joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002f6a1
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xf8
mov r13, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x140162028]
xor rax, rsp
mov qword [rsp + 0xf0], rax
lea rbp, [rsp + 0x50]
mov rcx, rbp
call fcn.140069880
mov byte [rbp + 0x21], 1
lea rcx, [rsp + 0x58]
call fcn.140078b60
lea rsi, [rsp + 0x40]
mov rcx, rsi
mov rdx, rbx
mov r8, rbp
call fcn.140079fc0
mov rax, qword [rsi]
inc rax
cmp rax, 1
ja 0x14002f714
cmp byte [rsp + 0x48], 0
je 0x14002f836
lea rsi, [rsp + 0x38]
mov qword [rsi], 0
mov rcx, rdi
call fcn.14007ac10
mov rbx, rax
lea rcx, [rsp + 0x40]
call fcn.14007ac10
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor edi, edi
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 0x101000
mov rcx, rax
mov rdx, rbp
mov r8, rbx
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x14002f836
mov rbx, qword [rsp + 0x38]
cmp qword [r13], rbx
je 0x14002f852
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [r13]
inc rax
cmp rax, 2
jb 0x14002f7ea
call fcn.140063690
mov r15, rax
mov r14, qword [rsp + 0x138]
mov r12, qword [r13]
mov rcx, qword [0x14016a370]
test rcx, rcx
je 0x14002f88c
mov rax, qword [rcx]
mov qword [rsp + 0x20], r15
mov rdx, r12
mov r8, r13
mov r9, r14
call qword [rax + 0x10]
mov r14, qword [r13]
mov rcx, qword [0x14016a370]
test rcx, rcx
je 0x14002f89d
mov rax, qword [rcx]
mov rdx, r14
call qword [rax]
mov qword [r13], 0
lea rax, [rbx + 1]
cmp rax, 2
jb 0x14002f82c
mov qword [r13], rbx
call fcn.140063690
mov r15, rax
mov r14, qword [rsp + 0x138]
mov rcx, qword [0x14016a370]
test rcx, rcx
je 0x14002f8ae
mov rax, qword [rcx]
mov qword [rsp + 0x20], r15
mov rdx, rbx
mov r8, r13
mov r9, r14
call qword [rax + 8]
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14002f852
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov edi, 0x80004005
cmovne edi, ecx
lea rcx, [rsp + 0x40]
call fcn.14007a940
lea rcx, [rsp + 0x50]
call fcn.1400698f0
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.1400f0560
mov eax, edi
add rsp, 0xf8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.1400dae20
mov rcx, qword [0x14016a370]
jmp 0x14002f7b2
call fcn.1400dae20
mov rcx, qword [0x14016a370]
jmp 0x14002f7da
call fcn.1400dae20
mov rcx, qword [0x14016a370]
jmp 0x14002f818
Function at 0x140037b40
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x88
movdqa xmmword [rsp + 0x70], xmm13
movdqa xmmword [rsp + 0x60], xmm12
movdqa xmmword [rsp + 0x50], xmm11
movdqa xmmword [rsp + 0x40], xmm10
movdqa xmmword [rsp + 0x30], xmm9
movdqa xmmword [rsp + 0x20], xmm8
movdqa xmmword [rsp + 0x10], xmm7
movdqa xmmword [rsp], xmm6
movdqu xmm0, xmmword [rcx]
movdqu xmm3, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rcx + 0x20]
movdqu xmm1, xmmword [rcx + 0x30]
movd xmm4, r8d
pxor xmm4, xmm0
add rdx, 0xffffffffffffffc0
mov eax, 0x40
add rcx, rax
cmp rdx, rax
jb 0x140037c6a
movabs rax, 0x154442bd4
movq xmm9, rax
movdqa xmm8, xmmword [0x140132eb0]
movdqa xmm6, xmm4
pclmulqdq xmm6, xmm9, 0
movdqa xmm12, xmm3
pclmulqdq xmm12, xmm9, 0
movdqa xmm11, xmm2
pclmulqdq xmm11, xmm9, 0
movdqa xmm10, xmm1
pclmulqdq xmm10, xmm9, 0
movdqa xmm0, xmm4
pclmulqdq xmm0, xmm8, 0x11
movdqa xmm5, xmm3
pclmulqdq xmm5, xmm8, 0x11
movdqa xmm7, xmm2
pclmulqdq xmm7, xmm8, 0x11
movdqa xmm13, xmm1
pclmulqdq xmm13, xmm8, 0x11
movdqu xmm4, xmmword [rcx]
pxor xmm4, xmm6
pxor xmm4, xmm0
movdqu xmm3, xmmword [rcx + 0x10]
pxor xmm3, xmm12
pxor xmm3, xmm5
movdqu xmm2, xmmword [rcx + 0x20]
pxor xmm2, xmm11
pxor xmm2, xmm7
movdqu xmm1, xmmword [rcx + 0x30]
pxor xmm1, xmm10
pxor xmm1, xmm13
add rdx, 0xffffffffffffffc0
add rcx, 0x40
cmp rdx, 0x3f
ja 0x140037bc5
movabs rax, 0x1751997d0
movq xmm0, rax
movdqa xmm5, xmm4
pclmulqdq xmm5, xmm0, 0
pxor xmm5, xmm3
movdqa xmm3, xmmword [0x140132ec0]
pclmulqdq xmm4, xmm3, 0x11
pxor xmm4, xmm5
movdqa xmm5, xmm4
pclmulqdq xmm5, xmm0, 0
pxor xmm5, xmm2
pclmulqdq xmm4, xmm3, 0x11
pxor xmm4, xmm5
movdqa xmm2, xmm4
pclmulqdq xmm2, xmm0, 0
pxor xmm2, xmm1
pclmulqdq xmm4, xmm3, 0x11
pxor xmm4, xmm2
cmp rdx, 0x10
jb 0x140037cf9
movdqu xmm1, xmmword [rcx]
movdqa xmm2, xmm4
pclmulqdq xmm2, xmm0, 0
pxor xmm2, xmm1
pclmulqdq xmm4, xmm3, 0x11
pxor xmm4, xmm2
add rcx, 0x10
add rdx, 0xfffffffffffffff0
cmp rdx, 0xf
ja 0x140037ccf
movdqa xmm0, xmmword [0x140132ec0]
pclmulqdq xmm0, xmm4, 1
psrldq xmm4, 8
pxor xmm4, xmm0
pxor xmm0, xmm0
pxor xmm1, xmm1
movss xmm1, xmm4
psrldq xmm4, 4
movabs rax, 0x163cd6124
movq xmm2, rax
pclmulqdq xmm2, xmm1, 0
pxor xmm2, xmm4
xorps xmm1, xmm1
movss xmm1, xmm2
pclmulqdq xmm1, xmmword [0x140132ed0], 0x10
pblendw xmm1, xmm0, 0xfc
movabs rax, 0x1db710641
movq xmm0, rax
pclmulqdq xmm0, xmm1, 0
pxor xmm0, xmm2
pextrd eax, xmm0, 1
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
movaps xmm12, xmmword [rsp + 0x60]
movaps xmm13, xmmword [rsp + 0x70]
add rsp, 0x88
ret
Function at 0x14003cc70
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rsi, rcx
mov rax, qword [0x140162028]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea r14, [rsp + 0x38]
lea r12, [rsp + 0x28]
lea r15, [rsp + 0x30]
mov ebp, 0xffffffff
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x20], r12
mov r8, r15
mov r9, r14
call qword [rax + 0x20]
mov edi, eax
mov rbx, qword [rsp + 0x28]
sub rbx, r15
mov r9, qword [rsi + 0x40]
mov edx, 1
mov rcx, r15
mov r8, rbx
call fcn.1401085b0
cmp rax, rbx
jne 0x14003ccf7
cmp edi, 1
je 0x14003cca4
cmp edi, 2
je 0x14003ccf7
mov rcx, qword [rsi + 0x40]
call fcn.1401079ec
neg eax
sbb ebp, ebp
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400f0560
mov eax, ebp
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x14003cd20
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov r14, rdx
mov rdi, rcx
cmp byte [rcx + 0x58], 0
je 0x14003cd55
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, r14
mov r8, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.1401085b0
xor ebx, ebx
test rsi, rsi
jle 0x14003cd7a
movzx edx, byte [r14 + rbx]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x60]
cmp eax, 0xffffffff
je 0x14003cd7a
inc rbx
cmp rsi, rbx
jne 0x14003cd5c
mov rbx, rsi
mov rax, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x14003cd90
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r15d, edx
mov rax, qword [0x140162028]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp edx, 0xffffffff
je 0x14003cde9
mov rdi, rcx
mov byte [rsp + 0x57], r15b
cmp byte [rcx + 0x58], 0
je 0x14003ce13
mov r9, qword [rdi + 0x40]
lea rcx, [rsp + 0x57]
mov edx, 1
mov r8d, 1
call fcn.1401085b0
mov esi, 0xffffffff
cmp rax, 1
jne 0x14003cdf3
xor esi, esi
cmp r15d, 0xffffffff
cmovne esi, r15d
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400f0560
mov eax, esi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rbx, [rsp + 0x58]
lea r12, [rsp + 0x48]
mov qword [r12], rbx
lea rsi, [rsp + 0x57]
lea r13, [rsp + 0x60]
lea r14, [rsp + 0x40]
mov rcx, qword [rdi + 0x48]
mov rdx, qword [rdi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r14
mov r8, rsi
lea r9, [rsp + 0x58]
call qword [rax + 0x10]
cmp qword [rsp + 0x40], rsi
je 0x14003cebe
mov ebp, eax
cmp eax, 3
je 0x14003ce9d
cmp ebp, 1
ja 0x14003cebe
mov rsi, qword [rsp + 0x48]
sub rsi, rbx
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, rbx
mov r8, rsi
call fcn.1401085b0
cmp rax, rsi
jne 0x14003cebe
mov rsi, qword [rsp + 0x40]
cmp ebp, 1
je 0x14003ce30
jmp 0x14003cde9
mov r9, qword [rdi + 0x40]
mov edx, 1
mov r8d, 1
mov rcx, rsi
call fcn.1401085b0
cmp rax, 1
je 0x14003cde9
mov esi, 0xffffffff
jmp 0x14003cdf3
Function at 0x14003cf10
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov r14, rdx
mov rdi, rcx
cmp byte [rcx + 0x58], 0
je 0x14003cf45
mov r9, qword [rdi + 0x40]
mov edx, 2
mov rcx, r14
mov r8, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.1401085b0
xor ebx, ebx
test rsi, rsi
jle 0x14003cf6b
movzx edx, word [r14 + rbx*2]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x60]
cmp ax, 0xffff
je 0x14003cf6b
inc rbx
cmp rsi, rbx
jne 0x14003cf4c
mov rbx, rsi
mov rax, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x14003cf80
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov esi, edx
mov rax, qword [0x140162028]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp dx, 0xffff
je 0x14003cfd8
mov rdi, rcx
mov word [rsp + 0x56], si
cmp byte [rcx + 0x58], 0
je 0x14003d003
mov r9, qword [rdi + 0x40]
lea rcx, [rsp + 0x56]
mov edx, 2
mov r8d, 1
call fcn.1401085b0
mov di, 0xffff
cmp rax, 1
jne 0x14003cfe3
xor eax, eax
cmp si, 0xffff
cmove esi, eax
mov edi, esi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400f0560
mov eax, edi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r15, [rsp + 0x58]
lea r12, [rsp + 0x48]
mov qword [r12], r15
lea rbx, [rsp + 0x56]
lea r13, [rsp + 0x60]
lea r14, [rsp + 0x40]
mov rcx, qword [rdi + 0x48]
mov rdx, qword [rdi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
mov r8, rbx
lea r9, [rsp + 0x58]
call qword [rax + 0x10]
cmp qword [rsp + 0x40], rbx
je 0x14003d0ae
mov ebp, eax
cmp eax, 3
je 0x14003d08d
cmp ebp, 1
ja 0x14003d0ae
mov rbx, qword [rsp + 0x48]
sub rbx, r15
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, r15
mov r8, rbx
call fcn.1401085b0
cmp rax, rbx
jne 0x14003d0ae
mov rbx, qword [rsp + 0x40]
cmp ebp, 1
je 0x14003d020
jmp 0x14003cfd8
mov r9, qword [rdi + 0x40]
mov edx, 1
mov r8d, 1
mov rcx, rbx
call fcn.1401085b0
cmp rax, 1
je 0x14003cfd8
mov di, 0xffff
jmp 0x14003cfe3
Function at 0x14004d488
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r15, r9
mov r14, r8
mov rdi, rdx
mov rsi, rcx
call fcn.14003c33a
mov ebx, eax
test rdi, rdi
je 0x14004d54f
mov rax, qword [rdi + 0x18]
cmp rax, qword [rdi + 0x20]
je 0x14004d5bc
movzx eax, word [rax]
cmp ax, 0xffff
je 0x14004d54f
test bl, bl
je 0x14004d572
mov rcx, qword [rsi]
mov rax, qword [rcx + 0x18]
cmp rax, qword [rcx + 0x20]
je 0x14004d531
movzx r8d, word [rax]
mov rax, qword [r15]
mov rcx, r15
mov dx, 8
call qword [rax + 0x18]
test al, al
je 0x14004d5ab
mov rcx, qword [rsi]
mov rax, qword [rcx + 0x18]
cmp rax, qword [rcx + 0x20]
je 0x14004d53c
add rax, 2
