joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140012dd0
Capabilities:
Find process by pid

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov dword [rsp + 0x20], 0
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
call fcn.1400121a0
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x140012e0a
mov eax, 0xc0000001
jmp 0x140012ed1
call fcn.1400131c0
mov dword [rsp + 0x24], eax
call fcn.140013260
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x24], 0xc0000001
je 0x140012e30
cmp dword [rsp + 0x28], 0xc0000001
jne 0x140012e3a
mov eax, 0xc0000001
jmp 0x140012ed1
mov ecx, 4
call fcn.14000a290
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jge 0x140012e63
mov eax, dword [rsp + 0x20]
jmp 0x140012ed1
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ExAcquirePushLockExclusiveEx]
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.1400119e0
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ExReleasePushLockExclusiveEx]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov qword [rsp + 0x38], 0
mov eax, dword [rsp + 0x20]
add rsp, 0x58
ret
Function at 0x140012ee0
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x30], 0
call fcn.140013260
mov dword [rsp + 0x28], eax
call fcn.1400134d0
mov dword [rsp + 0x2c], eax
cmp dword [rsp + 0x2c], 0xc0000001
je 0x140012f25
cmp dword [rsp + 0x28], 0xc0000001
jne 0x140012f2f
mov eax, 0xc0000225
jmp 0x14001302f
mov rax, qword [rsp + 0x68]
mov ecx, dword [rax]
call fcn.14000a290
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jge 0x140012fc1
cmp dword [rsp + 0x20], 0xc0000225
je 0x140012f67
mov eax, dword [rsp + 0x20]
jmp 0x14001302f
mov dword [rsp + 0x24], 0
lea r8, [rsp + 0x24]
lea rdx, [0x14001a170]
mov rcx, qword [rsp + 0x60]
call fcn.140011ed0
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jge 0x140012f99
mov eax, dword [rsp + 0x20]
jmp 0x14001302f
mov ecx, dword [rsp + 0x24]
call fcn.14000a290
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jge 0x140012fc1
mov eax, dword [rsp + 0x20]
jmp 0x14001302f
mov eax, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ExAcquirePushLockExclusiveEx]
mov eax, dword [rsp + 0x2c]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x68]
mov rdx, qword [rax + 8]
mov rcx, qword [rsp + 0x40]
call fcn.14000a0a0
jmp 0x140013013
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ExReleasePushLockExclusiveEx]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, dword [rsp + 0x20]
add rsp, 0x58
ret
Function at 0x140013040
Capabilities:
Find process by pid

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x30], 0
mov r8d, dword [rsp + 0x78]
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x70]
call fcn.1400122d0
cmp dword [rsp + 0x4c], 0
jne 0x140013083
mov eax, 0xc0000225
jmp 0x1400131ac
call fcn.140013260
mov dword [rsp + 0x28], eax
call fcn.1400134d0
mov dword [rsp + 0x2c], eax
cmp dword [rsp + 0x2c], 0xc0000001
je 0x1400130a9
cmp dword [rsp + 0x28], 0xc0000001
jne 0x1400130b3
mov eax, 0xc0000225
jmp 0x1400131ac
mov ecx, dword [rsp + 0x48]
call fcn.14000a290
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jge 0x140013142
cmp dword [rsp + 0x20], 0xc0000225
je 0x1400130e8
mov eax, dword [rsp + 0x20]
jmp 0x1400131ac
mov dword [rsp + 0x24], 0
lea r8, [rsp + 0x24]
lea rdx, [0x14001a170]
mov rcx, qword [rsp + 0x70]
call fcn.140011ed0
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jge 0x14001311a
mov eax, dword [rsp + 0x20]
jmp 0x1400131ac
mov ecx, dword [rsp + 0x24]
call fcn.14000a290
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jge 0x140013142
mov eax, dword [rsp + 0x20]
jmp 0x1400131ac
mov eax, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ExAcquirePushLockExclusiveEx]
mov eax, dword [rsp + 0x2c]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
call fcn.14000a0a0
jmp 0x140013190
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ExReleasePushLockExclusiveEx]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, dword [rsp + 0x20]
add rsp, 0x68
ret
Function at 0x140004160
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r15, r9
mov r14, rdx
movzx eax, byte [r8]
movabs rdx, 0xcbf29ce484222325
xor rdx, rax
movabs rax, 0x100000001b3
imul rdx, rax
movzx ebx, byte [r8 + 1]
xor rbx, rdx
imul rbx, rax
movzx edx, byte [r8 + 2]
xor rdx, rbx
imul rdx, rax
movzx ebx, byte [r8 + 3]
xor rbx, rdx
imul rbx, rax
and rbx, qword [rcx + 0x30]
mov rdi, qword [rcx + 8]
mov rsi, qword [rcx + 0x18]
lea r9, [rbx + rbx]
shl rbx, 4
mov rdx, qword [rsi + rbx]
mov rbx, rdi
cmp rdx, rdi
je 0x1400041e7
lea rax, [r9*8]
or rax, 8
mov rax, qword [rsi + rax]
mov rbx, qword [rax]
mov eax, dword [r8]
nop word [rax + rax]
cmp rdx, rbx
je 0x140004227
mov rbx, qword [rbx + 8]
cmp eax, dword [rbx + 0x10]
jne 0x1400041f0
mov rax, qword [r15]
mov rdx, qword [r15 + 8]
mov qword [rdx], rax
mov rax, qword [r15]
mov rdx, qword [r15 + 8]
mov qword [rax + 8], rdx
add qword [rcx + 0x10], 0xffffffffffffffff
mov rcx, r15
call fcn.140003550
xor eax, eax
mov r15, rbx
jmp 0x140004290
mov rbx, qword [r15]
cmp rbx, rdx
je 0x140004264
mov rax, qword [r15 + 8]
mov qword [rax], rbx
mov rax, qword [rbx + 8]
mov qword [rax], rdx
mov rax, qword [rdx + 8]
mov qword [rax], r15
mov rax, qword [rdx + 8]
mov rdi, qword [rbx + 8]
mov qword [rdx + 8], rdi
mov rdi, qword [r15 + 8]
mov qword [rbx + 8], rdi
mov qword [r15 + 8], rax
mov rdi, qword [rcx + 8]
mov rsi, qword [rcx + 0x18]
lea rbx, [rsi + r9*8]
mov rax, qword [rsi + r9*8]
cmp rax, rdi
jne 0x1400042a6
mov qword [rbx], r15
shl r9, 3
or r9, 8
add r9, qword [rcx + 0x18]
mov rbx, r9
mov rdi, r15
mov qword [rbx], rdi
int3
mov qword [r14], r15
mov byte [r14 + 8], al
mov rax, r14
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rdi, r15
cmp rax, rdx
je 0x140004286
or r9, 1
mov rax, qword [rsi + r9*8]
mov rax, qword [rax]
mov qword [rsi + r9*8], rax
cmp rax, r15
je 0x140004289
mov rax, qword [rcx + 0x18]
lea rbx, [rax + r9*8]
mov rax, qword [rax + r9*8]
mov rdi, qword [rax + 8]
jmp 0x140004286
Function at 0x140005200
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
mov rax, rdx
movzx edx, byte [r8]
movabs rdi, 0xcbf29ce484222325
xor rdi, rdx
movabs rdx, 0x100000001b3
imul rdi, rdx
movzx esi, byte [r8 + 1]
xor rsi, rdi
imul rsi, rdx
movzx edi, byte [r8 + 2]
xor rdi, rsi
imul rdi, rdx
movzx esi, byte [r8 + 3]
xor rsi, rdi
imul rsi, rdx
and rsi, qword [rcx + 0x30]
mov r11, qword [rcx + 8]
mov r9, qword [rcx + 0x18]
lea r10, [rsi + rsi]
add r10, 1
shl rsi, 4
mov rdx, qword [r9 + rsi]
mov r8d, dword [r8]
mov rcx, rdx
nop word [rax + rax]
mov rsi, rdx
cmp rdx, r11
je 0x14000527f
mov rsi, qword [r9 + r10*8]
mov rsi, qword [rsi]
cmp rsi, rcx
je 0x1400052c4
cmp dword [rcx + 0x10], r8d
je 0x14000528f
mov rcx, qword [rcx]
jmp 0x140005270
mov rsi, rcx
nop word cs:[rax + rax]
nop dword [rax]
mov rdi, rdx
cmp rdx, r11
je 0x1400052af
mov rdi, qword [r9 + r10*8]
mov rdi, qword [rdi]
cmp rdi, rsi
je 0x1400052bf
