joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007cc70
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r15, rdx
mov rsi, rcx
call fcn.14007ce20
mov rdi, qword [r15]
mov qword [r15], 0
lea rbx, [rdi + 1]
cmp rbx, 2
jb 0x14007cca0
call fcn.140071760
cmp qword [rsi], rdi
je 0x14007ccd3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14007cda0
cmp rbx, 2
jb 0x14007cccb
mov qword [rsi], rdi
call fcn.140071760
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp rsi, r15
je 0x14007cd6b
lea rdx, [r15 + 8]
lea rbx, [rsi + 8]
cmp byte [rbx + 0x17], 0
mov al, byte [rdx + 0x17]
js 0x14007cdc8
test al, al
jns 0x14007cd90
mov r14, qword [r15 + 8]
mov rdi, qword [r15 + 0x10]
cmp rdi, 0xa
jbe 0x14007cdf2
lea rax, [rdi - 0xa]
movabs rcx, 0x7fffffffffffffe5
cmp rax, rcx
jae 0x14007ce13
cmp rdi, 0x14
mov ebp, 0x14
cmova rbp, rdi
add rbp, 8
and rbp, 0xfffffffffffffff8
mov rcx, rbp
add rcx, rbp
int3
mov word [rbx + rdi*2], 0
mov eax, dword [r15 + 0x24]
mov dword [rsi + 0x24], eax
mov al, byte [r15 + 0x28]
mov byte [rsi + 0x28], al
mov al, byte [r15 + 0x29]
mov byte [rsi + 0x29], al
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov rax, qword [rdx + 0x10]
mov qword [rbx + 0x10], rax
movups xmm0, xmmword [rdx]
movups xmmword [rbx], xmm0
jmp 0x14007cd6b
call fcn.140071760
mov r14, qword [rsi]
mov rcx, qword [0x1402980e0]
test rcx, rcx
je 0x14007cde4
mov rax, qword [rcx]
mov rdx, r14
call qword [rax]
mov qword [rsi], 0
jmp 0x14007ccbd
test al, al
jns 0x14007cdd6
mov r8, qword [r15 + 0x10]
mov rdx, qword [r15 + 8]
jmp 0x14007cdda
movzx r8d, al
mov rcx, rbx
int3
int3
mov byte [rbx + 0x17], dil
test rdi, rdi
je 0x14007cd65
lea r8, [rdi + rdi]
mov rcx, rbx
mov rdx, r14
call fcn.1400cf0a0
jmp 0x14007cd65
mov rcx, rbx
int3
Function at 0x14007cf70
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov r12, rdx
mov rsi, rcx
mov rbx, qword [rdx]
mov qword [rdx], 0
lea rbp, [rbx + 1]
cmp rbp, 2
jb 0x14007cf9d
call fcn.140071760
mov qword [rsi], 0
test rbx, rbx
je 0x14007cfd9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14007d08f
cmp rbp, 2
jb 0x14007cfd0
mov qword [rsi], rbx
call fcn.140071760
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsi + 8]
cmp byte [r12 + 0x1f], 0
jns 0x14007d074
mov r14, qword [r12 + 8]
mov rbp, qword [r12 + 0x10]
cmp rbp, 0xa
jbe 0x14007d089
movabs rbx, 0x7fffffffffffffef
cmp rbp, rbx
ja 0x14007d0c5
lea rdi, [rbp + 8]
and rdi, 0xfffffffffffffff8
lea rcx, [rdi + rdi]
int3
lea r8, [rbp + 2]
add r8, rbp
mov rdx, r14
call fcn.1400cf0a0
mov eax, dword [r12 + 0x24]
mov dword [rsi + 0x24], eax
mov al, byte [r12 + 0x28]
mov byte [rsi + 0x28], al
mov al, byte [r12 + 0x29]
mov byte [rsi + 0x29], al
mov rax, rsi
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rax, [r12 + 8]
mov rdx, qword [rax + 0x10]
mov qword [rcx + 0x10], rdx
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
jmp 0x14007d04a
mov byte [rcx + 0x17], bpl
jmp 0x14007d037
call fcn.140071760
mov r14, qword [rsi]
mov rcx, qword [0x1402980e0]
test rcx, rcx
je 0x14007d0b7
mov rax, qword [rcx]
mov rdx, r14
call qword [rax]
mov qword [rsi], 0
jmp 0x14007cfc2
int3
int3
Function at 0x140084870
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov eax, dword [0x140297f88]
mov ecx, dword [0x140293330]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14008494c
mov ecx, dword [0x1402910c8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14008498f
movsxd rcx, dword [0x140297f80]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x140297f84]
jne 0x14008498f
mov rdi, qword [rax + rcx]
cmp byte [rsi], 0
jne 0x1400848e1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov rax, qword [rdi]
test rax, rax
js 0x140084996
cmp dword [rdi + 0x14], 1
jne 0x1400849a0
mov rcx, qword [rdi + 8]
test rcx, rcx
jne 0x1400849df
movabs rax, 0xbfffffffffffffff
lock and qword [rdi], rax
mov rsi, qword [rsi + 8]
mov rcx, qword [rdi + 8]
test rcx, rcx
jne 0x1400849fd
mov rax, qword [rdi]
movabs rcx, 0x6000000000000000
and rcx, rax
movabs rax, 0xffffffffffffff
and rsi, rax
or rsi, rcx
mov qword [rdi], rsi
add dword [rdi + 0x14], 0xffffffff
jmp 0x1400848d9
lea rcx, [0x140297f88]
int3
xor edi, edi
jmp 0x1400848d4
int3
cmp byte [rsi + 0x10], 0
je 0x140084912
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1400849cc
mov rbx, qword [rdi]
call qword [rcx + 8]
movabs rcx, 0xff00000000000000
and rcx, rbx
or rcx, rax
mov qword [rdi], rcx
movabs rax, 0x4000000000000000
lock or qword [rdi], rax
jmp 0x140084912
mov rbx, qword [rdi]
call qword [rcx + 8]
movabs rcx, 0xff00000000000000
and rcx, rbx
or rcx, rax
mov qword [rdi], rcx
jmp 0x140084904
mov rbx, qword [rdi]
call qword [rcx + 8]
movabs rcx, 0xff00000000000000
and rcx, rbx
or rcx, rax
mov qword [rdi], rcx
jmp 0x140084923
Function at 0x140092510
Capabilities:
Get thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rcx
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0x30], rax
cmp byte [rcx + 0x18], 0
je 0x1400925d1
mov eax, dword [0x14029bfe0]
mov ecx, dword [0x140293330]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140092635
mov ecx, dword [0x1402910c8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [0x14029bfe0]
mov ecx, dword [0x140293330]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140092678
mov ecx, dword [0x1402910c8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400925c5
movsxd rcx, dword [0x14029bfd8]
shl rcx, 4
mov qword [rax + rcx], 0
mov ecx, dword [0x14029bfdc]
movsxd rdx, dword [0x14029bfd8]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rbx, qword [rsi]
mov rdi, qword [rsi + 8]
cmp rbx, rdi
jne 0x1400925ef
cmp qword [rsi], 0
jne 0x140092623
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400ccfe0
nop
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
lea r14, [rsp + 0x28]
mov r9, qword [rbx + 0x30]
mov rcx, qword [rbx]
mov rax, qword [rbx + 0x28]
mov qword [rsp + 0x28], rax
mov qword [rbx + 0x28], 0
mov rax, qword [rcx]
lea rdx, [rbx + 8]
mov r8, r14
call qword [rax]
add rbx, 0x38
cmp rbx, rdi
je 0x1400925d1
jmp 0x1400925f4
mov rcx, rsi
int3
lea rcx, [0x14029bfe0]
int3
lea rcx, [0x14029bfe0]
int3
Function at 0x140098d50
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x1402910c8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140098d8e
movsxd rcx, dword [rsi]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rsi + 4]
movsxd rdx, dword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
test rdi, rdi
je 0x140098d87
call fcn.140008460
jmp 0x140098d6e

Function at 0x14009acb0
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm6
mov rsi, rdx
mov rbx, rcx
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0x68], rax
movups xmm0, xmmword [rdx]
lea rdx, [rsp + 0x50]
movaps xmmword [rdx], xmm0
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 3
call fcn.14009bb10
movups xmm0, xmmword [rdi]
movups xmmword [rsi], xmm0
cmp qword [rsi + 8], 0
je 0x14009aed5
movups xmm0, xmmword [rsi]
mov qword [rsp + 0x28], rbx
movups xmmword [rbx], xmm0
mov dword [rsp + 0x4c], 0
lea rcx, str.api_ms_win_downlevel_shell32_l1_1_0.dll
xor edx, edx
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test rax, rax
mov qword [rsp + 0x20], rax
je 0x14009af0b
lea rdx, [0x14025c29a]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14009af1e
mov rbx, rax
mov rcx, qword [rsi]
lea rdx, [rsp + 0x4c]
call rax
mov r12, rax
movsxd rbp, dword [rsp + 0x4c]
xorps xmm6, xmm6
movaps xmmword [rsp + 0x30], xmm6
mov qword [rsp + 0x40], 0
test rbp, rbp
je 0x14009af26
test ebp, ebp
js 0x14009af2d
shl rbp, 3
lea rsi, [rbp*2]
add rsi, rbp
mov rcx, rsi
int3
lea rdx, [rsp + 0x30]
mov rsi, qword [rsp + 0x28]
mov rcx, rsi
int3
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400ccfe0
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsi]
lea rdx, [rsp + 0x4c]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x14009ad68
xor r12d, r12d
jmp 0x14009ad6b
xor ebx, ebx
jmp 0x14009ae6c
lea rcx, [rsp + 0x30]
int3

Function at 0x1400a08a0
Capabilities:
Get thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [0x140299978]
cmp rbx, 1
jbe 0x1400a08f4
mov ecx, dword [0x1402910c8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400a093a
movsxd rcx, dword [rbx]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rbx + 4]
movsxd rdx, dword [rbx]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x140299978]
call fcn.14008f690
test al, al
je 0x1400a0946
mov qword [0x140299980], 0
lea r14, [0x140299978]
lea rbx, [0x140299980]
mov rcx, rbx
xor edx, edx
call fcn.1400721e0
mov rcx, r14
mov rdx, rbx
xor r8d, r8d
mov r9, r14
call fcn.14008f670
jmp 0x1400a08bc
test rdi, rdi
je 0x1400a08e7
call fcn.140008460
jmp 0x1400a08ce
mov rbx, qword [0x140299978]
jmp 0x1400a08bc
Function at 0x1400a0960
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x1402910c8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400a0994
movsxd rcx, dword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 4]
jne 0x1400a0994
mov rax, qword [rax + rcx]
add rsp, 0x20
pop rsi
ret
xor eax, eax
jmp 0x1400a098e

Function at 0x1400a41c0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov eax, dword [0x14029ba28]
mov ecx, dword [0x140293330]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400a4225
mov ecx, dword [0x1402910c8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400a4261
movsxd rcx, dword [0x14029ba20]
shl rcx, 4
mov qword [rax + rcx], rsi
mov ecx, dword [0x14029ba24]
movsxd rdx, dword [0x14029ba20]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x20
pop rsi
ret
lea rcx, [0x14029ba28]
int3
test rsi, rsi
je 0x1400a421f
call fcn.140008460
jmp 0x1400a41fb
Function at 0x1400ae960
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rcx
mov eax, dword [0x14029ba08]
mov ecx, dword [0x140293330]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400ae9cf
mov ecx, dword [0x1402910c8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, 0xffffffff
and rax, 0xfffffffffffffffc
je 0x1400ae9c3
movsxd rdx, dword [0x14029ba00]
shl rdx, 4
mov esi, dword [rax + rdx + 8]
cmp esi, dword [0x14029ba04]
jne 0x1400ae9c3
mov rax, qword [rax + rdx]
test rax, rax
je 0x1400ae9c3
mov ecx, dword [rax]
mov dword [rdi], ecx
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x14029ba08]
int3

Function at 0x1400b9b50
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [rdx]
mov qword [rdx], 0
lea rbp, [rbx + 1]
cmp rbp, 2
jae 0x1400b9bcd
cmp qword [rsi], rbx
je 0x1400b9ba7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x1400b9bd4
cmp rbp, 2
jb 0x1400b9b9e
mov qword [rsi], rbx
call fcn.140071760
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov al, byte [rdi + 8]
mov byte [rsi + 8], al
mov byte [rdi + 8], 0
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x1400b9c07
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.140071760
jmp 0x1400b9b76
call fcn.140071760
mov r14, qword [rsi]
mov rcx, qword [0x1402980e0]
test rcx, rcx
je 0x1400b9bf9
mov rax, qword [rcx]
mov rdx, r14
call qword [rax]
mov qword [rsi], 0
jmp 0x1400b9b90
int3
call fcn.140071760
mov rbx, qword [rdi]
mov rcx, qword [0x1402980e0]
test rcx, rcx
je 0x1400b9c2c
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax]
mov qword [rdi], 0
jmp 0x1400b9bbd
int3

Function at 0x1400bb9d0
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [rdx]
mov qword [rdx], 0
lea rbp, [rbx + 1]
cmp rbp, 2
jb 0x1400bb9fb
call fcn.140071760
mov qword [rsi], 0
test rbx, rbx
je 0x1400bba33
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x1400bba5d
cmp rbp, 2
jb 0x1400bba2a
mov qword [rsi], rbx
call fcn.140071760
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov al, byte [rdi + 8]
mov byte [rsi + 8], al
xor eax, eax
mov byte [rsi + 9], al
mov byte [rdi + 8], al
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x1400bba90
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.140071760
mov r14, qword [rsi]
mov rcx, qword [0x1402980e0]
test rcx, rcx
je 0x1400bba82
mov rax, qword [rcx]
mov rdx, r14
call qword [rax]
mov qword [rsi], 0
jmp 0x1400bba1c
int3
call fcn.140071760
mov rbx, qword [rdi]
mov rcx, qword [0x1402980e0]
test rcx, rcx
je 0x1400bbab5
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax]
mov qword [rdi], 0
jmp 0x1400bba4d
int3
Function at 0x1400bdb78
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
cmp qword [rcx], rdx
je 0x1400bdbc4
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x1400bdbcf
lea rax, [rsi + 1]
cmp rax, 2
jb 0x1400bdbb2
mov qword [rdi], rsi
call fcn.140071760
mov ecx, ebx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.140071760
mov r14, qword [rdi]
mov rcx, qword [0x1402980e0]
test rcx, rcx
je 0x1400bdbf4
mov rax, qword [rcx]
mov rdx, r14
call qword [rax]
mov qword [rdi], 0
jmp 0x1400bdba0
int3

Function at 0x1400c0fe0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
push rdi
mov r9, qword [rcx]
mov r10, qword [rcx + 8]
mov r8, r10
sub r8, r9
je 0x1400c106f
mov rax, r8
shr rax, 2
mov rdx, r9
not rdx
add rdx, r10
jne 0x1400c1007
xor edx, edx
jmp 0x1400c104c
mov r10, r8
and r10, 0xfffffffffffffffe
xor edx, edx
lea r11, [0x140263af0]
nop word [rax + rax]
movzx esi, al
movzx edi, byte [r9 + rdx]
xor edi, esi
shr eax, 8
xor eax, dword [r11 + rdi*4]
movzx esi, al
movzx edi, byte [r9 + rdx + 1]
xor edi, esi
shr eax, 8
xor eax, dword [r11 + rdi*4]
add rdx, 2
cmp r10, rdx
jne 0x1400c1020
test r8b, 1
je 0x1400c1069
movzx edi, al
movzx edx, byte [r9 + rdx]
xor edx, edi
lea rdi, [0x140263af0]
shr eax, 8
xor eax, dword [rdi + rdx*4]
mov dword [rcx + 0x18], eax
pop rdi
pop rsi
ret
xor eax, eax
jmp 0x1400c1069

Function at 0x1400c1d10
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov qword [rcx], rdx
mov rdi, qword [0x140295ff8]
cmp rdi, 1
jbe 0x1400c1d60
mov ecx, dword [0x1402910c8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400c1da6
movsxd rcx, dword [rdi]
shl rcx, 4
mov qword [rax + rcx], rsi
mov ecx, dword [rdi + 4]
movsxd rdx, dword [rdi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x140295ff8]
call fcn.14008f690
test al, al
je 0x1400c1db2
mov qword [0x140296000], 0
lea rbx, [0x140295ff8]
lea rdi, [0x140296000]
mov rcx, rdi
xor edx, edx
call fcn.1400721e0
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.14008f670
jmp 0x1400c1d2a
test rsi, rsi
je 0x1400c1d55
call fcn.140008460
jmp 0x1400c1d3c
mov rdi, qword [0x140295ff8]
jmp 0x1400c1d2a
Function at 0x1400c1dc0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, qword [0x140297820]
cmp rsi, 1
jbe 0x1400c1e04
mov ecx, dword [0x1402910c8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400c1e53
movsxd rcx, dword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 4]
jne 0x1400c1e53
cmp qword [rax + rcx], 0
setne al
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x140297820]
call fcn.14008f690
test al, al
je 0x1400c1e4a
mov qword [0x140297828], 0
lea rdi, [0x140297820]
lea rsi, [0x140297828]
mov rcx, rsi
xor edx, edx
call fcn.1400721e0
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
mov r9, rdi
call fcn.14008f670
jmp 0x1400c1dd3
mov rsi, qword [0x140297820]
jmp 0x1400c1dd3
xor eax, eax
jmp 0x1400c1dfd

Function at 0x1400c5740
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov eax, dword [rdx]
mov dword [rcx], eax
mov eax, 1
lock xadd dword [0x14029ba0c], eax
mov dword [rcx + 4], eax
mov eax, dword [0x14029ba08]
mov ecx, dword [0x140293330]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400c5829
mov ecx, dword [0x1402910c8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400c58af
movsxd rcx, dword [0x14029ba00]
shl rcx, 4
mov qword [rax + rcx], rsi
mov ecx, dword [0x14029ba04]
movsxd rdx, dword [0x14029ba00]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov eax, dword [0x14029ba18]
mov ecx, dword [0x140293330]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400c586c
lea rdi, [rsi + 4]
mov ecx, dword [0x1402910c8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400c58c2
movsxd rcx, dword [0x14029ba10]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [0x14029ba14]
movsxd rdx, dword [0x14029ba10]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rax, rsi
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x14029ba08]
int3
lea rcx, [0x14029ba18]
int3
test rsi, rsi
je 0x1400c57bc
call fcn.140008460
jmp 0x1400c5798
test rdi, rdi
je 0x1400c581f
call fcn.140008460
jmp 0x1400c57fb

Function at 0x1400c58e0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov byte [rcx], dl
mov rdi, qword [0x140299ab8]
cmp rdi, 1
jbe 0x1400c592f
mov ecx, dword [0x1402910c8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400c5975
movsxd rcx, dword [rdi]
shl rcx, 4
mov qword [rax + rcx], rsi
mov ecx, dword [rdi + 4]
movsxd rdx, dword [rdi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x140299ab8]
call fcn.14008f690
test al, al
je 0x1400c5981
mov qword [0x140299ac0], 0
lea rbx, [0x140299ab8]
lea rdi, [0x140299ac0]
mov rcx, rdi
xor edx, edx
call fcn.1400721e0
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.14008f670
jmp 0x1400c58f9
test rsi, rsi
je 0x1400c5924
call fcn.140008460
jmp 0x1400c590b
mov rdi, qword [0x140299ab8]
jmp 0x1400c58f9
Function at 0x1400c5990
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, qword [0x140299ab8]
cmp rsi, 1
jbe 0x1400c59d9
mov ecx, dword [0x1402910c8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400c59d2
movsxd rcx, dword [rsi]
shl rcx, 4
mov qword [rax + rcx], 0
mov ecx, dword [rsi + 4]
movsxd rdx, dword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x140299ab8]
call fcn.14008f690
test al, al
je 0x1400c5a1f
mov qword [0x140299ac0], 0
lea rdi, [0x140299ab8]
lea rsi, [0x140299ac0]
mov rcx, rsi
xor edx, edx
call fcn.1400721e0
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
mov r9, rdi
call fcn.14008f670
jmp 0x1400c59a3
mov rsi, qword [0x140299ab8]
jmp 0x1400c59a3

Function at 0x1400c5a30
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x14029ba08]
mov ecx, dword [0x140293330]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400c5af7
mov ecx, dword [0x1402910c8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400c5a93
movsxd rcx, dword [0x14029ba00]
shl rcx, 4
mov qword [rax + rcx], 0
mov ecx, dword [0x14029ba04]
movsxd rdx, dword [0x14029ba00]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov eax, dword [0x14029ba18]
mov ecx, dword [0x140293330]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400c5b3a
mov ecx, dword [0x1402910c8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400c5af2
movsxd rcx, dword [0x14029ba10]
shl rcx, 4
mov qword [rax + rcx], 0
mov ecx, dword [0x14029ba14]
movsxd rdx, dword [0x14029ba10]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
ret
lea rcx, [0x14029ba08]
int3
lea rcx, [0x14029ba18]
int3

Function at 0x1400c5e90
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov edi, dword [0x14029b018]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test esi, esi
jne 0x1400c5ebd
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400c5eb3

Function at 0x1400cbe98
Capabilities:
Encode data using xor

Disassembly:
push rbp
hlt
and eax, dword [rsi]
fcmovnb st(0), st(0)
imul dword [rdx]
sbb edi, dword [rax]
test dh, 0xb7
cdq
stc
xor al, 0xbd
jae 0x1400cbe96
cwde
movabs al, byte [0x3c2e0d4113264c59]
js 0x1400cbe50
int3
Function at 0x1400cdb0d
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x1400cdb2b
je 0x1400cdb36
call 0x1400cdb85
mov bl, 0xc7
lahf
pop rsi
jne 0x1400cdb16
call 0x1400cdb2e
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x1400cdb16
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x1400cdb64
je 0x1400cdba2
invalid
je 0x1400cdbb3
jne 0x1400cdb16
lea rax, [0x1400cda3c]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x1400c979d]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x1400cdc54
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x1400cdcad
je 0x1400cdcb3
call 0x1400cdca4
fild qword [rdi - 0x7c]
jmp 0x17500a426
jne 0x1400cdc76
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x1400cdc36
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret