joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003d100
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rsi, rdx
mov rdi, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x20
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
cmp eax, 0xc0000000
jb 0x14003d151
mov ebx, eax
lea rcx, [rsp + 0x20]
mov edx, 0x20
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x14003d1a1
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x50], xmm1
movaps xmmword [rsp + 0x40], xmm0
mov rax, qword [0x142f53100]
test rax, rax
je 0x14003d1d6
lea rbx, [rsp + 0x70]
test eax, 0x4000
jne 0x14003d1e7
movaps xmm0, xmmword [rsp + 0x40]
movaps xmm1, xmmword [rsp + 0x50]
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x80], xmm1
xorps xmm0, xmm0
movaps xmmword [rsp + 0x90], xmm0
jmp 0x14003d1fb
and ebx, 0x7fffffff
je 0x14003d151
movzx eax, byte [0x142f53108]
mov edx, 4
xor ecx, ecx
call fcn.140025a60
test rax, rax
je 0x14003d23f
mov dword [rax], ebx
mov rcx, qword [0x142f53058]
xor edx, edx
mov r8, rax
call sub.KERNEL32.dll_HeapFree
jmp 0x14003d211
call fcn.1400357f0
lea rbx, [rsp + 0x70]
test eax, 0x4000
je 0x14003d17d
lea r8, [0x142f4d520]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.14001e7e0
movaps xmm0, xmmword [rbx]
movaps xmm1, xmmword [rbx + 0x10]
movaps xmm2, xmmword [rbx + 0x20]
movaps xmmword [rdi + 0x20], xmm2
movaps xmmword [rdi + 0x10], xmm1
movaps xmmword [rdi], xmm0
mov qword [rdi + 0x40], 0
mov rax, 0xffffffffffffff00
add rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov rdx, rsi
call fcn.14001c540
nop
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
ret
ud2

Function at 0x14003d6d0
Capabilities:
Set registry value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x70
mov r14, r9
mov rdi, r8
mov rbx, rdx
mov r15, rcx
movzx eax, byte [0x142f53108]
mov edx, 4
xor ecx, ecx
call fcn.140025a60
test rax, rax
je 0x14003d7ad
mov rsi, rax
mov eax, dword [r14]
mov dword [rsi], eax
mov r14, qword [r15]
add rdi, rbx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rdi
mov word [rsp + 0x48], 0
mov dword [rsp + 0x50], 1
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x38]
call fcn.14003c3b0
mov rbx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x28], 4
mov rcx, r14
mov rdx, rbx
xor r8d, r8d
mov r9d, 4
call sub.ADVAPI32.dll_RegSetValueExW
mov edi, eax
cmp qword [rsp + 0x58], 0
je 0x14003d77a
mov rcx, qword [0x142f53058]
xor edx, edx
mov r8, rbx
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [0x142f53058]
xor ebx, ebx
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapFree
mov rax, rdi
shl rax, 0x20
or rax, 2
test edi, edi
cmovne rbx, rax
mov rax, rbx
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
ud2
Function at 0x140043cf0
Capabilities:
Get memory capacity

