joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003d7f0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x68], rcx
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x68]
add rax, 0x60
mov qword [rsp + 0x70], rax
mov rax, qword [rcx]
movabs rcx, 0xd569627d6ecce962
movabs rdx, 0xd569627d6ecce962
xor rcx, rdx
cmp rax, rcx
jle 0x14003da21
mov rax, qword [rsp + 0x68]
add rax, 8
mov qword [rsp + 0x58], rax
xor eax, eax
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x48], rcx
mov rax, qword [rax]
mov rax, qword [rax + rcx*8 + 8]
mov qword [rsp + 0x50], rax
cmp rax, 0
je 0x14003d9f6
mov rax, qword [rsp + 0x50]
movabs rcx, 0xb71ca76dd5bd0faa
add rax, rcx
add rax, 0xfffffffffffffff0
movabs rcx, 0xb71ca76dd5bd0faa
sub rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
cmp rax, 0x10
jb 0x14003d9a6
mov rdx, qword [rsp + 0x40]
xor eax, eax
mov ecx, eax
sub rcx, 0xfffffffffffffff0
mov rax, rdx
sub rax, rcx
mov qword [rsp + 0x30], rax
mov rcx, rax
xor rcx, rdx
cmp rcx, 0
setl dl
cmp rax, 0xffffffffffffffff
setg cl
xor dl, 0xff
mov al, cl
xor al, dl
and al, cl
test al, 1
jne 0x14003d8ed
jmp 0x14003d8f7
call fcn.14000ee80
jmp 0x14003d9f6
mov eax, dword [0x1402a9a08]
sub eax, dword [0x1402a9a0c]
or eax, 0x88f51eb
mov ecx, eax
add ecx, 1
xor eax, 0xffffffff
or eax, 0x3ba6dcc0
add eax, ecx
and eax, 0x4620d689
mov ecx, 0x33615061
xor ecx, 0x3df4b4ad
cmp eax, ecx
jae 0x14003da5c
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
mov eax, dword [0x1402a9a10]
mov r8d, dword [0x1402a9a14]
mov r9d, 0xe203be09
xor r9d, 0x1dfc41f6
xor r8d, r9d
add eax, r8d
mov r8d, 0x95b7d2f7
xor r8d, 0x95b7d2f6
add eax, r8d
and eax, 0xd2e1ef64
and eax, 0x378e69c
mov r8d, 0x529929d5
xor r8d, 0x529929d5
mov r9d, 0xdbcbf5a5
xor r9d, 0xb8fbda18
sub r8d, r9d
add eax, r8d
mov qword [rcx], rdx
cmp eax, 0xd2b75ea9
je 0x14003da5c
jmp 0x14003d9f6
mov rcx, qword [rsp + 0x50]
call fcn.1401ee560
mov rax, qword [rsp + 0x70]
cmp byte [rax], 0
jne 0x14003da56
mov rcx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x58]
mov rax, qword [rax]
mov rax, qword [rax + rcx*8 + 8]
add rax, 0xfffffffffffffff0
mov qword [rsp + 0x28], rax
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0x28]
mov rcx, rax
add rcx, 0x68
call fcn.140017ba0
mov rcx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x48]
xor edx, edx
sub rdx, rax
xor eax, eax
sub rax, 1
add rdx, rax
xor eax, eax
sub rax, rdx
cmp rax, qword [rcx]
mov qword [rsp + 0x60], rax
jl 0x14003d84b
mov rax, qword [rsp + 0x68]
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], rax
cmp rax, 0
je 0x14003da56
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0x20]
mov rcx, rax
add rcx, 0x68
call fcn.140017ba0
nop
add rsp, 0x78
ret
cli
mov ebp, 0xfecae9b4
invalid
Function at 0x14003da65
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
call fcn.1400af330
mov rax, qword [rsp + 0x30]
cmp byte [rax + 0x60], 0
jne 0x14003daa5
mov rcx, qword [rsp + 0x28]
call fcn.1400af5cf
nop
add rsp, 0x38
ret
Function at 0x14003e500
Capabilities:
Encode data using xor
