joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180011c10
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x18004b040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x18006b1b0]
mov edi, ecx
cmp byte [rbx + 0x4a1d], 0
jne 0x180011c71
cmp byte [rbx + 0x4a1e], 0
jne 0x180011c71
movsx r9d, word [rbx + 0x5b12]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.180003410
test dil, 1
je 0x180011d98
jmp 0x180011cfc
movss xmm1, dword [rbx + 0x3898]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x5b12]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x180043710]
mov edx, 0x10
mulss xmm1, dword [0x180043700]
addss xmm0, dword [rbx + 0xdfc]
addss xmm1, dword [rbx + 0xe00]
mov qword [rbx + 0x4780], rax
mov dword [rbx + 0x476c], 1
movss dword [rbx + 0x4778], xmm0
movss dword [rbx + 0x477c], xmm1
movss xmm0, dword [rbx + 0x38f4]
mulss xmm0, dword [0x180043688]
or dword [rbx + 0x4768], 0x41
movss dword [rbx + 0x47c8], xmm0
call fcn.180003410
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x180011d50
lea r11, [0x18003da50]
nop dword [rax]
cmp r9b, 0x23
jne 0x180011d33
cmp byte [r8], r9b
jne 0x180011d33
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x180011d20
not ecx
call fcn.18000afe0
test rax, rax
je 0x180011d98
cmp byte [rax + 0x96], 0
je 0x180011d98
mov byte [rax + 0x9d], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xb8], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x5b12]
mov edx, 0x10
movsx r9d, word [rbx + 0x5b12]
call fcn.180003410
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.18000d7f0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800389c0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x180016690
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5bc0], 0
lea rbx, [rcx + 0x5bc8]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x180016737
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x1800166ea
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.180018a50
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.180003b60
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5bc0]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5bd0]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x18006b1a8]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x18001673f
mov rcx, rbx
call fcn.180003b60
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x180016cb0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x18006b1b0]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x180016d13
mov qword [rsp], rbx
lea rbx, [0x18003da50]
nop dword [rax]
cmp r9b, 0x23
jne 0x180016cf3
cmp byte [r8], r9b
jne 0x180016cf3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x180016ce0
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5b70]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x180016d47
mov r10, qword [r10 + 0x5b78]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x180016d4e
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x180016d34
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret
Function at 0x180033310
Capabilities:
Enumerate processes

Disassembly:
push rsi
sub rsp, 0x160
mov rax, qword [0x18004b040]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rsi, rdx
test rdx, rdx
jne 0x18003333a
xor eax, eax
jmp 0x1800333dc
mov qword [rsp + 0x170], rbx
xor edx, edx
mov qword [rsp + 0x180], rbp
mov ecx, 2
mov qword [rsp + 0x188], rdi
xor edi, edi
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x1800333c2
nop
mov rdx, rsi
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
test eax, eax
jne 0x1800333b0
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jbe 0x1800333b0
mov edi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x180033390
mov rbp, qword [rsp + 0x180]
mov eax, edi
mov rdi, qword [rsp + 0x188]
mov rbx, qword [rsp + 0x170]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1800389c0
add rsp, 0x160
pop rsi
ret
Function at 0x1800334e0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x18004b040]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r14, r8
mov rsi, rdx
mov rbx, rcx
call fcn.180033400
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__msize]
mov rdi, rax
test eax, eax
jg 0x180033524
xor al, al
jmp 0x18003364e
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x38], xmm1
xor r15d, r15d
mov qword [rsp + 0x48], r15
lea r8, [rsp + 0x38]
mov rdx, rsi
mov rcx, rbx
call fcn.180033670
mov r10, qword [rsp + 0x38]
mov rax, qword [rsp + 0x40]
cmp r10, rax
jne 0x18003355b
xor bl, bl
jmp 0x18003360a
mov esi, r15d
sub rax, r10
sar rax, 3
test rax, rax
je 0x180033608
movsxd rbp, edi
mov rdi, r15
nop dword [rax]
nop dword [rax + rax]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
mov r8, rbp
mov rdx, qword [rdi + r10]
mov rcx, qword [rbx + 8]
call qword [sym.imp.ntdll.dll_ZwProtectVirtualMemory]
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x20], r15
mov r9, rbp
mov r8, r14
mov rdx, qword [rdi + rax]
mov rcx, qword [rbx + 8]
call qword [sym.imp.ntdll.dll_ZwWriteVirtualMemory]
mov rax, qword [rsp + 0x38]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20
mov r8, rbp
mov rdx, qword [rdi + rax]
mov rcx, qword [rbx + 8]
call qword [sym.imp.ntdll.dll_ZwProtectVirtualMemory]
inc esi
lea rdi, [rdi + 8]
mov rcx, qword [rsp + 0x40]
mov r10, qword [rsp + 0x38]
sub rcx, r10
sar rcx, 3
movsxd rax, esi
cmp rax, rcx
jb 0x180033580
mov bl, 1
test r10, r10
je 0x18003364b
mov rdx, qword [rsp + 0x48]
sub rdx, r10
and rdx, 0xfffffffffffffff8
mov rax, r10
cmp rdx, 0x1000
jb 0x180033643
add rdx, 0x27
mov r10, qword [r10 - 8]
sub rax, r10
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180033643
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r10
call fcn.180038ab0
movzx eax, bl
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1800389c0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x180033a20
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x18004b040]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edx, edx
mov ecx, 2
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180033aac
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x180033a9c
lea rdx, str.HD_Player.exe
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
lea rdx, [rsp + 0x20]
mov rcx, rdi
test eax, eax
cmove ebx, dword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x180033a71
test rdi, rdi
je 0x180033aaa
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1800389c0
mov rbx, qword [rsp + 0x170]
add rsp, 0x160
pop rdi
ret
Function at 0x1800378a0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x1800378ce
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor eax, eax
lea r8, [0x180036230]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x38
ret
Function at 0x1400176ec
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.14000c850
sub rsp, rax
mov rax, qword [0x14003e040]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.14001a47c
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x14001773b
mov rax, rbp
jmp 0x140017843
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x42a30]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.14001c27c
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0x42a30]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x14001783f
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14001783f
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.14001c27c
test rax, rax
js 0x14001783f
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x14001783f
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x140017831
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x140017831
cmp byte [rcx], 0xd
jne 0x140017817
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x140017826
cmp byte [rcx + 1], 0xa
jne 0x140017826
inc rcx
jmp 0x140017826
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x3e350]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x1400177f9
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x140017843
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.14000c550
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14005cc1e
Capabilities:
Authenticate hmac
Hash data using murmur3

Disassembly:
push rax
pushf
mov eax, 0x99473b09
pushf
not eax
add eax, 0x53fd7de9
xor eax, 0x6cd2cf81
rol eax, 0xaa
popf
pushf
not eax
add eax, 0x6a4d5a52
xor eax, 0x6c5d1e06
rol eax, 0x98
popf
pushf
not eax
add eax, 0x62be6001
xor eax, 0x67bf7b1f
rol eax, 0x47
popf
pushf
not eax
add eax, 0x14b47946
xor eax, 0x39fd49c4
rol eax, 0xc7
popf

Function at 0x1400629be
Capabilities:
Authenticate hmac
Hash data using murmur3

Disassembly:
push rax
pushf
mov eax, 0x8006808e
pushf
not eax
add eax, 0x59a708cf
xor eax, 0x5081597d
rol eax, 0x56
popf
pushf
not eax
add eax, 0x7859d625
xor eax, 0x30d7d9bd
rol eax, 0x2a
popf
pushf
not eax
add eax, 0x11416be
xor eax, 0x7fc3e25d
rol eax, 0x53
popf
Function at 0x14007c7db
Capabilities:
Query environment variable

Disassembly:
push rax
pushf
mov eax, 0x3cdc8377
pushf
not eax
add eax, 0x4a968034
xor eax, 0x146236b1
rol eax, 0xa6
popf
pushf
not eax
add eax, 0x3973d269
xor eax, 0x16bb1077
rol eax, 0x2a
popf
pushf
not eax
add eax, 0x469a413d
xor eax, 0x5d1ce9ec
rol eax, 0x10
popf
cmp eax, 0
jne 0x14007c82b
popf
pop rax
jmp 0x14007c858
cmp eax, 1
jne 0x14007c83a
popf
pop rax
jmp 0x14007c9aa
cmp eax, 3
jne 0x14007c849
popf
pop rax
jmp 0x14007cb08
cmp eax, 2
jne 0x14007c858
popf
pop rax
jmp 0x14007caab
mov eax, 0x2d4124fa
pushf
not eax
add eax, 0x2e538017
xor eax, 0x19eb8074
rol eax, 0xbe
popf
pushf
not eax
add eax, 0x37e75bcd
xor eax, 0x312894f2
rol eax, 0x77
popf
call fcn.14008c714
sub rsp, rax
mov rax, qword [0x14003e040]
xor rax, rsp
mov qword [rsp + 0x4020], rax
xor r8d, r8d
xor edx, edx
call fcn.140080b6c
mov r8d, 0x2a63f438
pushf
not r8d
add r8d, 0x3d6fa970
xor r8d, 0x77a05195
rol r8d, 0x8e
popf
pushf
not r8d
add r8d, 0x3a9f0bf7
xor r8d, 0x417672dc
rol r8d, 0x68
popf
lea rdx, [rsp + 0x20]
mov rcx, rax
jmp 0x14007c8e8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x14007c8ef
dec eax
cmp eax, 0xffe
ja 0x14007c951
push rax
pushf
mov eax, 0xa5c3c677
pushf
not eax
add eax, 0x4e2903ff
xor eax, 0x292756a2
rol eax, 0x65
popf
pushf
not eax
add eax, 0x3c733d84
xor eax, 0x498ea065
rol eax, 0x6d
popf
pushf
not eax
add eax, 0x3a250490
xor eax, 0x71118ab2
rol eax, 0xcc
popf
pushf
not eax
add eax, 0xa53d615
xor eax, 0xf2d4a63
rol eax, 0x7c
popf
jmp 0x14007c81c
push rax
pushf
mov eax, 0x1fb9a8a9
pushf
not eax
add eax, 0x7141f53c
xor eax, 0x708b7d80
rol eax, 4
popf
pushf
not eax
add eax, 0x77914597
xor eax, 0x48677d41
rol eax, 0xae
popf
pushf
not eax
add eax, 0x1613e30
xor eax, 0x61c71d1c
rol eax, 0xd4
popf
pushf
not eax
add eax, 0x105e250d
xor eax, 0x18e137be
rol eax, 0xab
popf
jmp 0x14007c81c
mov r8d, 0x15afe5a9
pushf
not r8d
add r8d, 0x6a6a57ad
xor r8d, 0x7d7bfa1b
rol r8d, 0xfc
popf
pushf
not r8d
add r8d, 0x7480aa97
xor r8d, 0x7e2a1b2c
rol r8d, 0x11
popf
pushf
not r8d
add r8d, 0x29d239d4
xor r8d, 0x2d90f979
rol r8d, 0xb7
popf
pushf
not r8d
add r8d, 0xad12be1
xor r8d, 0x6333c3ed
rol r8d, 0xab
popf
lea rdx, [rsp + 0x2020]
lea rcx, [rsp + 0x20]
jmp 0x14007ca22
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x14007ca29
dec eax
cmp eax, 0xffe
ja 0x14007ca65
push rax
pushf
mov eax, 0x9abe3790
pushf
not eax
add eax, 0x57865381
xor eax, 0x4e8f58b2
rol eax, 0xaa
popf
pushf
not eax
add eax, 0x52f6de03
xor eax, 0x35c9d239
rol eax, 0xac
popf
jmp 0x14007c81c
push rax
pushf
mov eax, 0xd08cd65c
pushf
not eax
add eax, 0x265001bd
xor eax, 0x6ad4b60c
rol eax, 0x73
popf
pushf
not eax
add eax, 0x35a8b9b1
xor eax, 0x3896e16b
rol eax, 0x57
popf
pushf
not eax
add eax, 0xd50aa85
xor eax, 0x3d574274
rol eax, 0x4a
popf
jmp 0x14007c81c
xor r8d, r8d
lea rcx, [rsp + 0x2020]
xor edx, edx
call fcn.1400812a1
mov rcx, qword [rsp + 0x4020]
xor rcx, rsp
call fcn.140089a05
add rsp, 0x4038
ret
xor eax, eax
mov rcx, qword [rsp + 0x4020]
xor rcx, rsp
call fcn.140089a05
add rsp, 0x4038
ret
Function at 0x14008af9e
Capabilities:
Authenticate hmac
Contain obfuscated stackstrings
Encrypt data using speck

Disassembly:
push rax
pushf
mov eax, 0xc77bc8b2
pushf
not eax
add eax, 0x1e42fa2f
xor eax, 0x51d76c5e
rol eax, 0x8f
popf
pushf
not eax
add eax, 0x1b0fcb92
xor eax, 0x6e6f37b2
rol eax, 0x76
popf
pushf
not eax
add eax, 0x5e2dcdf2
xor eax, 0x6f4d4972
rol eax, 0x12
popf

Function at 0x140095041
Capabilities:
Allocate thread local storage

Disassembly:
push rax
pushf
mov eax, 0x29d6abc3
pushf
not eax
add eax, 0x2aab97ce
xor eax, 0x5a31b771
rol eax, 0xe7
popf
pushf
not eax
add eax, 0x2bcd52b2
xor eax, 0x186c624a
rol eax, 0x2f
popf
pushf
not eax
add eax, 0x43ec088a
xor eax, 0x4844b7d0
rol eax, 0xc1
popf
cmp eax, 0
jne 0x140095091
popf
pop rax
jmp 0x1400950af
cmp eax, 2
jne 0x1400950a0
popf
pop rax
jmp 0x1400951db
cmp eax, 1
jne 0x1400950af
popf
pop rax
jmp 0x140095173
push rbx
sub rsp, 0x20
mov rbx, rcx
lea r9, [0x180b90780]
pushf
sub r9, 0x40b5e7b0
popf
xor ecx, ecx
lea r8, [0x1a6817741]
pushf
sub r8, 0x667e5779
popf
lea rdx, [0x1b0a47fc9]
pushf
sub rdx, 0x70a15ff9
popf
call fcn.14000dcc8
test rax, rax
je 0x14009512d
push rax
pushf
mov eax, 0x1883591
pushf
not eax
add eax, 0x31cae04b
xor eax, 0x462eff0d
rol eax, 0xbd
popf
pushf
not eax
add eax, 0x209ce17
xor eax, 0x732c4360
rol eax, 0xec
popf
jmp 0x140095082
push rax
pushf
mov eax, 0x9f638b55
pushf
not eax
add eax, 0x45752d98
xor eax, 0x26ad7c9f
rol eax, 0x5e
popf
pushf
not eax
add eax, 0x1d37ddf6
xor eax, 0x2a33ce20
rol eax, 0xfc
popf
pushf
not eax
add eax, 0x477621b1
xor eax, 0x5e0a6b2f
rol eax, 0x6e
popf
jmp 0x140095082
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [0x14002b4b0]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x1400953cf
Capabilities:
Get thread local storage value

Disassembly:
push rax
pushf
mov eax, 0xa07e37e0
pushf
not eax
add eax, 0x568b50a6
xor eax, 0x7a62548f
rol eax, 0xf4
popf
pushf
not eax
add eax, 0x1e9c44fe
xor eax, 0x59ef7e09
rol eax, 0xea
popf
cmp eax, 1
jne 0x14009540c
popf
pop rax
jmp 0x140095509
cmp eax, 2
jne 0x14009541b
popf
pop rax
jmp 0x14009556e
cmp eax, 0
jne 0x14009542a
popf
pop rax
jmp 0x14009542a
push rbx
sub rsp, 0x20
mov ebx, ecx
lea r9, [0x1a859c1bc]
pushf
sub r9, 0x6856a1c4
popf
mov ecx, 0x3df77f9c
pushf
not ecx
add ecx, 0x6789ec06
xor ecx, 0x3c9505b
rol ecx, 0x74
popf
pushf
not ecx
add ecx, 0x1d93cb54
xor ecx, 0x5a7125e0
rol ecx, 0x9b
popf
lea r8, [0x1bb0a9ef6]
pushf
sub r8, 0x7b077f06
popf
lea rdx, [0x18e098172]
pushf
sub rdx, 0x4e06617a
popf
call fcn.14000dcc8
mov ecx, ebx
test rax, rax
je 0x1400954d6
push rax
pushf
mov eax, 0x50f47ef7
pushf
not eax
add eax, 0x226effba
xor eax, 0xb489e70
rol eax, 0xad
popf
pushf
not eax
add eax, 0x6c43592d
xor eax, 0x284cfde6
rol eax, 0x2b
popf
jmp 0x1400953fd
push rax
pushf
mov eax, 0x6492de29
pushf
not eax
add eax, 0x194164b5
xor eax, 0x2ad77ce1
rol eax, 0xf0
popf
pushf
not eax
add eax, 0x64fe1ac
xor eax, 0xbe54232
rol eax, 0x99
popf
jmp 0x1400953fd
add rsp, 0x20
pop rbx
jmp qword [0x14002b4b0]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x14009557a
Capabilities:
Set thread local storage value

Disassembly:
push rax
pushf
mov eax, 0x89cc6264
pushf
not eax
add eax, 0x15fa53fc
xor eax, 0x64b5ea88
rol eax, 0x46
popf
pushf
not eax
add eax, 0x46625018
xor eax, 0x13d76a1a
rol eax, 0xb0
popf
pushf
not eax
add eax, 0x536d1733
xor eax, 0x7165e3a6
rol eax, 0
popf
cmp eax, 1
jne 0x1400955ca
popf
pop rax
jmp 0x14009571c
cmp eax, 3
jne 0x1400955d9
popf
pop rax
jmp 0x1400957a7
cmp eax, 0
jne 0x1400955e8
popf
pop rax
jmp 0x1400955f7
cmp eax, 2
jne 0x1400955f7
popf
pop rax
jmp 0x14009575b
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x1a4bba8ed]
pushf
sub r9, 0x64b888dd
popf
mov edi, ecx
lea rdx, [0x1bffd0686]
pushf
sub rdx, 0x7ff9e676
popf
mov ecx, 0xba8b8f9
pushf
not ecx
add ecx, 0x1f6ec5e9
xor ecx, 0x45ddc9b2
rol ecx, 0xad
popf
pushf
not ecx
add ecx, 0x68a8f3d3
xor ecx, 0x6f47dbb6
rol ecx, 0x52
popf
pushf
not ecx
add ecx, 0x6bcfce1b
xor ecx, 0x2ce9cb30
rol ecx, 0xc6
popf
lea r8, [0x1af8d111e]
pushf
sub r8, 0x6f89f116
popf
call fcn.14000dcc8
mov rdx, rbx
mov ecx, edi
test rax, rax
je 0x1400956d5
push rax
pushf
mov eax, 0x9c57407d
pushf
not eax
add eax, 0x187142a6
xor eax, 0x568aa627
rol eax, 0x84
popf
pushf
not eax
add eax, 0x9318099
xor eax, 0xae880b
rol eax, 0x55
popf
pushf
not eax
add eax, 0x524b581d
xor eax, 0x5e9f46e6
rol eax, 0xc7
popf
jmp 0x1400955bb
push rax
pushf
mov eax, 0xac44f9e6
pushf
not eax
add eax, 0x266b0de2
xor eax, 0x3cbd2f1a
rol eax, 0xd5
popf
pushf
not eax
add eax, 0x36fbd9c
xor eax, 0x5ed8cae5
rol eax, 0x19
popf
pushf
not eax
add eax, 0x2000a387
xor eax, 0x7d8c6745
rol eax, 0x51
popf
jmp 0x1400955bb
call qword [0x14002b4b0]
jmp 0x1400957a7
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
push rax
pushf
mov eax, 0x806cb1c2
pushf
not eax
add eax, 0xfc5b34a
xor eax, 0x2419d29a
rol eax, 0xaf
popf
pushf
not eax
add eax, 0x62646821
xor eax, 0x197af632
rol eax, 0x49
popf
pushf
not eax
add eax, 0x74f5abac
xor eax, 0x262c45e8
rol eax, 4
popf
jmp 0x1400955bb
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140097fed
Capabilities:
Authenticate hmac
Hash data using murmur3

Disassembly:
push rax
pushf
mov eax, 0x2e572ad4
pushf
not eax
add eax, 0x18bda72
xor eax, 0x707cc617
rol eax, 0x5a
popf
pushf
not eax
add eax, 0x3cb3be76
xor eax, 0xdd3544b
rol eax, 0xac
popf
pushf
not eax
add eax, 0x4beffef0
xor eax, 0x18def717
rol eax, 0x33
popf
pushf
not eax
add eax, 0x7da923b8
xor eax, 0x1e6965ed
rol eax, 0xa6
popf
cmp eax, 0
jne 0x140098050
popf
pop rax
jmp 0x140098050
mov r8, qword [rdx]
jmp fcn.140098058
Function at 0x1400ebfc7
Capabilities:
Authenticate hmac

Disassembly:
push rax
pushf
mov eax, 0x67203097
pushf
not eax
add eax, 0x2ae2d4cf
xor eax, 0x2f459964
rol eax, 0x5c
popf
pushf
not eax
add eax, 0x20dc848b
xor eax, 0x70cd2cf9
rol eax, 0x32
popf
pushf
not eax
add eax, 0x4005b2cb
xor eax, 0x4ed36766
rol eax, 0x36
popf
cmp eax, 0
jne 0x1400ec017
popf
pop rax
jmp 0x1400ec044
cmp eax, 1
jne 0x1400ec026
popf
pop rax
jmp 0x1400ec0fe
cmp eax, 2
jne 0x1400ec035
popf
pop rax
jmp 0x1400ec17b
cmp eax, 3
jne 0x1400ec044
popf
pop rax
jmp 0x1400ec1b9
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
jne 0x1400ec0a5
push rax
pushf
mov eax, 0xb4983cd
pushf
not eax
add eax, 0x7abf6340
xor eax, 0x3248718
rol eax, 0x67
popf
pushf
not eax
add eax, 0x37199af8
xor eax, 0x52c9a283
rol eax, 0xe3
popf
pushf
not eax
add eax, 0x4f5c4313
xor eax, 0x7a360900
rol eax, 4
popf
jmp 0x1400ec008
push rax
pushf
mov eax, 0xfdbd7fe3
pushf
not eax
add eax, 0x2ce2743
xor eax, 0x6c2ed5df
rol eax, 0x8b
popf
pushf
not eax
add eax, 0x6d3b2c9e
xor eax, 0x7651165b
rol eax, 3
popf
pushf
not eax
add eax, 0x68797781
xor eax, 0x785c832a
rol eax, 0x64
popf
pushf
not eax
add eax, 0x29fa37fa
xor eax, 0x2c3a75d0
rol eax, 0xa6
popf
jmp 0x1400ec008
mov byte [rdx + 0x30], 1
mov dword [rdx + 0x2c], 0x16
mov qword [rax - 0x10], rdx
and qword [rax - 0x18], rcx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call fcn.140106c3b
or rax, 0xffffffffffffffff
push rax
pushf
mov eax, 0xbb2729a8
pushf
not eax
add eax, 0x7da657
xor eax, 0x7b9a0fed
rol eax, 0xe1
popf
pushf
not eax
add eax, 0x6d6dc7a1
xor eax, 0x7785ca69
rol eax, 0x63
popf
pushf
not eax
add eax, 0x1cbf4712
xor eax, 0x1cb3167d
rol eax, 0xad
popf
pushf
not eax
add eax, 0x142ea265
xor eax, 0x349d9994
rol eax, 0xed
popf
jmp 0x1400ec008
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
call fcn.1400d867c
nop
mov rdx, rdi
mov rcx, rbx
call fcn.1400ec1da
mov rdi, rax
mov rcx, rbx
call fcn.1400d86d7
mov rax, rdi
jmp 0x1400ec17b
Function at 0x1400ee09e
Capabilities:
Authenticate hmac

Disassembly:
push rax
pushf
mov eax, 0x8e3d1283
pushf
not eax
add eax, 0x442526c2
xor eax, 0x2b861d09
rol eax, 0x6f
popf
pushf
not eax
add eax, 0x708a0617
xor eax, 0x52396ae7
rol eax, 0x1d
popf
pushf
not eax
add eax, 0xfd64326
xor eax, 0x89b579e
rol eax, 0x71
popf
cmp eax, 0
jne 0x1400ee0ee
popf
pop rax
jmp 0x1400ee0ee
jmp fcn.1400ec1da
Function at 0x140101ab1
Capabilities:
Parse pe header

Disassembly:
push rax
pushf
mov eax, 0x9a89fee8
pushf
not eax
add eax, 0x585969cd
xor eax, 0x52cc7e91
rol eax, 0x4b
popf
pushf
not eax
add eax, 0x705e70de
xor eax, 0x57bac165
rol eax, 0xf
popf
cmp eax, 0
jne 0x140101aee
popf
pop rax
jmp 0x140101aee
xor r8d, r8d
lea edx, [r8 + 2]
jmp 0x140019968
Function at 0x1401365db
Capabilities:
Set environment variable

Disassembly:
push rax
pushf
mov eax, 0xe455ee38
pushf
not eax
add eax, 0x3eb1fa31
xor eax, 0x26470ac4
rol eax, 0xfc
popf
pushf
not eax
add eax, 0x7624bf2b
xor eax, 0x76a7bd03
rol eax, 0x99
popf
pushf
not eax
add eax, 0x7c7b8ccd
xor eax, 0x52ca0368
rol eax, 0x75
popf
cmp eax, 0
jne 0x14013662b
popf
pop rax
jmp 0x14013662b
jmp 0x140020c20

Function at 0x14013a49d
Capabilities:
Enumerate files on windows

Disassembly:
push rax
pushf
mov eax, 0xf5bdc74a
pushf
not eax
add eax, 0x3aba8c82
xor eax, 0x3aaf91d0
rol eax, 0x2e
popf
pushf
not eax
add eax, 0x4f969b8f
xor eax, 0x20df1a73
rol eax, 0x34
popf
pushf
not eax
add eax, 0x4c9881b9
xor eax, 0x4485868e
rol eax, 0xf5
popf
pushf
not eax
add eax, 0x79820927
xor eax, 0x7b73f83b
rol eax, 0x31
popf
cmp eax, 0
jne 0x14013a500
popf
pop rax
jmp 0x14013a500
jmp 0x140021874