joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14020bf50
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
cmp qword [rcx], 0
je 0x14020bfd5
mov dword [rsp + 0x2c], 0
lea rbx, [rsi + 0x10]
lea r8, [rsp + 0x2c]
mov rcx, rbx
xor edx, edx
xor r9d, r9d
call sub.kernel32.dll_InitOnceBeginInitialize
mov dword [rsp + 0x28], eax
cmp eax, 1
jne 0x14020c016
cmp dword [rsp + 0x2c], 0
je 0x14020bffa
call sub.kernel32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x14020c02e
mov edi, eax
inc eax
mov dword [rsi + 0x18], eax
mov rax, qword [0x1403f9230]
nop
mov qword [rsi + 8], rax
lock cmpxchg qword [0x1403f9230], rsi
jne 0x14020bfb0
mov byte [0x1403f9228], 1
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call sub.kernel32.dll_InitOnceComplete
jmp 0x14020c00c
call sub.kernel32.dll_TlsAlloc
mov dword [rsp + 0x28], eax
cmp eax, 0xffffffff
je 0x14020c078
mov ecx, eax
inc ecx
xor eax, eax
lock cmpxchg dword [rsi + 0x18], ecx
jne 0x14020bfff
mov edi, dword [rsp + 0x28]
jmp 0x14020c00c
mov edi, dword [rsi + 0x18]
jmp 0x14020c00a
mov edi, eax
mov ecx, dword [rsp + 0x28]
call sub.kernel32.dll_TlsFree
dec edi
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x30]
call fcn.14020c660
mov rcx, rbx
mov edx, 4
xor r8d, r8d
call sub.kernel32.dll_InitOnceComplete
lea rax, str.out_of_TLS_indexes
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
lea rax, str._home_janus_.cargo_registry_src_index.crates.io_6f17d22bba15001f_unicode_segmentation_1.10.1_src_grapheme.rs
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rdx, str.library_std_src_syswindows_thread_local_key.rs
lea rcx, [rsp + 0x30]
call fcn.1400790c0
lea rax, str.out_of_TLS_indexes
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
lea rax, str._home_janus_.cargo_registry_src_index.crates.io_6f17d22bba15001f_unicode_segmentation_1.10.1_src_grapheme.rs
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x30]
call fcn.14020c6b0
int3
Function at 0x14020c530
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov ecx, dword [0x1402e8858]
test ecx, ecx
je 0x14020c610
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jb 0x14020c564
mov rdi, rax
cmp qword [rax + 8], 0
je 0x14020c564
add rdi, 0x10
jmp 0x14020c606
mov ecx, dword [0x1402e8858]
test ecx, ecx
je 0x14020c623
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x14020c604
mov rsi, rax
test rax, rax
jne 0x14020c5d3
movzx eax, byte [0x1403f9274]
mov ecx, 0x18
mov edx, 8
call fcn.140061500
test rax, rax
je 0x14020c646
mov rsi, rax
lea rax, [0x1402e8840]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x1402e8858]
test ecx, ecx
je 0x14020c636
dec ecx
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
lea rdi, [rsi + 0x10]
mov rcx, qword [rsi + 0x10]
cmp qword [rsi + 8], 0
mov qword [rsi + 8], 1
mov qword [rsi + 0x10], 0
je 0x14020c606
test rcx, rcx
je 0x14020c606
lock dec qword [rcx]
jne 0x14020c606
call fcn.14020bef0
jmp 0x14020c606
xor edi, edi
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x1402e8840]
call fcn.14020bf50
mov ecx, eax
jmp 0x14020c546
lea rcx, [0x1402e8840]
call fcn.14020bf50