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
call fcn.140072dee
mov rax, qword [rsp + 0x30]
cmp byte [rax + 0x60], 0
jne 0x14003e619
mov eax, dword [str.R_0W]
sub eax, dword [0x1402a9a6c]
mov ecx, 0x25cf999b
xor ecx, 0xdaee9af6
or eax, ecx
mov ecx, 0x46767527
xor ecx, 0xb9898ad8
xor eax, ecx
mov ecx, 0xffffffff
xor ecx, 0xeca53e6c
mov edx, 0xffffffff
xor edx, 0xb8ccab22
or eax, ecx
mov ecx, 0xa90c9cd8
xor ecx, 0x11c037fa
or ecx, edx
xor eax, 0xffffffff
and eax, ecx
mov ecx, eax
xor ecx, 0xffffffff
and ecx, 0x76d06647
mov edx, 0xffffffff
xor edx, 0x76d06647
and eax, edx
sub eax, ecx
cmp eax, 0x9cb9321d
jae 0x14003e61e
mov eax, dword [0x1402a9a70]
xor eax, 0xada6321b
mov ecx, dword [0x1402a9a74]
sub eax, ecx
mov ecx, 0xf1ab799d
imul rax, rcx
shr rax, 0x3e
imul eax, eax, 0x622500b4
imul rax, rax, 0x6b2edf73
shr rax, 0x3b
mov dword [rsp + 0x24], eax
mov eax, 0x1b1b0a11
mov dword [rsp + 0x20], eax
mov ecx, dword [0x1402d10b0]
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov rdx, qword [rsp + 0x28]
mov ecx, dword [rsp + 0x20]
mov eax, dword [rsp + 0x24]
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
movups xmmword [rdx + 0x10], xmm0
cmp eax, ecx
je 0x14003e5a8
jmp 0x14003e619
add rsp, 0x38
ret
sar byte [rax - 0x7c], 1
scasb al, byte [rdi]
jmp 0x14003e5a8
Function at 0x14003f0b6
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
call fcn.1401981b0
mov rax, qword [rsp + 0x30]
cmp byte [rax + 0x60], 0
jne 0x14003f0f6
mov rcx, qword [rsp + 0x28]
call fcn.1401983d9
nop
add rsp, 0x38
ret
Function at 0x14003ff40
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx + 8]
mov qword [rsp + 0x20], rax
cmp rax, 0
je 0x14003ff74
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0x20]
mov rcx, rax
add rcx, 0x68
call fcn.140017ba0
mov eax, dword [0x1402a9b58]
xor eax, 0x39fe92a3
xor edx, edx
div dword [0x1402a9b5c]
mov ecx, eax
add ecx, 0xfd2201b4
add ecx, 0x132911f5
sub ecx, 0xfd2201b4
mov eax, 0xe7393045
xor eax, 0xe3a2b1d7
or ecx, eax
mov eax, ecx
and eax, 0x929c60cc
mov edx, 0x1827d182
xor edx, 0x8abbb14e
or ecx, edx
add eax, ecx
mov ecx, 0xe643c33a
xor ecx, 0x4df51462
cmp eax, ecx
je 0x140040025
mov eax, dword [0x1402a9b60]
xor eax, 0xdcb9fe4a
mov ecx, dword [0x1402a9b64]
add eax, 0xaac03ccd
sub eax, ecx
mov ecx, 0xa6db5246
xor ecx, 0xc1b6e8b
sub eax, ecx
xor ecx, ecx
sub ecx, 0x80c689b3
sub eax, ecx
and eax, 0x756ae23f
mov ecx, 0x1d524a7a
xor edx, edx
div ecx
mov ecx, 0xd9ac8be8
xor ecx, 0x161ee53b
cmp eax, ecx
je 0x140040025
add rsp, 0x28
ret
movsb byte [rdi], byte [rsi]
imul ebx, dword [rdx - 0x5d168d], 0xffffffff
dec dword [rax - 0x39]
add dword [rax], eax
add byte [rax], al
add cl, ch
invalid

Function at 0x140040180
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rcx
mov eax, dword [0x1402a9b78]
xor edx, edx
div dword [0x1402a9b7c]
sub eax, 0x41aa2b3
and eax, 0x7a5b55e4
mov ecx, 0x4f78886e
xor edx, edx
div ecx
mov ecx, 0x41257254
xor ecx, 0x7cb4d0d3
cmp eax, ecx
jae 0x1400402a8
mov eax, dword [0x1402a9b80]
xor eax, 0xda8dda83
mov edx, dword [0x1402a9b84]
xor edx, 0x1ee01ff5
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov ecx, 0x62ec3d24
xor edx, edx
div ecx
mov rdx, qword [rsp + 0x30]
mov ecx, eax
xor ecx, 0xffffffff
mov r8d, 0xf55981c1
xor r8d, 0x1b394525
and r8d, ecx
mov r9d, 0xffffffff
xor r9d, 0xee60c4e4
mov ecx, eax
and ecx, r9d
imul ecx, r8d
mov r8d, eax
and r8d, 0xee60c4e4
or eax, 0xee60c4e4
imul eax, r8d
add eax, ecx
mov ecx, 0x82731fb8
xor ecx, 0x82731fb8
mov r8d, 0x50b9ab56
xor r8d, 0xef5220c3
sub ecx, r8d
add eax, ecx
mov ecx, 0xad13c506
xor ecx, 0xd7f25d16
mov rdx, qword [rdx + 8]
mov qword [rsp + 0x20], rdx
cmp rdx, 0
sete dl
mov byte [rsp + 0x2f], dl
cmp eax, ecx
ja 0x1400401bd
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x1400402a2
jmp 0x140040285
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0x20]
mov rcx, rax
add rcx, 0x68
call fcn.140017ba0
nop
add rsp, 0x38
ret
cmp al, 0x8f
push 0xffffffffff0ce971
invalid
Function at 0x140040af0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x40], rdx
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rcx, qword [rax]
mov qword [rsp + 0x50], rcx
mov rdx, rax
add rdx, 8
mov qword [rsp + 0x58], rdx
mov rax, qword [rax + 8]
mov qword [rsp + 0x60], rax
mov r8, 0xffffffffffffffff
xor r8, 1
xor edx, edx
sub rdx, 1
sub r8, rdx
mov rdx, rcx
sub rdx, r8
mov qword [rsp + 0x68], rdx
movabs r9, 0x647a17bef857bedf
movabs r8, 0x9b85e84107a84120
xor r9, r8
mov r8, rcx
xor r8, r9
and r8, 0xffffffffffffffff
mov r9, 0xffffffffffffffff
xor r9, 0xffffffffffffffff
and rcx, r9
or r8, rcx
mov rcx, rdx
and rcx, r8
xor rcx, 0xffffffffffffffff
xor rdx, 0xffffffffffffffff
movabs r9, 0x942ddf377a00d946
movabs r10, 0x6bd220c885ff26b9
xor r9, r10
xor r8, r9
or rdx, r8
and rcx, rdx
movabs rdx, 0x7e44256cc82a3974
movabs r8, 0x81bbda9337d5c68b
xor rdx, r8
xor rcx, rdx
mov qword [rsp + 0x70], rcx
cmp rax, 0
je 0x140040c3a
mov rax, qword [rsp + 0x70]
cmp rax, 0
jl 0x140040c30
mov rax, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
movabs rcx, 0xbfffffffffffffff
and rcx, qword [rax]
cmp rcx, rdx
mov qword [rsp + 0x38], rax
jge 0x140040c84
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
mov r8d, 1
mov r9d, 8
mov qword [rsp + 0x20], 8
call fcn.140023a90
mov rcx, qword [rsp + 0x58]
mov qword [rcx], rax
mov qword [rsp + 0x38], rax
jmp 0x140040c84
call fcn.14000ee80
jmp 0x140040d2f
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
mov r8d, 1
mov r9d, 8
mov qword [rsp + 0x20], 8
call fcn.140023a90
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x70]
mov qword [rdx], rax
cmp rcx, 0
mov qword [rsp + 0x38], rax
jge 0x140040c84
call fcn.14000ee80
jmp 0x140040d2f
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x30], rax
mov ecx, dword [0x1402a9bc8]
xor ecx, 0x95a34d08
mov eax, dword [0x1402a9bcc]
xor eax, 0x8fc64a2b
and ecx, eax
mov eax, 0x536d406e
xor eax, 0x28d6d0a4
imul ecx, eax
mov eax, 0xf23df918
xor eax, 0x50a89ac2
or ecx, eax
mov edx, 0xffffffff
xor edx, 0x5f5fbfe6
mov eax, ecx
xor eax, edx
and eax, ecx
cmp eax, 0x85e1b146
ja 0x140040d34
mov rcx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x40]
mov r9, qword [rsp + 0x48]
mov r10, qword [rsp + 0x68]
mov eax, dword [0x1402a9bd0]
xor eax, 0xa24d3f89
xor edx, edx
div dword [0x1402a9bd4]
mov rdx, qword [rsp + 0x50]
add eax, 0x6ea5a0cd
add eax, 0xdfa6afbc
xor eax, 0xa73b98c4
mov qword [r9], r10
mov qword [rcx + rdx*8 + 8], r8
cmp eax, 0xa33c19e
jbe 0x140040cdc
jmp 0x140040d2f
add rsp, 0x78
ret
adc edx, dword [rax - 0x601655b9]
invalid
Function at 0x140040d40
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
call fcn.14017610d
mov rax, qword [rsp + 0x30]
cmp byte [rax + 0x60], 0
jne 0x140040d80
mov rcx, qword [rsp + 0x28]
call fcn.140176105
mov ecx, dword [0x1402a9bd8]
xor ecx, dword [0x1402a9bdc]
add ecx, 0x63483bb3
add ecx, 0x258b374a
sub ecx, 0x63483bb3
mov r8d, 0xffffffff
xor r8d, 0xcfbbb446
mov edx, ecx
and edx, r8d
mov eax, ecx
or eax, r8d
xor eax, 0xffffffff
imul eax, edx
mov edx, ecx
and edx, 0xcfbbb446
mov r8d, 0x4f2b887
xor r8d, 0xcb490cc1
or ecx, r8d
imul ecx, edx
add ecx, eax
mov eax, ecx
or eax, eax
xor eax, 0xffffffff
mov edx, 0x1b303c24
or edx, 0x1b303c24
mov r8d, 0xf530dde3
xor r8d, 0xacf221c
xor edx, r8d
or eax, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x1b303c24
and ecx, edx
or eax, ecx
mov ecx, 0xf7baf6da
xor ecx, 0x8450925
xor eax, ecx
cmp eax, 0xa8d987fa
je 0x140040ea3
mov eax, dword [0x1402a9be0]
add eax, dword [0x1402a9be4]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0x54599392
add ecx, eax
mov eax, 0x3d26d256
xor eax, 0x3d26d256
sub eax, ecx
mov ecx, 0xc9362b8a
xor ecx, 0x36c9d475
mov edx, eax
xor edx, ecx
and edx, 0x77dd8128
mov r8d, 0xffffffff
xor r8d, 0x77dd8128
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0x77dd8128
or eax, 0x77dd8128
imul eax, edx
add eax, ecx
mov ecx, 0x343b3c32
xor edx, edx
div ecx
cmp eax, 0x3f899ceb
je 0x140040ea3
add rsp, 0x38
ret
int1
invalid

Function at 0x1400421d0
Capabilities:
Encode data using xor
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rcx
mov edx, dword [0x1402a9c98]
mov ecx, dword [0x1402a9c9c]
xor ecx, 0xa75ba34e
mov eax, edx
xor eax, 0xffffffff
mov r8d, 0x5da5a4b1
xor r8d, 0xa25a5b4e
xor edx, r8d
and eax, edx
or ecx, ecx
xor ecx, 0xffffffff
or eax, ecx
xor eax, 0xffffffff
xor eax, 0x921e32d3
mov ecx, 0x158adf03
xor edx, edx
div ecx
sub eax, 0xa16b023b
mov ecx, 0xbd08b676
xor ecx, 0x473f732b
cmp eax, ecx
je 0x1400422c7
mov eax, dword [0x1402a9ca0]
and eax, dword [0x1402a9ca4]
or eax, 0x681e546e
mov ecx, 0xba1707ab
xor ecx, 0x55dc6a10
xor eax, ecx
or eax, 0x9e07860f
mov dword [rsp + 0x28], eax
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.14007cc50
mov rcx, qword [rsp + 0x20]
mov eax, dword [rsp + 0x28]
cmp byte [rcx + 0x60], 0
sete cl
mov byte [rsp + 0x2f], cl
cmp eax, 0xac9b3390
jae 0x140042232
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x1400422a4
jmp 0x1400422c2
mov ecx, dword [0x1402d10b0]
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov rax, qword [rsp + 0x30]
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
add rsp, 0x38
ret
adc dword [rsi + 0x62e93900], edx