mov qword [rcx + 0x18], rax
mov rcx, rsi
call fcn.14003c33a
mov ebx, eax
test rdi, rdi
je 0x14004d563
mov rax, qword [rdi + 0x18]
cmp rax, qword [rdi + 0x20]
je 0x14004d544
movzx eax, word [rax]
cmp ax, 0xffff
jne 0x14004d4ca
jmp 0x14004d563
mov rax, qword [rcx]
call qword [rax + 0x40]
mov r8d, eax
jmp 0x14004d4e3
mov rax, qword [rcx]
call qword [rax + 0x48]
jmp 0x14004d50d
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x40]
jmp 0x14004d529
test bl, bl
je 0x14004d5a4
mov rcx, rsi
call fcn.14003c33a
mov ebx, eax
test bl, bl
jne 0x14004d594
jmp 0x14004d598
mov edi, 0
test bl, bl
je 0x14004d4d2
jmp 0x14004d553
mov rcx, rsi
call fcn.14003c33a
mov ebx, eax
mov rax, qword [rdi + 0x18]
cmp rax, qword [rdi + 0x20]
je 0x14004d5ca
movzx eax, word [rax]
cmp ax, 0xffff
sete al
xor bl, al
jne 0x14004d598
or byte [r14], 2
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
xor edi, edi
jmp 0x14004d4d2
mov rcx, rsi
call fcn.14003c33a
mov ebx, eax
test rdi, rdi
jne 0x14004d57c
jmp 0x14004d55d
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x40]
jmp 0x14004d4c0
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x40]
jmp 0x14004d589

Function at 0x14005d160
Capabilities:
Accept command line arguments

Disassembly:
push rsi
sub rsp, 0x40
mov rax, qword [0x140162028]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp qword [0x140168098], 0
jne 0x14005d21e
mov ecx, 0x38
call fcn.1400ef770
mov rsi, rax
mov ecx, 0x18
call fcn.1400ef770
mov qword [rsi], rax
lea rcx, [rax + 0x18]
mov qword [rsi + 0x10], rcx
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov qword [rsi + 8], rcx
lea rax, [rsi + 0x20]
movups xmmword [rsi + 0x20], xmm0
mov qword [rsi + 0x18], rax
mov qword [rsi + 0x30], 1
mov qword [0x140168098], rsi
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x28], rax
test rax, rax
je 0x14005d222
cmp word [rax], 0
je 0x14005d222
xor ecx, ecx
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x14005d1e9
lea rdx, [rsp + 0x28]
mov qword [rdx + 8], rcx
mov rcx, rsi
call fcn.14005d230
mov sil, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400f0560
mov eax, esi
add rsp, 0x40
pop rsi
ret
xor esi, esi
jmp 0x14005d209
xor ecx, ecx
jmp 0x14005d1f5
Function at 0x1400636a0
Capabilities:
Delete file

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
mov r14, rcx
mov rax, qword [0x140162028]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rdi, qword [0x140168098]
lea r15, [0x14013c571]
mov rcx, rdi
mov rdx, r15
call fcn.14005dc30
test al, al
jne 0x1400636f3
lea rdx, str.vmodule
mov rcx, rdi
call fcn.14005dc30
test al, al
je 0x140063794
cmp qword [0x1401680a0], 0
jne 0x140063887
mov rax, qword [0x1401680a8]
mov qword [0x1401680a0], rax
mov ecx, 0x20
call fcn.1400ef770
mov rsi, rax
lea rax, str.vmodule
lea r8, [rsp + 0x48]
mov qword [r8], rax
mov qword [r8 + 8], 7
lea r12, [rsp + 0x58]
mov rcx, rdi
mov rdx, r12
call fcn.14005dd20
lea r8, [rsp + 0x20]
mov qword [r8], r15
mov qword [r8 + 8], 1
lea rbx, [rsp + 0x30]
mov rcx, rdi
mov rdx, rbx
call fcn.14005dd20
lea r9, [0x1401680b0]
mov rcx, rsi
mov rdx, rbx
mov r8, r12
call fcn.1400c9ec0
mov qword [0x1401680a8], rsi
cmp byte [rbx + 0x17], 0
js 0x14006383c
cmp byte [rsp + 0x6f], 0
js 0x14006384b
mov eax, dword [r14]
mov dword [0x140163cd8], eax
mov bl, 1
test al, 1
je 0x14006381f
mov rcx, qword [0x1401680c0]
test rcx, rcx
jne 0x14006385a
mov rdi, qword [0x1401680b8]
test rdi, rdi
jne 0x1400637e1
mov ecx, 0x18
call fcn.1400ef770
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov qword [0x1401680b8], rax
mov rsi, qword [r14 + 8]
mov rcx, rsi
call fcn.14010e320
mov rcx, rdi
mov rdx, rsi
mov r8, rax
call fcn.14005aa4a
cmp dword [r14 + 0x14], 0
jne 0x140063818
mov rcx, qword [0x1401680b8]
cmp byte [rcx + 0x17], 0
jns 0x140063812
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.140063890
mov ebx, eax
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400f0560
mov eax, ebx
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x30]
call fcn.1400ef7cc
jmp 0x140063789
mov rcx, qword [rsp + 0x58]
call fcn.1400ef7cc
jmp 0x140063794
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x1401680c0], 0
mov rdi, qword [0x1401680b8]
test rdi, rdi
jne 0x1400637e1
and byte [0x140163cd8], 0xfe
jmp 0x1400637bf
int3
Function at 0x140063890
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x250
mov rax, qword [0x140162028]
xor rax, rsp
mov qword [rsp + 0x248], rax
mov sil, 1
cmp qword [0x1401680c0], 0
je 0x1400638d6
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
call fcn.1400f0560
mov eax, esi
add rsp, 0x250
pop rbx
pop rdi
pop rsi
ret
mov rdi, qword [0x1401680b8]
test rdi, rdi
jne 0x1400638fe
mov ecx, 0x18
call fcn.1400ef770
mov rdi, rax
mov rcx, rax
call fcn.140064800
mov qword [0x1401680b8], rdi
test byte [0x140163cd8], 1
je 0x1400638b9
cmp byte [rdi + 0x17], 0
jns 0x140063910
mov rdi, qword [rdi]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov rcx, rdi
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1401680c0], rax
inc rax
cmp rax, 1
ja 0x1400638b9
lea rdx, [rsp + 0x40]
mov word [rdx], 0
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x140063974
cmp eax, 0x104
jbe 0x14006397b
xor esi, esi
jmp 0x1400638b9
mov rdi, qword [0x1401680b8]
lea rbx, [rsp + 0x40]
mov rcx, rbx
call fcn.14010e320
mov rcx, rdi
mov rdx, rbx
mov r8, rax
call fcn.14005aa4a
mov rcx, qword [0x1401680b8]
movzx eax, byte [rcx + 0x17]
test al, al
jns 0x140063a3f
mov rdx, qword [rcx]
mov rax, qword [rcx + 8]
cmp word [rdx + rax*2 - 2], 0x5c
je 0x1400639d2
lea rdx, [0x1401355a4]
call fcn.14005b0d0
mov rcx, qword [0x1401680b8]
lea rdx, [0x1401355a8]
call fcn.14005b0d0
mov rcx, qword [0x1401680b8]
cmp byte [rcx + 0x17], 0
jns 0x1400639ee
mov rcx, qword [rcx]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1401680c0], rax
inc rax
cmp rax, 1
ja 0x1400638b9
mov qword [0x1401680c0], 0
jmp 0x140063974
mov rdx, rcx
jmp 0x1400639b7
Function at 0x140064ba0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
push rdi
mov r9, qword [rcx]
mov r10, qword [rcx + 8]
mov r8, r10
sub r8, r9
je 0x140064c27
mov rax, r8
shr rax, 2
lea rdx, [r9 + 1]
cmp r10, rdx
jne 0x140064bc5
xor edx, edx
jmp 0x140064c01
mov r10, r8
and r10, 0xfffffffffffffffe
xor edx, edx
lea r11, [0x14013c580]
movzx esi, al
movzx edi, byte [r9 + rdx]
xor edi, esi
shr eax, 8
xor eax, dword [r11 + rdi*4]
movzx esi, al
movzx edi, byte [r9 + rdx + 1]
xor edi, esi
shr eax, 8
xor eax, dword [r11 + rdi*4]
add rdx, 2
cmp r10, rdx
jne 0x140064bd5
test r8b, 1
je 0x140064c1e
movzx edi, al
movzx edx, byte [r9 + rdx]
xor edx, edi
lea rdi, [0x14013c580]
shr eax, 8
xor eax, dword [rdi + rdx*4]
cmp eax, dword [rcx + 0x18]
sete al
pop rdi
pop rsi
ret
xor eax, eax
jmp 0x140064c1e

Function at 0x140064c30
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
push rdi
mov r9, qword [rcx]
mov r10, qword [rcx + 8]
mov r8, r10
sub r8, r9
je 0x140064cbf
mov rax, r8
shr rax, 2
lea rdx, [r9 + 1]
cmp r10, rdx
jne 0x140064c55
xor edx, edx
jmp 0x140064c9c
mov r10, r8
and r10, 0xfffffffffffffffe
xor edx, edx
lea r11, [0x14013c580]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, al
movzx edi, byte [r9 + rdx]
xor edi, esi
shr eax, 8
xor eax, dword [r11 + rdi*4]
movzx esi, al
movzx edi, byte [r9 + rdx + 1]
xor edi, esi
shr eax, 8
xor eax, dword [r11 + rdi*4]
add rdx, 2
cmp r10, rdx
jne 0x140064c70
test r8b, 1
je 0x140064cb9
movzx edi, al
movzx edx, byte [r9 + rdx]
xor edx, edi
lea rdi, [0x14013c580]
shr eax, 8
xor eax, dword [rdi + rdx*4]
mov dword [rcx + 0x18], eax
pop rdi
pop rsi
ret
xor eax, eax
jmp 0x140064cb9
Function at 0x14006e560
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
test byte [0x140163db0], 0x19
jne 0x14006e57e
mov rcx, rsi
add rsp, 0x20
pop rsi
jmp fcn.1400d4720
lea rcx, str.ScopedBlockingCall
call fcn.14006e590
jmp 0x14006e571

Function at 0x14006e680
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
test byte [0x140163db0], 0x19
jne 0x14006e69e
mov rcx, rsi
add rsp, 0x20
pop rsi
jmp fcn.1400d4720
lea rcx, str.ScopedBlockingCallWithBaseSyncPrimitives
call fcn.14006e590
jmp 0x14006e691

Function at 0x14006e990
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x140163d10]
cmp ecx, 0xffffffff
je 0x14006e9b5
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
dec eax
cmp eax, 2
setb al
add rsp, 0x28
ret
xor eax, eax
jmp 0x14006e9b0

Function at 0x14006e9c0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
mov eax, 0x1028
call fcn.1400f04f0
sub rsp, rax
mov rax, qword [0x140162028]
xor rax, rsp
mov qword [rsp + 0x1020], rax
mov esi, dword [0x140163d10]
cmp esi, 0xffffffff
jne 0x14006ea1d
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x14006ea9a
mov esi, eax
mov eax, 0xffffffff
lock cmpxchg dword [0x140163d10], esi
je 0x14006ea1d
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsFree]
mov esi, dword [0x140163d10]
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x14006ea97
lea r14, [rsp + 0x20]
mov r8d, 0x1000
mov rcx, r14
xor edx, edx
call fcn.1400f27e0
lea rdx, [rsp + 0x23]
mov rdi, qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, esi
call rdi
mov ecx, 0x1000
call fcn.1400ef80c
mov rbx, rax
mov r8d, 0x1000
mov rcx, rax
mov rdx, r14
call fcn.1400f23d0
mov rdx, rbx
or rdx, 3
mov ecx, esi
call rdi
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.1400f0560
mov rax, rbx
add rsp, 0x1028
pop rbx
pop rdi
pop rsi
pop r14
ret
int3
int3

Function at 0x14006eaa0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x140163d10]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14006ead4
movsxd rcx, dword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 4]
jne 0x14006ead4
mov rax, qword [rax + rcx]
add rsp, 0x20
pop rsi
ret
xor eax, eax
jmp 0x14006eace

Function at 0x14006eae0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x140163d10]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14006eb1e
movsxd rcx, dword [rsi]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rsi + 4]
movsxd rdx, dword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
test rdi, rdi
je 0x14006eb17
call fcn.14006e9c0
jmp 0x14006eafe