joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001ff0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140002012
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je case.default.0x140002021
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140002044
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140002046
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140002082
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14000211e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x1400020bd
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x1400020fe
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14000211e
cmp rbx, rax
ja 0x1400020d0
test rbx, rbx
je 0x14000211e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x140002580
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140009040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x1400025ad
xor eax, eax
jmp 0x140002719
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x1400025e7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x1400025e7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140002719
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14000270c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000262a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140002655
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002711
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400026c4
sub eax, 1
je 0x1400026c4
cmp eax, 2
jne 0x14000270c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002711
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1400026f2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14000270c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140002711
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140003910
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140002b60
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140009040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140002c33
cmp byte [rcx + 0x71], 0
je 0x140002c33
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140002c2f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140002bf4
sub eax, 1
je 0x140002bf8
cmp eax, 2
jne 0x140002c2f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140003910
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140002c26
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140002c2f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140002bdc
xor al, al
jmp 0x140002bdc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140003910
add rsp, 0x60
pop rbx
ret

Function at 0x140004290
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400042da
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400042da
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400042da
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400042da
cmp dword [rcx + 0x84], 0xe
jbe 0x1400042da
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400042dc
xor al, al
add rsp, 0x28
ret
Function at 0x140009038
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, r8
mov r9, rcx
xor ecx, ecx
movabs r8, 0xcbf29ce484222325
mov rsi, rdx
movzx eax, byte [rbx + rcx + 0x10]
movabs rdx, 0x100000001b3
xor r8, rax
inc rcx
imul r8, rdx
cmp rcx, 4
jb 0x14000905c
mov rdx, qword [r9 + 0x30]
mov rcx, qword [r9 + 0x18]
and rdx, r8
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rbx
jne 0x1400090b3
cmp qword [rcx + rdx*8], rbx
jne 0x1400090a8
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x1400090ac
mov rax, qword [rbx + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400090c0
cmp qword [rcx + rdx*8], rbx
jne 0x1400090c0
mov rax, qword [rbx]
mov qword [rcx + rdx*8], rax
mov rax, qword [rbx + 8]
mov rdi, qword [rbx]
mov qword [rax], rdi
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r9 + 0x10]
mov rdx, qword [rbx + 0x30]
cmp rdx, 8
jb 0x1400090f5
mov rcx, qword [rbx + 0x18]
inc rdx
mov r8d, 2
call fcn.1400020a4
mov edx, 1
mov rcx, rbx
lea r8d, [rdx + 0x37]
call fcn.1400020a4
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov qword [rsi], rdi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14000b51c
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_1.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x1400148a0], eax
call fcn.14000b2a4
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_UnhandledExceptionFilter]
cmp dword [0x1400148a0], 0
jne case.default.0x14000b572
mov ecx, 1
call fcn.14000b2a4
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_TerminateProcess]
je 0x1400209fd
mov bh, 0xf3
invalid
scasd eax, dword [rdi]
imul esi, dword [rax - 0x5e], 0xfffffff0
jnp 0x140020a05
invalid
add cl, dl
out 0xe1, eax
mov dl, al
mov edx, 0x24936251
test byte [rsi - 0x1582d84b], bh
add byte [rbx + 0x6c], ah
pop rbp
cmc
fdivr qword [rdi]
adc al, 0xff
sbb ah, al
in al, 0xe0
invalid
Function at 0x140011203
Capabilities:
Terminate process

