joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001f980
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edi, ecx
mov ecx, dword [0x140362d30]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14001f9d1
lea ecx, [rax + 0xc]
call fcn.140012670
mov rbx, rax
test rax, rax
je 0x14001f9bf
mov qword [rax], rsi
mov dword [rax + 8], esi
jmp 0x14001f9c2
mov rbx, rsi
mov ecx, dword [0x140362d30]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp dword [rbx + 8], 0x40
jl 0x14001f9f2
mov edx, dword [rbx]
test edx, edx
je 0x14001f9e9
lea rcx, [0x140362d38]
call fcn.140021060
mov eax, dword [rbx + 4]
mov dword [rbx], eax
mov qword [rbx + 4], rsi
test edi, edi
jne 0x14001f9fb
mov rcx, rsi
jmp 0x14001fa1e
mov rcx, rdi
lea rdx, [0x140362e48]
mov rax, rdi
shr rax, 0xe
and ecx, 0x3fff
mov rax, qword [rdx + rax*8]
lea rcx, [rcx + rcx*2]
lea rcx, [rax + rcx*8]
and qword [rcx], 0xfffffffffc000000
mov dword [rcx + 0x10], esi
mov eax, dword [rbx + 4]
mov rsi, qword [rsp + 0x38]
mov qword [rcx + 8], rax
inc dword [rbx + 8]
mov dword [rbx + 4], edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14001fc90
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
movss xmm0, dword [0x140265820]
jmp fcn.1400db530
Function at 0x1400211a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov r14, rcx
mov rcx, qword [rcx + 0x38]
test rcx, rcx
mov edi, dword [r14 + 0x40]
lea rbx, [r14 + 0x18]
cmovne rbx, rcx
test edi, edi
je 0x1400211e5
nop
mov rcx, rbx
call fcn.14001e2b0
add rbx, 8
sub edi, 1
jne 0x1400211d0
mov rcx, qword [r14 + 0x38]
test rcx, rcx
je 0x1400211ef
call fcn.14004db90
mov ecx, dword [0x140362c68]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor edi, edi
mov rbx, rax
test rax, rax
jne 0x140021233
lea ecx, [rax + 0x18]
call fcn.140012670
mov rbx, rax
test rax, rax
je 0x140021221
mov qword [rax], rdi
mov qword [rax + 8], rdi
mov dword [rax + 0x10], edi
jmp 0x140021224
mov rbx, rdi
mov ecx, dword [0x140362c68]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp dword [rbx + 0x10], 0x20
jl 0x14002125d
mov rdx, qword [rbx]
test rdx, rdx
je 0x14002124d
lea rcx, [0x140362c70]
call fcn.140021140
mov rax, qword [rbx + 8]
mov qword [rbx], rax
mov qword [rbx + 8], rdi
mov dword [rbx + 0x10], edi
jmp 0x140021261
mov rdi, qword [rbx + 8]
mov rsi, qword [rsp + 0x38]
mov qword [r14], rdi
inc dword [rbx + 0x10]
mov rdi, qword [rsp + 0x40]
mov qword [rbx + 8], r14
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r14
ret
Function at 0x140024740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rdi
push r12
sub rsp, 0x50
movsxd rdi, dword [rcx + 8]
mov rbx, rdx
mov r12, rcx
test edi, edi
jne 0x140024766
xor eax, eax
add rsp, 0x50
pop r12
pop rdi
pop rbx
ret
mov rcx, qword [rcx]
xor eax, eax
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], r13
xor r13d, r13d
mov qword [rsp + 0x30], r14
xor r14d, r14d
mov qword [rsp + 0x28], r15
cmp dword [rcx + 8], eax
je 0x1400247a5
mov rcx, qword [rcx]
test rcx, rcx
je 0x1400247a5
mov rax, qword [rcx]
lea rdx, [rsp + 0x70]
call qword [rax + 0x38]
mov rax, qword [rax]
cmp rax, qword [rbx]
mov r15, rdi
setne al
xor esi, esi
mov byte [rsp + 0x70], al
nop dword [rax]
nop dword [rax + rax]
movsxd rbp, r14d
inc rsi
inc r14d
cmp rsi, r15
jge 0x14002482b
mov rdx, qword [rsp + 0x78]
mov rbx, rsi
shl rbx, 4
movzx edi, al
nop dword [rax]
mov rcx, qword [r12]
xor eax, eax
cmp dword [rcx + rbx + 8], eax
je 0x14002480b
mov rcx, qword [rcx + rbx]
test rcx, rcx
je 0x14002480b
mov rax, qword [rcx]
lea rdx, [rsp + 0x88]
call qword [rax + 0x38]
mov rdx, qword [rsp + 0x78]
mov rax, qword [rax]
xor ecx, ecx
cmp rax, qword [rdx]
setne cl
cmp edi, ecx
jne 0x140024826
inc r14d
inc rsi
add rbx, 0x10
cmp rsi, r15
jl 0x1400247e0
movzx eax, byte [rsp + 0x70]
mov edi, r14d
sub edi, ebp
test al, al
je 0x140024865
cmp r13d, ebp
je 0x140024860
mov rdx, rbp
movsxd rcx, r13d
shl rdx, 4
add rdx, qword [r12]
shl rcx, 4
add rcx, qword [r12]
movsxd r8, edi
shl r8, 4
call fcn.1402517fc
movzx eax, byte [rsp + 0x70]
add r13d, edi
jmp 0x1400248dc
mov rbx, rbp
shl rbx, 4
add rbx, qword [r12]
test edi, edi
je 0x1400248dc
mov eax, dword [rbx + 8]
test eax, eax
je 0x140024883
mov rcx, qword [rbx]
mov r8, rcx
jmp 0x140024888
mov r8, qword [rbx]
xor ecx, ecx
test rcx, rcx
je 0x140024892
mov rax, qword [rcx]
jmp 0x1400248a1
test eax, eax
je 0x1400248c1
test r8, r8
je 0x1400248c1
mov rax, qword [r8]
mov rcx, r8
xor edx, edx
call qword [rax]
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400248ba
xor r8d, r8d
xor edx, edx
call fcn.1400580b0
mov qword [rbx], rax
mov dword [rbx + 8], 0
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400248ce
call fcn.14004db90
add rbx, 0x10
sub edi, 1
jne 0x140024874
movzx eax, byte [rsp + 0x70]
xor al, 1
mov byte [rsp + 0x70], al
cmp rsi, r15
jl 0x1400247c0
mov r14, qword [rsp + 0x30]
mov eax, r15d
mov r15, qword [rsp + 0x28]
sub eax, r13d
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov dword [r12 + 8], r13d
mov r13, qword [rsp + 0x38]
add rsp, 0x50
pop r12
pop rdi
pop rbx
ret
Function at 0x140025140
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
lea rax, [0x140270cb0]
mov rsi, rcx
mov qword [rcx], rax
mov rdi, rdx
add rcx, 8
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov edx, 0xfa0
lea rcx, [rsi + 8]
call qword [sym.imp.KERNEL32.dll_SetCriticalSectionSpinCount]
xor r13d, r13d
mov qword [rsi + 0x58], rdi
lea rcx, [rsp + 0x20]
mov dword [rsi + 0x30], r13d
mov dword [rsi + 0x40], r13d
mov dword [rsi + 0x50], r13d
call fcn.1400d7030
mov edx, dword [rax + 0x10]