mov ecx, eax
jmp 0x14020c574
lea rcx, [0x1402e8840]
call fcn.14020bf50
mov ecx, eax
jmp 0x14020c5cb
mov ecx, 8
mov edx, 0x18
call fcn.140077010
int3

Function at 0x14020ccb0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov ecx, dword [0x1402e8878]
test ecx, ecx
je 0x14020cd4f
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jb 0x14020ccd9
mov rsi, rax
cmp byte [rax + 8], 0
jne 0x14020cd3e
mov ecx, dword [0x1402e8878]
test ecx, ecx
je 0x14020cd62
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x14020cd44
mov rsi, rax
test rax, rax
jne 0x14020cd38
movzx eax, byte [0x1403f9274]
mov ecx, 0x10
mov edx, 8
call fcn.140061500
test rax, rax
je 0x14020cd85
mov rsi, rax
lea rax, [0x1402e8860]
mov qword [rsi], rax
mov byte [rsi + 8], 0
mov ecx, dword [0x1402e8878]
test ecx, ecx
je 0x14020cd75
dec ecx
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
mov word [rsi + 8], 1
add rsi, 9
jmp 0x14020cd46
xor esi, esi
mov rax, rsi
add rsp, 0x20
pop rsi
ret
lea rcx, [0x1402e8860]
call fcn.14020bf50
mov ecx, eax
jmp 0x14020ccc5
lea rcx, [0x1402e8860]
call fcn.14020bf50
mov ecx, eax
jmp 0x14020cce5
lea rcx, [0x1402e8860]
call fcn.14020bf50
mov ecx, eax
jmp 0x14020cd30
mov ecx, 8
mov edx, 0x10
call fcn.140077010
int3
Function at 0x14020da40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov ecx, dword [0x1402e8838]
test ecx, ecx
je 0x14020dafd
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jb 0x14020da70
cmp qword [rax + 8], 0
je 0x14020da70
add rax, 0x10
jmp 0x14020daf7
mov ecx, dword [0x1402e8838]
test ecx, ecx
je 0x14020db10
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x14020daf5
mov rsi, rax
test rax, rax
jne 0x14020dadb
movzx eax, byte [0x1403f9274]
mov ecx, 0x20
mov edx, 8
call fcn.140061500
test rax, rax
je 0x14020db33
mov rsi, rax
lea rax, [0x1402e8820]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x1402e8838]
test ecx, ecx
je 0x14020db23
dec ecx
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
mov qword [rsi + 8], 1
lea rax, [rsi + 0x10]
mov qword [rsi + 0x10], 0
mov byte [rsi + 0x18], 0
jmp 0x14020daf7
xor eax, eax
add rsp, 0x20
pop rsi
ret
lea rcx, [0x1402e8820]
call fcn.14020bf50
mov ecx, eax
jmp 0x14020da55
lea rcx, [0x1402e8820]
call fcn.14020bf50
mov ecx, eax
jmp 0x14020da80
lea rcx, [0x1402e8820]
call fcn.14020bf50
mov ecx, eax
jmp 0x14020dad3
mov ecx, 8
mov edx, 0x20
call fcn.140077010
int3
Function at 0x140211440
Capabilities:
Read file via mapping

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xc8
mov rax, r8
mov rsi, rcx
mov dword [rsp + 0x38], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 7
mov qword [rsp + 0x54], 0
mov word [rsp + 0x5c], 0
mov byte [rsp + 0x58], 1
lea r8, [rsp + 0x38]
mov rcx, rdx
mov rdx, rax
call fcn.14022a0f0
mov rdi, rdx
test rax, rax
je 0x1402114d4
mov qword [rsp + 0x80], 1
lea rcx, [rsp + 0x88]
mov qword [rsp + 0x88], rdi
call fcn.14020b600
mov qword [rsi], 0
add rsp, 0xc8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, [rsp + 0x38]
mov rdx, rdi
call fcn.14022a340
cmp dword [rsp + 0x38], 2
jne 0x140211503
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x80], 2
jmp 0x14021154f
movups xmm0, xmmword [rsp + 0x38]
movups xmm1, xmmword [rsp + 0x48]
movups xmm2, xmmword [rsp + 0x58]
movups xmm3, xmmword [rsp + 0x68]
movaps xmmword [rsp + 0x80], xmm0
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0xc0], rax
movaps xmmword [rsp + 0xb0], xmm3
movaps xmmword [rsp + 0xa0], xmm2
movaps xmmword [rsp + 0x90], xmm1
cmp qword [rsp + 0x80], 2
jne 0x14021157b
lea rcx, [rsp + 0x88]
call fcn.14020b600
mov qword [rsi], 0
mov rcx, rdi
add rsp, 0xc8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp sub.kernel32.dll_CloseHandle
mov r12, qword [rsp + 0xb8]
test rdi, rdi
je 0x1402115d9
mov qword [rsp + 0x80], 0
call sub.kernel32.dll_GetCurrentProcess
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x80]
mov rcx, rax
mov rdx, rdi
mov r8, rax
call sub.kernel32.dll_DuplicateHandle
test eax, eax
je 0x140211655
mov rbx, qword [rsp + 0x80]
jmp 0x1402115db
xor ebx, ebx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rbx
xor edx, edx
mov r8d, 2
xor r9d, r9d
call sub.kernel32.dll_CreateFileMappingA
test rax, rax
je 0x140211644
mov r14, rax
mov qword [rsp + 0x20], r12
mov rcx, rax
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call sub.kernel32.dll_MapViewOfFile
mov r15, rax
mov rcx, r14
call sub.kernel32.dll_CloseHandle
test r15, r15
je 0x140211644
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], r12
mov qword [rsi], 1
jmp 0x140211681
mov qword [rsi], 0
mov rcx, rbx
call sub.kernel32.dll_CloseHandle
jmp 0x140211681
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x38], 1
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
call fcn.14020b600
mov qword [rsi], 0
mov rcx, rdi
call sub.kernel32.dll_CloseHandle
jmp 0x1402114c3
Function at 0x14022aaa0
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x4a8
mov rsi, rcx
movabs rdi, 0x8000000000000000
lea rcx, [rsp + 0xa8]
call fcn.14020dfe0
mov rax, qword [rsp + 0xa8]
cmp rax, rdi
jne 0x14022aaef
lea rcx, [rsp + 0xb0]
call fcn.14020b600
mov qword [rsi], rdi
jmp 0x14022acd3
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 2
mov qword [rsp + 0x58], 0
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x28], rax
xor ebx, ebx
mov esi, 0xffffffff
xor r14d, r14d
xor r13d, r13d
cmp r8, 0x201
jae 0x14022ab80
jmp 0x14022ab5f
jae 0x14022ac27
cmp r8, 0x201
jae 0x14022ab80
mov edi, 0x200
lea rbp, [rsp + 0xa8]
mov r12, r8
jmp 0x14022abc7
sub r8, r13
sub r14, r13
cmp r14, r8
jae 0x14022aba7
lea rcx, [rsp + 0x48]
mov rdx, r13
call fcn.14020e470
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
cmp rbx, rsi
mov r13d, 0xffffffff
cmovb r13, rbx
mov qword [rsp + 0x58], r13
mov r14, rbx
mov rdi, r13
mov rbp, qword [rsp + 0x28]
mov r12, r13
xor ecx, ecx
call sub.kernel32.dll_SetLastError
mov rcx, qword [rsp + 0x30]
mov rdx, rbp
mov r8d, r12d
call sub.kernel32.dll_GetEnvironmentVariableW
mov r15d, eax
test eax, eax
jne 0x14022abee
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x14022ac66
mov r8d, r15d
cmp r12, r8
jne 0x14022ab50
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x14022ad03
add r12, r12
cmp r12, rsi