Disassembly:
jmp 0x1400139b0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x14001128f
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014cf0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014d10
xor al, al
jmp 0x140014d91
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014d23
xor al, al
jmp 0x140014d91
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140014d4d
xor al, al
jmp 0x140014d91
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014d61
xor al, al
jmp 0x140014d91
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014d73
xor al, al
jmp 0x140014d91
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140014d8f
xor al, al
jmp 0x140014d91
mov al, 1
add rsp, 0x38
ret
Function at 0x14001b5e0
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rsi, rcx
mov rax, qword [0x140114028]
xor rax, rsp
mov qword [rsp + 0x88], rax
movabs rax, 0x300000050
lea rdi, [rsp + 0x38]
mov qword [rdi], rax
lea rax, [0x14001b730]
mov qword [rdi + 8], rax
xor ebx, ebx
mov qword [rdi + 0x10], rbx
mov rax, qword [rcx]
mov qword [rdi + 0x18], rax
mov qword [rdi + 0x20], rbx
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [rdi + 0x28], rax
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateSolidBrush]
mov qword [rdi + 0x30], rax
mov qword [rdi + 0x38], rbx
lea rax, str.GxSplashWindow
mov qword [rdi + 0x40], rax
mov qword [rdi + 0x48], rbx
mov rcx, rdi
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
lea r8, [0x14001b6c0]
xor ecx, ecx
xor edx, edx
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi + 0x18], rax
test rax, rax
je 0x14001b69c
add rsi, 0x20
mov rcx, rsi
call fcn.14005dac0
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140081b60
nop
add rsp, 0x90
pop rbx
pop rdi
pop rsi
ret

Function at 0x14001b6d0
Capabilities:
Terminate thread

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14001b6f2
mov edx, 0x10
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x14001b728
mov edx, 0x3e8
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14001b716
mov rcx, qword [rsi + 0x18]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi + 0x18], 0
add rsp, 0x20
pop rsi
ret
Function at 0x14001bc40
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov qword [rcx], 0
test rdx, rdx
je 0x14001bc87
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14001bc92
lea rax, [rdi + 1]
cmp rax, 2
jb 0x14001bc7f
mov qword [rsi], rdi
call fcn.140060c80
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.140060c80
mov rcx, qword [rsi]
call fcn.14005a900
mov qword [rsi], 0
jmp 0x14001bc6d

Function at 0x14001bce0
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
xor eax, eax
mov qword [rcx], rax
mov rbx, qword [rdx]
mov qword [rdx], rax
lea r14, [rbx + 1]
cmp r14, 2
jb 0x14001bd06
call fcn.140060c80
cmp qword [rsi], rbx
je 0x14001bd35
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14001bd42
cmp r14, 2
jb 0x14001bd2d
mov qword [rsi], rbx
call fcn.140060c80
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.140060c80
mov rcx, qword [rsi]
call fcn.14005a900
mov qword [rsi], 0
jmp 0x14001bd1f

Function at 0x14001bd60
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rbx, qword [rdx]
mov qword [rdx], 0
lea r14, [rbx + 1]
cmp r14, 2
jb 0x14001bd85
call fcn.140060c80
cmp qword [rsi], rbx
je 0x14001bdb4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14001bdc1
cmp r14, 2
jb 0x14001bdac
mov qword [rsi], rbx
call fcn.140060c80
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.140060c80
mov rcx, qword [rsi]
call fcn.14005a900
mov qword [rsi], 0
jmp 0x14001bd9e

