joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001a370
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rcx, qword [rcx]
mov ebp, edx
test rcx, rcx
je 0x14001a448
mov rdi, qword [rcx]
test rdi, rdi
je 0x14001a448
lea rbx, [rdi - 1]
jg 0x14001a3e4
jmp 0x14001a4f9
test rbx, rbx
je 0x14001a4d5
mov rdx, qword [rcx]
lea r12, [rdi - 2]
cmp r12, rdx
jl 0x14001a3cc
mov rcx, r12
sub rdx, 1
call fcn.14000ac40
mov rcx, qword [rsi]
movzx eax, byte [rcx + r12 + 0x10]
cmp al, 0x5c
je 0x14001a3da
cmp al, 0x2f
jne 0x14001a405
lea rax, [rbx - 1]
mov rdi, rbx
mov rbx, rax
mov rdx, qword [rcx]
cmp rbx, rdx
jge 0x14001a458
movzx eax, byte [rcx + rbx + 0x10]
cmp al, 0x2f
je 0x14001a4b0
cmp al, 0x5c
je 0x14001a4b0
cmp al, 0x2e
je 0x14001a3a8
test bpl, bpl
je 0x14001a4c8
mov rdx, rdi
call fcn.140009520
mov rcx, rsi
mov rdx, rax
call fcn.140007a10
mov rcx, qword [rsi]
mov edx, 0x5c
call fcn.140009ed0
mov rdx, rax
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.140007a10
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, rbx
sub rdx, 1
call fcn.14000ac40
mov rcx, qword [rsi]
movzx eax, byte [rcx + rbx + 0x10]
cmp al, 0x5c
je 0x14001a498
cmp al, 0x2f
je 0x14001a498
mov rdx, qword [rcx]
cmp rbx, rdx
jl 0x14001a401
mov rcx, rbx
sub rdx, 1
call fcn.14000ac40
mov rcx, qword [rsi]
movzx eax, byte [rcx + rbx + 0x10]
jmp 0x14001a401
test rbx, rbx
jne 0x14001a3da
test bpl, bpl
je 0x14001a4e8
xor edi, edi
jmp 0x14001a40e
test rbx, rbx
je 0x14001a4a1
mov rdi, rbx
sub rbx, 1
jmp 0x14001a3e7
mov rdx, rdi
call fcn.140009520
jmp 0x14001a42e
mov edi, 1
test bpl, bpl
jne 0x14001a40e
jmp 0x14001a4c8
lea rcx, [0x140032810]
call fcn.140009490
jmp 0x14001a42e
test dl, dl
je 0x14001a4e8
movabs r8, 0x7fffffffffffffff
mov rcx, rdi
xor edx, edx
call fcn.14000aaa0
mov rcx, qword [rsi]
jmp 0x14001a40e

Function at 0x14001a520
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rbp, rdx
mov rsi, r8
test r8, r8
je 0x14001a552
mov rax, qword [r8]
test rax, rax
jle 0x14001a550
movzx eax, byte [r8 + rax + 0xf]
jmp 0x14001a569
jne 0x14001a5b0
mov rax, qword [rbx]
test rax, rax
je 0x14001a5b0
mov rdx, qword [rax]
xor edi, edi
test rdx, rdx
jle 0x14001a57a
movzx eax, byte [rax + rdx + 0xf]
cmp al, 0x5c
sete dil
cmp al, 0x2f
sete al
or edi, eax
movzx edi, dil
xor edx, edx
mov rcx, rbx
call fcn.14001a370
mov rdx, rbx
mov rcx, rsi
mov r8, rbp
mov r9d, 0x5c
call fcn.1400194a0
mov edx, edi
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.14001a370
xor edi, edi
jmp 0x14001a57a
Function at 0x14001aaf0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbp, rdx
mov rsi, rcx
xor edx, edx
mov rcx, rbp
lea rdi, [rbp + 8]
call fcn.140007a10
xor edx, edx
mov rcx, rdi
call fcn.140007a10
test rsi, rsi
je 0x14001ab30
mov rax, qword [rsi]
mov rbx, rax
add rbx, 0xffffffffffffffff
