joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004c360
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
movapd xmmword [rsp + 0x40], xmm6
mov rsi, rcx
mov rax, qword [0x1400e5028]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x20]
call fcn.14004baa0
mov qword [rsp + 0x28], 0
mov rcx, qword [rsp + 0x20]
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryThreadCycleTime]
movsd xmm0, qword [0x1400ec6f8]
xorpd xmm6, xmm6
ucomisd xmm0, xmm6
jne 0x14004c3bd
jnp 0x14004c422
ucomisd xmm0, xmm6
jne 0x14004c3c9
jnp 0x14004c54c
movsd xmm1, qword [rsp + 0x28]
unpcklps xmm1, xmmword [0x1400ca9b0]
subpd xmm1, xmmword [0x1400ca9c0]
movapd xmm2, xmm1
unpckhpd xmm2, xmm1
addsd xmm2, xmm1
divsd xmm2, xmm0
mulsd xmm2, qword [0x1400d1398]
cvttsd2si rax, xmm2
mov qword [rsi], rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14005e850
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rbx, qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov r12d, eax
call rbx
mov rcx, rax
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x1400ec708]
mov ecx, dword [0x1400e843c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14004c553
mov eax, dword [0x1400ec718]
mov ecx, dword [0x1400e843c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14004c58d
rdtsc
mov r14, rax
mov r15, rdx
xor edi, edi
lea rbx, [rsp + 0x30]
mov qword [rbx], rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rbp, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov qword [rbx], rdi
lea rdi, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub rbp, qword [0x1400ec710]
movq xmm1, rbp
punpckldq xmm1, xmmword [0x1400ca9b0]
subpd xmm1, xmmword [0x1400ca9c0]
haddpd xmm1, xmm1
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rdi]
divsd xmm1, xmm0
xorpd xmm0, xmm0
movsd xmm2, qword [0x1400d1390]
ucomisd xmm2, xmm1
ja 0x14004c3bd
shl r15, 0x20
or r14, r15
sub r14, qword [0x1400ec700]
movq xmm0, r14
punpckldq xmm0, xmmword [0x1400ca9b0]
subpd xmm0, xmmword [0x1400ca9c0]
haddpd xmm0, xmm0
divsd xmm0, xmm1
movsd qword [0x1400ec6f8], xmm0
jmp 0x14004c3bd
xor eax, eax
jmp 0x14004c3fb
lea rcx, [0x1400ec708]
call fcn.14005dc30
cmp dword [0x1400ec708], 0xffffffff
jne 0x14004c46c
rdtsc
shl rdx, 0x20
or rdx, rax
mov qword [0x1400ec700], rdx
lea rcx, [0x1400ec708]
call fcn.14005dcc8
jmp 0x14004c46c
lea rcx, [0x1400ec718]
call fcn.14005dc30
cmp dword [0x1400ec718], 0xffffffff
jne 0x14004c491
lea rbx, [rsp + 0x30]
mov qword [rbx], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbx]
mov qword [0x1400ec710], rax
lea rcx, [0x1400ec718]
call fcn.14005dcc8
jmp 0x14004c491
Function at 0x140052200
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x1400e82d8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140052234
movsxd rcx, dword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 4]
jne 0x140052234
mov rax, qword [rax + rcx]
add rsp, 0x20
pop rsi
ret
xor eax, eax
jmp 0x14005222e

Function at 0x140052240
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x1400e82d8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14005227e
movsxd rcx, dword [rsi]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rsi + 4]
movsxd rdx, dword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
test rdi, rdi
je 0x140052277
call fcn.140030ad0
jmp 0x14005225e