test edx, edx
mov eax, 0x10000
cmove edx, eax
lea ecx, [rdx + 0x1fffff]
neg edx
mov eax, edx
and rcx, rax
call fcn.1400d2330
mov rcx, rsi
mov qword [rsi + 0x38], rax
call fcn.1400313b0
mov ecx, eax
call fcn.1400d2330
mov qword [rsi + 0x48], rax
test rax, rax
je 0x1400251e6
cmp qword [rsi + 0x38], r13
jne 0x1400251f9
lea rcx, str.Memory_pools_allocations_failed__exiting..._n
call sub.KERNEL32.dll_OutputDebugStringW
mov cl, 1
call fcn.1400da8e0
test byte [rsi + 0x38], 0xf
jne 0x140025205
test byte [rsi + 0x48], 0xf
je 0x140025218
lea rcx, str.OS_allocations_must_be_aligned_to_a_value_multiple_of_16__exiting..._n
call sub.KERNEL32.dll_OutputDebugStringW
mov cl, 1
call fcn.1400da8e0
mov r15d, r13d
lea r12, [0x14034d270]
lea rdx, [0x14036b828]
nop dword [rax]
movsxd rax, r15d
mov edi, r13d
imul rbx, rax, 0x4020
mov eax, dword [r12]
add rbx, rdx
add eax, 0x10
mov edx, dword [r12 + 4]
mov qword [rbx], r13
mov qword [rbx + 8], r13
mov dword [rbx + 0x10], eax
mov dword [rbx + 0x4018], edx
test edx, edx
je 0x1400252a3
mov ebp, dword [rbx + 0x10]
mov rcx, rsi
mov r14d, dword [rsi + 0x50]
add ebp, r14d
call fcn.1400313b0
cmp ebp, eax
ja 0x140025282
mov eax, r14d
mov dword [rsi + 0x50], ebp
add rax, qword [rsi + 0x48]
jmp 0x140025285
mov rax, r13
lea rcx, [rax + 0x10]
mov qword [rax], r13
mov qword [rax + 8], rcx
mov ecx, edi
inc edi
mov qword [rbx + rcx*8 + 0x18], rax
mov edx, dword [rbx + 0x4018]
cmp edi, edx
jb 0x140025260
cmp edx, 0x800
jae 0x1400252cf
mov eax, edx
mov r8d, 0x800
sub r8d, edx
add rax, 3
shl r8, 3
xor edx, edx
lea rcx, [rbx + rax*8]
call sub.VCRUNTIME140.dll_memset
mov edx, dword [rbx + 0x4018]
mov eax, dword [rbx + 0x10]
inc r15d
imul eax, edx
add r12, 8
lea rdx, [0x14036b828]
add eax, 0x4000
mov dword [rbx + 0x401c], eax
cmp r15d, 0xe
jb 0x140025230
lea r11, [rsp + 0xa0]
mov rax, rsi
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14002b3e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
xor r12d, r12d
mov r15d, r8d
mov rsi, rdx
mov r14, rcx
test rdx, rdx
je 0x14002b40c
mov ebp, dword [rdx + 0x28]
jmp 0x14002b40f
mov ebp, r12d
call fcn.14001fa60
mov rdi, rax
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
jne 0x14002b452
lea ecx, [rax + 0x18]
call fcn.140012670
mov rbx, rax
test rax, rax
je 0x14002b444
mov qword [rax], r12
mov qword [rax + 8], r12
mov dword [rax + 0x10], r12d
jmp 0x14002b447
mov rbx, r12
mov ecx, dword [rdi]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, qword [rbx + 8]
test rcx, rcx
jne 0x14002b4c4
mov rax, qword [rbx]
test rax, rax
je 0x14002b477
mov edx, 0x20
mov qword [rbx + 8], rax
mov dword [rbx + 0x10], edx
mov rcx, rax
mov qword [rbx], r12
jmp 0x14002b4c7
lea rcx, [rdi + 8]
call fcn.1400208b0
mov qword [rbx + 8], rax
test rax, rax
jne 0x14002b4b6
xor edx, edx
mov ecx, 0x2000
call fcn.140056b30
mov qword [rbx + 8], rax
mov edx, 0x1f
nop
lea rcx, [rax + 0x100]
mov qword [rax], rcx
mov rax, rcx
sub rdx, 1
jne 0x14002b4a0
mov qword [rcx], r12
mov rcx, qword [rbx + 8]
mov edx, 0x20
mov dword [rbx + 0x10], edx
jmp 0x14002b4c7
mov edx, dword [rbx + 0x10]
mov rax, qword [rcx]
mov qword [rbx + 8], rax
lea eax, [rdx - 1]
mov dword [rbx + 0x10], eax
lea rax, [0x1402655b8]
mov rbx, qword [rsp + 0x58]
mov qword [rcx], rax
lea eax, [rbp + 1]
mov rbp, qword [rsp + 0x60]
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x50], r12
mov dword [rcx + 8], 0xff
mov dword [rcx + 0xc], eax
lea rax, [0x140273498]
mov qword [rcx], rax
mov rax, r14
mov byte [rcx + 0x28], r12b
mov qword [rcx + 0x30], r12
mov qword [r14], rcx
mov qword [r14 + 8], rsi
mov dword [r14 + 0x10], r15d
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140034760
Capabilities:
Print debug messages

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x450
mov rax, qword [0x14035d6e8]
xor rax, rsp
mov qword [rsp + 0x440], rax
xor r12d, r12d
lea r14, [rsp + 0x40]
mov ebx, r12d
lea rbp, [r11 + 0x10]
mov rdi, rcx
mov esi, 0x400
call fcn.14001d6f0
mov qword [rsp + 0x28], rbp
lea rdx, [rsp + 0x40]
mov r9, rdi
mov qword [rsp + 0x20], r12
mov r8d, 0x200
mov r15, rax
mov rcx, qword [rax]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vswprintf]
test eax, eax
mov ebp, 0xffffffff
cmovs eax, ebp
cmp eax, 0x200
jae 0x1400347f0
cmp eax, ebp
jne 0x14003484a
nop dword [rax + rax]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
movsxd rdi, esi
lea rcx, [rdi + rdi]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
mov r14, rax
test rax, rax
je 0x140034862
mov r9, qword [rsp + 0x490]
lea rax, [rsp + 0x498]
mov rcx, qword [r15]
mov r8, rdi
mov qword [rsp + 0x28], rax
mov rdx, rbx
mov qword [rsp + 0x20], r12
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vswprintf]
test eax, eax
cmovs eax, ebp
cmp eax, esi
cmovge eax, ebp
add esi, esi
cmp eax, ebp
je 0x1400347f0
cdqe
mov rcx, r14
mov word [r14 + rax*2], r12w
call sub.KERNEL32.dll_OutputDebugStringW
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.14024f8b0
add rsp, 0x450
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400348f0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
cmp r8d, 0x10
jbe 0x140034912
lea rcx, str.Alignment___16_is_not_supported_n
call sub.KERNEL32.dll_OutputDebugStringW
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsi + 0x30], eax
je 0x140034931
call fcn.1400db5c0
jmp 0x140034a65
xor ebp, ebp
lea r10, [0x14036b828]
mov edx, ebp
nop dword [rax]
movsxd rax, edx
imul rax, rax, 0x4020
add rax, r10
mov r9d, dword [rax]
mov r8d, dword [rax + 0x4018]
cmp r9d, r8d
jae 0x140034966
mov ecx, dword [rax + 0x10]
sub ecx, 0x10
cmp edi, ecx
jbe 0x1400349c8
inc edx
cmp edx, 0xe
jb 0x140034940
mov eax, dword [rsi + 0x40]
lea ecx, [rdi + 0x10]
add eax, 0xf
mov r8d, 0x200000
and eax, 0xfffffff0
mov edx, edi
add ecx, eax
mov dword [rsi + 0x40], eax
cmp ecx, r8d
ja 0x140034a43
mov rbx, qword [rsi + 0x38]
mov dword [rsi + 0x40], ecx
mov ecx, eax
add rbx, rcx
mov eax, edi
mov qword [rbx], rax
mov rax, qword [rsi + 0x38]
add rax, 0x10
add rcx, rax
mov qword [rbx + 8], rcx
lea rcx, str.Malloc_Size_d_LargeMemoryPoolOffset_d__n
mov r8d, dword [rsi + 0x40]
call fcn.140034760
mov rax, qword [rbx + 8]
jmp 0x140034a67
mov edx, ebp
test r8d, r8d
je 0x1400349e3
nop
mov ecx, edx
mov rbx, qword [rax + rcx*8 + 0x18]
cmp qword [rbx], rbp
je 0x140034a09
inc edx
cmp edx, r8d
jb 0x1400349d0
mov edx, edi
lea rcx, str.AllocateFromPool_run_out_of_memory_allocating__u_bytes_for__u_allocations_n
call fcn.140034760
lea rcx, str.Please_increase_MaxNumAllocations_for_that_pool__exiting..._n
call sub.KERNEL32.dll_OutputDebugStringW
mov cl, 1
call fcn.1400da8e0
mov rax, rbp
jmp 0x140034a67
cmp dword [rax + 4], edx
mov r8d, edi
cmovae edx, dword [rax + 4]
inc dword [rax + 0xc]
mov dword [rax + 4], edx
lea edx, [r9 + 1]
cmp dword [rax + 8], edx
mov dword [rax], edx
cmovae edx, dword [rax + 8]
mov dword [rax + 8], edx
mov edx, 0xfe
mov rcx, qword [rbx + 8]
mov qword [rbx], r8
call sub.VCRUNTIME140.dll_memset
mov rbp, qword [rbx + 8]
mov rax, rbp
jmp 0x140034a67
sub r8d, eax
lea rcx, str.MallocCrash_run_out_of_memory_allocating__u_bytes__free__u_bytes_n
call fcn.140034760
lea rcx, str.Please_increase_LARGE_MEMORYPOOL_SIZE__exiting..._n
call sub.KERNEL32.dll_OutputDebugStringW
mov cl, 1
call fcn.1400da8e0
xor eax, eax
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400422a9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp edx, 2
jl 0x140042497
mov r11, rsp
push rbx
push rdi
sub rsp, 0x368
mov rax, qword [0x14035d6e8]
xor rax, rsp
mov qword [rsp + 0x340], rax
mov qword [rsp + 0x40], rcx
mov rbx, r9
mov qword [r11 - 0x18], rbp
dec rcx
movd xmm0, edx
movzx edi, r8b
movsxd rax, edx
add rcx, rax
mov qword [r11 - 0x20], rsi
cvtdq2ps xmm0, xmm0
mov qword [r11 - 0x28], r14
mov qword [rsp + 0x48], rcx
call sub.api_ms_win_crt_math_l1_1_0.dll_logf
addss xmm0, xmm0
xor edx, edx
mov r8d, 0x2e8
lea rcx, [rsp + 0x58]
cvttss2si rax, xmm0
mov dword [rsp + 0x50], eax
call sub.VCRUNTIME140.dll_memset
lea rsi, [rsp + 0x40]
nop dword [rax]
movups xmm2, xmmword [rsi]
movsd xmm0, qword [rsi + 0x10]
movdqa xmm1, xmm2
movd ebp, xmm2
psrldq xmm1, 8
movd r14d, xmm1
movsd qword [rsp + 0x30], xmm0
mov r11d, dword [rsp + 0x30]
mov edx, r14d
sub edx, ebp
inc edx
movups xmmword [rsp + 0x20], xmm2
mov r10, qword [rsp + 0x20]
test r11d, r11d
je 0x140042445
mov r9, qword [rsp + 0x28]
cmp edx, 8
jle 0x140042498
mov eax, edx
lea r8, [r9 + 1]
cdq
sub eax, edx
sar eax, 1
movsxd rdx, eax
movzx eax, byte [r10]
movzx ecx, byte [rdx + r10]
mov byte [rdx + r10], al
mov rdx, r10
mov byte [r10], cl
nop
inc rdx
cmp rdx, r9
ja 0x1400423a0
movzx eax, byte [rdx]
cmp byte [r10], al
jae 0x140042390
movzx ecx, byte [r8 - 1]
dec r8
cmp r8, r10
jbe 0x1400423b2
cmp cl, byte [r10]
jae 0x1400423a0
cmp rdx, r8
ja 0x1400423c1
movzx eax, byte [rdx]
mov byte [rdx], cl
mov byte [r8], al
jmp 0x140042390
movzx eax, byte [r10]
dec r11d
mov byte [r10], cl
mov rcx, r8
mov byte [r8], al
sub rcx, r10
mov rax, r9
sub rax, rdx
cmp rcx, rax
jle 0x14004240c
lea rax, [r10 + 1]
cmp rax, r8
jae 0x1400423fb
lea rax, [r8 - 1]
mov qword [rsi], r10
mov qword [rsi + 8], rax
mov dword [rsi + 0x10], r11d
add rsi, 0x18
cmp r9, rdx
jbe 0x140042454
mov r10, rdx
mov qword [rsp + 0x20], rdx
mov ebp, edx
jmp 0x140042435
cmp r9, rdx
jbe 0x140042420
mov qword [rsi], rdx
mov qword [rsi + 8], r9
mov dword [rsi + 0x10], r11d
add rsi, 0x18
lea rax, [r10 + 1]
cmp rax, r8
jae 0x140042454
lea r9, [r8 - 1]
mov qword [rsp + 0x28], r9
mov r14d, r9d
mov edx, r14d
sub edx, ebp
inc edx
test r11d, r11d
jne 0x140042364
mov r9, rbx
movzx r8d, dil
mov rcx, r10
call fcn.140041dc0
sub rsi, 0x18
lea rax, [rsp + 0x40]
cmp rsi, rax
jae 0x140042320
mov r14, qword [rsp + 0x350]
mov rsi, qword [rsp + 0x358]
mov rbp, qword [rsp + 0x360]
mov rcx, qword [rsp + 0x340]
xor rcx, rsp
call fcn.14024f8b0
add rsp, 0x368
pop rdi
pop rbx
ret
cmp r9, r10
jbe 0x140042454
lea r8, [r10 + 1]
mov rdx, r10
mov rcx, r8
cmp r8, r9
ja 0x1400424c1
nop dword [rax]
movzx eax, byte [rcx]
cmp byte [rdx], al
cmovb rdx, rcx
inc rcx
cmp rcx, r9
jbe 0x1400424b0
movzx eax, byte [r9]
movzx ecx, byte [rdx]
mov byte [rdx], al
mov byte [r9], cl
dec r9
cmp r9, r10
ja 0x1400424a1
jmp 0x140042454
Function at 0x1400424e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r12
push r14
sub rsp, 0x38
mov r14, rdx
mov r12, rcx
movsxd rdx, dword [rcx + 8]
test edx, edx
jne 0x140042501
xor eax, eax
add rsp, 0x38
pop r14
pop r12
ret
mov rax, qword [rcx]
xor r8d, r8d
mov qword [rsp + 0x58], rbx
movabs r9, 0x10ffffffc0ffe5
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rsi
movzx ecx, word [rax]
mov qword [rsp + 0x30], rdi
mov edi, r8d
mov qword [rsp + 0x28], r13
mov r13d, r8d
mov qword [rsp + 0x20], r15
test cx, cx
je 0x14004254d
cmp cx, 0x2f
jne 0x140042611
mov rax, qword [r14]
mov dword [rax], r8d
mov bpl, 1
mov r15, rdx
mov rbx, r8
nop word [rax + rax]
movsxd rdx, edi
inc rbx
inc edi
cmp rbx, r15
jge 0x14004259e
nop dword [rax]
mov rax, qword [r12]
movzx eax, word [rax + rbx*2]
test ax, ax
je 0x14004258d
cmp ax, 0x2f
jne 0x140042643
mov rax, qword [r14]
mov dword [rax], r8d
mov al, 1
cmp bpl, al
jne 0x14004259e
inc edi
inc rbx
cmp rbx, r15
jl 0x140042570
mov esi, edi
sub esi, edx
test bpl, bpl
je 0x1400425d6
cmp r13d, edx
je 0x1400425d3
mov rcx, qword [r12]
movsxd rax, r13d
movsxd r8, esi
add r8, r8
lea rdx, [rcx + rdx*2]
lea rcx, [rcx + rax*2]
call fcn.1402517fc
xor r8d, r8d
movabs r9, 0x10ffffffc0ffe5
add r13d, esi
xor bpl, 1
cmp rbx, r15
jl 0x140042560
mov rdi, qword [rsp + 0x30]
mov eax, r15d
mov r15, qword [rsp + 0x20]
sub eax, r13d
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
mov dword [r12 + 8], r13d
mov r13, qword [rsp + 0x28]
add rsp, 0x38
pop r14
pop r12
ret
lea eax, [rcx - 0x2b]
cmp ax, 0x34
ja 0x140042623
movzx eax, ax
bt r9, rax
jb 0x14004262d
sub cx, 0x61
cmp cx, 0x19
ja 0x14004263b
mov rax, qword [r14]
inc dword [rax]
cmp dword [rax], 0xe
jle 0x14004254d
xor bpl, bpl
jmp 0x140042550
lea ecx, [rax - 0x2b]
cmp cx, 0x34
ja 0x140042655
movzx ecx, cx
bt r9, rcx
jb 0x14004265f
sub ax, 0x61
cmp ax, 0x19
ja 0x14004266d
mov rax, qword [r14]
inc dword [rax]
cmp dword [rax], 0xe
jle 0x14004258d
xor al, al
jmp 0x14004258f

Function at 0x140042bb0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
movzx eax, word [rcx]
lea r10, [rcx + 2]
not edx
test ax, ax
je 0x140042c29
lea r11, [0x14034d6d0]
nop word [rax + rax]
movzx r9d, ax
lea r10, [r10 + 2]
mov eax, edx
shr edx, 8
xor rax, r9
shr r9, 8
movzx ecx, al
mov r8d, dword [r11 + rcx*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor r9, rax
movzx eax, r9b
mov edx, dword [r11 + rax*4]
movzx eax, word [r10 - 2]
xor edx, r8d
movzx ecx, dl
shr edx, 8
mov r8d, dword [r11 + rcx*4]
xor r8d, edx
movzx ecx, r8b
shr r8d, 8
mov edx, dword [r11 + rcx*4]
xor edx, r8d
test ax, ax
jne 0x140042bd0
not edx
mov eax, edx
ret
Function at 0x140043a60
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea rax, [0x140274118]
mov qword [rcx + 8], rdx
mov qword [rcx], rax
mov rdi, rcx
mov byte [rcx + 0x10], 0
add rcx, 0x18
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov edx, 0xfa0
lea rcx, [rdi + 0x18]
call qword [sym.imp.KERNEL32.dll_SetCriticalSectionSpinCount]
lea rcx, [rdi + 0x48]
call qword [sym.imp.KERNEL32.dll_InitializeSRWLock]
xor eax, eax
mov dword [rdi + 0x7c], 0x80
mov qword [rdi + 0x50], rax
mov qword [rdi + 0x58], rax
mov qword [rdi + 0x70], rax
mov dword [rdi + 0x78], eax
mov dword [rdi + 0x84], eax
mov qword [rdi + 0x90], rax
mov dword [rdi + 0x98], eax
mov qword [rdi + 0xa0], rax
mov qword [rdi + 0xa8], rax
mov dword [rdi + 0x80], 0xffffffff
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ecx, eax
mov dword [rdi + 0x40], eax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x20
pop rdi
ret

Function at 0x14004dfa0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
cmp dword [rdx], 0xffffffff
mov rdi, rdx
mov rbx, rcx
jne 0x14004dfd1