jo 0x14001ab58
test rbx, rbx
jns 0x14001ab6b
nop dword [rax]
mov rcx, rbp
xor edx, edx
call fcn.140007a10
mov rcx, rsi
call fcn.140009490
mov rdx, rax
mov rcx, rdi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.140007a10
call fcn.14000ae00
test rbx, rbx
js 0x14001ab30
nop word [rax + rax]
mov rax, qword [rsi]
cmp rbx, rax
jl 0x14001ab7c
lea rdx, [rax - 1]
mov rcx, rbx
call fcn.14000ac40
movzx eax, byte [rsi + rbx + 0x10]
cmp al, 0x5c
je 0x14001ab98
cmp al, 0x2f
je 0x14001ab98
sub rbx, 1
jb 0x14001ab30
jmp 0x14001ab68
xor eax, eax
lea r8, [rbx - 1]
test rbx, rbx
mov rcx, rsi
cmove r8, rax
xor edx, edx
call fcn.14000dc60
mov rcx, rbp
mov rdx, rax
call fcn.140007a10
mov rdx, rbx
add rdx, 1
jo 0x14001abd0
mov rcx, rsi
call fcn.14000dd70
jmp 0x14001ab42
mov qword [rsp + 0x28], rdx
call fcn.14000ae00
mov rdx, qword [rsp + 0x28]
jmp 0x14001abc3
Function at 0x14001b230
Capabilities:
Hash data using murmur3

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rsi, rdx
cmp rdx, 3
jle 0x14001b3d0
sar rdx, 0x3f
mov rdi, rsi
shr rdx, 0x3e
lea rax, [rsi + rdx]
and eax, 3
sub rax, rdx
mov rdx, rsi
sub rdi, rax
cmp rdi, rsi
cmovle rdx, rdi
xor r13d, r13d
xor r12d, r12d
mov eax, dword [rbx + r13]
add r13, 4
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor eax, r12d
rol eax, 0xd
lea r12d, [rax + rax*4 - 0x19ab949c]
cmp r13, rdx
jl 0x14001b278
lea rbp, [rsi - 1]
cmp rdi, r13
jle 0x14001b2e5
nop dword [rax + rax]
mov rcx, r13
mov rdx, rbp
call fcn.14000ac40
mov eax, dword [rbx + r13]
add r13, 4
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor eax, r12d
rol eax, 0xd
lea r12d, [rax + rax*4 - 0x19ab949c]
cmp rdi, r13
jg 0x14001b2b0
lea rax, [rdi - 1]
shr rax, 2
test rdi, rdi
lea r13, [rax*4 + 4]
mov eax, 4
cmovle r13, rax
mov rax, rsi
xor r14d, r14d
sar rax, 0x3f
shr rax, 0x3e
lea rdi, [rsi + rax]
and edi, 3
sub rdi, rax
test rdi, rdi
jle 0x14001b388
lea r15, [rsi - 1]
jmp 0x14001b33d
cmp rbp, rsi
jge 0x14001b35b
movzx eax, byte [rbx + rbp]
shl r14d, 8
or r14d, eax
test rdi, rdi
je 0x14001b376
sub rdi, 1
mov rbp, r13
add rbp, rdi
js 0x14001b3db
cmp rbp, rdi
jb 0x14001b3db
test rbp, rbp
jns 0x14001b328
mov rdx, r15
mov rcx, rbp
shl r14d, 8
call fcn.14000ac40
movzx eax, byte [rbx + rbp]
or r14d, eax
test rdi, rdi
jne 0x14001b33d
imul r14d, r14d, 0xcc9e2d51
rol r14d, 0xf
imul r14d, r14d, 0x1b873593
xor r12d, esi
mov eax, r12d
xor eax, r14d
mov r12d, eax
shr r12d, 0x10
xor r12d, eax
imul r12d, r12d, 0x85ebca6b
mov edx, r12d
shr edx, 0xd
xor edx, r12d
imul edx, edx, 0xc2b2ae35
mov eax, edx
shr eax, 0x10
xor eax, edx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor r13d, r13d
xor r12d, r12d
jmp 0x14001b301
call fcn.14000ae00
jmp 0x14001b356
sub rsp, 0x38
xor edx, edx
test rcx, rcx
je 0x14001b407
mov rdx, qword [rcx]
test rdx, rdx
