joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002f320
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x140309d10]
mov rcx, qword [rax + 0x4308]
mov r10, qword [rax + 0x3ea0]
movsxd rax, dword [rcx + 0x7c]
movups xmm0, xmmword [rcx + 0x170]
movss xmm4, dword [rcx + 0x170]
movss xmm3, dword [rcx + 0x174]
movss xmm2, dword [rcx + 0x178]
movss xmm1, dword [rcx + 0x17c]
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
movss dword [rsp + 0x28], xmm2
movss dword [rsp + 0x2c], xmm1
imul r9, rax, 0x68
mov rax, qword [r10 + 0x280]
add r9, qword [rcx + 0x18]
movups xmmword [r10 + 0x220], xmm0
movss dword [rax + 0x88], xmm4
movss dword [rax + 0x8c], xmm3
movss dword [rax + 0x90], xmm2
movss dword [rax + 0x94], xmm1
mov rax, qword [r10 + 0x280]
movups xmm0, xmmword [rsp + 0x20]
movsxd r8, dword [rax + 0x58]
mov rdx, qword [rax + 0x60]
add r8, r8
movups xmmword [rdx + r8*8 - 0x10], xmm0
movzx r8d, byte [r9 + 0x57]
mov rdx, qword [r10 + 0x280]
mov rcx, qword [rcx + 0x1a0]
add rsp, 0x38
jmp 0x140023df0

Function at 0x14002f3f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x140309d10]
mov rcx, qword [rax + 0x4308]
mov r9, qword [rax + 0x3ea0]
movups xmm0, xmmword [r9 + 0x220]
movups xmmword [rcx + 0x170], xmm0
mov rax, qword [r9 + 0x280]
movups xmm0, xmmword [rcx + 0x150]
movss xmm4, dword [rcx + 0x150]
movss xmm3, dword [rcx + 0x154]
movss xmm2, dword [rcx + 0x158]
movss xmm1, dword [rcx + 0x15c]
movups xmmword [r9 + 0x220], xmm0
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
movss dword [rsp + 0x28], xmm2
movss dword [rsp + 0x2c], xmm1
movss dword [rax + 0x88], xmm4
movss dword [rax + 0x8c], xmm3
movss dword [rax + 0x90], xmm2
movss dword [rax + 0x94], xmm1
mov rax, qword [r9 + 0x280]
movups xmm0, xmmword [rsp + 0x20]
movsxd r8, dword [rax + 0x58]
mov rdx, qword [rax + 0x60]
add r8, r8
movups xmmword [rdx + r8*8 - 0x10], xmm0
movzx r8d, byte [rcx + 0x207]
mov rcx, qword [rcx + 0x1a0]
mov rdx, qword [r9 + 0x280]
add rsp, 0x38
jmp 0x140023df0
Function at 0x14003ee30
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140309b80]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov edi, r8d
mov rsi, rdx
xor r9d, r9d
cmp ecx, 0x7b
ja 0x14003ee71
movsxd rax, ecx
lea r9, str.VK_RBUTTON
mov r9, qword [r9 + rax*8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], 0
test r9, r9
jne 0x14003eeb7
mov qword [rbp - 0x20], 0xa
movsd xmm0, qword [str.VK_RBUTTON]
movsd qword [rbp - 0x30], xmm0
movzx eax, word [0x14004bfd0]
mov word [rbp - 0x28], ax
mov byte [rbp - 0x26], r9b
jmp 0x14003eef7
mov rbx, 0xffffffffffffffff
nop
inc rbx
cmp byte [r9 + rbx], 0
jne 0x14003eec0
lea rcx, [rbp - 0x30]
cmp rbx, 0xf
ja 0x14003eeea
mov qword [rbp - 0x20], rbx
mov r8, rbx
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + rbx - 0x30], 0
jmp 0x14003eef7
movzx r8d, byte [rbp - 0x40]
mov rdx, rbx
call fcn.140035a90
cmp edi, 1
jne 0x14003ef4e
mov rax, qword [rbp - 0x18]
cmp rax, 0xa
jb 0x14003ef34
lea rbx, [rbp - 0x30]
cmp rax, 0xf
cmova rbx, qword [rbp - 0x30]
mov qword [rbp - 0x20], 0xa
lea r8d, [rdi + 9]
lea rdx, str.VK_RBUTTON
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0xa], 0
jmp 0x14003ef4e
lea r9, str.VK_RBUTTON
movzx r8d, byte [rbp - 0x40]
mov edx, 0xa
lea rcx, [rbp - 0x30]
call fcn.140035a90
mov dword [rbp - 0x3c], 0x43480000
mov dword [rbp - 0x38], 0x41f00000
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0xf
cmova rcx, qword [rbp - 0x30]
lea rdx, [rbp - 0x3c]
call fcn.140035bd0
test al, al
je 0x14003ef99
test edi, edi
jne 0x14003ef99
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], edi
xor r9d, r9d
mov r8, rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x14003efd7
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003efd2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003efd2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140047220
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400476a0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140047e84
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140047ece
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140047ece
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140047ece
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140047ece
cmp dword [rcx + 0x84], 0xe
jbe 0x140047ece
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140047ed0
xor al, al
add rsp, 0x28
ret
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x1400054a0]
mov dword [rax], 1
mov rax, qword [0x1400054b0]
mov dword [rax], 1
mov rax, qword [0x1400054c0]
mov dword [rax], 1
mov rax, qword [0x140005460]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x1400016d0
Capabilities:
Hide graphical window

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xf0
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov dword [rbp + 0x28], r9d
mov dword [rbp - 0x60], 0x50
mov dword [rbp - 0x5c], 3
mov rax, qword [sym.imp.USER32.dll_DefWindowProcA]
mov qword [rbp - 0x58], rax
mov dword [rbp - 0x50], 0
mov dword [rbp - 0x4c], 0
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x48], rax
mov rax, qword [rbp + 0x10]
mov edx, 0x7f00
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_LoadIconA]
call rax
mov qword [rbp - 0x40], rax
mov edx, 0x7f00
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_LoadCursorA]
call rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 6
mov qword [rbp - 0x28], 0
lea rax, str.NEW_EPIC_WINDOW
mov qword [rbp - 0x20], rax
mov rax, qword [rbp + 0x10]
mov edx, 0x7f00
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_LoadIconA]
call rax
mov qword [rbp - 0x18], rax
lea rax, [rbp - 0x60]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_RegisterClassExA]
call rax
test ax, ax
jne 0x1400017c2
mov r9d, 0x30
lea r8, str.ERRROR
lea rax, str.Window_Registration_failed_
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
call rax
mov eax, 1
jmp 0x1400018f4
mov qword [rsp + 0x58], 0
mov rax, qword [rbp + 0x10]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0x190
mov dword [rsp + 0x30], 0x258
mov dword [rsp + 0x28], 0x80000000
mov dword [rsp + 0x20], 0x80000000
mov r9d, 0xcf0000
lea r8, str.OKno
lea rax, str.NEW_EPIC_WINDOW
mov rdx, rax
mov ecx, 0x300
mov rax, qword [sym.imp.USER32.dll_CreateWindowExA]
call rax
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140001865
mov r9d, 0x30
lea r8, str.ERRROR
lea rax, str.Window_Creation_failed_
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
call rax
mov eax, 1
jmp 0x1400018f4
mov edx, dword [rbp + 0x28]
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_UpdateWindow]
call rax
mov edx, 0x7f02
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_LoadCursorA]
call rax
mov qword [rbp - 0x38], rax
jmp 0x1400018c7
lea rax, [rbp - 0x90]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_TranslateMessage]
call rax
lea rax, [rbp - 0x90]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_DispatchMessageA]
call rax
lea rax, [rbp - 0x90]
mov r9d, 0
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_GetMessageA]
call rax
test eax, eax
jg 0x1400018a1
mov eax, 0
add rsp, 0xf0
pop rbp
ret
Function at 0x140001d70
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x140002a42
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x140009168]
test eax, eax
je 0x140002ada
lea rax, [0x140009140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x140009170]
mov qword [rbp - 8], rax
jmp 0x140002abe
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x140002ab2
cmp qword [rbp - 0x10], 0
je 0x140002ab2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140002a78
lea rax, [0x140009140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x140002adb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x140002be0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x140002c08
mov eax, 0
jmp 0x140002c56
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140002c31
mov eax, 0
jmp 0x140002c56
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x140002c51
mov eax, 0
jmp 0x140002c56
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x140006c60
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov qword [rcx], 0
test rdx, rdx
je 0x140006ca9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140006cc5
lea rax, [rdi + 1]
cmp rax, 2
jb 0x140006ca1
mov qword [rsi], rdi
call fcn.14003af20
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [rsi + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp rax, rdi
je 0x140006cf8
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.14003af20
mov r14, qword [rsi]
mov rcx, qword [0x140175fe0]
test rcx, rcx
je 0x140006cea
mov rax, qword [rcx]
mov rdx, r14
call qword [rax]
mov qword [rsi], 0
jmp 0x140006c8f
call fcn.1400b2190
mov rcx, qword [0x140175fe0]
jmp 0x140006cd9
int3
Function at 0x140008040
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
mov eax, 0x1040
call fcn.14007d530
sub rsp, rax
mov rax, qword [0x14016e028]
xor rax, rsp
mov qword [rsp + 0x1038], rax
mov dword [rsp + 0x2c], 0xaaaaaaaa
mov ecx, dword [0x140171588]
mov dword [rsp + 0x2c], ecx
cmp ecx, 0xffffffff
jne 0x1400080e3
lea rcx, [rsp + 0x2c]
call fcn.140138690
test al, al
je 0x140008160
mov ecx, dword [rsp + 0x2c]
cmp ecx, 0xffffffff
jne 0x1400080c0
lea rcx, [rsp + 0x2c]
call fcn.140138690
test al, al
je 0x140008163
cmp dword [rsp + 0x2c], 0xffffffff
je 0x140008163
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TlsFree]
mov ecx, dword [rsp + 0x2c]
mov eax, 0xffffffff
lock cmpxchg dword [0x140171588], ecx
mov ecx, dword [rsp + 0x2c]
je 0x1400080e3
call qword [sym.imp.KERNEL32.dll_TlsFree]
mov ecx, dword [0x140171588]
mov dword [rsp + 0x2c], ecx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x14000815d
lea rsi, [rsp + 0x30]
mov r8d, 0x1000
mov rcx, rsi
xor edx, edx
call fcn.14007f940
mov ecx, dword [rsp + 0x2c]
lea rdx, [rsp + 0x33]
mov rbx, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rbx
mov ecx, 0x1000
call fcn.14007ac94
mov rdi, rax
mov r8d, 0x1000
mov rcx, rax
mov rdx, rsi
call fcn.14007f530
mov ecx, dword [rsp + 0x2c]
mov rdx, rdi
or rdx, 3
call rbx
mov rcx, qword [rsp + 0x1038]
xor rcx, rsp
call fcn.14007d5a0
mov rax, rdi
add rsp, 0x1040
pop rbx
pop rdi
pop rsi
ret
int3
int3
int3
Function at 0x140008940
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, qword [0x140179758]
cmp rsi, 1
jbe 0x140008985
mov ecx, dword [0x140171588]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400089cb
movsxd rcx, dword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 4]
jne 0x1400089cb
mov rax, qword [rax + rcx]
test rax, rax
je 0x1400089cb
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x140179758]
call fcn.14004bff0
test al, al
je 0x1400089ce
mov qword [0x140179760], 0
lea rdi, [0x140179758]
lea rsi, [0x140179760]
mov rcx, rsi
xor edx, edx
call fcn.140050d20
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
mov r9, rdi
call fcn.14004be50
jmp 0x140008953
int3
mov rsi, qword [0x140179758]
jmp 0x140008953
Function at 0x140008e70
Capabilities:
Set thread local storage value

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rax, qword [0x14016e028]
xor rax, rsp
mov qword [rsp + 0x38], rax
test rcx, rcx
je 0x1400090c9
mov rsi, rcx
mov byte [rsp + 0x37], 0xaa
lea r14, [rcx + 0x718]
lea rbx, [rcx + 8]
mov edi, 1
xor ebp, ebp
mov r15, qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
mov r12d, 0x40
mov rcx, rbx
call r15
test al, al
jne 0x140008ef4
mov eax, edi
test edi, edi
jle 0x140008eda
pause
dec eax
jne 0x140008ed2
add ebp, edi
add edi, edi
cmp edi, 0x40
cmovge edi, r12d
cmp ebp, 0x3e8
jl 0x140008ec2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov rax, qword [r14]
mov rdi, qword [rax]
test rdi, rdi
je 0x14000909d
mov byte [rsp + 0x37], 0
mov rcx, qword [rdi]
test rcx, rcx
je 0x140008f21
mov rdx, rcx
not rdx
cmp qword [rdi + 8], rdx
je 0x140008f23
call fcn.1400a8470
xor ecx, ecx
bswap rcx
mov qword [rax], rcx
inc word [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
xorps xmm6, xmm6
movups xmmword [rdi + 0x2d8], xmm6
movups xmmword [rdi + 0x2c8], xmm6
movups xmmword [rdi + 0x2b8], xmm6
movups xmmword [rdi + 0x2a8], xmm6
movups xmmword [rdi + 0x298], xmm6
mov qword [rdi + 0x2e8], 0
xor r14d, r14d
mov r8d, 0x291
mov rcx, rdi
xor edx, edx
call fcn.14007f940
mov qword [rdi + 0x2f0], rsi
movups xmmword [rdi + 0x2f8], xmm6
mov ebp, 1
lea rbx, [0x1401715a0]
mov r12d, 0x40
mov rcx, rbx
call r15
test al, al
jne 0x140008fd2
mov eax, ebp
test ebp, ebp
jle 0x140008fb3
pause
dec eax
jne 0x140008faa
add r14d, ebp
add ebp, ebp
cmp ebp, 0x40
cmovge ebp, r12d
cmp r14d, 0x3e8
jl 0x140008f9a
lea rcx, [0x1401715a0]
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov qword [rdi + 0x300], 0
mov rax, qword [0x1401715a8]
mov qword [0x1401715a8], rdi
mov qword [rdi + 0x2f8], rax
test rax, rax
je 0x140008ffe
mov qword [rax + 0x300], rdi
lea rcx, [0x1401715a0]
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
add rsi, 0x10
mov eax, 0xa
cmp qword [rsi], 0
je 0x14000903c
mov ecx, dword [rsi + 0x18]
cmp ecx, 0x10000
jae 0x1400090c6
mov word [rdi + rax], cx
cmp ecx, 0x80
ja 0x140009046
mov byte [rdi + rax - 1], 0x80
jmp 0x14000905a
mov dword [rdi + rax - 2], 0
jmp 0x14000905a
cmp ecx, 0x100
ja 0x140009055
mov byte [rdi + rax - 1], 0x40
jmp 0x14000905a
mov byte [rdi + rax - 1], 0x20
add rax, 0x10
add rsi, 0x28
cmp rax, 0x29a
jne 0x140009014
mov ecx, dword [0x1401797f8]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14007d5a0
mov rax, rdi
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rax, [rsp + 0x37]
mov qword [rsp + 0x20], rax
mov r9d, 0x308
mov rcx, r14
mov rdx, rsi
mov r8d, 2
call fcn.140002610
mov rdi, rax
jmp 0x140008f2d
int3
int3
Function at 0x14000a620
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
mov rax, qword [0x14016e028]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rax, [0x140149098]
mov qword [rcx], rax
lea rax, [0x14014a2c0]
mov qword [rcx + 8], rax
mov eax, dword [0x140179c88]
mov ecx, dword [0x1401719a0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000a79f
lea rdi, [rsi + 8]
mov ecx, dword [0x140171588]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14000a7e2
movsxd rcx, dword [0x140179c80]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x140179c84]
jne 0x14000a7e2
mov rcx, qword [rax + rcx]
mov rdx, rsi
call fcn.1400510d0
call fcn.14006dd80
mov rcx, rax
mov rdx, rdi
xor r8d, r8d
call fcn.140061ac0
mov rdi, qword [rsi + 0x10]
add rdi, 8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x14000a792
mov rcx, rsi
call fcn.140137a20
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [rsp + 0x2c]
mov dword [rdx], eax
mov ecx, 0x308
add rcx, qword [rsi + 0x10]
call fcn.1400bc280
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov rdi, qword [rsi + 0x10]
mov ecx, dword [0x140171588]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14000a749
movsxd rcx, dword [rdi + 0x2f0]
shl rcx, 4
mov qword [rax + rcx], 0
mov ecx, dword [rdi + 0x2f4]
movsxd rdx, dword [rdi + 0x2f0]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rdi, qword [rsi + 0x18]
mov qword [rsi + 0x18], 0
test rdi, rdi
je 0x14000a77d
mov rcx, rdi
call fcn.1400fde60
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14007d5a0
mov rcx, rdi
add rsp, 0x38
pop rdi
pop rsi
jmp fcn.14007a98c
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14007d5a0
nop
add rsp, 0x38
pop rdi
pop rsi
ret
mov rcx, rdi
call fcn.140039d60
jmp 0x14000a6df
lea rcx, [0x140179c88]
call fcn.14007b4e8
cmp dword [0x140179c88], 0xffffffff
jne 0x14000a672
mov qword [0x140179c80], 0
lea rcx, [0x140179c80]
xor edx, edx
call fcn.140050d20
lea rcx, [0x140179c88]
call fcn.14007ac34
jmp 0x14000a672
xor ecx, ecx
jmp 0x14000a6ab
Function at 0x14000eda0
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov ebx, r8d
mov esi, edx
mov rdi, rcx
mov rax, qword [0x14016e028]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [rcx + 8], 0
je 0x14000edcf
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x14000edd2
mov rcx, qword [rdi]
mov edx, esi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x14000ee20
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [rdi + 8], 0
je 0x14000edf5
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x14000edf8
mov rcx, qword [rdi]
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14000ee2f
xor esi, esi
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14007d5a0
mov eax, esi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
test bl, bl
je 0x14000ee74
cmp byte [rdi + 8], 0
jne 0x14000ee60
mov rcx, qword [rdi]
jmp 0x14000ee69
mov dword [rsp + 0x24], 0xaaaaaaaa
cmp byte [rdi + 8], 0
jne 0x14000ee42
mov rcx, qword [rdi]
jmp 0x14000ee4b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x14000ee74
mov esi, dword [rsp + 0x24]
jmp 0x14000ee74
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
mov edx, esi
call fcn.1400f8090
mov sil, 1
jmp 0x14000ee09
Function at 0x14000f330
Capabilities:
Get thread local storage value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rdi, rdx
mov r14, rcx
mov rax, qword [0x14016e028]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov qword [rcx], 0
mov byte [rcx + 8], 0
mov eax, dword [0x140179c08]
mov ecx, dword [0x1401719a0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000f4d5
mov ecx, dword [0x140171588]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14000f4b5
movsxd rcx, dword [0x140179c00]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x140179c04]
jne 0x14000f4b5
mov rsi, qword [rax + rcx]
test rsi, rsi
je 0x14000f4b5
movabs r12, 0x6000000000000000
movabs r15, 0xffffffffffffff
mov rax, qword [rsi]
mov rbx, rax
and rbx, r15
and rax, r12
movabs rcx, 0x4000000000000000
cmp rax, rcx
jne 0x14000f426
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14000f413
mov r13, qword [rsi]
call qword [rcx + 8]
movabs rcx, 0xff00000000000000
and rcx, r13
or rcx, rax
mov qword [rsi], rcx
movabs rax, 0xbfffffffffffffff
lock and qword [rsi], rax
mov byte [r14 + 8], 1
movabs r13, 0x8000000000000001
mov qword [r14], rbx
lea rbx, [rsp + 0x20]
mov rcx, rbx
call qword [fcn.14003c7a0]
mov rax, qword [rbx]
lea rcx, [rdi + r13]
cmp rcx, 2
jae 0x14000f45f
cmp rax, rdi
je 0x14000f481
add rax, r13
cmp rax, 1
ja 0x14000f481
int3
xor ecx, ecx
mov rdx, rax
add rdx, rdi
setns cl
movabs rdx, 0x7fffffffffffffff
add rdx, rcx
add rax, rdi
cmovo rax, rdx
mov rdi, rax
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14000f4a3
mov rbx, qword [rsi]
call qword [rcx + 8]
movabs rcx, 0xff00000000000000
and rcx, rbx
or rcx, rax
mov qword [rsi], rcx
mov rax, qword [rsi]
and rax, r12
and rdi, r15
or rdi, rax
mov qword [rsi], rdi
inc dword [rsi + 0x14]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14007d5a0
mov rax, r14
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x140179c08]
call fcn.14007b4e8
cmp dword [0x140179c08], 0xffffffff
jne 0x14000f384
mov qword [0x140179c00], 0
lea rcx, [0x140179c00]
xor edx, edx
call fcn.140050d20
lea rcx, [0x140179c08]
call fcn.14007ac34
jmp 0x14000f384

Function at 0x14000f5e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14000f600
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
repz ret