joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140137120
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rcx
add rcx, 8
mov qword [rsp + 0x48], rcx
xor eax, eax
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
cmp rax, qword [rcx]
jge 0x140137273
mov eax, dword [0x1401e3028]
xor eax, dword [0x1401e302c]
mov ecx, 0x89dca5b5
xor ecx, 0x4d320a8f
sub eax, ecx
and eax, eax
xor eax, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0x98f840c5
mov edx, 0xffffffff
xor edx, 0x98f840c5
or ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
xor eax, 0x9c2d2ca8
cmp eax, 0x4e5d71f8
je 0x140137278
mov r8, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
mov eax, dword [0x1401e3030]
mov r9d, dword [0x1401e3034]
mov edx, eax
and edx, r9d
shl edx, 1
add eax, r9d
sub eax, edx
mov r9d, 0xc3685cc1
xor edx, edx
div r9d
mov r9d, 0x2b5a4fbc
xor edx, edx
div r9d
mov edx, eax
mov rax, qword [rsp + 0x30]
mov r9d, 0x834b8859
xor r9d, 0x3a0db483
or edx, r9d
mov dword [rsp + 0x24], edx
mov edx, 0x10ce7860
xor edx, 0xe43707bf
mov dword [rsp + 0x20], edx
mov rcx, qword [rcx]
add rcx, 8
shl rax, 3
add rcx, rax
lea rdx, [0x1401e2c18]
call fcn.140137290
mov rdx, qword [rsp + 0x30]
mov ecx, dword [rsp + 0x20]
mov eax, dword [rsp + 0x24]
movabs r8, 0x332e027b7d25be37
movabs r9, 0x332e027b7d25be37
xor r8, r9
sub r8, rdx
xor edx, edx
sub rdx, 1
add r8, rdx
xor edx, edx
sub rdx, r8
mov qword [rsp + 0x28], rdx
cmp eax, ecx
jae 0x1401371a4
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x50], rax
jmp 0x14013713e
add rsp, 0x58
ret
sbb dword [rbp + r8*2 - 0x17], 0xffffff23
nop word cs:[rax + rax]
Function at 0x14015e1f0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x38], rcx
call fcn.14015e0f4
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
add rcx, 8
mov qword [rsp + 0x48], rcx
xor eax, eax
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov rcx, qword [rcx]
mov rdx, qword [rdx]
mov qword [rsp + 0x30], rdx
cmp rax, rcx
jge 0x14015e2dc
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rax + rcx*8 + 8]
call fcn.14015e10f
test al, 1
jne 0x14015e261
jmp 0x14015e2a2
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
mov rcx, qword [rax + rcx*8 + 8]
call fcn.14015e030
mov rax, qword [rsp + 0x40]
cmp byte [rax], 0
jne 0x14015e3c0
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
mov rcx, qword [rax + rcx*8 + 8]
mov edx, 8
call fcn.14000e330
mov rax, qword [rsp + 0x28]
movabs rcx, 0x3027f96cc3f0af9d
sub rax, rcx
add rax, 1
movabs rcx, 0xd330f669149a85d
movabs rdx, 0x3d14f60a52b907c0
xor rcx, rdx
add rax, rcx
mov qword [rsp + 0x50], rax
jmp 0x14015e218
mov eax, dword [0x1401e3e68]
mov ecx, dword [0x1401e3e6c]
xor ecx, 0x7319f26c
sub eax, ecx
mov edx, eax
xor edx, 0xffffffff
and edx, 0xfea73f26
mov r8d, 0xffffffff
xor r8d, 0xfea73f26
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov r8d, 0x62c90391