js 0x14001b410
add rcx, 0x10
add rsp, 0x38
jmp 0x14001b230
mov qword [rsp + 0x28], rcx
call fcn.14000bfd0
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rcx]
jmp 0x14001b403
Function at 0x14001b3f0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rsi, rdx
cmp rdx, 3
jle 0x14001b3d0
sar rdx, 0x3f
mov rdi, rsi
shr rdx, 0x3e
lea rax, [rsi + rdx]
and eax, 3
sub rax, rdx
mov rdx, rsi
sub rdi, rax
cmp rdi, rsi
cmovle rdx, rdi
xor r13d, r13d
xor r12d, r12d
mov eax, dword [rbx + r13]
add r13, 4
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor eax, r12d
rol eax, 0xd
lea r12d, [rax + rax*4 - 0x19ab949c]
cmp r13, rdx
jl 0x14001b278
lea rbp, [rsi - 1]
cmp rdi, r13
jle 0x14001b2e5
nop dword [rax + rax]
mov rcx, r13
mov rdx, rbp
call fcn.14000ac40
mov eax, dword [rbx + r13]
add r13, 4
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor eax, r12d
rol eax, 0xd
lea r12d, [rax + rax*4 - 0x19ab949c]
cmp rdi, r13
jg 0x14001b2b0
lea rax, [rdi - 1]
shr rax, 2
test rdi, rdi
lea r13, [rax*4 + 4]
mov eax, 4
cmovle r13, rax
mov rax, rsi
xor r14d, r14d
sar rax, 0x3f
shr rax, 0x3e
lea rdi, [rsi + rax]
and edi, 3
sub rdi, rax
test rdi, rdi
jle 0x14001b388
lea r15, [rsi - 1]
jmp 0x14001b33d
cmp rbp, rsi
jge 0x14001b35b
movzx eax, byte [rbx + rbp]
shl r14d, 8
or r14d, eax
test rdi, rdi
je 0x14001b376
sub rdi, 1
mov rbp, r13
add rbp, rdi
js 0x14001b3db
cmp rbp, rdi
jb 0x14001b3db
test rbp, rbp
jns 0x14001b328
mov rdx, r15
mov rcx, rbp
shl r14d, 8
call fcn.14000ac40
movzx eax, byte [rbx + rbp]
or r14d, eax
test rdi, rdi
jne 0x14001b33d
imul r14d, r14d, 0xcc9e2d51
rol r14d, 0xf
imul r14d, r14d, 0x1b873593
xor r12d, esi
mov eax, r12d
xor eax, r14d
mov r12d, eax
shr r12d, 0x10
xor r12d, eax
imul r12d, r12d, 0x85ebca6b
mov edx, r12d
shr edx, 0xd
xor edx, r12d
imul edx, edx, 0xc2b2ae35
mov eax, edx
shr eax, 0x10
xor eax, edx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor r13d, r13d
xor r12d, r12d
jmp 0x14001b301
call fcn.14000ae00
jmp 0x14001b356
sub rsp, 0x38
xor edx, edx
test rcx, rcx
je 0x14001b407
mov rdx, qword [rcx]
test rdx, rdx
js 0x14001b410
add rcx, 0x10
add rsp, 0x38
jmp 0x14001b230
mov qword [rsp + 0x28], rcx
call fcn.14000bfd0
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rcx]
jmp 0x14001b403

Function at 0x14001b430
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, rdx
mov rbx, rcx
xor edx, edx
mov rcx, rsi
call fcn.140007a10
mov qword [rsi + 8], 0
test rbx, rbx
js 0x14001b4a0
imul rbx, rbx, 3
jo 0x14001b4d6
mov rcx, rbx
shr rcx, 0x3f
add rcx, rbx
sar rcx, 1
add rcx, 4
call fcn.1400117e0
mov qword [rsi + 8], 0
mov rbx, rax
test rax, rax
js 0x14001b4c0
mov rcx, qword [0x14009e890]
mov rdx, rbx
call fcn.14000b000
mov rcx, rsi
mov rdx, rax
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.140007a10
