joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2fc4d5d80
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4d6782
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4fb108]
test eax, eax
je 0x2fc4d681a
lea rax, [0x2fc4fb0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4fb110]
mov qword [rbp - 8], rax
jmp 0x2fc4d67fe
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d67f2
cmp qword [rbp - 0x10], 0
je 0x2fc4d67f2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d67b8
lea rax, [0x2fc4fb0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d681b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d6920
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d6948
mov eax, 0
jmp 0x2fc4d6996
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d6971
mov eax, 0
jmp 0x2fc4d6996
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d6991
mov eax, 0
jmp 0x2fc4d6996
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d9ff0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4da9f2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4ff108]
test eax, eax
je 0x2fc4daa8a
lea rax, [0x2fc4ff0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4ff110]
mov qword [rbp - 8], rax
jmp 0x2fc4daa6e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4daa62
cmp qword [rbp - 0x10], 0
je 0x2fc4daa62
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4daa28
lea rax, [0x2fc4ff0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4daa8b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4dab90
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4dabb8
mov eax, 0
jmp 0x2fc4dac06
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4dabe1
mov eax, 0
jmp 0x2fc4dac06
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4dac01
mov eax, 0
jmp 0x2fc4dac06
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4dac0c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4dac8a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4dac81
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4dac81
mov rax, qword [rbp - 8]
jmp 0x2fc4dac9f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4dac54
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d9330
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4d9d32
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4fe108]
test eax, eax
je 0x2fc4d9dca
lea rax, [0x2fc4fe0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4fe110]
mov qword [rbp - 8], rax
jmp 0x2fc4d9dae
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d9da2
cmp qword [rbp - 0x10], 0
je 0x2fc4d9da2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d9d68
lea rax, [0x2fc4fe0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d9dcb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d9ed0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d9ef8
mov eax, 0
jmp 0x2fc4d9f46
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d9f21
mov eax, 0
jmp 0x2fc4d9f46
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d9f41
mov eax, 0
jmp 0x2fc4d9f46
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d9f4c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d9fca
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d9fc1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d9fc1
mov rax, qword [rbp - 8]
jmp 0x2fc4d9fdf
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d9f94
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140003010
Capabilities:
Get thread local storage value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x30
mov r14, rdx
mov r13, rcx
mov rax, qword [0x1400ff028]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov byte [rcx], 1
mov qword [rcx + 8], 0
mov byte [rcx + 0x10], 0
mov eax, dword [0x140108668]
mov ecx, dword [0x1401025d8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400031c1
mov ecx, dword [0x140102430]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140003144
movsxd rcx, dword [0x140108660]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x140108664]
jne 0x140003144
mov rdi, qword [rax + rcx]
test rdi, rdi
je 0x140003144
movabs r12, 0x6000000000000000
movabs r15, 0xffffffffffffff
mov rax, qword [rdi]
mov rbx, rax
and rbx, r15
and rax, r12
movabs rcx, 0x4000000000000000
cmp rax, rcx
jne 0x14000310a
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1400030f7
mov rsi, qword [rdi]
call qword [rcx + VariantCopy]
movabs rcx, 0xff00000000000000
and rcx, rsi
or rcx, rax
mov qword [rdi], rcx
movabs rax, 0xbfffffffffffffff
lock and qword [rdi], rax
mov byte [r13 + 0x10], 1
movabs rsi, 0x8000000000000001
mov qword [r13 + 8], rbx
lea rbx, [rsp + 0x20]
mov rcx, rbx
call qword [fcn.140047d70]
mov rax, qword [rbx]
lea rcx, [r14 + rsi]
cmp rcx, 2
jae 0x14000314b
add rsi, rax
cmp rsi, 1
ja 0x14000316d
cmp rax, r14
je 0x14000316d
int3
mov byte [r13], 0
jmp 0x1400031a1
xor ecx, ecx
mov rdx, rax
add rdx, r14
setns cl
movabs rdx, 0x7fffffffffffffff
add rdx, rcx
add rax, r14
cmovo rax, rdx
mov r14, rax
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14000318f
mov rsi, qword [rdi]
call qword [rcx + VariantCopy]
movabs rcx, 0xff00000000000000
and rcx, rsi
or rcx, rax
mov qword [rdi], rcx
mov rax, qword [rdi]
and rax, r12
and r14, r15
or r14, rax
mov qword [rdi], r14
inc dword [rdi + 0x14]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140069b80
mov rax, r13
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x140108668]
int3
Function at 0x140005610
Capabilities:
Get thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov r14, r8
mov ebp, edx
mov rsi, rcx
mov ebx, dword [0x1401085a4]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test edi, edi
jne 0x1400056f5
cmp rbx, 1
je 0x140005653
mov eax, dword [rsi + 0x1518]
test eax, eax
je 0x14000565a
xor eax, eax
jmp 0x1400056ea
mov eax, 1
lock xadd dword [rsi + 0x1518], eax
cmp eax, 0x7fffffff
je 0x140005741
mov rcx, rsi
int3
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140005643
int3

Function at 0x140005d40
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
xor eax, eax
test r8d, r8d
sete al
xor ebx, ebx
test edx, edx
sete bl
xor ecx, ecx
mov edx, ebx
mov r8d, eax
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi], 0
test rax, rax
je 0x140005dfc
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140005dc9
lea rax, [rdi + 1]
cmp rax, 2
jb 0x140005da4
mov qword [rsi], rdi
call fcn.140035e50
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsi]
mov byte [rsi + 8], 1
inc rax
cmp rax, 1
jbe 0x140005e00
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.140035e50
mov r14, qword [rsi]
mov rcx, qword [0x140106b30]
test rcx, rcx
je 0x140005dee
mov rax, qword [rcx]
mov rdx, r14
call qword [rax]
mov qword [rsi], 0
jmp 0x140005d92
int3
mov byte [rsi + 8], 1
int3
Function at 0x140006dd0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, qword [0x140108508]
cmp rsi, 1
jbe 0x140006e15
mov ecx, dword [0x140102430]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140006e67
movsxd rcx, dword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 4]
jne 0x140006e67
mov rax, qword [rax + rcx]
test rax, rax
je 0x140006e67
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x140108508]
int3
int3
Function at 0x14002b840
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x138
movapd xmmword [rsp + 0x120], xmm10
movapd xmmword [rsp + 0x110], xmm9
movaps xmmword [rsp + 0x100], xmm8
movaps xmmword [rsp + 0xf0], xmm7
movaps xmmword [rsp + 0xe0], xmm6
mov rsi, rcx
mov rax, qword [0x1400ff028]
xor rax, rsp
mov qword [rsp + 0xd8], rax
movabs r13, 0xaaaaaaaaaaaaaaaa
test byte [0x140100f70], 0x19
jne 0x14002c02c
mov rcx, qword [rsi + 0x60]
test rcx, rcx
jne 0x14002c4b6
mov rcx, qword [rsi + 0x48]
mov rdx, rsi
int3
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, eax
mov qword [rsp + 0x90], r13
mov rax, qword [0x140102428]
lea r14, [0x140027b30]
cmp rax, r14
jne 0x14002c3c1
lea rbx, [rsp + 0xb0]
mov qword [rbx], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbx]
movabs rcx, 0x8637bd05af7
cmp rax, rcx
jge 0x14002c171
imul rax, rax, 0xf4240
cqo
idiv qword [0x1401051e8]
jmp 0x14002c193
mov rcx, qword [0x1401051e8]
cqo
idiv rcx
imul rbp, rax, 0xf4240
imul rax, rdx, 0xf4240
cqo
idiv rcx
add rax, rbp
mov qword [rsp + 0x90], rax
lea rbp, [rsp + 0x90]
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], edi
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x48], 8
mov qword [rsp + 0x40], 0
lea rdx, [0x140100f70]
lea r8, str.WorkerThread_born
mov cl, 0x49
xor r9d, r9d
call fcn.14002edd0
test byte [0x140100f70], 0x19
je 0x14002b8ac
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, eax
mov qword [rsp + 0x90], r13
mov rax, qword [0x140102428]
cmp rax, r14
jne 0x14002c3d0
lea rbx, [rsp + 0xb0]
mov qword [rbx], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbx]
movabs rcx, 0x8637bd05af7
cmp rax, rcx
jge 0x14002c246
imul rax, rax, 0xf4240
cqo
idiv qword [0x1401051e8]
jmp 0x14002c268
mov rcx, qword [0x1401051e8]
cqo
idiv rcx
imul rbx, rax, 0xf4240
imul rax, rdx, 0xf4240
cqo
idiv rcx
add rax, rbx
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], edi
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
lea rdx, [0x140100f70]
lea r8, str.WorkerThread_active
mov cl, 0x42
xor r9d, r9d
call fcn.14002edd0
jmp 0x14002b8ac
lea rcx, [rsp + 0x90]
call rax
jmp 0x14002c19b
lea rcx, [rsp + 0x90]
call rax
jmp 0x14002c270
mov rax, qword [rcx]
call qword [rax + VariantCopy]
jmp 0x14002b8b9
Function at 0x140036880
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdi, qword [0x140108578]
cmp rdi, 1
jbe 0x1400368dd
mov ecx, dword [0x140102430]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400368c6
movsxd rcx, dword [rdi]
shl rcx, 4
mov qword [rax + rcx], 0
mov ecx, dword [rdi + 4]
movsxd rdx, dword [rdi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rcx, qword [rsi]
test rcx, rcx
je 0x1400368d5
lock sub dword [rcx + 8], 1
je 0x140036932
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x140108578]
int3
add rcx, 8
add rcx, 0xfffffffffffffff8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.140036950

Function at 0x140036d20
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov qword [rcx], rdx
test rdx, rdx
je 0x140036d36
lock inc dword [rdx + 8]
mov qword [rsi + 8], rdx
mov rdi, qword [0x140108578]
cmp rdi, 1
jbe 0x140036dc5
lea rbx, [rsi + 8]
mov ecx, dword [0x140102430]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140036e5b
movsxd rcx, dword [rdi]
shl rcx, 4
mov qword [rax + rcx], rbx
mov ecx, dword [rdi + 4]
movsxd rdx, dword [rdi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rdi, qword [0x140108508]
cmp rdi, 1
jbe 0x140036e12
mov ecx, dword [0x140102430]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140036e6e
movsxd rcx, dword [rdi]
shl rcx, 4
mov qword [rax + rcx], rsi
mov ecx, dword [rdi + 4]
movsxd rdx, dword [rdi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x140108578]
int3
lea rcx, [0x140108508]
int3
test rbx, rbx
je 0x140036d7a
call fcn.140006940
jmp 0x140036d61
test rsi, rsi
je 0x140036dba
call fcn.140006940
jmp 0x140036da1

Function at 0x140037b00
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov eax, dword [0x140109c48]
mov ecx, dword [0x1401025d8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140037b62
mov ecx, dword [0x140102430]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140037b9e
movsxd rcx, dword [0x140109c40]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x140109c44]
jne 0x140037b9e
mov rax, qword [rax + rcx]
mov qword [rsi], rax
mov rax, rsi
add rsp, 0x20
pop rsi
ret
lea rcx, [0x140109c48]
int3
xor eax, eax
jmp 0x140037b56
Function at 0x14003d070
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
sub rsp, 0x130
mov rax, qword [0x1400ff028]
xor rax, rsp
mov qword [rsp + 0x128], rax
mov r9, qword [rcx + 8]
mov rsi, 0xffffffffffffffff
cmp r9, r8
jbe 0x14003d1ae
mov r11, qword [rdx + 8]
cmp r11, 1
je 0x14003d1db
test r11, r11
je 0x14003d1ab
xorps xmm0, xmm0
movaps xmmword [rsp + 0x110], xmm0
movaps xmmword [rsp + 0x100], xmm0
movaps xmmword [rsp + 0xf0], xmm0
movaps xmmword [rsp + 0xe0], xmm0
movaps xmmword [rsp + 0xd0], xmm0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
mov rdx, qword [rdx]
lea rsi, [r11 - 1]
mov r10d, r11d
and r10d, 3
cmp rsi, 3
jae 0x14003d13e
xor esi, esi
jmp 0x14003d180
and r11, 0xfffffffffffffffc
xor esi, esi
nop word cs:[rax + rax]
nop
movzx eax, byte [rdx + rsi]
mov byte [rsp + rax + 0x20], 1
movzx eax, byte [rdx + rsi + 1]
mov byte [rsp + rax + 0x20], 1
movzx eax, byte [rdx + rsi + 2]
mov byte [rsp + rax + 0x20], 1
movzx eax, byte [rdx + rsi + 3]
mov byte [rsp + rax + 0x20], 1
add rsi, 4
cmp r11, rsi
jne 0x14003d150
test r10, r10
je 0x14003d19c
add rdx, rsi
xor eax, eax
movzx esi, byte [rdx + rax]
mov byte [rsp + rsi + 0x20], 1
add rax, 1
cmp r10, rax
jne 0x14003d18a
mov rax, qword [rcx]
movzx ecx, byte [rax + r8]
cmp byte [rsp + rcx + 0x20], 0
jne 0x14003d1ca
mov rsi, r8
mov rcx, qword [rsp + 0x128]
xor rcx, rsp
call fcn.140069b80
mov rax, rsi
add rsp, 0x130
pop rsi
ret
inc r8
cmp r9, r8
jne 0x14003d19f
mov r8, 0xffffffffffffffff
jmp 0x14003d1ab
mov rax, qword [rdx]
mov al, byte [rax]
mov rcx, qword [rcx]
cmp byte [rcx + r8], al
jne 0x14003d1ab
inc r8
cmp r9, r8
jne 0x14003d1e3
jmp 0x14003d1ae
Function at 0x14003d200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x128
mov rax, qword [0x1400ff028]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov r14, qword [rcx + 8]
test r14, r14
je 0x14003d361
add r14, 0xffffffffffffffff
cmp r14, r8
jae 0x14003d3c3
mov rsi, qword [rdx + 8]
cmp rsi, 1
je 0x14003d36a
test rsi, rsi
je 0x14003d341
xorps xmm0, xmm0
movaps xmmword [rsp + 0x110], xmm0
movaps xmmword [rsp + 0x100], xmm0
movaps xmmword [rsp + 0xf0], xmm0
movaps xmmword [rsp + 0xe0], xmm0
movaps xmmword [rsp + 0xd0], xmm0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
mov rax, qword [rdx]
lea rdi, [rsi - 1]
mov edx, esi
and edx, 3
cmp rdi, 3
jae 0x14003d2d6
xor edi, edi
jmp 0x14003d310
and rsi, 0xfffffffffffffffc
xor edi, edi
nop dword [rax]
movzx ebx, byte [rax + rdi]
mov byte [rsp + rbx + 0x20], 1
movzx ebx, byte [rax + rdi + 1]
mov byte [rsp + rbx + 0x20], 1
movzx ebx, byte [rax + rdi + 2]
mov byte [rsp + rbx + 0x20], 1
movzx ebx, byte [rax + rdi + 3]
mov byte [rsp + rbx + 0x20], 1
add rdi, 4
cmp rsi, rdi
jne 0x14003d2e0
test rdx, rdx
je 0x14003d32c
add rax, rdi
xor edi, edi
movzx esi, byte [rax + rdi]
mov byte [rsp + rsi + 0x20], 1
add rdi, 1
cmp rdx, rdi
jne 0x14003d31a
mov rcx, qword [rcx]
movzx eax, byte [rcx + r14]
cmp byte [rsp + rax + 0x20], 0
jne 0x14003d39c
mov rax, r14
mov r14, rax
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.140069b80
mov rax, r14
add rsp, 0x128
pop rbx
pop rdi
pop rsi
pop r14
ret
mov r14, 0xffffffffffffffff
jmp 0x14003d341
mov rax, qword [rdx]
mov al, byte [rax]
mov rdi, qword [rcx]
inc r14
mov rdx, r14
mov cl, byte [rdi + rdx - 1]
lea r14, [rdx - 1]
cmp cl, al
jne 0x14003d38d
cmp rdx, 1
mov rdx, r14
jne 0x14003d378
cmp cl, al
mov rax, 0xffffffffffffffff
cmove r14, rax
jmp 0x14003d341
mov rax, r14
sub rax, 1
jb 0x14003d3b7
movzx edx, byte [rcx + r14 - 1]
cmp byte [rsp + rdx + 0x20], 0
mov r14, rax
je 0x14003d33e
jmp 0x14003d39f
mov rax, 0xffffffffffffffff
jmp 0x14003d33e
mov r14, r8
jmp 0x14003d238