joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001de2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0xa8
mov word [rsp + 0x20], 0x65
mov word [rsp + 0x22], 0x5b
mov word [rsp + 0x24], 0x6e
mov word [rsp + 0x26], 0x70
mov word [rsp + 0x28], 0x72
mov word [rsp + 0x2a], 0x7c
mov word [rsp + 0x2c], 0x7d
mov word [rsp + 0x2e], 0x7b
mov word [rsp + 0x30], 0x82
mov word [rsp + 0x32], 0x65
mov word [rsp + 0x34], 0x56
mov word [rsp + 0x36], 0x6a
mov word [rsp + 0x38], 0x6c
mov word [rsp + 0x3a], 0x71
mov word [rsp + 0x3c], 0x72
mov word [rsp + 0x3e], 0x77
mov word [rsp + 0x40], 0x6e
mov word [rsp + 0x42], 0x65
mov word [rsp + 0x44], 0x5c
mov word [rsp + 0x46], 0x62
mov word [rsp + 0x48], 0x5c
mov word [rsp + 0x4a], 0x5d
mov word [rsp + 0x4c], 0x4e
mov word [rsp + 0x4e], 0x56
mov word [rsp + 0x50], 0x65
mov word [rsp + 0x52], 0x4c
mov word [rsp + 0x54], 0x7e
mov word [rsp + 0x56], 0x7b
mov word [rsp + 0x58], 0x7b
mov word [rsp + 0x5a], 0x6e
mov word [rsp + 0x5c], 0x77
mov word [rsp + 0x5e], 0x7d
mov word [rsp + 0x60], 0x4c
mov word [rsp + 0x62], 0x78
mov word [rsp + 0x64], 0x77
mov word [rsp + 0x66], 0x7d
mov word [rsp + 0x68], 0x7b
mov word [rsp + 0x6a], 0x78
mov word [rsp + 0x6c], 0x75
mov word [rsp + 0x6e], 0x5c
mov word [rsp + 0x70], 0x6e
mov word [rsp + 0x72], 0x7d
mov word [rsp + 0x74], 0x65
mov word [rsp + 0x76], 0x5c
mov word [rsp + 0x78], 0x6e
mov word [rsp + 0x7a], 0x7b
mov word [rsp + 0x7c], 0x7f
mov word [rsp + 0x7e], 0x72
mov word [rsp + 0x80], 0x6c
mov word [rsp + 0x82], 0x6e
mov word [rsp + 0x84], 0x7c
mov word [rsp + 0x86], 0x65
mov word [rsp + 0x88], pe_nt_image_headers64
mov word [rsp + 0x8a], 0x7e
mov word [rsp + 0x8c], 0x6a
mov word [rsp + 0x8e], 0x7e
mov word [rsp + 0x90], 0x7c
mov word [rsp + 0x92], 0x6e
mov word [rsp + 0x94], 0x7b
mov word [rsp + 0x96], 0x7f
mov word [rsp + 0x98], 9
cmp byte [0x140869660], 0
jne 0x140001ffd
mov byte [0x1408696fa], 1
mov eax, 0
lea rcx, [0x140869680]
movzx edx, word [rsp + rax*2 + 0x20]
mov word [rcx + rax*2], dx
add rax, 1
cmp rax, 0x3d
jne 0x140001fd7
mov byte [0x140869660], 1
lea rcx, [0x14000168a]
call fcn.1400014f0
lea rax, [0x140869680]
add rsp, 0xa8
ret

