joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40fd00
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x004aa9c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004aa9a0]
test rbx, rbx
je 0x40fd54
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x40fd4b
test rsi, rsi
je 0x40fd4b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x40fd30
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x004aa9c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax

Function at 0x4104f0
Capabilities:
Check mutex on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x80]
mov rdi, rcx
movsxd r12, edx
mov r13, r8
call sub.msvcrt.dll_strlen
mov rsi, rax
lea ebx, [rax + 0xf]
lea eax, [rax + 0x52]
cdqe
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.00410430
sub rsp, rax
movsxd r14, esi
movabs rax, 0x656d68732d636367
lea r15, [rsp + 0x20]
lea rcx, [rsp + 0x2f]
mov r8, r14
mov rdx, rdi
mov qword [rsp + 0x20], rax
mov eax, 0x326d
mov dword [rsp + 0x28], 0x64742d6d
mov word [rsp + 0x2c], ax
movsxd rbx, ebx
mov byte [rsp + 0x2e], 0x2d
call sub.msvcrt.dll_memcpy
lea rax, [r15 + r14 + 0x10]
lea r14d, [rsi + 0x50]
movabs rdx, 0x6161616161616161
xor ecx, ecx
mov r8, r15
mov qword [rax], rdx
mov qword [rax + 8], rdx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], rdx
mov qword [rax + 0x20], rdx
mov qword [rax + 0x28], rdx
mov qword [rax + 0x30], rdx
mov qword [rax + 0x38], rdx
movsxd rax, r14d
xor edx, edx
mov byte [rsp + rax + 0x20], 0
mov byte [rsp + rbx + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov byte [rsp + rbx + 0x20], 0x2d
mov rdi, rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4105d9
int3
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindAtomA]
test ax, ax
jne 0x410678
mov rcx, r12
call sub.msvcrt.dll_malloc
lea r9d, [rsi + 0x10]
mov rbx, rax
mov r10d, 0x40
bt rbx, r10
jae 0x410614
mov r11d, r14d
sub r11d, r10d
movsxd r11, r11d
mov byte [r15 + r11], 0x41
sub r10d, 1
jne 0x410600
mov dword [rbp - 0x54], r9d
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_AddAtomA]
test ax, ax
mov r9d, dword [rbp - 0x54]
je 0x410675
lea r8d, [rsi + 0x51]
movzx ecx, ax
mov rdx, r15
call fcn.00410470
cmp rax, rbx
mov rsi, rax
je 0x410690
mov rcx, rbx
call fcn.0041aa70
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rsi
lea rsp, [rbp - 0x48]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
int3
lea r9d, [rsi + 0x10]
lea r8d, [rsi + 0x51]
movzx ecx, ax
mov rdx, r15
call fcn.00410470
mov rsi, rax
jmp 0x41064f
xor edx, edx
mov r8, r12
mov rcx, rbx
call sub.msvcrt.dll_memset
test r13, r13
je 0x41064f
mov rcx, rbx
call r13
jmp 0x41064f
Function at 0x41b880
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [0x004ab508]
test rbx, rbx
je 0x41b8b0
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [rbx], eax
mov rax, qword [0x004ab508]
test rax, rax
je 0x41b8d4
cmp dword [rax], 0xffffffff
je 0x41b8f5
add rsp, 0x20
pop rbx
ret
lea r8, [0x0041ad10]
lea rcx, str._pthread_tls_shmem
mov edx, 4
call fcn.00420a60
mov rbx, rax
mov qword [0x004ab508], rax
jmp 0x41b891
lea r8, [0x0041ad10]
