joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001310
Capabilities:
Get disk information
Terminate process

Disassembly:
mov r11, rsp
push rbp
push rsi
push r12
push r15
sub rsp, 0x4b8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x4a0], rax
mov qword [rsp + 0x50], rcx
mov rbp, rcx
mov r15, qword [rdx + 0x10]
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
xor r12d, r12d
sub rax, r15
mov rsi, rdx
cmp rax, 1
jb 0x140001560
cmp qword [rdx + 0x18], 7
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rdi
mov qword [r11 - 0x28], r14
jbe 0x140001374
mov rsi, qword [rdx]
lea r14, [r15 + 1]
mov ebx, 7
lea rdi, [rsp + 0x58]
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rsp + 0x58], xmm0
movdqu xmmword [rsp + 0x68], xmm1
cmp r14, rbx
jbe 0x140001428
mov rbx, r14
or rbx, 7
cmp rbx, rcx
jbe 0x1400013ee
movabs rax, 0x7fffffffffffffff
mov rbx, rcx
lea rcx, [rax + rax]
cmp rcx, 0x1000
jb 0x14000141b
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000155a
mov rcx, rax
call fcn.140009350
test rax, rax
je 0x1400014dd
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140001423
mov eax, 0xa
cmp rbx, rax
cmovb rbx, rax
movabs rax, 0x7fffffffffffffff
lea rcx, [rbx + 1]
cmp rcx, rax
ja 0x14000155a
add rcx, rcx
jne 0x1400013b9
mov rdi, r12
jmp 0x140001423
call fcn.140009350
mov rdi, rax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x70], rbx
mov rdx, rsi
lea rbx, [r15 + r15]
mov qword [rsp + 0x68], r14
mov r8, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov word [rbx + rdi], 0x5c
lea rax, [rsp + 0x80]
mov dword [rsp + 0x38], 0x105
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x44]
mov word [rdi + r14*2], r12w
lea rax, [rsp + 0x48]
cmp qword [rsp + 0x70], 7
lea rdx, [rsp + 0x290]
mov qword [rsp + 0x28], rax
mov r8d, 0x105
cmova rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov rdx, qword [rsp + 0x70]
mov ebx, eax
cmp rdx, 7
jbe 0x1400014e9
mov rcx, qword [rsp + 0x58]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400014e4
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400014e4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000945c
test ebx, ebx
je 0x14000154e
mov r9d, dword [rsp + 0x44]
lea r8, str._08X
mov edx, 0x11
lea rcx, [rsp + 0x58]
call fcn.140001010
lea rdx, [rsp + 0x58]
mov rcx, rbp
call fcn.140008290
mov rdi, qword [rsp + 0x4f8]
mov rax, rbp
mov rbx, qword [rsp + 0x4f0]
mov r14, qword [rsp + 0x4b0]
mov rcx, qword [rsp + 0x4a0]
xor rcx, rsp
call fcn.140009330
add rsp, 0x4b8
pop r15
pop r12
pop rsi
pop rbp
ret
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.140001170
int3
call fcn.140001210
int3
Function at 0x140003e60
Capabilities:
Enumerate gui resources
Execute command
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbx, rcx
lea rdx, [rcx + 0x20]
xor esi, esi
mov qword [rcx + 0x20], rsi
lea rcx, [0x140003c70]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x140003fea
lea rdx, [0x14000c648]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rcx, qword [rbx + 0x20]
mov edx, 0xfffffff0
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
mov rcx, qword [rbx + 0x20]
mov edx, 0xfffffff0
and rax, 0xfffffffffffcffff
mov r8, rax
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
mov rcx, qword [rbx + 0x20]
xor r9d, r9d
mov dword [rsp + 0x30], 0x27
xor r8d, r8d
mov dword [rsp + 0x28], esi
xor edx, edx
mov dword [rsp + 0x20], esi
call qword [sym.imp.USER32.dll_SetWindowPos]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov edx, 0x65
call qword [sym.imp.USER32.dll_LoadIconW]
mov rsi, rax
test rax, rax
je 0x140003f46
mov rcx, qword [rbx + 0x20]
mov r9, rax
mov edx, 0x80
mov r8d, 1
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 0x20]
mov r9, rsi
xor r8d, r8d
mov edx, 0x80
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 0x20]
lea rdx, [rsp + 0x50]
mov dword [rbx + 8], 0x341
mov dword [rbx + 0xc], 0xf9
mov rax, qword [rbx + 8]
mov qword [rsp + 0x50], rax
call qword [sym.imp.USER32.dll_ClientToScreen]
test eax, eax
je 0x140003fea
mov eax, dword [rsp + 0x50]
lea rcx, [0x14000b584]
mov dword [rbx], eax
mov eax, dword [rsp + 0x54]
mov dword [rbx + 4], eax
mov byte [rbx + 0x70], 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov eax, dword [rbx + 0x40]
mov r9d, dword [rbx + 0x30]
mov r8d, dword [rbx + 0x28]
mov edx, dword [rbx + 4]
mov ecx, dword [rbx]
mov dword [rsp + 0x48], eax
mov eax, dword [rbx + 0x2c]
mov dword [rsp + 0x40], eax
mov eax, dword [rbx + 0x6c]
mov dword [rsp + 0x38], eax
mov eax, dword [rbx + 0x3c]
mov dword [rsp + 0x30], eax
mov eax, dword [rbx + 0x38]
mov dword [rsp + 0x28], eax
mov eax, dword [rbx + 0x34]
mov dword [rsp + 0x20], eax
call fcn.140001d60
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140009330
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x140009d78
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140009dc2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140009dc2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140009dc2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140009dc2
cmp dword [rcx + 0x84], 0xe
jbe 0x140009dc2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140009dc4
xor al, al
add rsp, 0x28
ret
Function at 0x180001d50
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
push rdi
push r12
push r14
sub rsp, 0x120
xor r14d, r14d
mov eax, 0x5a4d
mov r12, rdx
mov rdi, rcx
cmp word [rcx], ax
jne 0x180001ecb
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x180001ecb
movups xmm0, xmmword [rax + 0x18]
lea rcx, [rsp + 0x20]
movups xmm1, xmmword [rax + 0x28]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax + 0x38]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x48]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x58]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax + 0x68]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x78]
movups xmmword [rcx + 0x50], xmm1
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax + 0x88]
sub rax, 0xffffffffffffff68
movups xmmword [rcx - 0x10], xmm0
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rcx], xmm1
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rcx + 0x10], xmm0
movups xmm0, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm1
movups xmm1, xmmword [rax + 0x40]
movups xmmword [rcx + 0x30], xmm0
movups xmm0, xmmword [rax + 0x50]
movups xmmword [rcx + 0x40], xmm1
movups xmm1, xmmword [rax + 0x60]
movups xmmword [rcx + 0x50], xmm0
movups xmmword [rcx + 0x60], xmm1
mov eax, dword [r11 - 0xa8]
test eax, eax
je 0x180001ecb
mov qword [r11 + 0x10], rbx
mov ebx, r14d
mov qword [r11 + 0x20], rsi
lea rsi, [rdi + rax]
mov eax, dword [rdi + rax + 0x24]
mov qword [r11 - 0x20], r13
add rax, rdi
mov r13d, dword [rsi + 0x1c]
mov qword [r11 - 0x28], r15
add r13, rdi
mov r15d, dword [rsi + 0x20]
add r15, rdi
mov qword [rsp + 0x140], rax
cmp dword [rsi + 0x18], ebx
jbe 0x180001e9b
mov qword [r11 + 0x18], rbp
nop
mov ebp, ebx
mov rdx, r12
mov ecx, dword [r15 + rbp*4]
add rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x180001e7f
inc ebx
cmp ebx, dword [rsi + 0x18]
jb 0x180001e60
jmp 0x180001e93
mov rax, qword [rsp + 0x140]
movzx eax, word [rax + rbp*2]
mov r14d, dword [r13 + rax*4]
add r14, rdi
mov rbp, qword [rsp + 0x150]
mov r15, qword [rsp + 0x110]
mov rax, r14
mov r13, qword [rsp + 0x118]
mov rsi, qword [rsp + 0x158]
mov rbx, qword [rsp + 0x148]
add rsp, 0x120
pop r14
pop r12
pop rdi
ret
xor eax, eax
add rsp, 0x120
pop r14
pop r12
pop rdi
ret
Function at 0x1800036f0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x180003718
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x18000373e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x180003740
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x180003799
test ecx, ecx
jle 0x180003779
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x180003799
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x180003799
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x1800037c0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x1800037e2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x1800037f8
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x180003814
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x180003816
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x180003852
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x1800038ee
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x18000388d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x1800038ce
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x1800038ee
cmp rbx, rax
ja 0x1800038a0
test rbx, rbx
je 0x1800038ee
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x180003d50
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x18000b040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x180003d7d