Function at 0x140002218
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 3
mov byte [rsp + 0x21], 0x59
mov byte [rsp + 0x22], 0x4c
mov byte [rsp + 0x23], 0x55
mov byte [rsp + 0x24], 0x58
mov byte [rsp + 0x25], 0x56
mov byte [rsp + 0x26], 0x46
mov byte [rsp + 0x27], 0x4b
mov byte [rsp + 0x28], 0x48
mov byte [rsp + 0x29], 0x46
mov byte [rsp + 0x2a], 0x4e
mov byte [rsp + 0x2b], 0x50
mov byte [rsp + 0x2c], 0x44
mov byte [rsp + 0x2d], 0x57
mov byte [rsp + 0x2e], 0x48
mov byte [rsp + 0x2f], 0x11
mov byte [rsp + 0x30], 0x46
mov byte [rsp + 0x31], 0x52
mov byte [rsp + 0x32], 0x50
mov byte [rsp + 0x33], 0xe3
cmp byte [0x1408692e8], 0
jne 0x1400022c1
mov byte [0x140869304], 1
mov eax, 0
lea rcx, [0x1408692f0]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x14
jne 0x14000229c
mov byte [0x1408692e8], 1
lea rcx, [0x1400017bd]
call fcn.1400014f0
lea rax, [0x1408692f0]
add rsp, 0x48
ret
Function at 0x1400022ce
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 3
mov byte [rsp + 0x21], 0x51
mov byte [rsp + 0x22], 0x52
mov byte [rsp + 0x23], 0x47
mov byte [rsp + 0x24], 0x4c
mov byte [rsp + 0x25], 0x56
mov byte [rsp + 0x26], 0x57
mov byte [rsp + 0x27], 0x55
mov byte [rsp + 0x28], 0x4c
mov byte [rsp + 0x29], 0x45
mov byte [rsp + 0x2a], 0x58
mov byte [rsp + 0x2b], 0x57
mov byte [rsp + 0x2c], 0x48
mov byte [rsp + 0x2d], 0x11
mov byte [rsp + 0x2e], 0x46
mov byte [rsp + 0x2f], 0x52
mov byte [rsp + 0x30], 0x50
mov byte [rsp + 0x31], 0xe3
cmp byte [0x1408692c0], 0
jne 0x14000236d
mov byte [0x1408692e2], 1
mov eax, 0
lea rcx, [0x1408692d0]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x12
jne 0x140002348
mov byte [0x1408692c0], 1
lea rcx, [0x1400017d5]
call fcn.1400014f0
lea rax, [0x1408692d0]
add rsp, 0x48
ret

Function at 0x14000237a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 3
mov byte [rsp + 0x21], 0x59
mov byte [rsp + 0x22], 0x4c
mov byte [rsp + 0x23], 0x55
mov byte [rsp + 0x24], 0x58
mov byte [rsp + 0x25], 0x56
mov byte [rsp + 0x26], 0x56
mov byte [rsp + 0x27], 0x46
mov byte [rsp + 0x28], 0x44
mov byte [rsp + 0x29], 0x51
mov byte [rsp + 0x2a], 0x11
mov byte [rsp + 0x2b], 0x4d
mov byte [rsp + 0x2c], 0x52
mov byte [rsp + 0x2d], 0x57
mov byte [rsp + 0x2e], 0x57
mov byte [rsp + 0x2f], 0x4c
mov byte [rsp + 0x30], 0x11
mov byte [rsp + 0x31], 0x52
mov byte [rsp + 0x32], 0x55
mov byte [rsp + 0x33], 0x4a
mov byte [rsp + 0x34], 0xe3
cmp byte [0x140869288], 0
jne 0x140002428
mov byte [0x1408692a5], 1
mov eax, 0
lea rcx, [0x140869290]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x15
jne 0x140002403
mov byte [0x140869288], 1
lea rcx, [0x140001805]
call fcn.1400014f0
lea rax, [0x140869290]
add rsp, 0x48
ret