Disassembly:
push rsi
push rdi
sub rsp, 0x1d8
movaps xmmword [rsp + 0x1c0], xmm7
movaps xmmword [rsp + 0x1b0], xmm6
mov rsi, rcx
xor ecx, ecx
call fcn.14002a6d0
test rax, rax
je 0x140043faa
movups xmm6, xmmword [rax]
inc qword [rax]
movzx eax, byte [0x142f53108]
mov edx, 0x56410
xor ecx, ecx
call fcn.140025a60
test rax, rax
je 0x140043faa
mov rdi, rax
add rdi, 0x56000
mov r8d, 0x410
mov rcx, rdi
mov dl, 0xff
call sub.msvcrt.dll_memset
mov qword [rsp + 0x120], rdi
mov qword [rsp + 0x128], 0x3ff
mov qword [rsp + 0x130], 0x380
mov qword [rsp + 0x138], 0
movzx eax, byte [0x142f53108]
mov edx, 9
xor ecx, ecx
call fcn.140025a60
test rax, rax
je 0x140043faa
movabs rcx, 0x5043206c61746f54
mov qword [rax], rcx
mov byte [rax + 8], 0x55
mov qword [rsp + 0x90], 9
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], 9
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0xb0], 1
xorps xmm7, xmm7
movups xmmword [rsp + 0xb8], xmm7
mov qword [rsp + 0xc8], 1
mov qword [rsp + 0xd0], 0
movabs rax, 0x8000000000000000
mov qword [rsp + 0xd8], rax
mov qword [rsp + 0xf0], 0
mov dword [rsp + 0xf8], 0
mov qword [rsp + 0x100], 0
mov qword [rsp + 0x108], 8
mov qword [rsp + 0x110], 0
mov byte [rsp + 0x118], 0
movups xmmword [rsp + 0x140], xmm6
movups xmmword [rsp + 0x150], xmm7
movups xmmword [rsp + 0x160], xmm7
mov qword [rsp + 0x170], 0
movaps xmmword [rsp + 0x20], xmm7
movaps xmmword [rsp + 0x50], xmm7
movaps xmmword [rsp + 0x40], xmm7
movaps xmmword [rsp + 0x30], xmm7
mov dword [rsp + 0x20], 0x40
lea rcx, [rsp + 0x20]
call sub.KERNEL32.dll_GlobalMemoryStatusEx
test eax, eax
jne 0x140043eb4
call sub.KERNEL32.dll_GetLastError
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rsp + 0x150], xmm0
movaps xmmword [rsp + 0x70], xmm7
movaps xmmword [rsp + 0x60], xmm7
movaps xmmword [rsp + 0x50], xmm7
movaps xmmword [rsp + 0x40], xmm7
movaps xmmword [rsp + 0x30], xmm7
movaps xmmword [rsp + 0x20], xmm7
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x20]
mov edx, 0x68
call sub.KERNEL32.dll_K32GetPerformanceInfo
test eax, eax
je 0x140043f4e
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
xor r9d, r9d
sub rdx, r8
cmovb rdx, r9
mov rcx, qword [rsp + 0x70]
mov rax, rcx
mul rdx
mov r10, 0xffffffffffffffff
cmovo rax, r10
mov rdx, qword [rsp + 0x28]
sub rdx, r8
cmovb rdx, r9
mov qword [rsp + 0x160], rax
mov rax, rcx
mul rdx
cmovo rax, r10
mov qword [rsp + 0x168], rax
lea rdi, [rsp + 0x90]
mov rcx, rdi
call fcn.140048dd0
mov byte [rsp + 0x20], 1
movabs rax, 0x202020202020101
mov qword [rsp + 0x21], rax
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1400491e0
mov r8d, 0x120
mov rcx, rsi
mov rdx, rdi
call sub.msvcrt.dll_memcpy
movaps xmm6, xmmword [rsp + 0x1b0]
movaps xmm7, xmmword [rsp + 0x1c0]
add rsp, 0x1d8
pop rdi
pop rsi
ret
ud2
Function at 0x14004e450
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x70
mov r14, r8
mov r15, rdx
mov rsi, rcx
mov qword [rsp + 0x50], 0
lea r12, [rsp + 0x50]
mov qword [rsp + 0x20], r12
lea rcx, [0x142f4d92c]
lea r9, [0x142f4d910]
xor ebx, ebx
xor edx, edx
mov r8d, 1
call sub.ole32.dll_CoCreateInstance
test eax, eax
js 0x14004e55f
mov rdi, qword [rsp + 0x50]
test rdi, rdi
je 0x14004e576
mov rcx, r15
mov rdx, r14
call fcn.14004ab80
mov r14, rax
mov qword [rsp + 0x50], 0
mov rax, qword [rdi]
mov qword [rsp + 0x40], r12
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov qword [rsp + 0x20], 0
xor r15d, r15d
mov rcx, rdi
mov rdx, r14
xor r8d, r8d
xor r9d, r9d
call qword [rax + 0x18]
test eax, eax
js 0x14004e598
mov rbx, qword [rsp + 0x50]
test rbx, rbx
je 0x14004e5b0
test r14, r14
je 0x14004e51a
mov rcx, r14
call sub.oleaut32.dll_SysFreeString
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
mov rcx, rbx
mov edx, 0xa
xor r8d, r8d
xor r9d, r9d
call sub.ole32.dll_CoSetProxyBlanket
test eax, eax
js 0x14004e5f7
mov qword [rsi + 8], rbx
mov byte [rsi], 0x12
