joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400012d7
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x14028d170]
mov dword [rax], 1
mov rax, qword [0x14028d180]
mov dword [rax], 1
mov rax, qword [0x14028d190]
mov dword [rax], 1
mov rax, qword [0x14028d0e0]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x140001328
mov eax, 0
jmp 0x1400013d5
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140001354
mov eax, 0
jmp 0x1400013d5
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000137a
cmp eax, 0x20b
je 0x1400013a1
jmp 0x1400013d0
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000138d
mov eax, 0
jmp 0x1400013d5
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x1400013d5
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x1400013bc
mov eax, 0
jmp 0x1400013d5
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x1400013d5
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x14000a443
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rcx
cmp rdx, 0
mov qword [rsp + 0x50], rdx
jge 0x14000a55a
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
xor eax, eax
sub rax, rdx
mov qword [rsp + 0x28], rax
mov edx, 1
call fcn.140037690
mov rax, qword [rsp + 0x48]
mov rcx, rax
add rcx, 8
mov qword [rsp + 0x30], rcx
mov rcx, qword [rax + 8]
mov rdx, qword [rax]
mov byte [rcx + rdx + 8], 0x2d
mov rcx, qword [rax]
movabs rdx, 0xa39aec66a3870a75
movabs rax, 0xa39aec66a3870a74
xor rdx, rax
mov rax, rcx
add rax, rdx
mov qword [rsp + 0x38], rax
movabs rdx, 0xf553a0152f075391
movabs r8, 0xaac5fead0f8ac6e
xor rdx, r8
mov r8, rcx
and r8, rdx
movabs rdx, 0x823936ef90fa6735
movabs r9, 0x823936ef90fa6737
xor rdx, r9
imul rdx, r8
movabs r8, 0xbe40bf4cef4cb160
movabs r9, 0x41bf40b310b34e9f
xor r8, r9
add rcx, r8
sub rcx, rdx
and rax, rcx
cmp rax, 0
jge 0x14000a536
call fcn.14000f24b
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x50], rax
jmp 0x14000a55a
mov rax, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x48]
mov qword [r8], rdx
mov rcx, qword [rcx]
mov byte [rcx + rdx + 8], 0
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
add rsp, 0x58
jmp fcn.1400099d0
Function at 0x14000efe0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x50
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rcx
cmp rdx, 0
mov qword [rsp + 0x48], rcx
je 0x14000f19d
mov rcx, qword [rsp + 0x38]
mov rdx, rcx
dec rdx
mov qword [rsp + 0x30], rdx
test rdx, rdx
setns al
or rcx, rdx
sets cl
add al, cl
inc al
test al, 1
jne 0x14000f02b
jmp 0x14000f035
call fcn.14000f24b
jmp 0x14000f19d
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x40]
mov rdx, r8
add rdx, r9
mov qword [rsp + 0x28], rdx
movabs rax, 0x57077bc7859432c9
movabs rcx, 0xa8f884387a6bcd36
xor rax, rcx
mov rcx, rdx
xor rcx, rax
movabs rax, 0xbc3f6f5e8729a8c
movabs r10, 0xbd93beb4d995b9c8
xor rax, r10
and rax, rcx
movabs r11, 0x538b6e05880ae1e2
movabs rcx, 0xe5db2644b9edc2a6
xor r11, rcx
movabs rcx, 0x4f6831b5d3adae74
movabs r10, 0xb097ce4a2c52518b
xor rcx, r10
xor r11, rcx
mov r10, rdx
and r10, r11
movabs rsi, 0x587ac24fb3c0a019
movabs rcx, 0xa7853db04c3f5fe6
xor rsi, rcx
mov rcx, r9
xor rcx, rsi
movabs rsi, 0xb650484131e72344
and rcx, rsi
and r9, r11
or rax, r10
or rcx, r9
xor rax, rcx
mov rcx, rdx
xor rcx, 0xffffffffffffffff
mov r9, rdx
xor r9, 0xffffffffffffffff
or rcx, r9
movabs r9, 0x824865165c4b00d6
movabs r10, 0x7db79ae9a3b4ff29
xor r9, r10
xor rcx, r9
mov r9, r8
xor r9, 0xffffffffffffffff
or rcx, r9
and r8, r8
xor r8, 0xffffffffffffffff
and rdx, r8
xor rdx, 0xffffffffffffffff
movabs r8, 0xaac696cb0120ef41
movabs r9, 0x55396934fedf10be
xor r8, r9
xor rcx, r8
xor rdx, 0xffffffffffffffff
or rcx, rdx
and rax, rcx
movabs rcx, 0xdfdb94f28d819a4a
movabs rdx, 0xdfdb94f28d819a4a
xor rcx, rdx
cmp rax, rcx
jge 0x14000f17f
call fcn.14000f24b
jmp 0x14000f19d
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
xor rcx, 0xffffffffffffffff
add rcx, 0
add rcx, 1
and rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov eax, dword [0x1402727e8]
mov ecx, dword [0x1402727ec]
mov edx, 0xf4728ce4
xor edx, 0xaad71990
xor ecx, edx
sub eax, ecx
xor ecx, ecx
sub ecx, 0x59e0311
add eax, ecx
mov ecx, 0xffffffff
xor ecx, 0x3194f194
xor edx, edx
sub edx, 1
sub ecx, edx
sub eax, ecx
mov ecx, eax
and ecx, 0x91e8c4f3
shl ecx, 1
add eax, 0x91e8c4f3
sub eax, ecx
cmp eax, 0x97cc2534
jb 0x14000f242
mov eax, dword [0x1402727f0]
xor eax, 0x805a5b6e
mov edx, dword [0x1402727f4]
xor ecx, ecx
sub ecx, edx
add eax, ecx
imul eax, eax, 0xfeda963a
sub eax, 0x3668c274
mov ecx, 0xfe0a4e62
xor ecx, 0x758aa67e
xor eax, ecx
cmp eax, 0x8d77bc2a
jbe 0x14000f1fd
mov rax, qword [rsp + 0x20]
add rsp, 0x50
pop rsi
ret
invalid
Function at 0x14000f24b
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
movabs rcx, 0x4343c3cf02328580
movabs rax, 0x4343c3cf023285c0
xor rcx, rax
movabs rdx, 0x9ec41966f3ac5d58
movabs rax, 0x9ec41966f3ac5d50
xor rdx, rax
call fcn.140029060
mov rcx, rax
mov rax, qword [str.8__]
mov qword [rcx], rax
lea rax, [0x140281edf]
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 0
lea rax, [0x140281eb0]
mov qword [rcx + 0x20], rax
mov rax, rsp
mov qword [rax + 0x20], 0x5f1b804d
lea rdx, [0x140281edf]
lea r8, [0x140281ecc]
lea r9, [0x140281ed5]
call fcn.140028fa8
nop
add rsp, 0x28
ret
Function at 0x140015f8d
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], rcx
mov ecx, dword [0x1402980b0]
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov rdx, qword [rsp + 0x20]
mov rcx, rax
add rcx, 0x68
add rsp, 0x28
jmp fcn.140014f80

Function at 0x140015fba
Capabilities:
Encode data using xor
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], rcx
mov ecx, dword [0x1402980b0]
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov rdx, qword [rsp + 0x20]
mov rcx, rax
add rcx, 0x68
add rsp, 0x28
jmp fcn.140014f80
Function at 0x140017058
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x48], rcx