Function at 0x140002434
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 3
mov byte [rsp + 0x21], 0x53
mov byte [rsp + 0x22], 0x44
mov byte [rsp + 0x23], 0x51
mov byte [rsp + 0x24], 0x47
mov byte [rsp + 0x25], 0x44
mov byte [rsp + 0x26], 0x56
mov byte [rsp + 0x27], 0x48
mov byte [rsp + 0x28], 0x46
mov byte [rsp + 0x29], 0x58
mov byte [rsp + 0x2a], 0x55
mov byte [rsp + 0x2b], 0x4c
mov byte [rsp + 0x2c], 0x57
mov byte [rsp + 0x2d], 0x5c
mov byte [rsp + 0x2e], 0x11
mov byte [rsp + 0x2f], 0x46
mov byte [rsp + 0x30], 0x52
mov byte [rsp + 0x31], 0x50
mov byte [rsp + 0x32], 0xe3
cmp byte [0x1408691d8], 0
jne 0x1400024d8
mov byte [0x1408691f3], 1
mov eax, 0
lea rcx, [0x1408691e0]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x13
jne 0x1400024b3
mov byte [0x1408691d8], 1
lea rcx, [0x1400018ad]
call fcn.1400014f0
lea rax, [0x1408691e0]
add rsp, 0x48
ret
Function at 0x1400024e4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 3
mov byte [rsp + 0x21], 0x16
mov byte [rsp + 0x22], 0x19
mov byte [rsp + 0x23], 0x13
mov byte [rsp + 0x24], 0x57
mov byte [rsp + 0x25], 0x52
mov byte [rsp + 0x26], 0x57
mov byte [rsp + 0x27], 0x44
mov byte [rsp + 0x28], 0x4f
mov byte [rsp + 0x29], 0x56
mov byte [rsp + 0x2a], 0x48
mov byte [rsp + 0x2b], 0x46
mov byte [rsp + 0x2c], 0x58
mov byte [rsp + 0x2d], 0x55
mov byte [rsp + 0x2e], 0x4c
mov byte [rsp + 0x2f], 0x57
mov byte [rsp + 0x30], 0x5c
mov byte [rsp + 0x31], 0x11
mov byte [rsp + 0x32], 0x46
mov byte [rsp + 0x33], 0x52
mov byte [rsp + 0x34], 0x50
mov byte [rsp + 0x35], 0xe3
cmp byte [0x140869180], 0
jne 0x140002597
mov byte [0x1408691a6], 1
mov eax, 0
lea rcx, [0x140869190]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x16
jne 0x140002572
mov byte [0x140869180], 1
lea rcx, [0x1400018f5]
call fcn.1400014f0
lea rax, [0x140869190]
add rsp, 0x48
ret

