joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140057a8a
Capabilities:
Get file version info

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x70
mov rsi, r9
mov r15, r8
mov r14, rdx
mov rdi, rcx
mov rax, qword [0x1401ee6a8]
xor rax, rsp
mov qword [rsp + 0x68], rax
lea rdx, str.MSEdge
mov rcx, r14
call fcn.14002ee92
lea rdx, str.0.0.0.0_devel
mov rcx, r15
call fcn.14002ee92
cmp byte [rsi + 0x17], 0
js 0x140057ae2
mov word [rsi], 0
mov byte [rsi + 0x17], 0
jmp 0x140057af2
mov rax, qword [rsi]
mov word [rax], 0
mov qword [rsi + 8], 0
mov dword [rsp + 0x64], 0
cmp byte [rdi + 0x17], 0
mov rcx, rdi
jns 0x140057b06
mov rcx, qword [rdi]
mov r12, qword [rsp + 0xd0]
lea rdx, [rsp + 0x64]
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x140057c8d
mov ebp, eax
mov ecx, eax
call fcn.140163acc
mov rbx, rax
mov edx, dword [rsp + 0x64]
cmp byte [rdi + 0x17], 0
jns 0x140057b39
mov rdi, qword [rdi]
mov rcx, rdi
mov r8d, ebp
mov r9, rbx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x140057c85
lea rdx, [0x14019ebce]
lea rdi, [rsp + 0x40]
mov rcx, rdi
call fcn.140003584
mov rcx, rbx
mov rdx, rdi
mov r8, r15
call fcn.140057d0b
cmp byte [rdi + 0x17], 0
jns 0x140057b81
mov rcx, qword [rsp + 0x40]
call fcn.140163a8c
xorps xmm0, xmm0
lea rdi, [rsp + 0x40]
movaps xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
lea rdx, [0x14019ebec]
lea rbp, [rsp + 0x28]
mov rcx, rbp
call fcn.140003584
mov rcx, rbx
mov rdx, rbp
mov r8, rdi
call fcn.140057d0b
cmp byte [rbp + 0x17], 0
jns 0x140057bc6
mov rcx, qword [rsp + 0x28]
call fcn.140163a8c
movzx eax, byte [rsp + 0x57]
test al, al
jns 0x140057bd4
mov rax, qword [rsp + 0x48]
cmp rax, 1
jne 0x140057c01
mov qword [rsp + 0x20], 1
lea r9, [0x140197034]
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8, 0xffffffffffffffff
call fcn.14002f448
test eax, eax
je 0x140057c10
lea rdx, [0x14019ec0a]
mov rcx, r15
call fcn.14002ecc2
lea rdx, [0x14019ec18]
lea rdi, [rsp + 0x28]
mov rcx, rdi
call fcn.140003584
mov rcx, rbx
mov rdx, rdi
mov r8, r14
call fcn.140057d0b
cmp byte [rdi + 0x17], 0
jns 0x140057c42
mov rcx, qword [rsp + 0x28]
call fcn.140163a8c
lea rdx, str.SpecialBuild
lea rdi, [rsp + 0x28]
mov rcx, rdi
call fcn.140003584
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call fcn.140057d0b
cmp byte [rdi + 0x17], 0
jns 0x140057c74
mov rcx, qword [rsp + 0x28]
call fcn.140163a8c
cmp byte [rsp + 0x57], 0
jns 0x140057c85
mov rcx, qword [rsp + 0x40]
call fcn.140163a8c
mov rcx, rbx
call fcn.140163ad4
lea rcx, [rsp + 0x40]
call fcn.140057ec3
cmp byte [r12 + 0x17], 0
js 0x140057cae
mov word [r12], 0
mov byte [r12 + 0x17], 0
jmp 0x140057cda
mov rax, qword [r12]
mov word [rax], 0
mov qword [r12 + 8], 0
cmp byte [r12 + 0x17], 0
jns 0x140057cda
mov rcx, qword [r12]
call fcn.140163a8c
mov qword [r12 + 0x10], 0
mov rax, qword [rsp + 0x50]
mov qword [r12 + 0x10], rax
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [r12], xmm0
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140163e00
nop
add rsp, 0x70
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140057d0b
Capabilities:
Identify system language via api

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x278
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x1401ee6a8]
xor rax, rsp
mov qword [rsp + 0x270], rax
cmp byte [r8 + 0x17], 0
js 0x140057d4b
mov word [rsi], 0
mov byte [rsi + 0x17], 0
jmp 0x140057d5b
mov rax, qword [rsi]
mov word [rax], 0
mov qword [rsi + 8], 0
test rbx, rbx
je 0x140057e9e
lea r8, [rsp + 0x50]
mov qword [r8], 0
lea r9, [rsp + 0x260]
mov dword [r9], 0
lea rdx, str.VarFileInfoTranslation
mov rcx, rbx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x140057e9e
mov qword [rsp + 0x38], rsi
lea rsi, [rsp + 0x50]
mov rax, qword [rsi]
movzx r14d, word [rax]
movzx ebp, word [rax + 2]
mov word [rsp + 0x260], r14w
mov word [rsp + 0x262], bp
mov r15, qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
call r15
mov word [rsp + 0x264], ax
mov word [rsp + 0x266], bp
mov word [rsp + 0x268], r14w
mov bp, 0x4e4
mov word [rsp + 0x26a], bp
call r15
mov word [rsp + 0x26c], ax
mov word [rsp + 0x26e], bp
mov ebp, 2
lea r15, str.StringFileInfo_04hx_04hx_ls
lea r12, [rsp + 0x48]
lea r13, [rsp + 0x44]
movzx eax, word [rsp + rbp*2 + 0x25e]
cmp byte [rdi + 0x17], 0
mov rcx, rdi
jns 0x140057e28
mov rcx, qword [rdi]
movzx edx, r14w
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], edx
mov edx, 0x104
mov r8d, 0x104
mov rcx, rsi
mov r9, r15
call fcn.140057f72
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x44], 0
mov rcx, rbx
mov rdx, rsi
mov r8, r12
mov r9, r13
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x140057e7f
mov rdx, qword [rsp + 0x48]
test rdx, rdx
jne 0x140057e94
cmp rbp, 7
ja 0x140057e9e
movzx r14d, word [rsp + rbp*2 + 0x260]
add rbp, 2
jmp 0x140057e14
mov rcx, qword [rsp + 0x38]
call fcn.14002ee92
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140163e00
nop
add rsp, 0x278
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140059fdf
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1401ee6a8]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov eax, 0xffffffff
cmp r8, rax
mov ebx, 0xffffffff
cmovb ebx, r8d
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x2c]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14005a06f
mov r15, qword [sym.imp.KERNEL32.dll_GetFileType]
lea r14, [rsp + 0x2c]
mov r12, qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x2c]
test eax, eax
jne 0x14005a083
mov rcx, rdi
call r15
cmp eax, 3
jne 0x14005a0a8
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, rsi
mov r8d, ebx
mov r9, r14
call r12
test eax, eax
jne 0x14005a040
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x6d
setne sil
neg rsi
jmp 0x14005a08a
cmp eax, 0xffffffff
je 0x14005a0ae
mov esi, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140163e00
mov rax, rsi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov eax, dword [rsp + 0x2c]
jmp 0x14005a088
int3

