joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800500d0
Capabilities:
Hash data with crc32

Disassembly:
push rdi
sub rsp, 0x20
test dword [rcx + 0x10], 0x100000
mov rdi, rdx
je 0x18005015c
movzx r9d, byte [rdx]
lea r8, [rdx + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x180050130
lea r11, [0x180086470]
nop
cmp r9b, 0x23
jne 0x180050113
cmp byte [r8], r9b
jne 0x180050113
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x180050100
mov rcx, qword [0x18009b0f8]
not eax
cmp dword [rcx + 0x3f30], eax
jne 0x180050147
mov dword [rcx + 0x3f34], eax
cmp dword [rcx + 0x3f60], eax
jne 0x1800501b9
mov byte [rcx + 0x3f64], 1
add rsp, 0x20
pop rdi
ret
mov rax, qword [0x18009b0f8]
xor edx, edx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rsi
mov rbx, qword [rax + 0x3ed0]
movsxd rcx, dword [rbx + 0xf0]
mov rax, qword [rbx + 0xf8]
mov r8d, dword [rax + rcx*4 - 4]
mov rcx, rdi
call fcn.18001ad00
mov rcx, qword [rbx]
mov esi, eax
mov rbx, qword [rsp + 0x30]
cmp dword [rcx + 0x3f18], eax
jne 0x1800501b2
mov r8, rdi
mov edx, 0xb
mov ecx, eax
call fcn.180030c70
mov eax, esi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x180052660
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov ebx, edx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
cmp ebx, 1
je 0x180052687
xor eax, eax
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov rcx, rdi
call fcn.180051f50
movabs rcx, 0xda38374eae8fcaa6
lea rdx, [rsp + 0x40]
movabs rax, 0xa29022974c03e14b
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x30], rcx
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
movabs rax, 0xa29022af2a779465
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x30], rcx
xor ecx, ecx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x30]
movdqa xmm0, xmmword [rsp + 0x40]
mov qword [rsp + 0x58], rax
pxor xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x40], xmm0
call qword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_setlocale]
xor eax, eax
lea r8, [0x180052180]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x78]
mov eax, 1
add rsp, 0x60
pop rdi
ret
Function at 0x180053010
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [0x18009a028]
xor rax, rsp
mov qword [rsp + 0x10], rax
cmp byte [rcx], 0
mov r10d, edx
mov r8, rcx
mov r9d, 2
jne 0x180053076
mov word [rcx + 1], 1
rdtsc
shl rdx, 0x20
or rax, rdx
mov edx, r9d
mov byte [rcx + 4], al
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 9]
mov byte [rcx + 5], al
movzx ecx, byte [rsp + rdx + 8]
inc edx
mov byte [r8 + 6], cl
mov rcx, r8
movzx eax, byte [rsp + rdx + 8]
mov byte [r8 + 7], al
mov byte [r8 + 8], 0
mov byte [r8], 1
mov eax, dword [r8 + 4]
movzx edx, byte [r8 + 1]
mov dword [rsp + 8], eax
lea rax, [r9 + rcx]
mov dword [rsp], r10d
test dl, dl
je 0x1800530a9
xor ecx, ecx
mov eax, dword [rsp + rcx + 8]
lea rcx, [rcx + 4]
not eax
xor dword [rsp + rcx - 4], eax
sub rdx, 1
jne 0x180053091
lea rax, [r8 + 2]
movzx ecx, byte [rax]
mov eax, 4
sub rax, rcx
cmp rax, 4
jae 0x1800530d3
nop word [rax + rax]
movzx ecx, byte [rsp + rax + 8]
not cl
xor byte [rsp + rax], cl
inc rax
cmp rax, 4
jb 0x1800530c0
movzx eax, byte [r8 + 8]
inc al
and eax, 3
mov ecx, eax
mov eax, dword [rsp]
mov dword [r8 + rcx*4 + 0xc], eax
mov byte [r8 + 8], cl
mov rcx, qword [rsp + 0x10]
xor rcx, rsp
call fcn.180062040
add rsp, 0x28
ret
Function at 0x18005ece0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rax, qword [0x18009a028]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov r14, rcx
mov rax, qword [rcx]
movabs r12, 0xcbf29ce484222325
movabs r15, 0x100000001b3
cmp qword [rax], 0
je 0x18005edbf
call fcn.180002f20
cmp dword [rax + 0x10], 0
jle 0x18005edbf
mov rax, qword [r14]
mov rcx, qword [rax]
mov r9, qword [rcx + 0x35e8]
mov r8, r12
nop
movsx rdx, byte [r9]
lea r9, [r9 + 1]
xor r8, rdx
imul r8, r15
test dl, dl
jne 0x18005ed50
mov qword [rsp + 0x20], r8
lea rdx, [rsp + 0x20]
mov rcx, qword [r14 + 8]
call fcn.180059ea0
mov rdi, rax
mov rcx, qword [r14]
mov rsi, qword [rcx]
call fcn.180002f20
movsxd rcx, dword [rax + 0x10]
dec rcx
lea r8, [rcx + rcx*2]
add r8, r8
mov rdx, qword [rdi]
mov ebx, dword [rdx + r8*8 + 0x28]
call fcn.180002f20
movsxd rdx, dword [rax + 0x10]
dec rdx
lea rax, [rdx + rdx*2]
add rax, rax
mov rdx, qword [rdi]
mov r8d, ebx
mov rdx, qword [rdx + rax*8]
mov rcx, rsi
call fcn.180052e30
mov rax, qword [r14]
mov rcx, qword [rax]
test rcx, rcx
je 0x18005edcf
mov ebp, dword [rcx + 0x3c]
jmp 0x18005edd4
mov ebp, 0x64
xor esi, esi
mov rax, qword [r14 + 0x10]
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
sub rcx, rdx
sar rcx, 3
test rcx, rcx
je 0x18005eeeb
mov r8d, esi
movabs r13, 0x96380e6f20703d36
nop
mov rdi, qword [rdx + r8*8]
mov rax, qword [r14]
cmp rdi, qword [rax]
je 0x18005eecb
mov r8, qword [rdi + 0x35e8]
mov rdx, r12
nop word [rax + rax]
movsx rcx, byte [r8]
lea r8, [r8 + 1]
xor rdx, rcx
imul rdx, r15
test cl, cl
jne 0x18005ee20
mov qword [rsp + 0x20], rdx
cmp rdx, r13
je 0x18005eecb
cmp ebp, dword [rdi + 0x3c]
je 0x18005ee51
call fcn.180002f20
add rax, 0x40
jmp 0x18005ee5a
call fcn.180002f20
add rax, 0x30
mov rdx, qword [rax]
mov rax, qword [rdx + 8]
mov rbx, rdx
mov rcx, qword [rsp + 0x20]
cmp byte [rax + 0x19], 0
jne 0x18005ee87
nop
cmp dword [rax + 0x1c], ecx
jae 0x18005ee7b
mov rax, qword [rax + 0x10]
jmp 0x18005ee81
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x18005ee70
cmp byte [rbx + 0x19], 0
jne 0x18005eecb
cmp ecx, dword [rbx + 0x1c]
jb 0x18005eecb
cmp rbx, rdx
je 0x18005eecb
cmp dword [rbx + 0x20], 0
jle 0x18005eecb
lea rdx, [rsp + 0x20]
mov rcx, qword [r14 + 8]
call fcn.180059ea0
movsxd rdx, dword [rbx + 0x20]
lea rdx, [rdx + rdx*2]
add rdx, rdx
mov rax, qword [rax]
mov r8d, dword [rax + rdx*8 - 8]
mov rdx, qword [rax + rdx*8 - 0x30]
mov rcx, rdi
call fcn.180052e30
inc esi
mov rax, qword [r14 + 0x10]
mov rdx, qword [rax]
mov r8d, esi
mov rcx, qword [rax + 8]
sub rcx, rdx
sar rcx, 3
cmp r8, rcx
jb 0x18005ee00
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180062040
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180060848
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx], 0
mov rbx, rcx
je 0x1800608ac
xor edi, edi
cmp dword [rcx + 0xc], edi
jbe 0x18006089a
mov rax, qword [rbx]
xor edx, edx
mov r8d, dword [rax + rdi*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x180060893
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [rbx + 0xc]
jb 0x180060867
mov r8, qword [rbx]
xor edx, edx
mov rcx, qword [0x18009b128]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1800608bc
Capabilities:
Allocate or change rwx memory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov dword [rax + 0x10], edx
push rdi
sub rsp, 0x20
mov eax, ecx
imul rdi, rax, 0x38
add rdi, qword [0x18009c650]
mov rdx, qword [rdi]
mov cl, byte [rdi + 0x20]
mov rsi, rdx
lea rbx, [rdx - 5]
and cl, 1
je 0x1800608f5
mov rsi, rbx
movzx eax, cl
lea r9, [rsp + 0x38]
test cl, cl
mov r8d, 0x40
cmove rbx, rdx
lea rbp, [rax*2 + 5]
mov rcx, rbx
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x180060928
mov eax, 0xa
jmp 0x180060975
mov byte [rbx], 0xe9
mov eax, dword [rdi + 8]
sub eax, esi
sub eax, 5
mov dword [rbx + 1], eax
test byte [rdi + 0x20], 1
je 0x180060944
mov rax, qword [rdi]
mov word [rax], 0xf9eb
mov r8d, dword [rsp + 0x38]
lea r9, [rsp + 0x38]
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rbp
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
or byte [rdi + 0x20], 6
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x180060cf0
Capabilities:
Check for software breakpoints

Disassembly:
mov r8b, byte [rcx]
mov r9d, edx
test r8b, r8b
je 0x180060d07
cmp r8b, 0x90
je 0x180060d07
cmp r8b, 0xcc
jne 0x180060d29
mov r10d, 1
mov edx, r10d
cmp r9d, r10d
jbe 0x180060d25
mov eax, edx
cmp byte [rax + rcx], r8b
jne 0x180060d29
add edx, r10d
cmp edx, r9d
jb 0x180060d15
mov eax, r10d
ret
xor eax, eax
ret
Function at 0x180061090
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rdi, rcx
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r14, qword [rbp - 0x58]
cmp rdi, 0x40000000
jbe 0x1800610da
lea rax, [rdi - 0x40000000]
cmp r14, rax
cmovb r14, rax
mov rbx, qword [0x18009c648]
lea r12, [rdi + 0x40000000]
cmp qword [rbp - 0x50], r12
cmovbe r12, qword [rbp - 0x50]
sub r12, 0xfff
xor esi, esi
test rbx, rbx
je 0x180061118
cmp rbx, r14
jb 0x180061113
cmp rbx, r12
jae 0x180061113
cmp qword [rbx + 8], rsi
jne 0x18006126f
mov rbx, qword [rbx]
jmp 0x1800610fa
mov r15, rdi
cmp rdi, r14
jb 0x18006119c
mov r13d, dword [rbp - 0x38]
xor edx, edx
mov rax, r15
div r13
sub r15, rdx
sub r15, r13
cmp r15, r14
jb 0x180061193
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x180061193
cmp dword [rbp - 0x10], 0x10000
je 0x180061163
mov r15, qword [rbp - 0x28]
cmp r15, r13
jb 0x180061193
jmp 0x18006112f
test r15, r15
je 0x180061193
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x180061234
cmp r15, r14
jae 0x180061120
test rbx, rbx
jne 0x180061234
cmp rdi, r12
ja 0x18006126f
mov r15d, dword [rbp - 0x38]
xor edx, edx
mov rax, rdi
mov r14d, r15d
div r15
mov eax, r15d
sub rax, rdx
add rax, rdi
mov rdi, rax
cmp rax, r12
ja 0x18006126f
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18006126f
cmp dword [rbp - 0x10], 0x10000
je 0x18006120a
xor edx, edx
lea edi, [r15 - 1]
add rdi, qword [rbp - 0x18]
add rdi, qword [rbp - 0x30]
mov rax, rdi
div r14
sub rdi, rdx
cmp rdi, r12
jmp 0x1800611c3
test rdi, rdi
je 0x18006126f
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jmp 0x180061196
lea rcx, [rbx + 0x40]
mov dword [rbx + 0x10], esi
mov edx, 0x40
mov qword [rcx], rsi
mov rax, rcx
mov qword [rbx + 8], rcx
add rdx, 0x40
add rcx, 0x40
mov rsi, rax
cmp rdx, 0xfc0
jbe 0x180061240
mov rax, qword [0x18009c648]
mov qword [rbx], rax
mov qword [0x18009c648], rbx
lea r11, [rsp + 0x80]
mov rax, rbx
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1800619ac
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x180061a30
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x180065860]
cmp byte [rcx + rax], 0
je 0x180061a30
dec r8
sub rdx, 1
jne 0x180061a16
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x140007960
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r9
mov qword [rsp + 8], r9
xchg rbx, r9
mov qword [rsp + 0x10], rbp
xchg r9, rsi
mov qword [rsp + 0x18], r9
xchg rsi, r9
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
mov edi, r8d
xchg r12, rdx
mov rbx, r12
xchg r12, rdx
lea r9, [rcx + 0xf0]
xchg r8, rcx
mov rsi, r8
xchg rcx, r8
test r8d, r8d
je 0x140007a2e
dec rdi
shr rdi, 2
shr rdi, 2
inc rdi
nop dword [rax]
nop word [rax + rax]
xchg r9, rbx
mov rax, r9
xchg r9, rbx
sub r9, rbx
mov edx, 0x11a43a15
sub edx, 0x11a43a05
nop dword [rax + rax]
movzx ecx, byte [r9 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x1400079e5
xchg rdx, rsi
mov rsi, rdx
xchg rdx, rsi
xchg rcx, rbx
mov rbx, rcx
xchg rbx, rcx
call fcn.140007af0
xchg rbx, r9
mov rbx, r9
xchg r9, rbx
neg rbx
add rbx, 0xfffffffffffffff0
neg rbx
sub rdi, 1
jne 0x1400079c9
movups xmm0, xmmword [r9]
xchg rbx, rcx
mov rcx, qword [rsp + 0x30]
xchg rcx, rbx
xchg rbp, rdi
mov rdi, qword [rsp + 0x38]
xchg rdi, rbp
xchg r10, rsi
movups xmmword [r10 + 0xf0], xmm0
xchg rsi, r10
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
push rdx
push rax
push rcx
push rbx
push rdx
push rax
push rax
push rax
xchg qword [rsp + 0x40], rdi
pop rax
pop rax
pop rax
pop rdx
pop rbx
pop rcx
pop rax
pop rdx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14000caf0
Capabilities:
Access peb ldr_data
Check os version
Get number of processors

Disassembly:
mov qword [rsp + 0x10], rbx
xchg rsi, r14
mov qword [rsp + 0x18], r14
xchg rsi, r14
xchg r8, rdi
mov qword [rsp + 0x20], r8
xchg r8, rdi
nop
mov qword [rsp - 8], r14
sub rsp, 8
sub rsp, 0x30
xchg rdx, rsi
mov rdx, rcx
xchg rdx, rsi
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 0x60]
mov r14d, dword [0x7ffe026c]
xor ebx, ebx
xchg rcx, rbx
mov qword [rsp + 0x40], rcx
xchg rbx, rcx
add rcx, 0xc8
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x6ac05e64
xor dword [rsp + 0x20], 0x6ac05e6c
lea r9, [rsp + 0x40]
lea rdx, [rbx - 1]
lea r8d, [rbx + 7]
call fcn.14000bdd0
test eax, eax
js 0x14000cb8d
cmp qword [rsp + 0x40], rbx
je 0x14000cb8d
lea eax, [rbx + 1]
jmp 0x14000cc34
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x30]
cmp dword [rcx + 0x70], 2