xor eax, eax
jmp 0x180003ee9
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x180003db7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x180003db7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x180003ee9
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x180003edc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x180003dfa
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x180003e25
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x180003ee1
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180003e94
sub eax, 1
je 0x180003e94
cmp eax, 2
jne 0x180003edc
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x180003ee1
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x180003ec2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x180003edc
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x180003ee1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.180004d90
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x180004280
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x18000b040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x180004353
cmp byte [rcx + 0x71], 0
je 0x180004353
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x18000434f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180004314
sub eax, 1
je 0x180004318
cmp eax, 2
jne 0x18000434f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180004d90
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x180004346
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x18000434f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1800042fc
xor al, al
jmp 0x1800042fc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180004d90
add rsp, 0x60
pop rbx
ret
Function at 0x140001180
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, qword [0x14010dba0]
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword gs:[0x30]
mov rsi, qword [rax + 8]
jmp 0x1400011c0
cmp rsi, rax
je 0x140001320
mov ecx, 0x3e8
call rdi
xor eax, eax
lock cmpxchg qword [rbx], rsi
jne 0x1400011b0
mov rsi, qword [0x14010dbb0]
xor edi, edi
mov eax, dword [rsi]
cmp eax, 1
je 0x140001337
mov eax, dword [rsi]
test eax, eax
je 0x1400013a0
mov dword [0x140112008], 1
mov eax, dword [rsi]
cmp eax, 1
je 0x14000134c
test edi, edi
je 0x14000136d
mov rax, qword [0x14010db10]
mov rax, qword [rax]
test rax, rax
je 0x14000121f
xor r8d, r8d
mov edx, 2
xor ecx, ecx
call rax
call fcn.1400528b0
mov rcx, qword [0x14010dc30]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rdx, qword [0x14010db90]
lea rcx, section..text
mov qword [rdx], rax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__set_invalid_parameter_handler
call fcn.1400526c0
mov ebx, dword [0x140112028]
lea edi, [rbx + 1]
movsxd rdi, edi
shl rdi, 3
mov rcx, rdi
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov r12, qword [0x140112020]
mov rbp, rax
test ebx, ebx
jle 0x1400013c0
sub rdi, 8
xor ebx, ebx
nop dword [rax]
mov rcx, qword [r12 + rbx]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
lea rsi, [rax + 1]
mov rcx, rsi
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov r8, rsi
mov qword [rbp + rbx], rax
mov rdx, qword [r12 + rbx]
mov rcx, rax
add rbx, 8
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
cmp rdi, rbx
jne 0x140001280
add rdi, rbp
mov qword [rdi], 0
mov qword [0x140112020], rbp
call fcn.1400524c0
mov rax, qword [0x14010db20]
mov r8, qword [0x140112018]
mov ecx, dword [0x140112028]
mov rax, qword [rax]
mov qword [rax], r8
mov rdx, qword [0x140112020]
call fcn.14000f1b0
mov ecx, dword [0x14011200c]
mov dword [0x140112010], eax
test ecx, ecx
je 0x1400013c8
mov edx, dword [0x140112008]
test edx, edx
je 0x140001380
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rsi, qword [0x14010dbb0]
mov edi, 1
mov eax, dword [rsi]
cmp eax, 1
jne 0x1400011dd
mov ecx, 0x1f
call fcn.1400521a0
mov eax, dword [rsi]
cmp eax, 1
jne 0x1400011fc
mov rdx, qword [0x14010dbd0]
mov rcx, qword [0x14010dbc0]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
mov dword [rsi], 2
test edi, edi
jne 0x140001204
xor eax, eax
xchg qword [rbx], rax
jmp 0x140001204
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
mov eax, dword [0x140112010]
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rdx, qword [0x14010dbf0]
mov rcx, qword [0x14010dbe0]
mov dword [rsi], 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
