joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140215b90
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
call fcn.140214830
mov ecx, dword [0x140328f38]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140215c08
test byte [rbx + 0x40], 0xc
jne 0x140215bbf
mov eax, dword [0x14041fc88]
test eax, eax
jne 0x140215bd0
add rsp, 0x28
pop rbx
pop rsi
ret
lea rsi, [rbx + 0x38]
mov rcx, rsi
call fcn.140213ae0
movzx eax, byte [rbx + 0x40]
test al, 3
je 0x140215bf3
mov edx, dword [rbx + 0x44]
test dl, 1
je 0x140215bf3
mov ecx, dword [rbx + 0x20]
test ecx, ecx
jle 0x140215c1c
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.140213db0
call fcn.1402148e0
mov rbx, rax
test rax, rax
jne 0x140215baf
add rsp, 0x28
pop rbx
pop rsi
ret
and eax, 0xfffffff3
mov rcx, qword [rbx + 0x30]
and edx, 0xfffffffe
or eax, 4
mov dword [rbx + 0x44], edx
mov byte [rbx + 0x40], al
test rcx, rcx
je 0x140215c3a
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, rsi
call fcn.140213db0
call fcn.140215ab0
nop
nop dword [rax + rax]
push rdi
push rsi
push rbx
sub rsp, 0x20
test rcx, rcx
je 0x140215cb8
call fcn.1402137a0
mov rsi, rax
mov eax, 0xffffffff
cmp rsi, rax
cmovbe rax, rsi
mov rdi, rax
call fcn.140214830
mov ecx, dword [0x140328f38]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140215d00
test rsi, rsi
je 0x140215cce
call fcn.140215b90
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140215cf0
mov edx, edi
call fcn.140213870
call fcn.140215b90
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.140214830
mov ecx, dword [0x140328f38]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140215d10
call fcn.140215b90
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140215b90
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140215ca6
call fcn.1402148e0
mov rbx, rax
jmp 0x140215c8c
call fcn.1402148e0
jmp 0x140215cce
Function at 0x140215c50
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
call fcn.140214830
mov ecx, dword [0x140328f38]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140215c08
test byte [rbx + 0x40], 0xc
jne 0x140215bbf
mov eax, dword [0x14041fc88]
test eax, eax
jne 0x140215bd0
add rsp, 0x28
pop rbx
pop rsi
ret
lea rsi, [rbx + 0x38]
mov rcx, rsi
call fcn.140213ae0
movzx eax, byte [rbx + 0x40]
test al, 3
je 0x140215bf3
mov edx, dword [rbx + 0x44]
test dl, 1
je 0x140215bf3
mov ecx, dword [rbx + 0x20]
test ecx, ecx
jle 0x140215c1c
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.140213db0
call fcn.1402148e0
mov rbx, rax
test rax, rax
jne 0x140215baf
add rsp, 0x28
pop rbx
pop rsi
ret
and eax, 0xfffffff3
mov rcx, qword [rbx + 0x30]
and edx, 0xfffffffe
or eax, 4
mov dword [rbx + 0x44], edx
mov byte [rbx + 0x40], al
test rcx, rcx
je 0x140215c3a
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, rsi
call fcn.140213db0
call fcn.140215ab0
nop
nop dword [rax + rax]
push rdi
push rsi
push rbx
sub rsp, 0x20
test rcx, rcx
je 0x140215cb8
call fcn.1402137a0
mov rsi, rax
mov eax, 0xffffffff
cmp rsi, rax
cmovbe rax, rsi
mov rdi, rax
call fcn.140214830
mov ecx, dword [0x140328f38]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140215d00
test rsi, rsi
je 0x140215cce
call fcn.140215b90
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140215cf0
mov edx, edi
call fcn.140213870
call fcn.140215b90
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.140214830
mov ecx, dword [0x140328f38]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140215d10
call fcn.140215b90
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140215b90
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140215ca6
call fcn.1402148e0
mov rbx, rax
jmp 0x140215c8c
call fcn.1402148e0
jmp 0x140215cce

Function at 0x140215d20
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov esi, ecx
call fcn.140214830
mov ecx, dword [0x140328f38]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140215d90
test esi, esi
je 0x140215d70
call fcn.140215b90
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140215da0
mov edx, esi
call fcn.140213870
call fcn.140215b90
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
call fcn.140215b90
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140215b90
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
call fcn.1402148e0
mov rbx, rax
jmp 0x140215d41
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140215d5a
Function at 0x4157c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41594b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00432400
xorps xmm15, xmm15
mov r14, qword [0x006a0818]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x415825
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x415834
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x415853
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x415863
cmp rbx, 0x1000
jae 0x41582b
jmp 0x4158cd
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x415875
xor edx, edx
jmp 0x4158c4
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00432400
xorps xmm15, xmm15
mov r14, qword [0x006a0818]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x415859
jmp 0x415848
call fcn.004640e0
xorps xmm15, xmm15
mov r14, qword [0x006a0818]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.004364a0
lea rax, [0x0053930d]
mov ebx, 0x18
nop dword [rax]
call fcn.00436d20
mov rax, qword [rsp + 0x38]
call fcn.00436a60
lea rax, [0x005395cb]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00436d20
mov rax, qword [rsp + 0x30]
call fcn.00436a60
call fcn.004366e0
call fcn.00436500
lea rax, [0x0053b141]
mov ebx, 0x21
call fcn.00434a00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004609c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004157c0
Function at 0x415980
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x415ba6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00432480
xorps xmm15, xmm15
mov r14, qword [0x006a0818]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x4159f3
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x415a02
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x415a25
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x415a35
cmp rbx, 0x1000
jae 0x4159f9
nop
jmp 0x415ab8
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x415a4d
xor esi, esi
jmp 0x415aaa
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00432480
xorps xmm15, xmm15
mov r14, qword [0x006a0818]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x415a2b
jmp 0x415a16
call fcn.004640e0
xorps xmm15, xmm15
mov r14, qword [0x006a0818]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x415b40
nop dword [rax + rax]
call fcn.004364a0
lea rax, [0x005395e4]
mov ebx, 0x19
call fcn.00436d20
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.00436a60
lea rax, [0x005395cb]
mov ebx, 0x19
call fcn.00436d20
mov eax, dword [rsp + 0x34]
call fcn.00436a60
nop
call fcn.004366e0
call fcn.00436500
lea rax, [0x00536d04]
mov ebx, 0xd
call fcn.00434a00
nop dword [rax + rax]
cmp eax, 0x5af
je 0x415ae0
call fcn.004364a0
lea rax, [0x005395e4]
mov ebx, 0x19
call fcn.00436d20
mov rax, qword [rsp + 0x38]
call fcn.00436a60
lea rax, [0x005395cb]
mov ebx, 0x19
call fcn.00436d20
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.00436a60
call fcn.004366e0
call fcn.00436500
lea rax, [0x0053aae4]
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.00434a00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004609c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00415980
Function at 0x41e100
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x006a0612], 0
jne 0x41e1f0
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x48]
test byte [rdx], al
mov ecx, dword [rax + 0x5c]
imul rcx, rbx
mov rbx, rcx
shr rbx, 0x20
shr rcx, 0x23
and ebx, 7
mov rsi, rcx
mov rcx, rbx
mov edi, 1
shl edi, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], dil
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
add rdx, rcx
mov rbx, rdx
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x41e1e3
lea rsi, [0x00632718]
mov rdx, qword [rsi + rdx*8]
test byte [rdx], al
mov rsi, rcx
shr rsi, 0x10
and esi, 0x3f
shr rcx, 0xd
and ecx, 7
mov edi, 1
shl edi, cl
shr rbx, 0x16
and ebx, 0xfffff
mov rdx, qword [rdx + rbx*8]
test byte [rdx], al
movzx ebx, byte [rdx + rsi + 0x1040]
lea rdx, [rdx + rsi]
lea rdx, [rdx + 0x1040]
test dil, bl
jne 0x41e1be
lock or byte [rdx], dil
mov rcx, qword [r14 + 0x30]
mov rcx, qword [rcx + 0xa0]
test byte [rcx], al
mov rdx, qword [rcx + 0x1270]
add rdx, qword [rax + 0x68]
mov qword [rcx + 0x1270], rdx
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call fcn.00462cc0
lea rax, [0x0053c8ce]
mov ebx, 0x2c
nop dword [rax]
call fcn.00434a00
nop
int3

Function at 0x420640
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x420746
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov byte [rsp + 0x70], dil
mov qword [rsp + 0x10], 0
jmp 0x420683
mov rax, qword [rsp + 0x58]
mov rcx, rdx
mov rbx, qword [rsp + 0x60]
movzx edi, byte [rsp + 0x70]
cmp qword [rsp + 0x10], rbx
jae 0x42073b
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call fcn.00421420
test rax, rax
je 0x42073b
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x00420780]
mov qword [rsp + 0x18], rcx
lea rdx, [rsp + 0x10]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x18]
mov qword [rsp], rbx
nop dword [rax]
call fcn.004608a0
xorps xmm15, xmm15
mov r14, qword [0x006a0818]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x68]
nop dword [rax]
test rdx, rdx
jne 0x420729
xor eax, eax
jmp 0x420733
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x68]
test al, al
je 0x420671
mov rax, qword [rsp + 0x10]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.004609c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.00420640
Function at 0x43fac0
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [0x006a05d0]
test rcx, rcx
jne 0x43fae4
xor ecx, ecx
xor edx, edx
jmp 0x43faf9
call fcn.00453f20
mov rcx, rbx
mov rdx, rax
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], r14
mov rsi, qword [r14 + 0x30]
inc dword [rsi + 0xd8]
mov qword [r14 + 0x10], 0xfffffffffffffade
mov byte [r14 + 0xb7], 1
call fcn.0043fa60
mov rcx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x20]
mov qword [rax + 0x70], rcx
mov rdx, qword [rsp + 0x60]
mov qword [rax + 0x78], rdx
mov ebx, 2
mov ecx, 3
call fcn.00439380
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rcx + 0x70]
cmp qword [rcx], rdx
ja 0x43fb66
nop dword [rax + rax]
cmp qword [rcx + 8], rdx
jae 0x43fba2
movups xmmword [rsp + 0x40], xmm15
lea rax, [0x0043fdc0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rcx
lea rax, [rsp + 0x40]
mov qword [rsp], rax
call fcn.004608a0
xorps xmm15, xmm15
mov r14, qword [0x006a0818]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x10]
test rax, rax
je 0x43fc0b
movups xmmword [rsp + 0x28], xmm15
mov qword [rsp + 0x38], 0
lea rcx, [0x0043fd40]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x28]
mov qword [rsp], rax
nop
call fcn.004608a0
xorps xmm15, xmm15
mov r14, qword [0x006a0818]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
call fcn.0043fa60
mov rcx, qword [rsp + 0x20]
mov al, byte [0x0061ccb8]
test al, al
je 0x43fc4b
lea rax, [0x0053e5d0]
mov qword [rsp], rax
call fcn.004608a0
xorps xmm15, xmm15
mov r14, qword [0x006a0818]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
call fcn.0043fa60
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
cmp dword [rax + 0x2298], 0
nop
je 0x43fc98
lea rax, fcn.0043ac00
mov qword [rsp], rax
call fcn.004608a0
xorps xmm15, xmm15
mov r14, qword [0x006a0818]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
call fcn.0043fa60
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx + 0x30]
mov rdx, qword [rax + 0xa0]
mov edx, dword [rdx + 0x14]
mov dword [rax + 0x388], edx
mov rax, qword [rcx + 0x30]
mov rax, qword [rax + 0xa0]
mov qword [rax + 0x38], 0
mov rdx, qword [rcx + 0x30]
mov rbx, rax
mov qword [rdx + 0xb0], rax
mov rax, qword [rcx + 0x30]
mov qword [rax + 0xa0], 0
mov eax, 2
xchg dword [rbx + 4], eax
mov al, byte [0x0061cca8]
test al, al
je 0x43fd24
lea rax, [0x0053e5c8]
mov qword [rsp], rax
call fcn.004608a0
xorps xmm15, xmm15
mov r14, qword [0x006a0818]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
call fcn.0043fa60
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx + 0x30]
dec dword [rax + 0xd8]
add rsp, 0x50
pop rbp
ret
Function at 0x4449c0
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x444b27
push rbp
mov rbp, rsp
sub rsp, 0x18
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x4449d2
cmp edx, ecx
jne 0x444b15
nop word [rax + rax]
test rsi, rsi
jne 0x444b15
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x444a34
nop
call fcn.004645a0
xorps xmm15, xmm15
mov r14, qword [0x006a0818]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call fcn.004448e0
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx]
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1b
add edx, ebx
mov esi, edx
and edx, 0xffffffe0
sub ebx, edx
test ebx, ebx
jl 0x444b10
mov rdx, qword [0x0061b2a8]
sar esi, 5
mov rax, rcx
mov ecx, ebx
mov edi, 1
shl edi, cl
movsxd rsi, esi
cmp ecx, 0x20
sbb r8d, r8d
and edi, r8d
cmp rdx, rsi
jbe 0x444b05
mov rcx, qword [0x0061b2a0]
lea rcx, [rcx + rsi*4]
lock or dword [rcx], edi
mov rcx, qword [0x0061cc10]
mov qword [rax + 8], rcx
mov rcx, rax
nop
mov qword [0x0061cc10], rax
nop
mov edx, 1
lea rsi, [0x0061cc18]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1248]
shr rdx, 0x3d
test dl, dl
jne 0x444af3
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
nop
nop
xchg qword [rcx + 0x1248], rdx
add rsp, 0x18
pop rbp
ret
lea rax, [0x0053c190]
mov ebx, 0x28
nop
call fcn.00434a00
mov rax, rsi
mov rcx, rdx
call fcn.00462ca0
call fcn.004335e0
lea rax, [0x0053b623]
mov ebx, 0x23
call fcn.00434a00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004609c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004449c0
Function at 0x4c1100
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c11ca
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403300
xorps xmm15, xmm15
mov r14, qword [0x006a0818]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x4c11af
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x00502e80]
xor ebx, ebx
mov rcx, rdx
call fcn.00449100
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.004c1700
inc rbx
cmp rcx, rbx
jae 0x4c119e
mov edi, 1
lea rsi, [0x00502e80]
call fcn.004491e0
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x0055bf58]
lea rsi, [0x0055bbd0]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004609c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004c1100
Function at 0x140001540
Capabilities:
Check for unmoving mouse cursor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rax, qword [0x1400cb100]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rcx
movaps xmm6, xmm2
lea rcx, [rsp + 0x20]
movzx edi, dl
call fcn.140001ce0
xorps xmm0, xmm0
comiss xmm0, xmm6
jae 0x140001727
cmp byte [0x1400cbdf0], 0
jne 0x14000158b
addss xmm6, dword [rbx + 4]
movss xmm0, dword [0x1400b986c]
divss xmm0, xmm6
mulss xmm0, dword [0x1400b9718]
movss dword [rbx], xmm0
cmp byte [0x1400cbdf0], 0
jne 0x1400015c9
movss xmm1, dword [0x1400cbe04]
movss xmm0, dword [0x1400b9764]
call fcn.140001b30
addss xmm0, dword [rbx]
movss dword [rbx], xmm0
movsd xmm6, qword [0x1400b97d0]
cvtss2sd xmm0, xmm0
divsd xmm0, xmm6
call fcn.1400561c0
lea rcx, [rsp + 0x28]
test dil, dil
je 0x140001660
xor edi, edi
mov qword [rsp + 0x28], rdi
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x140001625
call qword [sym.imp.USER32.dll_GetForegroundWindow]
movzx r9d, word [rsp + 0x2c]
mov edx, 0x201
movzx ecx, word [rsp + 0x28]
mov r8d, 1
shl r9d, 0x10
or r9, rcx
mov rcx, rax
call qword [sym.imp.USER32.dll_PostMessageW]
movss xmm0, dword [rbx]
cvtps2pd xmm0, xmm0
divsd xmm0, xmm6
call fcn.1400561c0
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x28], rdi
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x1400016ed
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov edx, 0x202
mov r8d, 1
jmp 0x1400016d2
xor edi, edi
mov qword [rsp + 0x28], rdi
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x14000169d
call qword [sym.imp.USER32.dll_GetForegroundWindow]
movzx r9d, word [rsp + 0x2c]
mov edx, 0x204
movzx ecx, word [rsp + 0x28]
mov r8d, 2
shl r9d, 0x10
or r9, rcx
mov rcx, rax
call qword [sym.imp.USER32.dll_PostMessageW]
movss xmm0, dword [rbx]
cvtps2pd xmm0, xmm0
divsd xmm0, xmm6
call fcn.1400561c0
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x28], rdi
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x1400016ed
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov edx, 0x205
mov r8d, 2
movzx r9d, word [rsp + 0x2c]
movzx ecx, word [rsp + 0x28]
shl r9d, 0x10
or r9, rcx
mov rcx, rax
call qword [sym.imp.USER32.dll_PostMessageW]
lea rcx, [rsp + 0x28]
call fcn.140001ce0
mov rax, qword [rsp + 0x28]
xorps xmm0, xmm0
sub rax, qword [rsp + 0x20]
inc dword [0x1400ce1d4]
cvtsi2sd xmm0, rax
divsd xmm0, qword [0x1400b9808]
divsd xmm6, xmm0
cvtpd2ps xmm0, xmm6
movss dword [0x1400ce1d8], xmm0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400587d0
mov rbx, qword [rsp + 0x68]
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rdi
ret
Function at 0x140001b30
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, 0x13e8
call fcn.140059320
sub rsp, rax
movaps xmmword [rsp + 0x13d0], xmm6
movaps xmmword [rsp + 0x13c0], xmm7
mov rax, qword [0x1400cb100]
xor rax, rsp
mov qword [rsp + 0x13b0], rax
movaps xmm6, xmm1
movaps xmm7, xmm0
call fcn.1400568a4
mov edx, eax
mov ecx, 1
movabs rax, 0x5555555555555555
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x13a8], rax
movabs r9, 0x5851f42d4c957f2d
mov r8d, 0x138
nop dword [rax + rax]
mov rax, rdx
shr rax, 0x3e
xor rdx, rax
imul rdx, r9
add rdx, rcx
mov qword [rsp + rcx*8 + 0x28], rdx
inc rcx
cmp rcx, r8
jb 0x140001ba0
movss xmm1, dword [0x1400b9764]
lea r9, [rsp + 0x30]
mov dword [rsp + 0x20], r8d
xorps xmm2, xmm2
movabs r10, 0xb5026f5aa96619e9
nop dword [rax]
mov rdx, qword [r9]
xor rdx, qword [r9 - 8]
lea r9, [r9 + 8]
and rdx, 0xffffffff80000000
xor rdx, qword [r9 - 8]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r10
xor rcx, qword [r9 + 0x4d0]
xor rcx, rdx
mov qword [r9 + 0x9b0], rcx
sub r8, 1
jne 0x140001be0
mov eax, dword [rsp + 0x20]
movabs rdx, 0x38eb3ffff6d3
xorps xmm0, xmm0
mov rcx, qword [rsp + rax*8 + 0x28]
mov rax, rcx
shr rax, 0x1d
and rax, qword [rsp + 0x13a8]
xor rcx, rax
mov rax, rcx
and rax, rdx
shl rax, 0x11
xor rcx, rax
mov rax, rcx
and rax, 0xffffffffffffbf77
shl rax, 0x25
xor rcx, rax
mov rdx, rcx
shr rdx, 0x2b
xor rdx, rcx
js 0x140001c75
cvtsi2ss xmm0, rdx
jmp 0x140001c8a
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
subss xmm0, xmm2
subss xmm6, xmm7
mulss xmm0, xmm1
mulss xmm1, dword [0x1400b9898]
addss xmm0, xmm2
divss xmm0, xmm1
mulss xmm0, xmm6
addss xmm0, xmm7
mov rcx, qword [rsp + 0x13b0]
xor rcx, rsp
call fcn.1400587d0
movaps xmm6, xmmword [rsp + 0x13d0]
movaps xmm7, xmmword [rsp + 0x13c0]
add rsp, 0x13e8
ret