joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006a2c0
Capabilities:
Hash data using sha256

Disassembly:
push rbx
mov eax, 0x20
call fcn.1400cc090
sub rsp, rax
lea r8d, [rax + 0x50]
xor edx, edx
mov rbx, rcx
call fcn.1400ce270
mov dword [rbx], 0x6a09e667
mov dword [rbx + 4], 0xbb67ae85
mov dword [rbx + 8], 0x3c6ef372
mov dword [rbx + 0xc], 0xa54ff53a
mov dword [rbx + 0x10], 0x510e527f
mov dword [rbx + 0x14], 0x9b05688c
mov dword [rbx + 0x18], 0x1f83d9ab
mov dword [rbx + 0x1c], 0x5be0cd19
mov dword [rbx + 0x6c], 0x20
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x14006ce10
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x38
call fcn.1400cc090
sub rsp, rax
cmp dword [rsp + 0x68], 0
je 0x14006ce39
lea rax, [0x14006b3e0]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.140066c20
lea rax, [0x14006a540]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.140066950
Function at 0x140070d79
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x140070f69
push rbx
mov eax, 0xd0
call fcn.1400cc090
sub rsp, rax
mov rax, qword [0x140175060]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xe8], rbp
mov qword [rsp + 0xf0], rsi
mov qword [rsp + 0xf8], rdi
mov qword [rsp + 0xc8], r14
lea rbp, [r8 - 1]
mov qword [rsp + 0xc0], r15
shr rbp, 3
mov rbx, rdx
lea r14, [rcx + 0xc]
inc rbp
lea r15, [rcx + 0x14]
nop word [rax + rax]
movzx eax, byte [rbx + 1]
movzx edi, byte [rbx]
movzx esi, byte [rbx + 4]
shl eax, 8
mov rcx, r14
lea rbx, [rbx + 8]
or edi, eax
movzx eax, byte [rbx - 6]
shl eax, 0x10
or edi, eax
movzx eax, byte [rbx - 5]
shl eax, 0x18
or edi, eax
movzx eax, byte [rbx - 3]
shl eax, 8
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
or esi, eax
movzx eax, byte [rbx - 2]
shl eax, 0x10
or esi, eax
movzx eax, byte [rbx - 1]
and byte [r14], 0xdf
and byte [r15], 0xbf
or byte [r14], 0x40
or byte [r15], 0x20
shl eax, 0x18
or esi, eax
mov dword [rsp + 0x2c], esi
mov dword [rsp + 0x24], esi
call fcn.14005d240
lea rdx, [rsp + 0x30]
mov rcx, r14
call fcn.14005cf90
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
mov r8d, 1
call fcn.14005ba10
mov rcx, r15
call fcn.14005d240
lea rdx, [rsp + 0x30]
mov rcx, r15
call fcn.14005cf90
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x28]
mov r8d, 1
call fcn.14005ba10
mov r8d, dword [rsp + 0x28]
mov edx, dword [rsp + 0x2c]
xor r8d, edi
xor edi, dword [rsp + 0x20]
xor edx, esi
xor esi, dword [rsp + 0x24]
mov byte [r14], dil
mov eax, edi
shr eax, 8
mov byte [r14 + 1], al
mov eax, edi
shr edi, 0x18
shr eax, 0x10
mov byte [r14 + 2], al
mov byte [r14 + 3], dil
mov byte [r14 + 4], dl
mov eax, edx
shr eax, 8
mov byte [r14 + 5], al
mov eax, edx
shr edx, 0x18
shr eax, 0x10
mov byte [r14 + 6], al
mov byte [r14 + 7], dl
mov byte [r15], r8b
mov eax, r8d
shr eax, 8
mov byte [r15 + 1], al
mov eax, r8d
shr eax, 0x10
shr r8d, 0x18
mov byte [r15 + 2], al
mov byte [r15 + 3], r8b
mov byte [r15 + 4], sil
mov eax, esi
shr eax, 8
mov byte [r15 + 5], al
mov eax, esi
shr esi, 0x18
shr eax, 0x10
mov byte [r15 + 6], al
mov byte [r15 + 7], sil
dec rbp
jne 0x140070de0
mov r15, qword [rsp + 0xc0]
mov r14, qword [rsp + 0xc8]
mov rdi, qword [rsp + 0xf8]
mov rsi, qword [rsp + 0xf0]
mov rbp, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1400cbcb0
add rsp, 0xd0
pop rbx
ret

Function at 0x140071110
Capabilities:
Hash data using sha1

Disassembly:
push rbx
mov eax, 0x20
call fcn.1400cc090
sub rsp, rax
lea r8d, [rax + 0x40]
xor edx, edx
mov rbx, rcx
call fcn.1400ce270
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
mov dword [rbx + 0x10], 0xc3d2e1f0
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x140073c90
Capabilities:
Terminate process

Disassembly:
mov eax, 0x28
call fcn.1400cc090
sub rsp, rax
lea r8, [0x14015eb58]
lea edx, [rax - 0x26]
lea ecx, [rax - 0x1f]
mov r9d, 0xc9
call fcn.14004bf50
mov rax, qword [0x1401785f0]
mov edx, 2
test rax, rax
lea rcx, str._1_a_
lea r8, [0x14015eb70]
cmovne rcx, rax
mov r9d, 0xcc
mov qword [0x1401785f0], rcx
lea ecx, [rdx + 8]
add rsp, 0x28
jmp fcn.14004bf50
Function at 0x140073fd0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r10, dword [rdx + 8]
lea rbx, [rcx - 1]
movsxd rcx, dword [r8 + 8]
xor rcx, r10
shr rbx, 0x3f
movsxd rsi, r9d
dec rbx
lea eax, [rsi - 1]
mov r11, r8
and rcx, rbx
mov rdi, rdx
xor r10d, ecx
mov dword [rdx + 8], r10d
xor dword [r8 + 8], ecx
cmp eax, 9
ja case.default.0x140074027
lea rdx, [0x140000000]
cdqe
mov ecx, dword [rdx + rax*4 + 0x741d0]
add rcx, rdx
jmp rcx
mov r9d, 0xa
cmp r9, rsi
jge case.0x140074027.10
nop dword [rax]
nop dword [rax + rax]
mov rax, qword [rdi]
mov rcx, qword [rax + r9*8]
lea rdx, [rax + r9*8]
mov rax, qword [r11]
inc r9
mov r8, qword [rax + r9*8 - 8]
xor r8, rcx
and r8, rbx
xor rcx, r8
mov qword [rdx], rcx
mov rax, qword [r11]
xor qword [rax + r9*8 - 8], r8
cmp r9, rsi
jl 0x140074040
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 0x48]
mov rdx, qword [rax + 0x48]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 0x48], rcx
mov rax, qword [r11]
xor qword [rax + 0x48], rdx
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 0x40]
mov rdx, qword [rax + 0x40]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 0x40], rcx
mov rax, qword [r11]
xor qword [rax + 0x40], rdx
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 0x38]
mov rdx, qword [rax + 0x38]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 0x38], rcx
mov rax, qword [r11]
xor qword [rax + 0x38], rdx
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 0x30]
mov rdx, qword [rax + 0x30]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 0x30], rcx
mov rax, qword [r11]
xor qword [rax + 0x30], rdx
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 0x28]
mov rdx, qword [rax + 0x28]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 0x28], rcx
mov rax, qword [r11]
xor qword [rax + 0x28], rdx
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 0x20]
mov rdx, qword [rax + 0x20]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 0x20], rcx
mov rax, qword [r11]
xor qword [rax + 0x20], rdx
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 0x18]
mov rdx, qword [rax + 0x18]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 0x18], rcx
mov rax, qword [r11]
xor qword [rax + 0x18], rdx
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 0x10]
mov rdx, qword [rax + 0x10]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 0x10], rcx
mov rax, qword [r11]
xor qword [rax + 0x10], rdx
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 8]
mov rdx, qword [rax + 8]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 8], rcx
mov rax, qword [r11]
xor qword [rax + 8], rdx
mov r8, qword [rdi]
mov rax, qword [r11]
mov rsi, qword [rsp + 0x10]
mov rdx, qword [r8]
mov rcx, qword [rax]
mov rdi, qword [rsp + 0x18]
xor rcx, rdx
and rcx, rbx
mov rbx, qword [rsp + 8]
xor rdx, rcx
mov qword [r8], rdx
mov rax, qword [r11]
xor qword [rax], rcx
ret
Function at 0x14007fba0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x28
call fcn.1400cc090
sub rsp, rax
cmp dword [0x14016078c], 0
je 0x14007fbe8
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x14007fbcd
mov dword [0x14016078c], eax
jmp 0x14007fbe8
xorps xmm2, xmm2
lea rcx, [rsp + 0x38]
mov edx, 8
call fcn.14005d6c0
cmp dword [0x14016078c], 0
jne 0x14007fc04
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xorps xmm2, xmm2
lea rcx, [rsp + 0x30]
mov edx, 4
mov dword [rsp + 0x30], eax
call fcn.14005d6c0
add rsp, 0x28
ret
Function at 0x140080fd0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
mov eax, 0xb8
call fcn.1400cc090
sub rsp, rax
mov rax, qword [0x140175060]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov r12, qword [rsp + 0x110]
xor ebx, ebx
mov rbp, r9
movsxd rsi, r8d
mov r14, rdx
mov rdi, rcx
mov eax, ebx
test r9, r9
je 0x140081036
cmp r9, qword [rcx]
je 0x14008102c
test rdx, rdx
je 0x140081229
test r8d, r8d
js 0x140081229
mov eax, 1
mov qword [rcx], r9
jmp 0x140081042
mov rbp, qword [rcx]
test rbp, rbp
je 0x140081229
mov qword [rsp + 0xb0], r15
test rdx, rdx
je 0x140081125
mov rcx, rbp
call fcn.14005b2d0
mov r15d, eax
cmp eax, 0x80
jle 0x14008107d
lea r8, str.j____int_sizeof_ctx__key_
lea rcx, str..cryptohmachmac.c
mov edx, 0x74
call fcn.14004c610
cmp r15d, esi
jge 0x1400810d4
lea rcx, [rdi + 8]
mov r8, r12
mov rdx, rbp
call fcn.14007fdc0
test eax, eax
je 0x140081218
lea rcx, [rdi + 8]
mov r8, rsi
mov rdx, r14
call fcn.140080020
test eax, eax
je 0x140081218
lea r14, [rdi + 0x98]
lea rdx, [rdi + 0x9c]
lea rcx, [rdi + 8]
mov r8, r14
call fcn.14007fd20
test eax, eax
je 0x140081218
jmp 0x1400810fc
cmp esi, 0x80
ja 0x140081218
lea rcx, [rdi + 0x9c]
mov r8, rsi
mov rdx, r14
call fcn.1400cdc90
lea r14, [rdi + 0x98]
mov dword [r14], esi
mov ecx, dword [r14]
cmp ecx, 0x80
je 0x14008112d
mov eax, ecx
mov r8d, 0x80
xor edx, edx
sub r8d, ecx
lea rcx, [rdi + 0x9c]
add rcx, rax
call fcn.1400ce270
jmp 0x14008112d
test eax, eax
je 0x140081207
lea rcx, [rsp + 0x20]
mov rax, rdi
mov rdx, rbx
sub rax, rcx
lea rsi, [rax + 0x9c]
lea r14, [rax + 0x9d]
nop dword [rax]
lea rcx, [rsp + 0x20]
add rcx, rdx
add rdx, 2
movzx eax, byte [rsi + rcx]
xor al, 0x36
mov byte [rcx], al
movzx eax, byte [r14 + rcx]
xor al, 0x36
mov byte [rcx + 1], al
cmp rdx, 0x80
jl 0x140081150
lea rcx, [rdi + 0x38]
mov r8, r12
mov rdx, rbp
call fcn.14007fdc0
test eax, eax
je 0x140081218
mov rcx, rbp
call fcn.14005b2d0
lea rdx, [rsp + 0x20]
lea rcx, [rdi + 0x38]
movsxd r8, eax
call fcn.140080020
test eax, eax
je 0x140081218
nop dword [rax + rax]
lea rcx, [rsp + 0x20]
add rcx, rbx
add rbx, 2
movzx eax, byte [rsi + rcx]
xor al, 0x5c
mov byte [rcx], al
movzx eax, byte [r14 + rcx]
xor al, 0x5c
mov byte [rcx + 1], al
cmp rbx, 0x80
jl 0x1400811b0
lea rcx, [rdi + 0x68]
mov r8, r12
mov rdx, rbp
call fcn.14007fdc0
test eax, eax
je 0x140081218
mov rcx, rbp
call fcn.14005b2d0
lea rdx, [rsp + 0x20]
lea rcx, [rdi + 0x68]
movsxd r8, eax
call fcn.140080020
test eax, eax
je 0x140081218
lea rdx, [rdi + 0x38]
lea rcx, [rdi + 8]
call fcn.140080130
test eax, eax
jne 0x14008121c
xor eax, eax
jmp 0x140081221
mov eax, 1
mov r15, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400cbcb0
add rsp, 0xb8
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400988b0
Capabilities:
Check for software breakpoints