Function at 0x1400025a4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 3
mov byte [rsp + 0x21], 0x44
mov byte [rsp + 0x22], 0x51
mov byte [rsp + 0x23], 0x57
mov byte [rsp + 0x24], 0x4c
mov byte [rsp + 0x25], 0x59
mov byte [rsp + 0x26], 0x4c
mov byte [rsp + 0x27], 0x55
mov byte [rsp + 0x28], 0x58
mov byte [rsp + 0x29], 0x56
mov byte [rsp + 0x2a], 0x11
mov byte [rsp + 0x2b], 0x46
mov byte [rsp + 0x2c], 0x52
mov byte [rsp + 0x2d], 0x50
mov byte [rsp + 0x2e], 0x52
mov byte [rsp + 0x2f], 0x47
mov byte [rsp + 0x30], 0x52
mov byte [rsp + 0x31], 0x11
mov byte [rsp + 0x32], 0x46
mov byte [rsp + 0x33], 0x52
mov byte [rsp + 0x34], 0x50
mov byte [rsp + 0x35], 0xe3
cmp byte [0x140869148], 0
jne 0x140002657
mov byte [0x140869166], 1
mov eax, 0
lea rcx, [0x140869150]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x16
jne 0x140002632
mov byte [0x140869148], 1
lea rcx, [0x140001925]
call fcn.1400014f0
lea rax, [0x140869150]
add rsp, 0x48
ret
Function at 0x140002852
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x88
mov word [rsp + 0x20], 0xe4
mov word [rsp + 0x22], 0x12
mov word [rsp + 0x24], 0xdf
mov word [rsp + 0x26], 0xee
mov word [rsp + 0x28], 0x22
mov word [rsp + 0x2a], 0xdf
mov word [rsp + 0x2c], 0x22
mov word [rsp + 0x2e], 0x27
mov word [rsp + 0x30], 0x2e
mov word [rsp + 0x32], 0x28
mov word [rsp + 0x34], 0x22
mov word [rsp + 0x36], 0x24
mov word [rsp + 0x38], 0xdf
mov word [rsp + 0x3a], 0xee
mov word [rsp + 0x3c], 2
mov word [rsp + 0x3e], 0xdf
mov word [rsp + 0x40], 0x18
mov word [rsp + 0x42], 0xdf
mov word [rsp + 0x44], 0xee
mov word [rsp + 0x46], 0xd
mov word [rsp + 0x48], 0xdf
mov word [rsp + 0x4a], 0xee
mov word [rsp + 0x4c], 3
mov word [rsp + 0x4e], 0xdf
mov word [rsp + 0x50], 0x18
mov word [rsp + 0x52], 0xdf
mov word [rsp + 0x54], 0xee
mov word [rsp + 0x56], 0x13
mov word [rsp + 0x58], 0xdf
mov word [rsp + 0x5a], 0xf2
mov word [rsp + 0x5c], 0xdf
mov word [rsp + 0x5e], 0xe5
mov word [rsp + 0x60], 0xdf
mov word [rsp + 0x62], 3
mov word [rsp + 0x64], 0x24
mov word [rsp + 0x66], 0x2b
mov word [rsp + 0x68], 0xdf
mov word [rsp + 0x6a], 0xe1
mov word [rsp + 0x6c], 0xe4
mov word [rsp + 0x6e], 0x12
mov word [rsp + 0x70], 0xe1
mov word [rsp + 0x72], 0xbf
cmp byte [0x1408689a8], 0
jne 0x1400029c1
mov byte [0x140868a14], 1
mov eax, 0
lea rcx, [0x1408689c0]
movzx edx, word [rsp + rax*2 + 0x20]
mov word [rcx + rax*2], dx
add rax, 1
cmp rax, 0x2a
jne 0x14000299b
mov byte [0x1408689a8], 1
lea rcx, [0x140001a8a]
call fcn.1400014f0
lea rax, [0x1408689c0]
add rsp, 0x88
ret
Function at 0x140002a34
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov r12, rcx
test edx, edx
je 0x140002ba8
mov r13d, edx
mov edi, 0
lea r14, [0x140001530]
lea rbx, [0x140869bc1]
jmp 0x140002a9a
mov byte [0x140869bc1], 0
mov edx, esi
sar edx, 0x1f
shr edx, 0x1b
lea eax, [rsi + rdx]
and eax, 0x1f
sub eax, edx
cdqe
lea rdx, [0x140869ba0]
xor bpl, byte [rdx + rax]
mov byte [r12 + rdi], bpl
add rdi, 1
cmp r13, rdi
je 0x140002ba8
mov esi, edi
movzx ebp, byte [r12 + rdi]
mov byte [rsp + 0x20], 0x87
mov byte [rsp + 0x21], 0x78
mov byte [rsp + 0x22], 0x7c
mov byte [rsp + 0x23], 0x78
mov byte [rsp + 0x24], 0x8b
mov byte [rsp + 0x25], 0x77
mov byte [rsp + 0x26], 0x7f
mov byte [rsp + 0x27], 0x81
mov byte [rsp + 0x28], 0x77
mov byte [rsp + 0x29], 0x7e
mov byte [rsp + 0x2a], 0x7f
mov byte [rsp + 0x2b], 0x7c
mov byte [rsp + 0x2c], 0x77
mov byte [rsp + 0x2d], 0x8d
mov byte [rsp + 0x2e], 0x86
mov byte [rsp + 0x2f], 0x84
mov byte [rsp + 0x30], 0x7b
mov byte [rsp + 0x31], 0x76
mov byte [rsp + 0x32], 0x7f
mov byte [rsp + 0x33], 0x89
mov byte [rsp + 0x34], 0x79
mov byte [rsp + 0x35], 0x78
mov byte [rsp + 0x36], 0x77
mov byte [rsp + 0x37], 0x76
mov byte [rsp + 0x38], pe_nt_image_headers64
mov byte [rsp + 0x39], 0x8d
mov byte [rsp + 0x3a], 0x88
mov byte [rsp + 0x3b], 0x83
mov byte [rsp + 0x3c], 0x82
mov byte [rsp + 0x3d], 0x76
mov byte [rsp + 0x3e], 0x8c
mov byte [rsp + 0x3f], 0x7c
mov byte [rsp + 0x40], 0x13
cmp byte [0x140869b80], 0
jne 0x140002b83
mov byte [0x140869bc1], 1
mov eax, 0
lea rcx, [0x140869ba0]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x21
jne 0x140002b62
mov byte [0x140869b80], 1
mov rcx, r14
call fcn.1400014f0
cmp byte [0x140869bc1], 0
je 0x140002a6c
lea rax, [0x140869ba0]
sub byte [rax], 0x13
add rax, 1
cmp rbx, rax
jne 0x140002b97
jmp 0x140002a65
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x140008630
Capabilities:
Parse pe header

Disassembly:
test rcx, rcx
je 0x140008660
mov eax, 0
cmp word [rcx], 0x5a4d
jne 0x14000865f
mov eax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x140008665
cdqe
add rax, rcx
cmp dword [rax], 0x4550
mov edx, 0
cmovne rax, rdx
ret
mov rax, rcx
jmp 0x14000865f
mov eax, 0
jmp 0x14000865f

Function at 0x140008ce0
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov rcx, r10
call fcn.140008c90
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret
Function at 0x140012360
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x140869f74]
test esi, esi
mov rdi, rcx
mov rbp, rdx
mov rbx, r8
jle 0x1400124f0
mov rax, qword [0x140869f78]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rdi, rdx
jb 0x1400123ac
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rdi, rdx
jb 0x140012435
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x140012390
mov rcx, rdi
call fcn.140012ec0
test rax, rax
mov r12, rax
je 0x140012542
mov rax, qword [0x140869f78]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call fcn.140013000
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x140869f78]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140012525
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x14001242e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x1400124a0
add dword [0x140869f74], 1
cmp ebx, 8
jae 0x140012461
test bl, 4
jne 0x140012500
test ebx, ebx
je 0x140012456
movzx eax, byte [rbp]
test bl, 2
mov byte [rdi], al
jne 0x140012514
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, ebx
sub ebx, 1
mov rdx, qword [rbp + rax - 8]
cmp ebx, 8
mov qword [rdi + rax - 8], rdx
jb 0x140012456
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, ebx
mov qword [rdi + rdx], rcx
jb 0x14001247a
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp eax, 2
mov r8d, 4
mov eax, 0x40
mov rcx, qword [rsp + 0x20]
cmovne r8d, eax
mov rdx, qword [rsp + 0x38]
add rsi, qword [0x140869f78]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14001242e
call qword [0x14086b2c4]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.1400122f0
xor esi, esi
jmp 0x1400123b7
mov eax, dword [rbp]
mov ebx, ebx
mov dword [rdi], eax
mov eax, dword [rbp + rbx - 4]
mov dword [rdi + rbx - 4], eax
jmp 0x140012456
mov ebx, ebx
movzx eax, word [rbp + rbx - 2]
mov word [rdi + rbx - 2], ax
jmp 0x140012456
mov rax, qword [0x140869f78]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call fcn.1400122f0
lea rcx, str.Address__p_has_no_image_section
mov rdx, rdi
call fcn.1400122f0
nop
nop dword [rax]
nop word cs:[rax + rax]
Function at 0x140012ec0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x14085c750]
xor edx, edx
cmp word [r9], 0x5a4d
mov r8, rcx
jne 0x140012f2f
mov rcx, r9
call fcn.140012d90
test eax, eax
je 0x140012f2f
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add r9, rax
movzx eax, word [r9 + 0x14]
lea rdx, [r9 + rax + 0x18]
movzx eax, word [r9 + 6]
test eax, eax
je 0x140012f2d
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x140012f24
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x140012f2f
add rdx, 0x28
cmp rdx, r9
jne 0x140012f10
xor edx, edx
mov rax, rdx
add rsp, 0x28
ret
Function at 0x14001d3d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
lea rcx, [0x140852760]
jmp 0x140013cf0

Function at 0x14001d3e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
lea rcx, [0x140852760]
jmp 0x140013cf0

Function at 0x140877f78
Capabilities:
Packed with generic packer

Disassembly:
mov rdx, qword [rsp + 0x20]
mov rdx, qword [rdx]
add r9d, 0x830d0623
shl r9, 0xac
call fcn.14092b6bd
cmovge r15w, di
and edi, dword [rsp + 0x32]
xchg qword [rsp + 0x58], rdx
mov r10, qword [rsp + 0x28]
setle dil
cmp r13, qword [rsp + 0x30]
je 0x140918735
jl 0x14099aaba
movsx edi, dil
setbe r13b
mov r12, qword [rsp + 0x40]
Function at 0x14087ef3a
Capabilities:
Packed with generic packer

Disassembly:
mov r10, r9
or r10, qword [rsp + r10*4 + 0x1c]
jb 0x1409a4bba
call fcn.1409711d5
mov rdi, qword [rsp + r8 - 0x56]
mov rdi, qword [rdi + r10 + 0x5966b200]
shl qword [rsp + r8*4 - 0x228], 9
cmovbe r13d, dword [rsp + 0x32]
mov r13b, 0x27
shr r8w, 0xeb
lea rdi, [rdi + r10*2 + 0x42e84d2f]
sub dword [rsp + r8*2 + 0x30], 0x4523509c
neg r10w
mov qword [rsp + r8*2 + 0x40], r13
push rdi
xchg qword [rsp + r10 + 0x59664e88], rdi
mov r10, qword [rsp + r10 + 0x59664e68]
jle 0x14097b745

Function at 0x140880c8c
Capabilities:
Packed with generic packer

Disassembly:
jns 0x14088a36d
or byte [rsp + 0x40], 0x2d
lea rdx, [rdx + r12*8 + 0x54176ddd]
not word [rsp + r12*2 - 0xfa34]
movabs rcx, 0x7b2239ece2a5021
call fcn.140876e87

Function at 0x14088b200
Capabilities:
Get thread local storage value

Disassembly:
neg r10
movabs rbx, 0x97a6db92501cf83f
setns byte [rsp + 0x20]
shl r10w, 0x4c
cmp bl, r10b
xchg qword [rsp + 0x40], rax
mov r10, qword [rsp + 0x30]
sub r9b, bpl
jg 0x140919333
not word [rsp + 0x10]
jo 0x14087c51a
jae 0x14098e486
int3
push rdx
call fcn.140922f3e
sub dword [0xffa07b84], ebp
add ebp, dword [rbx + rdi*8]
adc al, 0xcc
cmp cx, r15w
mov ecx, dword [rsp + rsi - 0x8040dd]
mov rbx, rax
mov byte [rsp + rsi*2 - 0x10081e0], sil
push rcx
jg 0x1408846c9
jl 0x1408fa1cb
sub rbp, 0x7ea0a788
or r9d, 0xf00e0abf
mov rbp, qword [rsp + 0x10]
mov rbp, qword [rbp + riz]
setno r9b
mov qword [rsp + 0x10], r9
movzx r9, byte [rsp + 0x10]
setle r9b
or dword [rsp + r9 + 0xf], 0x802c128
lea rbp, [rbp + r9 - 0x61ef5c4f]
neg qword [rsp + r9*4 + 0xc]
push r10
call fcn.14087ef3a
test r8b, 0xae
xchg qword [rsp + 0x10], rdx
jno 0x14088098c

Function at 0x14088b223
Capabilities:
Get thread local storage value

Disassembly:
and eax, 0x13c51fa
nop
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]
xchg qword [rsp + 0x50], rdi
mov r11, qword [rsp + 0x48]
cmovno r9w, word [rsp + 0x3e]
sub r9b, byte [rsp + 0x3c]
and r9d, 0x96865234
shl word [rsp + r9 - 0x16040fec], 0x37
jne 0x14001b4d1
movabs r9, 0x6a2832be682f88a
mov r9, qword [rsp + 0x30]
js 0x14096fc39
mov rbp, qword [rsp + 0x38]
call fcn.14088b490
pushfq
push rbp
pushfq
movabs rbp, 0x5cac0c86f11120a7
push r11
push r12
mov rbp, qword [rsp + 0x18]
mov qword [rsp + 0x18], 0x6a9a404a
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x18]
call fcn.1409ac0d3
lea rsp, [rsp + 0x78]
ret
mov rdi, qword [rdi]
add sil, sil
not sil
setno sil
lea rdi, [rdi + 0x118e08b9]
sub sil, sil
test sil, sil
lea rsi, [rsi + riz + 0x29151c19]
jb 0x14096675c
jle 0x14099defc
call fcn.14094ed12
add qword [rsp], 0xfffffffffff70f2d
xor rcx, 0x38a7dea5
call fcn.140991c02
add al, 0xe3
sbb dh, byte [rbp + 0x1de2d774]
in al, dx
invalid
or rsi, 0x4eb021a2
xchg qword [rsp + 0x38], rdi
mov rsi, qword [rsp]
jl 0x14099bc6d
push rax
push rcx
movabs rcx, 0x768cf22bbb170c30
pushfq
and ecx, 0xf42b7826
setae cl
movabs rcx, 0x7d268b00520a1d1a
push r12
call 0x14099bc72
push rdi
call fcn.140975763
Function at 0x1408f6dca
Capabilities:
Packed with generic packer

