joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400041ee
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 0x11
mov byte [rsp + 0x21], 0x68
mov byte [rsp + 0x22], 0x68
mov byte [rsp + 0x23], 0x68
mov byte [rsp + 0x24], 0x1f
mov byte [rsp + 0x25], 0x53
mov byte [rsp + 0x26], 0x5a
mov byte [rsp + 0x27], 0x65
mov byte [rsp + 0x28], 0x55
mov byte [rsp + 0x29], 0x56
mov byte [rsp + 0x2a], 0x57
mov byte [rsp + 0x2b], 0x56
mov byte [rsp + 0x2c], 0x5f
mov byte [rsp + 0x2d], 0x55
mov byte [rsp + 0x2e], 0x56
mov byte [rsp + 0x2f], 0x63
mov byte [rsp + 0x30], 0x1f
mov byte [rsp + 0x31], 0x54
mov byte [rsp + 0x32], 0x60
mov byte [rsp + 0x33], 0x5e
mov byte [rsp + 0x34], 0xf1
cmp byte [0x1409d1b70], 0
jne 0x14000429c
mov byte [0x1409d1b95], 1
mov eax, 0
lea rcx, [0x1409d1b80]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x15
jne 0x140004277
mov byte [0x1409d1b70], 1
lea rcx, [0x140001878]
call fcn.1400014f0
lea rax, [0x1409d1b80]
add rsp, 0x48
ret

Function at 0x1400042a8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 0x11
mov byte [rsp + 0x21], 0x68
mov byte [rsp + 0x22], 0x68
mov byte [rsp + 0x23], 0x68
mov byte [rsp + 0x24], 0x1f
mov byte [rsp + 0x25], 0x59
mov byte [rsp + 0x26], 0x60
mov byte [rsp + 0x27], 0x5e
mov byte [rsp + 0x28], 0x56
mov byte [rsp + 0x29], 0x1f
mov byte [rsp + 0x2a], 0x64
mov byte [rsp + 0x2b], 0x60
mov byte [rsp + 0x2c], 0x61
mov byte [rsp + 0x2d], 0x59
mov byte [rsp + 0x2e], 0x60
mov byte [rsp + 0x2f], 0x64
mov byte [rsp + 0x30], 0x1f
mov byte [rsp + 0x31], 0x54
mov byte [rsp + 0x32], 0x60
mov byte [rsp + 0x33], 0x5e
mov byte [rsp + 0x34], 0xf1
cmp byte [0x1409d17e8], 0
jne 0x140004356
mov byte [0x1409d1805], 1
mov eax, 0
lea rcx, [0x1409d17f0]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x15
jne 0x140004331
mov byte [0x1409d17e8], 1
lea rcx, [0x140001b48]
call fcn.1400014f0
lea rax, [0x1409d17f0]
add rsp, 0x48
ret

Function at 0x140004362
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 0x11
mov byte [rsp + 0x21], 0x68
mov byte [rsp + 0x22], 0x68
mov byte [rsp + 0x23], 0x68
mov byte [rsp + 0x24], 0x1f
mov byte [rsp + 0x25], 0x61
mov byte [rsp + 0x26], 0x52
mov byte [rsp + 0x27], 0x5f
mov byte [rsp + 0x28], 0x55
mov byte [rsp + 0x29], 0x52
mov byte [rsp + 0x2a], 0x64
mov byte [rsp + 0x2b], 0x56
mov byte [rsp + 0x2c], 0x54
mov byte [rsp + 0x2d], 0x66
mov byte [rsp + 0x2e], 0x63
mov byte [rsp + 0x2f], 0x5a
mov byte [rsp + 0x30], 0x65
mov byte [rsp + 0x31], 0x6a
mov byte [rsp + 0x32], 0x1f
mov byte [rsp + 0x33], 0x54
mov byte [rsp + 0x34], 0x60
mov byte [rsp + 0x35], 0x5e
mov byte [rsp + 0x36], 0xf1
cmp byte [0x1409d1a80], 0
jne 0x14000441a
mov byte [0x1409d1aa7], 1
mov eax, 0
lea rcx, [0x1409d1a90]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x17
jne 0x1400043f5
mov byte [0x1409d1a80], 1
lea rcx, [0x140001938]
call fcn.1400014f0
lea rax, [0x1409d1a90]
add rsp, 0x48
ret
Function at 0x140004426
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 0x11
mov byte [rsp + 0x21], 0x68
mov byte [rsp + 0x22], 0x68
mov byte [rsp + 0x23], 0x68
mov byte [rsp + 0x24], 0x1f
mov byte [rsp + 0x25], 0x66
mov byte [rsp + 0x26], 0x64
mov byte [rsp + 0x27], 0x52
mov byte [rsp + 0x28], 0x1f
mov byte [rsp + 0x29], 0x5c
mov byte [rsp + 0x2a], 0x52
mov byte [rsp + 0x2b], 0x64
mov byte [rsp + 0x2c], 0x61
mov byte [rsp + 0x2d], 0x56
mov byte [rsp + 0x2e], 0x63
mov byte [rsp + 0x2f], 0x64
mov byte [rsp + 0x30], 0x5c
mov byte [rsp + 0x31], 0x6a
mov byte [rsp + 0x32], 0x1f
mov byte [rsp + 0x33], 0x54
mov byte [rsp + 0x34], 0x60
mov byte [rsp + 0x35], 0x5e
mov byte [rsp + 0x36], 0xf1
cmp byte [0x1409d18a0], 0
jne 0x1400044de
mov byte [0x1409d18c7], 1
mov eax, 0
lea rcx, [0x1409d18b0]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x17
jne 0x1400044b9
mov byte [0x1409d18a0], 1
lea rcx, [0x140001ab8]
call fcn.1400014f0
lea rax, [0x1409d18b0]
add rsp, 0x48
ret

Function at 0x1400044ea
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 0x11
mov byte [rsp + 0x21], 0x68
mov byte [rsp + 0x22], 0x68
mov byte [rsp + 0x23], 0x68
mov byte [rsp + 0x24], 0x1f
mov byte [rsp + 0x25], 0x61
mov byte [rsp + 0x26], 0x52
mov byte [rsp + 0x27], 0x5f
mov byte [rsp + 0x28], 0x55
mov byte [rsp + 0x29], 0x52
mov byte [rsp + 0x2a], 0x64
mov byte [rsp + 0x2b], 0x56
mov byte [rsp + 0x2c], 0x54
mov byte [rsp + 0x2d], 0x66
mov byte [rsp + 0x2e], 0x63
mov byte [rsp + 0x2f], 0x5a
mov byte [rsp + 0x30], 0x65
mov byte [rsp + 0x31], 0x6a
mov byte [rsp + 0x32], 0x1f
mov byte [rsp + 0x33], 0x54
mov byte [rsp + 0x34], 0x60
mov byte [rsp + 0x35], 0x5e
mov byte [rsp + 0x36], 0xf1
cmp byte [0x1409d15e8], 0
jne 0x1400045a2
mov byte [0x1409d1607], 1
mov eax, 0
lea rcx, [0x1409d15f0]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x17
jne 0x14000457d
mov byte [0x1409d15e8], 1
lea rcx, [0x140001ce0]
call fcn.1400014f0
lea rax, [0x1409d15f0]
add rsp, 0x48
ret

Function at 0x1400045ae
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov byte [rsp + 0x22], 0x11
mov byte [rsp + 0x23], 0x68
mov byte [rsp + 0x24], 0x68
mov byte [rsp + 0x25], 0x68
mov byte [rsp + 0x26], 0x1f
mov byte [rsp + 0x27], 0x56
mov byte [rsp + 0x28], 0x64
mov byte [rsp + 0x29], 0x56
mov byte [rsp + 0x2a], 0x65
mov byte [rsp + 0x2b], 0x1f
mov byte [rsp + 0x2c], 0x54
mov byte [rsp + 0x2d], 0x60
mov byte [rsp + 0x2e], 0x5e
mov byte [rsp + 0x2f], 0xf1
cmp byte [0x1409d19a0], 0
jne 0x140004639
mov byte [0x1409d19b6], 1
mov eax, 0
lea rcx, [0x1409d19a8]
movzx edx, byte [rsp + rax + 0x22]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0xe
jne 0x140004614
mov byte [0x1409d19a0], 1
lea rcx, [0x1400019f8]
call fcn.1400014f0
lea rax, [0x1409d19a8]
add rsp, 0x38
ret
Function at 0x140004646
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov byte [rsp + 0x22], 0x11
mov byte [rsp + 0x23], 0x56
mov byte [rsp + 0x24], 0x5e
mov byte [rsp + 0x25], 0x64
mov byte [rsp + 0x26], 0x5a
mov byte [rsp + 0x27], 0x64
mov byte [rsp + 0x28], 0x60
mov byte [rsp + 0x29], 0x57
mov byte [rsp + 0x2a], 0x65
mov byte [rsp + 0x2b], 0x1f
mov byte [rsp + 0x2c], 0x54
mov byte [rsp + 0x2d], 0x60
mov byte [rsp + 0x2e], 0x5e
mov byte [rsp + 0x2f], 0xf1
cmp byte [0x1409d1668], 0
jne 0x1400046d1
mov byte [0x1409d167e], 1
mov eax, 0
lea rcx, [0x1409d1670]
movzx edx, byte [rsp + rax + 0x22]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0xe
jne 0x1400046ac
mov byte [0x1409d1668], 1
lea rcx, [0x140001c80]
call fcn.1400014f0
lea rax, [0x1409d1670]
add rsp, 0x38
ret

Function at 0x1400046de
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov byte [rsp + 0x22], 0x11
mov byte [rsp + 0x23], 0x57
mov byte [rsp + 0x24], 0x1e
mov byte [rsp + 0x25], 0x64
mov byte [rsp + 0x26], 0x56
mov byte [rsp + 0x27], 0x54
mov byte [rsp + 0x28], 0x66
mov byte [rsp + 0x29], 0x63
mov byte [rsp + 0x2a], 0x56
mov byte [rsp + 0x2b], 0x1f
mov byte [rsp + 0x2c], 0x54
mov byte [rsp + 0x2d], 0x60
mov byte [rsp + 0x2e], 0x5e
mov byte [rsp + 0x2f], 0xf1
cmp byte [0x1409d1608], 0
jne 0x140004769
mov byte [0x1409d161e], 1
mov eax, 0
lea rcx, [0x1409d1610]
movzx edx, byte [rsp + rax + 0x22]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0xe
jne 0x140004744
mov byte [0x1409d1608], 1
lea rcx, [0x140001cc8]
call fcn.1400014f0
lea rax, [0x1409d1610]
add rsp, 0x38
ret

Function at 0x140004776
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov byte [rsp + 0x22], 0x11
mov byte [rsp + 0x23], 0x54
mov byte [rsp + 0x24], 0x54
mov byte [rsp + 0x25], 0x5d
mov byte [rsp + 0x26], 0x56
mov byte [rsp + 0x27], 0x52
mov byte [rsp + 0x28], 0x5f
mov byte [rsp + 0x29], 0x56
mov byte [rsp + 0x2a], 0x63
mov byte [rsp + 0x2b], 0x1f
mov byte [rsp + 0x2c], 0x54
mov byte [rsp + 0x2d], 0x60
mov byte [rsp + 0x2e], 0x5e
mov byte [rsp + 0x2f], 0xf1
cmp byte [0x1409d1508], 0
jne 0x140004801
mov byte [0x1409d151e], 1
mov eax, 0
lea rcx, [0x1409d1510]
movzx edx, byte [rsp + rax + 0x22]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0xe
jne 0x1400047dc
mov byte [0x1409d1508], 1
lea rcx, [0x140001d88]
call fcn.1400014f0
lea rax, [0x1409d1510]
add rsp, 0x38
ret
Function at 0x14000480e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 0x11
mov byte [rsp + 0x21], 0x68
mov byte [rsp + 0x22], 0x68
mov byte [rsp + 0x23], 0x68
mov byte [rsp + 0x24], 0x1f
mov byte [rsp + 0x25], 0x65
mov byte [rsp + 0x26], 0x63
mov byte [rsp + 0x27], 0x56
mov byte [rsp + 0x28], 0x5f
mov byte [rsp + 0x29], 0x55
mov byte [rsp + 0x2a], 0x5e
mov byte [rsp + 0x2b], 0x5a
mov byte [rsp + 0x2c], 0x54
mov byte [rsp + 0x2d], 0x63
mov byte [rsp + 0x2e], 0x60
mov byte [rsp + 0x2f], 0x1f
mov byte [rsp + 0x30], 0x54
mov byte [rsp + 0x31], 0x60
mov byte [rsp + 0x32], 0x5e
mov byte [rsp + 0x33], 0xf1
cmp byte [0x1409d1568], 0
jne 0x1400048b7
mov byte [0x1409d1584], 1
mov eax, 0
lea rcx, [0x1409d1570]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x14
jne 0x140004892
mov byte [0x1409d1568], 1
lea rcx, [0x140001d40]
call fcn.1400014f0
lea rax, [0x1409d1570]
add rsp, 0x48
ret

Function at 0x1400048c4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 0x11
mov byte [rsp + 0x21], 0x68
mov byte [rsp + 0x22], 0x68
mov byte [rsp + 0x23], 0x68
mov byte [rsp + 0x24], 0x1f
mov byte [rsp + 0x25], 0x67
mov byte [rsp + 0x26], 0x5a
mov byte [rsp + 0x27], 0x63
mov byte [rsp + 0x28], 0x66
mov byte [rsp + 0x29], 0x64
mov byte [rsp + 0x2a], 0x65
mov byte [rsp + 0x2b], 0x60
mov byte [rsp + 0x2c], 0x65
mov byte [rsp + 0x2d], 0x52
mov byte [rsp + 0x2e], 0x5d
mov byte [rsp + 0x2f], 0x1f
mov byte [rsp + 0x30], 0x54
mov byte [rsp + 0x31], 0x60
mov byte [rsp + 0x32], 0x5e
mov byte [rsp + 0x33], 0xf1
cmp byte [0x1409d14e8], 0
jne 0x14000496d
mov byte [0x1409d1504], 1
mov eax, 0
lea rcx, [0x1409d14f0]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x14
jne 0x140004948
mov byte [0x1409d14e8], 1
lea rcx, [0x140001da0]
call fcn.1400014f0
lea rax, [0x1409d14f0]
add rsp, 0x48
ret
Function at 0x14000a580
Capabilities:
Parse pe header

Disassembly:
test rcx, rcx
je 0x14000a5b0
mov eax, 0
cmp word [rcx], 0x5a4d
jne 0x14000a5af
mov eax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x14000a5b5
cdqe
add rax, rcx
cmp dword [rax], 0x4550
mov edx, 0
cmovne rax, rdx
ret
mov rax, rcx
jmp 0x14000a5af
mov eax, 0
jmp 0x14000a5af

Function at 0x14000ac30
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov rcx, r10
call fcn.14000abe0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140014240
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.14001cd80
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.14001cd80
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]
Function at 0x1400142b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x1409d27f4]
test esi, esi
mov rdi, rcx
mov rbp, rdx
mov rbx, r8
jle 0x140014440
mov rax, qword [0x1409d27f8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rdi, rdx
jb 0x1400142fc
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rdi, rdx
jb 0x140014385
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x1400142e0
mov rcx, rdi
call fcn.140014e10
test rax, rax
mov r12, rax
je 0x140014492
mov rax, qword [0x1409d27f8]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call fcn.140014f50
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x1409d27f8]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140014475
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x14001437e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x1400143f0
add dword [0x1409d27f4], 1
cmp ebx, 8
jae 0x1400143b1
test bl, 4
jne 0x140014450
test ebx, ebx
je 0x1400143a6
movzx eax, byte [rbp]
test bl, 2
mov byte [rdi], al
jne 0x140014464
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, ebx
sub ebx, 1
mov rdx, qword [rbp + rax - 8]
cmp ebx, 8
mov qword [rdi + rax - 8], rdx
jb 0x1400143a6
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, ebx
mov qword [rdi + rdx], rcx
jb 0x1400143ca
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp eax, 2
mov r8d, 4
mov eax, 0x40
mov rcx, qword [rsp + 0x20]
cmovne r8d, eax
mov rdx, qword [rsp + 0x38]
add rsi, qword [0x1409d27f8]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14001437e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140014240
xor esi, esi
jmp 0x140014307
mov eax, dword [rbp]
mov ebx, ebx
mov dword [rdi], eax
mov eax, dword [rbp + rbx - 4]
mov dword [rdi + rbx - 4], eax
jmp 0x1400143a6
mov ebx, ebx
movzx eax, word [rbp + rbx - 2]
mov word [rdi + rbx - 2], ax
jmp 0x1400143a6
mov rax, qword [0x1409d27f8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call fcn.140014240
lea rcx, str.Address__p_has_no_image_section
mov rdx, rdi
call fcn.140014240
nop
nop dword [rax]
nop word cs:[rax + rax]
Function at 0x140014a60
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x1409d2860]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1409d2840]
test rbx, rbx
je 0x140014ab4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x140014aab
test rsi, rsi
je 0x140014aab
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140014a90
lea rcx, [0x1409d2860]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140014e10
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x1409c9b50]
xor edx, edx
cmp word [r9], 0x5a4d
mov r8, rcx
jne 0x140014e7f
mov rcx, r9
call fcn.140014ce0
test eax, eax
je 0x140014e7f
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add r9, rax
movzx eax, word [r9 + 0x14]
lea rdx, [r9 + rax + 0x18]
movzx eax, word [r9 + 6]
test eax, eax
je 0x140014e7d
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x140014e74
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x140014e7f
add rdx, 0x28
cmp rdx, r9
jne 0x140014e60
xor edx, edx
mov rax, rdx
add rsp, 0x28
ret
Function at 0x14001f470
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
lea rcx, [0x1409c4f80]
jmp 0x140015c40

Function at 0x14001f480
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
lea rcx, [0x1409c4f80]
jmp 0x140015c40
Function at 0x1400034a0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x13e0
call fcn.1400bdad0
sub rsp, rax
mov rax, qword [0x140153080]
xor rax, rsp
mov qword [rsp + 0x13d0], rax
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rsp + 0x13c4], 0xffffffff
mov edx, 1
mov dword [rsp + 0x44], eax
nop dword [rax]
nop dword [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rsp + rdx*4 + 0x44], eax
inc rdx
cmp rdx, 0x270
jb 0x1400034f0
mov dword [rsp + 0x40], 0x270
mov edi, reloc.WLDAP32.dll_Ordinal_200
mov dword [rsp + 0x20], 3
mov esi, 0xffffffff
nop dword [rax]
lea rcx, [rsp + 0x40]
call fcn.140003da0
mov ecx, eax
imul rax, rcx, 0x439
cmp eax, 0x319
ja 0x14000356a
nop word [rax + rax]
lea rcx, [rsp + 0x40]
call fcn.140003da0
mov ecx, eax
imul rax, rcx, 0x439
cmp eax, 0x31a
jb 0x140003550
shr rax, 0x20
lea rcx, [rsp + 0x40]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
call fcn.140003da0
mov ecx, eax
mov rbx, rdi
movaps xmm1, xmm0
imul rax, rcx, 0x781
cmp eax, 0x781
jae 0x1400035ba
cmp eax, 0x4eb
jae 0x1400035ba
nop dword [rax]
lea rcx, [rsp + 0x40]
call fcn.140003da0
mov ecx, eax
imul rax, rcx, 0x781
cmp eax, 0x4eb
jb 0x1400035a0
mov rdx, qword [0x1402243e0]
shr rax, 0x20
cmp rdx, qword [0x1402243e8]
movss dword [rsp + 0x28], xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rsp + 0x24], xmm0
je 0x1400035f8
unpcklps xmm0, xmm1
movsd qword [rdx], xmm0
add qword [0x1402243e0], 8
movsd qword [rsp + 0x24], xmm0
jmp 0x140003609
lea r8, [rsp + 0x24]
lea rcx, [0x1402243d8]
call fcn.140003940
lea rcx, [rsp + 0x40]
call fcn.140003da0
mov eax, eax
lea rcx, [rsp + 0x40]
add rax, rax
shr rax, 0x20
lea eax, [rax*2 - 1]
movd xmm1, eax
cvtdq2ps xmm1, xmm1
call fcn.140003da0
mov rdx, qword [0x1402243f8]
mov ecx, eax
mov eax, 1
add rcx, rcx
movss dword [rsp + 0x30], xmm1
shr rcx, 0x20
test ecx, ecx
cmove eax, esi
cmp rdx, qword [0x140224400]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rsp + 0x2c], xmm0
je 0x140003681
unpcklps xmm0, xmm1
movsd qword [rdx], xmm0
add qword [0x1402243f8], 8
movsd qword [rsp + 0x2c], xmm0
jmp 0x140003692
lea r8, [rsp + 0x2c]
lea rcx, [0x1402243f0]
call fcn.140003940
mov rdx, qword [0x140224410]
cmp rdx, qword [0x140224418]
je 0x1400036b2
mov dword [rdx], 3
add qword [0x140224410], 4
jmp 0x1400036bc
lea r8, [rsp + 0x20]
call fcn.140003790
lea rdi, [rbx - 1]
test rdi, rdi
jne 0x140003530
mov rcx, qword [rsp + 0x13d0]
xor rcx, rsp
call fcn.1400bcef0
lea r11, [rsp + 0x13e0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140003da0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x140003e01
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140003dc0
mov ecx, dword [r9]
jmp 0x140003ee8
cmp ecx, 0x4e0
jb 0x140003ee8
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x140003e20
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x140003e70
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret

Function at 0x140005df0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x140005e4d
lea rbx, [0x1400cf680]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140005e34
cmp r10, 2
jb 0x140005e34
cmp byte [r9], r8b
jne 0x140005e34
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140005e10
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x140005e8f
lea rbx, [0x1400cf680]
cmp r8b, 0x23
jne 0x140005e73
cmp byte [r9], r8b
jne 0x140005e73
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140005e60
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x140006050
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, r8
mov rbx, rcx
test rcx, rcx
jne 0x14000607f
mov r8d, 0x645
lea rdx, str.C:UsersGusDesktop_nuzydev0imguiimgui.cpp
lea rcx, str.filename__mode
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
test rdi, rdi
je 0x14000608b
mov qword [rdi], 0
lea rdx, [0x14013ab78]
mov rcx, rbx
call fcn.140005ea0
mov rbx, rax
test rax, rax
jne 0x1400060ad
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x140006184
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140006184
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x140006184
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140006184
cmp rsi, 0xffffffffffffffff
je 0x140006184
mov rax, qword [0x1402240b0]
test rax, rax
je 0x140006121
inc dword [rax + 0x3e8]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbp, rax
test rax, rax
je 0x140006184
mov r9, rbx
mov r8, rsi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rsi
je 0x140006171
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1402240b0]
test rax, rax
je 0x140006166
dec dword [rax + 0x3e8]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14000618d
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rdi, rdi
je 0x14000617f
mov qword [rdi], rsi
mov rax, rbp
jmp 0x14000618f
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret