joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140008ec0
Capabilities:
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x470
mov rax, qword [0x1400cf248]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov r14, r9
mov r15, r8
mov rsi, rdx
mov r12, rcx
mov qword [rsp + 0x38], rcx
mov rbp, qword [rsp + 0x4d0]
xor eax, eax
mov dword [rsp + 0x30], eax
mov qword [rcx], rax
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 0xf
mov byte [rcx], al
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], al
lea rdx, [0x1400fe1f0]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rdx + r8], 0
jne 0x140008f44
lea rcx, [rsp + 0x40]
call fcn.140004a00
mov r9, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x140008f65
mov r9, qword [rsi]
mov rsi, qword [rsi + 0x10]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov rax, rdx
sub rax, rcx
cmp rsi, rax
ja 0x140008fad
lea rax, [rcx + rsi]
mov qword [rsp + 0x50], rax
lea rbx, [rsp + 0x40]
cmp rdx, 0x10
cmovae rbx, qword [rsp + 0x40]
add rbx, rcx
mov r8, rsi
mov rdx, r9
mov rcx, rbx
call fcn.140065280
mov byte [rbx + rsi], 0
jmp 0x140008fc2
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.140002090
lea rax, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rax, qword [rsp + 0x40]
cmp qword [rbp + 0x18], 0x10
jb 0x140008fde
mov rbp, qword [rbp]
cmp qword [r14 + 0x18], 0x10
jb 0x140008fe8
mov r14, qword [r14]
cmp qword [r15 + 0x18], 0x10
jb 0x140008ff2
mov r15, qword [r15]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0x60]
mov r8, rbp
mov rdx, r14
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea rax, [rsp + 0x60]
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140009020
mov r8, rdi
lea rdx, [rsp + 0x60]
mov rcx, r12
call fcn.140004a00
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x140009073
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000906e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009098
call fcn.140062edc
mov rax, r12
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.1400634e0
add rsp, 0x470
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.140071a7c
int3
Function at 0x140011e70
Capabilities:
Check for time delay via gettickcount
Get system information on windows

Disassembly:
push r14
push r15
sub rsp, 0xa8
mov r14, rcx
xor eax, eax
mov r15d, 1
lock cmpxchg dword [rcx], r15d
mov edx, dword [rcx]
cmp edx, r15d
jne 0x140011e9a
test eax, eax
je 0x140012076
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0x98], rbp
xor ebp, ebp
mov qword [rsp + 0x90], rsi
mov ebx, ebp
mov qword [rsp + 0x88], rdi
mov esi, ebp
mov qword [rsp + 0x80], r12
mov edi, ebp
movabs r12, 0x38d7ea4c67fff
mov dword [rsp + 0x44], ebx
xor eax, eax
lock cmpxchg dword [r14], r15d
mov ecx, dword [r14]
cmp ecx, r15d
jne 0x140011eef
test eax, eax
je 0x14001204e
test ebx, ebx
jne 0x140011f1b
mov eax, dword [0x1400fe848]
test eax, eax
jne 0x140011f0c
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x68]
cmp eax, r15d
mov ebx, 0x20
cmova ebx, ebp
mov dword [rsp + 0x44], ebx
cmp ebx, 8
jb 0x140012002
cmp ebx, 0x20
jae 0x140011f2f
pause
inc ebx
jmp 0x140011ed4
jne 0x140011fe2
mov ecx, 7
call fcn.140016050
lea r8, [rsp + 0xc8]
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0xd8]
call rax
mov ecx, 9
call fcn.140016050
lea rcx, [rsp + 0x30]
call rax
test eax, eax
jne 0x140011f85
mov ecx, dword [rsp + 0xc8]
mov eax, 0xd1b71759
dec ecx
mul ecx
mov eax, edx
shr eax, 0xd
jmp 0x140011faa
mov eax, dword [rsp + 0xc8]
imul r8, rax, 0x5f5e100
mov rax, r12
cqo
idiv qword [rsp + 0x30]
lea rcx, [rax + 1]
lea rax, [r8 - 1]
cqo
idiv rcx
mov ecx, 8
lea esi, [rax + 1]
call fcn.140016050
lea rcx, [rsp + 0x20]
call rax
test eax, eax
jne 0x140011fd6
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
inc ebx
mov qword [rsp + 0x20], rdi
jmp 0x140011ed4
mov rdi, qword [rsp + 0x20]
inc ebx
jmp 0x140011ed4
test esi, esi
jne 0x140012009
movzx eax, byte [rsp + 0x44]
and al, r15b
je 0x14001203e
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
test eax, eax
jne 0x140012002
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
jmp 0x140011ed4
mov ecx, 8
call fcn.140016050
lea rcx, [rsp + 0x28]
call rax
test eax, eax
jne 0x14001202d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov qword [rsp + 0x28], rcx
jmp 0x140012032
mov rcx, qword [rsp + 0x28]
sub rcx, rdi
mov eax, esi
cmp rcx, rax
jb 0x140011ff0
mov esi, ebp
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
jmp 0x140011ed4
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x98]
mov rbx, qword [rsp + 0xa0]
mov r12, qword [rsp + 0x80]
add rsp, 0xa8
pop r15
pop r14
ret
Function at 0x140017360
Capabilities:
Check for time delay via gettickcount
Get system information on windows