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
mov rax, rcx
add rax, 8
mov qword [rsp + 0x58], rax
mov r8, qword [rcx + 8]
mov qword [rsp + 0x60], r8
mov rax, r8
add rax, 0xffffffffffffffff
mov qword [rsp + 0x68], rax

Function at 0x1400172e5
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
movabs rcx, 0x1e62c23244ec73fe
movabs rax, 0x1e62c23244ec73be
xor rcx, rax
movabs rdx, 0x64c102f977e9df7e
movabs rax, 0x64c102f977e9df76
xor rdx, rax
call fcn.140029060
mov rcx, rax
mov rax, qword [0x14028cf70]
mov qword [rcx], rax
lea rax, [0x140281ec0]
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 0
lea rax, [0x140281eb0]
mov qword [rcx + 0x20], rax
mov rax, rsp
mov qword [rax + 0x20], 0x5f1b804d
lea rdx, [0x140281ec0]
lea r8, [0x140281ecc]
lea r9, [0x140281ed5]
call fcn.140028fa8
nop
add rsp, 0x28
ret
Function at 0x140018fc0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov rax, qword [rdx + 8]
mov rdx, qword [rcx + 0x2088]
sub rdx, rax
mov qword [rcx + 0x2088], rdx
cmp rax, 0x3f000000
jle 0x140019003
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
call fcn.140018ce0
jmp 0x140019012
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
call fcn.140018180
mov r8d, dword [0x140272c48]
mov ecx, dword [0x140272c4c]
mov edx, r8d
xor edx, ecx
xor edx, 0xffffffff
mov eax, ecx
and eax, edx
shl eax, 1
sub eax, ecx
sub r8d, eax
and r8d, 0x30b895c
xor r8d, 0x80fc017
mov eax, r8d
xor eax, 0xffffffff
and eax, 0x258949bd
mov edx, 0xffffffff
xor edx, 0x258949bd
and r8d, edx
mov ecx, 0xd585a7da
xor ecx, 0x320fc8aa
mov r9d, 0x4ead755
xor r9d, 0xfb1528aa
xor ecx, r9d
mov r9d, 0x7db54dd4
xor r9d, 0x583c0469
and ecx, r9d
and edx, 0xe78a6f70
or eax, r8d
or ecx, edx
xor eax, ecx
cmp eax, 0x750f960e
je 0x1400190df
mov eax, dword [0x140272c50]
mov ecx, dword [0x140272c54]
mov edx, 0x66b9ef53
xor edx, 0x87bfc58a
xor ecx, edx
and eax, ecx
add eax, 0x2ffb7cc9
mov ecx, 0x1eb681b0
xor ecx, 0x2171aa87
xor eax, ecx
sub eax, 0x1640d5f1
cmp eax, 0x9cf44ec0
jbe 0x14001909d
add rsp, 0x38
ret
xchg esp, eax
lodsb al, byte [rsi]
push rsp
mov ch, cl
mov ch, 0xff
invalid

Function at 0x14001a17e
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x1402980b0]
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov rdx, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov rcx, rax
add rcx, 0x68
add rsp, 0x38
jmp fcn.140019b60

Function at 0x14001a1b5
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x1402980b0]
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov rdx, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov rcx, rax
add rcx, 0x68
add rsp, 0x38
jmp fcn.140019b60
Function at 0x14001a720
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov edx, dword [0x140272d28]
xor edx, dword [0x140272d2c]
add edx, 0xa62fc39c
mov eax, 0x28c1594d
xor eax, 0x5c709d0f
add edx, eax
mov eax, 0xa4e0d745
xor eax, 0x2cf14d9
sub edx, eax
and edx, 0xab057449
mov ecx, edx
xor ecx, 0x944e86a
mov eax, 0xffffffff
xor eax, 0x944e86a
and edx, eax
mov eax, 0xe7f7bad3
xor eax, 0xe7f7bad1
imul eax, edx
sub eax, ecx
cmp eax, 0x9bca9013
ja 0x14001a8ba
mov eax, dword [0x140272d30]
mov edx, dword [0x140272d34]
mov ecx, 0x5b59849a
xor ecx, 0x1bc4495
xor edx, ecx
mov ecx, eax
and ecx, edx
xor eax, edx
or ecx, eax
mov edx, 0x9371bb41
xor edx, 0x9371bb40
mov eax, ecx
add eax, edx
xor ecx, 0xffffffff
or ecx, 0x268f3ef8
add ecx, eax
mov eax, ecx
or eax, eax
mov edx, 0xc1a0e86f
xor edx, 0x3e5f1790
xor eax, edx
mov edx, 0x835e002f
or edx, 0x835e002f
xor edx, 0xffffffff
or eax, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
mov edx, 0x137cc818
xor edx, 0x9022c837
mov r8d, 0x155da28
xor r8d, 0xfeaa25d7
xor edx, r8d
and ecx, edx
mov edx, 0x31de64bb
xor edx, 0xce219b44
xor eax, edx
mov edx, 0x1ecc4a42
xor edx, 0xe133b5bd
xor ecx, edx
and eax, ecx
mov ecx, 0x2b148dd8
xor edx, edx
div ecx
mov dword [rsp + 0x34], eax
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, 0x40
mov edx, 8
call fcn.140029060
mov rcx, rax
mov rax, qword [0x14028cf70]
mov qword [rcx], rax
lea rax, [0x140281ec0]
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 0
lea rax, [0x140281eb0]
mov qword [rcx + 0x20], rax
movabs rax, 0xbcbfff89e46399ec
movabs rdx, 0xbcbfff89bb7819a1
xor rax, rdx
lea rdx, [0x140281ec0]
lea r8, [0x140281ecc]
lea r9, [0x140281ed5]
mov qword [rsp + 0x20], rax
call fcn.140028fa8
mov eax, dword [rsp + 0x34]
cmp eax, 0x8da1687f
ja 0x14001a782
add rsp, 0x38
ret
fsub st(2)
retf 0xe9ec
Function at 0x14001d1d6
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], rcx
mov ecx, dword [0x1402980b0]
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov rdx, qword [rsp + 0x20]
mov rcx, rax
add rcx, 0x68
add rsp, 0x28
jmp fcn.1400190f0

Function at 0x14001d203
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
cmp rdx, 0x11
mov qword [rsp + 0x30], rcx
jl 0x14001d266
mov rax, qword [rsp + 0x28]
movabs rdx, 0xaf0567105a99a0b1
movabs rcx, 0xebf7c66103ca8529
xor rdx, rcx
mov rcx, rax
add rcx, rdx
add rcx, 0xfffffffffffffffe
movabs rdx, 0x7266f3f30fb8bdf
movabs r8, 0x43d4ce4e69a8ae47
xor rdx, r8
sub rcx, rdx
movzx ecx, word [rcx]
sub rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov ecx, dword [0x1402980b0]
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov rdx, qword [rsp + 0x20]
mov rcx, rax
add rcx, 0x68
add rsp, 0x38
jmp fcn.1400190f0

Function at 0x14001d294
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
mov ecx, 0x10
call fcn.14000efe0
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
sub rcx, rax
add rsp, 0x38
jmp fcn.14001d203
Function at 0x1400200e0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], rdx
mov byte [rsp + 0x3f], cl
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0x30]
mov cl, byte [rsp + 0x3f]
mov rax, qword [rdx + 8]
mov qword [rsp + 0x40], rax
test cl, 1
jne 0x14002011e
jmp 0x14002013c
mov rax, qword [rsp + 0x40]
cmp rax, 0
jle 0x140020287
mov rcx, qword [rsp + 0x30]
call fcn.140017058
jmp 0x140020287
mov eax, dword [0x140272fb8]
mov edx, dword [0x140272fbc]
xor eax, 0xffffffff
xor edx, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0x58ec40f2
or eax, edx
or ecx, 0x58ec40f2
xor eax, 0xffffffff
and eax, ecx
and eax, 0x93afb27b
mov ecx, 0x85bfdd5e
xor edx, edx
div ecx
mov r8d, eax
mov ecx, 0x7ff2a356
xor ecx, 0x800d5ca9
mov eax, r8d
xor eax, ecx
and eax, 0x60af875b
mov edx, 0xffffffff
xor edx, 0x60af875b
and r8d, edx
mov ecx, 0xffffffff
xor ecx, 0x9e3fbce6
mov r9d, 0x21bd5431
xor r9d, 0x4112d36a
and ecx, r9d
and edx, 0x9e3fbce6
or eax, r8d
or ecx, edx
xor eax, ecx
cmp eax, 0x90c95f4f
jb 0x14002028d
mov rcx, qword [rsp + 0x40]
mov eax, dword [0x140272fc0]
mov r8d, dword [0x140272fc4]
xor edx, edx
sub edx, eax
mov eax, 0x4014fb95
xor eax, 0x4014fb95
sub eax, r8d
add edx, eax
xor eax, eax
sub eax, edx
mov edx, 0xd2fb9bdd
xor edx, 0x2c5302a7
add eax, edx
mov r8d, 0xa49269cd
xor r8d, 0x3217b91d
xor edx, edx
div r8d
or eax, 0x3a967a5d
movabs rdx, 0x3433abbc4a6b5641
movabs r8, 0x3433abbc4a6b5641
xor rdx, r8
cmp rcx, rdx
sete cl
mov byte [rsp + 0x27], cl
cmp eax, 0x70c385f1
jae 0x14002028d
mov al, byte [rsp + 0x27]
test al, 1
jne 0x140020257
jmp 0x140020287
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x30]
and rax, 1
cmp rax, 0
jne 0x140020287
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
and rax, 0xfffffffffffffffc
mov qword [rcx], rax
call fcn.14001fa50
nop
add rsp, 0x48
ret
lahf
movsb byte [rdi], byte [rsi]
cmpsb byte [rsi], byte [rdi]
jmp 0x1400201cd

Function at 0x140020296
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rax, qword [rcx]
mov rcx, qword [rax]
mov qword [rsp + 0x38], rcx
cmp rcx, 0
mov qword [rsp + 0x40], rax
je 0x1400202f7
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
call rax
mov rax, qword [rsp + 0x30]
cmp byte [rax + 0x60], 0
jne 0x140020322
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
movsx rdx, word [rax + 0x10]
mov qword [rsp + 0x20], rdx
mov ecx, 0x10
call fcn.14000efe0
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
sub rcx, rax
call fcn.14001d203
nop
add rsp, 0x48
ret

Function at 0x140020328
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx + 8]
mov qword [rsp + 0x20], rax
cmp rax, 0
je 0x14002035c
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0x20]
mov rcx, rax
add rcx, 0x68
call fcn.1400190f0
nop
add rsp, 0x28
ret
Function at 0x140020362
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x50], rcx
mov rax, rcx
add rax, 8
mov qword [rsp + 0x58], rax
mov rcx, qword [rcx + 8]
movabs rdx, 0x5303618f3f0a5320
movabs rax, 0x5303618f3f0a5323
xor rdx, rax
mov rax, rcx
imul rax, rdx
mov qword [rsp + 0x60], rax
cvtsi2sd xmm0, rcx
movsd xmm1, qword [0x140281748]
mulsd xmm0, xmm1
movsd qword [rsp + 0x68], xmm0
cvtsi2sd xmm1, rax
movsd qword [rsp + 0x70], xmm1
ucomisd xmm0, xmm1
jne 0x1400203d5
jp 0x1400203d5
jmp 0x140020424
movsd xmm1, qword [rsp + 0x68]
movsd xmm0, qword [rsp + 0x70]
subsd xmm0, xmm1
call fcn.140271c60
movaps xmm1, xmm0
movsd xmm0, qword [rsp + 0x68]
movsd qword [rsp + 0x48], xmm1
call fcn.140271c60
movsd xmm1, qword [rsp + 0x48]
movsd xmm2, qword [0x140281750]
mulsd xmm1, xmm2
ucomisd xmm0, xmm1
jae 0x140020424
call fcn.14000f24b
jmp 0x14002052b
mov rax, qword [rsp + 0x60]
mov ecx, 2
cqo
idiv rcx
mov rcx, rax
mov rax, qword [rsp + 0x58]
mov qword [rax], rcx
mov rax, rcx
shl rax, 4
mov qword [rsp + 0x30], rax
cvtsi2sd xmm0, rcx
movsd xmm1, qword [0x140281758]
mulsd xmm0, xmm1
movsd qword [rsp + 0x38], xmm0
cvtsi2sd xmm1, rax
movsd qword [rsp + 0x40], xmm1
ucomisd xmm0, xmm1
jne 0x140020481
jp 0x140020481
jmp 0x1400204d0
movsd xmm1, qword [rsp + 0x38]
movsd xmm0, qword [rsp + 0x40]
subsd xmm0, xmm1
call fcn.140271c60
movaps xmm1, xmm0
movsd xmm0, qword [rsp + 0x38]
movsd qword [rsp + 0x28], xmm1
call fcn.140271c60
movsd xmm1, qword [rsp + 0x28]
movsd xmm2, qword [0x140281750]
mulsd xmm1, xmm2
ucomisd xmm0, xmm1
jae 0x1400204d0
call fcn.14000f24b
jmp 0x14002052b
mov rax, qword [rsp + 0x30]
cmp rax, 0
jge 0x1400204ef
mov rcx, r8
mov rdx, r8
call fcn.14001a720
jmp 0x14002052b
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x20], rax
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x30]
mov rcx, rax
add rcx, 0x68
call fcn.140019b60
mov rcx, rax
mov rax, qword [rsp + 0x50]
mov qword [rax + 0x10], rcx
add rsp, 0x78
ret
Function at 0x140023470
Capabilities:
Encode data using xor
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x3a0
movaps xmmword [rsp + 0x390], xmm15
movaps xmmword [rsp + 0x380], xmm14
movaps xmmword [rsp + 0x370], xmm13
movaps xmmword [rsp + 0x360], xmm12
movaps xmmword [rsp + 0x350], xmm11
movaps xmmword [rsp + 0x340], xmm10
movaps xmmword [rsp + 0x330], xmm9
movaps xmmword [rsp + 0x320], xmm8
movaps xmmword [rsp + 0x310], xmm7
Function at 0x140028c90
Capabilities:
Encode data using xor
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov rax, qword [rcx]
mov qword [rsp + 0x40], rax
mov qword [rcx], rdx
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rax, qword [rsp + 0x40]
cmp rax, 0
je 0x140028d8e
mov rax, qword [rsp + 0x40]
mov rcx, rax
add rcx, 0xfffffffffffffff0
mov qword [rsp + 0x30], rcx
mov rax, qword [rax - 0x10]
mov qword [rsp + 0x38], rax
movabs rcx, 0xf1e37c7b5c5e5d2c
movabs rdx, 0xf1e37c7b5c5e5d3c
xor rcx, rdx
cmp rax, rcx
jb 0x140028d6d
mov rdx, qword [rsp + 0x38]
mov rax, rdx
add rax, 0xfffffffffffffff0
mov qword [rsp + 0x28], rax
mov rcx, rax
xor rcx, rdx
cmp rcx, 0
setl cl
cmp rax, 0xffffffffffffffff
setg dl
mov al, dl
xor al, 0xff
mov r8b, 1
xor r8b, 0
xor dl, r8b
and al, dl
or cl, cl
xor cl, 0xff
xor al, 0xff
xor cl, 0xff
and al, cl
test al, 1
jne 0x140028d42
jmp 0x140028d4c
call fcn.14000f24b
jmp 0x140028d8e
mov rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
mov qword [rdx], rcx
mov r8, qword [rax]
xor ecx, ecx
call fcn.1400200e0
jmp 0x140028d8e
mov rax, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
mov r8, qword [rax]
mov ecx, 1
call fcn.1400200e0
mov rcx, qword [rsp + 0x40]
call fcn.140020296
mov eax, dword [0x1402733b8]
mov ecx, 0x4f4e80dd
xor ecx, 0x7c6b89f0
xor eax, ecx
sub eax, dword [0x1402733bc]
mov ecx, eax
xor ecx, 0x2b63bc12
mov edx, 0xffffffff
xor edx, 0x2b63bc12
and eax, edx
shl eax, 1
sub eax, ecx
sub eax, 0x58fb27bb
add eax, 0x502bb49
sub eax, 0xc984b1b8
sub eax, 0x502bb49
cmp eax, 0x74ad99f9
jae 0x140028e32
mov eax, dword [0x1402733c0]
xor eax, 0x3cf06ac4
mov ecx, dword [0x1402733c4]
xor ecx, 0xc83b9cc3
add eax, ecx
mov ecx, 0xa352eb1f
xor edx, edx
div ecx
mov ecx, 0x5904ae93
xor ecx, 0x1ae72463
imul eax, ecx
mov ecx, eax
and ecx, 0xa1a3bf6c
shl ecx, 1
add eax, 0xa1a3bf6c
sub eax, ecx
cmp eax, 0x7a1e622
jb 0x140028de0
add rsp, 0x48
ret
add ebp, dword [rcx + rdi*8 - 0x76]
jmp 0x140028de0
Function at 0x140028e40
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x50], rcx
mov eax, dword [0x1402733c8]
xor edx, edx
div dword [0x1402733cc]
mov ecx, 0xde0ab414
xor ecx, 0x370b038b
sub eax, ecx
mov ecx, eax
xor ecx, 0x770c297
mov edx, 0xeeb951cd
xor edx, 0xe9c9935a
mov r8d, 0x68c720f0
xor r8d, 0x9738df0f
xor edx, r8d
and eax, edx
shl eax, 1
sub eax, ecx
xor eax, 0x59c0952d
cmp eax, 0xf316b5c0
ja 0x140028f9f
mov eax, dword [0x1402733d0]
xor eax, 0x9f736484
xor eax, dword [0x1402733d4]
or eax, 0xf0c42dad
sub eax, 0x77cab5e5
imul eax, eax, 0x6a15215c
mov dword [rsp + 0x34], eax
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, rax
mov eax, dword [rsp + 0x34]
mov qword [rsp + 0x38], rcx
mov rcx, qword [rcx + 0x40]
mov qword [rsp + 0x40], rcx
cmp rcx, 0
sete cl
mov byte [rsp + 0x4f], cl
cmp eax, 0x4356cac4
jb 0x140028e9e
mov al, byte [rsp + 0x4f]
test al, 1
jne 0x140028f24
jmp 0x140028f0b
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
call rax
test al, 1
jne 0x140028f24
jmp 0x140028f9a
mov rax, qword [0x140298088]
mov qword [rsp + 0x28], rax
cmp rax, 0
je 0x140028f53
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
call rax
test al, 1
jne 0x140028f53
jmp 0x140028f9a
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x50]
add rcx, 0x38
mov rdx, rax
add rdx, 0x10
mov qword [rsp + 0x20], rdx
mov rdx, qword [rax + 0x10]
xor eax, eax
mov r8b, al
call fcn.140028560
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x50]
call fcn.140028c90
mov rax, qword [rsp + 0x38]
mov byte [rax + 0x60], 1
add rsp, 0x58
ret
shr dword [rdi*2 - 0x1091644], 1
invalid
sub rsp, 0x68
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x40], rax
mov rax, rcx
add rax, 0x10
mov qword [rsp + 0x48], rax
cmp qword [rcx + 0x10], 0
jne 0x140028ff1
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x28]
cmp rax, 0
setne al
cmp rcx, 0
setne cl
and al, cl
test al, 1
jne 0x140029018
jmp 0x140029049
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
add rcx, 0x28
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x50]
call fcn.140027fe0
mov rcx, qword [rsp + 0x38]
add rsp, 0x68
jmp 0x140028e40