jmp 0x14004e5de
mov ecx, eax
call fcn.14004a750
mov ebx, edx
test rax, rax
je 0x14004e576
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x10]
movzx eax, byte [rsp + 0x4f]
mov byte [rsi + 3], al
movzx eax, word [rsp + 0x4d]
mov word [rsi + 1], ax
mov dword [rsi + 4], ebx
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [rsi + 0x10], xmm0
mov byte [rsi], 0
jmp 0x14004e5e7
mov ecx, eax
call fcn.14004a750
mov r15d, edx
test rax, rax
je 0x14004e5b0
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x10]
test r14, r14
je 0x14004e5bd
mov rcx, r14
call sub.oleaut32.dll_SysFreeString
movzx eax, byte [rsp + 0x4f]
mov byte [rsi + 3], al
movzx eax, word [rsp + 0x4d]
mov word [rsi + 1], ax
mov dword [rsi + 4], r15d
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [rsi + 0x10], xmm0
mov byte [rsi], 0
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
nop
add rsp, 0x70
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov ecx, eax
call fcn.14004a750
mov ebp, edx
test rax, rax
je 0x14004e60e
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x10]
mov byte [rsi], 0
movzx eax, word [rsp + 0x50]
mov word [rsi + 1], ax
movzx eax, byte [rsp + 0x52]
mov byte [rsi + 3], al
mov dword [rsi + 4], ebp
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [rsi + 8], xmm0
mov rax, qword [rsp + 0x68]
mov qword [rsi + 0x18], rax
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
jmp 0x14004e5de
Function at 0x1400560e0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140056eb0
mov r8d, 0x1b
mov edx, 1
lea rcx, [0x142f4e1e0]
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.140056eb0
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x140056150
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x142f53194]
mov rbx, rcx
test esi, esi
jle 0x140056280
mov rax, qword [0x142f53198]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x14005619b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140056225
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140056180
mov rcx, rbx
call fcn.140056bd0
mov rdi, rax
test rax, rax
je 0x1400562a2
mov rax, qword [0x142f53198]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.140056d10
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x142f53198]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140056287
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x14005621e
lea edx, [rax - 0x40]
and edx, 0xffffffbf
jne 0x140056230
add dword [0x142f53194], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x142f53198]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14005621e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x142f4e258]
mov edx, eax
call fcn.1400560e0
nop dword [rax]
xor esi, esi
jmp 0x1400561a8
mov rax, qword [0x142f53198]
mov edx, dword [rdi + 8]
lea rcx, [0x142f4e220]
mov r8, qword [rax + rbx + 0x18]
call fcn.1400560e0
mov rdx, rbx
lea rcx, [0x142f4e200]
call fcn.1400560e0
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140056840
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x142f53200]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x142f531e0]
test rbx, rbx
je 0x14005689c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test rsi, rsi
je 0x140056893
test eax, eax
jne 0x140056893
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140056878
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x140056bd0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x142f4e3d0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140056bf0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140056bf8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140056bf0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x140056c4d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140056c44
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140056bf0
add rax, 0x28
cmp rax, r9
jne 0x140056c30
xor eax, eax
ret

Function at 0x140056c50
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x142f4e3d0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x140056c6f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140056c78
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x140056c6f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140056d10
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x142f4e3d0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x140056d2f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140056d38
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x140011258
Capabilities:
Terminate process

Disassembly:
jmp 0x140014ce0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x1400112f8
Capabilities:
Parse pe header

Disassembly:
jmp 0x140016030
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140016050
xor al, al
jmp 0x1400160d1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140016063
xor al, al
jmp 0x1400160d1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001608d
xor al, al
jmp 0x1400160d1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400160a1
xor al, al
jmp 0x1400160d1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400160b3
xor al, al
jmp 0x1400160d1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400160cf
xor al, al
jmp 0x1400160d1
mov al, 1
add rsp, 0x38
ret
Function at 0x140013f10
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.14001142e
movzx eax, al
test eax, eax
jne 0x140013f30
mov ecx, 7
call fcn.1400113a2
nop
mov byte [rsp + 0x20], 0
call fcn.1400113b6
mov byte [rsp + 0x21], al
cmp dword [0x14001f868], 1
jne 0x140013f54
mov ecx, 7
call fcn.1400113a2
nop
jmp 0x140013fac
cmp dword [0x14001f868], 0
jne 0x140013fa7
mov dword [0x14001f868], 1
lea rdx, [0x14001b770]
lea rcx, [0x14001b440]
call fcn.1400111fe
test eax, eax
je 0x140013f88
mov eax, 0xff
jmp 0x1400140b1
lea rdx, [0x14001b330]
lea rcx, [section..rdata]
call fcn.1400113ac
mov dword [0x14001f868], 2
jmp 0x140013fac
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.14001138e
call fcn.14001131b
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140014009
mov rcx, qword [rsp + 0x30]
call fcn.14001119f
movzx eax, al
test eax, eax
je 0x140014009
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140026020]
nop
call fcn.140011352
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x14001403d
mov rcx, qword [rsp + 0x38]
call fcn.14001119f
movzx eax, al
test eax, eax
je 0x14001403d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.1400113ed
nop
call fcn.140014160
mov dword [rsp + 0x28], eax
call fcn.1400112f8
movzx eax, al
test eax, eax
jne 0x14001405c
mov ecx, dword [rsp + 0x28]
call fcn.140011064
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14001406b
call fcn.1400113f7
nop
xor edx, edx
mov cl, 1
call fcn.14001118b
mov eax, dword [rsp + 0x28]
jmp 0x1400140b1
add rsp, 0x68
ret
Function at 0x1400071d0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x1400071f2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x14000726c
mov rdi, r14
mov rcx, rbx
call fcn.140009020
test rax, rax
jle 0x140007244
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.14005a3a0
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14000725c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x140007264
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x140007206
sub r14, rdi
jmp 0x14000734f
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x140007283
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140007285
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400072b7
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.14005a3a0
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14000734c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400072f2
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x14000732d
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.14006cb44
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x14000734c
cmp rbp, rax
ja 0x140007300
test rbp, rbp
je 0x14000734c
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.14006cb44
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
Function at 0x14001efc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rsi
push rdi
push r12
push r13
push r14
push r15
mov r14, qword [rsp + 0x58]
xor r15d, r15d
mov r11, qword [rsp + 0x70]
mov r13, rdx
mov rax, qword [rsp + 0x60]
mov qword [r14], r8
mov qword [r11], rax
mov rdi, qword [r14]
cmp rdi, r9
je 0x14001f153
mov r12, qword [rsp + 0x68]
lea r8d, [r15 + 1]
mov rsi, qword [r11]
mov r9d, 0x3ff
mov r10d, 0x2400
mov ebx, 0x2800
cmp rsi, r12
je 0x14001f153
movzx edx, word [r13]
xor bpl, bpl
movzx ecx, word [rdi]
cmp r8w, dx
jae 0x14001f059
lea eax, [r10 + rcx]
cmp ax, r9w
ja 0x14001f177
mov eax, edx
sub ecx, 0xdc00
shl eax, 0xa
or eax, ecx
jmp 0x14001f06f
mov eax, ecx
add cx, bx
cmp cx, r9w
ja 0x14001f06f
shl eax, 0xa
mov bpl, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x14001f082
movzx r9d, al
mov r10d, r15d
mov ebx, r15d
jmp 0x14001f0cd
mov r9d, eax
cmp eax, 0x800
jae 0x14001f09c
shr r9d, 6
mov r10d, r8d
or r9b, 0xc0
mov ebx, r8d
jmp 0x14001f0cd
cmp eax, 0x10000
jae 0x14001f0b6
shr r9d, 0xc
mov r10d, 2
or r9b, 0xe0
mov ebx, r10d
jmp 0x14001f0cd
shr r9d, 0x12
mov r10d, 3
movzx ebx, bpl
or r9b, 0xf0
xor ebx, 1
add ebx, ebx
lea r8d, [rbx + 1]
mov rdx, r12
sub rdx, rsi
mov ecx, r8d
cmp rdx, rcx
jl 0x14001f153
lea rcx, [rdi + 2]
mov qword [r14], rcx
test bpl, bpl
jne 0x14001f0f1
cmp r10d, 3
jae 0x14001f0fd
mov rcx, qword [r11]
mov r8d, ebx
mov byte [rcx], r9b
inc qword [r11]
mov r9, qword [r11]
test r8d, r8d
jle 0x14001f12e
lea ecx, [r10 + r10*2]
add ecx, ecx
nop dword [rax + rax]
sub ecx, 6
mov edx, eax
shr edx, cl
dec r8d
and dl, 0x3f
or dl, 0x80
mov byte [r9], dl
inc qword [r11]
mov r9, qword [r11]
test r8d, r8d
jg 0x14001f110
shr eax, 0xa
mov r8d, 1
test bpl, bpl
mov ecx, r8d
cmovne ecx, eax
mov word [r13], cx
mov rdi, qword [r14]
cmp rdi, qword [rsp + 0x50]
jne 0x14001f00e
mov rax, qword [rsp + 0x48]
cmp rax, qword [r14]
sete r15b
mov eax, r15d
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
mov eax, 2
jmp 0x14001f162