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, rbx
call fcn.14000aaa0
jmp 0x14001b453
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, rax
call fcn.14000aaa0
jmp 0x14001b47f
call fcn.14000ae00
jmp 0x14001b459
Function at 0x14001c630
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, rdx
mov rbx, rcx
xor edx, edx
mov rcx, rsi
call fcn.140007a10
mov qword [rsi + 8], 0
test rbx, rbx
js 0x14001c6a0
imul rbx, rbx, 3
jo 0x14001c6d6
mov rcx, rbx
shr rcx, 0x3f
add rcx, rbx
sar rcx, 1
add rcx, 4
call fcn.1400117e0
mov qword [rsi + 8], 0
mov rbx, rax
test rax, rax
js 0x14001c6c0
mov rcx, qword [0x14009e880]
mov rdx, rbx
call fcn.14000b000
mov rcx, rsi
mov rdx, rax
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.140007a10
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, rbx
call fcn.14000aaa0
jmp 0x14001c653
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, rax
call fcn.14000aaa0
jmp 0x14001c67f
call fcn.14000ae00
jmp 0x14001c659

Function at 0x14001e3c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
push rbx
test rdx, rdx
mov eax, r8d
lea r8, [rdx + 7]
mov r9, rcx
cmovns r8, rdx
mov r10, rdx
xor r11d, r11d
lea rcx, [0x140032d80]
sar r8, 3
cmp rdx, 7
jle 0x14001e4a8
nop
mov ebx, dword [r9 + r11*8 + 4]
xor eax, dword [r9 + r11*8]
add r11, 1
mov esi, ebx
movzx edx, bl
shr esi, 0x18
mov edx, dword [rcx + rdx*4 + 0xc00]
xor edx, dword [rcx + rsi*4]
movzx esi, al
xor edx, dword [rcx + rsi*4 + 0x1c00]
mov esi, eax
shr esi, 0x18
xor edx, dword [rcx + rsi*4 + 0x1000]
movzx esi, bh
shr ebx, 0x10
movzx ebx, bl
mov esi, esi
xor edx, dword [rcx + rsi*4 + 0x800]
xor edx, dword [rcx + rbx*4 + 0x400]
movzx ebx, ah
shr eax, 0x10
movzx eax, al
mov ebx, ebx
xor edx, dword [rcx + rbx*4 + 0x1800]
xor edx, dword [rcx + rax*4 + 0x1400]
mov eax, edx
cmp r8, r11
jg 0x14001e3f0
shl r8, 3
mov edx, 8
cmp r10, 7
cmovle r8, rdx
cmp r10, r8
jle 0x14001e4a0
add r8, r9
lea rcx, [0x140032d80]
add r9, r10
nop dword [rax]
movzx edx, byte [r8]
add r8, 1
xor edx, eax
shr eax, 8
movzx edx, dl
xor eax, dword [rcx + rdx*4]
cmp r9, r8
jne 0x14001e488
pop rbx
pop rsi
ret
xor r8d, r8d
jmp 0x14001e46f
Function at 0x1400224b0
Capabilities:
Get thread local storage value

Disassembly:
cmp cx, 0x48
ja case.default.0x1400224c7
lea rdx, [0x140035360]
movzx ecx, cx
movsxd rax, dword [rdx + rcx*4]
add rax, rdx
jmp rax
cmp cx, 0xfff
jne case.0x1400224c7.15
lea rcx, [0x1400354e0]
jmp fcn.140009490
lea rcx, [0x140035aa0]
jmp fcn.140009490
lea rcx, [0x140035500]
jmp fcn.140009490
lea rcx, [0x140035520]
jmp fcn.140009490
lea rcx, [0x140035540]
jmp fcn.140009490
lea rcx, [0x140035560]
jmp fcn.140009490
lea rcx, [0x1400355a0]
jmp fcn.140009490
lea rcx, [0x1400355e0]
jmp fcn.140009490
lea rcx, [0x140035600]
jmp fcn.140009490
lea rcx, [0x140035620]
jmp fcn.140009490
lea rcx, [0x140035640]
jmp fcn.140009490
lea rcx, [0x140035660]
jmp fcn.140009490
lea rcx, [0x140035680]
jmp fcn.140009490
lea rcx, [0x1400356a0]
jmp fcn.140009490
lea rcx, [0x1400356c0]
jmp fcn.140009490
lea rcx, [0x1400356e0]
jmp fcn.140009490
lea rcx, [0x140035700]
jmp fcn.140009490
lea rcx, [0x140035720]
jmp fcn.140009490
lea rcx, [0x140035740]
jmp fcn.140009490
lea rcx, [0x140035760]
jmp fcn.140009490
lea rcx, [0x140035780]
jmp fcn.140009490
lea rcx, [0x1400357a0]
jmp fcn.140009490
lea rcx, [0x1400357c0]
jmp fcn.140009490
lea rcx, [0x1400357e0]
jmp fcn.140009490
lea rcx, [0x140035800]
jmp fcn.140009490
lea rcx, [0x140035820]
jmp fcn.140009490
lea rcx, [0x140035840]
jmp fcn.140009490
lea rcx, [0x140035860]
jmp fcn.140009490
lea rcx, [0x140035880]
jmp fcn.140009490
lea rcx, [0x1400358a0]
jmp fcn.140009490
lea rcx, [0x1400358c0]
jmp fcn.140009490
lea rcx, [0x1400358e0]
jmp fcn.140009490
lea rcx, [0x140035900]
jmp fcn.140009490
lea rcx, [0x140035920]
jmp fcn.140009490
lea rcx, [0x140035940]
jmp fcn.140009490
lea rcx, [0x140035960]
jmp fcn.140009490
lea rcx, [0x140035980]
jmp fcn.140009490
lea rcx, [0x1400359a0]
jmp fcn.140009490
lea rcx, [0x1400359c0]
jmp fcn.140009490
lea rcx, [0x1400359e0]
jmp fcn.140009490
lea rcx, [0x140035a00]
jmp fcn.140009490
lea rcx, [0x140035a20]
jmp fcn.140009490
lea rcx, [0x140035a40]
jmp fcn.140009490
lea rcx, [0x140035a60]
jmp fcn.140009490
lea rcx, [0x140035a80]
jmp fcn.140009490
Function at 0x1400227b0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov esi, ecx
mov edi, edx
cmp cx, 0xffff
je 0x140022a08
xor ebx, ebx
test ch, 0x10
jne 0x1400228c0
test esi, 0x4000
jne 0x140022880
test si, si
js 0x140022900
test esi, 0x2000
je 0x14002282a
test edi, edi
jne 0x140022940
mov rcx, rbx
mov edx, 9
movabs rdi, 0x59415252415f5456
call fcn.140009db0
mov r8d, 0x7c
mov rbx, rax
mov rax, qword [rax]
lea rax, [rbx + rax + 0x10]
mov qword [rax], rdi
mov word [rax + 8], r8w
add qword [rbx], 9
and esi, 0xfff
mov ecx, esi
call fcn.1400224b0
mov rsi, rax
test rax, rax
je 0x1400229f0
mov rdx, qword [rax]
mov rcx, rbx
call fcn.140009db0
lea rdx, [rsi + 0x10]
mov rbx, rax
mov rax, qword [rax]
lea rcx, [rbx + rax + 0x10]
mov rax, qword [rsi]
lea r8, [rax + 1]
call sub.msvcrt.dll_memcpy
mov rax, qword [rsi]
add qword [rbx], rax
mov rax, rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov edx, 9
mov rcx, rbx
call fcn.140009db0
mov r9d, 0x7c
movabs rdx, 0x46455259425f5456
mov rbx, rax
mov rax, qword [rax]
lea rax, [rbx + rax + 0x10]
mov qword [rax], rdx
mov word [rax + 8], r9w
add qword [rbx], 9
test si, si
jns 0x1400227e6
jmp 0x140022900
mov edx, 0xa
xor ecx, ecx
call fcn.140009db0
movabs rdx, 0x4f544345565f5456
mov rbx, rax
mov rax, qword [rax]
lea rax, [rbx + rax + 0x10]
mov qword [rax], rdx