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ecx, eax
mov eax, 0xffffffff
lock cmpxchg dword [rdi], ecx
cmp eax, 0xffffffff
je 0x14004dfd1
call qword [sym.imp.KERNEL32.dll_TlsFree]
mov ecx, dword [rdi]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x14004e03e
mov rcx, qword [rbx + 8]
mov qword [rsp + 0x38], rsi
call qword [rbx]
mov ecx, dword [0x1403a94d4]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14004e02b
lea rbx, [rax + 0x30]
mov qword [rsp + 0x30], rbp
movsxd rbp, dword [rbx + 8]
lea ecx, [rbp + 1]
mov dword [rbx + 8], ecx
cmp ecx, dword [rbx + 0xc]
jle 0x14004e01f
mov edx, ebp
mov rcx, rbx
call fcn.14005a240
mov rax, qword [rbx]
mov qword [rax + rbp*8], rsi
mov rbp, qword [rsp + 0x30]
mov ecx, dword [rdi]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14005b4f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rdi
push r13
sub rsp, 0x48
movsxd rdi, dword [rdx + 8]
mov r13, rcx
cmp edi, 1
jg 0x14005b514
call fcn.14001e130
mov rax, r13
add rsp, 0x48
pop r13
pop rdi
ret
mov qword [rsp + 0x60], rbx
lea rcx, [rsp + 0x20]
mov rbx, qword [rdx]
xor r8d, r8d
mov qword [rsp + 0x40], r12
mov edx, edi
xor r12d, r12d
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x20], r12
mov dword [rsp + 0x28], edi
call fcn.14001c130
mov r15, qword [rsp + 0x20]
mov r8, rdi
add r8, r8
mov rdx, rbx
mov rcx, r15
call sub.VCRUNTIME140.dll_memcpy
movsxd rdx, dword [rsp + 0x28]
test edx, edx
je 0x14005b64b
movzx ecx, word [r15]
mov edi, r12d
mov qword [rsp + 0x68], rbp
movabs r8, 0x43ffffff95ffb
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x38], r14
test cx, cx
je 0x14005b5aa
lea eax, [rcx - 0x2d]
cmp ax, 0x32
ja 0x14005b59b
movzx eax, ax
bt r8, rax
jb 0x14005b5aa
sub cx, 0x61
cmp cx, 0x19
jbe 0x14005b5aa
xor bpl, bpl
jmp 0x14005b5ad
mov bpl, 1
mov r14, rdx
mov rbx, r12
movsxd rdx, edi
inc rbx
inc edi
cmp rbx, r14
jge 0x14005b5fb
movzx eax, word [r15 + rbx*2]
test ax, ax
je 0x14005b5ea
lea ecx, [rax - 0x2d]
cmp cx, 0x32
ja 0x14005b5dc
movzx ecx, cx
bt r8, rcx
jb 0x14005b5ea
sub ax, 0x61
cmp ax, 0x19
jbe 0x14005b5ea
xor al, al
jmp 0x14005b5ec
mov al, 1
cmp bpl, al
jne 0x14005b5fb
inc edi
inc rbx
cmp rbx, r14
jl 0x14005b5c0
mov esi, edi
sub esi, edx
test bpl, bpl
je 0x14005b62c
cmp r12d, edx
je 0x14005b629
movsxd rax, r12d
lea rdx, [r15 + rdx*2]
movsxd r8, esi
add r8, r8
lea rcx, [r15 + rax*2]
call fcn.1402517fc
movabs r8, 0x43ffffff95ffb
add r12d, esi
xor bpl, 1
cmp rbx, r14
jl 0x14005b5b3
mov r14, qword [rsp + 0x38]
mov edx, r12d
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
mov eax, dword [rsp + 0x2c]
mov r12, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x60]
mov qword [r13], r15
mov r15, qword [rsp + 0x30]
mov dword [r13 + 0xc], eax
mov rax, r13
mov dword [r13 + 8], edx
add rsp, 0x48
pop r13
pop rdi
ret