Function at 0x14003b418
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
lea r9, [rdx + rdx]
movabs r8, 0xcbf29ce484222325
xor edx, edx
test r9, r9
je 0x140026bea
movzx eax, byte [rdx + rcx]
movabs r10, 0x100000001b3
xor r8, rax
inc rdx
imul r8, r10
cmp rdx, r9
jb 0x140026bcd
mov rax, r8
ret
sub r8, rdx
mov rcx, rdx
sar r8, 1
mov rdx, r8
jmp 0x140026bb8

Function at 0x140046928
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140046972
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140046972
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140046972
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140046972
cmp dword [rcx + 0x84], 0xe
jbe 0x140046972
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140046974
xor al, al
add rsp, 0x28
ret
Function at 0x1400514c0
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [rbx], eax
cmp eax, 0xffffffff
je 0x1400514df
mov rax, rbx
add rsp, 0x20
pop rbx
ret
mov r9d, 0xc
lea r8, str.TLS_capacity_depleted
lea rcx, str.libslog_src_thread_specific.cpp
lea edx, [r9 + 0x1d]
call fcn.14004ac90
int3

Function at 0x140058380
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x20
mov ecx, dword [0x1400b60f8]
cmp ecx, 0xffffffff
je 0x1400583a0
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x1400583ba
call fcn.1400588a0
mov ecx, dword [0x1400b60f8]
cmp ecx, 0xffffffff
jne 0x1400583b4
xor eax, eax
jmp 0x1400583ba
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
lea rbx, [rax + 0x18]
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.1400572b0
mov qword [rbx], rax
add rsp, 0x20
pop rbx
ret

Function at 0x140058810
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [0x1400b60f8]
cmp ecx, 0xffffffff
je 0x140058873
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140058873
mov rdx, qword [rax + 0x28]
mov rcx, rdx
mov rax, qword [rdx + 8]
cmp byte [rax + 0x19], 0
jne 0x140058858
cmp qword [rax + 0x20], rbx
jae 0x14005884c
mov rax, qword [rax + 0x10]
jmp 0x140058852
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x140058840
cmp byte [rcx + 0x19], 0
jne 0x140058873
cmp rbx, qword [rcx + 0x20]
jb 0x140058873
cmp rcx, rdx
je 0x140058873
lea rax, [rcx + 0x28]
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x1400588a0
Capabilities:
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
call fcn.140057250
mov rbx, rax
mov qword [rsp + 0x30], rax
lea rdx, [0x1400587f0]
lea rcx, [0x1400bbcc8]
call fcn.1400583e0
mov ecx, dword [0x1400b60f8]
cmp ecx, 0xffffffff
je 0x1400588db
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
add rsp, 0x20
pop rbx
ret
Function at 0x140074b50
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14007494c

Function at 0x1400787b4
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x1400787ca
mov al, 1
jmp 0x14007882a
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x1400787db
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140078828
mov ecx, dword [rcx + 0x18]
nop
call fcn.140083168
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140078828
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140078828
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140078828
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14007882a
xor al, al
add rsp, 0x20
pop rbx
ret