Disassembly:
mov eax, 0x38
call fcn.1400cc090
sub rsp, rax
mov r11, rcx
cmp dword [rsp + 0x60], r9d
jne 0x14009899f
movzx r10d, byte [r8]
lea eax, [r10 - 0x6a]
cmp al, 1
ja 0x14009899f
mov qword [rsp + 0x30], rbx
lea rdx, [r8 + 1]
cmp r10b, 0x6b
jne 0x14009894e
lea ebx, [r9 - 3]
xor eax, eax
test ebx, ebx
jle 0x14009890a
movzx ecx, byte [rdx]
inc rdx
cmp cl, 0xba
je 0x14009890a
cmp cl, 0xbb
jne 0x14009893d
inc eax
cmp eax, ebx
jl 0x1400988f4
sub ebx, eax
test eax, eax
jne 0x140098952
mov dword [rsp + 0x20], 0x83
lea r9, [0x140165be8]
mov edx, 0x80
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 0xa]
call fcn.14004b7a0
mov rbx, qword [rsp + 0x30]
or eax, 0xffffffff
add rsp, 0x38
ret
mov dword [rsp + 0x20], 0x7b
lea r9, [0x140165bd0]
jmp 0x14009891f
lea ebx, [r9 - 2]
movsxd rax, ebx
cmp byte [rax + rdx], 0xcc
je 0x140098988
mov edx, 0x80
lea r9, str..crypto_rsa_rsa_x931.c
mov dword [rsp + 0x20], 0x8b
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 0xb]
call fcn.14004b7a0
mov rbx, qword [rsp + 0x30]
or eax, 0xffffffff
add rsp, 0x38
ret
mov r8d, ebx
mov rcx, r11
call fcn.1400cdc90
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret
mov edx, 0x80
lea r9, [0x140165bb8]
mov dword [rsp + 0x20], 0x70
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 9]
call fcn.14004b7a0
or eax, 0xffffffff
add rsp, 0x38
ret
Function at 0x1400ba170
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x20
call fcn.1400cc090
sub rsp, rax
mov eax, dword [r8 + 8]
mov rsi, rdx
mov rdi, rcx
cmp dword [rdx + 8], eax
jge 0x1400ba19c
mov rbx, r8
jmp 0x1400ba1a2
mov rbx, rdx
mov rsi, r8
mov edx, dword [rbx + 8]
cmp edx, dword [rcx + 0xc]
jg 0x1400ba1af
mov rax, rcx
jmp 0x1400ba1b4
call fcn.140074990
test rax, rax
jne 0x1400ba1c9
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor r8d, r8d
cmp dword [rsi + 8], r8d
jle 0x1400ba204
mov r9d, r8d
nop word [rax + rax]
mov rax, qword [rbx]
mov rcx, qword [rsi]
inc r8d
mov rdx, qword [rcx + r9]
lea r9, [r9 + 8]
xor rdx, qword [rax + r9 - 8]
mov rax, qword [rdi]
mov qword [r9 + rax - 8], rdx
cmp r8d, dword [rsi + 8]
jl 0x1400ba1e0
cmp r8d, dword [rbx + 8]
jge 0x1400ba23c
movsxd rax, r8d
lea rdx, [rax*8]
nop word [rax + rax]
mov rax, qword [rbx]
mov rcx, qword [rdi]
inc r8d
mov rax, qword [rdx + rax]
lea rdx, [rdx + 8]
mov qword [rdx + rcx - 8], rax
cmp r8d, dword [rbx + 8]
jl 0x1400ba220
mov edx, dword [rbx + 8]
mov dword [rdi + 8], edx
test edx, edx
jle 0x1400ba268
lea eax, [rdx - 1]
movsxd rcx, eax
mov rax, qword [rdi]
lea r8, [rax + rcx*8]
mov rax, qword [r8]
lea r8, [r8 - 8]
test rax, rax
jne 0x1400ba265
dec edx
test edx, edx
jg 0x1400ba253
mov dword [rdi + 8], edx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x1400c5880
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x40
call fcn.1400cc090
sub rsp, rax
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
test r8, r8
jne 0x1400c58b8
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
test rcx, rcx
je 0x1400c594f
test rdx, rdx
je 0x1400c5913
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x28], r8
call fcn.14004f4f0
test rax, rax
jne 0x1400c593b
lea rdx, [0x140172390]
sub rdx, rbx
nop dword [rax]
movzx ecx, byte [rbx]
movzx eax, byte [rbx + rdx]
sub ecx, eax
jne 0x1400c5902
inc rbx
test eax, eax
jne 0x1400c58f0
test ecx, ecx
jne 0x1400c5913
mov rcx, rdi
call fcn.1400cc998
test rax, rax
jne 0x1400c5957
mov rcx, qword [rsi + 0x10]
lea rax, [0x140172398]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rdi
call fcn.14004f4f0
test rax, rax
je 0x1400c58a6
mov rax, qword [rax + 0x10]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov rcx, r8
call fcn.1400cc998
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x1400ca5c0
Capabilities:
Encode data using base64