cmovae r12, rsi
mov r8, r12
cmp r8, 0x201
jb 0x14022ab5f
jmp 0x14022ab80
cmp rdi, r8
jb 0x14022ad1d
lea rcx, [rsp + 0x88]
mov rdx, rbp
call fcn.140210100
movabs rdi, 0x8000000000000000
movups xmm0, xmmword [rsp + 0x88]
movups xmm1, xmmword [rsp + 0x98]
movaps xmmword [rsp + 0x70], xmm1
movaps xmmword [rsp + 0x60], xmm0
jmp 0x14022ac87
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x68], rax
movabs rdi, 0x8000000000000000
mov qword [rsp + 0x60], rdi
mov rsi, qword [rsp + 0x38]
test rbx, rbx
je 0x14022aca4
mov rcx, qword [0x1403f9220]
xor edx, edx
mov r8, qword [rsp + 0x28]
call fcn.1402e3f64
cmp qword [rsp + 0x60], rdi
jne 0x14022ace8
mov qword [rsi], rdi
lea rcx, [rsp + 0x68]
call fcn.14020b600
cmp qword [rsp + 0x40], 0
je 0x14022acd3
mov rcx, qword [0x1403f9220]
xor edx, edx
mov r8, qword [rsp + 0x30]
call fcn.1402e3f64
nop
add rsp, 0x4a8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movaps xmm0, xmmword [rsp + 0x60]
movaps xmm1, xmmword [rsp + 0x70]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
cmp qword [rsp + 0x40], 0
jne 0x14022acc0
jmp 0x14022acd3
lea rcx, str.internal_error:_entered_unreachable_codefatal_runtime_error:_thread_local_panicked_on_drop_n
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.14007aaa0
jmp 0x14022ad32
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, rdi
mov r8, rax
call fcn.14007a270
ud2
Function at 0x14022e8f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov ecx, dword [0x1402e88d8]
test ecx, ecx
je 0x14022e9d0
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jb 0x14022e924
mov rdi, rax
cmp qword [rax + 8], 0
je 0x14022e924
add rdi, 0x10
jmp 0x14022e9c6
mov ecx, dword [0x1402e88d8]
test ecx, ecx
je 0x14022e9e3
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x14022e9c4
mov rsi, rax
test rax, rax
jne 0x14022e993
movzx eax, byte [0x1403f9274]
mov ecx, 0x18
mov edx, 8
call fcn.140061500
test rax, rax
je 0x14022ea06
mov rsi, rax
lea rax, [0x1402e88c0]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x1402e88d8]
test ecx, ecx
je 0x14022e9f6
dec ecx
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
lea rdi, [rsi + 0x10]
mov rcx, qword [rsi + 0x10]
cmp qword [rsi + 8], 0
mov qword [rsi + 8], 1
mov qword [rsi + 0x10], 0
je 0x14022e9c6
test rcx, rcx
je 0x14022e9c6
lock dec qword [rcx]
jne 0x14022e9c6
call fcn.14022ea20
jmp 0x14022e9c6
xor edi, edi
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x1402e88c0]
call fcn.14020bf50
mov ecx, eax
jmp 0x14022e906
lea rcx, [0x1402e88c0]
call fcn.14020bf50
mov ecx, eax
jmp 0x14022e934
lea rcx, [0x1402e88c0]
call fcn.14020bf50
mov ecx, eax
jmp 0x14022e98b
mov ecx, 8
mov edx, 0x18
call fcn.140077010
int3

Function at 0x14022fb40
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
sub rsp, 0x80
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
mov edx, 0x10
call sub.advapi32.dll_SystemFunction036
test al, al
je 0x14022fb76
mov rax, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
add rsp, 0x80
pop rsi
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x40], rax
lea rax, [fcn.14022b5b0]
mov qword [rsp + 0x48], rax
lea rax, str._b8_
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 1
mov qword [rsp + 0x70], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 1
lea rdx, str.library_std_src_syswindows_rand.rs
lea rcx, [rsp + 0x50]
call fcn.1400790c0
ud2
Function at 0x14022fd00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov ecx, dword [0x1402e8898]
test ecx, ecx
je 0x14022fd9f
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jb 0x14022fd29
mov rsi, rax
cmp byte [rax + 8], 0
jne 0x14022fd8e
mov ecx, dword [0x1402e8898]
test ecx, ecx
je 0x14022fdb2
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x14022fd94
mov rsi, rax
test rax, rax
jne 0x14022fd88
movzx eax, byte [0x1403f9274]
mov ecx, 0x10
mov edx, 8
call fcn.140061500
test rax, rax
je 0x14022fdd5
mov rsi, rax
lea rax, [0x1402e8880]
mov qword [rsi], rax
mov byte [rsi + 8], 0
mov ecx, dword [0x1402e8898]
test ecx, ecx
je 0x14022fdc5
dec ecx
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
mov word [rsi + 8], 1
add rsi, 9
jmp 0x14022fd96
xor esi, esi
mov rax, rsi
add rsp, 0x20
pop rsi
ret
lea rcx, [0x1402e8880]
call fcn.14020bf50
mov ecx, eax
jmp 0x14022fd15
lea rcx, [0x1402e8880]
call fcn.14020bf50
mov ecx, eax
jmp 0x14022fd35
lea rcx, [0x1402e8880]
call fcn.14020bf50
mov ecx, eax
jmp 0x14022fd80
mov ecx, 8
mov edx, 0x10
call fcn.140077010
int3

Function at 0x140234d00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x30
mov ecx, dword [0x1402e88b8]
test ecx, ecx
je 0x140234dac
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jb 0x140234d30
mov rsi, rax
cmp qword [rax + 8], 0
je 0x140234d30
add rsi, 0x10
jmp 0x140234d4d
mov ecx, dword [0x1402e88b8]
test ecx, ecx
je 0x140234dbf
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jne 0x140234d56
xor esi, esi
mov rax, rsi
add rsp, 0x30
pop rsi
ret
mov rsi, rax
test rax, rax
jne 0x140234ddc
movzx eax, byte [0x1403f9274]
mov ecx, 0x18
mov edx, 8
call fcn.140061500
test rax, rax
je 0x140234e2a
mov rsi, rax
lea rax, [0x1402e88a0]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x1402e88b8]
test ecx, ecx
jne 0x140234dd2
lea rcx, [0x1402e88a0]
call fcn.14020bf50
mov ecx, eax
jmp 0x140234dd4
lea rcx, [0x1402e88a0]
call fcn.14020bf50
mov ecx, eax
jmp 0x140234d15
lea rcx, [0x1402e88a0]
call fcn.14020bf50
mov ecx, eax
jmp 0x140234d40
dec ecx
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
call fcn.14022fc20
mov rdx, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rcx
mov qword [rsi + 8], 1
mov qword [rsi + 0x10], rax
test rdx, rdx
je 0x140234d2a
test rcx, rcx
je 0x140234d2a
lock dec qword [rcx]
jne 0x140234d2a
lea rcx, [rsp + 0x28]
call fcn.140234e40
jmp 0x140234d2a
mov ecx, 8
mov edx, 0x18
call fcn.140077010
int3
Function at 0x140234fc0
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x30
mov ecx, dword [0x1402e88f8]
test ecx, ecx
je 0x1402350b9
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jb 0x140234ff0
cmp qword [rax + 8], 0
je 0x140234ff0
add rax, 0x10
jmp 0x1402350b3
mov ecx, dword [0x1402e88f8]
test ecx, ecx
je 0x1402350cc
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x140235093
mov rsi, rax
test rax, rax
jne 0x140235063
movzx eax, byte [0x1403f9274]
mov ecx, 0x20
mov edx, 8
call fcn.140061500
test rax, rax
je 0x1402350f2
mov rsi, rax
lea rax, [0x1402e88e0]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x1402e88f8]
test ecx, ecx
je 0x1402350df
dec ecx
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x140235097
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
jmp 0x14023509f
xor eax, eax
jmp 0x1402350b3
call fcn.14022fb40
mov rcx, rax
mov qword [rsi + 8], 1
lea rax, [rsi + 0x10]
mov qword [rsi + 0x10], rcx
mov qword [rsi + 0x18], rdx
add rsp, 0x30
pop rsi
ret
lea rcx, [0x1402e88e0]
call fcn.14020bf50
mov ecx, eax
jmp 0x140234fd5
lea rcx, [0x1402e88e0]
call fcn.14020bf50
mov ecx, eax
jmp 0x140235000
lea rcx, [0x1402e88e0]
call fcn.14020bf50
mov ecx, eax
jmp 0x14023505b
mov ecx, 8
mov edx, 0x20
call fcn.140077010
int3
Function at 0x14028efad
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x28
movzx r10d, byte [rcx + 3]
movzx r9d, word [rcx]
test r10d, r10d
je 0x14028eff3
xor eax, eax
cmp r9, r8
ja 0x14028f038
cmp r10d, 1
je 0x14028f03a
cmp r10d, 3
jne 0x14028f03f
lea r10d, [r9 + 2]
mov word [rcx], r10w
lea r10, [r9 + 2]
cmp r10, r8
ja 0x14028f06a
movzx eax, word [rdx + r9]
rol ax, 8
cwde
jmp 0x14028f051
cmp r9, r8
jae 0x14028f036
mov al, byte [rdx + r9]
inc r9d
mov word [rcx], r9w
mov r9d, eax
and r9b, 0x3f
inc r9b
mov byte [rcx + 2], r9b
test al, 0x40
sete r9b
xor r9b, 3
test al, al
movzx eax, r9b
mov r9d, 1
cmovns r9d, eax
mov byte [rcx + 3], r9b
call fcn.14028efad
jmp 0x14028f06a
xor eax, eax
jmp 0x14028f06a
xorps xmm0, xmm0
jmp 0x14028f05c
lea r10d, [r9 + 1]
mov word [rcx], r10w
cmp r9, r8
jae 0x14028f06a
movsx eax, byte [rdx + r9]
xorps xmm0, xmm0
cvtsi2ss xmm0, eax
mulss xmm0, xmm3
dec byte [rcx + 2]
mov eax, 1
jne 0x14028f06a
mov byte [rcx + 3], 0
add rsp, 0x28
ret
Function at 0x1402c10cc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov ebx, r9d
mov rdi, r8
mov r14, rdx
mov rsi, rcx
mov rcx, r8
call fcn.1401a6baf
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], 0
test rdi, rdi
je 0x1402c12c7
add rdi, r14
mov ebp, ebx
xor bpl, 1
mov r15d, 0x30
mov r13d, 0x2600
movzx r12d, byte [r14]
test r12b, r12b
js 0x1402c112f
inc r14
jmp 0x1402c118e
mov eax, r12d
and eax, 0x1f
movzx edx, byte [r14 + 1]
and edx, 0x3f
cmp r12b, 0xdf
jbe 0x1402c1174
movzx ecx, byte [r14 + 2]
shl edx, 6
and ecx, 0x3f
or ecx, edx
cmp r12b, 0xf0
jb 0x1402c1182
movzx r12d, byte [r14 + 3]
add r14, 4
and eax, 7
shl eax, 0x12
shl ecx, 6
and r12d, 0x3f
or r12d, ecx
or r12d, eax
jmp 0x1402c118e
add r14, 2
shl eax, 6
or eax, edx
mov r12d, eax
jmp 0x1402c118e
add r14, 3
shl eax, 0xc
or ecx, eax
mov r12d, ecx
cmp r12d, 0xd
ja 0x1402c11ac
bt r13d, r12d
jae 0x1402c11ac
cmp r15d, 0x20
mov r15d, 0x20
jne 0x1402c11dd
test bl, bl
je 0x1402c1209
jmp 0x1402c11dd
cmp r12d, 0x110000
je 0x1402c12c7
cmp r12d, 0x20
sete al
cmp r15d, 0x20
jne 0x1402c11d1
mov r15d, 0x20
and al, bpl
jne 0x1402c1209
cmp r12d, 0x80
jae 0x1402c1217
mov r15d, r12d
mov rdx, qword [rsp + 0x40]
cmp rdx, qword [rsp + 0x30]
jne 0x1402c11f8
lea rcx, [rsp + 0x30]
call fcn.1402356a4
mov rdx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x38]
mov byte [rax + rdx], r15b
inc rdx
mov qword [rsp + 0x40], rdx
cmp r14, rdi
jne 0x1402c1121
jmp 0x1402c12c7
mov dword [rsp + 0x2c], 0
mov eax, r12d
cmp r12d, 0x800
jae 0x1402c1247
shr eax, 6
or al, 0xc0
mov byte [rsp + 0x2c], al
mov eax, r12d
and al, 0x3f
or al, 0x80
mov byte [rsp + 0x2d], al
mov r8d, 2
jmp 0x1402c12b0
cmp r12d, 0x10000
jae 0x1402c127a
shr eax, 0xc
or al, 0xe0
mov byte [rsp + 0x2c], al
mov eax, r12d
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [rsp + 0x2d], al
mov eax, r12d
and al, 0x3f
or al, 0x80
mov byte [rsp + 0x2e], al
mov r8d, 3
jmp 0x1402c12b0
shr eax, 0x12
or al, 0xf0
mov byte [rsp + 0x2c], al
mov eax, r12d
shr eax, 0xc
and al, 0x3f
or al, 0x80
mov byte [rsp + 0x2d], al
mov eax, r12d
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [rsp + 0x2e], al
mov eax, r12d
and al, 0x3f
or al, 0x80
mov byte [rsp + 0x2f], al
mov r8d, 4
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x2c]
call fcn.140189c0d
mov r15d, r12d
jmp 0x1402c1209
mov rax, qword [rsp + 0x40]
mov qword [rsi + 0x10], rax
mov rax, qword [rsp + 0x30]
mov qword [rsi], rax
mov rax, qword [rsp + 0x38]
mov qword [rsi + 8], rax
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1402c1e43
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
mov rax, rcx
movabs r9, 0x7e4c0c103dce328d
movabs rsi, 0x736f6d6570736575
movabs r11, 0x6e461a132ade3893
movabs r10, 0x6c7967656e657261
mov edi, edx
and edi, 7
mov rcx, rdx
xor ebx, ebx
and rcx, 0xfffffffffffffff8
je 0x1402c1ec8
add rsi, r11
rol r11, 0xd
mov r8, qword [rax + rbx]
xor r11, rsi
rol rsi, 0x20
xor r9, r8
add r10, r9
rol r9, 0x10
xor r9, r10
add rsi, r9
rol r9, 0x15
add r10, r11
rol r11, 0x11
xor r11, r10
rol r10, 0x20
xor r9, rsi
xor rsi, r8
add rbx, 8
cmp rbx, rcx
jb 0x1402c1e85
cmp edi, 4
jb 0x1402c1ed9
mov r14d, dword [rax + rbx]
mov r8d, 4
jmp 0x1402c1edf
xor r14d, r14d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, rdi
jae 0x1402c1f06
lea rcx, [r8 + rbx]
movzx r15d, word [rax + rcx]
lea ecx, [r8*8]
shl r15, cl
or r14, r15
or r8, 2
cmp r8, rdi
jae 0x1402c1f1f
add rbx, r8
movzx eax, byte [rax + rbx]
shl r8d, 3
mov ecx, r8d
shl rax, cl
or r14, rax
shl rdx, 0x38
add rsi, r11
rol r11, 0xd
or rdx, r14
xor r11, rsi
rol rsi, 0x20
xor r9, rdx
add r10, r9
rol r9, 0x10
xor r9, r10
add rsi, r9
rol r9, 0x15
add r10, r11
rol r11, 0x11
xor r9, rsi
xor r11, r10
rol r10, 0x20
xor rsi, rdx
add rsi, r11
rol r11, 0xd
xor r11, rsi
rol rsi, 0x20
xor r10, 0xff
add r10, r9
rol r9, 0x10
xor r9, r10
add rsi, r9
rol r9, 0x15
add r10, r11
rol r11, 0x11
xor r11, r10
rol r10, 0x20
xor r9, rsi
add rsi, r11
rol r11, 0xd
xor r11, rsi
rol rsi, 0x20
add r10, r9
rol r9, 0x10
xor r9, r10
add rsi, r9
rol r9, 0x15
add r10, r11
rol r11, 0x11
xor r11, r10
rol r10, 0x20
xor r9, rsi
add rsi, r11
rol r11, 0xd
add r10, r9
rol r9, 0x10
xor r9, r10
rol r9, 0x15
xor r11, rsi
add r10, r11
rol r11, 0x11
mov rax, r10
rol rax, 0x20
xor rax, r11
xor rax, r9
xor rax, r10
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret