joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140042c90
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov r8, qword [r8 + 0x20]
mov r10, rcx
cmp qword [rdi + 0x28], 8
lea r9, [rdi + 0x10]
jb 0x140042cbb
mov r9, qword [rdi + 0x10]
xor ecx, ecx
movabs rdx, 0xcbf29ce484222325
add r8, r8
je 0x140042cf4
movabs rbx, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + r9]
inc rcx
xor rdx, rax
imul rdx, rbx
cmp rcx, r8
jb 0x140042ce0
mov r8, qword [r10 + 0x30]
mov rcx, qword [r10 + 0x18]
and r8, rdx
shl r8, 4
add rcx, r8
mov rax, qword [rcx]
cmp qword [rcx + 8], rdi
jne 0x140042d34
cmp rax, rdi
jne 0x140042d2a
mov rax, qword [r10 + 8]
mov qword [rcx], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
mov qword [r8 + rcx + 8], rax
jmp 0x140042d3f
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
jmp 0x140042d3f
cmp rax, rdi
jne 0x140042d3f
mov rax, qword [rdi]
mov qword [rcx], rax
mov rdx, qword [rdi + 8]
lea rcx, [rdi + 0x10]
mov rbx, qword [rdi]
mov qword [rdx], rbx
mov r8, qword [rdi]
mov rdx, qword [rdi + 8]
mov qword [r8 + 8], rdx
dec qword [r10 + 0x10]
call fcn.140040510
mov edx, 0x50
mov rcx, rdi
call fcn.140072f50
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140043010
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0xa0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rax, qword [0x140124190]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov r14, r9
mov r15, r8
mov rsi, rdx
mov rbx, rcx
xor eax, eax
mov qword [r11 - 0x58], rax
mov qword [r11 - 0x50], rax
mov qword [r11 - 0x48], rax
mov r8, rdx
mov rdx, rcx
lea rcx, [r11 - 0x58]
call fcn.1400432a0
nop
mov rax, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x80]
sub rax, rdi
cmp rax, r14
jne 0x140043097
mov r8, r14
mov rdx, rdi
mov rcx, r15
call fcn.140097b70
test eax, eax
je 0x14004322a
mov rcx, rbx
call fcn.140042da0
mov rbp, rax
test rax, rax
je 0x14004322a
mov r9, rbx
mov r10, qword [rbx + 0x18]
cmp r10, 8
jb 0x1400430bb
mov r9, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rdx, 0xffffffffffffffff
test r8, r8
je 0x1400430e1
mov rcx, r8
mov rax, r9
cmp word [rax], 0x5c
je 0x140043145
add rax, 2
sub rcx, 1
jne 0x1400430d1
mov rax, rdx
inc rax
movdqa xmm0, xmmword [0x1401057a0]
movdqu xmmword [rsp + 0x70], xmm0
xor r12d, r12d
mov word [rsp + 0x60], r12w
cmp r8, rax
jb 0x14004328b
sub r8, rax
cmp r8, rdx
cmovb rdx, r8
cmp r10, 8
jb 0x14004311a
mov rbx, qword [rbx]
lea r9, [rbx + rax*2]
lea rcx, [rsp + 0x60]
cmp rdx, 7
ja 0x140043152
mov qword [rsp + 0x70], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, r9
call fcn.140096e70
mov word [rsp + rbx + 0x60], r12w
jmp 0x140043157
test rax, rax
je 0x1400430e1
sub rax, r9
sar rax, 1
jmp 0x1400430e4
call fcn.14002d400
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x2011f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400431d4
cmp qword [rsi + 0x18], 8
jb 0x1400431a6
mov rsi, qword [rsi]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r15
mov r9d, dword [rsp + 0x100]
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140043216
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140043211
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140043291
call fcn.140072f50
movdqa xmm0, xmmword [0x1401057a0]
movdqu xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], r12w
test rdi, rdi
je 0x140043263
mov rdx, qword [rsp + 0x90]
sub rdx, rdi
mov rax, rdi
cmp rdx, 0x1000
jb 0x14004325b
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140043285
mov rcx, rdi
call fcn.140072f50
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140072ef0
add rsp, 0xa0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.1400a01c4
nop
call fcn.14002cb80
nop
call fcn.1400a01c4
int3
Function at 0x140047770
Capabilities:
Check for time delay via gettickcount
Enumerate services
Query service status
Stop service

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0xc0
mov rax, qword [0x140124190]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0x30], rsp
mov rbx, rcx
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r15, rax
test rax, rax
je 0x140047996
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
lea rax, [rsp + 0x84]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
test eax, eax
jne 0x140047996
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x140047996
mov ecx, dword [rsp + 0x80]
call fcn.1400a2d0c
mov r14, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140047996
lea rax, [rsp + 0x84]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x80]
mov r8, r14
mov edx, 1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
test eax, eax
jne 0x14004786d
lea rdx, [0x140047996]
mov rcx, rsp
call fcn.1400daf20
xor edi, edi
mov dword [rsp + 0x38], edi
cmp edi, dword [rsp + 0x84]
jae 0x14004798e
lea rcx, [rdi + rdi*2]
add rcx, rcx
movups xmm0, xmmword [r14 + rcx*8 + 0x10]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [r14 + rcx*8 + 0x20]
movups xmmword [rsp + 0x70], xmm1
mov r8d, 0x24
mov rdx, qword [r14 + rcx*8]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x1400478cf
lea rdx, [0x140047996]
mov rcx, qword [rsp + 0x30]
call fcn.1400daf20
nop
lea r8, [rsp + 0x88]
mov edx, 1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x140047900
lea rdx, [0x140047996]
mov rcx, qword [rsp + 0x30]
call fcn.1400daf20
nop word [rax + rax]
cmp dword [rsp + 0x8c], 1
je 0x14004797e
mov ecx, dword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rsp + 0x88]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x140047952
lea rdx, [0x140047996]
mov rcx, qword [rsp + 0x30]
call fcn.1400daf20
cmp dword [rsp + 0x8c], 1
je 0x14004797e
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, esi
cmp eax, 0x7530
jbe 0x14004797c
lea rdx, [0x140047996]
mov rcx, qword [rsp + 0x30]
call fcn.1400daf20
jmp 0x140047900
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
inc edi
jmp 0x14004786f
mov rcx, r14
call fcn.1400a2a50
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140072ef0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1400479c0
Capabilities:
Check for time delay via gettickcount
Query service status
Stop service

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x80
mov rax, qword [0x140124190]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x30], rsp
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140047c01
cmp qword [rbx + 0x18], 8
jb 0x140047a22
mov rbx, qword [rbx]
mov r8d, 0x2c
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x140047bf8
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rsp + 0x50]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x140047a7a
lea rdx, [0x140047c01]
mov rcx, qword [rsp + 0x30]
call fcn.1400daf20
mov eax, dword [rsp + 0x54]
cmp eax, 1
jne 0x140047a94
lea rdx, [0x140047c01]
mov rcx, qword [rsp + 0x30]
call fcn.1400daf20
mov r14d, 0x2710
nop word [rax + rax]
cmp eax, 3
jne 0x140047b49
mov eax, 0xcccccccd
mul dword [rsp + 0x68]
shr edx, 3
cmp edx, 0x3e8
jae 0x140047ac4
mov edx, 0x3e8
jmp 0x140047acb
cmp edx, r14d
cmova edx, r14d
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rsp + 0x50]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x140047b08
lea rdx, [0x140047c01]
mov rcx, qword [rsp + 0x30]
call fcn.1400daf20
cmp dword [rsp + 0x54], 1
jne 0x140047b20
lea rdx, [0x140047c01]
mov rcx, qword [rsp + 0x30]
call fcn.1400daf20
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x7530
jbe 0x140047b40
lea rdx, [0x140047c01]
mov rcx, qword [rsp + 0x30]
call fcn.1400daf20
mov eax, dword [rsp + 0x54]
jmp 0x140047aa0
mov rcx, rbx
call fcn.140047770
lea r8, [rsp + 0x50]
mov edx, 1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x140047b80
lea rdx, [0x140047c01]
mov rcx, qword [rsp + 0x30]
call fcn.1400daf20
nop dword [rax]
cmp dword [rsp + 0x54], 1
je 0x140047bef
mov ecx, dword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rsp + 0x50]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x140047bc6
lea rdx, [0x140047c01]
mov rcx, qword [rsp + 0x30]
call fcn.1400daf20
cmp dword [rsp + 0x54], 1
je 0x140047bef
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x7530
jbe 0x140047bed
lea rdx, [0x140047c01]
mov rcx, qword [rsp + 0x30]
call fcn.1400daf20
jmp 0x140047b80
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140072ef0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x140052030
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push rdi
sub rsp, 0xb0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0xc8], rbx
mov rax, qword [0x140124190]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rbx, rcx
mov qword [rcx], 0
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 1
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x1400520d3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [rsp + 0x20], 8
mov r9d, 1
xor r8d, r8d
lea rdx, str.Crypto_RNG
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x1400520d3
mov dword [rsp + 0x20], 0x28
lea r9d, [rax + 1]
xor r8d, r8d
lea rdx, str.Crypto_RNG
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x1400520f7
mov rax, rbx
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140072ef0
mov rbx, qword [rsp + 0xc8]
add rsp, 0xb0
pop rdi
ret
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, str.CryptAcquireContext
lea rcx, [rsp + 0x38]
call fcn.140022ce0
nop
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x60]
call fcn.140052170
lea rdx, [0x140120980]
lea rcx, [rsp + 0x60]
call fcn.140096d78
int3

Function at 0x140052780
Capabilities:
Generate random numbers via winapi

Disassembly:
push rdi
sub rsp, 0xa0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0xb0], rbx
mov rax, qword [0x140124190]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, r8
mov rdi, rdx
mov ecx, dword [0x14012f790]
mov rax, qword gs:[0x58]
mov edx, 0x120
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x14012e488], ecx
jg 0x14005286c
mov eax, ebx
cmp rbx, rax
jne 0x14005282e
xor ecx, ecx
mov eax, ecx
test rbx, rbx
setne al
test ebx, ebx
setne cl
cmp eax, ecx
jne 0x14005282e
mov r8, rdi
mov edx, ebx
mov rcx, qword [0x14012e480]
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x1400528af
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140072ef0
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rdi
ret
mov ecx, 0x5b6
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, str.GenerateBlock_size
lea rcx, [rsp + 0x28]
call fcn.140022ce0
nop
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x50]
call fcn.140052170
lea rdx, [0x140120980]
lea rcx, [rsp + 0x50]
call fcn.140096d78
nop
lea rcx, [0x14012e488]
call fcn.140073990
cmp dword [0x14012e488], 0xffffffff
jne 0x1400527d9
lea rcx, [0x14012e480]
call fcn.140052030
lea rcx, [0x1400defa0]
call fcn.140073314
nop
lea rcx, [0x14012e488]
call fcn.140073930
jmp 0x1400527d9
lea rdx, [0x1400e2010]
lea rcx, [rsp + 0x28]
call fcn.140022ce0
nop
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x50]
call fcn.140052170
lea rdx, [0x140120980]
lea rcx, [rsp + 0x50]
call fcn.140096d78
int3
Function at 0x140063f50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xor ebx, ebx
mov r11, rdx
mov r9, rcx
mov r10d, ebx
cmp r8, 8
jb 0x140063f97
mov rcx, r8
shr rcx, 3
imul rax, rcx, 0xfffffffffffffff8
add r8, rax
nop dword [rax]
nop dword [rax + rax]
mov rax, qword [r9]
add r9, 8
xor rax, qword [r11]
add r11, 8
or r10, rax
sub rcx, 1
jne 0x140063f80
mov rdx, r10
shr rdx, 0x20
or edx, r10d
mov eax, edx
mov ecx, edx
shr eax, 8
or eax, edx
shr ecx, 0x10
and eax, 0xff00
or eax, ecx
movzx ecx, dl
shr eax, 8
or eax, ecx
test r8, r8
je 0x1400640a7
cmp r8, 8
jb 0x140064074
mov rdx, r8
mov rcx, r9
and rdx, 0xfffffffffffffff8
xorps xmm4, xmm4
sub rcx, r11
xorps xmm3, xmm3
mov r10, r11
nop word [rax + rax]
movd xmm2, dword [rcx + r10]
xorps xmm0, xmm0
movd xmm1, dword [r10]
lea r10, [r10 + 8]
punpcklbw xmm2, xmm0
add rbx, 8
punpcklwd xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
movd xmm1, dword [r10 - 4]
punpcklbw xmm1, xmm0
por xmm2, xmm4
punpcklwd xmm1, xmm0
movdqa xmm4, xmm2
movd xmm2, dword [rcx + r10 - 4]
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
pxor xmm2, xmm1
por xmm2, xmm3
movdqa xmm3, xmm2
cmp rbx, rdx
jb 0x140063ff0
por xmm3, xmm4
movdqa xmm0, xmm3
psrldq xmm0, 8
por xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
por xmm3, xmm0
movd ecx, xmm3
or eax, ecx
cmp rbx, r8
jae 0x1400640a7
sub r9, r11
lea r10, [rbx + r11]
sub r8, rbx
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [r10 + r9]
movzx ecx, byte [r10]
lea r10, [r10 + 1]
xor edx, ecx
or eax, edx
sub r8, 1
jne 0x140064090
mov rbx, qword [rsp + 8]
test eax, eax
sete al
ret
Function at 0x1400640c0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r10, rdx
test r9, r9
je 0x140064204
cmp r9, 4
jb 0x14006410a
mov rdx, r9
shr rdx, 2
imul rax, rdx, 0xfffffffffffffffc
add r9, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, dword [r10]
add r10, 4
xor eax, dword [r8]
add r8, 4
mov dword [rcx], eax
add rcx, 4
sub rdx, 1
jne 0x1400640f0
xor r11d, r11d
test r9, r9
je 0x140064204
cmp r9, 0x40
jb 0x1400641d8
lea rdx, [rcx - 1]
lea rax, [r8 - 1]
add rdx, r9
add rax, r9
cmp rcx, rax
ja 0x14006413c
cmp rdx, r8
jae 0x1400641d8
lea rax, [r10 - 1]
add rax, r9
cmp rcx, rax
ja 0x140064151
cmp rdx, r10
jae 0x1400641d8
mov qword [rsp + 0x10], rbx
mov qword [rsp], rdi
mov rdi, r9
and rdi, 0xffffffffffffffc0
mov rdx, r10
mov rbx, rcx
sub rdx, r8
mov rax, r8
sub rbx, r8
movdqu xmm0, xmmword [rax]
add r11, 0x40
movdqu xmm1, xmmword [rdx + rax]
movdqu xmm2, xmmword [rdx + rax + 0x10]
lea rax, [rax + 0x40]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x30]
movdqu xmmword [rbx + rax - 0x40], xmm1
pxor xmm2, xmm0
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm1, xmmword [rdx + rax - 0x20]
movdqu xmmword [rbx + rax - 0x30], xmm2
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x10]
movdqu xmm2, xmmword [rdx + rax - 0x10]
movdqu xmmword [rbx + rax - 0x20], xmm1
pxor xmm2, xmm0
movdqu xmmword [rbx + rax - 0x10], xmm2
cmp r11, rdi
jb 0x140064170
mov rdi, qword [rsp]
mov rbx, qword [rsp + 0x10]
cmp r11, r9
jae 0x140064204
sub r10, r8
lea rdx, [r11 + r8]
sub rcx, r8
sub r9, r11
nop word [rax + rax]
movzx eax, byte [rdx + r10]
xor al, byte [rdx]
mov byte [rdx + rcx], al
lea rdx, [rdx + 1]
sub r9, 1
jne 0x1400641f0
add rsp, 8
ret
Function at 0x1400a5a1c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400a5780
Function at 0x1400c0cc0
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1400c0cd3
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.1400cabc4
lea rdx, [0x140120fb8]
lea rcx, [rsp + 0x20]
call fcn.140096d78
int3

Function at 0x1400cb55c
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x140131568]
xor edx, edx
jmp fcn.1400c0cc0

Function at 0x1400cbef4
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x140131568]
jmp fcn.1400c0cc0

Function at 0x1400d7ab0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x1400d7b6c]
mov r9, qword [r9 + 8]
jmp fcn.1400c8d20

Function at 0x1400d7b44
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x1400d7b7c]
mov r9, qword [r9 + 8]
jmp fcn.1400c8d20
Function at 0x1400026d4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000271e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000271e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000271e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000271e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000271e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002720
xor al, al
add rsp, 0x28
ret
Function at 0x4161c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41636b
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.004329a0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
nop
jne 0x41622e
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x416241
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x416265
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x416279
cmp rbx, 0x1000
jae 0x416238
nop
jmp 0x4162e9
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x41628d
xor edx, edx
jmp 0x4162e0
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.004329a0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop
test dl, dl
jne 0x41626f
jmp 0x416255
call fcn.00461120
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00436f60
lea rax, [0x0050ba76]
mov ebx, 0x18
nop dword [rax + rax]
call fcn.00437860
mov rax, qword [rsp + 0x38]
call fcn.00437560
lea rax, [0x0050bb66]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00437860
mov rax, qword [rsp + 0x30]
call fcn.00437560
call fcn.004371c0
call fcn.00436fe0
lea rax, [0x0050ebf6]
mov ebx, 0x21
call fcn.004356a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045d580
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004161c0
Function at 0x4163a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4165ca
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00432a20
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x41641b
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x41642e
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x416450
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x416464
cmp rbx, 0x1000
jae 0x416425
jmp 0x4164ee
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x416476
xor esi, esi
jmp 0x4164e0
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.00432a20
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
test sil, sil
jne 0x41645a
jmp 0x416442
call fcn.00461120
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x416569
call fcn.00436f60
lea rax, [0x0050c15b]
mov ebx, 0x19
call fcn.00437860
mov rax, qword [rsp + 0x68]
call fcn.00437560
lea rax, [0x0050bb66]
mov ebx, 0x19
nop
call fcn.00437860
mov eax, dword [rsp + 0x34]
call fcn.00437560
call fcn.004371c0
call fcn.00436fe0
lea rax, [0x00507c8d]
mov ebx, 0xd
call fcn.004356a0
cmp eax, 0x5af
je 0x416513
call fcn.00436f60
lea rax, [0x0050c15b]
mov ebx, 0x19
call fcn.00437860
mov rax, qword [rsp + 0x38]
call fcn.00437560
lea rax, [0x0050bb66]
mov ebx, 0x19
nop dword [rax]
call fcn.00437860
mov eax, dword [rsp + 0x34]
call fcn.00437560
call fcn.004371c0
call fcn.00436fe0
lea rax, [0x0050e323]
mov ebx, 0x1f
call fcn.004356a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045d580
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004163a0