Disassembly:
push rbp
push r14
push r15
sub rsp, 0xa0
mov r15d, edx
mov rbp, rcx
call fcn.140011e70
mov eax, dword [rbp + 8]
xor r14d, r14d
nop
test eax, eax
jne 0x14001739b
mov eax, 1
lock cmpxchg dword [rbp], r14d
add rsp, 0xa0
pop r15
pop r14
pop rbp
ret
mov qword [rsp + 0x98], rbx
xor eax, eax
mov qword [rsp + 0x90], rsi
mov ebx, r14d
mov qword [rsp + 0x88], rdi
mov esi, r14d
mov rdi, r14
mov dword [rsp + 0x4c], ebx
lock cmpxchg dword [rbp + 4], r15d
je 0x140017507
mov qword [rsp + 0x80], r12
movabs r12, 0x38d7ea4c67fff
test ebx, ebx
jne 0x14001740d
mov eax, dword [0x1400fe848]
test eax, eax
jne 0x1400173fd
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x70]
cmp eax, 1
mov ebx, 0x20
cmova ebx, r14d
mov dword [rsp + 0x4c], ebx
cmp ebx, 8
jb 0x1400174eb
cmp ebx, 0x20
jae 0x140017422
pause
jmp 0x1400174eb
jne 0x1400174c8
mov ecx, 7
call fcn.140016050
lea r8, [rsp + 0xd0]
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x20]
call rax
mov ecx, 9
call fcn.140016050
lea rcx, [rsp + 0x38]
call rax
test eax, eax
jne 0x140017475
mov ecx, dword [rsp + 0xd0]
mov eax, 0xd1b71759
dec ecx
mul ecx
mov eax, edx
shr eax, 0xd
jmp 0x14001749a
mov eax, dword [rsp + 0xd0]
imul r8, rax, 0x5f5e100
mov rax, r12
cqo
idiv qword [rsp + 0x38]
lea rcx, [rax + 1]
lea rax, [r8 - 1]
cqo
idiv rcx
mov ecx, 8
lea esi, [rax + 1]
call fcn.140016050
lea rcx, [rsp + 0x28]
call rax
test eax, eax
jne 0x1400174c1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov qword [rsp + 0x28], rdi
jmp 0x1400174eb
mov rdi, qword [rsp + 0x28]
jmp 0x1400174eb
test esi, esi
jne 0x14001752c
movzx eax, byte [rsp + 0x4c]
and al, 1
je 0x140017566
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
test eax, eax
jne 0x1400174eb
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
mov dword [rsp + 0x4c], ebx
xor eax, eax
lock cmpxchg dword [rbp + 4], r15d
jne 0x1400173e0
mov r12, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x98]
mov rdi, qword [rsp + 0x88]
add rsp, 0xa0
pop r15
pop r14
pop rbp
ret
mov ecx, 8
call fcn.140016050
lea rcx, [rsp + 0x30]
call rax
test eax, eax
jne 0x140017550
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov qword [rsp + 0x30], rcx
jmp 0x140017555
mov rcx, qword [rsp + 0x30]
sub rcx, rdi
mov eax, esi
cmp rcx, rax
jb 0x1400174d9
mov esi, r14d
mov ecx, 1
jmp 0x1400174e5
Function at 0x14001ca70
Capabilities:
Check for time delay via gettickcount
Get system information on windows