cmp r8d, dword [rsi + 0x10]
jne 0x1400052bf
mov rsi, qword [rsi]
jmp 0x1400052a0
cmp rcx, rsi
jne 0x1400052ca
mov rcx, r11
mov rsi, r11
mov qword [rax], rcx
mov qword [rax + 8], rsi
pop rdi
pop rsi
ret

Function at 0x140006590
Capabilities:
Encode data using xor

Disassembly:
push rsi
xor eax, eax
test rcx, rcx
je 0x140001515
test edx, edx
jle 0x140001515
mov r8d, edx
and r8d, 3
mov r11d, edx
shr r11d, 2
je 0x140001496
lea r10d, [r11 - 1]
test dl, 4
jne 0x140001419
mov r9d, r11d
mov rsi, rcx
jmp 0x140001441
movzx r9d, word [rcx]
add r9d, edx
movzx eax, word [rcx + 2]
shl eax, 0xb
xor eax, r9d
shl r9d, 0x10
xor r9d, eax
lea rsi, [rcx + 4]
mov edx, r9d
shr edx, 0xb
add edx, r9d
mov r9d, r10d
lea r10, [r10*4]
cmp r11d, 1
je 0x14000148f
nop
movzx eax, word [rsi]
add eax, edx
movzx edx, word [rsi + 2]
shl edx, 0xb
xor edx, eax
shl eax, 0x10
xor eax, edx
mov edx, eax
shr edx, 0xb
add edx, eax
movzx eax, word [rsi + 4]
add eax, edx
movzx edx, word [rsi + 6]
shl edx, 0xb
xor edx, eax
shl eax, 0x10
xor eax, edx
mov edx, eax
shr edx, 0xb
add edx, eax
add rsi, 8
add r9d, 0xfffffffe
jg 0x140001450
add rcx, r10
add rcx, 4
cmp r8d, 1
je 0x1400014c4
cmp r8d, 2
je 0x1400014d6
cmp r8d, 3
jne 0x1400014e9
movzx eax, word [rcx]
add edx, eax
movsx eax, byte [rcx + 2]
shl eax, 0x12
xor eax, edx
mov ecx, edx
shl ecx, 0x10
xor eax, ecx
mov edx, eax
shr edx, 0xb
jmp 0x1400014e7
movsx eax, byte [rcx]
add edx, eax
mov eax, edx
shl eax, 0xa
xor eax, edx
mov edx, eax
shr edx, 1
jmp 0x1400014e7
movzx eax, word [rcx]
add edx, eax
mov eax, edx
shl eax, 0xb
xor eax, edx
mov edx, eax
shr edx, 0x11
add edx, eax
lea eax, [rdx*8]
xor eax, edx
mov ecx, eax
shr ecx, 5
add ecx, eax
mov eax, ecx
shl eax, 4
xor eax, ecx
mov ecx, eax
shr ecx, 0x11
add ecx, eax
mov edx, ecx
shl edx, 0x19
xor edx, ecx
mov eax, edx
shr eax, 6
add eax, edx
pop rsi
ret
cmp rdx, 0x7fffffff
jbe 0x14000659c
xor eax, eax
ret
jmp 0x1400013e0
Function at 0x140006820
Capabilities:
Read file via mapping

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rbx, r8
mov r15d, edx
mov rsi, rcx
mov rax, qword [0x14003f010]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rdi, [rcx + 0x28]
mov rcx, rdi
call fcn.140006700
xor ebp, ebp
cmp rbx, 0x7fffffff
ja 0x140006868
test al, al
je 0x140006868
cmp qword [rsi + 0x58], 0
je 0x140006884
xor ebp, ebp
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400365a0
mov eax, ebp
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
cmp byte [rsi], 0
je 0x14000690d
mov rcx, rdi
call fcn.140006710
mov r14, rax
mov rbp, qword [0x14003f2b0]
test rbp, rbp
jne 0x1400068cb
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtQuerySection
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbp, rax
mov qword [0x14003f2b0], rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x30]
mov rcx, r14
xor edx, edx
mov r9d, 0x18
call rbp
test eax, eax
jne 0x140006866
test dword [rsp + 0x38], 0x1000000
jne 0x140006866
mov r14d, r15d
sar r14d, 0x1f
xor eax, eax
cmp byte [rsi + 0x60], 0
sete al
lea ebp, [rax + rax]
add ebp, 4
mov rcx, rdi
call fcn.140006710
mov qword [rsp + 0x20], rbx
mov rcx, rax
mov edx, ebp
mov r8d, r14d
mov r9d, r15d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsi + 0x58], rax
test rax, rax
jne 0x140006984
xor eax, eax
cmp byte [rsi + 0x60], 0
sete al
lea ebp, [rax + rax]
add ebp, 4
mov rcx, rdi
call fcn.140006710
mov qword [rsp + 0x20], rbx
mov rcx, rax
mov edx, ebp
mov r8d, r14d
mov r9d, r15d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsi + 0x58], rax
test rax, rax
je 0x140006866
mov rbp, rax
lea rdx, [rsp + 0x30]
mov r8d, 0x30
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x1400069a4
xor eax, eax
jmp 0x1400069b1
mov rax, qword [rsp + 0x48]
sub rax, rbp
add rax, qword [rsp + 0x38]
mov qword [rsi + 0x50], rax
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1400066a0
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rsi + 0x70], xmm0
int3

Function at 0x140006b40
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x140
mov rax, qword [0x14003f010]
xor rax, rsp
mov qword [rsp + 0x138], rax
test rdx, rdx
je 0x140006bd0
mov rsi, rdx
mov rdi, rcx
mov r13d, 0xffffffff
lea r14, str.z:_task_1579288126_build_src_security_sandbox_chromium_base_rand_util_win.cc
lea r15, str.success
lea r12, [rsp + 0x28]
jmp 0x140006b98
add rdi, rbx
sub rsi, rbx
je 0x140006bd0
cmp rsi, r13
mov ebx, 0xffffffff
cmovb rbx, rsi
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x140006b90
mov rcx, r12
mov rdx, r14
mov r8d, 0x20
mov r9, r15
call fcn.1400016f0
mov rcx, r12
call fcn.1400017f0
jmp 0x140006b90
mov rcx, qword [rsp + 0x138]
xor rcx, rsp
call fcn.1400365a0
nop
add rsp, 0x140
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14000b350
Capabilities:
Get thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x148
mov r14, rdx
mov rsi, rcx
mov rax, qword [0x14003f010]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov ecx, dword [0x14003f038]
cmp ecx, 0xffffffff
je 0x14000b38a
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x14000b38f
call fcn.14000b570
mov eax, dword [0x140040b08]
mov ecx, dword [0x14003f180]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000b467
mov rbx, qword [0x140040b00]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov rcx, qword [0x14003f2f0]
add rcx, 1
mov r8d, 0x100
lea rax, [0x14003f300]
movzx edi, cl
lea rdx, [rdi + rdi*2]
cmp dword [rax + rdx*8], 0
jne 0x14000b4ad
lea rcx, [rax + rdx*8]
mov dword [rcx], 1
lea rcx, [rdi + rdi*2]
mov qword [rax + rcx*8 + 8], r14
mov qword [0x14003f2f0], rdi
mov dword [rsi], edi
mov eax, dword [rax + rcx*8 + 0x10]
mov dword [rsi + 4], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [rsi]
mov dword [rsp + 0x30], 0xffffffff
mov dword [rsp + 0x2c], eax
cmp eax, 0xffffffff
je 0x14000b4d4
mov eax, dword [rsi]
mov dword [rsp + 0x30], 0x100
mov dword [rsp + 0x2c], eax
cmp eax, 0xff
jg 0x14000b51d
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400365a0
nop
add rsp, 0x148
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x140040b08]
int3
lea edx, [rcx + 1]
movzx edi, dl
lea rdx, [rdi + rdi*2]
cmp dword [rax + rdx*8], 0
je 0x14000b3ed
add rcx, 2
add r8, 0xfffffffffffffffe
jne 0x14000b3dc
jmp 0x14000b410
lea r8, str.slot____kInvalidSlotValue
lea rcx, [rsp + 0x2c]
lea rdx, [rsp + 0x30]
call fcn.140001a30
test rax, rax
je 0x14000b430
lea rdx, str.z:_task_1579288126_build_src_security_sandbox_chromium_base_threading_thread_local_storage.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x159
mov r9, rax
call fcn.140001740
mov rcx, rdi
call fcn.1400017f0
jmp 0x14000b430
lea r8, str.slot____kThreadLocalStorageSize
lea rcx, [rsp + 0x2c]
lea rdx, [rsp + 0x30]
call fcn.140001a30
test rax, rax
je 0x14000b449
lea rdx, str.z:_task_1579288126_build_src_security_sandbox_chromium_base_threading_thread_local_storage.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x15a
mov r9, rax
call fcn.140001740
mov rcx, rsi
call fcn.1400017f0
jmp 0x14000b449

Function at 0x14000b710
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x14003f038]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14000b73f
movsxd rcx, dword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 4]
jne 0x14000b73f
mov rax, qword [rax + rcx]
jmp 0x14000b741
xor eax, eax
add rsp, 0x20
pop rsi
ret
Function at 0x14000b750
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x14003f038]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14000b78d
movsxd rcx, dword [rsi]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rsi + 4]
movsxd rdx, dword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
test rdi, rdi
je 0x14000b786
call fcn.14000b570
jmp 0x14000b76d

Function at 0x14000c1e0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [rcx + 8]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x14000c217
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14000c217
movzx edx, word [rax + rcx + 0x14]
cmp edx, 0xf0
jne 0x14000c217
movzx eax, word [rax + rcx + 0x18]
cmp eax, 0x20b
sete al
ret
xor eax, eax
ret
Function at 0x140035bdd
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x140035bfb
je 0x140035c06
call 0x140035c55
mov bl, 0xc7
lahf
pop rsi
jne 0x140035be6
call 0x140035bfe
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x140035be6
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x140035c34
je 0x140035c72
invalid
je 0x140035c83
jne 0x140035be6
lea rax, [0x140035b0c]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x14003186d]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x140035d24
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x140035d7d
je 0x140035d83
call 0x140035d74
fild qword [rdi - 0x7c]
jmp 0x174f724f6
jne 0x140035d46
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x140035d06
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret
Function at 0x140035be0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x140035bfb
je 0x140035c06
call 0x140035c55
mov bl, 0xc7
lahf
pop rsi
jne 0x140035be6
call 0x140035bfe
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x140035be6
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x140035c34
je 0x140035c72
invalid
je 0x140035c83
jne 0x140035be6
lea rax, [0x140035b0c]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x14003186d]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x140035d24
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x140035d7d
je 0x140035d83
call 0x140035d74
fild qword [rdi - 0x7c]
jmp 0x174f724f6
jne 0x140035d46
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x140035d06
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret
Function at 0x140035bf0
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x140035bfb
je 0x140035c06
call 0x140035c55
mov bl, 0xc7
lahf
pop rsi
jne 0x140035be6
call 0x140035bfe
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x140035be6
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x140035c34
je 0x140035c72
invalid
je 0x140035c83
jne 0x140035be6
lea rax, [0x140035b0c]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x14003186d]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x140035d24
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x140035d7d
je 0x140035d83
call 0x140035d74
fild qword [rdi - 0x7c]
jmp 0x174f724f6
jne 0x140035d46
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x140035d06
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret