joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140049360
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov ecx, 0x10
call sub.msvcrt.dll_malloc
test rax, rax
jne 0x14004938a
mov rax, qword [0x14027c368]
call rax
jmp 0x140049370
mov qword [rax], rbx
mov qword [rax + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x1400493e0]
xor ecx, ecx
xor edx, edx
mov r9, rax
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov qword [rsi], rax
test rax, rax
je 0x1400493c8
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.DLL_GetLastError]
Function at 0x14004e1d6
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x328
movaps xmmword [rsp + 0x310], xmm6
mov rbx, r9
mov rdi, r8
mov rsi, rcx
lea r14, [rsp + 0x28]
mov rcx, r14
mov rdx, r8
call fcn.140032da4
cmp byte [r14 + 0x17], 0
jns 0x14004e212
mov r14, qword [rsp + 0x28]
lea rdx, [0x14022bf4a]
mov rcx, r14
call qword [sym.imp.msvcrt.dll__wfopen]
test rax, rax
je 0x14004e25f
mov r15, rax
mov rcx, qword [rbx]
mov r8, qword [rbx + 8]
mov edx, 1
mov r9, rax
call sub.msvcrt.dll_fwrite
mov r14, rax
mov rcx, r15
call sub.msvcrt.dll_fclose
cmp r14, qword [rbx + 8]
jne 0x14004e315
mov byte [rsi + 0xe8], 1
jmp 0x14004e42b
call qword [sym.imp.msvcrt.dll__errno]
mov ebp, dword [rax]
lea rbx, [rsp + 0x90]
xorps xmm6, xmm6
movaps xmmword [rbx - 0x20], xmm6
movaps xmmword [rbx - 0x10], xmm6
mov r14b, 1
lea rdx, [rsp + 0x58]
mov byte [rdx + 0x10], r14b
lea rax, [0x14022bf56]
mov qword [rdx], rax
mov qword [rdx + 8], 0x28
mov rcx, rbx
call fcn.140039a7c
xor eax, eax
mov byte [rbx + 0x20], al
mov byte [rbx + 0x38], al
mov rcx, qword [rdi + 0x10]
mov qword [rbx + 0x50], rcx
movups xmm0, xmmword [rdi]
movaps xmmword [rbx + 0x40], xmm0
and qword [rdi + 0x10], 0
movups xmmword [rdi], xmm6
mov byte [rbx + 0x58], r14b
mov byte [rbx + 0x60], al
mov byte [rbx + 0x68], al
mov byte [rbx + 0x70], al
mov byte [rbx + 0x78], al
mov byte [rbx + 0x80], al
mov byte [rbx + 0x88], al
mov byte [rbx + 0x90], al
mov byte [rbx + 0xa8], al
mov byte [rbx + 0xb0], al
mov byte [rbx + 0xb4], al
mov dword [rbx + 0xb8], ebp
mov byte [rbx + 0xbc], r14b
lea r8, [rsp + 0x40]
mov byte [r8 + 0x10], r14b
lea rax, [0x14022bf7e]
jmp 0x14004e3d2
lea r15, [rsp + 0x90]
xorps xmm6, xmm6
movaps xmmword [r15 - 0x20], xmm6
movaps xmmword [r15 - 0x10], xmm6
mov bpl, 1
lea rdx, [rsp + 0x58]
mov byte [rdx + 0x10], bpl
lea rax, [0x14022c036]
mov qword [rdx], rax
mov qword [rdx + 8], 0x28
mov rcx, r15
call fcn.140039a7c
xor eax, eax
mov byte [r15 + 0x20], al
mov byte [r15 + 0x38], al
mov rcx, qword [rdi + 0x10]
mov qword [r15 + 0x50], rcx
movups xmm0, xmmword [rdi]
movaps xmmword [r15 + 0x40], xmm0
and qword [rdi + 0x10], 0
movups xmmword [rdi], xmm6
mov byte [r15 + 0x58], bpl
mov rcx, qword [rbx + 8]
mov qword [r15 + 0x60], rcx
mov byte [r15 + 0x68], bpl
mov qword [r15 + 0x70], r14
mov byte [r15 + 0x78], bpl
mov byte [r15 + 0x80], al
mov byte [r15 + 0x88], al
mov byte [r15 + 0x90], al
mov byte [r15 + 0xa8], al
mov byte [r15 + 0xb0], al
mov byte [r15 + 0xb4], al
mov byte [r15 + 0xb8], al
mov byte [r15 + 0xbc], al
lea r8, [rsp + 0x40]
mov byte [r8 + 0x10], bpl
lea rax, [0x14022c05e]
mov qword [r8], rax
mov qword [r8 + 8], 0xb8
lea rdi, [rsp + 0x230]
lea rbx, [rsp + 0x70]
mov rcx, rdi
mov rdx, rbx
call fcn.14004e454
lea r14, [rsp + 0x150]
mov rcx, r14
mov rdx, rdi
call fcn.14004e49c
mov rcx, rdi
call fcn.14004e5ca
mov rcx, rbx
call fcn.14004e5ca
mov rcx, rsi
mov rdx, r14
call fcn.14004e60c
mov rcx, r14
call fcn.14004e5ca
mov rcx, qword [rsp + 0x28]
mov dl, byte [rsp + 0x3f]
call fcn.14003ae60
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x310]
add rsp, 0x328
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140051d42
Capabilities:
Get disk size

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x320
movaps xmmword [rsp + 0x310], xmm6
mov rdi, r8
mov rsi, rcx
lea rbx, [rsp + 0x28]
mov rcx, rbx
mov rdx, r8
call fcn.140032da4
cmp byte [rbx + 0x17], 0
jns 0x140051d78
mov rbx, qword [rsp + 0x28]
lea r9, [rsp + 0x20]
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.DLL_GetDiskFreeSpaceExW]
test eax, eax
je 0x140051da3
mov byte [rsi + 0xe8], 1
mov rax, qword [rsp + 0x20]
mov qword [rsi], rax
jmp 0x140051ead
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ebp, eax
lea rbx, [rsp + 0x90]
xorps xmm6, xmm6
movaps xmmword [rbx - 0x20], xmm6
movaps xmmword [rbx - 0x10], xmm6
mov r14b, 1
lea rdx, [rsp + 0x58]
mov byte [rdx + 0x10], r14b
lea rax, [0x14022cd48]
mov qword [rdx], rax
mov qword [rdx + 8], 0x30
mov rcx, rbx
call fcn.140039a7c
xor eax, eax
mov byte [rbx + 0x20], al
mov byte [rbx + 0x38], al
mov rcx, qword [rdi + 0x10]
mov qword [rbx + 0x50], rcx
movups xmm0, xmmword [rdi]
movaps xmmword [rbx + 0x40], xmm0
and qword [rdi + 0x10], 0
movups xmmword [rdi], xmm6
mov byte [rbx + 0x58], r14b
mov byte [rbx + 0x60], al
mov byte [rbx + 0x68], al
mov byte [rbx + 0x70], al
mov byte [rbx + 0x78], al
mov byte [rbx + 0x80], al
mov byte [rbx + 0x88], al
mov byte [rbx + 0x90], al
mov byte [rbx + 0xa8], al
mov dword [rbx + 0xb0], ebp
mov byte [rbx + 0xb4], r14b
mov byte [rbx + 0xb8], al
mov byte [rbx + 0xbc], al
lea r8, [rsp + 0x40]
mov byte [r8 + 0x10], r14b
lea rax, [0x14022cd78]
mov qword [r8], rax
mov qword [r8 + 8], 0xb0
lea rdi, [rsp + 0x230]
lea rbx, [rsp + 0x70]
mov rcx, rdi
mov rdx, rbx
call fcn.14004e454
lea r14, [rsp + 0x150]
mov rcx, r14
mov rdx, rdi
call fcn.14004e49c
mov rcx, rdi
call fcn.14004e5ca
mov rcx, rbx
call fcn.14004e5ca
mov rcx, rsi
mov rdx, r14
call fcn.140051d36
mov rcx, r14
call fcn.14004e5ca
mov rcx, qword [rsp + 0x28]
mov dl, byte [rsp + 0x3f]
call fcn.14003ae60
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x310]
add rsp, 0x320
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x140092bfa
Capabilities:
Hash data using sha256

Disassembly:
push rsi
push rdi
sub rsp, 0x98
mov rsi, r8
mov r8, rdx
mov rdx, rcx
xorps xmm0, xmm0
lea rdi, [rsp + 0x20]
movups xmmword [rdi + 0x5c], xmm0
movaps xmmword [rdi + 0x50], xmm0
movaps xmmword [rdi + 0x40], xmm0
movaps xmmword [rdi + 0x30], xmm0
movaps xmmword [rdi + 0x20], xmm0
movaps xmm0, xmmword [0x14012cbe0]
movaps xmmword [rdi], xmm0
movaps xmm0, xmmword [0x14012cbf0]
movaps xmmword [rdi + 0x10], xmm0
mov dword [rdi + 0x6c], 0x20
mov rcx, rdi
call fcn.1400901d4
mov rcx, rsi
mov rdx, rdi
call fcn.1400902de
mov ecx, 0x70
xor eax, eax
rep stosb byte [rdi], al
mov rax, rsi
add rsp, 0x98
pop rdi
pop rsi
ret

Function at 0x140092c6d
Capabilities:
Hash data using sha512

Disassembly:
push rsi
push rdi
sub rsp, 0xf8
mov rsi, rdx
mov rdx, rcx
movabs rax, 0x6a09e667f3bcc908
lea rdi, [rsp + 0x20]
mov qword [rdi], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rdi + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rdi + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rdi + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rdi + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rdi + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rdi + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rdi + 0x38], rax
movabs rax, 0x4000000000
mov qword [rdi + 0xd0], rax
xorps xmm0, xmm0
movups xmmword [rdi + 0x40], xmm0
mov r8d, 0x20
mov rcx, rdi
call fcn.140091d50
mov rcx, rsi
mov rdx, rdi
call fcn.140091f52
mov ecx, 0xd8
xor eax, eax
rep stosb byte [rdi], al
mov rax, rsi
add rsp, 0xf8
pop rdi
pop rsi
ret
Function at 0x14009a5a5
Capabilities:
Authenticate hmac

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x130
mov rdi, r9
mov rbx, r8
mov r14, rdx
mov rsi, rcx
test r9, r9
mov rax, qword [rcx]
cmove rdi, rax
test rdx, rdx
jne 0x14009a5d7
cmp rdi, rax
je 0x14009a6e7
mov eax, dword [rdi + 0x28]
cmp rax, rbx
jae 0x14009a61e
lea r15, [rsi + 8]
mov rcx, r15
mov rdx, rdi
call fcn.14008c9b1
test eax, eax
je 0x14009a6f9
mov rax, qword [r15]
mov rcx, r15
mov rdx, r14
mov r8, rbx
call qword [rax + 0x18]
lea rdx, [rsp + 0x30]
lea rbx, [rsp + 0x2c]
mov rcx, r15
mov r8, rbx
call fcn.14008ca10
mov ebx, dword [rbx]
jmp 0x14009a637
test rbx, rbx
je 0x14009a633
lea rcx, [rsp + 0x30]
mov rdx, r14
mov r8, rbx
call sub.msvcrt.dll_memcpy
mov dword [rsp + 0x2c], ebx
cmp ebx, 0x80
je 0x14009a659
mov eax, ebx
mov r8d, pe_nt_image_headers64
sub r8, rax
lea rcx, [rsp + rax]
add rcx, 0x30
xor edx, edx
call sub.msvcrt.dll_memset
xor eax, eax
cmp rax, 0x80
je 0x14009a676
mov cl, byte [rsp + rax + 0x30]
xor cl, 0x36
mov byte [rsp + rax + 0xb0], cl
inc rax
jmp 0x14009a65b
lea rbx, [rsi + 0x28]
mov rcx, rbx
mov rdx, rdi
call fcn.14008c9b1
test eax, eax
je 0x14009a6f9
mov r8d, dword [rdi + 0x28]
mov rax, qword [rbx]
lea rdx, [rsp + 0xb0]
mov rcx, rbx
call qword [rax + 0x18]
xor eax, eax
cmp rax, 0x80
je 0x14009a6bb
mov cl, byte [rsp + rax + 0x30]
xor cl, 0x5c
mov byte [rsp + rax + 0xb0], cl
inc rax
jmp 0x14009a6a0
lea rbx, [rsi + 0x48]
mov rcx, rbx
mov rdx, rdi
call fcn.14008c9b1
test eax, eax
je 0x14009a6f9
mov r8d, dword [rdi + 0x28]
mov rax, qword [rsi + 0x48]
lea rdx, [rsp + 0xb0]
mov rcx, rbx
call qword [rax + 0x18]
mov qword [rsi], rdi
lea rcx, [rsi + 8]
add rsi, 0x28
mov rdx, rsi
call fcn.14008ca71
jmp 0x14009a6fb
xor eax, eax
add rsp, 0x130
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400ab232
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
cmp dword [0x14027c370], 0
je 0x1400ab323
mov rsi, rcx
test rcx, rcx
je 0x1400ab32f
lea rcx, [rsi + 0x2d0]
mov r8d, 0x88
xor edx, edx
call sub.msvcrt.dll_memset
mov ecx, dword [0x14027d9a0]
call sub.KERNEL32.DLL_TlsGetValue
cmp rax, rsi
jne 0x1400ab27b
xor ecx, ecx
call fcn.1400ada5e
cmp qword [rsi + 0x50], 0
je 0x1400ab28a
mov rcx, rsi
call fcn.1400acf34
mov rax, qword [rsi + 0x278]
test rax, rax
je 0x1400ab29b
mov rcx, rsi
call rax
cmp qword [0x14027e7f8], rsi
jne 0x1400ab2ac
and qword [0x14027e7f8], 0
mov rcx, qword [rsi + 0x358]
test rcx, rcx
je 0x1400ab2da
lea rdx, str.GLFW
call qword [sym.imp.USER32.dll_RemovePropW]
mov rcx, qword [rsi + 0x358]
call qword [sym.imp.USER32.dll_DestroyWindow]
and qword [rsi + 0x358], 0
mov rcx, qword [rsi + 0x360]
test rcx, rcx
je 0x1400ab2ec
call qword [sym.imp.USER32.dll_DestroyIcon]
mov rcx, qword [rsi + 0x368]
test rcx, rcx
je 0x1400ab2fe
call qword [sym.imp.USER32.dll_DestroyIcon]
lea rcx, [0x14027c770]
mov rax, rcx
mov rcx, qword [rcx]
cmp rcx, rsi
jne 0x1400ab305
mov rcx, qword [rsi]
mov qword [rax], rcx
mov rcx, rsi
add rsp, 0x20
pop rsi
jmp sub.msvcrt.dll_free
mov ecx, 0x10001
xor edx, edx
call fcn.1400ab5f4
nop
add rsp, 0x20
pop rsi
ret
Function at 0x1400abc8f
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
test rcx, rcx
je 0x1400abca0
and qword [rsi], 0
cmp dword [0x14027c370], 0
je 0x1400abcc0
mov ecx, dword [0x14027d998]
call sub.KERNEL32.DLL_TlsGetValue
mov rcx, rax
test rax, rax
jne 0x1400abcc7
xor eax, eax
jmp 0x1400abcde
lea rcx, [0x14027eab0]
mov eax, dword [rcx + 8]
and dword [rcx + 8], 0
test rsi, rsi
je 0x1400abcde
test eax, eax
je 0x1400abcde
add rcx, 0xc
mov qword [rsi], rcx
add rsp, 0x20
pop rsi
ret

Function at 0x1400acd48
Capabilities:
Register raw input devices

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [0x14027e7f8], rcx
lea rdx, [0x14027e7e8]
lea r8, [0x14027e7f0]
call fcn.1400ad6cc
mov rcx, rsi
call fcn.1400ad64e
mov rcx, rsi
call fcn.1400ae35a
mov rcx, rsi
call fcn.1400acecd
cmp dword [rsi + 0x200], 0
je 0x1400acdc8
lea rcx, [rsp + 0x20]
mov qword [rcx], 0x20001
mov rax, qword [rsi + 0x358]
mov qword [rcx + 8], rax
mov edx, 1
mov r8d, 0x10
call qword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x1400acdc8
lea rdx, str.Win32:_Failed_to_register_raw_input_device
mov ecx, 0x10008
call fcn.1400f9637
nop
add rsp, 0x30
pop rsi
ret

Function at 0x1400acdcf
Capabilities:
Register raw input devices

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
cmp dword [rcx + 0x200], 0
je 0x1400ace15
movups xmm0, xmmword [0x140235648]
lea rcx, [rsp + 0x20]
movaps xmmword [rcx], xmm0
mov edx, 1
mov r8d, 0x10
call qword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x1400ace15
lea rdx, str.Win32:_Failed_to_remove_raw_input_device
mov ecx, 0x10008
call fcn.1400f9637
and qword [0x14027e7f8], 0
xor ecx, ecx
call fcn.1400acecd
movsd xmm1, qword [0x14027e7e8]
movsd xmm2, qword [0x14027e7f0]
mov rcx, rsi
call fcn.1400ad68c
mov rcx, rsi
add rsp, 0x30
pop rsi
jmp fcn.1400ad64e

Function at 0x1400ace49
Capabilities:
Log keystrokes via polling

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x10
call rdi
movzx esi, ax
shr esi, 0xf
mov ecx, 0x11
call rdi
lea ebx, [rsi + 2]
test ax, ax
cmovns ebx, esi
mov ecx, 0x12
call rdi
lea r14d, [rbx + 4]
test ax, ax
cmovns r14d, ebx
mov ecx, 0x5b
call rdi
mov esi, eax
mov ecx, 0x5c
call rdi
lea ebx, [r14 + 8]
or ax, si
cmovns ebx, r14d
mov ecx, 0x14
call rdi
mov esi, eax
shl esi, 4
and esi, 0x10
mov ecx, 0x90
call rdi
shl eax, 5
and eax, 0x20
or eax, esi
or eax, ebx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400ada5e
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x14027d9a0]
call sub.KERNEL32.DLL_TlsGetValue
cmp dword [0x14027c370], 0
je 0x1400adaa0
test rsi, rsi
mov rdx, rsi
je 0x1400adaa9
cmp dword [rdx + 0x208], 0
je 0x1400adad0
test rax, rax
je 0x1400adac1
mov ecx, dword [rdx + 0x20c]
cmp ecx, dword [rax + 0x20c]
jne 0x1400adaae
jmp 0x1400adac1
mov ecx, 0x10001
xor edx, edx
jmp 0x1400adadc
test rax, rax
je 0x1400adae1
xor ecx, ecx
mov rsi, rdx
call qword [rax + 0x250]
mov rdx, rsi
test rsi, rsi
je 0x1400adae1
mov rcx, rdx
add rsp, 0x20
pop rsi
jmp qword [rdx + 0x250]
lea rdx, str.Cannot_make_current_with_a_window_that_has_no_OpenGL_or_OpenGL_ES_context
mov ecx, 0x1000a
call fcn.1400ab5f4
nop
add rsp, 0x20
pop rsi
ret

Function at 0x1400adb12
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
cmp dword [0x14027c370], 0
je 0x1400adb88
mov rsi, rcx
mov ecx, dword [0x14027d9a0]
call sub.KERNEL32.DLL_TlsGetValue
test rax, rax
je 0x1400adb98
cmp byte [rsi], 0
je 0x1400adba6
mov rdi, rax
cmp dword [rax + 0x210], 3
jl 0x1400adbb4
lea rdx, [rsp + 0x2c]
mov ecx, 0x821d
call qword [rdi + 0x240]
xor ebx, ebx
cmp ebx, dword [rsp + 0x2c]
jge 0x1400adbd8
mov ecx, 0x1f03
mov edx, ebx
call qword [rdi + 0x238]
test rax, rax
je 0x1400adbe5
mov rcx, rax
mov rdx, rsi
call sub.msvcrt.dll_strcmp
inc ebx
test eax, eax
jne 0x1400adb58
mov ebx, 1
jmp 0x1400adbf8
xor ebx, ebx
mov ecx, 0x10001
xor edx, edx
call fcn.1400ab5f4
jmp 0x1400adbf8
lea rdx, str.Cannot_query_extension_without_a_current_OpenGL_or_OpenGL_ES_context
mov ecx, 0x10002
jmp 0x1400adbf1
lea rdx, str.Extension_name_cannot_be_an_empty_string
mov ecx, 0x10004
jmp 0x1400adbf1
mov ecx, 0x1f03
call qword [rdi + 0x248]
test rax, rax
je 0x1400adbe5
mov rcx, rsi
mov rdx, rax
call fcn.1400adc02
mov ebx, 1
test eax, eax
jne 0x1400adbf8
mov rcx, rsi
call qword [rdi + 0x268]
mov ebx, eax
jmp 0x1400adbf8
lea rdx, str.Extension_string_retrieval_is_broken
mov ecx, 0x10008
call fcn.1400ab5f4
xor ebx, ebx
mov eax, ebx
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400caa39
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, eax
mov ecx, dword [0x14027efb0]
call qword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov rdi, rax
mov ecx, esi
call qword [sym.imp.KERNEL32.DLL_SetLastError]
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x1400caa68
Capabilities:
Set thread local storage value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov ebx, ecx
lea rcx, [0x14027efa8]
lea rdx, [0x1400caa16]
call fcn.1400ca99e
cmp dword [0x14027efa0], 0
je 0x1400caaa0
mov rcx, rsi
call rdi
xor eax, eax
jmp 0x1400caada
call fcn.1400caa39
mov r14, rax
test rax, rax
je 0x1400caae6
lea r15, [0x14027ef28]
mov rcx, r15
call sub.KERNEL32.DLL_AcquireSRWLockExclusive
mov ebx, ebx
lea rax, [0x14027ef00]
mov qword [rax + rbx*8], rdi
mov rcx, r15
call sub.KERNEL32.DLL_ReleaseSRWLockExclusive
mov qword [r14 + rbx*8], rsi
mov eax, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, 0x28
call fcn.140081d70
test rax, rax
je 0x1400caa97
mov r14, rax
xorps xmm0, xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax], xmm0
and qword [rax + 0x20], 0
mov ecx, dword [0x14027efb0]
mov rdx, rax
call qword [sym.imp.KERNEL32.DLL_TlsSetValue]
test eax, eax
jne 0x1400caaad
mov rcx, r14
call fcn.140081da5
jmp 0x1400caa97

Function at 0x1400df7d9
Capabilities:
Hash data using sha256

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xe8
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov r14, qword [rcx]
movzx ecx, word [r14 + 0x10]
call fcn.140079dd8
xorps xmm0, xmm0
cmp ax, 0x304
jb 0x1400df848
lea rdx, [rsp + 0x30]
movaps xmmword [rdx], xmm0
mov rcx, rbx
mov r8d, 2
call fcn.1400d80a7
mov ebx, eax
test al, al
je 0x1400df839
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov r8, rdi
call fcn.140092bfa
mov qword [rsi], 0x20
lea rcx, [rsp + 0x30]
call fcn.140078b08
jmp 0x1400df937
lea rcx, [rsp + 0x30]
movups xmmword [rcx + 0x5c], xmm0
movaps xmmword [rcx + 0x50], xmm0
movaps xmmword [rcx + 0x40], xmm0
movaps xmmword [rcx + 0x30], xmm0
movaps xmmword [rcx + 0x20], xmm0
movaps xmm0, xmmword [0x14012cdc0]
movaps xmmword [rcx], xmm0
movaps xmm0, xmmword [0x14012cdd0]
movaps xmmword [rcx + 0x10], xmm0
mov dword [rcx + 0x6c], 0x20
lea rdx, str.TLS_Channel_ID_signature
mov r8d, 0x19
call fcn.1400901d4
cmp qword [r14 + 0x58], 0
je 0x1400df8cf
lea rdx, str.Resumption
lea rcx, [rsp + 0x30]
mov r8d, 0xb
call fcn.1400901d4
mov rdx, qword [r14 + 0x58]
movzx r8d, byte [rdx + 0x170]
test r8, r8
je 0x1400df91f
add rdx, 0x130
lea rcx, [rsp + 0x30]
call fcn.1400901d4
add rbx, 0x198
lea rdx, [rsp + 0xa0]
lea r8, [rsp + 0x28]
mov rcx, rbx
call fcn.1401065c0
mov ebx, eax
test al, al
je 0x1400df937
mov r8, qword [rsp + 0x28]
lea r14, [rsp + 0x30]
lea rdx, [rsp + 0xa0]
mov rcx, r14
call fcn.1400901d4
mov rcx, rdi
mov rdx, r14
call fcn.1400902de
mov qword [rsi], 0x20
jmp 0x1400df937
lea r8, [0x14023c20e]
mov ecx, 0x10
mov edx, 0x44
call fcn.140078457
xor ebx, ebx
mov eax, ebx
add rsp, 0xe8
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400f2bbb
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
test rsi, rsi
je 0x1400f2bf7
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x1400f2c01
sub rsi, rbx
add rdi, rbx
jmp 0x1400f2bd0
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call sub.msvcrt.dll_abort
int3
Function at 0x1400f9530
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call qword [sym.imp.KERNEL32.DLL_TlsAlloc]
mov dword [rsi + 4], eax
cmp eax, 0xffffffff
je 0x1400f9553
mov dword [rsi], 1
mov eax, 1
jmp 0x1400f9566
lea rdx, [0x1402550a0]
mov ecx, 0x10008
call fcn.1400f9637
xor eax, eax
add rsp, 0x20
pop rsi
ret

Function at 0x1400f97a5
Capabilities:
Log keystrokes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x178
movaps xmmword [rsp + 0x160], xmm6
xor r14d, r14d
lea rsi, [rsp + 0x60]
mov r8d, 0x100
mov rcx, rsi
xor edx, edx
call sub.msvcrt.dll_memset
lea rcx, [0x14027e112]
mov r8d, 0x6d1
xor edx, edx
call sub.msvcrt.dll_memset
lea r15, [0x14027c370]
lea rdi, [rsp + 0x40]
mov r13, qword [sym.imp.USER32.dll_ToUnicode]
xorps xmm6, xmm6
xor r12d, r12d
cmp r12, 0x13d
je 0x1400f98c9
movsx ebx, word [r15 + r12*2 + 0x1b28]
cmp ebx, 0xffffffff
je 0x1400f98bd
lea rax, [r12 - 0x120]
cmp eax, 0xe
ja 0x1400f983f
mov eax, eax
lea rcx, str._abcdefghinojmk
mov ebp, dword [rcx + rax*4]
jmp 0x1400f984e
mov ecx, ebx
mov edx, 1
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov ebp, eax
and dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10
mov ecx, ebp
mov edx, ebx
mov r8, rsi
mov r9, rdi
call r13
cmp eax, 0xffffffff
jne 0x1400f9887
and dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10
mov ecx, ebp
mov edx, ebx
mov r8, rsi
mov r9, rdi
call r13
test eax, eax
jle 0x1400f98bd
lea rax, [r14 + r15]
add rax, 0x1e42
movups xmmword [rsp + 0x30], xmm6
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 5
mov ecx, 0xfde9
xor edx, edx
mov r8, rdi
mov r9d, 1
call qword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
inc r12
add r14, 5
jmp 0x1400f9805
movaps xmm6, xmmword [rsp + 0x160]
add rsp, 0x178
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14010fe03
Capabilities:
Encrypt data using curve25519

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x100
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
lea r14, [rsp + 0x20]
mov rcx, r8
mov rdx, r14
call fcn.140092c6d
and byte [r14], 0xf8
mov al, byte [r14 + 0x1f]
and al, 0x3f
or al, 0x40
mov byte [r14 + 0x1f], al
lea r15, [rsp + 0x60]
mov rcx, r15
mov rdx, r14
call fcn.14010f051
mov rcx, rbx
mov rdx, r15
call fcn.14010fe81
movups xmm0, xmmword [rdi]
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
movups xmm0, xmmword [rbx]
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsi + 0x20], xmm0
movups xmmword [rsi + 0x30], xmm1
add rsp, 0x100
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x1401101d7
Capabilities:
Encrypt data using curve25519

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x160
mov rsi, rcx
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
lea rdx, [rsp + 0x20]
movaps xmmword [rdx], xmm0
movaps xmmword [rdx + 0x10], xmm1
and byte [rdx], 0xf8
mov al, byte [rdx + 0x1f]
and al, 0x3f
or al, 0x40
mov byte [rdx + 0x1f], al
lea rbx, [rsp + 0xc0]
mov rcx, rbx
call fcn.14010f051
mov rax, qword [rbx + 0x70]
mov rcx, qword [rbx + 0x48]
lea rdx, [rcx + rax]
movdqu xmm0, xmmword [rbx + 0x50]
movdqu xmm1, xmmword [rbx + 0x28]
movdqu xmm2, xmmword [rbx + 0x38]
movdqa xmm3, xmm1
paddq xmm3, xmm0
lea rdi, [rsp + 0x70]
movdqa xmmword [rdi], xmm3
movdqu xmm3, xmmword [rbx + 0x60]
movdqa xmm4, xmm2
paddq xmm4, xmm3
movdqa xmmword [rdi + 0x10], xmm4
mov qword [rdi + 0x20], rdx
sub rax, rcx
movabs rcx, 0xffffffffffffe
psubq xmm0, xmm1
paddq xmm0, xmmword [0x14012d300]
add rcx, rax
psubq xmm3, xmm2
paddq xmm3, xmmword [0x14012d310]
lea rdx, [rsp + 0x40]
movdqa xmmword [rdx], xmm0
movdqa xmmword [rdx + 0x10], xmm3
mov qword [rdx + 0x20], rcx
lea rbx, [rsp + 0x98]
mov rcx, rbx
call fcn.14010e427
mov rcx, rbx
mov rdx, rdi
mov r8, rbx
call fcn.14010dd78
mov rcx, rsi
mov rdx, rbx
call fcn.14010e169
nop
add rsp, 0x160
pop rbx
pop rdi
pop rsi
ret