Function at 0x14005a6bf
Capabilities:
Clear file content

Disassembly:
push rsi
push rdi
sub rsp, 0x178
mov rdi, rcx
mov rax, qword [0x1401ee6a8]
xor rax, rsp
mov qword [rsp + 0x170], rax
xor esi, esi
xor edx, edx
xor r8d, r8d
call fcn.14005a5fb
test rax, rax
jne 0x14005a756
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov sil, 1
test eax, eax
jne 0x14005a756
mov ecx, 2
call fcn.140038810
test al, al
je 0x14005a754
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_file_io_win.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0xf3
mov r9d, 2
call fcn.140039550
lea rcx, [rsp + 0x40]
lea rdx, [0x14019f262]
mov r8d, 0xc
call fcn.140001e11
mov rcx, rsi
call fcn.140039620
xor esi, esi
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140163e00
mov eax, esi
add rsp, 0x178
pop rdi
pop rsi
ret
Function at 0x14005c524
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
cmp dword [0x1401f5498], 0
mov r8, qword [rcx]
je 0x14005c556
mov rcx, qword [rsi + 0x28]
mov rdx, rdi
mov r9d, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.140004ae9
movsxd rax, ebx
mov rcx, rdi
mov rdx, r8
mov r8, rax
call fcn.1401667e0
mov ecx, dword [rsi + 0x4c]
mov r8d, ebx
mov rdx, rdi
call fcn.14005c184
mov dword [rsi + 0x4c], eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x140066c50
Capabilities:
Read file via mapping

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r14, r9
mov rdi, r8
mov ebx, edx
mov rsi, rcx
call fcn.140050060
test rdi, rdi
je 0x140066c9b
test al, al
je 0x140066c9b
movsxd rax, ebx
mov rdx, rax
sar rdx, 0x3f
add rax, rdi
adc rdx, 0
mov ecx, edx
and ecx, 1
neg rcx
xor rdx, rcx
jne 0x140066c9b
test rcx, rcx
js 0x140066c9b
cmp qword [rsi + 0x10], rax
jae 0x140066ca7
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rcx, rsi
mov edx, ebx
mov r8, rdi
mov r9, r14
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.140066fa0

Function at 0x140066fa0
Capabilities:
Read file via mapping

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x60
mov r14, r9
mov r15, r8
mov edi, edx
mov rsi, rcx
mov rax, qword [0x1401ee6a8]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor eax, eax
cmp dword [rcx + 8], 0
setne al
mov ebp, edx
sar ebp, 0x1f
lea r12d, [rax + rax]
add r12d, 4
mov rcx, qword [rcx]
mov qword [rsp + 0x20], r8
mov edx, r12d
mov r8d, ebp
mov r9d, edi
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbx, rax
mov qword [r14], rax
test rax, rax
jne 0x140067034
call fcn.14008c5c0
mov rcx, qword [rsi]
mov qword [rsp + 0x20], r15
mov edx, r12d
mov r8d, ebp
mov r9d, edi
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbx, rax
mov qword [r14], rax
test rax, rax
jne 0x140067034
call fcn.14008c5c0
mov rbx, qword [r14]
test rbx, rbx
je 0x140067088
mov rsi, qword [rsp + 0xc0]
lea rdx, [rsp + 0x28]
mov r8d, 0x30
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
mov rcx, qword [rsp + 0x40]
sub rcx, rbx
add rcx, qword [rsp + 0x30]
test rax, rax
cmove rcx, rax
mov qword [rsi], rcx
mov sil, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140163e00
mov eax, esi
add rsp, 0x60
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xor esi, esi
jmp 0x14006706a

Function at 0x1400671a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
mov eax, ecx
test r8, r8
je 0x14006721b
mov r9d, r8d
and r9d, 1
cmp r8, 1
jne 0x1400671be
xor ecx, ecx
test r9, r9
jne 0x140067203
jmp 0x14006721b
sub r8, r9
xor ecx, ecx
lea r10, [0x1401a1bc0]
nop word [rax + rax]
movzx r11d, al
movzx esi, byte [rdx + rcx]
xor esi, r11d
shr eax, 8
xor eax, dword [r10 + rsi*4]
movzx r11d, al
movzx esi, byte [rdx + rcx + 1]
xor esi, r11d
shr eax, 8
xor eax, dword [r10 + rsi*4]
add rcx, 2
cmp r8, rcx
jne 0x1400671d0
test r9, r9
je 0x14006721b
movzx r8d, al
movzx ecx, byte [rdx + rcx]
xor ecx, r8d
lea rdx, [0x1401a1bc0]
shr eax, 8
xor eax, dword [rdx + rcx*4]
pop rsi
ret

Function at 0x1400676d0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1401ee6b8]
cmp ecx, 0xffffffff
je 0x1400676f3
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
add eax, 0xffffffff
cmp eax, 2
setb al
jmp 0x1400676f5
xor eax, eax
add rsp, 0x28
ret
Function at 0x140067700
Capabilities:
Get thread local storage value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r14, rdx
mov r15, rcx
mov ecx, dword [0x1401ee6b8]
cmp ecx, 0xffffffff
je 0x140067726
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x14006772b
call fcn.140067840
mov eax, dword [0x1401f5318]
mov ecx, dword [0x1401f3a70]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400677f3
mov rbx, qword [0x1401f5310]
mov rcx, rbx
call fcn.140051750
mov rcx, qword [0x1401f3b00]
add rcx, 1
mov edx, 0x100
lea rax, [0x1401f3b10]
nop word cs:[rax + rax]
movzx edi, cl
lea rsi, [rdi + rdi*2]
cmp dword [rax + rsi*8], 0
je 0x1400677aa
lea edi, [rcx + 1]
movzx edi, dil
lea rsi, [rdi + rdi*2]
cmp dword [rax + rsi*8], 0
je 0x1400677aa
add rcx, 2
add rdx, 0xfffffffffffffffe
jne 0x140067780
jmp 0x1400677cf
lea rcx, [rax + rsi*8]
mov dword [rcx], 1
lea rcx, [rdi + rdi*2]
mov qword [rax + rcx*8 + 8], r14
mov qword [0x1401f3b00], rdi
mov dword [r15], edi
mov eax, dword [rax + rcx*8 + 0x10]
mov dword [r15 + 4], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [r15]
cmp eax, 0xffffffff
je 0x140067839
cmp eax, 0x100
jge 0x14006783c
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, [0x1401f5318]
call fcn.140163bb0
cmp dword [0x1401f5318], 0xffffffff
jne 0x140067750
mov ecx, 8
call fcn.140163a50
mov rbx, rax
mov rcx, rax
call fcn.1400457d0
mov qword [0x1401f5310], rbx
lea rcx, [0x1401f5318]
call fcn.140163c48
jmp 0x140067750
int3
int3

Function at 0x140067840
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
mov eax, 0x1038
call fcn.140163d90
sub rsp, rax
mov rax, qword [0x1401ee6a8]
xor rax, rsp
mov qword [rsp + 0x1030], rax
mov ecx, dword [0x1401ee6b8]
mov dword [rsp + 0x2c], ecx
cmp ecx, 0xffffffff
jne 0x1400678d8
lea rcx, [rsp + 0x2c]
call fcn.14008cce0
test al, al
je 0x140067953
mov ecx, dword [rsp + 0x2c]
cmp ecx, 0xffffffff
jne 0x1400678b6
lea rcx, [rsp + 0x2c]
call fcn.14008cce0
test al, al
je 0x140067956
cmp dword [rsp + 0x2c], 0xffffffff
je 0x140067956
mov ecx, 0xffffffff
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [rsp + 0x2c]
mov eax, 0xffffffff
lock cmpxchg dword [0x1401ee6b8], ecx
mov ecx, dword [rsp + 0x2c]
je 0x1400678d8
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [0x1401ee6b8]
mov dword [rsp + 0x2c], ecx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x140067950
lea rsi, [rsp + 0x30]
mov r8d, 0x1000
mov rcx, rsi
xor edx, edx
call fcn.140166bf0
mov ecx, dword [rsp + 0x2c]
lea rdx, [rsp + 0x33]
call sub.KERNEL32.dll_TlsSetValue
mov ecx, 0x1000
call fcn.140163acc
mov rdi, rax
mov r8d, 0x1000
mov rcx, rax
mov rdx, rsi
call fcn.1401667e0
mov ecx, dword [rsp + 0x2c]
mov rdx, rdi
or rdx, 3
call sub.KERNEL32.dll_TlsSetValue
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.140163e00
mov rax, rdi
add rsp, 0x1038
pop rdi
pop rsi
ret
int3
int3
int3
Function at 0x140067a30
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x1401ee6b8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140067a60
movsxd rcx, dword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 4]
jne 0x140067a60
mov rax, qword [rax + rcx]
jmp 0x140067a62
xor eax, eax
add rsp, 0x20
pop rsi
ret

Function at 0x140067a70
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x1401ee6b8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
jne 0x140067a98
test rdi, rdi
je 0x140067ab1
call fcn.140067840
movsxd rcx, dword [rsi]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rsi + 4]
movsxd rdx, dword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x14006f140
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test rdx, rdx
je 0x14006f182
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
nop word [rax + rax]
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x14006f18c
add rdi, rbx
sub rsi, rbx
jne 0x14006f160
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
int3

Function at 0x1400761f0
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r14, rdx
mov r13, rcx
mov rdi, qword [rcx + 0x10]
mov rax, qword [rcx + 0x18]
cmp rdi, rax
jne 0x1400763c4
mov r15, qword [r13]
mov rbx, qword [r13 + 8]
mov rcx, rbx
sub rcx, r15
jbe 0x140076282
sar rcx, 3
lea rax, [rcx + 1]
shr rax, 0x3f
add rax, rcx
add rax, 1
sar rax, 1
mov r12, rax
neg r12
shl rax, 3
mov r15, rbx
sub r15, rax
sub rdi, rbx
mov rsi, rdi
sar rsi, 3
test rdi, rdi
je 0x14007626d
mov rcx, r15
mov rdx, rbx
mov r8, rdi
call fcn.1401667e0
mov rbx, qword [r13 + 8]
lea rdi, [r15 + rsi*8]
mov qword [r13 + 0x10], rdi
lea rax, [rbx + r12*8]
mov qword [r13 + 8], rax
jmp 0x1400763c4
sub rax, r15
mov rcx, rax
sar rcx, 2
test rax, rax
mov esi, 1
cmovne rsi, rcx
mov rax, rsi
shr rax, 0x3d
jne 0x1400763df
mov r12, rsi
shr r12, 2
lea rcx, [rsi*8]
call fcn.140163a50
lea r11, [rax + r12*8]
mov r9, r11
lea r8, [rax + rsi*8]
sub rdi, rbx
je 0x14007639e
lea r10, [rdi - 8]
mov ecx, r10d
shr ecx, 3
add ecx, 1
and rcx, 7
je 0x140076308
neg rcx
mov rdx, r9
nop word cs:[rax + rax]
mov rsi, qword [rbx]
mov qword [rdx], rsi
add rdx, 8
add rbx, 8
inc rcx
jne 0x1400762f0
mov rcx, rdx
jmp 0x14007630e
mov rdx, r9
mov rcx, r9
add r11, rdi
cmp r10, 0x38
jb 0x14007639a
sar rdi, 3
shl r12, 3
lea rsi, [r12 + rdi*8]
sub rsi, rdx
mov r15, rax
add r15, rsi
lea r10, [rdx + 0x40]
xor esi, esi
nop word cs:[rax + rax]
mov rdi, qword [rbx + rsi]
mov qword [rcx], rdi
mov rcx, qword [rbx + rsi + 8]
mov qword [rdx + rsi + 8], rcx
mov rcx, qword [rbx + rsi + 0x10]
mov qword [rdx + rsi + 0x10], rcx
mov rcx, qword [rbx + rsi + 0x18]
mov qword [rdx + rsi + 0x18], rcx
mov rcx, qword [rbx + rsi + 0x20]
mov qword [rdx + rsi + 0x20], rcx
mov rcx, qword [rbx + rsi + 0x28]
mov qword [rdx + rsi + 0x28], rcx
mov rcx, qword [rbx + rsi + 0x30]
mov qword [rdx + rsi + 0x30], rcx
mov rcx, qword [rbx + rsi + 0x38]
mov qword [rdx + rsi + 0x38], rcx
lea rcx, [r10 + rsi]
add rsi, 0x40
cmp r15, rsi
jne 0x140076340
mov r15, qword [r13]
mov qword [r13], rax
mov qword [r13 + 8], r9
mov qword [r13 + 0x10], r11
mov qword [r13 + 0x18], r8
test r15, r15
je 0x1400763c1
mov rcx, r15
call fcn.140163a8c
mov rdi, qword [r13 + 0x10]
jmp 0x1400763c4
mov rdi, r11
mov rax, qword [r14]
mov qword [rdi], rax
add qword [r13 + 0x10], 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.140177b74
int3
Function at 0x1400764f4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
test r8, r8
je 0x14007660a
mov rdi, rcx
mov rax, qword [rcx + 8]
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx + 0x84], 0
je 0x14007660a
cmp word [rax + rcx + 0x14], 0x78
jb 0x14007660a
mov r12, r8
mov r13, rdx
mov edx, dword [rax + rcx + 0x88]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 8]
test rax, rax
je 0x14007660a
cmp r13, 0xffff
ja 0x140076564
mov word [r12], r13w
jmp 0x140076643
mov rsi, rax
mov edx, dword [rax + 0x20]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 8]
mov edx, dword [rsi + 0x18]
lea rcx, [rdx*4]
test rcx, rcx
je 0x14007660a
mov qword [rsp + 0x30], rsi
lea rbx, [rax + rdx*4]
lea r14, [r13 + 1]
mov qword [rsp + 0x28], rax
mov rsi, rax
mov rax, rbx
sub rax, rsi
mov rcx, rax
sar rcx, 2
shr rax, 0x3f
add rax, rcx
and rax, 0xfffffffffffffffe
lea r15, [rsi + rax*2]
mov edx, dword [r15]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 8]
mov cl, byte [r13]
test cl, cl
je 0x1400765df
mov rdx, r14
cmp cl, byte [rax]
jne 0x1400765e1
inc rax
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x1400765cf
xor ecx, ecx
movzx ecx, cl
movzx eax, byte [rax]
mov edx, ecx
sub edx, eax
lea rbp, [r15 + 4]
test edx, edx
cmovg rsi, rbp
sub ecx, eax
cmovs rbx, r15
cmove rsi, r15
je 0x140076606
cmp rsi, rbx
jne 0x14007659c
test ecx, ecx
je 0x14007661d
xor eax, eax
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rbx, qword [rsp + 0x30]
mov edx, dword [rbx + 0x24]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 8]
sub rsi, qword [rsp + 0x28]
sar rsi, 1
movzx eax, word [rax + rsi]
add ax, word [rbx + 0x10]
mov word [r12], ax
mov al, 1
jmp 0x14007660c

Function at 0x1400766ec
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [rcx + 8]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x140076723
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x140076723
movzx edx, word [rax + rcx + 0x14]
cmp edx, 0xf0
jne 0x140076723
movzx eax, word [rax + rcx + 0x18]
cmp eax, 0x20b
sete al
ret
xor eax, eax
ret
Function at 0x14008cce0
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x14008ccf9
mov dword [rsi], eax
mov al, 1
jmp 0x14008ccfb
xor eax, eax
add rsp, 0x20
pop rsi
ret

Function at 0x14008fb90
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x1401f5dc0]
mov ecx, dword [0x1401f3a70]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14008fbc5
lea rcx, [0x1401f5db8]
add rsp, 0x28
jmp fcn.140067a30
lea rcx, [0x1401f5dc0]
call fcn.140163bb0
cmp dword [0x1401f5dc0], 0xffffffff
jne 0x14008fbb5
mov qword [0x1401f5db8], 0
lea rcx, [0x1401f5db8]
xor edx, edx
call fcn.140067ac0
lea rcx, [0x1401f5dc0]
call fcn.140163c48
jmp 0x14008fbb5

Function at 0x140090ce0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140090d00
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
repz ret

Function at 0x140090d40
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140090d60
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
repz ret

Function at 0x140090da0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140090dc3
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
repz ret