xor r8d, 0x9c6e3cb7
mov edx, eax
and edx, r8d
or eax, 0xfea73f26
imul eax, edx
add eax, ecx
and eax, 0xaea06d1c
xor eax, 0xbd0d8de3
mov ecx, 0xc19703f6
xor ecx, 0x75d8798a
cmp eax, ecx
je 0x14015e3c6
mov rcx, qword [rsp + 0x30]
mov eax, dword [0x1401e3e70]
xor edx, edx
div dword [0x1401e3e74]
mov edx, 0xcfd5c3dc
xor edx, 0xf29e29c3
xor eax, edx
xor eax, 0xa7f3103f
mov r8d, 0x2ae0e451
xor r8d, 0x4c73c41c
mov edx, eax
and edx, r8d
shl edx, 1
add eax, 0x6693204d
sub eax, edx
cmp rcx, 0
sete cl
mov byte [rsp + 0x27], cl
cmp eax, 0x808498e3
jbe 0x14015e349
mov al, byte [rsp + 0x27]
test al, 1
jne 0x14015e3c0
jmp 0x14015e3b1
mov rcx, qword [rsp + 0x30]
mov edx, 8
call fcn.14000e284
nop
add rsp, 0x58
ret
sbb esp, ebp
rol byte [0x140155eb8], 0xff
nop
Function at 0x14015f9a0
Capabilities:
Encode data using xor

Disassembly:
push rax
mov qword [rsp], rcx
mov eax, dword [0x1401e3f48]
mov edx, dword [0x1401e3f4c]
xor edx, 0x721c0d97
mov ecx, eax
and ecx, edx
xor eax, edx
or ecx, eax
mov eax, ecx
xor eax, 0xffffffff
mov r8d, 0x30af7fcc
xor r8d, 0xcf508033
mov edx, ecx
xor edx, r8d
or eax, edx
and eax, 0xe8a7da93
xor eax, 0xffffffff
mov edx, 0xe8a7da93
and edx, 0xe8a7da93
xor edx, 0xffffffff
and ecx, edx
xor ecx, 0xffffffff
and eax, ecx
xor eax, 0xffffffff
mov ecx, 0x87767154
xor ecx, 0xd5866bb
sub eax, ecx
mov ecx, 0xa242391b
xor ecx, 0xb1c94dc2
sub eax, ecx
mov ecx, 0xacbe69fb
xor ecx, 0xb182cfa8
add eax, ecx
add eax, 0x138b74d9
cmp eax, 0xc6c1aebe
jb 0x14015fa74
mov rcx, qword [rsp]
mov eax, dword [0x1401e3f50]
or eax, dword [0x1401e3f54]
sub eax, 0xcadcf871
sub eax, 0x4fee4dea
mov edx, 0xc8172775
xor edx, 0x2cbdf04
add eax, edx
or eax, 0x2b1631a4
xor eax, 0x4f98047
mov qword [rcx], 0
cmp eax, 0x59d78849
je 0x14015fa2f
pop rax
ret
invalid
Function at 0x140180110
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 0x20], r8
mov qword [rbp - 0x18], rdx
mov qword [rbp - 0x10], rcx
mov qword [rbp - 8], rcx
mov r8d, dword [0x1401e4c98]
mov ecx, dword [0x1401e4c9c]
mov eax, r8d
and eax, ecx
shl eax, 1
add r8d, ecx
sub r8d, eax
mov eax, r8d
xor eax, 0xffffffff
and eax, 0xcf8db003
mov edx, 0xffffffff
xor edx, 0xcf8db003
and r8d, edx
mov ecx, 0xffffffff
xor ecx, 0x69e608dc
and ecx, 0xcf8db003
and edx, 0x69e608dc
or eax, r8d
or ecx, edx
xor eax, ecx
imul eax, eax, 0x32090719
and eax, 0x4f95f114
mov ecx, 0x2a4c8882
xor ecx, 0xc64c9b86
cmp eax, ecx
ja 0x140180251
mov eax, dword [0x1401e4ca0]
mov ecx, dword [0x1401e4ca4]
xor ecx, 0x3bd943fa
sub eax, ecx
shr eax, 1
mov ecx, 0x90b17e33
imul rax, rcx
shr rax, 0x3e
add eax, 0x1dbfb101
mov dword [rbp - 0x24], eax
mov eax, 0x10
mov qword [rbp - 0x40], rax
call fcn.1401da3e0
sub rsp, rax
mov rax, qword [rbp - 0x40]
mov rcx, rsp
mov qword [rbp - 0x38], rcx
call fcn.1401da3e0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x30], rax
sub rsp, 0x20
call fcn.140180e30
mov r9, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x10]
mov rdx, qword [rbp - 0x38]
mov r8, qword [rbp - 0x30]
add rsp, 0x20
mov rax, qword [rbp - 0x20]
mov r10, qword [r9]
mov qword [rdx], r10
mov r9, qword [r9 + 8]
mov qword [rdx + 8], r9
mov r9, qword [rax]
mov qword [r8], r9
mov rax, qword [rax + 8]
mov qword [r8 + 8], rax
sub rsp, 0x20
call fcn.1400917b1
mov eax, dword [rbp - 0x24]
add rsp, 0x20
cmp eax, 0xd4dcc2c3
je 0x14018019a
mov rax, qword [rbp - 8]
mov rsp, rbp
pop rbp
ret
xchg ebx, eax
shr byte [rbp - 0xbf1613], 1
invalid
Function at 0x140180b50
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x50], rcx
mov eax, dword [0x1401e4cf8]
mov ecx, dword [0x1401e4cfc]
mov edx, 0xaab8ba3a
xor edx, 0xd6700a74
xor ecx, edx
and eax, ecx
imul eax, eax, 0x9eeb0574
mov r8d, 0xffffffff
xor r8d, 0x20d4b750
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
mov r8d, 0x4584359f
xor r8d, 0xba7bca60
xor ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0x20d4b750
or eax, 0x20d4b750
imul eax, edx
add eax, ecx
mov ecx, 0xefe1a93
xor ecx, 0x5fe3702c
and eax, ecx
cmp eax, 0x6ff4a098
ja 0x140180e13
mov eax, dword [0x1401e4d00]
xor edx, edx
div dword [0x1401e4d04]
mov ecx, 0x6a6324e0
xor edx, edx
div ecx
imul eax, eax, 0x517e7d84
mov ecx, 0x89d1699
xor ecx, 0x5852111c
xor edx, edx
div ecx
mov dword [rsp + 0x48], eax
mov eax, 0x15de2208
xor eax, 0x7d53f4b6
mov dword [rsp + 0x44], eax
call fcn.140180e30
mov rdx, qword [rsp + 0x50]
mov ecx, dword [rsp + 0x44]
mov eax, dword [rsp + 0x48]
cmp rdx, 0
sete dl
mov byte [rsp + 0x4f], dl
cmp eax, ecx
je 0x140180bce
mov al, byte [rsp + 0x4f]
test al, 1
jne 0x140180e0d
jmp 0x140180c42
mov rax, qword [rsp + 0x50]
mov rcx, rax
add rcx, 0xfffffffffffffff0
mov qword [rsp + 0x30], rcx
mov rax, qword [rax - 0x10]
mov qword [rsp + 0x38], rax
cmp rax, 0x10
jb 0x140180de7
mov r8, qword [rsp + 0x38]
movabs rcx, 0xa1495ff5429dd701
movabs rax, 0x5eb6a00abd6228f1
xor rcx, rax
mov rax, r8
add rax, rcx
mov qword [rsp + 0x28], rax
mov rdx, rax
xor rdx, 0xffffffffffffffff
movabs rcx, 0x5870ea07f2873017
movabs r9, 0x7af4b9f2e461313c
xor rcx, r9
and rcx, rdx
mov r10, 0xffffffffffffffff
movabs rdx, 0x228453f516e6012b
xor r10, rdx
mov r9, rax
and r9, r10
mov rdx, r8
xor rdx, 0xffffffffffffffff
movabs r11, 0x228453f516e6012b
and rdx, r11
and r8, r10
or rcx, r9
or rdx, r8
xor rcx, rdx
cmp rcx, 0
setl cl
cmp rax, 0xffffffffffffffff
setg al
and al, cl
test al, 1
jne 0x140180d05
jmp 0x140180d0f
call fcn.1400067fe
jmp 0x140180e0d
mov eax, dword [0x1401e4d08]
mov ecx, 0xbf360c30
xor ecx, 0x9f91b237
xor eax, ecx
xor edx, edx
div dword [str._mE]
mov ecx, 0xc120bf2a
xor ecx, 0x6879736b
sub eax, ecx
mov ecx, 0xce41ee61
xor edx, edx
div ecx
sub eax, 0x7bec63e
add eax, 0xf5a1e954
mov ecx, 0x24f06178
xor ecx, 0x234ea746
add eax, ecx
mov ecx, 0x1f5c82e8
xor ecx, 0xcaa8b41c
cmp eax, ecx
jbe 0x140180e1c
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x1401e4d10]
imul eax, dword [0x1401e4d14]
mov r8d, 0xf18a4e1f
xor edx, edx
div r8d
mov rdx, qword [rsp + 0x30]
mov r8d, eax
mov rax, qword [rsp + 0x50]
xor r9d, r9d
sub r9d, 0x8a19ef95
add r8d, r9d
xor r9d, r9d
sub r9d, 0xe6442b7f
sub r8d, r9d
mov dword [rsp + 0x24], r8d
mov r8d, 0x1f3b83c2
xor r8d, 0x1f14a378
mov dword [rsp + 0x20], r8d
mov qword [rdx], rcx
mov r8, qword [rax]
xor ecx, ecx
call fcn.14000f8f0
mov ecx, dword [rsp + 0x20]
mov eax, dword [rsp + 0x24]
cmp eax, ecx
jb 0x140180d6a
jmp 0x140180e0d
mov rax, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x30]
mov r8, qword [rax]
xor eax, eax
mov cl, al
xor cl, 1
and cl, 1
call fcn.14000f8f0
mov rcx, qword [rsp + 0x50]
call fcn.14000fd30
nop
add rsp, 0x58
ret
nop
cmc
mov dl, 0x1e
jmp 0x140180bce
in eax, dx
jne 0x140180e99
add ebp, ecx
invalid
Function at 0x140194a60
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rcx
call fcn.140194c26
mov rcx, qword [rsp + 0x40]
cmp rcx, 0
je 0x140194c17
mov eax, dword [0x1401e5380]
mov ecx, 0xe6083f3e
xor ecx, 0x6e796ffe
xor eax, ecx
mov ecx, dword [0x1401e5384]
mov edx, 0x12ab372b
xor edx, 0x48df8a39
xor ecx, edx
imul eax, ecx
mov ecx, eax
xor ecx, 0xae0737d0
mov edx, 0xffffffff
xor edx, 0xae0737d0
and eax, edx
shl eax, 1
sub eax, ecx
imul ecx, eax, 0x79e91c5f
mov eax, ecx
and eax, 0xaa73f923
xor ecx, 0xaa73f923
or eax, ecx
cmp eax, 0xa989ce86
jbe 0x140194c1d
mov rcx, qword [rsp + 0x40]
mov eax, dword [0x1401e5388]
mov edx, 0x5f964672
xor edx, 0x4199acad
xor eax, edx
mov r8d, dword [0x1401e538c]
mov edx, eax
and edx, r8d
mov r9d, 0xf1dd034a
xor r9d, 0xf1dd0348
imul edx, r9d
xor eax, r8d
add eax, edx
xor eax, 0x83b227f2
mov edx, 0x58ebfdb
xor edx, 0xae2ed3ec
add eax, edx
xor eax, 0xe86e5326
movabs rdx, 0xef27d231b1bdcd14
movabs r8, 0x705beb6727feec32
xor rdx, r8
sub rcx, rdx
add rcx, 0xfffffffffffffff0
movabs rdx, 0xb7551fe8c0dc675d
movabs r8, 0x282926be569f467b
xor rdx, r8
add rcx, rdx
mov qword [rsp + 0x28], rcx
mov rcx, qword [rcx]
mov qword [rsp + 0x30], rcx
cmp rcx, 0x10
setb cl
mov byte [rsp + 0x3f], cl
cmp eax, 0xb4a45a43
je 0x140194ae0
mov al, byte [rsp + 0x3f]
test al, 1
jne 0x140194bf6
jmp 0x140194b9d
mov rcx, qword [rsp + 0x30]
mov rdx, rcx
add rdx, 0xfffffffffffffff0
mov qword [rsp + 0x20], rdx
test rdx, rdx
setns al
or rcx, rdx
sets cl
add al, cl
inc al
test al, 1
jne 0x140194bcb
jmp 0x140194bd5
call fcn.1400067fe
jmp 0x140194c17
mov rdx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
mov qword [rdx], rcx
mov r8, qword [rax]
xor ecx, ecx
call fcn.14000f8f0
jmp 0x140194c17
mov rax, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x28]
mov r8, qword [rax]
mov ecx, 1
call fcn.14000f8f0
mov rcx, qword [rsp + 0x40]
call fcn.14000fd30
nop
add rsp, 0x48
ret
loopne 0x140194c68
jno 0x140194c27
jmp 0x140194ae0
mov eax, dword [0x1401f0e70]
and al, 0x40
Function at 0x14019b0b0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x320
Function at 0x1401a3310
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov ecx, dword [0x1401e5890]
or ecx, dword [0x1401e5894]
or ecx, 0xffd7dc92
mov eax, ecx
and eax, 0x827fff97
xor eax, 0xffffffff
xor ecx, 0xffffffff
mov edx, 0xc8fb45c8
xor edx, 0x4a84ba5f
mov r8d, 0x6de3b31f
xor r8d, 0x921c4ce0
xor edx, r8d
or ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
sub eax, 0xc041dd60
cmp eax, 0x7e130e76
jbe 0x1401a341a
mov eax, dword [0x1401e5898]
mov r8d, dword [0x1401e589c]
mov edx, r8d
xor edx, 0xfd715157
mov ecx, eax
not ecx
xor r8d, 0x28eaea8
or eax, r8d
or ecx, edx
not eax
not ecx
or eax, ecx
mov ecx, eax
imul rcx, rcx, 0x1bd83cb9
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1e
xor eax, 0x1ac6c9d1
mov dword [rbp - 0xc], eax
mov eax, 0x10
call fcn.1401da3e0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x18], rax
sub rsp, 0x20
call fcn.1401a5ed0
mov rcx, qword [rbp - 0x18]
add rsp, 0x20
mov qword [rcx], 0
mov rdx, qword [rax + 0x10]
xor r8d, r8d
sub rsp, 0x20
call fcn.140012a40
mov rcx, qword [rbp - 0x18]
mov eax, dword [rbp - 0xc]
add rsp, 0x20
mov rcx, qword [rcx]
mov qword [rbp - 8], rcx
cmp eax, 0xb6a219f9
je 0x1401a336e
mov rax, qword [rbp - 8]
mov rsp, rbp
pop rbp
ret
pop rsp
test eax, 0x4be98b0a
invalid

Function at 0x1401a57c0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x90
lea rbp, [rsp + 0x80]
mov qword [rbp + 8], rcx
mov eax, dword [0x1401e5920]
mov ecx, dword [str.p_c_]
xor ecx, 0x3ea47782
add eax, ecx
mov ecx, 0x2244b1b1
xor ecx, 0x3b66ae93
or eax, ecx
mov ecx, 0x3b73cf53
xor edx, edx
div ecx
xor ecx, ecx
sub ecx, 0x17fa5c94
add eax, ecx
cmp eax, 0xd9073e9c
je 0x1401a5c94
rcl eax, 0x97
movsb byte [rdi], byte [rsi]
jmp 0x1401a5815
Function at 0x1401b97b0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x2a0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xa0], rcx
mov eax, 0x10
Function at 0x1401bf410
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov ecx, dword [0x1401e6380]
mov edx, dword [0x1401e6384]
mov eax, ecx
and eax, eax
xor eax, 0xffffffff
and eax, edx
xor eax, 0xffffffff
and edx, edx
xor edx, 0xffffffff
xor ecx, 0xffffffff
xor edx, 0xffffffff
or ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
imul ecx, eax, 0x1f76b7d1
mov edx, 0xffffffff
xor edx, 0xef5f588
mov eax, ecx
xor eax, edx
and eax, ecx
mov r8d, 0xffffffff
xor r8d, 0x97713190
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
mov r8d, 0x75b960ea
xor r8d, 0x8a469f15
xor ecx, r8d
imul ecx, edx
mov r8d, 0xfb8fd1f6
xor r8d, 0x6cfee066
mov edx, eax
and edx, r8d
mov r8d, 0x18752b4a
xor r8d, 0x8f041ada
or eax, r8d
imul eax, edx
add eax, ecx
cmp eax, 0x3c5e5262
jae 0x1401bf51a
mov eax, dword [0x1401e6388]
mov ecx, dword [0x1401e638c]
xor ecx, 0x5cd3a08f
imul eax, ecx
and eax, 0xc9df69a7
mov ecx, 0xec0ec6fb
xor ecx, 0x18b52d4a
xor edx, edx
div ecx
sub eax, 0x3a03a60d
add eax, 0xf4110ca6
add eax, 0x3a03a60d
mov dword [rsp + 0x2c], eax
call fcn.1401cfb6b
mov rcx, rax
mov eax, dword [rsp + 0x2c]
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x30], rcx
cmp eax, 0xe17e39af
je 0x1401bf4b4
mov rax, qword [rsp + 0x30]
add rsp, 0x38
ret
or dword [rax + 0x70], ebx
lodsb al, byte [rsi]
jmp 0x1401bf4b4
Function at 0x1401c8520
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
sub rsp, 0x228
lea rbp, [rsp + 0x80]
Function at 0x1401d212c
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov rax, qword gs:[0x60]
movzx rax, byte [rax + 2]
ret
Function at 0x1401d86fe
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
sub rsp, 0x38
call fcn.14016f3d2
mov qword [rsp + 0x28], rax
sub rsp, 0x28
call fcn.140063c54
call fcn.140064a1c
call fcn.140064e40
call fcn.140069f3c
call fcn.1400991b0
call fcn.1400a0e86
call fcn.1400cabbc
call fcn.140116480
call fcn.140117a71
call fcn.140128818
call fcn.1401293a0
call fcn.14015dd48
nop
add rsp, 0x28
jmp 0x14016f38c
sub rsp, 0x28
call fcn.140002ca5
call fcn.140003071
call fcn.140003efb
call fcn.140037000
mov rax, qword [sym.imp.KERNEL32.dll_TlsAlloc]
call rax
mov ecx, eax
mov rax, qword [0x1401f0e70]
mov dword [rax], ecx
mov rdx, qword [0x1401f0e88]
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
call fcn.140036ffb
call fcn.14009b878
call fcn.14009b934
call fcn.1400ac060
call fcn.140128844
call fcn.14012db18
call fcn.1401d22be
call fcn.1401d3ac1
nop
add rsp, 0x28
jmp 0x1401d86b4

Function at 0x1401d9d42
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x140261ec8]
test eax, eax
je 0x1401d9dda
lea rax, [0x140261ea0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x140261ed0]
mov qword [rbp - 8], rax
jmp 0x1401d9dbe
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x1401d9db2
cmp qword [rbp - 0x10], 0
je 0x1401d9db2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x1401d9d78
lea rax, [0x140261ea0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x1401d9ddb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x1401d9ee0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1401d9f08
mov eax, 0
jmp 0x1401d9f56
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1401d9f31
mov eax, 0
jmp 0x1401d9f56
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x1401d9f51
mov eax, 0
jmp 0x1401d9f56
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x1401d9f5c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x1401d9fda
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x1401d9fd1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x1401d9fd1
mov rax, qword [rbp - 8]
jmp 0x1401d9fef
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x1401d9fa4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140640b0c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov rsi, rdx
mov r12, rcx
test r8d, r8d
je 0x140640cf5
mov r8d, dword [rdx + 0xc]
test r8d, r8d
je 0x140640cf5
xor edi, edi
mov r9, rdx
mov qword [rbp + 0xa8], rdi
mov eax, dword [r9 + 0x10]
mov r13d, dword [r9]
add rax, r12
mov ebx, r8d
add r13, r12
add rbx, r12
mov qword [rsp + 0x30], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r15, rax
test rax, rax
jne 0x140640b8a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r15, rax
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x104
call fcn.1406388ec
test r15, r15
je 0x140640c98
mov rax, qword [r13]
xor r14d, r14d
xor ebx, ebx
test rax, rax
je 0x140640c77
mov rsi, qword [rsp + 0x30]
mov rdi, r13
jns 0x140640bc7
movzx r13d, ax
jmp 0x140640bcf
lea r13, [r12 + 2]
add r13, rax
mov rdx, r13
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
movsxd rcx, r14d
mov qword [rsi + rcx*8], rax
test rax, rax
jne 0x140640c56
cmp dword [0x14064a4f0], 1
jne 0x140640c56
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x104
call fcn.1406388ec
lea rcx, [rsp + 0x40]
call fcn.140640e5c
lea rdx, [0x140637898]
lea rcx, [rsp + 0x40]
call fcn.140638910
mov rdx, r13
lea rcx, [rsp + 0x40]
call fcn.140638910
lea rcx, [rsp + 0x40]
call fcn.140638938
mov rcx, qword [0x14064a490]
lea r9, [rbp + 0xa0]
and qword [rsp + 0x20], 0
lea rdx, [rsp + 0x40]
mov r8, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
inc rbx
inc r14d
mov rax, qword [rdi + rbx*8]
test rax, rax
jne 0x140640bbf
mov rdi, qword [rbp + 0xa8]
mov rsi, qword [rbp + 0x98]
inc rdi
mov qword [rbp + 0xa8], rdi
lea rax, [rdi + rdi*4]
lea r9, [rsi + rax*4]
mov r8d, dword [r9 + 0xc]
test r8d, r8d
jne 0x140640b55
jmp 0x140640cf5
lea rcx, [rsp + 0x40]
call fcn.140640e5c
lea rdx, [0x140637878]
lea rcx, [rsp + 0x40]
call fcn.140638910
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.140638910
cmp dword [0x14064a4f0], 1
jne 0x140640cf5
lea rcx, [rsp + 0x40]
call fcn.140638938
mov rcx, qword [0x14064a490]
lea r9, [rbp + 0xa0]
and qword [rsp + 0x20], 0
lea rdx, [rsp + 0x40]
mov r8, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x190]
xor eax, eax
add rsp, 0x150
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140640d58
Capabilities:
Read file via mapping

Disassembly:
sub rsp, 0x458
call fcn.140640e14
mov r8d, 0x208
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x14064a238], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 2
xor edx, edx
mov rcx, qword [0x14064a238]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [0x14064a240], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 4
mov rcx, qword [0x14064a240]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
movsxd rcx, dword [0x14064a4f8]
add rax, rcx
add rsp, 0x458
ret