joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d3810
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xb8
mov esi, r8d
mov r14, rdx
mov r15, rcx
mov rax, qword [0x140173028]
xor rax, rsp
mov qword [rsp + 0xb0], rax
movabs r12, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x50]
mov qword [rdi + 0x50], r12
movaps xmm0, xmmword [0x14014df90]
movaps xmmword [rdi + 0x40], xmm0
movaps xmmword [rdi + 0x30], xmm0
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
lea rdx, str.ReadAtCurrentPos
lea r8, str..._.._base_files_file_win.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r9d, 0x57
call fcn.14004cb40
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.140054820
test esi, esi
js 0x1400d3915
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], 0
call fcn.140052ae0
test al, al
jne 0x1400d391c
lea r9, [rsp + 0x2c]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [r15]
mov qword [rsp + 0x20], 0
mov rdx, r14
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400d3938
mov esi, dword [rsp + 0x2c]
lea rcx, [rsp + 0x30]
call fcn.140052b70
lea rcx, [rsp + 0x50]
call fcn.140054af0
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140083c00
mov eax, esi
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov esi, 0xffffffff
jmp 0x1400d38e8
mov r9d, esi
lea rdx, str.File::ReadAtCurrentPos
lea rcx, [rsp + 0x30]
mov r8, r15
call fcn.1400d83f0
jmp 0x1400d38b2
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x26
setne sil
neg esi
jmp 0x1400d38de

Function at 0x1400d3950
Capabilities:
Get file size

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xb8
mov r14, rcx
mov rax, qword [0x140173028]
xor rax, rsp
mov qword [rsp + 0xb0], rax
movabs rsi, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x50]
mov qword [rdi + 0x50], rsi
movaps xmm0, xmmword [0x14014df90]
movaps xmmword [rdi + 0x40], xmm0
movaps xmmword [rdi + 0x30], xmm0
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
lea rdx, str.GetLength
lea r8, str..._.._base_files_file_win.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r9d, 0x9c
call fcn.14004cb40
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.140054820
mov qword [rbx + 8], rsi
mov qword [rbx], 0
call fcn.140052ae0
test al, al
jne 0x1400d3a34
lea rdi, [rsp + 0x28]
mov qword [rdi], rsi
mov rcx, qword [r14]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
xor esi, esi
cmp eax, 1
sbb rsi, rsi
or rsi, qword [rdi]
lea rcx, [rsp + 0x30]
call fcn.140052b70
lea rcx, [rsp + 0x50]
call fcn.140054af0
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140083c00
mov rax, rsi
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rdx, str.File::GetLength
lea rcx, [rsp + 0x30]
mov r8, r14
xor r9d, r9d
call fcn.1400d83f0
jmp 0x1400d39e1
Function at 0x1400d58a7
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x230
mov rsi, rcx
mov rax, qword [0x140173028]
xor rax, rsp
mov qword [rsp + 0x228], rax
lea rdi, [rsp + 0x20]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.140085d30
xor ebx, ebx
lea r14, str.PROGRAMFILES
mov r15, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rcx, qword [rbx + r14]
mov word [rsp + 0x20], 0
mov rdx, rdi
mov r8d, 0x104
call r15
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x1400d5922
mov edx, eax
mov rcx, rdi
mov r8, rsi
call fcn.1400d5834
test al, al
jne 0x1400d594f
add rbx, 8
cmp rbx, 0x18
jne 0x1400d58ef
xor esi, esi
mov rcx, qword [rsp + 0x228]
xor rcx, rsp
call fcn.140083c00
mov eax, esi
add rsp, 0x230
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov sil, 1
jmp 0x1400d592e

Function at 0x1400d5aaa
Capabilities:
Get common file path
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x250
mov rax, qword [0x140173028]
xor rax, rsp
mov qword [rsp + 0x248], rax
lea rsi, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rsi
mov dl, 0xaa
call fcn.140085d30
mov word [rsi], 0
mov rcx, rsi
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x20]
mov qword [rdi + 0x10], rax
movaps xmm0, xmmword [0x14014df90]
movaps xmmword [rdi], xmm0
mov rcx, rsi
call fcn.14009db00
mov rcx, rdi
mov rdx, rsi
mov r8, rax
call fcn.140047c74
lea rdx, str.usp10.dll
mov rcx, rdi
call fcn.140048822
cmp byte [rax + 0x17], 0
jns 0x1400d5b39
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp byte [rsp + 0x37], 0
jns 0x1400d5b55
mov rcx, qword [rsp + 0x20]
call fcn.140082794
cmp esi, 0xffffffff
setne bl
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
call fcn.140083c00
mov eax, ebx
add rsp, 0x250
pop rbx
pop rdi
pop rsi
ret

Function at 0x1400d7bb0
Capabilities:
Get hostname

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x260
mov rax, qword [0x140173028]
xor rax, rsp
mov qword [rsp + 0x258], rax
lea rsi, [rsp + 0x50]
mov r8d, 0x200
mov rcx, rsi
mov dl, 0xaa
call fcn.140085d30
mov word [rsi], 0
lea r8, [rsp + 0x4c]
mov dword [r8], 0x100
mov ecx, 3
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
je 0x1400d7c44
lea rax, str..corp.microsoft.com
lea rdi, [rsp + 0x38]
mov qword [rdi], rax
mov qword [rdi + 8], 0x13
lea rbx, [rsp + 0x28]
mov qword [rbx], rsi
mov rcx, rsi
call fcn.14009db00
mov qword [rbx + 8], rax
mov rcx, rbx
mov rdx, rdi
mov r8d, 1
call fcn.1400d8160
test al, al
jne 0x1400d7c63
xor esi, esi
mov rcx, qword [rsp + 0x258]
xor rcx, rsp
call fcn.140083c00
mov eax, esi
add rsp, 0x260
pop rbx
pop rdi
pop rsi
ret
mov sil, 1
jmp 0x1400d7c46
Function at 0x1400d8550
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xb0
movaps xmmword [rsp + 0xa0], xmm6
mov r14, rdx
mov rdi, rcx
mov rax, qword [0x140173028]
xor rax, rsp
mov qword [rsp + 0x98], rax
movabs r15, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x40]
mov qword [rsi + 0x50], r15
movaps xmm6, xmmword [0x14014df90]
movaps xmmword [rsi + 0x40], xmm6
movaps xmmword [rsi + 0x30], xmm6
movaps xmmword [rsi + 0x20], xmm6
movaps xmmword [rsi + 0x10], xmm6
movaps xmmword [rsi], xmm6
lea rdx, str.CreateDirectoryAndGetError
lea r8, str..._.._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x2f1
call fcn.14004cb40
mov rcx, rsi
mov rdx, rbx
xor r8d, r8d
call fcn.140054820
cmp byte [rdi + 0x17], 0
mov rbx, rdi
jns 0x1400d3246
mov rbx, qword [rdi]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400d3292
mov sil, 1
test al, 0x10
je 0x1400d332c
lea rcx, [rsp + 0x40]
call fcn.140054af0
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140083c00
mov eax, esi
movaps xmm6, xmmword [rsp + 0xa0]
add rsp, 0xb0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rsi, [rsp + 0x20]
mov qword [rsi + 0x10], r15
movaps xmmword [rsi], xmm6
mov rcx, rdi
mov rdx, rsi
call fcn.1400218f0
movzx ecx, byte [rsi + 0x17]
mov r8, rcx
test cl, cl
jns 0x1400d32b9
mov r8, qword [rsp + 0x28]
movzx eax, byte [rdi + 0x17]
mov rdx, rax
test al, al
jns 0x1400d32c8
mov rdx, qword [rdi + 8]
cmp r8, rdx
je 0x1400d334a
lea rcx, [rsp + 0x20]
mov rdx, r14
call 0x1400d31b0
test al, al
je 0x1400d3394
mov rcx, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov sil, 1
test eax, eax
je 0x1400d3303
lea rcx, [rsp + 0x20]
call fcn.14004bda0
jmp 0x1400d325f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0xb7
jne 0x1400d331e
mov rcx, rdi
call fcn.1400d2b10
test al, al
jne 0x1400d32f4
test r14, r14
je 0x1400d338c
mov ecx, ebx
call fcn.1400d3b80
jmp 0x1400d3389
test r14, r14
je 0x1400d3338
mov dword [r14], 0xfffffff7
mov ecx, 0x50
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
jmp 0x1400d325f
test r8, r8
je 0x1400d337a
test cl, cl
jns 0x1400d3358
mov rsi, qword [rsp + 0x20]
mov rcx, rdi
test al, al
jns 0x1400d3362
mov rcx, qword [rdi]
xor edx, edx
movzx eax, word [rsi + rdx*2]
cmp ax, word [rcx + rdx*2]
jne 0x1400d32cd
inc rdx
cmp r8, rdx
jne 0x1400d3364
mov eax, 0xfffffffc
mov ebx, 2
test r14, r14
je 0x1400d338c
mov dword [r14], eax
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
jmp 0x1400d32f4
xor edx, edx
jmp 0x1400d31b0
Function at 0x1400db880
Capabilities:
Create thread

Disassembly:
jmp 0x1400db890
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov ebp, r9d
mov rdi, r8
mov rsi, rdx
mov r13, rcx
xor ebx, ebx
test rcx, rcx
setne bl
mov rax, qword [0x140173028]
xor rax, rsp
mov qword [rsp + 0x60], rax
movabs r12, 0xfffffffe00000000
shl ebx, 0x10
mov ecx, 0x10
call fcn.140082758
mov r15, rax
mov rax, rsi
and rax, r12
cmp rax, qword [0x140174f48]
je 0x1400db953
mov qword [r15], rsi
test rdi, rdi
setne byte [r15 + 8]
mov dword [r15 + 0xc], ebp
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x28], 0
lea r8, [0x1400dbaf0]
xor ecx, ecx
mov rdx, r13
mov r9, r15
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r14, rax
test rax, rax
je 0x1400db95d
test rdi, rdi
je 0x1400db9a1
mov qword [rdi], r14
test r14, r14
setne bl
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140083c00
mov eax, ebx
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rsi
call fcn.140025050
jmp 0x1400db8ec
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
je 0x1400db976
mov edi, eax
cmp eax, 0x5af
je 0x1400db976
cmp edi, 0xe
jne 0x1400db9ac
mov rcx, r13
call fcn.1400e10b0
test r15, r15
je 0x1400db92d
mov rcx, qword [r15]
and r12, rcx
cmp r12, qword [0x140174f48]
jne 0x1400db997
call fcn.140025170
mov rcx, r15
call fcn.140082794
jmp 0x1400db92d
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400db92d
mov eax, dword [0x14017f838]
mov ecx, dword [0x14017c9f0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400dba1f
lea rsi, [rsp + 0x38]
mov rcx, rsi
mov edx, edi
call fcn.1400d8710
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
cmovs rax, qword [rsi + 8]
lea rdx, [rsp + 0x50]
mov qword [rdx], rcx
mov qword [rdx + 8], rax
mov rcx, qword [0x14017f830]
call fcn.140059d70
cmp byte [rsi + 0x17], 0
jns 0x1400db97e
mov rcx, qword [rsp + 0x38]
call fcn.140082794
jmp 0x1400db97e
lea rcx, [0x14017f838]
call fcn.1400828b0
cmp dword [0x14017f838], 0xffffffff
jne 0x1400db9cd
lea rcx, str.create_thread_last_error
mov edx, 0x20
call fcn.1400e10d0
mov qword [0x14017f830], rax
lea rcx, [0x14017f838]
call fcn.140082948
jmp 0x1400db9cd
Function at 0x1400de1c0
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
mov edi, edx
mov rsi, rcx
lea rax, [0x14014fd80]
mov qword [rcx], rax
add rcx, 8
call fcn.140051220
lea rcx, [rsi + 0x10]
call fcn.140051220
xor ebx, ebx
mov byte [rsi + 0x18], bl
lea rcx, [rsi + 0x40]
xorps xmm6, xmm6
movups xmmword [rsi + 0x1c], xmm6
movups xmmword [rsi + 0x2c], xmm6
mov dword [rsi + 0x3c], ebx
call fcn.140051220
mov byte [rsi + 0x48], bl
lea rax, [rsi + 0x70]
movups xmmword [rsi + 0x50], xmm6
mov qword [rsi + 0x60], rbx
movups xmmword [rsi + 0x70], xmm6
mov qword [rsi + 0x68], rax
movups xmmword [rsi + 0x80], xmm6
movups xmmword [rsi + 0x90], xmm6
movups xmmword [rsi + 0xa0], xmm6
movups xmmword [rsi + 0xb0], xmm6
movups xmmword [rsi + 0xc0], xmm6
movups xmmword [rsi + 0xd0], xmm6
mov qword [rsi + 0xe0], rbx
mov ebp, 0x3f800000
mov dword [rsi + 0xe8], ebp
mov dword [rsi + 0xf0], ebx
movups xmmword [rsi + 0xf8], xmm6
movups xmmword [rsi + 0x108], xmm6
mov dword [rsi + 0x118], ebp
movups xmmword [rsi + 0x120], xmm6
movups xmmword [rsi + 0x130], xmm6
mov dword [rsi + 0x140], ebp
movups xmmword [rsi + 0x148], xmm6
movups xmmword [rsi + 0x158], xmm6
mov dword [rsi + 0x168], ebp
movups xmmword [rsi + 0x170], xmm6
movups xmmword [rsi + 0x180], xmm6
mov dword [rsi + 0x190], ebp
mov qword [rsi + 0x1b0], rbx
movups xmmword [rsi + 0x198], xmm6
mov dword [rsi + 0x1a8], ebx
mov eax, dword [0x14015cadc]
mov dword [rsi + 0x1b8], eax
lea rcx, [rsi + 0x1c0]
call fcn.1400eba20
lea rcx, [rsi + 0x308]
movups xmmword [rsi + 0x2f0], xmm6
mov qword [rsi + 0x300], rbx
xor edx, edx
call fcn.14005c4e0
lea rcx, [rsi + 0x310]
xor edx, edx
call fcn.14005c4e0
lea rcx, [rsi + 0x318]
xor edx, edx
call fcn.14005c4e0
movups xmmword [rsi + 0x320], xmm6
movups xmmword [rsi + 0x330], xmm6
mov dword [rsi + 0x340], ebp
movups xmmword [rsi + 0x348], xmm6
movups xmmword [rsi + 0x358], xmm6
movups xmmword [rsi + 0x368], xmm6
mov byte [rsi + 0x378], bl
mov dword [rsi + 0x37c], edi
mov byte [rsi + 0x380], bl
movups xmmword [rsi + 0x388], xmm6
movups xmmword [rsi + 0x398], xmm6
call fcn.14001e320
call sub.KERNEL32.dll_GetCurrentProcessId
mov dword [rsi + 0x1a8], eax
cdqe
movabs rcx, 0xcbf29ce484222325
xor rcx, rax
movabs rax, 0x100000001b3
imul rax, rcx
mov qword [rsi + 0x1a0], rax
mov rcx, rsi
call fcn.1400de3f0
mov rcx, qword [rsi + 0x20]
mov qword [rsi + 0x20], rax
test rcx, rcx
jne 0x1400de3db
call fcn.1400609d0
lea r8, str.TraceLog
mov rcx, rax
mov rdx, rsi
xor r9d, r9d
call fcn.140060a80
mov qword [0x14017fca8], rsi
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rax, qword [rcx]
mov rax, qword [rax]
mov edx, 1
call qword [0x140192010]
jmp 0x1400de3a9
Function at 0x1400e2a6e
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov r12, r8
mov ebx, edx
mov edi, ecx
mov rax, qword [0x140173028]
xor rax, rsp
mov qword [rsp + 0x70], rax
movzx eax, byte [r8 + 0x17]
test al, al
jns 0x1400e2aa2
mov rax, qword [r12 + 8]
test rax, rax
je 0x1400e2b9a
mov eax, ebx
not eax
test eax, 0x300
je 0x1400e2b9a
cmp edi, 2
lea rax, [0x140181f20]
lea rcx, [0x140182120]
cmove rcx, rax
cmp word [rcx], 0
jne 0x1400e2b9a
xorps xmm0, xmm0
lea rsi, [rsp + 0x40]
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [rsi], 0
je 0x1400e2b9a
cmp byte [0x140181f10], 0
setne al
bt ebx, 8
jb 0x1400e2b9a
shr ebx, 9
and ebx, 1
or bl, al
je 0x1400e2b9a
cmp edi, 2
lea rax, str.SOFTWAREClasses
lea rsi, str.SOFTWARE
cmove rsi, rax
movzx r13d, byte [r12 + 0x17]
test r13b, r13b
jns 0x1400e2bf5
mov rbx, qword [r12]
mov r13, qword [r12 + 8]
mov r14d, 1
xor r15d, r15d
xor eax, eax
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x2c], 0
mov rdi, qword [rsi + 8]
mov rbp, r13
sub rbp, rdi
jb 0x1400e2b87
mov rdx, qword [rsi]
mov rcx, rbx
mov r8, rdi
call fcn.140097a84
test eax, eax
je 0x1400e2bb9
add rsi, 0x28
inc r15
cmp r15, r14
jb 0x1400e2b69
cmp dword [rsp + 0x2c], 0
jne 0x1400e2bfd
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140083c00
nop
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movzx ecx, word [rbx + rdi*2]
cmp cx, 0x5c
je 0x1400e2bc8
test cx, cx
jne 0x1400e2b87
lea rax, [rbx + rdi*2]
mov edx, dword [rsi + 0x10]
mov dword [rsp + 0x2c], edx
cmp edx, 1
je 0x1400e2c25
cmp dword [rsp + 0x2c], 2
jne 0x1400e2c36
lea rdx, str.WOW6432Node
mov qword [rsp + 0x38], rdx
mov rdx, rax
mov qword [rsp + 0x30], rax
jmp 0x1400e2c36
mov rbx, r12
jmp 0x1400e2b4a
cmp byte [r12 + 0x17], 0
js 0x1400e2c65
mov rax, r12
mov rdx, qword [rsp + 0x30]
sub rdx, rax
sar rdx, 1
mov rcx, r12
mov r8, qword [rsp + 0x38]
call fcn.1400ccfde
jmp 0x1400e2b9a
lea rdx, str.WOW6432Node_
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rbx
cmp cx, 0x5c
jne 0x1400e2c4f
lea rbx, [rax + 2]
dec rbp
cmp word [rax + 2], 0x5c
mov rax, rbx
je 0x1400e2c3c
jmp 0x1400e2c52
mov rbx, rax
mov r14, qword [rsi + 0x20]
mov rsi, qword [rsi + 0x18]
xor r15d, r15d
mov r13, rbp
jmp 0x1400e2b8e
mov rax, qword [r12]
jmp 0x1400e2c08

Function at 0x1400e7690
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x14017c5d0]
cmp ecx, 0xffffffff
je 0x1400e76b5
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
dec eax
cmp eax, 2
setb al
add rsp, 0x28
ret
xor eax, eax
jmp 0x1400e76b0

Function at 0x1400e83f0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
lea rcx, [0x1401845f8]
call fcn.14002d1e0
mov rcx, rax
mov rdx, rsi
add rsp, 0x20
pop rsi
jmp fcn.14005c490
Function at 0x1401008f0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x68
mov rax, qword [0x140173028]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp r9, 0x30
ja 0x1401009a4
mov rsi, rcx
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
movups xmm2, xmmword [rdx + 0x20]
movaps xmmword [rsp + 0x50], xmm2
movaps xmmword [rsp + 0x40], xmm1
movaps xmmword [rsp + 0x30], xmm0
test r9, r9
jne 0x1401009a8
xor eax, eax
lea rcx, [0x14015d240]
mov dl, byte [rax + rcx]
xor byte [rsp + rax + 0x30], dl
inc rax
cmp rax, 0x30
jne 0x14010093a
lea r8, [rsi + 0xf8]
mov qword [rsp + 0x20], 0x20
lea rdi, [rsp + 0x30]
mov rcx, rsi
xor edx, edx
mov r9, rdi
call fcn.140065b60
mov qword [rsi + 0x100], rax
movaps xmm0, xmmword [rdi + 0x20]
movups xmmword [rsi + 0x108], xmm0
mov qword [rsi + 0x118], 1
mov esi, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140083c00
mov eax, esi
add rsp, 0x68
pop rdi
pop rsi
ret
xor esi, esi
jmp 0x14010098e
xor eax, eax
mov cl, byte [r8 + rax]
xor byte [rsp + rax + 0x30], cl
inc rax
cmp r9, rax
je 0x140100931
jmp 0x1401009aa

Function at 0x14010d150
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov r14, rdx
mov rax, qword [0x140173028]
xor rax, rsp
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [0x14014df90]
lea rdx, [rsp + 0x20]
movaps xmmword [rdx], xmm0
mov r8d, 6
call fcn.140067410
xor ebp, ebp
test eax, eax
je 0x14010d1db
lea rcx, [rsp + 0x20]
call fcn.1400673d0
movzx edi, byte [0x1401622b5]
cmp rax, rdi
jne 0x14010d1f5
mov rbx, rax
lea rcx, [rsp + 0x20]
call fcn.14004f240
lea rsi, [0x1401622a8]
test dil, dil
je 0x14010d1d1
lea rdx, [0x1401622ac]
mov rcx, rax
mov r8, rbx
call fcn.140085580
test eax, eax
jne 0x14010d1f5
mov eax, dword [rsi]
mov dword [r14], eax
mov ebp, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140083c00
mov eax, ebp
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
lea rcx, [rsp + 0x20]
call fcn.1400673d0
movzx edi, byte [0x14016237d]
cmp rax, rdi
jne 0x14010d23a
mov rbx, rax
lea rcx, [rsp + 0x20]
call fcn.14004f240
lea rsi, [0x140162370]
test dil, dil
je 0x14010d1d1
lea rdx, [0x140162374]
mov rcx, rax
mov r8, rbx
call fcn.140085580
test eax, eax
je 0x14010d1d1
lea rcx, [rsp + 0x20]
call fcn.1400673d0
movzx edi, byte [0x140162445]
cmp rax, rdi
jne 0x14010d287
mov rbx, rax
lea rcx, [rsp + 0x20]
call fcn.14004f240
lea rsi, [0x140162438]
test dil, dil
je 0x14010d1d1
lea rdx, [0x14016243c]
mov rcx, rax
mov r8, rbx
call fcn.140085580
test eax, eax
je 0x14010d1d1
lea rcx, [rsp + 0x20]
call fcn.1400673d0
movzx edi, byte [0x14016250d]
cmp rax, rdi
jne 0x14010d2d4
mov rbx, rax
lea rcx, [rsp + 0x20]
call fcn.14004f240
lea rsi, [0x140162500]
test dil, dil
je 0x14010d1d1
lea rdx, [0x140162504]
mov rcx, rax
mov r8, rbx
call fcn.140085580
test eax, eax
je 0x14010d1d1
lea rcx, [rsp + 0x20]
call fcn.1400673d0
movzx edi, byte [0x1401625dd]
cmp rax, rdi
jne 0x14010d1db
mov rbx, rax
lea rcx, [rsp + 0x20]
call fcn.14004f240
lea rsi, [0x1401625d0]
test dil, dil
je 0x14010d1d1
lea rdx, [0x1401625d4]
mov rcx, rax
mov r8, rbx
call fcn.140085580
test eax, eax
je 0x14010d1d1
jmp 0x14010d1db
Function at 0x140112680
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x140112695
mov dword [rsi], eax
cmp eax, 0xffffffff
setne al
add rsp, 0x20
pop rsi
ret
Function at 0x14011af20
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
lea rcx, [0x140185c60]
call fcn.14002d1e0
mov rcx, rax
mov rdx, rsi
add rsp, 0x20
pop rsi
jmp fcn.14005c490

Function at 0x14011e900
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov rdi, r8
mov r14, rdx
mov ebx, ecx
mov rax, qword [0x140173028]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea rax, [0x14011e8d0]
lea r8, [rsp + 0x20]
mov qword [r8], rax
lea rcx, [0x140185d18]
lea rdx, [0x14011e860]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x14011e9f9
cmp dword [0x140185d20], 0
jne 0x14011ea06
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov ecx, dword [0x140185d24]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rsi, rsi
jne 0x14011e9af
mov ecx, 0x20
call fcn.140066d50
test rax, rax
je 0x14011ea06
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax], xmm0
mov ecx, dword [0x140185d24]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x14011e9fe
lea rbp, [0x140185d28]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
movsxd rbx, ebx
lea rax, [0x140185d30]
mov qword [rax + rbx*8], rdi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov qword [rsi + rbx*8], r14
mov esi, 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140083c00
mov eax, esi
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
call fcn.140094740
mov rcx, rsi
call fcn.140066d90
mov rcx, r14
mov rax, rdi
call qword [0x140192010]
xor esi, esi
jmp 0x14011e9df

Function at 0x14011ebd0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test rdx, rdx
je 0x14011ec0c
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x14011ec16
add rdi, rbx
sub rsi, rbx
jne 0x14011ebea
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.140094740
int3
Function at 0x14013e5fc
Capabilities:
Read file via mapping

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
cmp dword [r8], 0
jle 0x14013e617
xor eax, eax
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
call fcn.140137faf
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10000080
mov dword [rsp + 0x20], 3
mov rcx, rbx
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x14013e6c5
mov rbx, rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rax
xor edx, edx
mov r8d, 2
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r14, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14, r14
je 0x14013e6c5
mov qword [rsp + 0x20], 0
mov rcx, r14
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rdi + 8], rax
test rax, rax
je 0x14013e6f0
mov qword [rdi + 0x28], r14
mov al, 1
jmp 0x14013e60d
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
cmp ecx, 0x8007000e
jne 0x14013e60b
mov dword [rsi], 7
jmp 0x14013e60b
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14013e60b