Disassembly:
and r15d, dword [rsp + r15 + 0x14]
push r14
mov r14, qword [rsp + r15*2 + 0x18]
mov dword [rsp + r11*2 + 0x18], 0x34b99a3b
lea r14, [r15 + riz - 0x47d9cd55]
jl 0x14097a54e
jns 0x1408f8450
mov qword [rsp + 8], r15
jbe fcn.14098c649
push r11
sub r15d, r15d
mov r11, r15
lea rbx, [rbx + r15*2 - 0x5b6c00cd]
jns 0x1408792e5

Function at 0x1409090d2
Capabilities:
Packed with generic packer

Disassembly:
setbe byte [rsp + 8]
add edx, 0xb6ab6a1b
push r12
add qword [rsp + 8], 0xfffffffffff82502
shr rdx, 0xdc
push 0x3d9d6387
push r9
jbe 0x14088c9d8
push r12
mov rbx, qword [rsp + 0x20]
mov rbx, qword [rbx + rdx - 0xb]
mov qword [rsp + rdx*8 - 0x38], r12
call fcn.14097c4e6

Function at 0x140920c57
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [rsp + 0x20], 0
mov rdx, qword [rsp + 0x10]
mov rdx, qword [rdx]
movsx rsi, word [rsp + 8]
mov qword [rsp + rsi*2 - 0xbf42], rsi
movzx si, sil
jno 0x14097303a
ret
mov rdi, qword [rsp]
lea rsp, [rsp + 0x10]
ret 0x10
mov rsi, qword [rsp + rsi - 0x782564c1]
ja 0x14088a35a
jo 0x1408f24ef
push qword [rsp + 0x30]
popfq
lea rsp, [rsp + 0x48]
ret
jge 0x1409a635c
or r13b, 0xe
shl r15b, cl
mov r15, qword [rsp + rdi + 0x4f]
add r13d, 0x6725213e
cmp ecx, 0xb034ed37
jl 0x14098dba6
lea rdx, [rdx + rsi*2 - 0x36c02315]
add word [rsp + rsi - 0xa1], 0xb3b6
push rsi
js 0x14099aac7
push 0xffffffff83820d9e
cmp dword [rsp + rsi*8 - 0x540], esi
mov qword [rsp + rsi - 0x79], 0x67ab93a8
xchg qword [rsp + rsi*4 - 0x25c], rdx
mov rsi, qword [rsp + rsi*8 - 0x510]
mov dword [rsp + 0x20], 0x9d8fce8a
call fcn.14087c7ee
sub eax, 0x8454b646
test dword [rbp + 0x245c0828], ebp
sbb byte [rcx - 0x43], cl
movabs dword [0x4162270a11faa316], eax
push rsi
shr rcx, 0x35
neg ecx
ja 0x14098c5c8
jle 0x14095c268

Function at 0x140922fe0
Capabilities:
Encode data using xor

Disassembly:
xor word [rsp + 0x38], r11w
lea rbp, [rdi*4 - 0x6d5888d1]
xchg qword [rsp + 0x90], rdx
mov rbp, qword [rsp + 0x80]
call fcn.140909115
add eax, 0x5cf76600
and al, 0x50
jo 0x140922fa3
jbe 0x1408e98e6
xor word [rsp + 0x18], si
add qword [rsp + 0x10], 0xffffffffffed0a96
lea rdx, [rdx + 1]
neg word [rsp + 0x18]
call fcn.14088a5b7
xor dword [rsi - 0x41], 0xb7ee693c
sbb cl, bl
push rsi
ja 0x140922fde
jmp 0xd1f2cf4d

