15, 0x2a0d2f67f6ad9500
xor r11d, r11d
mov qword [rsp], rcx
mov rcx, r15
not rcx
mov qword [rsp + 0x10], rcx
and r15, 0xfffffffffffffffb
mov qword [rsp + 0x18], r15
lea r15, [0x0060ff80]
mov r13, r8
xor ebp, ebp
mov r12d, 0xe20b3747
mov r14, qword [rsp]
mov edx, dword [r14 + r11]
mov edi, edx
not edi
and edi, eax
not eax
and eax, edx
or eax, edi
mov rdx, r9
movabs rbx, 0x2a0d2f67f6ad9500
and rdx, rbx
mov rdi, r11
mov rcx, qword [rsp + 0x10]
and rdi, rcx
or rdi, rdx
mov edx, ecx
and edx, 4
add rdx, qword [rsp + 0x18]
xor rdx, rdi
mov esi, r9d
not esi
mov edi, ebx
or edi, ecx
and edi, esi
and edi, 4
or rdi, rdx
mov edx, eax
mov ecx, 0xffffff00
xor edx, ecx
and edx, eax
mov edx, dword [r15 + rdx*4 + 0x1c00]
mov esi, eax
shr esi, 8
mov ebx, esi
mov ecx, 0xffff00
xor ebx, ecx
and ebx, esi
mov esi, dword [r15 + rbx*4 + 0x1800]
mov ebx, esi
not ebx
mov ecx, 0xec57c4a2
and ebx, ecx
mov r10d, 0x13a83b5d
and esi, r10d
or esi, ebx
mov ebx, edx
not ebx
and ebx, ecx
and edx, r10d
or edx, ebx
mov ebx, eax
shr ebx, 0x10
xor edx, esi
mov esi, ebx
mov r10d, 0xff00
xor esi, r10d
and esi, ebx
mov esi, dword [r15 + rsi*4 + 0x1400]
mov ebx, edx
not ebx
mov ecx, 0x1df4c8b8
and ebx, ecx
and edx, r12d
or edx, ebx
mov ebx, esi
not ebx
and ebx, ecx
and esi, r12d
or esi, ebx
mov r14d, dword [r14 + rdi]
xor esi, edx
shr eax, 0x18
mov edx, dword [r15 + rax*4 + 0x1000]
mov eax, esi
not eax
and eax, edx
not edx
and edx, esi
or edx, eax
mov eax, r14d
mov ecx, 0xffffff00
xor eax, ecx
and eax, r14d
mov eax, dword [r15 + rax*4 + 0xc00]
mov esi, edx
not esi
and esi, eax
not eax
and eax, edx
or eax, esi
mov rdx, r14
shr rdx, 8
mov esi, edx
mov ecx, 0xffff00
xor esi, ecx
and esi, edx
mov edx, dword [r15 + rsi*4 + 0x800]
mov esi, eax
not esi
mov ecx, 0x615498fa
and esi, ecx
mov edi, 0x9eab6705
and eax, edi
or eax, esi
mov esi, edx
not esi
and esi, ecx
and edx, edi
or edx, esi
xor edx, eax
mov rax, r14
shr rax, 0x10
mov esi, eax
xor esi, r10d
and esi, eax
mov esi, dword [r15 + rsi*4 + 0x400]
mov eax, edx
not eax
and eax, esi
not esi
and esi, edx
or esi, eax
shr r14, 0x18
mov eax, dword [r15 + r14*4]
mov edx, esi
not edx
and edx, eax
not eax
and eax, esi
or eax, edx
add r11, 8
inc rbp
add r9, 0xfffffffffffffff8
dec r13
jne 0x5659a3
shl r8, 3
mov rdx, qword [rsp + 8]
mov rcx, qword [rsp]
jmp 0x565b4a
xor r8d, r8d
cmp r8, rdx
jge 0x565b97
mov ebp, 0xf62de500
lea r9, [0x0060ff80]
movzx ebx, byte [rcx + r8]
mov edi, eax
xor edi, 0xffffff00
and edi, eax
mov esi, edi
not esi
and esi, ebp
and edi, 0x9d21aff
or edi, esi
or ebx, ebp
xor ebx, edi
mov edi, dword [r9 + rbx*4]
shr eax, 8
mov ebx, edi
not ebx
and ebx, eax
not eax
and eax, edi
or eax, ebx
inc r8
cmp rdx, r8
jne 0x565b5b
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x5cded6
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
movabs r9, 0x799d0480615498fa
movabs r10, 0x4e6563f0eb8bf3d4
xor esi, esi
mov r11, r9
not r11
mov r15, r10
not r15
xor r8d, r8d
xor r14d, r14d
lea rax, [0x00638220]
mov r12, qword [rax + r14*8]
mov rdi, qword [rcx]
mov rdx, qword [rcx + 8]
xor r13d, r13d
mov rbx, r12
btc rbx, r13
not rbx
and rbx, r12
mov rbp, rdx
cmove rbp, rbx
mov rax, r8
cmovne rbx, rdi
not rax
and rax, rbp
not rbp
and r8, rbp
or r8, rax
mov rax, rsi
not rax
and rax, r9
and rsi, r11
mov rbp, rsi
or rbp, rax
mov rax, rbx
not rax
and rax, r9
and rbx, r11
or rbx, rax
mov rsi, rbx
xor rsi, rbp
mov rbx, rdi
not rbx
and rbx, rdx
not rdx
and rdx, rdi
rol rdi, 0x37
or rbx, rdx
mov rax, rbx
not rax
and rax, rdi
not rdi
and rdi, rbx
or rax, rdi
mov rdi, rbx
shl rdi, 0xe
mov rdx, rax
not rdx
and rdx, r10
and rax, r15
or rax, rdx
mov rdx, rdi
not rdx
and rdx, r10
and rdi, r15
or rdi, rdx
xor rdi, rax
mov rdx, rbx
rol rdx, 0x24
inc r13
cmp r13, 0x40
jne 0x5cdf1f
mov qword [rcx], rdi
mov qword [rcx + 8], rdx
inc r14
cmp r14, 2
jne 0x5cdf0a
mov qword [rcx], rsi
mov qword [rcx + 8], r8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x5ce080
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
cmp rdx, 0xffffffffffffffff
je 0x5ce1c1
mov r8, rdx
test rdx, rdx
je 0x5ce252
movabs r9, 0xf31d589c29ee32d4
movabs r10, 0xc10bb21032ade1fd
movabs r11, 0xa71bb28d2dd4c5f
mov rax, 0xffffffffffffffff
xor edx, edx
div r8
mov rax, rdx
not rax
movabs rsi, 0x394639c1598ffbfc
and rax, rsi
not rsi
and rdx, rsi
or rdx, rax
xor rdx, rsi
mov rsi, qword [rcx]
mov rbx, qword [rcx + 8]
mov r14, r11
not r14
mov r15, r10
not r15
mov rax, rbx
not rax
and rax, rsi
mov r13, rsi
not r13
and r13, rbx
or r13, rax
mov r12, rsi
add rbx, r9
add rbx, rsi
shl rsi, 0x37
shr r12, 9
mov rax, r12
not rax
mov rdi, rsi
not rdi
and rax, r11
and r12, r14
or r12, rax
and rdi, r11
and rsi, r14
or rsi, rdi
xor rsi, r12
mov rdi, r13
not rdi
and rdi, rsi
not rsi
and rsi, r13
or rdi, rsi
mov rax, rbx
sub rax, r9
mov rsi, r13
shl rsi, 0xe
mov rbx, rdi
not rbx
and rbx, rsi
not rsi
and rsi, rdi
or rsi, rbx
mov rbx, r13
shl rbx, 0x24
shr r13, 0x1c
mov rdi, r13
not rdi
mov r12, rbx
not r12
and rdi, r10
and r13, r15
or r13, rdi
and r12, r10
and rbx, r15
or rbx, r12
xor rbx, r13
cmp rax, rdx
ja 0x5ce0fd
mov qword [rcx], rsi
mov qword [rcx + 8], rbx
inc r8
xor edx, edx
div r8
mov r8, rdx
jmp 0x5ce252
mov rdi, qword [rcx]
mov r8, qword [rcx + 8]
mov rbx, r8
not rbx
movabs rax, 0x87f3284a136bfc09
and rbx, rax
mov rdx, rdi
not rdx
and rdx, rax
not rax
mov rsi, r8
and rsi, rax
or rsi, rbx
and rax, rdi
or rax, rdx
xor rax, rsi
add r8, rdi
rol rdi, 0x37
mov rdx, rax
not rdx
and rdx, rdi
not rdi
and rdi, rax
or rdx, rdi
mov rsi, rax
shl rsi, 0xe
mov rdi, rdx
not rdi
movabs r9, 0x3c250cb8167187fa
and rdi, r9
mov rbx, rsi
not rbx
and rbx, r9
not r9
and rdx, r9
or rdx, rdi
and r9, rsi
or r9, rbx
xor r9, rdx
mov qword [rcx], r9
rol rax, 0x24
mov qword [rcx + 8], rax
mov rax, r8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x5ec4e0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x02129860]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x5ec500
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x5ec508
ret
cmp word [r8 + 0x18], 0x20b
jne 0x5ec500
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x5ec555
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x5ec54c
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x5ec500
add rax, 0x28
cmp rax, r9
jne 0x5ec538
xor eax, eax
ret

Function at 0x5ec560
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x02129860]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x5ec580
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x5ec588
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x5ec580
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x5ec610
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x02129860]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x5ec630
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x5ec638
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret
Function at 0x140021fa0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov ecx, dword [0x1402dae9c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
lea rbx, [rdi + 3]
xor esi, esi
shr rbx, 2
test rax, rax
je 0x140022003
mov rax, qword [rax + 8]
test rax, rax
je 0x140022003
mov rcx, qword [rax]
test rcx, rcx
je 0x140022003
mov qword [rax], rsi
movzx eax, byte [rcx]
cmp rax, rbx
jb 0x140021ffe
mov byte [rcx + rdi], al
mov rax, rcx
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
call fcn.1401fb48c
lea rcx, [rbx*4 + 1]
call fcn.1401fb140
cmp rbx, 0xff
movzx ecx, bl
cmova ecx, esi
mov byte [rax + rdi], cl
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret

Function at 0x140022030
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
sub rsp, 0x28
mov rbx, rcx
mov rdi, rdx
mov ecx, dword [0x1402dae9c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14002205d
mov r8, qword [rax + 8]
jmp 0x140022060
xor r8d, r8d
cmp rdi, 0x3fc
ja 0x140022084
test r8, r8
je 0x140022084
cmp qword [r8], 0
jne 0x140022084
movzx eax, byte [rbx + rdi]
mov byte [rbx], al
mov qword [r8], rbx
add rsp, 0x28
pop rdi
pop rbx
ret
mov rcx, rbx
add rsp, 0x28
pop rdi
pop rbx
jmp fcn.1401fb48c
Function at 0x1400223a0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
xor r9d, r9d
mov r14d, r8d
mov rsi, rdx
mov rbp, rcx
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + 8], rax
mov rdi, rax
test rax, rax
jne 0x140022403
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [rsi]
lea edx, [rdi + 1]
mov rcx, rsi
mov ebx, eax
call qword [r8]
mov dword [rsp + 0x30], ebx
call fcn.1400b35b0
mov qword [rsp + 0x38], rax
test ebx, ebx
jne 0x140022506
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbp + 0x10], rax
mov qword [rsi + 0x10], rax
cmp qword [rbp + 0x10], 0
jne 0x140022450
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [rsi]
mov edx, 1
mov rcx, rsi
mov ebx, eax
call qword [r8]
mov dword [rsp + 0x30], ebx
call fcn.1400b35b0
mov qword [rsp + 0x38], rax
test ebx, ebx
jne 0x140022518
xor ecx, ecx
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea r8, [0x140022530]
mov r9, rsi
mov dword [rsp + 0x20], ecx
mov edx, r14d
mov dword [rsp + 0x68], ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 8], rax
test rax, rax
jne 0x1400224c5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [rsi]
mov edx, 1
mov rcx, rsi
mov ebx, eax
call qword [r8]
test rdi, rdi
je 0x1400224a4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x10]
test rcx, rcx
je 0x1400224b3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x30], ebx
call fcn.1400b35b0
mov qword [rsp + 0x38], rax
test ebx, ebx
jne 0x1400224f4
test rdi, rdi
je 0x1400224e1
mov edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
lea rdx, str.thread
lea rcx, [rsp + 0x30]
call fcn.140021d20
int3
lea rdx, str.thread.entry_event
lea rcx, [rsp + 0x30]
call fcn.140021d20
int3
lea rdx, str.thread.exit_event
lea rcx, [rsp + 0x30]
call fcn.140021d20
int3
Function at 0x140023110
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rdi, rcx
xor ebx, ebx
mov dword [rsp + 0x20], ebx
call fcn.1400b35b0
mov qword [rsp + 0x28], rax
mov rdi, qword [rdi + 0x10]
mov eax, ebx
lock xadd dword [rdi + 0x30], eax
test eax, eax
jne 0x140023162
mov rcx, rdi
call fcn.140022aa0
mov dword [rsp + 0x20], ebx
call fcn.1400b35b0
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
jmp 0x140023202
mov qword [rsp + 0x60], rbx
lea rax, [rdi + 0x28]
test rdi, rdi
cmove rax, rbx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov ecx, dword [0x1402dae9c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x30]
mov ecx, dword [0x1402dae9c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
lea r8, [rsp + 0x20]
mov rcx, rdi
call fcn.140022ba0
test rax, rax
je 0x1400231e1
nop word [rax + rax]
lea rax, [rbx + 1]
cmp rbx, 0xffffffffffffffff
cmove rax, rbx
mov rbx, rax
lea r8, [rsp + 0x20]
mov rcx, rdi
call fcn.140022ba0
test rax, rax
jne 0x1400231c0
mov rdx, qword [rsp + 0x40]
mov ecx, dword [0x1402dae9c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140023202
call fcn.1401fb48c
cmp dword [rsp + 0x20], 0
jne 0x140023217
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
lea rcx, [rsp + 0x20]
call fcn.140021ce0
int3
mov rcx, qword [rcx + 0x18]
jmp 0x140023110