jmp 0x1400011f1
mov rdi, rax
jmp 0x1400012b5
mov ecx, eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop
Function at 0x1400070a0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x1400070e2
mov r10d, 8
sub r10, r11
cmp r10, r8
mov rdi, r8
cmovb rdi, r10
cmp rdi, 4
jb 0x1400070ea
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x1400070fb
jmp 0x140007112
xor r10d, r10d
jmp 0x14000719d
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x140007112
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x140007129
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x140007149
add r11, r8
jmp 0x140007279
mov rcx, qword [rax + 0x18]
xor rcx, rsi
mov rdi, qword [rax + 0x10]
mov r9, qword [rax]
add r9, rdi
mov r11, qword [rax + 8]
add r11, rcx
rol rdi, 0xd
xor rdi, r9
rol rcx, 0x10
rol r9, 0x20
xor rcx, r11
add r11, rdi
rol rdi, 0x11
add r9, rcx
xor rdi, r11
rol rcx, 0x15
mov qword [rax + 0x10], rdi
xor rcx, r9
rol r11, 0x20
mov qword [rax + 0x18], rcx
mov qword [rax + 8], r11
xor r9, rsi
mov qword [rax], r9
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x140007212
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
mov rbx, qword [rdx + r10]
xor rdi, rbx
add rcx, rsi
rol rsi, 0xd
add r9, rdi
xor rsi, rcx
rol rdi, 0x10
xor rdi, r9
rol rcx, 0x20
add r9, rsi
add rcx, rdi
rol rsi, 0x11
xor rsi, r9
rol rdi, 0x15
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x1400071c0
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x14000722f
mov r9d, dword [rdx + r10]
mov r8d, 4
mov ecx, r8d
or ecx, 1
cmp ecx, r11d
jb 0x140007240
jmp 0x14000725b
xor r9d, r9d
xor r8d, r8d
mov ecx, r8d
or ecx, 1
cmp ecx, r11d
jae 0x14000725b
lea rcx, [rdx + r8]
movzx esi, word [r10 + rcx]
lea ecx, [r8*8]
invalid
add byte [rax], al
add byte [rax], al
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8d, r11d
jae 0x140007275
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x140023190
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x828
mov esi, dword [0x1400540d0]
test esi, esi
je 0x140023366
dec esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x140023359
je 0x140023357
mov eax, dword [0x140112038]
cmp eax, 3
jne 0x140023387
mov rdi, qword [0x140112030]
lock inc qword [rdi]
jle 0x14002339d
mov eax, 0x60
movups xmm0, xmmword [0x14010c470]
movups xmm1, xmmword [0x14010c460]
nop word cs:[rax + rax]
movups xmmword [rsp + rax - 0x30], xmm0
movups xmmword [rsp + rax - 0x40], xmm1
movups xmmword [rsp + rax - 0x20], xmm1
movups xmmword [rsp + rax - 0x10], xmm0
movups xmmword [rsp + rax], xmm1
movups xmmword [rsp + rax + 0x10], xmm0
movups xmmword [rsp + rax + 0x20], xmm1
movups xmmword [rsp + rax + 0x30], xmm0
sub rax, 0xffffffffffffff80
cmp rax, 0x860
jne 0x140023200
movzx eax, byte [0x140112110]
mov edx, 0x980
xor ecx, ecx
call fcn.140036850
test rax, rax
je 0x14002339d
mov r14, rax
and r14, 0xffffffffffffff80
lea rbx, [r14 + 0x80]
mov qword [r14 + 0x78], rax
mov qword [r14 + 0x80], 0
mov qword [r14 + 0x88], rdi
lea rcx, [r14 + 0x90]
lea rdx, [rsp + 0x20]
mov r8d, 0x800
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
xorps xmm0, xmm0
movaps xmmword [r14 + 0x890], xmm0
mov qword [r14 + 0x8a0], 1
mov qword [r14 + 0x8a8], 0
mov qword [r14 + 0x900], 0
mov rax, qword [rdi + 0x200]
mov qword [r14 + 0x80], rax
lock cmpxchg qword [rdi + 0x200], rbx
je 0x1400232de
nop
mov qword [rbx], rax
lock cmpxchg qword [rdi + 0x200], rbx
jne 0x1400232d0
movzx eax, byte [0x140112110]
mov edx, 0x10
xor ecx, ecx
call fcn.140036850
test rax, rax
je 0x14002339d
mov qword [rax], rbx
mov dword [rax + 8], esi
mov ecx, esi
mov rbx, rax
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
mov ecx, esi
mov rsi, rbx
mov rdx, rbx
call sub.KERNEL32.dll_TlsSetValue
test rdi, rdi
je 0x140023352
mov rcx, qword [rdi]
mov rax, qword [rcx + 0x820]
lea rdx, [rax - 1]
mov qword [rcx + 0x820], rdx
xor rax, 1
or rax, qword [rcx + 0x818]
je 0x14002339f
mov rcx, qword [0x1401120f0]
xor edx, edx
mov r8, rdi
call fcn.14005177c
mov rax, rsi
jmp 0x140023359
xor eax, eax
add rsp, 0x828
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x1400540b8]
call fcn.140027b70
mov esi, eax
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x1400231bd
jmp 0x140023359
call fcn.14001e770
mov rdi, qword [0x140112030]
lock inc qword [rdi]
jg 0x1400231e3
ud2
call fcn.14001db60
jmp 0x140023341