joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18009e218
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x40
lea rax, [rcx - 0x10000]
mov rsi, rcx
movabs rcx, 0x7ffffffeffff
mov rbx, rdx
cmp rax, rcx
ja 0x18009e333
movabs rax, 0xaf9c9cf17de93311
xor r9d, r9d
mov qword [r11 - 0x28], rax
movabs rax, 0x18b9c9e6e9f7bf27
mov qword [r11 - 0x20], rax
movabs rax, 0xd8eef3b719885659
movdqa xmm0, xmmword [rsp + 0x20]
mov qword [rsp + 0x30], rax
movabs rax, 0x18b9c9e6e993cd46
mov qword [rsp + 0x38], rax
xorps xmm0, xmmword [rsp + 0x30]
movq rax, xmm0
movdqa xmmword [rsp + 0x20], xmm0
test al, al
je 0x18009e2aa
inc r9
cmp byte [rsp + r9 + 0x20], 0
jne 0x18009e29f
xor r10d, r10d
movabs rdi, 0xcbf29ce484222325
test r9, r9
je 0x18009e2f0
movzx edx, byte [rsp + r10 + 0x20]
lea eax, [rdx + 0x20]
movzx ecx, al
lea r8d, [rdx - 0x41]
cmp r8b, 0x19
cmova ecx, edx
inc r10
movsx rax, cl
movabs rcx, 0x100000001b3
imul rdi, rcx
xor rdi, rax
cmp r10, r9
jb 0x18009e2bc
mov rax, qword [0x1800c3508]
test rax, rax
jne 0x18009e317
call fcn.18004c540
mov rcx, rax
lea rdx, str.PlayerEyes
call fcn.18002826c
mov qword [0x1800c3508], rax
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call fcn.18004b9dc
mov rdx, rsi
mov rcx, rbx
mov r8, qword [rax]
call r8
jmp 0x18009e344
xorps xmm3, xmm3
xorps xmm2, xmm2
xorps xmm1, xmm1
mov rcx, rbx
call fcn.1800a07c0
mov rsi, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x1800a25b4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
lea rax, [rcx - 0x10000]
movabs rdx, 0x7ffffffeffff
cmp rax, rdx
ja 0x1800a263d
mov rax, qword [rcx]
xor r9d, r9d
test rax, rax
je 0x1800a263d
mov rbx, qword [rax + 0x10]
mov r10d, r9d
cmp byte [rbx], r9b
je 0x1800a25ef
inc r10
cmp byte [rbx + r10], r9b
jne 0x1800a25e6
movabs r11, 0xcbf29ce484222325
test r10, r10
je 0x1800a2638
mov al, byte [rbx + r9]
movzx ecx, byte [rbx + r9]
add al, 0x20
mov r8b, byte [rbx + r9]
sub r8b, 0x41
movzx edx, al
cmp r8b, 0x19
movabs rax, 0x100000001b3
cmova edx, ecx
inc r9
imul r11, rax
movsx rcx, dl
xor r11, rcx
cmp r9, r10
jb 0x1800a25fe
mov rax, r11
jmp 0x1800a263f
xor eax, eax
mov rbx, qword [rsp + 8]
ret
Function at 0x14000d9e0
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3d0], rcx
mov qword [rbp + 0x3d8], 0
mov qword [rbp + 0x3e0], 2
mov qword [rbp + 0x3e8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3c8], rax
xor esi, esi
xor edi, edi
xor ebx, ebx
cmp r8, 0x201
jae 0x14000da80
jmp 0x14000da6f
jae 0x14000db3f
cmp r8, 0x201
jae 0x14000da80
mov r14d, 0x200
lea r15, [rbp - 0x58]
mov r12, r8
jmp 0x14000dad7
sub r8, rbx
sub rdi, rbx
cmp rdi, r8
jae 0x14000daaf
lea rcx, [rbp + 0x3d8]
mov rdx, rbx
call fcn.14002e5d0
mov rsi, qword [rbp + 0x3d8]
mov rax, qword [rbp + 0x3e0]
mov qword [rbp + 0x3c8], rax
mov eax, 0xffffffff
cmp rsi, rax
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rbp + 0x3e8], rbx
mov rdi, rsi
mov r14, rbx
mov r15, qword [rbp + 0x3c8]
mov r12, rbx
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov ecx, r12d
mov rdx, r15
call qword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov r13d, eax
test eax, eax
jne 0x14000db00
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x14000dbab
mov r8d, r13d
cmp r12, r8
jne 0x14000da60
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14000dbdf
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x14000da6f
jmp 0x14000da80
cmp r14, r8
jb 0x14000dbf9
lea rcx, [rbp + 0x3a8]
mov rdx, r15
call fcn.1400100d0
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3d0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
je 0x14000db94
mov rcx, qword [rbp + 0x3e0]
add rdx, rdx
mov r8d, 2
call fcn.1400032c0
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3d0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
jne 0x14000db7f
jmp 0x14000db94
lea rcx, [0x140281878]
lea r8, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.14002f3c0
jmp 0x14000dc0e
lea rax, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.14002f710
ud2
Function at 0x1400136a0
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x10b8
call fcn.14002d810
sub rsp, rax
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x1020], xmm6
mov qword [rbp + 0x1018], 0xfffffffffffffffe
mov qword [rbp + 0x1008], rdx
mov r15, rcx
lea r12, [rbp - 0x50]
mov r8d, 0x1000
mov rcx, r12
xor edx, edx
call sub.VCRUNTIME140.dll_memset
xorps xmm6, xmm6
lea r13, [rbp + 0xffc]
lea rbx, [0x1400186c0]
lea r14, [rbp + 0xfb0]
mov rsi, qword [sym.imp.kernel32.dll_WriteFileEx]
mov rdi, qword [sym.imp.kernel32.dll_SleepEx]
mov qword [rbp + 0x1010], r15
mov r8d, 0x1000
mov rcx, r15
mov rdx, r12
call fcn.140018490
mov r15, rdx
mov qword [rbp + 0xfd8], rax
mov qword [rbp + 0xfe0], rdx
test rax, rax
jne 0x140013890
test r15, r15
je 0x14001385c
cmp r15, 0x1000
ja 0x1400138b2
xor r12d, r12d
nop word cs:[rax + rax]
mov r8d, r15d
sub r8d, r12d
lea rdx, [r12 + rbp]
add rdx, 0xffffffffffffffb0
mov dword [rbp + 0xffc], 0
movaps xmmword [rbp + 0xfb0], xmm6
mov qword [rbp + 0xfc0], 0
mov qword [rbp + 0xfc8], r13
mov qword [rsp + 0x20], rbx
mov rcx, qword [rbp + 0x1008]
mov r9, r14
call rsi
test eax, eax
je 0x140013830
nop word cs:[rax + rax]
mov ecx, 0xffffffff
mov edx, 1
call rdi
cmp dword [rbp + 0xffc], 0
je 0x1400137c0
mov ecx, dword [rbp + 0x1000]
mov eax, dword [rbp + 0x1004]
mov rdx, rcx
shl rdx, 0x20
or rdx, 2
xor r8d, r8d
test ecx, ecx
setne r8b
cmove rdx, rax
mov qword [rbp + 0xfe8], r8
mov qword [rbp + 0xff0], rdx
jne 0x140013850
add r12, rax
cmp r12, r15
je 0x140013820
jbe 0x140013770
jmp 0x14001389e
mov r15, qword [rbp + 0x1010]
lea r12, [rbp - 0x50]
jmp 0x14001371e
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp + 0xfe8], 1
mov qword [rbp + 0xff0], rax
lea rcx, [rbp + 0xff0]
call fcn.140008110
mov rsi, qword [sym.imp.kernel32.dll_CloseHandle]
mov rcx, qword [rbp + 0x1010]
call rsi
mov rcx, qword [rbp + 0x1008]
call rsi
movaps xmm6, xmmword [rbp + 0x1020]
add rsp, 0x10b8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, [rbp + 0xfe0]
call fcn.140008110
jmp 0x14001385c
lea r8, str.library_std_src_syspalwindowspipe.rs
mov rcx, r12
mov rdx, r15
call fcn.14002f720
jmp 0x1400138c6
lea r8, str.library_std_src_syspalwindowspipe.rs
mov edx, 0x1000
mov rcx, r15
call fcn.14002f710
ud2
Function at 0x140016ee0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov rsi, rcx
movups xmm0, xmmword [0x140283798]
movaps xmmword [rbp], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
test r9, r9
je 0x140016f18
mov rcx, qword [rbp + 0x60]
mov qword [rbp - 0x30], rcx
test r9, r9
mov qword [rbp - 0x38], r9
lea rcx, [rbp - 0x30]
cmove rcx, r9
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov rax, rbp
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x140016f76
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [rbp]
cmp eax, 0x103
je 0x140016fa3
test eax, eax
js 0x140016f82
mov rdx, qword [rbp + 8]
xor eax, eax
jmp 0x140016f99
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa8
pop rsi
pop rbp
ret
mov dword [rbp + 0x18], 0
mov byte [rbp + 0x1c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x18]
lea rdx, [rbp - 0x38]
call fcn.14000fdc0
mov qword [rbp - 8], rax
lea rcx, [rbp - 8]
call fcn.1400086e0
mov ecx, 7
int 0x29
ud2
Function at 0x14002c030
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
test r8, r8
je 0x14002c0ba
mov rax, rdx
mov rdx, qword [rbp + 0x50]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x14002c0b0
cmp r11, r10
ja 0x14002c136
cmp r10, rdx
ja 0x14002c148
add r11, r9
xor ebx, ebx
nop word cs:[rax + rax]
cmp rdi, rbx
je 0x14002c0b2
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x14002c090
jmp 0x14002c117
ja 0x14002c0ba
mov r11, r10
cmp rax, r8
jne 0x14002c057
mov rdx, qword [rbp + 0x60]
test rdx, rdx
je 0x14002c11b
mov r8, qword [rbp + 0x58]
add rdx, r8
movzx ecx, cx
mov al, 1
nop
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x14002c0f0
mov r8, r10
sub ecx, r9d
jns 0x14002c10e
jmp 0x14002c11d
cmp r10, rdx
je 0x14002c12a
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x14002c11d
xor al, 1
cmp r8, rdx
jne 0x14002c0d0
jmp 0x14002c11d
xor eax, eax
jmp 0x14002c11d
mov al, 1
and al, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.14002f2c0
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.14002f720
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.14002f710
int3

Function at 0x14002dd44
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x14002dd8e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002dd8e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002dd8e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002dd8e
cmp dword [rcx + 0x84], 0xe
jbe 0x14002dd8e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14002dd90
xor al, al
add rsp, 0x28
ret
Function at 0x14000b7f0
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x200
mov rax, qword [0x1400f2010]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
movzx ebx, dl
mov rdi, rcx
mov eax, 1
lock xadd dword [0x1400f9cf8], eax
inc eax
cmp eax, 1
jne 0x14000b83d
lea ecx, [rax + 1]
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [0x1400f9cfc], eax
test bl, bl
je 0x14000b8e8
xor ebx, ebx
lock xadd dword [0x1400f9cfc], ebx
test ebx, ebx
je 0x14000b8e8
movabs rcx, 0x4d54ee85da812030
mov qword [rsp + 0x210], rsi
add rcx, qword [0x1400f2dd0]
lea rsi, [0x1400f2dc8]
mov dword [rsp + 0x3c], 0
cmp rcx, 1
jbe 0x14000b89d
mov rax, qword [0x1400f2dc8]
mov edx, ebx
mov rcx, rsi
mov rax, qword [rax + 0x30]
call qword [case.0x14003b406.0]
jmp 0x14000b89f
mov al, 1
lea rcx, str.C:dev_bazelhgi62d3rexecrootesgexternal_boost_boost_asiodetailimplwinsock_init.ipp
movzx eax, al
add rax, 2
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x40], rsi
lea rcx, str.throw_on_error
mov rsi, qword [rsp + 0x210]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], 0x48
mov dword [rsp + 0x34], 0x1a
test al, 1
jne 0x14000b90c
mov rax, rdi
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.140085030
mov rbx, qword [rsp + 0x218]
add rsp, 0x200
pop rdi
ret
lea r8, [rsp + 0x20]
lea rdx, str.winsock
lea rcx, [rsp + 0x38]
call fcn.140070010
int3

Function at 0x140010fa0
Capabilities:
Query service status

Disassembly:
push rbx
sub rsp, 0x160
mov rax, qword [0x1400f2010]
xor rax, rsp
mov qword [rsp + 0x150], rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
mov r8, rdx
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x140011067
xor edx, edx
mov r8d, 0x110
lea rcx, [rsp + 0x40]
call fcn.14008b8d0
call fcn.140069780
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], 2
lea rcx, [rsp + 0x50]
call fcn.140005cf0
nop
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14003b406.0]
cmp dword [rsp + 0x48], eax
setl byte [rsp + 0x148]
jl 0x140011059
lea rcx, [rsp + 0x40]
call fcn.140012870
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140012770
mov byte [rsp + 0x148], 1
lea rcx, [rsp + 0x40]
call fcn.140003bf0
xor al, al
jmp 0x140011069
mov al, 1
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140085030
add rsp, 0x160
pop rbx
ret
Function at 0x140017d10
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x50
mov rax, qword [0x1400f2010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, rdx
mov r14, rcx
mov qword [rsp + 0x20], rcx
mov rax, qword [rcx + 8]
xor edi, edi
test al, 1
jne 0x140017d7e
and rax, 0xfffffffffffffffc
mov rax, qword [rax + 0x10]
lea rbx, [rax + 0x28]
test rax, rax
cmove rbx, rdi
mov ecx, dword [0x1400f9f34]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140017d7e
nop dword [rax]
cmp qword [rax], rbx
je 0x140017d95
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x140017d70
mov ecx, dword [0x1400f9f34]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140017dca
mov rdx, qword [rax + 8]
jmp 0x140017dcd
cmp qword [rax + 8], rdi
je 0x140017d7e
mov rax, qword [rsi]
mov qword [rsp + 0x28], rax
movzx eax, byte [rsi + 8]
mov byte [rsp + 0x30], al
mov rax, qword [rsi + 0x10]
mov qword [rsp + 0x38], rax
nop
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x28]
call fcn.140018ba0
nop
nop
jmp 0x140017e30
mov rdx, rdi
mov r8d, 0x58
call fcn.140016a60
mov rdx, rax
mov qword [rax + 0x20], rdi
lea rax, [0x1400186d0]
mov qword [rdx + 0x28], rax
mov qword [rdx], rdi
mov qword [rdx + 8], rdi
mov qword [rdx + 0x10], 0
mov qword [rdx + 0x18], rdi
mov dword [rdx + 0x30], edi
mov rcx, qword [rsi]
mov qword [rdx + 0x38], rcx
movzx eax, byte [rsi + 8]
mov byte [rdx + 0x40], al
mov rax, qword [rsi + 0x10]
mov qword [rdx + 0x48], rax
mov rax, qword [r14 + 8]
and rax, 0xfffffffffffffffc
mov rcx, qword [rax + 0x10]
lock inc dword [rcx + 0x30]
call fcn.140070960
nop
nop dword [rax]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140085030
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret

Function at 0x140018e10
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x140018e46
mov rax, qword [rax + 0x38]
test rax, rax
je 0x140018e3e
xor edx, edx
mov rcx, rax
mov rax, qword [rax]
call qword [case.0x14003b406.0]
nop
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x140018e92
mov ecx, dword [0x1400f9f34]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140018e82
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140018e82
xor ecx, ecx
xor eax, eax
nop dword [rax]
cmp qword [rdx + rax*8], 0
je 0x140018e9d
inc ecx
inc rax
cmp rax, 2
jl 0x140018e70
mov rcx, rbx
call fcn.140085094
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x48]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14001f7a0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x1e0
mov rax, qword [0x1400f2010]
xor rax, rsp
mov qword [rsp + 0x1d8], rax
mov r14, rdx
mov rsi, rcx
mov qword [rsp + 0x20], rcx
mov rax, qword [rcx + 8]
xor edi, edi
test al, 1
jne 0x14001f80e
and rax, 0xfffffffffffffffc
mov rax, qword [rax + 0x10]
lea rbx, [rax + 0x28]
test rax, rax
cmove rbx, rdi
mov ecx, dword [0x1400f9f34]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14001f80e
nop dword [rax + rax]
cmp qword [rax], rbx
je 0x14001f82e
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x14001f800
lea rax, [rsi + 1]
mov qword [rsp + 0x28], rax
mov ecx, dword [0x1400f9f34]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14001f89a
mov rdx, qword [rax + 8]
jmp 0x14001f89d
cmp qword [rax + 8], rdi
je 0x14001f80e
mov rax, qword [r14]
mov qword [rsp + 0x40], rax
lea rdx, [r14 + 8]
lea rcx, [rsp + 0x48]
call fcn.14001f9a0
movsd xmm2, qword [rdx + 0x170]
movsd qword [rsp + 0x1b8], xmm2
mov rax, qword [rdx + 0x178]
mov qword [rsp + 0x1c0], rax
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x40]
call fcn.14001ff20
nop
nop
lea rcx, [rsp + 0x48]
call fcn.14001d4c0
jmp 0x14001f92f
mov rdx, rdi
mov r8d, 0x1c8
call fcn.140016a60
mov r9, rax
mov qword [rax + 0x20], rdi
lea rax, [0x14001fd40]
mov qword [r9 + 0x28], rax
mov qword [r9], rdi
mov qword [r9 + 8], rdi
mov qword [r9 + 0x10], 0
mov qword [r9 + 0x18], rdi
mov dword [r9 + 0x30], edi
mov rcx, qword [r14]
mov qword [r9 + 0x38], rcx
lea rcx, [r9 + 0x40]
lea rdx, [r14 + 8]
call fcn.14001f9a0
movsd xmm2, qword [rdx + 0x170]
movsd qword [rcx + 0x170], xmm2
mov rax, qword [rdx + 0x178]
mov qword [rcx + 0x178], rax
mov rax, qword [rsi + 8]
and rax, 0xfffffffffffffffc
mov rcx, qword [rax + 0x10]
lock inc dword [rcx + 0x30]
mov rdx, r9
call fcn.140070960
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
lea rcx, [rsp + 0x28]
call fcn.14001fca0
mov rcx, qword [rsp + 0x1d8]
xor rcx, rsp
call fcn.140085030
mov rbx, qword [rsp + 0x210]
add rsp, 0x1e0
pop r14
pop rdi
pop rsi
ret

Function at 0x14001fca0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14001fcc7
add rcx, 0x40
call fcn.14001d4c0
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x14001fd12
mov ecx, dword [0x1400f9f34]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14001fd02
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14001fd02
xor ecx, ecx
xor eax, eax
nop
cmp qword [rdx + rax*8], 0
je 0x14001fd1d
inc ecx
inc rax
cmp rax, 2
jl 0x14001fcf0
mov rcx, rbx
call fcn.140085094
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x1c8]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x30]
mov qword [rdi + 8], 0
add rsp, 0x20
pop rdi
ret
Function at 0x140024530
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x2c0]
sub rsp, 0x3c0
mov rax, qword [0x1400f2010]
xor rax, rsp
mov qword [rbp + 0x2b0], rax
mov rsi, rcx
mov qword [rsp + 0x38], rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov rax, qword gs:[0x58]
mov rbx, qword [rax]
mov ecx, 0x18
mov eax, dword [rcx + rbx]
mov edi, 0x10
test al, 1
jne 0x1400245a0
or eax, 1
mov dword [rcx + rbx], eax
xor eax, eax
mov qword [rbx + rdi], rax
call fcn.140069700
mov qword [rbx + rdi], rax
lea r8, str.sophosfslib::GetLocalRepDataLocation
mov rdx, qword [rbx + rdi]
lea rcx, [rsp + 0x78]
call fcn.14000bf20
nop
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x23]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [rsp + 0x38], eax
test eax, eax
js 0x14002473a
xor r14d, r14d
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], r14w
lea rax, [rbp + 0xa0]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140024610
lea rdx, [rbp + 0xa0]
lea rcx, [rsp + 0x58]
call fcn.140006eb0
nop
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov rax, rdx
sub rax, rcx
cmp rax, 0x20
jb 0x140024678
lea rdi, [rcx + 0x20]
mov qword [rsp + 0x68], rdi
lea rbx, [rsp + 0x58]
cmp rdx, 8
cmovae rbx, qword [rsp + 0x58]
lea rcx, [rbx + rcx*2]
mov r8d, 0x40
lea rdx, str.SophosSophos_File_ScannerData
call fcn.14008baa0
mov word [rbx + rdi*2], r14w
jmp 0x1400246a0
lfence
mov qword [rsp + 0x20], 0x20
lea r9, str.SophosSophos_File_ScannerData
movzx r8d, byte [rsp + 0x30]
mov edx, 0x20
lea rcx, [rsp + 0x58]
call fcn.140007cd0
lea rdx, [rsp + 0x58]
mov rcx, rsi
call fcn.1400223e0
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x1400246ec
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400246e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024734
call fcn.140085050
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], r14w
lea rcx, [rsp + 0x78]
call fcn.14000c120
mov rax, rsi
mov rcx, qword [rbp + 0x2b0]
xor rcx, rsp
call fcn.140085030
lea r11, [rsp + 0x3c0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.14008fffc
nop
lea rcx, [rbp - 0x70]
call fcn.140005a60
call fcn.140069780
mov rdx, rax
xor r8d, r8d
lea rcx, [rbp - 0x70]
call fcn.140003ba0
cmp byte [rbp + 0x98], 0
jne 0x14002477d
lea rcx, [rbp - 0x70]
call fcn.14000d980
lea rdx, [rsp + 0x38]
mov rcx, rax
call fcn.14000d9f0
mov byte [rbp + 0x98], 1
lea rcx, [rbp - 0x70]
call fcn.140003bf0
lea rdx, str.Failed_to_find_application_data_path
lea rcx, [rsp + 0x40]
call fcn.14000be60
lea rdx, [0x1400eff08]
lea rcx, [rsp + 0x40]
call fcn.14008b7f4
int3
Function at 0x140032c00
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0x10]
mov rdi, rcx
test rax, rax
je 0x140032c46
mov rcx, qword [rax + 0x40]
lea rbx, [rax + 8]
test rcx, rcx
je 0x140032c3e
mov rax, qword [rcx]
cmp rcx, rbx
setne dl
mov rax, qword [rax + 0x20]
call qword [case.0x14003b406.0]
mov qword [rbx + 0x38], 0
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x140032c92
mov ecx, dword [0x1400f9f34]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140032c82
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140032c82
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x140032c9d
inc ecx
inc rax
cmp rax, 6
jl 0x140032c70
mov rcx, rbx
call fcn.140085094
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x68]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x30]
mov qword [rdi + 8], 0
add rsp, 0x20
pop rdi
ret

Function at 0x1400386d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub r8, rdx
movabs rax, 0xcbf29ce484222325
sar r8, 1
mov r9d, 0
add r8, r8
je 0x140038714
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x140038700
ret
Function at 0x140041fd0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x140042004
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x140041ff0
ret