invalid
Function at 0x140042b60
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x50
mov qword [rsp + 0x48], rcx
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x48]
cmp rcx, 0
je 0x140042d88
mov rax, qword [rsp + 0x48]
movabs rcx, 0x6bb82496d4669c60
movabs rdx, 0x9447db692b996390
xor rcx, rdx
add rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
cmp rax, 0x10
jb 0x140042d67
mov rcx, qword [rsp + 0x40]
xor eax, eax
mov edx, eax
sub rdx, 0xfffffffffffffff0
mov rax, rcx
sub rax, rdx
mov qword [rsp + 0x30], rax
mov r8, rax
xor r8, rcx
movabs rdx, 0xf06964d755f9ad
movabs r9, 0xff0f969b28aa0652
xor rdx, r9
xor r8, rdx
mov rdx, rcx
and rdx, r8
shl rdx, 1
sub rdx, rcx
mov rcx, rax
sub rcx, rdx
cmp rcx, 0
setl cl
cmp rax, 0xffffffffffffffff
setg al
and al, cl
test al, 1
jne 0x140042c23
jmp 0x140042c2d
call fcn.14000ee80
jmp 0x140042d88
mov eax, dword [0x1402a9ce8]
mov edx, dword [0x1402a9cec]
mov ecx, eax
xor ecx, edx
xor ecx, 0xffffffff
or eax, edx
and eax, ecx
mov edx, 0xffffffff
xor edx, 0x6f0f3ba1
mov ecx, eax
and ecx, edx
mov edx, eax
xor edx, 0x6f0f3ba1
add eax, edx
sub eax, ecx
mov ecx, 0x88d65f2d
xor edx, edx
div ecx
mov ecx, 0x5ee7b2a6
xor edx, edx
div ecx
mov ecx, 0x95b77677
xor ecx, 0x7d53272a
cmp eax, ecx
jae 0x140042d8f
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov r9d, dword [0x1402a9cf0]
mov r11d, dword [0x1402a9cf4]
mov r8d, r9d
xor r8d, 0xffffffff
mov r10d, r11d
and r10d, r8d
mov esi, r11d
xor esi, 0xffffffff
mov r8d, r9d
and r8d, esi
imul r8d, r10d
mov r10d, r9d
and r10d, r11d
or r9d, r11d
imul r9d, r10d
add r9d, r8d
sub r9d, 0xf00c1fd
mov r8d, r9d
or r8d, r8d
mov r10d, 0x5caa4a92
xor r10d, 0xa355b56d
xor r8d, r10d
mov r10d, 0xffffffff
xor r10d, 0x9ce8561
mov r11d, 0xffffffff
xor r11d, 0x9ce8561
and r10d, r11d
xor r8d, 0xffffffff
xor r10d, 0xffffffff
and r8d, r10d
mov r10d, 0x9857021a
xor r10d, 0x9199877b
or r9d, r10d
mov r10d, 0xf1058068
xor r10d, 0xefa7f97
xor r9d, r10d
or r8d, r9d
xor r8d, 0xffffffff
add r8d, 0x38f2b29f
mov dword [rsp + 0x2c], r8d
mov qword [rdx], rcx
mov r8, qword [rax]
xor ecx, ecx
call fcn.14001d8a6
mov eax, dword [rsp + 0x2c]
cmp eax, 0x8fcd9809
jb 0x140042c84
jmp 0x140042d88
mov rax, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x38]
mov r8, qword [rax]
mov ecx, 1
call fcn.14001d8a6
mov rcx, qword [rsp + 0x48]
call fcn.14001d970
nop
add rsp, 0x50
pop rsi
ret
pop rbx
and dword [rbx - 0x2c], edx
jmp 0x140042c84

Function at 0x1400430e6
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
call fcn.14010e600
mov rax, qword [rsp + 0x30]
cmp byte [rax + 0x60], 0
jne 0x140043126
mov rcx, qword [rsp + 0x28]
call fcn.14010e804
nop
add rsp, 0x38
ret
Function at 0x140043540
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x88
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0x68], rcx
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x68]
Function at 0x140044d10
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x58], rcx
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
add rax, 0x60
Function at 0x140045642
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
call fcn.1401cf960
mov rax, qword [rsp + 0x30]
mov al, byte [rax + 0x60]
mov cl, 0x54
xor cl, 0x54
cmp al, cl
jne 0x140045688
mov rcx, qword [rsp + 0x28]
call fcn.1401cfaf6
nop
add rsp, 0x38
ret
Function at 0x140046318
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
call fcn.1401f18e0
mov rax, qword [rsp + 0x30]
cmp byte [rax + 0x60], 0
jne 0x140046358
mov rcx, qword [rsp + 0x28]
call fcn.1401f1dc0
nop
add rsp, 0x38
ret
Function at 0x1400466cd
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x70
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], rcx
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
add rax, 0x60
mov qword [rsp + 0x60], rax
mov rax, qword [rcx]
mov qword [rsp + 0x68], rax
cmp rax, rdx
jle 0x140046720
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call fcn.140046360
jmp 0x14004697e
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
cmp rax, rcx
jge 0x14004697e
mov rax, qword [rsp + 0x50]
mov rcx, rax
add rcx, 8
mov qword [rsp + 0x40], rcx
mov rax, qword [rax + 8]
mov qword [rsp + 0x48], rax
cmp rax, 0
je 0x140046777
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x48]
movabs rax, 0xbfffffffffffffff
and rax, qword [rdx]
cmp rax, rcx
jge 0x14004687d
mov rdx, qword [rsp + 0x68]
mov r9, qword [rsp + 0x58]
movabs rax, 0x86ea865f553d23d0
mov rcx, r9
sub rcx, rax
sub rcx, rdx
movabs rax, 0x86ea865f553d23d0
add rcx, rax
mov qword [rsp + 0x38], rcx
mov r8, rcx
xor r8, 0xffffffffffffffff
movabs rax, 0x988f296f4e27e68e
movabs r10, 0xc0e06043297dc932
xor rax, r10
and rax, r8
mov r11, 0xffffffffffffffff
movabs r8, 0x586f492c675a2fbc
xor r11, r8
mov r10, rcx
and r10, r11
mov r8, r9
xor r8, 0xffffffffffffffff
movabs rsi, 0x586f492c675a2fbc
and r8, rsi
and r9, r11
or rax, r10
or r8, r9
xor rax, r8
cmp rax, 0
setl al
xor rcx, rdx
cmp rcx, 0xffffffffffffffff
setg cl
and al, cl
test al, 1
jne 0x140046873
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x68]
movabs r9, 0x1e9d6f39d381bdf2
movabs rax, 0x1e9d6f39d381bdfa
xor r9, rax
movabs rax, 0x2a03ccfe02fe5e2a
movabs r10, 0x2a03ccfe02fe5e22
xor rax, r10
mov qword [rsp + 0x20], rax
call fcn.140023a90
mov rcx, rax
mov rax, qword [rsp + 0x40]
mov qword [rax], rcx
jmp 0x14004687d
call fcn.14000ee80
jmp 0x14004697e
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov qword [rcx], rdx
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
cmp rax, rcx
jge 0x14004697e
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
add rcx, 8
shl rax, 3
add rcx, rax
xor eax, eax
mov edx, eax
call fcn.1401f1dd0
mov rax, qword [rsp + 0x60]
cmp byte [rax], 0
jne 0x14004697e
mov rdx, qword [rsp + 0x28]
mov rax, rdx
and rax, 1
movabs r8, 0x1308b81995ecb12f
movabs rcx, 0x1308b81995ecb12e
xor r8, rcx
mov rcx, rdx
or rcx, r8
add rax, rcx
mov r8, rdx
xor r8, 0xffffffffffffffff
xor r8, 0xffffffffffffffff
and r8, 0xffffffffffffffff
movabs rcx, 0x5335aee866c70ebf
movabs r9, 0x5335aee866c70ebd
xor rcx, r9
imul rcx, r8
movabs r8, 0x491d126617ac327a
movabs r9, 0xb6e2ed99e853cd85
xor r8, r9
sub rcx, r8
sub rdx, rcx
mov rcx, rax
and rcx, rdx
movabs rdx, 0x45ae093f25016aef
movabs r8, 0x45ae093f25016aef
xor rdx, r8
cmp rcx, rdx
mov qword [rsp + 0x30], rax
jge 0x140046894
call fcn.14000ee80
nop
add rsp, 0x70
pop rsi
ret
Function at 0x140046c90
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
call fcn.1401eff50
mov rax, qword [rsp + 0x30]
mov al, byte [rax + 0x60]
mov cl, 0x13
xor cl, 0x13
cmp al, cl
jne 0x140046cd6
mov rcx, qword [rsp + 0x28]
call fcn.1401f019b
mov eax, dword [0x1402a9e88]
xor eax, 0x4a5790c4
mov r8d, dword [0x1402a9e8c]
mov r9d, r8d
xor r9d, 0xffffffff
mov edx, eax
and edx, r9d
mov ecx, eax
or ecx, r9d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, eax
xor ecx, 0xc80de527
xor ecx, 0xffffffff
mov edx, 0xd06fa37d
xor edx, 0x1862465a
or eax, edx
and eax, ecx
xor eax, 0xade33ebd
sub eax, 0xe6a8fa06
cmp eax, 0x4a40f05
jb 0x140046dec
mov eax, dword [0x1402a9e90]
xor eax, 0x1577a0c5
mov ecx, dword [0x1402a9e94]
mov edx, eax
xor edx, 0xffffffff
xor eax, 0xffffffff
and edx, eax
mov eax, ecx
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
or edx, eax
mov eax, 0xc473f113
xor eax, 0x3b8c0eec
xor edx, eax
mov ecx, edx
xor ecx, 0x3b438ee8
mov eax, 0xffffffff
xor eax, 0x3b438ee8
and edx, eax
mov eax, 0x1c045fe0
xor eax, 0x1c045fe2
imul eax, edx
sub eax, ecx
mov ecx, eax
or ecx, ecx
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x18bc7e2d
mov r8d, 0xffffffff
xor r8d, 0x18bc7e2d
and edx, r8d
xor ecx, 0xffffffff
xor edx, 0xffffffff
and ecx, edx
or eax, 0x18bc7e2d
xor eax, 0xffffffff
xor ecx, 0xffffffff
xor eax, 0xffffffff
and ecx, eax
mov edx, 0xffffffff
xor edx, 0x89d93727
mov eax, ecx
xor eax, edx
and eax, ecx
cmp eax, 0xaef40a3f
ja 0x140046dec
add rsp, 0x38
ret
push rsp
adc eax, 0x46e92fb4
invalid
Function at 0x140048d75
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
call fcn.140279d76
mov rax, qword [rsp + 0x30]
cmp byte [rax + 0x60], 0
jne 0x140048db2
mov rcx, qword [rsp + 0x28]
call fcn.140279da0
nop
add rsp, 0x38
ret
Function at 0x14004a05f
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
call fcn.140279f20
mov rax, qword [rsp + 0x30]
mov al, byte [rax + 0x60]
mov cl, 0x5f
xor cl, 0x5f
cmp al, cl
jne 0x14004a0a2
mov rcx, qword [rsp + 0x28]
call fcn.14027a0a4
nop
add rsp, 0x38
ret
Function at 0x14004b1a5
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rcx
mov rdx, qword [rdx]
call fcn.140040390
mov rcx, qword [rsp + 0x40]
cmp qword [rcx], 0
jle 0x14004b24a
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
add rcx, 8
mov qword [rsp + 0x20], rcx
add rax, 8
mov qword [rsp + 0x28], rax
xor eax, eax
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x28]
mov r8, qword [rsp + 0x20]
mov r8, qword [r8]
mov r8b, byte [r8 + rax + 8]
mov rdx, qword [rdx]
mov byte [rdx + rax + 8], r8b
movabs rdx, 0x6566c1ea8cb250e5
add rax, rdx
add rax, 1
movabs rdx, 0x15ba1735a28abc88
movabs r8, 0x70dcd6df2e38ec6d
xor rdx, r8
sub rax, rdx
cmp rax, qword [rcx]
mov qword [rsp + 0x30], rax
jl 0x14004b1ed
add rsp, 0x48
ret