Function at 0x1400538a0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test rdx, rdx
je 0x1400538d8
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
mov rbx, rsi
cmp rsi, r14
jae 0x1400538e2
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x1400538e9
add rdi, rbx
sub rsi, rbx
jne 0x1400538ba
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov ebx, 0xffffffff
jmp 0x1400538c2
int3
Function at 0x140053dd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
movzx eax, byte [rcx + 0x4f]
test al, al
js 0x140053e50
test rax, rax
jne 0x140053e3f
cmp dword [rsi + 0x50], 0
jne 0x140053e3f
mov byte [rsi + 0x54], 0
mov rax, qword [rsi + 0x10]
mov qword [rsi + 8], rax
cmp rax, qword [rsi + 0x18]
je 0x140053e37
lea rdi, [rsi + 0x20]
lea rcx, [rax + 1]
mov qword [rsi + 0x10], rcx
movzx edx, byte [rax]
mov rcx, rdi
xor r8d, r8d
call fcn.140042900
cmp rax, 0xffffffffffffffff
jne 0x140053e29
cmp dword [rsi + 0x58], 1
jne 0x140053e73
jmp 0x140053e56
mov rax, qword [rsi + 0x10]
mov qword [rsi + 8], rax
cmp rax, qword [rsi + 0x18]
jne 0x140053e05
mov byte [rsi + 0x54], 1
xor ebx, ebx
jmp 0x140053ebc
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp 0x1400b8470
mov rax, qword [rsi + 0x40]
jmp 0x140053de4
mov rax, qword [rsi + 8]
movzx eax, byte [rax]
cmp rax, 0x20
ja 0x140053e73
movabs rcx, 0x100003600
bt rcx, rax
jb 0x140053e29
mov rax, qword [rsi + 0x10]
mov bl, 1
cmp rax, qword [rsi + 0x18]
je 0x140053ebc
movabs r14, 0x100003600
nop dword [rax]
movzx edx, byte [rax]
mov rcx, rdi
xor r8d, r8d
call fcn.140042900
cmp rax, 0xffffffffffffffff
jne 0x140053ebc
cmp dword [rsi + 0x58], 1
je 0x140053ec8
mov rax, qword [rsi + 0x10]
add rax, 1
mov qword [rsi + 0x10], rax
cmp rax, qword [rsi + 0x18]
jne 0x140053e90
mov eax, ebx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rax, qword [rsi + 0x10]
movzx ecx, byte [rax]
cmp rcx, 0x20
ja 0x140053eae
bt r14, rcx
jae 0x140053eae
jmp 0x140053ebc
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
mov rax, qword [0x1400e5028]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov word [rsp + 0x20], 0
mov byte [rsp + 0x22], 0
mov rax, qword [rcx + 0x10]
mov rcx, qword [rcx + 0x18]
cmp rax, rcx
je 0x1400b84d2
mov edx, dword [rsi + 0x58]
movabs rdi, 0x100003600
cmp edx, 1
jne 0x1400b84d2
movzx ebx, byte [rax]
cmp rbx, 0x20
ja 0x1400b84d2
bt rdi, rbx
jae 0x1400b84d2
inc rax
mov qword [rsi + 0x10], rax
cmp rcx, rax
jne 0x1400b84af
mov rax, rcx
cmp byte [rsi + 0x54], 0
sete dil
lea rbx, [rsp + 0x20]
test dil, 1
je 0x1400b850f
mov rdx, rcx
mov rcx, rax
mov byte [rsi + 0x54], 1
mov qword [rsi + 8], rcx
cmp rcx, rdx
je 0x1400b8574
mov rax, rcx
inc rax
mov qword [rsi + 0x10], rax
xor edi, edi
test byte [rsi + 0x50], 1
mov rcx, rdx
je 0x1400b84df
jmp 0x1400b855a
mov byte [rsi + 0x54], 0
mov qword [rsi + 8], rax
cmp rax, rcx
je 0x1400b8548
mov r8b, byte [rax]
mov rcx, rsi
mov rdx, rbx
call fcn.1400b8580
test al, al
je 0x1400b8554
mov rax, qword [rsi + 0x10]
inc rax
mov qword [rsi + 0x10], rax
cmp rax, qword [rsi + 0x18]
jne 0x1400b851c
mov rcx, rax
cmp qword [rsi + 8], rax
jne 0x1400b855a
test byte [rsi + 0x50], 2
jne 0x1400b855a
mov rdx, qword [rsi + 0x18]
jmp 0x1400b84eb
mov rax, qword [rsi + 0x10]
jmp 0x1400b853f
mov sil, 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14005e850
mov eax, esi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
xor esi, esi
jmp 0x1400b855d
Function at 0x140054960
Capabilities:
Set thread local storage value

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rax, qword [0x1400e5028]
xor rax, rsp
mov qword [rsp + 0x38], rax
test rcx, rcx
je 0x140054bd2
mov rsi, rcx
mov byte [rsp + 0x37], 0xaa
lea r14, [rcx + 0x718]
lea rbx, [rcx + 8]
mov edi, 1
xor ebp, ebp
mov r15, qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
mov r12d, 0x40
mov rcx, rbx
call r15
test al, al
jne 0x1400549e2
jmp 0x140054bb1
pause
dec eax
jne 0x1400549c1
add ebp, edi
add edi, edi
cmp edi, 0x40
cmovge edi, r12d
cmp ebp, 0x3e8
jl 0x1400549b2
mov rcx, rbx
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov rax, qword [r14]
mov rdi, qword [rax]
test rdi, rdi
je 0x140054b88
mov byte [rsp + 0x37], 0
mov rcx, qword [rdi]
test rcx, rcx
je 0x140054a0e
mov rdx, rcx
not rdx
cmp qword [rdi + 8], rdx
jne 0x140054bd5
bswap rcx
mov qword [rax], rcx
inc word [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
xorps xmm6, xmm6
movups xmmword [rdi + 0x2d8], xmm6
movups xmmword [rdi + 0x2c8], xmm6
movups xmmword [rdi + 0x2b8], xmm6
movups xmmword [rdi + 0x2a8], xmm6
movups xmmword [rdi + 0x298], xmm6
mov qword [rdi + 0x2e8], 0
xor r14d, r14d
mov r8d, 0x291
mov rcx, rdi
xor edx, edx
call fcn.1400611e0
mov qword [rdi + 0x2f0], rsi
movups xmmword [rdi + 0x2f8], xmm6
mov ebp, 1
lea rbx, [0x1400e82e8]
mov r12d, 0x40
mov rcx, rbx
call r15
test al, al
jne 0x140054abb
jmp 0x140054bc0
pause
dec eax
jne 0x140054a94
add r14d, ebp
add ebp, ebp
cmp ebp, 0x40
cmovge ebp, r12d
cmp r14d, 0x3e8
jl 0x140054a85
lea rcx, [0x1400e82e8]
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov qword [rdi + 0x300], 0
mov rax, qword [0x1400e82f0]
mov qword [0x1400e82f0], rdi
mov qword [rdi + 0x2f8], rax
test rax, rax
je 0x140054ae7
mov qword [rax + 0x300], rdi
lea rcx, [0x1400e82e8]
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
add rsi, 0x10
mov eax, 0xa
jmp 0x140054b17
mov dword [rdi + rax - 2], 0
add rax, 0x10
add rsi, 0x28
cmp rax, 0x29a
je 0x140054b55
cmp qword [rsi], 0
je 0x140054aff
mov ecx, dword [rsi + 0x18]
cmp ecx, 0x10000
jae 0x140054bcf
mov word [rdi + rax], cx
cmp ecx, 0x80
jbe 0x140054b47
cmp ecx, 0x100
ja 0x140054b4e
mov byte [rdi + rax - 1], 0x40
jmp 0x140054b07
mov byte [rdi + rax - 1], 0x80
jmp 0x140054b07
mov byte [rdi + rax - 1], 0x20
jmp 0x140054b07
mov ecx, dword [0x1400f0298]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14005e850
mov rax, rdi
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rax, [rsp + 0x37]
mov qword [rsp + 0x20], rax
mov r9d, 0x308
mov rcx, r14
mov rdx, rsi
mov r8d, 2
call fcn.14003bd50
mov rdi, rax
jmp 0x140054a18
mov eax, edi
test edi, edi
jg 0x1400549c1
jmp 0x1400549c9
mov eax, ebp
test ebp, ebp
jg 0x140054a94
jmp 0x140054a9d
int3
int3
call 0x140089960
int3
Function at 0x140055390
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, qword [0x1400f02c8]
cmp rsi, 1
jbe 0x1400553b3
mov rcx, rsi
xor edx, edx
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140052240
lea rcx, [0x1400f02c8]
call fcn.140034240
test al, al
je 0x1400553f9
mov qword [0x1400f02d0], 0
lea rdi, [0x1400f02c8]
lea rsi, [0x1400f02d0]
mov rcx, rsi
xor edx, edx
call fcn.140030c00
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
mov r9, rdi
call fcn.1400342e0
jmp 0x1400553a3
mov rsi, qword [0x1400f02c8]
jmp 0x1400553a3

Function at 0x140055800
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, qword [0x1400f02f0]
cmp rsi, 1
jbe 0x140055823
mov rcx, rsi
xor edx, edx
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140052240
lea rcx, [0x1400f02f0]
call fcn.140034240
test al, al
je 0x140055869
mov qword [0x1400f02f8], 0
lea rdi, [0x1400f02f0]
lea rsi, [0x1400f02f8]
mov rcx, rsi
xor edx, edx
call fcn.140030c00
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
mov r9, rdi
call fcn.1400342e0
jmp 0x140055813
mov rsi, qword [0x1400f02f0]
jmp 0x140055813

Function at 0x140056410
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x1400f0328]
mov ecx, dword [0x1400e843c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140056445
lea rcx, [0x1400f0320]
add rsp, 0x28
jmp fcn.140052200
lea rcx, [0x1400f0328]
call fcn.14005dc30
cmp dword [0x1400f0328], 0xffffffff
jne 0x140056435
mov qword [0x1400f0320], 0
lea rcx, [0x1400f0320]
xor edx, edx
call fcn.140030c00
lea rcx, [0x1400f0328]
call fcn.14005dcc8
jmp 0x140056435

Function at 0x140056c00
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
xor eax, eax
test r8d, r8d
sete al
xor ebx, ebx
test edx, edx
sete bl
xor ecx, ecx
mov edx, ebx
mov r8d, eax
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi], 0
test rax, rax
je 0x140056c97
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140056c81
lea rax, [rdi + 1]
cmp rax, 2
jb 0x140056c5e
mov qword [rsi], rdi
call fcn.14004acd0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsi]
mov byte [rsi + 8], 1
inc rax
cmp rax, 1
jbe 0x140056c9b
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.14004acd0
mov rcx, qword [rsi]
call fcn.14004ace0
mov qword [rsi], 0
jmp 0x140056c4c
mov byte [rsi + 8], 1
int3

Function at 0x14005c7c0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov eax, dword [0x1400f0cd8]
mov ecx, dword [0x1400e843c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14005c7fd
lea rcx, [0x1400f0cd0]
mov rdx, rsi
add rsp, 0x20
pop rsi
jmp fcn.140052240
lea rcx, [0x1400f0cd8]
call fcn.14005dc30
cmp dword [0x1400f0cd8], 0xffffffff
jne 0x14005c7e9
mov qword [0x1400f0cd0], 0
lea rcx, [0x1400f0cd0]
xor edx, edx
call fcn.140030c00
lea rcx, [0x1400f0cd8]
call fcn.14005dcc8
jmp 0x14005c7e9
Function at 0x14005d9b0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x1400f0ce8]
mov ecx, dword [0x1400e843c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14005da52
lea rcx, [0x1400f0ce0]
xor edx, edx
call fcn.140052240
mov eax, dword [0x1400f0cf8]
mov ecx, dword [0x1400e843c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14005da16
lea rcx, [0x1400f0cf0]
xor edx, edx
add rsp, 0x28
jmp fcn.140052240
lea rcx, [0x1400f0cf8]
call fcn.14005dc30
cmp dword [0x1400f0cf8], 0xffffffff
jne 0x14005da04
mov qword [0x1400f0cf0], 0
lea rcx, [0x1400f0cf0]
xor edx, edx
call fcn.140030c00
lea rcx, [0x1400f0cf8]
call fcn.14005dcc8
jmp 0x14005da04
lea rcx, [0x1400f0ce8]
call fcn.14005dc30
cmp dword [0x1400f0ce8], 0xffffffff
jne 0x14005d9d5
mov qword [0x1400f0ce0], 0
lea rcx, [0x1400f0ce0]
xor edx, edx
call fcn.140030c00
lea rcx, [0x1400f0ce8]
call fcn.14005dcc8
jmp 0x14005d9d5

Function at 0x14006a03c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14006a16c
Function at 0x140089b60
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rax, qword [0x1400e5028]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov al, 1
xchg byte [rcx + 0xb0], al
test al, 1
je 0x140089b98
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14005e850
nop
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov edi, edx
mov rbx, rcx
xor eax, eax
xchg qword [rcx + 0x90], rax
mov qword [rcx + 0xa8], rax
lock inc qword [rcx + 0xa0]
mov ecx, 0x58
call fcn.140089c40
mov rsi, rax
mov rcx, rax
mov rdx, rbx
call fcn.140089f20
cmp edi, 1
jne 0x140089be9
call fcn.14008a2b0
lea rdx, [rsp + 0x20]
mov qword [rdx], rsi
mov rcx, rax
call fcn.14008a370
jmp 0x140089b82
mov rcx, rsi
call fcn.14008a430
test rsi, rsi
je 0x140089b82
lea rcx, [rsi + 0x40]
mov rdx, qword [rsi + 0x48]
call fcn.14008a620
mov rcx, rsi
add rcx, 0x28
call fcn.14008a970
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x140089c21
mov qword [rsi + 0x18], rcx
call fcn.14008acb0
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14005e850
mov rcx, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp fcn.14008acb0
Function at 0x14008a370
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
call fcn.1400420c0
mov rax, qword [rsi]
mov qword [rsi], 0
mov rbx, qword [rdi + 0x10]
mov qword [rdi + 0x10], rax
test rbx, rbx
jne 0x14008a3c4
mov rcx, rdi
call fcn.1400420f0
add rdi, 8
mov rcx, rdi
call fcn.14001c340
mov rdi, qword [rsi]
mov qword [rsi], 0
test rdi, rdi
jne 0x14008a3f6
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [rbx + 0x40]
mov rdx, qword [rbx + 0x48]
call fcn.14008a620
lea rcx, [rbx + 0x28]
call fcn.14008a970
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14008a3ec
mov qword [rbx + 0x18], rcx
call fcn.14008acb0
mov rcx, rbx
call fcn.14008acb0
jmp 0x14008a399
lea rcx, [rdi + 0x40]
mov rdx, qword [rdi + 0x48]
call fcn.14008a620
lea rcx, [rdi + 0x28]
call fcn.14008a970
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x14008a41e
mov qword [rdi + 0x18], rcx
call fcn.14008acb0
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.14008acb0
Function at 0x14008d3e0
Capabilities:
Get thread local storage value

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rax, qword [0x1400e5028]
xor rax, rsp
mov qword [rsp + 0x38], rax
call fcn.14008aff0
mov rsi, rax
mov r15, rax
mov byte [rsp + 0x37], 0
cmp byte [rax + 2], 0
je 0x14008d4ad
mov edi, dword [0x1400f0298]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test ebx, ebx
jne 0x14008d4a3
cmp rdi, 1
jbe 0x14008d53e
inc qword [rdi + 0x298]
mov rbx, qword [rdi + 0xc0]
test rbx, rbx
je 0x14008d568
inc qword [rdi + 0x2a0]
mov rax, qword [rbx]
test rax, rax
je 0x14008d474
mov rcx, rax
not rcx
cmp qword [rbx + 8], rcx
jne 0x14008d5de
bswap rax
dec byte [rdi + 0xc8]
mov qword [rdi + 0xc0], rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14005e850
mov rax, rbx
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14008d434
lea r14, [rsi + 0x1f0]
add rsi, 8
mov edi, 1
xor ebx, ebx
mov r12, qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
mov ebp, 0x40
mov rcx, rsi
call r12
test al, al
jne 0x14008d4fa
jmp 0x14008d5e3
pause
dec eax
jne 0x14008d4da
add ebx, edi
add edi, edi
cmp edi, 0x40
cmovge edi, ebp
cmp ebx, 0x3e8
jl 0x14008d4cb
mov rcx, rsi
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov rax, qword [r14]
mov rbx, qword [rax]
test rbx, rbx
je 0x14008d5fa
mov byte [rsp + 0x37], 0
mov rcx, qword [rbx]
test rcx, rcx
je 0x14008d526
mov rdx, rcx
not rdx
cmp qword [rbx + 8], rdx
jne 0x14008d5de
bswap rcx
mov qword [rax], rcx
inc word [rax + 0x18]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
jmp 0x14008d484
je 0x14008d593
mov byte [r15 + 2], 0
mov rcx, r15
call fcn.140054960
mov rdi, rax
mov byte [r15 + 2], 1
inc qword [rax + 0x298]
mov rbx, qword [rax + 0xc0]
jmp 0x14008d44c
inc qword [rdi + 0x2b0]
inc qword [rdi + 0x2a8]
mov edx, 0xc
mov rcx, rdi
call fcn.140054be0
mov rbx, qword [rdi + 0xc0]
test rbx, rbx
jne 0x14008d45c
lea r14, [rsi + 0x1f0]
add rsi, 8
mov edi, 1
xor ebx, ebx
mov r12, qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
mov ebp, 0x40
mov rcx, rsi
call r12
test al, al
jne 0x14008d4fa
jmp 0x14008d5f2
pause
dec eax
jne 0x14008d5c1
add ebx, edi
add edi, edi
cmp edi, 0x40
cmovge edi, ebp
cmp ebx, 0x3e8
jl 0x14008d5b1
jmp 0x14008d4f2
call 0x140089960
mov eax, edi
test edi, edi
jg 0x14008d4da
jmp 0x14008d4e2
mov eax, edi
test edi, edi
jg 0x14008d5c1
jmp 0x14008d5c9
lea rax, [rsp + 0x37]
mov qword [rsp + 0x20], rax
mov r9d, 0x28
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.14003bd50
mov rbx, rax
jmp 0x14008d530
Function at 0x14008e7e0
Capabilities:
Set registry value

Disassembly:
push rsi
sub rsp, 0x40
mov rax, qword [0x1400e5028]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x34]
mov dword [rax], r8d
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14005e850
mov eax, esi
add rsp, 0x40
pop rsi
ret
xor r8d, r8d
test edx, edx
cmovns r8d, edx
lea rdx, str.PWALauncherResult
jmp 0x140029920

Function at 0x1400903d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor edx, edx
jmp 0x140090500
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r15d, edx
mov rsi, rcx
mov rax, qword [0x1400e5028]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [rcx + 0x60], 0
je 0x14009055e
mov edi, dword [rsi + 0x5c]
test r15b, r15b
je 0x14009053e
mov dword [rsi + 0x5c], 0xffffffff
mov byte [rsi + 0x60], 0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14005e850
mov eax, edi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movabs r14, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x58], r14
mov eax, dword [rsi + 0x58]
test eax, eax
mov edi, 1
cmovg edi, eax
xor ebp, ebp
mov rcx, qword [rsi + 0x40]
call fcn.140074b44
cmp eax, 0xffffffff
je 0x1400905d8
mov byte [rsp + rbp + 0x58], al
inc rbp
cmp rdi, rbp
jne 0x14009057c
mov byte [rsp + 0x57], 0xaa
cmp byte [rsi + 0x61], 0
je 0x1400905e2
mov al, byte [rsp + 0x58]
mov byte [rsp + 0x57], al
test r15b, r15b
je 0x1400905b8
movzx edi, byte [rsp + 0x57]
mov dword [rsi + 0x5c], edi
jmp 0x14009053e
mov edi, edi
test edi, edi
jle 0x140090686
mov rdx, qword [rsi + 0x40]
movzx ecx, byte [rsp + rdi + 0x57]
dec rdi
call fcn.140076594
cmp eax, 0xffffffff
jne 0x1400905ba
mov edi, 0xffffffff
jmp 0x14009053e
lea rax, [rsp + 0x48]
mov qword [rax], r14
lea r12, [rsp + 0x40]
mov qword [r12], r14
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov r13d, dword [rdx]
movzx ebp, word [rdx + 4]
movzx r14d, word [rdx + 6]
lea r9, [rsp + rdi + 0x58]
mov rax, qword [rcx]
mov qword [rsp + 0x38], r12
lea rbx, [rsp + 0x58]
mov qword [rsp + 0x30], rbx
lea rbx, [rsp + 0x57]
mov qword [rsp + 0x28], rbx
lea rbx, [rsp + 0x48]
mov qword [rsp + 0x20], rbx
lea r8, [rsp + 0x58]
call qword [rax + 0x18]
cmp eax, 1
jne 0x14009066f
mov rax, qword [rsi + 0x50]
mov dword [rax], r13d
mov word [rax + 4], bp
mov word [rax + 6], r14w
cmp edi, 8
je 0x1400905d8
mov rcx, qword [rsi + 0x40]
call fcn.140074b44
cmp eax, 0xffffffff
je 0x1400905d8
mov byte [rsp + rdi + 0x58], al
inc rdi
jmp 0x1400905f3
cmp eax, 2
je 0x1400905d8
cmp eax, 3
je 0x1400905a1
jmp 0x1400905a9
movzx edi, byte [rsp + 0x57]
jmp 0x14009053e