Disassembly:
mov eax, 8
call fcn.1400cc090
sub rsp, rax
xor r11d, r11d
mov r9d, r8d
test r8d, r8d
jle 0x1400ca6c7
mov qword [rsp], rbx
lea r10, [rdx + 1]
lea rbx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
nop dword [rax + rax]
movzx edx, byte [r10 - 1]
cmp r9d, 3
jl 0x1400ca64e
movzx eax, byte [r10]
shl edx, 8
or edx, eax
movzx eax, byte [r10 + 1]
shl edx, 8
or edx, eax
mov eax, edx
mov r8d, edx
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [rcx], al
mov eax, edx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [rcx + 1], al
mov eax, edx
shr rax, 6
and eax, 0x3f
and r8d, 0x3f
movzx eax, byte [rax + rbx]
mov byte [rcx + 2], al
movzx eax, byte [r8 + rbx]
mov byte [rcx + 3], al
jmp 0x1400ca69f
shl edx, 0x10
cmp r9d, 2
jne 0x1400ca660
movzx eax, byte [r10]
shl eax, 8
or edx, eax
mov rax, rdx
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [rcx], al
mov rax, rdx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [rcx + 1], al
cmp r9d, 1
jne 0x1400ca68d
lea eax, [r9 + 0x3c]
jmp 0x1400ca698
shr rdx, 6
and edx, 0x3f
movzx eax, byte [rdx + rbx]
mov byte [rcx + 2], al
mov byte [rcx + 3], 0x3d
sub r9d, 3
add rcx, 4
add r11d, 4
add r10, 3
test r9d, r9d
jg 0x1400ca5f0
mov rbx, qword [rsp]
mov byte [rcx], 0
mov eax, r11d
add rsp, 8
ret
mov byte [rcx], r11b
mov eax, r11d
add rsp, 8
ret

Function at 0x1400cc8e8
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.1400cc750
Function at 0x140009c4d
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
lea rcx, [0x140021018]
call fcn.140009c84
mov ecx, eax
add rsp, 0x28
jmp fcn.14001e9c0

Function at 0x140009c68
Capabilities:
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rdx
call fcn.140009c84
mov ecx, eax
mov rdx, rsi
add rsp, 0x20
pop rsi
jmp fcn.14001e9b8

Function at 0x140009c84
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [rcx + 0x18]
test eax, eax
je 0x140010a7c
dec eax
ret
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
cmp qword [rcx], 0
je 0x140010af3
lea r8, [rsp + 0x2c]
and dword [r8], 0
lea rbx, [rsi + 0x10]
mov rcx, rbx
xor edx, edx
xor r9d, r9d
call sub.KERNEL32.dll_InitOnceBeginInitialize
cmp eax, 1
jne 0x140010b3a
cmp dword [rsp + 0x2c], 0
je 0x140010b1b
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x140010b2a
mov edi, eax
inc eax
mov dword [rsi + 0x18], eax
mov rax, qword [0x1400290d8]
mov qword [rsi + 8], rax
lock cmpxchg qword [0x1400290d8], rsi
jne 0x140010ace
mov byte [0x1400290d0], 1
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
jmp 0x140010b20
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x140010b3a
mov edi, eax
mov ecx, eax
inc ecx
xor eax, eax
lock cmpxchg dword [rsi + 0x18], ecx
je 0x140010b20
mov esi, eax
mov ecx, edi
call sub.KERNEL32.dll_TlsFree
dec esi
mov edi, esi
jmp 0x140010b20
mov edi, dword [rsi + 0x18]
dec edi
mov eax, edi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov rcx, rbx
mov edx, 4
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
ud2

Function at 0x14000d62f
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
call fcn.140009c84
mov ecx, eax
add rsp, 0x28
jmp fcn.14001e9c0
Function at 0x14000f143
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov esi, ecx
mov eax, 0x30
mov rax, qword gs:[eax]
mov rax, qword [rax + 0x60]
mov rdi, qword [rax + 0x18]
add rdi, 0x10
mov rdi, qword [rdi]
movzx edx, word [rdi + 0x58]
mov rcx, qword [rdi + 0x60]
call fcn.14000f223
cmp eax, 0x1edab0ed
jne 0x14000f16b
mov rbx, qword [rdi + 0x30]
movsxd rax, dword [rbx + 0x3c]
mov eax, dword [rax + rbx + 0x88]
test rax, rax
je 0x14000f201
mov r15d, dword [rax + rbx + 0x18]
mov ecx, dword [rax + rbx + 0x1c]
add rcx, rbx
mov qword [rsp + 0x20], rcx
mov r12d, dword [rax + rbx + 0x20]
add r12, rbx
mov r13d, dword [rax + rbx + 0x24]
add r13, rbx
xor edi, edi
xor r14d, r14d
cmp r14, r15
je 0x14000f203
mov rbp, r14
mov ecx, dword [r12 + r14*4]
add rcx, rbx
mov rax, rcx
mov rdx, rax
inc rax
cmp byte [rdx], 0
jne 0x14000f1ce
lea r14, [rbp + 1]
sub rdx, rcx
call fcn.14000f223
cmp eax, esi
jne 0x14000f1bc
movzx eax, word [r13 + rbp*2]
cmp r15, rax
jbe 0x14000f21f
mov rcx, qword [rsp + 0x20]
mov edi, dword [rcx + rax*4]
add rdi, rbx
jmp 0x14000f203
xor edi, edi
movzx eax, word [rdi + 4]
add rdi, 0x12
mov rdx, rdi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2

Function at 0x14000f223
Capabilities:
Hash data using djb2

Disassembly:
mov eax, 0x1505
xor r8d, r8d
cmp r8, rdx
jae 0x14000f25f
mov r9b, byte [rcx + r8]
test r9b, r9b
jne 0x14000f23e
inc r8
jmp 0x14000f22b
lea r10d, [r9 - 0x20]
cmp r9b, 0x61
movzx r9d, r9b
movzx r10d, r10b
cmovb r10d, r9d
imul r9d, eax, 0x21
movzx eax, r10b
add eax, r9d
jmp 0x14000f239
ret
Function at 0x140010a7c
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [rcx + 0x18]
test eax, eax
je 0x140010a7c
dec eax
ret
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
cmp qword [rcx], 0
je 0x140010af3
lea r8, [rsp + 0x2c]
and dword [r8], 0
lea rbx, [rsi + 0x10]
mov rcx, rbx
xor edx, edx
xor r9d, r9d
call sub.KERNEL32.dll_InitOnceBeginInitialize
cmp eax, 1
jne 0x140010b3a
cmp dword [rsp + 0x2c], 0
je 0x140010b1b
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x140010b2a
mov edi, eax
inc eax
mov dword [rsi + 0x18], eax
mov rax, qword [0x1400290d8]
mov qword [rsi + 8], rax
lock cmpxchg qword [0x1400290d8], rsi
jne 0x140010ace
mov byte [0x1400290d0], 1
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
jmp 0x140010b20
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x140010b3a
mov edi, eax
mov ecx, eax
inc ecx
xor eax, eax
lock cmpxchg dword [rsi + 0x18], ecx
je 0x140010b20
mov esi, eax
mov ecx, edi
call sub.KERNEL32.dll_TlsFree
dec esi
mov edi, esi
jmp 0x140010b20
mov edi, dword [rsi + 0x18]
dec edi
mov eax, edi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov rcx, rbx
mov edx, 4
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
ud2
Function at 0x140011883
Capabilities:
Query environment variable

Disassembly:
mov r8d, 0x11
jmp fcn.14001154f

Function at 0x14001188e
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
sub rsp, 0x38
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movaps xmmword [rcx], xmm0
mov edx, 0x10
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x1400118ba
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
add rsp, 0x38
ret
call fcn.14000fae7
ud2

Function at 0x140011eb0
Capabilities:
Generate random numbers via winapi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rdi, rcx
lea rcx, [0x1400210f0]
call fcn.14000d62f
cmp rax, 2
jb 0x140011edf
mov rcx, rax
cmp qword [rax + 8], 0
je 0x140011edf
add rcx, 0x10
jmp 0x140011f82
lea rbx, [0x1400210f0]
mov rcx, rbx
call fcn.14000d62f
cmp rax, 1
je 0x140011f65
mov rsi, rax
test rax, rax
jne 0x140011f1c
mov ecx, 0x20
call fcn.140010a4d
mov rsi, rax
mov qword [rax], rbx
and qword [rax + 8], 0
mov rcx, rbx
mov rdx, rax
call fcn.140009c68
test rdi, rdi
je 0x140011f37
mov rax, qword [rdi]
and qword [rdi], 0
test rax, rax
je 0x140011f37
mov rax, qword [rdi + 8]
mov rdx, qword [rdi + 0x10]
jmp 0x140011f6e
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
movaps xmmword [rdx], xmm0
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x140011f69
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
jmp 0x140011f6e
xor ecx, ecx
jmp 0x140011f82
call fcn.14001188e
mov qword [rsi + 8], 1
lea rcx, [rsi + 0x10]
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x18], rdx
mov rax, rcx
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret

Function at 0x140012ba0
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rax, rdx
mov rsi, rcx
lea rdx, [rsp + 0x2c]
mov rcx, rax
call sub.SHELL32.dll_CommandLineToArgvW
test rax, rax
je 0x140012c39
mov rdi, rax
movsxd r12, dword [rsp + 0x2c]
lea rbx, [rsp + 0x30]
mov qword [rbx], 8
xorps xmm0, xmm0
movups xmmword [rbx + 8], xmm0
shl r12, 3
xor r13d, r13d
lea r14, [rsp + 0x48]
cmp r12, r13
je 0x140012c1e
mov r15, qword [rdi + r13]
mov rcx, r15
call sub.msvcrt.dll_wcslen
mov rcx, r14
mov rdx, r15
mov r8, rax
call fcn.14001267a
mov rcx, rbx
mov rdx, r14
call fcn.140012e26
add r13, 8
jmp 0x140012bee
mov rcx, rdi
call sub.KERNEL32.dll_LocalFree
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
mov rax, qword [rsp + 0x40]
mov qword [rsi + 0x10], rax
jmp 0x140012c47
mov qword [rsi], 8
xorps xmm0, xmm0
movups xmmword [rsi + 8], xmm0
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret