joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005cae0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov ecx, dword [0x1400c00a8]
test ecx, ecx
je 0x14005cb0f
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x14005cb28
cmp byte [rax + 8], 0
je 0x14005cb28
add rax, 9
jmp 0x14005cbd0
lea rcx, dbg.destroy_value_u8_
call sym.std::sys::windows::thread_local_key::StaticKey::init::h2de08b4a932e6024
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x14005cb00
mov ecx, dword [0x1400c00a8]
test ecx, ecx
je 0x14005cbb1
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x14005cbce
mov rdi, rax
test rax, rax
jne 0x14005cb8e
mov rax, qword [0x1400f12c8]
movzx eax, byte [rax]
mov ecx, 0x10
mov edx, 8
call sym.__rust_alloc
test rax, rax
je 0x14005cbe7
mov rdi, rax
lea rax, dbg.destroy_value_u8_
mov qword [rdi], rax
mov byte [rdi + 8], 0
mov ecx, dword [0x1400c00a8]
test ecx, ecx
je 0x14005cbd7
dec ecx
mov rdx, rdi
call fcn.1400bd584
xor ecx, ecx
test rsi, rsi
je 0x14005cba4
cmp byte [rsi], 0
mov byte [rsi], 0
movzx eax, byte [rsi + 1]
cmove eax, ecx
mov ecx, eax
lea rax, [rdi + 9]
mov byte [rdi + 8], 1
mov byte [rdi + 9], cl
jmp 0x14005cbd0
lea rcx, dbg.destroy_value_u8_
call sym.std::sys::windows::thread_local_key::StaticKey::init::h2de08b4a932e6024
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x14005cb43
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, dbg.destroy_value_u8_
call sym.std::sys::windows::thread_local_key::StaticKey::init::h2de08b4a932e6024
mov ecx, eax
jmp 0x14005cb86
mov ecx, 8
mov edx, 0x10
call dbg.handle_alloc_error
ud2
Function at 0x14005cc00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov ecx, dword [0x1400c00c8]
test ecx, ecx
je 0x14005cc2f
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x14005cc48
cmp byte [rax + 8], 0
je 0x14005cc48
add rax, 9
jmp 0x14005ccf0
lea rcx, dbg.destroy_value_u8_
call sym.std::sys::windows::thread_local_key::StaticKey::init::h2de08b4a932e6024
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x14005cc20
mov ecx, dword [0x1400c00c8]
test ecx, ecx
je 0x14005ccd1
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x14005ccee
mov rdi, rax
test rax, rax
jne 0x14005ccae
mov rax, qword [0x1400f12c8]
movzx eax, byte [rax]
mov ecx, 0x10
mov edx, 8
call sym.__rust_alloc
test rax, rax
je 0x14005cd07
mov rdi, rax
lea rax, dbg.destroy_value_u8_
mov qword [rdi], rax
mov byte [rdi + 8], 0
mov ecx, dword [0x1400c00c8]
test ecx, ecx
je 0x14005ccf7
dec ecx
mov rdx, rdi
call fcn.1400bd584
xor ecx, ecx
test rsi, rsi
je 0x14005ccc4
cmp byte [rsi], 0
mov byte [rsi], 0
movzx eax, byte [rsi + 1]
cmove eax, ecx
mov ecx, eax
lea rax, [rdi + 9]
mov byte [rdi + 8], 1
mov byte [rdi + 9], cl
jmp 0x14005ccf0
lea rcx, dbg.destroy_value_u8_
call sym.std::sys::windows::thread_local_key::StaticKey::init::h2de08b4a932e6024
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x14005cc63
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, dbg.destroy_value_u8_
call sym.std::sys::windows::thread_local_key::StaticKey::init::h2de08b4a932e6024
mov ecx, eax
jmp 0x14005cca6
mov ecx, 8
mov edx, 0x10
call dbg.handle_alloc_error
ud2
Function at 0x14005cd20
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
mov ecx, dword [0x1400c00e8]
test ecx, ecx
je 0x14005ce30
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x14005cd52
mov rdi, rax
cmp qword [rax + 8], 0
jne 0x14005ce2a
mov ecx, dword [0x1400c00e8]
test ecx, ecx
je 0x14005ce59
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x14005ce76
mov rdi, rax
test rax, rax
jne 0x14005cddc
mov qword [rsp + 0x28], 0
lea rax, dbg.destroy_value_core::cell::Cell_core::option::Option_std::sync::mpmc::context::Context___
mov qword [rsp + 0x20], rax
mov rax, qword [0x1400f12c8]
movzx eax, byte [rax]
mov ecx, 0x18
mov edx, 8
call sym.__rust_alloc
test rax, rax
je 0x14005ce95
mov rdi, rax
mov rax, qword [rsp + 0x30]
mov qword [rdi + 0x10], rax
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rdi], xmm0
mov ecx, dword [0x1400c00e8]
test ecx, ecx
je 0x14005ce82
dec ecx
mov rdx, rdi
call fcn.1400bd584
test rsi, rsi
je 0x14005ce52
mov rax, qword [rsi + 8]
cmp qword [rsi], 0
mov qword [rsi], 0
je 0x14005ce52
mov rdx, qword [rdi + 8]
mov rcx, qword [rdi + 0x10]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rcx
mov qword [rdi + 8], 1
mov qword [rdi + 0x10], rax
test rdx, rdx
je 0x14005ce2a
test rcx, rcx
je 0x14005ce2a
lock dec qword [rcx]
jne 0x14005ce2a
lea rcx, [rsp + 0x28]
call dbg.drop_slow<std::sync::mpmc::context::Inner, alloc::alloc::Global>
add rdi, 0x10
jmp 0x14005ce78
lea rcx, dbg.destroy_value_core::cell::Cell_core::option::Option_std::sync::mpmc::context::Context___
call sym.std::sys::windows::thread_local_key::StaticKey::init::h2de08b4a932e6024
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x14005cd44
jmp 0x14005cd52
call sym.std::sync::mpmc::context::Context::new::hecdaf09487166125
jmp 0x14005cdf2
lea rcx, dbg.destroy_value_core::cell::Cell_core::option::Option_std::sync::mpmc::context::Context___
call sym.std::sys::windows::thread_local_key::StaticKey::init::h2de08b4a932e6024
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x14005cd71
xor edi, edi
mov rax, rdi
add rsp, 0x38
pop rdi
pop rsi
ret
lea rcx, dbg.destroy_value_core::cell::Cell_core::option::Option_std::sync::mpmc::context::Context___
call sym.std::sys::windows::thread_local_key::StaticKey::init::h2de08b4a932e6024
mov ecx, eax
jmp 0x14005cdd4
mov ecx, 8
mov edx, 0x18
call dbg.handle_alloc_error
ud2
Function at 0x14005cec0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
mov ecx, dword [0x1400c0108]
test ecx, ecx
je 0x14005cfd6
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x14005cef2
mov rdi, rax
cmp qword [rax + 8], 0
jne 0x14005cfd0
mov ecx, dword [0x1400c0108]
test ecx, ecx
je 0x14005cff8
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x14005d015
mov rdi, rax
test rax, rax
jne 0x14005cf7c
mov qword [rsp + 0x28], 0
lea rax, dbg.destroy_value_core::cell::Cell_core::option::Option_alloc::sync::Arc_std::sync::mutex::Mutex_alloc::vec::Vec_u8__alloc::alloc::Global____alloc::alloc::Global____
mov qword [rsp + 0x20], rax
mov rax, qword [0x1400f12c8]
movzx eax, byte [rax]
mov ecx, 0x18
mov edx, 8
call sym.__rust_alloc
test rax, rax
je 0x14005d034
mov rdi, rax
mov rax, qword [rsp + 0x30]
mov qword [rdi + 0x10], rax
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rdi], xmm0
mov ecx, dword [0x1400c0108]
test ecx, ecx
je 0x14005d021
dec ecx
mov rdx, rdi
call fcn.1400bd584
test rsi, rsi
je 0x14005cf96
mov rax, qword [rsi]
mov qword [rsi], 0
test rax, rax
je 0x14005cf98
mov rax, qword [rsi + 8]
jmp 0x14005cf98
xor eax, eax
mov rdx, qword [rdi + 8]
mov rcx, qword [rdi + 0x10]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rcx
mov qword [rdi + 8], 1
mov qword [rdi + 0x10], rax
test rdx, rdx
je 0x14005cfd0
test rcx, rcx
je 0x14005cfd0
lock dec qword [rcx]
jne 0x14005cfd0
lea rcx, [rsp + 0x28]
call dbg.drop_slow<std::sync::mutex::Mutex<alloc::vec::Vec<u8, alloc::alloc::Global>>, alloc::alloc::Global>
add rdi, 0x10
jmp 0x14005d017
lea rcx, dbg.destroy_value_core::cell::Cell_core::option::Option_alloc::sync::Arc_std::sync::mutex::Mutex_alloc::vec::Vec_u8__alloc::alloc::Global____alloc::alloc::Global____
call sym.std::sys::windows::thread_local_key::StaticKey::init::h2de08b4a932e6024
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x14005cee4
jmp 0x14005cef2
lea rcx, dbg.destroy_value_core::cell::Cell_core::option::Option_alloc::sync::Arc_std::sync::mutex::Mutex_alloc::vec::Vec_u8__alloc::alloc::Global____alloc::alloc::Global____
call sym.std::sys::windows::thread_local_key::StaticKey::init::h2de08b4a932e6024
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x14005cf11
xor edi, edi
mov rax, rdi
add rsp, 0x38
pop rdi
pop rsi
ret
lea rcx, dbg.destroy_value_core::cell::Cell_core::option::Option_alloc::sync::Arc_std::sync::mutex::Mutex_alloc::vec::Vec_u8__alloc::alloc::Global____alloc::alloc::Global____
call sym.std::sys::windows::thread_local_key::StaticKey::init::h2de08b4a932e6024
mov ecx, eax
jmp 0x14005cf74
mov ecx, 8
mov edx, 0x18
call dbg.handle_alloc_error
ud2
Function at 0x14005d060
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
mov ecx, dword [0x1400c0128]
test ecx, ecx
je 0x14005d093
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x14005d0ac
mov rcx, rax
cmp qword [rax + 8], 0
je 0x14005d0ac
add rcx, 0x10
jmp 0x14005d1a9
lea rcx, dbg.destroy_value_core::cell::Cell__u64__u64___
call sym.std::sys::windows::thread_local_key::StaticKey::init::h2de08b4a932e6024
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x14005d080
mov ecx, dword [0x1400c0128]
test ecx, ecx
je 0x14005d18a
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x14005d1a7
mov rdi, rax
test rax, rax
jne 0x14005d122
mov rax, qword [0x1400f12c8]
movzx eax, byte [rax]
mov ecx, 0x20
mov edx, 8
call sym.__rust_alloc
test rax, rax
je 0x14005d1c6
mov rdi, rax
lea rax, dbg.destroy_value_core::cell::Cell__u64__u64___
mov qword [rdi], rax
mov qword [rdi + 8], 0
mov ecx, dword [0x1400c0128]
test ecx, ecx
je 0x14005d1b3
dec ecx
mov rdx, rdi
call fcn.1400bd584
test rsi, rsi
je 0x14005d13f
mov rcx, qword [rsi]
mov rax, qword [rsi + 8]
mov rdx, qword [rsi + 0x10]
mov qword [rsi], 0
cmp rcx, 1
je 0x14005d174
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x14005d16f
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
jmp 0x14005d174
call dbg.fallback_rng
mov qword [rdi + 8], 1
lea rcx, [rdi + 0x10]
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x18], rdx
jmp 0x14005d1a9
lea rcx, dbg.destroy_value_core::cell::Cell__u64__u64___
call sym.std::sys::windows::thread_local_key::StaticKey::init::h2de08b4a932e6024
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x14005d0cb
xor ecx, ecx
mov rax, rcx
add rsp, 0x38
pop rdi
pop rsi
ret
lea rcx, dbg.destroy_value_core::cell::Cell__u64__u64___
call sym.std::sys::windows::thread_local_key::StaticKey::init::h2de08b4a932e6024
mov ecx, eax
jmp 0x14005d11a
mov ecx, 8
mov edx, 0x20
call dbg.handle_alloc_error
ud2
Function at 0x1400a4210
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x1400a428a
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x1400a4280
cmp r11, r10
ja 0x1400a4323
cmp r10, rdx
ja 0x1400a4337
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x1400a4282
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x1400a4260
jmp 0x1400a42f7
ja 0x1400a428a
mov r11, r10
cmp rax, r8
jne 0x1400a4232
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x1400a42fb
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x1400a42d0
mov r8, r10
sub ecx, r9d
jns 0x1400a42ee
jmp 0x1400a42fd
cmp r10, rdx
je 0x1400a4309
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x1400a42fd
xor al, 1
cmp r8, rdx
jne 0x1400a42b0
jmp 0x1400a42fd
xor eax, eax
jmp 0x1400a42fd
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, str.called__Option::unwrap____on_a__None__valueassertion_failed:__buf.is_empty__
lea r8, [0x1400e4108]
mov edx, 0x2b
call dbg.panic
ud2
lea r8, [0x1400e4120]
mov rcx, r11
mov rdx, r10
call dbg.slice_index_order_fail
ud2
lea r8, [0x1400e4120]
mov rcx, r10
call dbg.slice_end_index_len_fail
ud2
Function at 0x1400b3390
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xd8
mov r13, rdx
movzx eax, byte [rcx + 0x28]
cmp al, 0x82
jne 0x1400b33b3
jmp 0x1400b34e7
movzx r8d, byte [rcx + 0x40]
cmp r8b, 0x82
je 0x1400b3409
cmp r8b, 0x81
je 0x1400b33f6
cmp r8b, 0x80
je 0x1400b33df
movzx edx, byte [rcx + 0x43]
mov byte [rsp + 0x5a], dl
movzx edx, word [rcx + 0x41]
mov word [rsp + 0x58], dx
mov r9d, dword [rcx + 0x48]
mov r10d, dword [rcx + 0x44]
movzx edx, byte [rsp + 0x5a]
mov byte [rsp + 0x3a], dl
movzx edx, word [rsp + 0x58]
mov word [rsp + 0x38], dx
movzx edx, byte [rsp + 0x3a]
mov byte [rsp + 0x5a], dl
movzx edx, word [rsp + 0x38]
mov word [rsp + 0x58], dx
mov byte [rsp + 0x2f], r8b
movzx edx, byte [rsp + 0x5a]
mov byte [rsp + 0x32], dl
movzx edx, word [rsp + 0x58]
mov word [rsp + 0x30], dx
cmp al, 0x81
je 0x1400b3458
cmp al, 0x80
je 0x1400b343e
movzx edx, byte [rcx + 0x2b]
mov byte [rsp + 0x5a], dl
movzx edx, word [rcx + 0x29]
mov word [rsp + 0x58], dx
mov r8d, dword [rcx + 0x30]
mov edx, dword [rcx + 0x2c]
movzx r11d, byte [rsp + 0x5a]
mov byte [rsp + 0x36], r11b
movzx r11d, word [rsp + 0x58]
mov word [rsp + 0x34], r11w
movzx r11d, byte [rcx + 0x34]
mov byte [rsp + 0x2e], r11b
cmp r11b, 0x81
je 0x1400b34a2
cmp byte [rsp + 0x2e], 0x80
je 0x1400b3488
movzx r11d, byte [rcx + 0x37]
mov byte [rsp + 0x5a], r11b
movzx r11d, word [rcx + 0x35]
mov word [rsp + 0x58], r11w
mov r14d, dword [rcx + 0x3c]
mov edi, dword [rcx + 0x38]
movzx r11d, byte [rsp + 0x5a]
mov byte [rsp + 0x3a], r11b
movzx r11d, word [rsp + 0x58]
mov word [rsp + 0x38], r11w
movzx r11d, byte [rsp + 0x32]
mov byte [rsp + 0x4a], r11b
movzx r11d, word [rsp + 0x30]
mov word [rsp + 0x48], r11w
movzx r11d, word [rsp + 0x34]
mov word [rsp + 0x50], r11w
movzx r11d, byte [rsp + 0x36]
mov byte [rsp + 0x52], r11b
movzx r11d, word [rsp + 0x38]
mov word [rsp + 0x4c], r11w
movzx r11d, byte [rsp + 0x3a]
mov byte [rsp + 0x4e], r11b
movzx ebx, byte [rcx + 0x1c]
cmp bl, 0x82
mov dword [rsp + 0xbc], edi
mov qword [rsp + 0xd0], r14
jne 0x1400b3504
jmp 0x1400b35b9
movzx ebp, byte [rcx + 0x10]
cmp bpl, 0x81
je 0x1400b354f
cmp bpl, 0x80
je 0x1400b352c
movzx r11d, byte [rcx + 0x13]
mov byte [rsp + 0x5a], r11b
movzx r11d, word [rcx + 0x11]
mov word [rsp + 0x58], r11w
mov esi, dword [rcx + 0x18]
mov r11d, dword [rcx + 0x14]
mov dword [rsp + 0xb8], r11d
movzx r11d, byte [rsp + 0x5a]
Function at 0x1400be370
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop dword [rax]

Function at 0x1400be3e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x140103294]
test esi, esi
mov rdi, rcx
mov rbp, rdx
mov rbx, r8
jle 0x1400be570
mov rax, qword [0x140103298]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rdi, rdx
jb 0x1400be42c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rdi, rdx
jb 0x1400be4b5
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x1400be410
mov rcx, rdi
call sym.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x1400be5c2
mov rax, qword [0x140103298]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call sym._GetPEImageBase
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x140103298]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400be5a5
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x1400be4ae
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x1400be520
add dword [0x140103294], 1
cmp ebx, 8
jae 0x1400be4e1
test bl, 4
jne 0x1400be580
test ebx, ebx
je 0x1400be4d6
movzx eax, byte [rbp]
test bl, 2
mov byte [rdi], al
jne 0x1400be594
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, ebx
sub ebx, 1
mov rdx, qword [rbp + rax - 8]
cmp ebx, 8
mov qword [rdi + rax - 8], rdx
jb 0x1400be4d6
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, ebx
mov qword [rdi + rdx], rcx
jb 0x1400be4fa
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp eax, 2
mov r8d, 4
mov eax, 0x40
mov rcx, qword [rsp + 0x20]
cmovne r8d, eax
mov rdx, qword [rsp + 0x38]
add rsi, qword [0x140103298]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400be4ae
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
xor esi, esi
jmp 0x1400be437
mov eax, dword [rbp]
mov ebx, ebx
mov dword [rdi], eax
mov eax, dword [rbp + rbx - 4]
mov dword [rdi + rbx - 4], eax
jmp 0x1400be4d6
mov ebx, ebx
movzx eax, word [rbp + rbx - 2]
mov word [rdi + rbx - 2], ax
jmp 0x1400be4d6
mov rax, qword [0x140103298]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rdi
call sym.__report_error
nop
nop dword [rax]
nop word cs:[rax + rax]
Function at 0x1400beb90
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x140103300]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1401032e0]
test rbx, rbx
je 0x1400bebe4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x1400bebdb
test rsi, rsi
je 0x1400bebdb
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1400bebc0
lea rcx, [0x140103300]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x1400bee30
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
jne 0x1400bee40
jmp sym._ValidateImageBase.part.0
xor eax, eax
ret

Function at 0x1400bee50
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x1400bee91
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x1400bee88
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x1400bee93
add rax, 0x28
cmp rax, r9
jne 0x1400bee74
xor eax, eax
ret

Function at 0x1400bef40
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x1400f1200]
xor edx, edx
cmp word [r9], 0x5a4d
mov r8, rcx
jne 0x1400befaf
mov rcx, r9
call sym._ValidateImageBase.part.0
test eax, eax
je 0x1400befaf
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add r9, rax
movzx eax, word [r9 + 0x14]
lea rdx, [r9 + rax + 0x18]
movzx eax, word [r9 + 6]
test eax, eax
je 0x1400befad
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x1400befa4
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x1400befaf
add rdx, 0x28
cmp rdx, r9
jne 0x1400bef90
xor edx, edx
mov rax, rdx
add rsp, 0x28
ret

Function at 0x1400bf0b0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x1400f1200]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x1400bf11f
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x1400bf11f
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x1400bf11d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x1400bf114
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400bf124
add rax, 0x28
cmp rax, r9
jne 0x1400bf100
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret
Function at 0x1400bf140
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x1400f1200]
xor r9d, r9d
cmp word [r11], 0x5a4d
mov r8d, ecx
jne 0x1400bf1b3
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x1400bf1b3
movsxd rcx, dword [r11 + 0x3c]
add rcx, r11
mov eax, dword [rcx + 0x90]
test eax, eax
je 0x1400bf1b3
movzx edx, word [rcx + 0x14]
lea rdx, [rcx + rdx + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x1400bf1b3
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r10, [rdx + rcx*8 + 0x28]
mov r9d, dword [rdx + 0xc]
cmp rax, r9
mov rcx, r9
jb 0x1400bf1a7
add ecx, dword [rdx + 8]
cmp rax, rcx
jb 0x1400bf1c0
add rdx, 0x28
cmp rdx, r10
jne 0x1400bf193
xor r9d, r9d
mov rax, r9
add rsp, 0x28
ret
add rax, r11
jne 0x1400bf1d8
jmp 0x1400bf1b0
sub r8d, 1
add rax, 0x14
mov ecx, dword [rax + 4]
test ecx, ecx
jne 0x1400bf1e6
mov edx, dword [rax + 0xc]
test edx, edx
je 0x1400bf1b0
test r8d, r8d
jg 0x1400bf1d0
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
add rsp, 0x28
ret
Function at 0x140016870
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
sub rsp, 0xb8
cmp byte [0x14004bacb], 0
xorps xmm0, xmm0
mov eax, dword [0x14004bac8]
movups xmmword [rsp + 0x48], xmm0
mov dword [rsp + 0x40], eax
movups xmmword [rsp + 0x58], xmm0
movups xmmword [rsp + 0x68], xmm0
movups xmm0, xmmword [0x14004bab8]
movups xmmword [rsp + 0x30], xmm0
je 0x140016a6d
xor ecx, ecx
cmp dword [0x14005e018], 2
jl 0x140016a2b
movdqa xmm0, xmmword [0x140057960]
lea rdx, [rsp + 0x34]
movdqa xmm5, xmmword [0x1400578d0]
mov eax, 4
movdqa xmm4, xmmword [0x1400579a0]
movaps xmmword [r11 - 0x18], xmm6
movaps xmmword [r11 - 0x28], xmm7
movdqa xmm7, xmmword [0x140057900]
movd xmm6, eax
mov eax, 0x1f
movdqa xmmword [rsp + 0x20], xmm0
mov r8d, dword [rsp + 0x20]
movaps xmmword [r11 - 0x38], xmm8
movd xmm8, eax
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x140057940]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140057940]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x10
jl 0x140016910
movaps xmm8, xmmword [rsp + 0x80]
movaps xmm7, xmmword [rsp + 0x90]
movaps xmm6, xmmword [rsp + 0xa0]
cmp ecx, 0x14
jge 0x140016a6d
movsxd rax, ecx
lea r8, [rsp + 0x30]
add r8, rax
nop word [rax + rax]
mov eax, 0x4d4873ed
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x35
movzx eax, cl
inc ecx
sub al, dl
add al, 0x33
xor byte [r8 - 1], al
cmp ecx, 0x14
jl 0x140016a40
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x30]
call fcn.14001a0f0
add rsp, 0xb8
ret