lea rcx, str._pthread_tls_shmem
mov edx, 4
call fcn.00420a60
mov qword [0x004ab508], rax
jmp 0x41b8a5
call sub.msvcrt.dll_abort
nop
nop dword [rax + rax]

Function at 0x41bd90
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rcx, qword [0x004ab510]
test rcx, rcx
je 0x41bed0
call fcn.0041bd00
mov rax, qword [0x004ab508]
test rax, rax
je 0x41bef3
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x41bdd3
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
call fcn.0041b6d0
test rax, rax
mov rbx, rax
je 0x41bf3b
cmp qword [0x004ae050], 0
je 0x41bf3b
mov dword [rax + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, 1
mov dword [rbx + 0x68], eax
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rsi, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rbx + 0x30], rax
mov qword [rbx + 0x38], 0xffffffffffffffff
mov qword [rbx + 0x60], 0xffffffffffffffff
mov dword [rbx + 0xb0], 0
mov qword [rbx + 0x28], 0
call rsi
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rdi, rax
call rsi
mov dword [rsp + 0x30], 2
mov rcx, rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rbx + 0x28]
mov r8, rbp
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x41bf42
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [rbx + 0xb8], eax
movzx eax, byte [rbx + 0x40]
mov dword [rbx + 0xb4], 0
and eax, 0xffffffcf
or eax, 0x10
mov byte [rbx + 0x40], al
mov rax, qword [0x004ab508]
test rax, rax
je 0x41bf17
mov rdx, rbx
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x41bf42
mov rax, rbx
jmp 0x41bdca
lea rcx, str._pthread_tls_once_shmem
xor r8d, r8d
mov edx, 4
call fcn.00420a60
mov rcx, rax
mov qword [0x004ab510], rax
jmp 0x41bda8
lea r8, [0x0041ad10]
lea rcx, str._pthread_tls_shmem
mov edx, 4
call fcn.00420a60
mov qword [0x004ab508], rax
jmp 0x41bdbd
lea r8, [0x0041ad10]
lea rcx, str._pthread_tls_shmem
mov edx, 4
call fcn.00420a60
mov qword [0x004ab508], rax
jmp 0x41beb8
xor eax, eax
jmp 0x41bdca
call sub.msvcrt.dll_abort
nop
nop dword [rax + rax]
lea rcx, str._pthread_key_dest_shmem
xor r8d, r8d
mov edx, 8
jmp fcn.00420a60
Function at 0x41bf50
Capabilities:
Check mutex on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rcx, qword [0x004ab510]
test rcx, rcx
je 0x41bed0
call fcn.0041bd00
mov rax, qword [0x004ab508]
test rax, rax
je 0x41bef3
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x41bdd3
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
call fcn.0041b6d0
test rax, rax
mov rbx, rax
je 0x41bf3b
cmp qword [0x004ae050], 0
je 0x41bf3b
mov dword [rax + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, 1
mov dword [rbx + 0x68], eax
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rsi, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rbx + 0x30], rax
mov qword [rbx + 0x38], 0xffffffffffffffff
mov qword [rbx + 0x60], 0xffffffffffffffff
mov dword [rbx + 0xb0], 0
mov qword [rbx + 0x28], 0
call rsi
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rdi, rax
call rsi
mov dword [rsp + 0x30], 2
mov rcx, rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rbx + 0x28]
mov r8, rbp
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x41bf42