mov dword [rax + 7], 0x7c524f
add qword [rbx], 0xa
test esi, 0x4000
je 0x1400227dd
jmp 0x140022880
mov rcx, rbx
mov edx, 0xc
call fcn.140009db0
movabs rdx, 0x52455345525f5456
movabs rcx, 0x7c444556524553
mov rbx, rax
mov rax, qword [rax]
lea rax, [rbx + rax + 0x10]
mov qword [rax], rdx
mov qword [rax + 5], rcx
add qword [rbx], 0xc
jmp 0x1400227e6
movsxd rcx, edi
call fcn.140001e80
mov rbp, rax
test rax, rax
je 0x140022a20
mov rax, qword [rax]
lea rcx, [rax + 0xc]
call fcn.140009300
mov ecx, 0x28
movabs rdx, 0x59415252415f5456
mov rdi, rax
mov rax, qword [rax]
lea rax, [rdi + rax + 0x10]
mov qword [rax], rdx
mov word [rax + 8], cx
mov rax, qword [rdi]
lea rdx, [rax + 9]
lea rcx, [rdi + rax + 0x19]
mov qword [rdi], rdx
mov rax, qword [rbp]
lea rdx, [rbp + 0x10]
lea r8, [rax + 1]
call sub.msvcrt.dll_memcpy
mov rax, qword [rbp]
add rax, qword [rdi]
mov qword [rdi], rax
mov dword [rdi + rax + 0x10], 0x7c2944
mov rax, qword [rdi]
mov rcx, rbx
lea rdx, [rax + 3]
mov qword [rdi], rdx
call fcn.140009db0
lea rdx, [rdi + 0x10]
mov rbx, rax
mov rax, qword [rax]
lea rcx, [rbx + rax + 0x10]
mov rax, qword [rdi]
lea r8, [rax + 1]
call sub.msvcrt.dll_memcpy
mov rax, qword [rdi]
add qword [rbx], rax
jmp 0x14002282a
xor edx, edx
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.140009db0
lea rcx, [0x140035aa0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.140009490
mov ecx, 0xc
call fcn.140009300
movabs rdx, 0x59415252415f5456
mov rdi, rax
mov rax, qword [rax]
lea rax, [rdi + rax + 0x10]
mov qword [rax], rdx
mov edx, 0x28
mov word [rax + 8], dx
mov rax, qword [rdi]
add rax, 9
mov qword [rdi], rax
jmp 0x1400229ab
Function at 0x1400249d0
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Populate syswhispers2 syscall list
Resolve function by parsing pe exports

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
mov eax, dword [0x14002e0c0]
test eax, eax
jne 0x140024bed
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx + 0x30]
test rax, rax
je 0x140024c31
xor r9d, r9d
nop word [rax + rax]
mov rdx, rax
movsxd rax, dword [rax + 0x3c]
mov eax, dword [rdx + rax + 0x88]
test eax, eax
je 0x140024a4f
lea r9, [rdx + rax]
mov eax, dword [r9 + 0xc]
add rax, rdx
mov r8d, dword [rax]
or r8d, 0x20202020
cmp r8d, 0x6c64746e
jne 0x140024a4f
mov eax, dword [rax + 4]
or eax, 0x20202020
cmp eax, 0x6c642e6c
je 0x140024a64
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
test rax, rax
jne 0x140024a10
test r9, r9
je 0x140024c31
mov eax, dword [r9 + 0x18]
mov edi, dword [r9 + 0x24]
xor r11d, r11d
lea r12, [0x14002e0c8]
mov ebp, dword [r9 + 0x1c]
lea ecx, [rax - 1]
mov eax, dword [r9 + 0x20]
add rdi, rdx
add rbp, rdx
lea rbx, [rdi + rcx*2]
add rax, rdx
lea rsi, [rax + rcx*4]
jmp 0x140024aac
sub rsi, 4
lea rax, [rbx - 2]
cmp rdi, rbx
je 0x140024b40
mov rbx, rax