Function at 0x14001be90
Capabilities:
Terminate process

Disassembly:
mov rcx, qword [rcx]
lea rax, [rcx + 1]
cmp rax, 2
jae 0x14001be9e
ret
xor edx, edx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
sub ah, cl
fild word [rax]
invalid
cmc
lodsb al, byte [rsi]
ret
or dword [rdx + 3], ecx
pop rdx
mov dh, 0xf7
push rsi
push rbp
push rax
xchg esp, eax
cmp byte [rsi + riz*2], bl
xor byte [0xf8dab54b], dh
invalid
Function at 0x14001df90
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rsi, rcx
mov rax, qword [0x140114028]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea rdx, str.opera_splash_done_
lea rdi, [rsp + 0x38]
mov rcx, rdi
call fcn.1400b3b00
movzx r8d, byte [rsi + 0x1f]
test r8b, r8b
js 0x14001dfd3
lea rdx, [rsi + 8]
and r8d, 0x7f
jmp 0x14001dfdb
mov r8, qword [rsi + 0x10]
mov rdx, qword [rsi + 8]
mov rcx, rdi
call fcn.14002c6f0
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x30], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x20], xmm0
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
cmp byte [rsp + 0x4f], 0
jns 0x14001e013
mov rcx, qword [rsp + 0x38]
call fcn.140080710
cmp byte [rsp + 0x37], 0
js 0x14001e021
lea r9, [rsp + 0x20]
jmp 0x14001e026
mov r9, qword [rsp + 0x20]
xor r14d, r14d
xor ecx, ecx
mov edx, 1
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
test rax, rax
je 0x14001e063
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp rbx, 0xffffffffffffffff
je 0x14001e0de
call fcn.140060c80
mov r14, rbx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rbx, [r14 + 1]
cmp rbx, 2
jb 0x14001e072
call fcn.140060c80
cmp qword [rsi + 0x40], r14
je 0x14001e0a4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rax, qword [rsi + 0x40]
inc rax
cmp rax, 2
jae 0x14001e0e6
cmp rbx, 2
jb 0x14001e09c
mov qword [rsi + 0x40], r14
call fcn.140060c80
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp byte [rsp + 0x37], 0
jns 0x14001e0b5
mov rcx, qword [rsp + 0x20]
call fcn.140080710
mov rax, qword [rsi + 0x40]
inc rax
test rax, 0xfffffffffffffffe
setne bl
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140081b60
mov eax, ebx
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
xor r14d, r14d
jmp 0x14001e05b
call fcn.140060c80
mov rcx, qword [rsi + 0x40]
call fcn.14005a900
mov qword [rsi + 0x40], 0
jmp 0x14001e08d
Function at 0x14001e7e0
Capabilities:
Reference processor manufacturer constants

Disassembly:
push rsi
push rdi
mov r8, rcx
xor edi, edi
xor ecx, ecx
xor eax, eax
xchg rbx, r9
cpuid
xchg rbx, r9
test eax, eax
jle 0x14001e902
mov r10d, eax
xor ecx, ecx
mov eax, 1
xchg rbx, r9
cpuid
xchg rbx, r9
mov r9d, ecx
mov r11d, edx
mov esi, eax
cmp r10d, 7
jb 0x14001e938
mov eax, 7
xor ecx, ecx
xchg rbx, rdi
cpuid
xchg rbx, rdi
mov r10d, ecx
and edi, 0x20
shr r10b, 4
and r10b, 1
mov dword [r8], esi
mov eax, esi
and eax, 0xf
mov dword [r8 + 8], eax
shr esi, 0xc
and esi, 3
mov dword [r8 + 4], esi
mov eax, r11d
shr eax, 0x17
and al, 1
mov byte [r8 + 0xc], al
mov eax, r11d
shr eax, 0x19
and al, 1
mov byte [r8 + 0xd], al
shr r11d, 0x1a
and r11b, 1
mov byte [r8 + 0xe], r11b
mov eax, r9d
and al, 1
mov byte [r8 + 0xf], al
mov eax, r9d
shr eax, 9
and al, 1
mov byte [r8 + 0x10], al
mov eax, r9d
shr eax, 0x13
and al, 1
mov byte [r8 + 0x11], al
mov eax, r9d
shr eax, 0x14
and al, 1
mov byte [r8 + 0x12], al
mov eax, r9d
shr eax, 0x17
and al, 1
mov byte [r8 + 0x13], al
mov eax, r9d
shr eax, 0x1f
mov byte [r8 + 0x1a], al
mov eax, r9d
not eax
test eax, 0x1c000000
jne 0x14001e940
xor ecx, ecx
xgetbv
not eax
test al, 6
sete al
mov byte [r8 + 0x14], al
mov ecx, r9d
shr ecx, 0x19
and cl, 1
mov byte [r8 + 0x17], cl
shr r9d, 0xc
and r9b, 1
mov byte [r8 + 0x15], r9b
test al, al
setne al
test edi, edi
setne cl
and cl, al
mov byte [r8 + 0x16], cl
mov byte [r8 + 0x18], r10b
xor ecx, ecx
mov eax, 0x80000000
xchg rbx, r9
cpuid
xchg rbx, r9
cmp eax, 0x80000006
jle 0x14001e944
mov eax, 0x80000007
xor ecx, ecx
xchg rbx, r9
cpuid
xchg rbx, r9
shr edx, 8
and dl, 1
mov byte [r8 + 0x19], dl
test dl, dl
je 0x14001e94a
pop rdi
pop rsi
ret
xor r10d, r10d
jmp 0x14001e83c
xor eax, eax
jmp 0x14001e8d1
mov dl, byte [r8 + 0x19]
jmp 0x14001e931
cmp byte [r8 + 0x1a], 0
je 0x14001e935
mov eax, 0x40000000
xor ecx, ecx
xchg rbx, r9
cpuid
xchg rbx, r9
cmp r9d, 0x7263694d
jne 0x14001e935
cmp ecx, 0x666f736f
jne 0x14001e935
cmp edx, 0x76482074
jne 0x14001e935
mov byte [r8 + 0x19], 1
jmp 0x14001e935
Function at 0x14001fac0
Capabilities:
Set thread local storage value

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rax, qword [0x140114028]
xor rax, rsp
mov qword [rsp + 0x50], rax
test rcx, rcx
je 0x14001fd09
movabs rax, 0xe69e32f3ad9ea63
cmp qword [0x140121010], rax
jne 0x14001fd0c
mov rsi, rcx
mov r14d, dword [rcx + 8]
add r14, 0x518
mov byte [rsp + 0x3f], 0xaa
cmp byte [rcx + 2], 0
sete al
bsr rdx, r14
xor rdx, 0xffffffffffffffc0
lea rcx, [0x1400fb680]
mov cl, byte [rdx + rcx + 0x41]
mov r8, r14
shr r8, cl
and r8d, 7
lea rcx, [0x1400fb6d0]
mov rcx, qword [rcx + rdx*8 + 0x208]
and rcx, r14
lea rdx, [r8 + rdx*8]
add rdx, 0x208
cmp rcx, 1
sbb rdx, 0xffffffffffffffff
lea rcx, [0x1400fae68]
movzx ecx, word [rcx + rdx*2 + 0x400]
cmp cx, 0x6e
setb dl
and dl, al
movzx eax, dl
or eax, ecx
movzx eax, ax
lea r12, [rax + rax*4]
lea r15, [rsi + r12*8]
add r15, 0x48
lea rbx, [rsi + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x14001fc8f
mov rax, qword [r15]
mov rdi, qword [rax]
test rdi, rdi
je 0x14001fc9c
mov byte [rsp + 0x3f], 0
mov rcx, qword [rdi]
test rcx, rcx
je 0x14001fc88
lea rdx, [rsi + 0x48]
bswap rcx
mov r14d, dword [rdx + r12*8 + 0x18]
mov rdx, rcx
xor rdx, rdi
cmp rdx, 0x1fffff
ja 0x14001fd0f
mov edx, ecx
and edx, 0x1fc000
je 0x14001fd0f
prefetcht0 byte [rcx]
mov qword [rax], rcx
mov ecx, dword [rax + 0x18]
lea edx, [rcx + 2]
and edx, 0x3ffe
and ecx, 0xffffc001
or ecx, edx
mov dword [rax + 0x18], ecx
mov rax, qword [rax + 0x10]
mov eax, dword [rax + 0x18]
add rax, qword [rsi + 0x1498]
mov qword [rsi + 0x1498], rax
mov rcx, qword [rsi + 0x14a0]
cmp rcx, rax
cmova rax, rcx
mov qword [rsi + 0x14a0], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov rcx, rdi
mov rdx, rsi
call fcn.140051400
mov ecx, dword [0x140125a78]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x140123880]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x120], rdi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140081b60
mov rax, rdi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xor ecx, ecx
jmp 0x14001fbe9
mov rcx, rbx
call fcn.140050fe0
jmp 0x14001fb99
lea rax, [rsp + 0x3f]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x4000
mov rcx, r15
mov rdx, rsi
mov r8d, 2
mov r9, r14
call fcn.14004f110
test rax, rax
je 0x14001fd02
mov rdi, rax
and rax, 0xffffffffffe00000
mov ecx, edi
shr ecx, 0xe
movzx ecx, cl
shl rcx, 5
or rcx, rax
mov rax, rcx
or rax, 0x1000
or rcx, 0x101e
movzx ecx, byte [rcx]
and ecx, 0x3f
shl rcx, 5
sub rax, rcx
jmp 0x14001fc03
xor edi, edi
jmp 0x14001fc2d
int3
int3
movaps xmm0, xmmword [0x1400f9e60]
lea rsi, [rsp + 0x40]
movaps xmmword [rsi], xmm0
mov r8, qword [rdi]
lea rdx, str.first
mov rcx, rsi
call fcn.1400b5cb0
mov rcx, rsi
call fcn.140018990
mov rcx, r14
call fcn.1400b5d20
int3
Function at 0x1400220d0
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
sub rsp, 0x28
cmp qword [0x140127548], 0
jne 0x14002210d
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x140022100
mov dword [rdi], eax
mov dword [0x140127550], eax
mov qword [0x140127548], rsi
cmp eax, 0xffffffff
setne al
add rsp, 0x28
pop rdi
pop rsi
ret
int3

Function at 0x140025e00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, r8
mov rsi, rdx
mov r15b, byte [rbp + 0x68]
test byte [r9 + 8], 1
jne 0x140025e6b
mov dl, byte [rbp + 0x60]
movzx r8d, r15b
mov rax, qword [rcx]
mov rax, qword [rax + 0x30]
mov dword [rsp + 0x28], r8d
mov byte [rsp + 0x20], dl
mov rdx, rsi
mov r8, rdi
call qword [0x140138008]
mov rax, rsi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov qword [rsi], rdi
test al, al
jns 0x140025e4d
call fcn.140080710
jmp 0x140025e4d
lea rbx, [rbp - 0x20]
mov rcx, r9
mov rdx, rbx
call fcn.140058d60
lea rdx, [0x14012b2e0]
mov rcx, rbx
call fcn.1400598a0
mov r14, rax
mov rcx, qword [rbp - 0x20]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
test eax, eax
jne 0x140025eab
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140138008]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rbx + 0x10], rax
movaps xmm0, xmmword [0x1400f9e60]
movaps xmmword [rbx], xmm0
mov rax, qword [r14]
xor r15b, 1
movzx ecx, r15b
mov rax, qword [rax + rcx*8 + 0x28]
mov rcx, r14
mov rdx, rbx
call qword [0x140138008]
movzx eax, byte [rbx + 0x17]
test al, al
js 0x140025eee
mov edx, eax
and edx, 0x7f
jmp 0x140025ef2
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x20]
test rdx, rdx
je 0x140025e5d
test al, al
cmovns rcx, rbx
mov r14, rcx
jmp 0x140025f4e
movzx edx, al
mov rax, qword [rdi]
mov rax, qword [rax + 0x60]
mov rcx, rdi
call qword [0x140138008]
cmp eax, 0xffffffff
jne 0x140025f24
xor edi, edi
inc r14
movzx eax, byte [rbp - 9]
mov edx, eax
and edx, 0x7f
test al, al
mov rcx, qword [rbp - 0x20]
mov r8, rbx
cmovs rdx, qword [rbp - 0x18]
cmovs r8, rcx
add rdx, r8
cmp r14, rdx
je 0x140025e5d
test rdi, rdi
je 0x140025f22
mov al, byte [r14]
mov rcx, qword [rdi + 0x30]
cmp rcx, qword [rdi + 0x38]
je 0x140025f0a
lea rdx, [rcx + 1]
mov qword [rdi + 0x30], rdx
mov byte [rcx], al
jmp 0x140025f24