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [rbx + 0xb8], eax
movzx eax, byte [rbx + 0x40]
mov dword [rbx + 0xb4], 0
and eax, 0xffffffcf
or eax, 0x10
mov byte [rbx + 0x40], al
mov rax, qword [0x004ab508]
test rax, rax
je 0x41bf17
mov rdx, rbx
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x41bf42
mov rax, rbx
jmp 0x41bdca
lea rcx, str._pthread_tls_once_shmem
xor r8d, r8d
mov edx, 4
call fcn.00420a60
mov rcx, rax
mov qword [0x004ab510], rax
jmp 0x41bda8
lea r8, [0x0041ad10]
lea rcx, str._pthread_tls_shmem
mov edx, 4
call fcn.00420a60
mov qword [0x004ab508], rax
jmp 0x41bdbd
lea r8, [0x0041ad10]
lea rcx, str._pthread_tls_shmem
mov edx, 4
call fcn.00420a60
mov qword [0x004ab508], rax
jmp 0x41beb8
xor eax, eax
jmp 0x41bdca
call sub.msvcrt.dll_abort
nop
nop dword [rax + rax]
lea rcx, str._pthread_key_dest_shmem
xor r8d, r8d
mov edx, 8
jmp fcn.00420a60
Function at 0x41ed00
Capabilities:
Check mutex on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
mov rcx, qword [0x004ab558]
mov esi, edx
test rcx, rcx
je 0x41eca0
call fcn.00420e20
cmp dword [rbx], 0xbab1f00d
jne 0x41ecc7
mov eax, dword [rbx + 4]
test eax, eax
jle 0x41ecc7
mov eax, dword [rbx + 4]
test eax, eax
jle 0x41ec53
mov eax, dword [rbx + 4]
sub eax, 1
mov dword [rbx + 4], eax
mov rcx, qword [0x004ab558]
test rcx, rcx
je 0x41ec70
call fcn.00420ed0
mov eax, esi
add rsp, 0x38
pop rbx
pop rsi
ret
lea r8, [0x0041e9e0]
lea rcx, str.mutex_global_shmem
mov edx, 8
call fcn.00420a60
mov rcx, rax
mov qword [0x004ab558], rax
call fcn.00420ed0
mov eax, esi
add rsp, 0x38
pop rbx
pop rsi
ret
lea rcx, str.mutex_global_shmem
lea r8, [0x0041e9e0]
mov edx, 8
call fcn.00420a60
mov rcx, rax
mov qword [0x004ab558], rax
jmp 0x41ec27
call qword [sym.imp.msvcrt.dll___iob_func]
lea r9, str.C:_crossdev_src_winpthreads_git20141130_src_mutex.c
lea rcx, [rax + 0x60]
lea r8, str._m___valid__LIFE_MUTEX____m___busy___0_
lea rdx, [0x0048e720]
mov dword [rsp + 0x20], 0x39
call sub.msvcrt.dll_fprintf
mov ecx, 1
call sub.msvcrt.dll_exit
nop
nop
lea r8, [0x0041e9e0]
lea rcx, str.mutex_global_shmem
mov edx, 8
jmp fcn.00420a60
Function at 0x420a60
Capabilities:
Check mutex on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x80]
mov rdi, rcx
movsxd r12, edx
mov r13, r8
call sub.msvcrt.dll_strlen
mov r14, rax
lea ebx, [rax + 0xf]
lea eax, [rax + 0x51]
cdqe
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.00410430
sub rsp, rax
movsxd r15, r14d
movabs rax, 0x656d68732d636367
lea rsi, [rsp + 0x20]
lea rcx, [rsp + 0x2f]
mov r8, r15
mov rdx, rdi
mov qword [rsp + 0x20], rax
mov eax, 0x326d
mov dword [rsp + 0x28], 0x64742d6d
mov word [rsp + 0x2c], ax
movsxd rbx, ebx
mov byte [rsp + 0x2e], 0x2d
call sub.msvcrt.dll_memcpy
lea rax, [rsi + r15 + 0x10]
lea r15d, [r14 + 0x50]
movabs rdx, 0x6161616161616161
xor ecx, ecx
mov r8, rsi
mov qword [rax], rdx
mov qword [rax + 8], rdx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], rdx
mov qword [rax + 0x20], rdx
mov qword [rax + 0x28], rdx
mov qword [rax + 0x30], rdx
mov qword [rax + 0x38], rdx
movsxd rax, r15d
xor edx, edx
mov byte [rsp + rax + 0x20], 0
mov byte [rsp + rbx + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov byte [rsp + rbx + 0x20], 0x2d
mov rdi, rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x420b49
int3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindAtomA]
test ax, ax
jne 0x420be2
mov rcx, r12
add r14d, 0x10
call sub.msvcrt.dll_malloc
mov r10d, 0x40
mov rbx, rax
bt rbx, r10
jae 0x420b84
mov r11d, r15d
sub r11d, r10d
movsxd r11, r11d
mov byte [rsi + r11], 0x41
sub r10d, 1
jne 0x420b70
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_AddAtomA]
test ax, ax
je 0x420bdf
mov rdx, rsi
movzx ecx, ax
mov r9d, r14d
mov r8d, r15d
call fcn.004209e0
cmp rax, rbx
mov rsi, rax
je 0x420bf9
mov rcx, rbx
call fcn.0041aa70
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rsi
lea rsp, [rbp - 0x58]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
int3
lea r9d, [r14 + 0x10]
mov rdx, rsi
movzx ecx, ax
mov r8d, r15d
call fcn.004209e0
mov rsi, rax
jmp 0x420bb9
xor edx, edx
mov r8, r12
mov rcx, rbx
call sub.msvcrt.dll_memset
test r13, r13
je 0x420bb9
mov rcx, rbx
call r13
jmp 0x420bb9

Function at 0x4227e0
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [0x00472560]
lea rcx, str.__terminate_handler_sh
mov edx, 8
jmp fcn.004104f0

Function at 0x422800
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [0x00472570]
lea rcx, str.__unexpected_handler_sh
mov edx, 8
jmp fcn.004104f0
Function at 0x452980
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, qword [sym.imp.msvcrt.dll__errno]
mov rbp, rcx
mov rdi, rdx
mov esi, r8d
mov rcx, rbp
call fcn.00452860
mov r8d, esi
mov rdx, rdi
mov ecx, eax
call sub.msvcrt.dll__read
movsxd rbx, eax
cmp rbx, 0xffffffffffffffff
je 0x4529d0
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call r12
cmp dword [rax], 4
je 0x45299a
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x140001e7c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x28], rcx
lea r8, [rbp - 0x38]
xor ebx, ebx
mov dword [rbp - 0x38], 0x30
xorps xmm0, xmm0
mov qword [rbp - 0x30], rbx
mov dword [rbp - 0x20], 0x40
lea rcx, [rbp + 0x10]
movdqu xmmword [rbp - 0x18], xmm0
mov qword [rbp + 0x10], rbx
movabs rsi, 0xfffff78000000330
mov edx, 0xf003f
mov edi, 0xc0000001
mov eax, dword [rsi]
mov r9d, eax
imul r9, rax
imul r9, rax
imul r9, rax
xor r9, qword [0x140007060]
call r9
test eax, eax
js 0x140001faa
mov eax, dword [rsi]
mov rcx, qword [rbp + 0x10]
mov edx, eax
imul rdx, rax
imul rdx, rax
imul rdx, rax
xor rdx, qword [0x140007068]
call rdx
mov edi, eax
test eax, eax
jns 0x140001f8b
cmp byte [0x14000676d], bl
mov ecx, dword [0x140006768]
movups xmm0, xmmword [0x140006758]
mov dword [rbp - 0x40], ecx
movzx ecx, word [0x14000676c]
movups xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x3c], cx
je 0x140001f67
lea r8, [rbp - 0x50]
mov eax, 0x5397829d
mul ebx
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, bl
inc ebx
sub al, cl
add al, 0x39
xor byte [r8], al
inc r8
cmp ebx, 0x16
jl 0x140001f44
mov eax, dword [rsi]
lea r8, [rbp - 0x50]
mov r9d, eax
xor edx, edx
imul r9, rax
lea ecx, [rdx + 0x4d]
imul r9, rax
imul r9, rax
xor r9, qword [0x140007018]
call r9
mov eax, dword [rsi]
mov rcx, qword [rbp + 0x10]
mov edx, eax
imul rdx, rax
imul rdx, rax
imul rdx, rax
xor rdx, qword [0x140007070]
call rdx
jmp 0x140002011
cmp byte [0x140006783], bl
movups xmm0, xmmword [0x140006770]
mov eax, dword [0x140006780]
mov dword [rbp - 0x40], eax
movups xmmword [rbp - 0x50], xmm0
je 0x140001fed
lea r8, [rbp - 0x50]
mov eax, 0x5397829d
mul ebx
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, bl
inc ebx
sub al, cl
add al, 0x39
xor byte [r8], al
inc r8
cmp ebx, 0x14
jl 0x140001fca
mov eax, dword [rsi]
lea r8, [rbp - 0x50]
mov r9d, eax
xor edx, edx
imul r9, rax
lea ecx, [rdx + 0x4d]
imul r9, rax
imul r9, rax
xor r9, qword [0x140007018]
call r9
lea r11, [rsp + 0x70]
mov eax, edi
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14000202c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rsi, rdx
mov rdi, rcx
call fcn.140002c34
xor ebp, ebp
test al, al
je 0x140002160
call fcn.140005a54
test al, al
je 0x140002160
lea rcx, [0x140007140]
call qword [sym.imp.ntoskrnl.exe_RtlGetVersion]
mov rbx, qword [rdi + 0x28]
mov rcx, rsi
call fcn.140001e7c
lea rsi, [rbx + 0x48]
mov rcx, rsi
call fcn.14000276c
movups xmm0, xmmword [rbx + 0x58]
lea rdx, [rsp + 0x20]
mov rcx, rdi
movdqu xmmword [rsp + 0x20], xmm0
call fcn.1400015d0
test eax, eax
js 0x1400020ba
movups xmm0, xmmword [rbx + 0x58]
lea rcx, [rsp + 0x20]
movdqu xmmword [rsp + 0x20], xmm0
call fcn.140001134
test eax, eax
jns 0x140002137
cmp byte [0x14000679b], bpl
movups xmm0, xmmword [str.bY__]
mov eax, dword [0x140006798]
mov dword [rsp + 0x30], eax
movups xmmword [rsp + 0x20], xmm0
je 0x140002108
mov r8d, ebp
lea r9, [rsp + 0x20]
mov eax, 0x5397829d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x39
xor byte [r9], al
inc r9
cmp r8d, 0x14
jl 0x1400020e1
movabs rax, 0xfffff78000000330
lea r8, [rsp + 0x20]
xor edx, edx
mov eax, dword [rax]
mov r9d, eax
lea ecx, [rdx + 0x4d]
imul r9, rax
imul r9, rax
imul r9, rax
xor r9, qword [0x140007018]
call r9
movzx r8d, word [rbx + 0x58]
xor edx, edx
mov rcx, qword [rbx + 0x60]
call fcn.140005dc0
movzx r8d, word [rsi]
xor edx, edx
mov rcx, qword [rbx + 0x50]
mov dword [rbx + 0x58], ebp
call fcn.140005dc0
mov word [rsi], bp
mov word [rbx + 0x4a], bp
mov rbx, qword [rsp + 0x50]
mov eax, 0xc0000001
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x1400022d8
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
movsxd r9, dword [rcx + 0x3c]
mov rdi, r8
mov r11, rdx
mov rbx, rcx
movzx eax, word [r9 + rcx + 0x14]
lea r10, [r9 + rcx]
add rax, 0x18
add r10, rax
movzx eax, word [r9 + rcx + 6]
lea r9, [rax + rax*4]
lea rsi, [r10 + r9*8]
cmp r10, rsi
jae 0x1400023a1
mov rax, qword [r10]
mov rbp, r11
mov qword [rsp + 0x18], rax
test r11, r11
je 0x140002372
lea r8, [rsp + 0x18]
sub r8, r11
movsx ecx, byte [r8 + rbp]
movsx edx, byte [rbp]
inc rbp
lea eax, [rcx - 0x41]
cmp ax, 0x19
lea r9d, [rcx + 0x20]
lea eax, [rdx - 0x41]
cmova r9w, cx
cmp ax, 0x19
lea ecx, [rdx + 0x20]
cmova cx, dx
test r9w, r9w
jne 0x14000236c
test cx, cx
je 0x140002378
cmp r9w, cx
je 0x140002337
add r10, 0x28
jmp 0x140002316
test rdi, rdi
je 0x140002398
mov ecx, dword [r10 + 8]
mov eax, dword [r10 + 0x10]
cmp ecx, eax
cmovbe ecx, eax
add ecx, 0xfff
and ecx, 0xfffff000
mov dword [rdi], ecx
mov eax, dword [r10 + 0xc]
add rax, rbx
jmp 0x1400023a3
xor eax, eax
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
pop r14
pop rdi
ret
Function at 0x140132fa3
Capabilities:
Access peb ldr_data
Hash data using fnv

Disassembly:
add byte [rax], al
add byte [rcx - 1], al
ror dword [rcx - 0x7d], 0xc0
add cl, byte [rcx + 0x63]
ror dword [rcx + 0x3b], 0xc3
add byte [rax], al
xor ebp, 0xf5dc1ab9
jmp 0x1401314f9
mov bh, 0x65
movsd dword [rdi], dword [rsi]
pop rcx
retf 0xff59
cmp edx, 0xb4944674
js 0x14013284d
lea r11d, [rbp - 0x2d51]
rcl edi, 0x1c
add r9d, 0x235f9bcb
and r12d, 0x1588fcb4
syscall
dec rbp
inc r15
in eax, 0x7c
cmp ebx, 0xf97bff30
test r12d, 0xe2b9c14f
cmp r10d, 0x8928cdfe
rol r10d, 2
lea r8d, [rdi - 0x40bc]
and r9d, 0xd8827acd
ret
cpuid
je 0x140132196
neg r10
mov ebx, 0x6a9fd1ad
jmp 0x140132e17
mov esi, 0xbde8ffff
idiv bh
dec dword [rcx - 9]
loopne 0x1401329fb
ror ecx, 0xd9
je 0x140132a23
jne 0x140132a23
test esi, 0xead1f8d5
jge 0x140132752
dec rbp
pushf
lea edx, [rdx - 0x6f2e]
call rax
syscall
pop r10
neg rdx
call rcx
movabs r8, 0x267e380000021be9
cmp rsi, rbx
lea r15d, [rbx - 0x213b]
mov edx, 0x18832039
dec rbx
cmp r10d, 0xac52e868
call fcn.140132937
jmp 0x140132c43
add al, al
jmp rcx
add byte [rax], al
sub r9d, 0xe918cb79
jmp 0x140132893
bswap r15
test edi, 0xd855946e
popfq
jg 0x140132b7b
dec r15
and al, 0xe9
xchg dl, bh
invalid
jnp 0x140132e3b
bswap rsi
test r11, rbx
jns 0x14013230d
jge 0x140132492
bswap r11
jmp 0x1401330f1
jbe 0x140132c7f
lea r15d, [rdx - 0x268a]
rcl r11d, 0xbb
jg 0x140131ac8
lea ecx, [rdx + 0x10ea]
jmp 0x140132f42
mov ebx, 0xefe75345
js 0x1401329ae
ror r15d, 0xf5
syscall
inc rbx
pushfq
jne 0x140133141
je 0x140133141
xor ebx, 0x1d39a2d9
inc r12
jmp 0x1401332ea
cmp edx, 0x6e6621d1
lea r13d, [rcx + 0xdd15]
call rcx
jmp 0x1401333f9
jmp rax
Function at 0x140019bb0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x3a], 0
mov rdx, rcx
je 0x140019cf8
movdqa xmm3, xmmword [0x14003a720]
lea r8, [rcx + 8]
movdqa xmm4, xmmword [0x14003a7c0]
xor eax, eax
mov r9d, 0xb891
nop dword [rax]
movd xmm1, dword [r8 - 8]
lea rcx, [r9 - 5]
xorps xmm0, xmm0
lea r8, [r8 + 0x10]
punpcklwd xmm1, xmm0
movq xmm2, rax
punpckldq xmm1, xmm0
add rax, 8
punpcklqdq xmm2, xmm2
paddq xmm2, xmm4
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
lea rcx, [r9 - 3]
movd dword [r8 - 0x18], xmm1
xorps xmm0, xmm0
movd xmm1, dword [r8 - 0x14]
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
punpcklqdq xmm2, xmm2
paddq xmm2, xmm3
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
lea rcx, [r9 - 1]
movd dword [r8 - 0x14], xmm1
xorps xmm0, xmm0
movd xmm1, dword [r8 - 0x10]
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
punpcklqdq xmm2, xmm2
paddq xmm2, xmm3
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
movq xmm0, r9
movd dword [r8 - 0x10], xmm1
add r9, 8
movd xmm1, dword [r8 - 0xc]
punpcklqdq xmm2, xmm0
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [r8 - 0xc], xmm1
cmp r9, 0xb8a9
jb 0x140019be0
cmp rax, 0x1c
jae 0x140019cf4
mov r8d, 0x4776
nop word [rax + rax]
movzx ecx, ax
sub cx, r8w
xor word [rdx + rax*2], cx
inc rax
cmp rax, 0x1c
jb 0x140019ce0
mov byte [rdx + 0x3a], 0
mov rax, rdx
ret

Function at 0x140019d00
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x58], 0
mov rdx, rcx
je 0x140019e48
movdqa xmm3, xmmword [0x14003a720]
lea r8, [rcx + 8]
movdqa xmm4, xmmword [0x14003a7c0]
xor eax, eax
mov r9d, 0xb891
nop dword [rax]
movd xmm1, dword [r8 - 8]
lea rcx, [r9 - 5]
xorps xmm0, xmm0
lea r8, [r8 + 0x10]
punpcklwd xmm1, xmm0
movq xmm2, rax
punpckldq xmm1, xmm0
add rax, 8
punpcklqdq xmm2, xmm2
paddq xmm2, xmm4
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
lea rcx, [r9 - 3]
movd dword [r8 - 0x18], xmm1
xorps xmm0, xmm0
movd xmm1, dword [r8 - 0x14]
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
punpcklqdq xmm2, xmm2
paddq xmm2, xmm3
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
lea rcx, [r9 - 1]
movd dword [r8 - 0x14], xmm1
xorps xmm0, xmm0
movd xmm1, dword [r8 - 0x10]
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
punpcklqdq xmm2, xmm2
paddq xmm2, xmm3
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
movq xmm0, r9
movd dword [r8 - 0x10], xmm1
add r9, 8
movd xmm1, dword [r8 - 0xc]
punpcklqdq xmm2, xmm0
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [r8 - 0xc], xmm1
cmp r9, 0xb8b9
jb 0x140019d30
cmp rax, 0x2b
jae 0x140019e44
mov r8d, 0x4776
nop word [rax + rax]
movzx ecx, ax
sub cx, r8w
xor word [rdx + rax*2], cx
inc rax
cmp rax, 0x2b
jb 0x140019e30
mov byte [rdx + 0x58], 0
mov rax, rdx
ret
Function at 0x140019e50
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xa4], 0
mov rdx, rcx
je 0x140019f9b
movdqa xmm3, xmmword [0x14003a720]
lea r8, [rcx + 8]
movdqa xmm4, xmmword [0x14003a7c0]
xor eax, eax
mov r9d, 0xb891
nop dword [rax]
movd xmm1, dword [r8 - 8]
lea rcx, [r9 - 5]
xorps xmm0, xmm0
lea r8, [r8 + 0x10]
punpcklwd xmm1, xmm0
movq xmm2, rax
punpckldq xmm1, xmm0
add rax, 8
punpcklqdq xmm2, xmm2
paddq xmm2, xmm4
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
lea rcx, [r9 - 3]
movd dword [r8 - 0x18], xmm1
xorps xmm0, xmm0
movd xmm1, dword [r8 - 0x14]
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
punpcklqdq xmm2, xmm2
paddq xmm2, xmm3
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
lea rcx, [r9 - 1]
movd dword [r8 - 0x14], xmm1
xorps xmm0, xmm0
movd xmm1, dword [r8 - 0x10]
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
punpcklqdq xmm2, xmm2
paddq xmm2, xmm3
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
movq xmm0, r9
movd dword [r8 - 0x10], xmm1
add r9, 8
movd xmm1, dword [r8 - 0xc]
punpcklqdq xmm2, xmm0
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [r8 - 0xc], xmm1
cmp r9, 0xb8e1
jb 0x140019e80
cmp rax, 0x51
jae 0x140019f94
mov r8d, 0x4776
nop word [rax + rax]
movzx ecx, ax
sub cx, r8w
xor word [rdx + rax*2], cx
inc rax
cmp rax, 0x51
jb 0x140019f80
mov byte [rdx + 0xa4], 0
mov rax, rdx
ret