mov eax, dword [rsi]
add rax, rdx
cmp word [rax], 0x775a
jne 0x140024a98
mov r13d, r11d
shl r13, 4
add r13, r12
cmp byte [rax], 0
je 0x140024c3c
cmp byte [rax + 1], 0
mov r8d, 0xc36a69e6
mov ecx, 1
mov r9d, 1
je 0x140024b06
nop word [rax + rax]
mov r10d, r8d
movzx ecx, word [rax + rcx]
add r9d, 1
ror r10d, 8
add ecx, r10d
xor r8d, ecx
mov ecx, r9d
cmp byte [rax + rcx], 0
jne 0x140024ae8
mov dword [r13], r8d
movzx eax, word [rbx]
add r11d, 1
mov eax, dword [rbp + rax*4]
mov qword [r13 + 8], 0
mov dword [r13 + 4], eax
cmp r11d, 0x1f4
jne 0x140024a98
mov dword [0x14002e0c0], 0x1f4
jmp 0x140024b51
mov dword [0x14002e0c0], r11d
cmp r11d, 1
je 0x140024bed
xor ebx, ebx
lea r10, [0x14002e0c8]
nop word [rax + rax]
mov eax, r11d
mov r9d, dword [0x14002e0cc]
xor edx, edx
sub eax, ebx
cmp eax, 1
je 0x140024c20
nop word [rax + rax]
lea eax, [rdx + 1]
mov rcx, rax
shl rax, 4
add rax, r10
mov r8d, dword [rax + 4]
cmp r8d, r9d
jae 0x140024c00
mov r11d, dword [rax]
shl rdx, 4
movd xmm1, r9d
lea r8, [r10 + rdx]
movd xmm0, dword [r10 + rdx]
mov dword [r8], r11d
mov r11d, dword [rax + 4]
punpckldq xmm0, xmm1
mov rdx, qword [r8 + 8]
mov dword [r8 + 4], r11d
mov r11, qword [rax + 8]
mov qword [r8 + 8], r11
movq qword [rax], xmm0
mov r11d, dword [0x14002e0c0]
mov qword [rax + 8], rdx
lea eax, [r11 - 1]
mov edx, eax
sub edx, ebx
cmp ecx, edx
jb 0x140024c0f
add ebx, 1
cmp ebx, eax
jb 0x140024b60
mov eax, 1
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
lea eax, [r11 - 1]
mov edx, eax
sub edx, ebx
cmp ecx, edx
jae 0x140024be2
mov r9d, r8d
mov edx, ecx
jmp 0x140024b80
lea eax, [r11 - 1]
add ebx, 1
cmp ebx, eax
jb 0x140024b60
jmp 0x140024bed
xor eax, eax
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov r8d, 0xb0db3b73
jmp 0x140024b06
Function at 0x140025240
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
inc rax
dec rax
mov qword [rsp + 0x10], rdx
inc rax
dec rax
mov qword [rsp + 0x18], r8
inc rax
dec rax
mov qword [rsp + 0x20], r9
inc rax
dec rax
sub rsp, 0x28
inc rax
dec rax
mov ecx, 0xc39fc115
inc rax
dec rax
call fcn.140024c50
inc rax
dec rax
add rsp, 0x28
inc rax
dec rax
mov rcx, qword [rsp + 8]
inc rax
dec rax
mov rdx, qword [rsp + 0x10]
inc rax
dec rax
mov r8, qword [rsp + 0x18]
inc rax
dec rax
mov r9, qword [rsp + 0x20]
inc rax
dec rax
mov r10, rcx
inc rax
dec rax
syscall
inc rax
dec rax
ret
Function at 0x1400256c0
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x1f890907
call fcn.140024c50
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140025710
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x395011f
call fcn.140024c50
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140025760
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0xc8271771
call fcn.140024c50
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x1400257b0
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
inc rax
dec rax
mov qword [rsp + 0x10], rdx
inc rax
dec rax
mov qword [rsp + 0x18], r8
inc rax
dec rax
mov qword [rsp + 0x20], r9
inc rax
dec rax
sub rsp, 0x28
inc rax
dec rax
mov ecx, 0x1ebe0c2f
inc rax
dec rax
call fcn.140024c50
inc rax
dec rax
add rsp, 0x28
inc rax
dec rax
mov rcx, qword [rsp + 8]
inc rax
dec rax
mov rdx, qword [rsp + 0x10]
inc rax
dec rax
mov r8, qword [rsp + 0x18]
inc rax
dec rax
mov r9, qword [rsp + 0x20]
inc rax
dec rax
mov r10, rcx
inc rax
dec rax
syscall
inc rax
dec rax
ret

Function at 0x140025850
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
inc rax
dec rax
mov qword [rsp + 0x10], rdx
inc rax
dec rax
mov qword [rsp + 0x18], r8
inc rax
dec rax
mov qword [rsp + 0x20], r9
inc rax
dec rax
sub rsp, 0x28
inc rax
dec rax
mov ecx, 0x10b65e17
inc rax
dec rax
call fcn.140024c50
inc rax
dec rax
add rsp, 0x28
inc rax
dec rax
mov rcx, qword [rsp + 8]
inc rax
dec rax
mov rdx, qword [rsp + 0x10]
inc rax
dec rax
mov r8, qword [rsp + 0x18]
inc rax
dec rax
mov r9, qword [rsp + 0x20]
inc rax
dec rax
mov r10, rcx
inc rax
dec rax
syscall
inc rax
dec rax
ret

Function at 0x1400258f0
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
inc rax
dec rax
mov qword [rsp + 0x10], rdx
inc rax
dec rax
mov qword [rsp + 0x18], r8
inc rax
dec rax
mov qword [rsp + 0x20], r9
inc rax
dec rax
sub rsp, 0x28
inc rax
dec rax
mov ecx, 0x6193216b
inc rax
dec rax
call fcn.140024c50
inc rax
dec rax
add rsp, 0x28
inc rax
dec rax
mov rcx, qword [rsp + 8]
inc rax
dec rax
mov rdx, qword [rsp + 0x10]
inc rax
dec rax
mov r8, qword [rsp + 0x18]
inc rax
dec rax
mov r9, qword [rsp + 0x20]
inc rax
dec rax
mov r10, rcx
inc rax
dec rax
syscall
ret
Function at 0x140027620
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
sub rsp, 0x38
lea rax, [0x140024870]
mov qword [rsp + 0x28], rax
call fcn.140002460
call fcn.140002c50
call fcn.14000df90
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rdx, qword [0x14009ed30]
mov ecx, eax
mov rax, qword [0x14009ed20]
mov dword [rax], ecx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea rcx, [rsp + 0x28]
call fcn.14000de30
call fcn.14000de80
call fcn.14000eaf0
call fcn.14000ed70
call fcn.14000ef80
call fcn.140011450
call fcn.1400114b0
call fcn.140013680
call fcn.140019ee0
call fcn.14001a0a0
call fcn.14001acf0
call fcn.14001af60
call fcn.14001d5a0
call fcn.140023260
call fcn.140024840
call fcn.140027260
mov rax, qword [rsp + 0x28]
call rax
nop
add rsp, 0x38
ret

Function at 0x1400279b0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.14002d730
mov r8d, 0x1b
mov edx, 1
lea rcx, str.jxxwkfxkfaqfcztqlxbannally_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.14002d730
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]