Disassembly:
push rbx
push rdi
sub rsp, 0x58
mov eax, dword [rcx + 0xc]
xor edi, edi
mov rbx, rcx
test eax, eax
jne 0x14001caaa
mov ecx, dword [0x1400fe848]
test ecx, ecx
jne 0x14001ca9c
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [rsp + 0x40]
cmp ecx, 1
mov eax, 0x20
cmova eax, edi
mov dword [rbx + 0xc], eax
cmp eax, 8
jb 0x14001cb9c
cmp eax, 0x20
jae 0x14001cac4
pause
inc dword [rbx + 0xc]
add rsp, 0x58
pop rdi
pop rbx
ret
jne 0x14001cb81
mov ecx, 7
call fcn.140016050
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x80]
call rax
mov ecx, 9
call fcn.140016050
lea rcx, [rsp + 0x88]
call rax
test eax, eax
jne 0x14001cb14
mov ecx, dword [rsp + 0x70]
mov eax, 0xd1b71759
dec ecx
mul ecx
mov eax, edx
shr eax, 0xd
jmp 0x14001cb40
mov eax, dword [rsp + 0x70]
imul r8, rax, 0x5f5e100
movabs rax, 0x38d7ea4c67fff
cqo
idiv qword [rsp + 0x88]
lea rcx, [rax + 1]
lea rax, [r8 - 1]
cqo
idiv rcx
inc eax
mov ecx, 8
mov dword [rbx + 8], eax
call fcn.140016050
lea rcx, [rsp + 0x70]
call rax
test eax, eax
jne 0x14001cb6f
call qword [sym.imp.KERNEL32.dll_GetTickCount]
inc dword [rbx + 0xc]
mov eax, eax
mov qword [rbx], rax
add rsp, 0x58
pop rdi
pop rbx
ret
mov rax, qword [rsp + 0x70]
inc dword [rbx + 0xc]
mov qword [rbx], rax
add rsp, 0x58
pop rdi
pop rbx
ret
cmp dword [rbx + 8], edi
jne 0x14001cba6
and al, 1
je 0x14001cbd8
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
test eax, eax
jne 0x14001cb9c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
inc dword [rbx + 0xc]
add rsp, 0x58
pop rdi
pop rbx
ret
mov ecx, 8
call fcn.140016050
lea rcx, [rsp + 0x70]
call rax
test eax, eax
jne 0x14001cbc5
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
jmp 0x14001cbca
mov rcx, qword [rsp + 0x70]
sub rcx, qword [rbx]
mov eax, dword [rbx + 8]
cmp rcx, rax
jb 0x14001cb8a
mov dword [rbx + 8], edi
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
inc dword [rbx + 0xc]
add rsp, 0x58
pop rdi
pop rbx
ret

Function at 0x140025a20
Capabilities:
Check os version

Disassembly:
sub rsp, 0xd8
mov rax, qword [0x1400cf248]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov dword [rsp + 0x20], 0x94
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x24], 6
jne 0x140025a74
cmp dword [rsp + 0x28], 2
jb 0x140025a74
mov al, 1
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1400634e0
add rsp, 0xd8
ret
xor al, al
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1400634e0
add rsp, 0xd8
ret

Function at 0x140025e90
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x140025ec4
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x140025eb0
ret
Function at 0x140027040
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x1e0
mov rax, qword [0x1400cf248]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
movzx edi, dl
mov rbx, rcx
mov eax, 1
lock xadd dword [0x1400fe758], eax
inc eax
cmp eax, 1
jne 0x14002708d
lea ecx, [rax + 1]
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [0x1400fe75c], eax
test dil, dil
je 0x1400270a0
xor eax, eax
lock xadd dword [0x1400fe75c], eax
test eax, eax
jne 0x1400270c4
mov rax, rbx
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1400634e0
mov rbx, qword [rsp + 0x1f0]
add rsp, 0x1e0
pop rdi
ret
mov dword [rsp + 0x20], eax
lea rdx, str.winsock
lea rax, [0x14009ebc0]
mov byte [rsp + 0x24], 1
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x28], rax
call fcn.1400151c0
int3

Function at 0x14002a580
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rcx + 0x10]
lea rdx, [rsp + 0x20]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rax, qword [rcx + 8]
mov rbx, rcx
mov r9d, 0xffffffff
mov qword [rsp + 0x28], rax
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lock xadd dword [0x1400fe750], eax
mov rcx, qword [rbx + 8]
test eax, eax
je 0x14002a5dd
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
add rsp, 0x30
pop rbx
ret
mov rdx, rcx
xor r8d, r8d
lea rcx, [fcn.140004730]
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, qword [rbx + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add rsp, 0x30
pop rbx
ret
Function at 0x14002aa20
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rsi, rdx
mov rbx, rcx
xor edi, edi
mov eax, edi
lock xadd dword [rcx + 0x30], eax
test eax, eax
jne 0x14002aa80
call fcn.14002b070
mov dword [rsp + 0x20], edi
mov byte [rsp + 0x24], dil
lea rax, [0x14009ebc0]
mov qword [rsp + 0x28], rax
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rsi], xmm0
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rdi
lea rax, [rcx + 0x28]
test rbx, rbx
cmove rax, rdi
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov ecx, dword [0x1400fe760]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x20]
mov ecx, dword [0x1400fe760]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
mov r8, rsi
mov edx, 0xffffffff
mov rcx, rbx
call fcn.140029cc0
test rax, rax
je 0x14002ab04
lea rax, [rdi + 1]
cmp rdi, 0xffffffffffffffff
cmove rax, rdi
mov rdi, rax
mov r8, rsi
mov edx, 0xffffffff
mov rcx, rbx
call fcn.140029cc0
test rax, rax
jne 0x14002aae0
mov rdx, qword [rsp + 0x30]
mov ecx, dword [0x1400fe760]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
lea rbx, [rsp + 0x38]
mov esi, 3
mov rcx, qword [rbx]
test rcx, rcx
je 0x14002ab2d
call fcn.140063820
add rbx, 8
sub rsi, 1
jne 0x14002ab20
mov rax, rdi
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x14002aeb0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x40
xor r9d, r9d
mov r14d, r8d
mov rsi, rdx
mov rbp, rcx
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + 8], rax
mov rdi, rax
lea r15, [0x14009ebc0]
test rax, rax
jne 0x14002af22
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [rsi]
lea edx, [rdi + 1]
mov rcx, rsi
mov ebx, eax
call qword [r8]
test ebx, ebx
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x38], r15
setne byte [rsp + 0x34]
test ebx, ebx
jne 0x14002b02e
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbp + 0x10], rax
mov qword [rsi + 0x10], rax
cmp qword [rbp + 0x10], 0
jne 0x14002af71
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [rsi]
mov edx, 1
mov rcx, rsi
mov ebx, eax
call qword [r8]
test ebx, ebx
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x38], r15
setne byte [rsp + 0x34]
test ebx, ebx
jne 0x14002b040
xor ecx, ecx
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea r8, [0x14002b420]
mov r9, rsi
mov dword [rsp + 0x20], ecx
mov edx, r14d
mov dword [rsp + 0x68], ecx
call fcn.140071c54
mov qword [rbp + 8], rax
test rax, rax
jne 0x14002afe7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [rsi]
mov edx, 1
mov rcx, rsi
mov ebx, eax
call qword [r8]
test rdi, rdi
je 0x14002afc4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x10]
test rcx, rcx
je 0x14002afd3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x38], r15
setne byte [rsp + 0x34]
test ebx, ebx
jne 0x14002b01c
test rdi, rdi
je 0x14002b003
mov edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
lea rdx, str.thread
lea rcx, [rsp + 0x30]
call fcn.1400151c0
int3
lea rdx, str.thread.entry_event
lea rcx, [rsp + 0x30]
call fcn.1400151c0
int3
lea rdx, str.thread.exit_event
lea rcx, [rsp + 0x30]
call fcn.1400151c0
int3

Function at 0x140030e00
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov ecx, dword [0x1400fe760]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
lea rbx, [rdi + 3]
xor esi, esi
shr rbx, 2
test rax, rax
je 0x140030e63
mov rax, qword [rax + 8]
test rax, rax
je 0x140030e63
mov rcx, qword [rax]
test rcx, rcx
je 0x140030e63
mov qword [rax], rsi
movzx eax, byte [rcx]
cmp rax, rbx
jb 0x140030e5e
mov byte [rcx + rdi], al
mov rax, rcx
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
call fcn.140063820
lea rcx, [rbx*4 + 1]
call fcn.140062ea0
cmp rbx, 0xff
movzx ecx, bl
cmova ecx, esi
mov byte [rax + rdi], cl
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
Function at 0x140030e90
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
sub rsp, 0x28
mov rbx, rcx
mov rdi, rdx
mov ecx, dword [0x1400fe760]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140030ebd
mov r8, qword [rax + 8]
jmp 0x140030ec0
xor r8d, r8d
cmp rdi, 0x3fc
ja 0x140030ee4
test r8, r8
je 0x140030ee4
cmp qword [r8], 0
jne 0x140030ee4
movzx eax, byte [rbx + rdi]
mov byte [rbx], al
mov qword [r8], rbx
add rsp, 0x28
pop rdi
pop rbx
ret
mov rcx, rbx
add rsp, 0x28
pop rdi
pop rbx
jmp fcn.140063820
Function at 0x140031e80
Capabilities:
Create thread

Disassembly:
mov rcx, qword [rcx + 0x78]
test rcx, rcx
jne 0x140031e80
xor al, al
ret
push rbx
sub rsp, 0x40
mov rbx, rcx
mov eax, 1
xchg byte [rcx + 0x70], al
test al, al
jne 0x140031f12
cmp qword [rcx + 0x68], 0
je 0x140031f12
cmp qword [rcx + 0x40], 0
je 0x140031f0a
mov rcx, qword [rcx + 0xb8]
xor eax, eax
xchg dword [rcx + 0x34], eax
mov ecx, 8
call fcn.140062ea0
test rax, rax
je 0x140031ec1
mov qword [rax], rbx
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1400306a0]
xor edx, edx
xor ecx, ecx
call fcn.140071c54
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140031f1a
cmp dword [rbx + 0xa0], 0
jne 0x140031f2d
movaps xmm0, xmmword [rsp + 0x30]
movups xmmword [rbx + 0x98], xmm0
mov al, 1
add rsp, 0x40
pop rbx
ret
xor al, al
add rsp, 0x40
pop rbx
ret
mov dword [rsp + 0x38], 0
mov ecx, 6
call fcn.14003b8b8
nop
call fcn.140071b08
int3

Function at 0x140039d90
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov ebp, edx
mov rdi, rcx
mov ecx, 0x18
call fcn.140062ea0
mov qword [rsp + 0x60], rax
xor r14d, r14d
test rax, rax
je 0x140039dce
mov rcx, rax
call fcn.140027380
jmp 0x140039dd1
mov rax, r14
mov qword [rdi], rax
test ebp, ebp
je 0x140039e03
mov ecx, 8
call fcn.140062ea0
mov qword [rsp + 0x60], rax
test rax, rax
je 0x140039dfc
mov rcx, qword [rdi]
mov rdx, qword [rcx + 0x10]
mov qword [rax], rdx
lock inc dword [rdx + 0x30]
jmp 0x140039dff
mov rax, r14
mov qword [rdi + 8], rax
mov ebx, r14d
test ebp, ebp
jle 0x140039eb1
lea r15, [0x140039360]
nop word [rax + rax]
mov rsi, qword [rdi]
mov ecx, 0x10
call fcn.140062ea0
test rax, rax
je 0x140039e3b
mov qword [rax], r15
mov qword [rax + 8], rsi
jmp 0x140039e3e
mov rax, r14
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9, rax
lea r8, [0x140038640]
xor edx, edx
xor ecx, ecx
call fcn.140071c54
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140039ed0
lea rcx, [rdi + 0x10]
mov rdx, qword [rcx + 8]
cmp rdx, qword [rcx + 0x10]
je 0x140039e95
xorps xmm0, xmm0
movaps xmm1, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
movups xmmword [rdx], xmm1
add qword [rcx + 8], 0x10
jmp 0x140039ea0
lea r8, [rsp + 0x30]
call fcn.140038410
nop
cmp dword [rsp + 0x38], 0
jne 0x140039eca
inc ebx
cmp ebx, ebp
jl 0x140039e20
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
call fcn.140071b08
nop
mov dword [rsp + 0x38], r14d
mov ecx, 6
call fcn.14003b8b8
int3

Function at 0x1400592d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
lea r9, [rdx + rdx]
movabs r8, 0xcbf29ce484222325
xor edx, edx
test r9, r9
je 0x1400431f6
movzx eax, byte [rdx + rcx]
movabs r10, 0x100000001b3
xor r8, rax
inc rdx
imul r8, r10
cmp rdx, r9
jb 0x1400431d9
mov rax, r8
ret
sub r8, rdx
mov rcx, rdx
sar r8, 1
mov rdx, r8
jmp 0x1400431c4
Function at 0x140080a58
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140080884
Function at 0x140096ff0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rdi
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
mov rdi, rcx
call fcn.140096fb0
xorps xmm1, xmm1
movaps xmm6, xmm0
comisd xmm1, xmm0
jb 0x140097024
mov qword [rdi], 0
mov rax, rdi
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 0x40], rbx
lea rcx, [rsp + 0x48]
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x140097056
nop word [rax + rax]
inc ebx
cmp ebx, 3
ja 0x14009707f
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x140097040
mov rbx, qword [rsp + 0x40]
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rsp + 0x48]
mulsd xmm0, xmm6
cvttsd2si rax, xmm0
mov qword [rdi], rax
mov rax, rdi
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x40]
mov rax, rdi
movaps xmm6, xmmword [rsp + 0x20]
mov qword [rdi], 0
add rsp, 0x30
pop rdi
ret
Function at 0x14014d920
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
mov dword [rsp + 8], 0xffffffff
mov dword [rsp + 0xc], 0
jmp 0x14014d952
mov eax, dword [rsp + 0xc]
inc eax
mov dword [rsp + 0xc], eax
mov eax, dword [rsp + 0x38]
cmp dword [rsp + 0xc], eax
jae 0x14014d9fa
mov eax, dword [rsp + 0xc]
mov rcx, qword [rsp]
movzx eax, byte [rcx + rax]
movzx ecx, byte [rsp + 8]
xor eax, ecx
mov dword [rsp + 0x10], eax
mov eax, dword [rsp + 8]
shr eax, 8
mov dword [rsp + 8], eax
mov dword [rsp + 0x14], 0
jmp 0x14014d996
mov eax, dword [rsp + 0x14]
inc eax
mov dword [rsp + 0x14], eax
cmp dword [rsp + 0x14], 8
jge 0x14014d9e5
mov eax, dword [rsp + 0x10]
and eax, 1
test eax, eax
je 0x14014d9b2
mov dword [rsp + 0x1c], 1
jmp 0x14014d9ba
mov dword [rsp + 0x1c], 0
movzx eax, byte [rsp + 0x1c]
mov byte [rsp + 0x18], al
mov eax, dword [rsp + 0x10]
shr eax, 1
mov dword [rsp + 0x10], eax
movzx eax, byte [rsp + 0x18]
test eax, eax
je 0x14014d9e3
mov eax, dword [rsp + 0x10]
xor eax, 0xedb88320
mov dword [rsp + 0x10], eax
jmp 0x14014d98c
mov eax, dword [rsp + 0x10]
mov ecx, dword [rsp + 8]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 8], eax
jmp 0x14014d948
mov eax, dword [rsp + 8]
not eax
add rsp, 0x28
ret

Function at 0x14014dff0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process filename

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x40], 0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x50], rax
mov eax, 0x6b
mov word [rsp + 0x20], ax
mov eax, 0x65
mov word [rsp + 0x22], ax
mov eax, WSAStartup
mov word [rsp + 0x24], ax
mov eax, 0x6e
mov word [rsp + 0x26], ax
mov eax, 0x65
mov word [rsp + 0x28], ax
mov eax, 0x6c
mov word [rsp + 0x2a], ax
mov eax, 0x33
mov word [rsp + 0x2c], ax
mov eax, 0x32
mov word [rsp + 0x2e], ax
mov eax, 0x2e
mov word [rsp + 0x30], ax
mov eax, 0x64
mov word [rsp + 0x32], ax
mov eax, 0x6c
mov word [rsp + 0x34], ax
mov eax, 0x6c
mov word [rsp + 0x36], ax
xor eax, eax
mov word [rsp + 0x38], ax
lea rdx, [rsp + 0x20]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x60]
call fcn.14014da10
test eax, eax
jne 0x14014e0c3
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x40], rax
jmp 0x14014e0ec
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x30], 0
je 0x14014e0ec
mov rax, qword [rsp + 0x48]
mov rax, qword [rax + 0x10]
cmp qword [rsp + 0x50], rax
jne 0x14014e09c
mov rax, qword [rsp + 0x40]
add rsp, 0x68
ret