joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400af310
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rdi, rdx
mov ecx, 0x50
call fcn.140134aa4
mov rdx, rdi
mov ecx, 0x4b
call fcn.140134aa4
mov rdx, rdi
mov ecx, 3
call fcn.140134aa4
mov rdx, rdi
mov ecx, 4
call fcn.140134aa4
movsx ecx, byte [rbx + 2]
mov rdx, rdi
call fcn.140134aa4
movsx ecx, byte [rbx + 3]
mov rdx, rdi
call fcn.140134aa4
movsx ecx, byte [rbx + 0x3c]
mov rdx, rdi
call fcn.140134aa4
movsx ecx, byte [rbx + 0x3d]
mov rdx, rdi
call fcn.140134aa4
movsx ecx, byte [rbx + 6]
mov rdx, rdi
call fcn.140134aa4
movsx ecx, byte [rbx + 7]
mov rdx, rdi
call fcn.140134aa4
movsx ecx, byte [rbx + 8]
mov rdx, rdi
call fcn.140134aa4
mov eax, dword [rbx + 8]
mov rdx, rdi
shr eax, 8
movsx ecx, al
call fcn.140134aa4
movsx ecx, byte [rbx + 0xa]
mov rdx, rdi
call fcn.140134aa4
movsx ecx, byte [rbx + 0xb]
mov rdx, rdi
call fcn.140134aa4
movsx ecx, byte [rbx + 0xc]
mov rdx, rdi
call fcn.140134aa4
mov eax, dword [rbx + 0xc]
mov rdx, rdi
shr eax, 8
movsx ecx, al
call fcn.140134aa4
movsx ecx, byte [rbx + 0xe]
mov rdx, rdi
call fcn.140134aa4
movsx ecx, byte [rbx + 0xf]
mov rdx, rdi
call fcn.140134aa4
movsx ecx, byte [rbx + 0x10]
mov rdx, rdi
call fcn.140134aa4
mov eax, dword [rbx + 0x10]
mov rdx, rdi
shr eax, 8
movsx ecx, al
call fcn.140134aa4
movsx ecx, byte [rbx + 0x12]
mov rdx, rdi
call fcn.140134aa4
movsx ecx, byte [rbx + 0x13]
mov rdx, rdi
call fcn.140134aa4
movsx ecx, byte [rbx + 0x14]
mov rdx, rdi
call fcn.140134aa4
mov eax, dword [rbx + 0x14]
mov rdx, rdi
shr eax, 8
movsx ecx, al
call fcn.140134aa4
movsx ecx, byte [rbx + 0x16]
mov rdx, rdi
call fcn.140134aa4
movsx ecx, byte [rbx + 0x17]
mov rdx, rdi
call fcn.140134aa4
movsx ecx, byte [rbx + 0x18]
mov rdx, rdi
call fcn.140134aa4
mov eax, dword [rbx + 0x18]
mov rdx, rdi
shr rax, 8
movsx ecx, al
call fcn.140134aa4
movsx ecx, byte [rbx + 0x20]
mov rdx, rdi
call fcn.140134aa4
mov eax, dword [rbx + 0x20]
mov rdx, rdi
shr rax, 8
movsx ecx, al
call fcn.140134aa4
mov r8, qword [rbx + 0x18]
mov r9, rdi
mov rcx, qword [rbx + 0x68]
mov edx, 1
call fcn.140137014
cmp rax, qword [rbx + 0x18]
jne 0x1400af4f1
mov r8, qword [rbx + 0x20]
test r8, r8
je 0x1400af4e4
mov rcx, qword [rbx + 0x50]
mov r9, rdi
mov edx, 1
call fcn.140137014
cmp rax, qword [rbx + 0x20]
jne 0x1400af4f1
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov eax, 0xa
add rsp, 0x20
pop rdi
ret
Function at 0x1400af8e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov r14, qword [rsp + 0x68]
mov esi, edx
mov r12, qword [0x1402bf9f8]
mov ebx, ecx
mov rdx, r14
mov ecx, 0x50
mov r15, r9
mov ebp, r8d
call fcn.140134aa4
mov rdx, r14
mov ecx, 0x4b
call fcn.140134aa4
mov rdx, r14
mov ecx, 5
call fcn.140134aa4
mov rdx, r14
mov ecx, 6
call fcn.140134aa4
mov rdx, r14
xor ecx, ecx
call fcn.140134aa4
mov rdx, r14
xor ecx, ecx
call fcn.140134aa4
mov rdx, r14
xor ecx, ecx
call fcn.140134aa4
mov rdx, r14
xor ecx, ecx
call fcn.140134aa4
movsx edi, bl
mov rdx, r14
mov ecx, edi
call fcn.140134aa4
shr ebx, 8
mov rdx, r14
movsx ebx, bl
mov ecx, ebx
call fcn.140134aa4
mov rdx, r14
mov ecx, edi
call fcn.140134aa4
mov rdx, r14
mov ecx, ebx
call fcn.140134aa4
movsx ecx, sil
mov rdx, r14
call fcn.140134aa4
mov eax, esi
mov rdx, r14
shr eax, 8
movsx ecx, al
call fcn.140134aa4
mov eax, esi
mov rdx, r14
shr eax, 0x10
movsx ecx, al
call fcn.140134aa4
shr esi, 0x18
mov rdx, r14
movsx ecx, sil
call fcn.140134aa4
movsx ecx, bpl
mov rdx, r14
call fcn.140134aa4
mov eax, ebp
mov rdx, r14
shr eax, 8
movsx ecx, al
call fcn.140134aa4
mov eax, ebp
mov rdx, r14
shr eax, 0x10
movsx ecx, al
call fcn.140134aa4
shr ebp, 0x18
mov rdx, r14
movsx ecx, bpl
call fcn.140134aa4
movsx ecx, r15b
mov rdx, r14
call fcn.140134aa4
mov rax, r15
mov rdx, r14
shr rax, 8
movsx ecx, al
call fcn.140134aa4
test r15, r15
je 0x1400afa59
mov r9, r14
mov r8, r15
mov edx, 1
mov rcx, r12
call fcn.140137014
cmp rax, r15
je 0x1400afa59
mov eax, 0xa
jmp 0x1400afa5b
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x1400b0bc0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
movzx eax, byte [rcx]
mov edx, 0x12345678
mov dword [0x1402c1550], edx
mov r9d, 0x23456789
mov dword [0x1402c1554], r9d
mov r8d, 0x34567890
mov dword [0x1402c1558], r8d
mov r10, rcx
test al, al
je 0x1400b0c63
mov r11, qword [0x14030bef0]
nop word [rax + rax]
xor rax, qword [0x1402c1550]
lea r10, [r10 + 1]
movzx ecx, al
mov eax, edx
shr eax, 8
mov edx, dword [r11 + rcx*4]
mov ecx, r8d
xor edx, eax
shr ecx, 8
movzx eax, dl
add eax, r9d
mov dword [0x1402c1550], edx
imul r9d, eax, 0x8088405
inc r9d
mov eax, r9d
mov dword [0x1402c1554], r9d
shr rax, 0x18
xor rax, qword [0x1402c1558]
movzx eax, al
mov r8d, dword [r11 + rax*4]
movzx eax, byte [r10]
xor r8d, ecx
mov dword [0x1402c1558], r8d
test al, al
jne 0x1400b0c00
ret
Function at 0x1400b0f70
Capabilities:
Generate random numbers using the delphi lcg
Write file on windows

Disassembly:
push rsi
push rdi
push r15
sub rsp, 0x20
cmp qword [0x1402bfa10], 0
mov r15, r9
mov rdi, r8
mov rsi, rcx
je 0x1400b106a
mov qword [rsp + 0x40], rbx
mov rbx, rcx
mov r11d, edi
test edi, edi
je 0x1400b1065
mov r9d, dword [0x1402c1558]
mov r10d, dword [0x1402c1550]
mov qword [rsp + 0x48], rbp
mov ebp, dword [0x1402c1554]
mov qword [rsp + 0x50], r14
mov r14, qword [0x14030bef0]
nop dword [rax + rax]
movsx rdx, byte [rbx]
lea rbx, [rbx + 1]
mov r8d, r9d
mov rax, rdx
xor rax, qword [0x1402c1550]
and r8d, 0xfffd
movzx ecx, al
or r8d, 2
mov eax, r10d
shr eax, 8
mov r10d, dword [r14 + rcx*4]
mov ecx, r9d
xor r10d, eax
shr ecx, 8
movzx eax, r10b
add eax, ebp
mov dword [0x1402c1550], r10d
imul ebp, eax, 0x8088405
inc ebp
mov eax, ebp
mov dword [0x1402c1554], ebp
shr rax, 0x18
xor rax, qword [0x1402c1558]
movzx eax, al
mov r9d, dword [r14 + rax*4]
mov eax, r8d
xor eax, 1
xor r9d, ecx
imul eax, r8d
mov dword [0x1402c1558], r9d
shr eax, 8
xor al, dl
mov byte [rbx - 1], al
add r11d, 0xffffffff
jne 0x1400b0fd0
mov r14, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov r9, r15
mov r8, rdi
mov edx, 1
mov rcx, rsi
add rsp, 0x20
pop r15
pop rdi
pop rsi
jmp fcn.140137014
Function at 0x1400b2d40
Capabilities:
Check mutex on windows

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1401b5030]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp dword [0x1402bfb98], 0
je 0x1400b2d76
mov eax, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14011b0c0
add rsp, 0x50
pop rbx
ret
mov ebx, 1
mov qword [rsp + 0x60], rsi
mov edx, ebx
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rsi, rax
test rax, rax
je 0x1400b2ef6
xchg dword [0x1402bfa98], eax
mov qword [rsp + 0x68], rdi
movsxd rdi, eax
test eax, eax
je 0x1400b2dde
mov eax, edi
mov rcx, rsi
xchg dword [0x1402bfa98], eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [0x1402bfb98]
jmp 0x1400b2ef1
lea rcx, [0x14030e060]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor edx, edx
lea rcx, [0x1402db680]
mov r8d, 0x124
call fcn.14011fff0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400b2ee0
lea r8, [rsp + 0x3c]
mov dword [rsp + 0x38], ebx
lea rdx, str.SeBackupPrivilege
mov dword [rsp + 0x44], 2
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
xor edi, edi
test eax, eax
je 0x1400b2e7b
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x38]
mov qword [rsp + 0x28], rdi
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x1400b2e7b
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400b2e7b
mov dword [0x1402bfa0c], ebx
jmp 0x1400b2ed5
cmp dword [0x1402bfa0c], edi
jne 0x1400b2ed5
lea r8, [rsp + 0x3c]
xor ecx, ecx
lea rdx, str.SeSecurityPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x1400b2ed5
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x38]
mov qword [rsp + 0x28], rdi
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x1400b2ed5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x1402bfb94]
test eax, eax
cmove ecx, ebx
mov dword [0x1402bfb94], ecx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
mov dword [0x1402bfb98], ebx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, ebx
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14011b0c0
add rsp, 0x50
pop rbx
ret
Function at 0x1400b7ec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov r9d, dword [rcx + 0xf4]
mov edi, edx
mov eax, dword [rcx + 0xa0]
xor r14d, r14d
mov r10d, dword [rcx + 0x118]
mov edx, r9d
mov r11d, dword [rcx + 0x104]
sub edx, eax
mov r13d, dword [rcx + 0x100]
add edx, 0x106
mov rbp, qword [rcx + 0xb0]
lea r8d, [rax - 0x106]
movzx eax, word [r9 + rbp]
lea rbx, [r9 + rbp]
mov r15, qword [rcx + 0xc0]
cmp r9d, r8d
mov r12d, dword [rcx + 0xa8]
lea r9, [rbx + 0x102]
movzx esi, word [r13 + rbx - 1]
cmova r14d, edx
mov word [rsp + 0x48], ax
mov eax, dword [rcx + 0xfc]
cmp r10d, eax
mov edx, eax
cmovbe edx, r10d
mov r10, qword [rsp + 0x40]
mov dword [rsp + 0x50], edx
mov edx, r11d
shr edx, 2
cmp r13d, dword [rcx + 0x114]
cmovb edx, r11d
mov r11d, dword [rsp + 0x50]
nop dword [rax]
nop word [rax + rax]
mov eax, edi
add rax, rbp
mov r8d, r13d
cmp word [r8 + rax - 1], si
je 0x1400b7fbb
mov eax, edi
mov rcx, r12
and rcx, rax
movzx edi, word [r15 + rcx*2]
cmp edi, r14d
jbe 0x1400b803d
add edx, 0xffffffff
je 0x1400b803d
lea rax, [rdi + rbp]
cmp word [r8 + rax - 1], si
jne 0x1400b7f90
movzx ecx, word [rsp + 0x48]
cmp word [rax], cx
jne 0x1400b8022
add rbx, 2
add rax, 2
nop dword [rax]
mov ecx, dword [rax]
xor ecx, dword [rbx]
jne 0x1400b7fe5
add rbx, 4
add rax, 4
cmp rbx, r9
jb 0x1400b7fd0
jmp 0x1400b7ff2
tzcnt ecx, ecx
mov ecx, ecx
shr rcx, 3
add rbx, rcx
cmp rbx, r9
cmova rbx, r9
sub ebx, r9d
lea eax, [rbx + 0x102]
lea rbx, [r9 - 0x102]
cmp eax, r13d
jbe 0x1400b8022
mov dword [r10 + 0xf8], edi
mov r13d, eax
cmp eax, r11d
jae 0x1400b803d
movzx esi, word [rax + rbx - 1]
mov eax, edi
mov rcx, r12
and rcx, rax
movzx edi, word [r15 + rcx*2]
cmp edi, r14d
jbe 0x1400b803d
add edx, 0xffffffff
jne 0x1400b7f80
mov eax, dword [r10 + 0xfc]
cmp r13d, eax
mov rbx, qword [rsp + 0x58]
cmovbe eax, r13d
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400b9a00
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
mov r10, r8
mov r9, rdx
test rdx, rdx
jne 0x1400b9a16
xor eax, eax
add rsp, 8
ret
mov qword [rsp], rbx
lea rbx, [0x14018eec0]
not ecx
cmp r10, 4
jb 0x1400b9a86
mov r11, r10
shr r11, 2
imul rax, r11, 0xfffffffffffffffc
add r10, rax
nop word [rax + rax]
xor ecx, dword [r9]
add r9, 4
mov r8d, ecx
mov eax, ecx
shr rax, 0x10
movzx ecx, al
mov eax, r8d
shr rax, 8
movzx edx, al
mov eax, r8d
shr rax, 0x18
mov ecx, dword [rbx + rcx*4 + 0x400]
xor ecx, dword [rbx + rdx*4 + 0x800]
xor ecx, dword [rbx + rax*4]
movzx eax, r8b
xor ecx, dword [rbx + rax*4 + 0xc00]
sub r11, 1
jne 0x1400b9a40
test r10, r10
je 0x1400b9ab0
nop dword [rax + rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
xor rdx, rax
shr eax, 8
movzx r8d, dl
mov ecx, dword [rbx + r8*4]
xor ecx, eax
sub r10, 1
jne 0x1400b9a90
mov rbx, qword [rsp]
not ecx
mov eax, ecx
add rsp, 8
ret
Function at 0x1400b9f00
Capabilities:
Hash data with crc32
Inspect section memory permissions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x1401b5030]
xor rax, rsp
mov qword [rbp + 0x20], rax
mov rdi, r8
mov esi, edx
mov ebx, ecx
test r8, r8
jle 0x1400b9ecd
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0xedb88320
lea rcx, [rbp - 0x60]
mov dword [rsp + 0x24], 1
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x2c], 4
mov dword [rsp + 0x30], 8
mov dword [rsp + 0x34], reloc.WS2_32.dll_recv
mov dword [rsp + 0x38], 0x20
mov dword [rsp + 0x3c], 0x40
mov dword [rsp + 0x40], 0x80
mov dword [rsp + 0x44], 0x100
mov dword [rsp + 0x48], 0x200
mov dword [rsp + 0x4c], 0x400
mov dword [rsp + 0x50], 0x800
mov dword [rsp + 0x54], 0x1000
mov dword [rsp + 0x58], 0x2000
mov dword [rsp + 0x5c], 0x4000
mov dword [rsp + 0x60], 0x8000
mov dword [rsp + 0x64], 0x10000
mov dword [rsp + 0x68], 0x20000
mov dword [rsp + 0x6c], 0x40000
mov dword [rsp + 0x70], 0x80000
mov dword [rsp + 0x74], 0x100000
mov dword [rsp + 0x78], 0x200000
mov dword [rsp + 0x7c], 0x400000
mov dword [rbp - 0x80], 0x800000
mov dword [rbp - 0x7c], 0x1000000
mov dword [rbp - 0x78], 0x2000000
mov dword [rbp - 0x74], 0x4000000
mov dword [rbp - 0x70], 0x8000000
mov dword [rbp - 0x6c], 0x10000000
mov dword [rbp - 0x68], 0x20000000
mov dword [rbp - 0x64], 0x40000000
call fcn.1400b9ad0
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x20]
call fcn.1400b9ad0
nop
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x60]
call fcn.1400b9ad0
test dil, 1
je 0x1400b9e91
xor ecx, ecx
lea rax, [rbp - 0x60]
test ebx, ebx
je 0x1400b9e8f
nop
test bl, 1
je 0x1400b9e87
xor ecx, dword [rax]
add rax, 4
shr ebx, 1
jne 0x1400b9e80
mov ebx, ecx
sar rdi, 1
je 0x1400b9ecb
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x20]
call fcn.1400b9ad0
test dil, 1
je 0x1400b9ec6
xor ecx, ecx
lea rax, [rsp + 0x20]
test ebx, ebx
je 0x1400b9ec4
test bl, 1
je 0x1400b9ebc
xor ecx, dword [rax]
add rax, 4
shr ebx, 1
jne 0x1400b9eb5
mov ebx, ecx
sar rdi, 1
jne 0x1400b9e60
xor ebx, esi
mov eax, ebx
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.14011b0c0
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
movsxd r8, r8d
jmp 0x1400b9d10
Function at 0x1400ba160
Capabilities:
Compute adler32 checksum

Disassembly:
mov r9d, ecx
mov r10, rdx
shr r9d, 0x10
movzx ecx, cx
cmp r8, 1
jne 0x1400ba1a4
movzx edx, byte [rdx]
add edx, ecx
cmp edx, 0xfff1
lea r8d, [rdx - 0xfff1]
cmovb r8d, edx
lea eax, [r8 + r9]
cmp eax, 0xfff1
lea ecx, [rax - 0xfff1]
cmovb ecx, eax
shl ecx, 0x10
or ecx, r8d
mov eax, ecx
ret
test rdx, rdx
jne 0x1400ba1ad
lea eax, [rdx + 1]
ret
cmp r8, 0x10
jae 0x1400ba1fc
test r8, r8
je 0x1400ba1d3
nop dword [rax + rax]
movzx eax, byte [r10]
lea r10, [r10 + 1]
add ecx, eax
add r9d, ecx
sub r8, 1
jne 0x1400ba1c0
cmp ecx, 0xfff1
lea r8d, [rcx - 0xfff1]
mov eax, 0x80078071
cmovb r8d, ecx
mul r9d
shr edx, 0xf
imul eax, edx, 0xf
add eax, r9d
shl eax, 0x10
or eax, r8d
ret
cmp r8, 0x15b0
jb 0x1400ba2c8
mov r11, r8
movabs rax, 0x79baa6bb6398b6f7
mul r8
sub r11, rdx
shr r11, 1
add r11, rdx
shr r11, 0xc
imul rax, r11, 0xffffffffffffea50
add r8, rax
mov edx, 0x2b6
nop word [rax + rax]
movzx eax, byte [r10]
add ecx, eax
movzx eax, byte [r10 + 1]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 2]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 3]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 4]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 5]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 6]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 7]
add r9d, ecx
add r10, 8
add ecx, eax
add r9d, ecx
add edx, 0xffffffff
jne 0x1400ba240
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
mov eax, 0x80078071
mul r9d
shr edx, 0xf
imul eax, edx, 0xffff000f
add r9d, eax
sub r11, 1
jne 0x1400ba230
test r8, r8
je 0x1400ba389
cmp r8, 8
jb 0x1400ba349
mov rdx, r8
shr rdx, 3
imul rax, rdx, 0xfffffffffffffff8
add r8, rax
nop word [rax + rax]
movzx eax, byte [r10]
add ecx, eax
movzx eax, byte [r10 + 1]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 2]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 3]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 4]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 5]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 6]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 7]
add r9d, ecx
add r10, 8
add ecx, eax
add r9d, ecx
sub rdx, 1
jne 0x1400ba2f0
test r8, r8
je 0x1400ba363
nop
movzx eax, byte [r10]
lea r10, [r10 + 1]
add ecx, eax
add r9d, ecx
sub r8, 1
jne 0x1400ba350
mov eax, 0x80078071
mul ecx
mov eax, 0x80078071
shr edx, 0xf
imul edx, edx, 0xffff000f
add ecx, edx
mul r9d
shr edx, 0xf
imul edx, edx, 0xffff000f
add r9d, edx
shl r9d, 0x10
or r9d, ecx
mov eax, r9d
ret
Function at 0x1400f1530
Capabilities:
Encode data using xor

Disassembly:
push rbx
and r8d, 0x1f
movabs rbx, 0xc2b2ae3d27d4eb4f
movabs r11, 0x9e3779b185ebca87
cmp r8, 8
jb 0x1400f159c
mov r10d, r8d
mov qword [rsp + 0x10], rdi
shr r10, 3
movabs rdi, 0x7a1435883d4d519d
imul rax, r10, 0xfffffffffffffff8
add r8, rax
nop dword [rax]
mov rax, qword [rdx]
add rdx, 8
imul rax, rbx
rol rax, 0x1f
imul rax, r11
xor rcx, rax
rol rcx, 0x1b
imul rcx, r11
sub rcx, rdi
sub r10, 1
jne 0x1400f1570
mov rdi, qword [rsp + 0x10]
movabs r10, 0x165667b19e3779f9
cmp r8, 4
jb 0x1400f15c8
mov eax, dword [rdx]
add rdx, 4
imul rax, r11
xor rcx, rax
rol rcx, 0x17
imul rcx, rbx
add rcx, r10
sub r8, 4
test r8, r8
je 0x1400f15fc
movabs r9, 0x27d4eb2f165667c5
nop word [rax + rax]
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
imul rax, r9
xor rcx, rax
rol rcx, 0xb
imul rcx, r11
sub r8, 1
jne 0x1400f15e0
mov rax, rcx
shr rax, 0x21
xor rax, rcx
imul rax, rbx
mov rcx, rax
shr rcx, 0x1d
xor rcx, rax
imul rcx, r10
mov rax, rcx
shr rax, 0x20
xor rax, rcx
pop rbx
ret

Function at 0x1400f17f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov r11, qword [rcx]
mov rbx, rcx
movabs rbp, 0x27d4eb2f165667c5
movabs rsi, 0xc2b2ae3d27d4eb4f
movabs rdi, 0x9e3779b185ebca87
movabs r14, 0x7a1435883d4d519d
cmp r11, 0x20
jb 0x1400f18d6
mov rdx, qword [rcx + 8]
mov r10, qword [rcx + 0x20]
mov rax, rdx
mov r8, qword [rcx + 0x10]
mov r9, qword [rcx + 0x18]
rol rax, 1
mov rcx, r9
rol rcx, 0xc
add rcx, rax
mov rax, r8
rol rax, 7
add rcx, rax
mov rax, r10
imul rdx, rsi
imul r8, rsi
imul r9, rsi
imul r10, rsi
rol rax, 0x12
add rcx, rax
rol rdx, 0x1f
imul rdx, rdi
rol r8, 0x1f
movabs rax, 0x85ebca77c2b2ae63
xor rcx, rdx
rol r9, 0x1f
imul rcx, rdi
imul r8, rdi
imul r9, rdi
sub rcx, r14
rol r10, 0x1f
xor rcx, r8
imul rcx, rdi
imul r10, rdi
sub rcx, r14
xor rcx, r9
imul rcx, rdi
sub rcx, r14
xor rcx, r10
imul rcx, rdi
add rax, rcx
jmp 0x1400f18dd
mov rax, qword [rcx + 0x18]
add rax, rbp
add rax, r11
lea r8, [rbx + 0x28]
and r11d, 0x1f
cmp r11, 8
jb 0x1400f1927
mov edx, r11d
shr rdx, 3
imul rcx, rdx, 0xfffffffffffffff8
add r11, rcx
nop dword [rax]
mov rcx, qword [r8]
add r8, 8
imul rcx, rsi
rol rcx, 0x1f
imul rcx, rdi
xor rax, rcx
rol rax, 0x1b
imul rax, rdi
sub rax, r14
sub rdx, 1
jne 0x1400f1900
movabs r9, 0x165667b19e3779f9
cmp r11, 4
jb 0x1400f1954
mov edx, dword [r8]
add r8, 4
imul rdx, rdi
xor rax, rdx
rol rax, 0x17
imul rax, rsi
add rax, r9
sub r11, 4
test r11, r11
je 0x1400f197d
nop dword [rax]
movzx ecx, byte [r8]
lea r8, [r8 + 1]
imul rcx, rbp
xor rax, rcx
rol rax, 0xb
imul rax, rdi
sub r11, 1
jne 0x1400f1960
mov rbx, qword [rsp + 0x10]
mov rcx, rax
mov rbp, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x28]
shr rcx, 0x21
xor rcx, rax
imul rcx, rsi
mov rsi, qword [rsp + 0x20]
mov rdx, rcx
shr rdx, 0x1d
xor rdx, rcx
imul rdx, r9
mov rax, rdx
shr rax, 0x20
xor rax, rdx
pop r14
ret
Function at 0x140110820
Capabilities:
Create thread
Resume thread

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov rdi, rcx
lea rbx, [rcx + 8]
mov qword [rsp + 0x60], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
cmp dword [rdi + 0x30], 0
jne 0x1401108ec
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 4
mov r9, rdi
lea r8, [0x1401105d0]
xor edx, edx
xor ecx, ecx
call fcn.140137b24
mov qword [rdi + 0x60], rax
mov ecx, dword [rsp + 0x58]
mov dword [rdi + 0x68], ecx
test rax, rax
je 0x1401108fe
mov edx, dword [rdi + 0x34]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
je 0x140110922
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x1401108c7
mov dword [rdi + 0x30], 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov edx, eax
lea rcx, [rsp + 0x50]
call fcn.1401103c0
lea rdx, [0x1401b1978]
lea rcx, [rsp + 0x50]
call fcn.1401202c4
int3
lea rdx, [0x1401b1948]
lea rcx, [rsp + 0x50]
call fcn.1401202c4
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x50]
call fcn.1401103c0
lea rdx, [0x1401b1978]
lea rcx, [rsp + 0x50]
call fcn.1401202c4
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x50]
call fcn.1401103c0
lea rdx, [0x1401b1978]
lea rcx, [rsp + 0x50]
call fcn.1401202c4
int3

Function at 0x140110950
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x1402db504]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rax, rax
je 0x1401109bf
lea rcx, [rax + 8]
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rdi + 8]
mov dword [rdi + 0x30], 2
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [rdi + 0x58], 0
mov rbx, qword [rsp + 0x30]
je 0x1401109bb
mov r8, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [r8]
xor ecx, ecx
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140137bf8
mov qword [rdi + 0x70], rsi
xor ecx, ecx
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140137bf8