jbe 0x14000cbb3
mov eax, 0x37175a38
sub eax, 0x37175a36
jmp 0x14000cc34
cmp dword [rcx + 0x74], ebx
jbe 0x14000cbcb
mov eax, 0x218e9acc
sub eax, 0x218e9ac9
jmp 0x14000cc34
cmp byte [rdi + 2], bl
je 0x14000cbe3
mov eax, 0x2853ce1a
sub eax, 0x2853ce16
jmp 0x14000cc34
cmp r14d, 0xa
jb 0x14000cc11
mov ax, word [0x7ffe0260]
cmp word [rdi + 0x120], ax
je 0x14000cc11
mov eax, 0x6079dac0
xor eax, 0x6079dac8
jmp 0x14000cc34
lea rcx, [rsi + 0xb8]
mov edx, 0x1d0fe307
add edx, 0x7c89b692
call fcn.14000c460
jmp 0x14000cc32
mov eax, ebx
xchg r14, rbx
mov r14, qword [rsp + 0x48]
xchg r14, rbx
mov rsi, qword [rsp + 0x50]
xchg r13, rdi
mov r13, qword [rsp + 0x58]
xchg r13, rdi
add rsp, 0x30
nop
mov r14, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14000da40
Capabilities:
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
xchg rcx, r9
mov rbx, r9
xchg rcx, r9
cmp byte [rcx + 6], 0
je 0x14000da71
xor eax, eax
add rsp, 0x20
nop
xchg qword [rsp], rbx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
cmp byte [rcx + 1], 0
je 0x14000da9c
mov eax, 0x49b4cd93
xor eax, 0x49b4cd90
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rbx
nop
add rsp, 8
jmp qword [rsp - 8]
cmp byte [rcx], 0
je 0x14000dacd
mov eax, 0x256ab647
sub eax, 0x256ab643
add rsp, 0x20
push rcx
push rdx
push rcx
push rcx
push rax
push rax
push rax
push rcx
xchg qword [rsp + 0x40], rbx
add rsp, 0x48
nop
add rsp, 8
jmp qword [rsp - 8]
cmp byte [rcx + 4], 0
je 0x14000daf8
mov eax, 0x51f157b7
sub eax, 0x51f157b0
add rsp, 0x20
nop
add rsp, 8
mov rbx, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]
mov edx, 0x891b70b
sub edx, 0x891b707
mov ecx, dword [rcx + 0xc]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
int3
Function at 0x14000f720
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, qword gs:[0x30]
mov rsi, rcx
mov rax, qword [rdi + 0x2d8]
mov qword [rcx + 0xf8], rax
xchg rbx, rax
mov rbx, qword [rdi + 0x2e0]
xchg rbx, rax
mov qword [rcx + 0x98], rax
mov rax, qword [rcx + 0xc8]
xchg rbx, rax
mov qword [rcx + 0x80], rbx
xchg rbx, rax
cmp byte [rdi + 0x2ec], 0
jne 0x14000f929
cmp qword [0x140128e90], 0
je 0x14000f929
mov byte [rdi + 0x2ec], 5
sub byte [rdi + 0x2ec], 4
mov rax, qword [0x140128e90]
xchg r9, rcx
mov r9, qword [rax + 0x30]
xchg r9, rcx
cmp qword [rdi + 0x2d8], rcx
jne 0x14000f91b
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 0x98]
cmp dword [rbx + 0x4f0], 0x80000003
jne 0x14000f86b
xchg rcx, rbx
mov rbx, qword [rax + 0x18]
xchg rbx, rcx
cmp qword [rbx + 0x500], rcx
jne 0x14000f810
lea rax, [0x14000db50]
mov byte [rdi + 0x2ec], 0x55
xor byte [rdi + 0x2ec], 0x55
xor edx, edx
mov qword [rbx + 0xf8], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RtlRestoreContext]
mov rax, qword [0x140128e90]
mov ecx, dword [rax + 0xc]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp rax, 4
mov rax, qword [0x140128e90]
jne 0x14000f86b
mov ecx, dword [rax + 0xc]
mov edx, 0x28d86ec7
sub edx, 0x28d86ec2
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov byte [rdi + 0x2ec], 0x32
sub byte [rdi + 0x2ec], 0x32
xor edx, edx
inc qword [rbx + 0xf8]
xchg rbx, rcx
mov rbx, rcx
xchg rcx, rbx
call qword [sym.imp.KERNEL32.dll_RtlRestoreContext]
mov rax, qword [0x140128e90]
cmp byte [rax + 6], 0
jne 0x14000f8dc
mov ecx, dword [rbx + 0x4f0]
cmp ecx, 1
je 0x14000f8cd
cmp ecx, 0x80000001
je 0x14000f8c0
cmp ecx, 0x80000003
je 0x14000f8b3
cmp ecx, 0x80000004
jne 0x14000f8dc
mov byte [rax], 0x59
sub byte [rax], 0x58
jmp 0x14000f8d5
mov byte [rax + 2], 0x54
sub byte [rax + 2], 0x53
jmp 0x14000f8d5
mov byte [rax + 4], 0x1e
xor byte [rax + 4], 0x1f
jmp 0x14000f8d5
mov byte [rax + 3], 0x62
sub byte [rax + 3], 0x61
mov rax, qword [0x140128e90]
cmp qword [rbx + 0x48], 0
jne 0x14000f908
cmp qword [rbx + 0x50], 0
jne 0x14000f908
cmp qword [rbx + 0x58], 0
jne 0x14000f908
cmp qword [rbx + 0x60], 0
je 0x14000f910
mov byte [rax + 1], 0x65
sub byte [rax + 1], 0x64
xchg rbx, rcx
mov rcx, qword [rsp + 0x30]
xchg rcx, rbx
mov byte [rdi + 0x2ec], 0x68
sub byte [rdi + 0x2ec], 0x68
xor edx, edx
mov rcx, rsi
xchg r12, rsi
mov r12, qword [rsp + 0x38]
xchg r12, rsi
add rsp, 0x20
push rax
xchg qword [rsp + 8], rdi
add rsp, 0x10
jmp qword [sym.imp.KERNEL32.dll_RtlRestoreContext]
Function at 0x140010b10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
nop
mov qword [rsp - 8], rsi
sub rsp, 8
sub rsp, 0x20
cmp byte [r8 + 0x19], 0
xchg r8, rbx
mov r8, rbx
xchg r8, rbx
xchg rdx, r9
mov rsi, r9
xchg rdx, r9
mov rbp, rcx
jne 0x140010bb7
mov qword [rsp + 0x30], rdi
nop dword [rax]
nop dword [rax + rax]
xchg r8, rdi
mov rdi, qword [rbx + 0x10]
xchg r8, rdi
xchg rdx, rsi
mov rsi, rdx
xchg rdx, rsi
xchg rcx, r14
mov r14, rbp
xchg r14, rcx
call fcn.140010b10
xchg rdi, rbx
mov rbx, rdi
xchg rbx, rdi
mov rbx, qword [rbx]
lea rcx, [rdi + 0x20]
call fcn.140018780
mov edx, 0x5ce8b133
xor edx, 0x5ce8b163
xchg rcx, r13
mov r13, rdi
xchg r13, rcx
call fcn.1401102d0
cmp byte [rbx + 0x19], 0
je 0x140010b59
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
xchg rbp, rdi
mov rdi, qword [rsp + 0x40]
xchg rdi, rbp
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rsi
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x1400180b0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 6], 0x3e
xor byte [rcx + rax + 6], 0x3e
inc rax
cmp rax, 0xa
jb 0x1400180b2
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140027350
Capabilities:
Encode data using xor

Disassembly:
mov r9, rcx
mov r8d, 0xa75043d
add r8d, 0xf58afbc2
test rcx, rcx
je 0x140027420
cmp byte [rcx], 0
je 0x140027420
test rdx, rdx
jne 0x1400273ab
nop
movabs rdx, 0xffffffff4a26a752
add rdx, 0x7fffffff
add rdx, 0x35d958ae
nop
inc rdx
cmp byte [rcx + rdx], 0
jne 0x140027395
test rdx, rdx
je 0x14002741d
xor r10d, r10d
lea r11, [0x140001f10]
nop dword [rax + rax]
movsx eax, byte [r9]
lea r9, [r9 + 1]
movzx ecx, r8b
inc r10d
push rcx
xor ecx, eax
push rcx
xor rcx, qword [rsp + 8]
shr rcx, 0x20
ror rax, 0x20
xor ecx, eax
ror rax, 0x20
shl rcx, 0x20
or rcx, qword [rsp]
add rsp, 0x10
shr r8d, 3
shr r8d, 1
shr r8d, 2
shr r8d, 1
shr r8d, 1
and ecx, 0x3ff
mov eax, r10d
xor r8d, dword [r11 + rcx*4]
xor r8d, 0x3948a593
cmp rax, rdx
jb 0x1400273bd
not r8d
mov eax, r8d
ret
Function at 0x14002a8d0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r9
mov qword [rsp + 8], r9
xchg r9, rbx
nop
push r14
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, r11
mov r11, rdx
xchg r11, rdi
xchg rbx, rcx
mov rcx, rbx
xchg rcx, rbx
test rdx, rdx
jne 0x14002a934
xchg rdi, rdx
mov qword [rcx + 0x10], rdi
xchg rdx, rdi
xchg r12, rax
mov r12, rcx
xchg r12, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rcx
push rdx
push rbx
push rcx
push rbx
push rax
push rcx
xchg qword [rsp + 0x38], rdi
add rsp, 0x40
nop
add rsp, 8
jmp qword [rsp - 8]
nop
movabs r8, 0xffffffff4b46ae27
add r8, 0x7fffffff
add r8, 0x34b951d9
xchg rcx, r8
mov r8, rcx
xchg r8, rcx
inc rcx
cmp word [rdx + rcx*2], 0
jne 0x14002a956
inc rcx
mov eax, 0x2d0abbc0
sub eax, 0x2d0abbbe
mul rcx
xchg r12, rcx
mov qword [rbx + 8], r12
xchg rcx, r12
cmovo rax, r8
mov rcx, rax
call fcn.1401102d8
mov r8, qword [rbx + 8]
mov rdx, rdi
add r8, r8
xchg rsi, rax
mov qword [rbx + 0x10], rsi
xchg rsi, rax
xchg rcx, rax
mov rax, rcx
xchg rcx, rax
call sub.VCRUNTIME140.dll_memcpy
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000ffff
jge 0x14002a9c2
dec eax
or eax, 0xffff0000
inc eax
xor edx, edx
mov word [rbx + 2], ax
cmp qword [rbx + 8], rdx
jbe 0x14002a9f0
nop
mov rax, qword [rbx + 0x10]
lea rcx, [rax + rdx*2]
movzx eax, word [rbx + 2]
xor word [rcx], ax
inc rdx
cmp rdx, qword [rbx + 8]
jb 0x14002a9d4
mov byte [rbx], 0x2b
sub byte [rbx], 0x2b
xchg r8, rax
mov r8, rbx
xchg r8, rax
xchg rbx, rbp
mov rbp, qword [rsp + 0x30]
xchg rbx, rbp
add rsp, 0x20
push rbx
push rbx
push rbx
push rcx
push rbx
push rcx
push rbx
push rcx
xchg qword [rsp + 0x40], rdi
add rsp, 0x48
ret

Function at 0x14002ae70
Capabilities:
Encode data using xor

Disassembly:
xchg r8, rax
mov r8, qword [rcx + 0x10]
xchg r8, rax
xchg rcx, rsi
mov rdx, rsi
xchg rsi, rcx
test rax, rax
jne 0x14002ae95
xor r8d, r8d
mov eax, r8d
nop
add rsp, 8
jmp qword [rsp - 8]
cmp byte [rcx], 0
jne 0x14002aec9
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14002aec3
xchg r15, rax
mov r15, qword [rdx + 0x10]
xchg r15, rax
lea rcx, [rax + r8*2]
movzx eax, word [rdx + 2]
xor word [rcx], ax
inc r8
cmp r8, qword [rdx + 8]
jb 0x14002aea3
mov rax, qword [rdx + 0x10]
mov byte [rdx], 0x60
xor byte [rdx], 0x61
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14002af60
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x10], 0
xchg rbx, rcx
mov rcx, rbx
xchg rbx, rcx
je 0x14002afc8
cmp byte [rcx], 0
je 0x14002afc8
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000ffff
jge 0x14002af91
dec eax
or eax, 0xffff0000
inc eax
xor word [rbx + 2], ax
xor edx, edx
cmp qword [rbx + 8], rdx
jbe 0x14002afc2
nop word [rax + rax]
xchg r10, rax
mov r10, qword [rbx + 0x10]
xchg r10, rax
lea rcx, [rax + rdx*2]
movzx eax, word [rbx + 2]
xor word [rcx], ax
inc rdx
cmp rdx, qword [rbx + 8]
jb 0x14002afa6
mov byte [rbx], 0x63
sub byte [rbx], 0x63
add rsp, 0x20
push rdx
push rax
push rdx
push rcx
xchg qword [rsp + 0x20], rbx
add rsp, 0x28
nop
add rsp, 8
jmp qword [rsp - 8]