Function at 0x1409250d7
Capabilities:
Packed with generic packer

Disassembly:
test dword [rsp + 0x28], 0xacab2181
call fcn.140967dfd
mov rcx, qword [rsp + 0x10]
jge 0x1409090c5
invalid

Function at 0x140925864
Capabilities:
Packed with generic packer

Disassembly:
jg 0x1409a6316
push qword [rsp + 0x40]
popfq
lea rsp, [rsp + 0x50]
ret 8
Function at 0x14093d38d
Capabilities:
Packed with generic packer

Disassembly:
jbe 0x14097a529
movsx r12d, word [rsp + r12*2 + 0x7c]
mov r13, qword [rsp + r12 + 0x58]
cmp dword [rsp + r12 + 0x78], 0xb12672ac
xchg qword [rsp + r12 + 0x88], rcx
mov byte [rax], al
add byte [rax], al
mov r13, qword [rsp + r12 + 0x18]
mov byte [rsp + r12 + 0x78], 2
movabs rdx, 0x79ba7d85ba8b5f0d
jo 0x1409692bf
adc byte [rax - 0x13], 0xfe
dec dword [rdi]
mov es, word [rax + 0x46fffa68]
cmp ah, byte [rsp + 0x5a]
jle 0x140920df5
cmp r12b, byte [rsp + r12 + 0x5a]
mov r12b, 3
mov rdx, qword [rsp + 0x10]
call fcn.140884470
or edx, ebx
jg 0x14097a54a
sub dword [rdx - 0x1fe6fb1], eax
paddq mm1, qword [rcx - 0x52]
push rdi
fdivr st(1)
sbb ch, bh
add dword [rsi], 0xb201985f
mov bh, 8
cmp dword [rdx + 0x32b1509f], esi
rcr cl, 1
jle 0x14097a5e8
jbe 0x14097a56a
pop rdx
cmp cl, byte [rsi - 0x13a6901d]
cld
lea esp, [rax + 0x2f]
int 0xfb
jns 0x14097a63a
fst st(3)
fisubr dword [r15]
int1
invalid
cli
rol dword [rdi + rcx*4 + 0xd], cl
mov edx, 0x87da6f4c
invalid
rcr edi, 0xc5
sbb al, 0xc4
push rax
invalid

Function at 0x14094baa5
Capabilities:
Packed with generic packer

Disassembly:
setb bpl
and bp, bp
mov rbp, qword [rsp + 0x10]
mov rbp, qword [rbp + riz]
js 0x1408fb308
mov qword [rsp + 0x10], 0xffffffffbe1302b5
push 0x598fc381
ja 0x14088ed87
mov rdi, qword [rsp + r11 - 0x3c019598]
mov rdi, qword [rdi + r11 - 0x3c0195a0]
lea r11, [r11 + r11*4 - 0x384e7ec7]
mov qword [rsp + 8], r11
or dword [rsp + 0x10], r11d
jo 0x140941146
shl qword [rsp + 0x10], 0xf1
not r11d
jae 0x14098254c
lea rdi, [rdi + r11*2 + 0xd85536e]
call fcn.1408fb358
ficomp dword [rcx]
invalid

Function at 0x14094bf27
Capabilities:
Encode data using xor

Disassembly:
mov rbp, qword [rsp + 0x28]
push rcx
movsx r10d, r10b
movabs rcx, 0xc0b39fba982745ad
not r10b
call fcn.1409a8cb2
shr byte [rbx - 0x5a], 0x79
call 0xe8ea6d7f
pop rdi
xchg esi, eax
cmp eax, edi
sub ecx, dword [rsi + 0x3edf1029]
popfq
test al, 0x4f
mov dh, 0x35
invalid

Function at 0x14095c251
Capabilities:
Packed with generic packer

Disassembly:
push r14
pushfq
movabs r14, 0xf1830d007c2edf01
sub r14w, r14w
jge 0x1408fbd14

Function at 0x14097026c
Capabilities:
Packed with generic packer

Disassembly:
add qword [rsp], 0xffffffffbf6afe79
mov rdi, qword [rsp + 0x18]
push qword [rsp + 0x20]
popfq
lea rsp, [rsp + 0x38]
call fcn.1409ac0d3
ja 0x1408ffb17