joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140051ee0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x140051f14
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x140051f00
ret

Function at 0x140057770
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x1400577d1
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140057790
mov ecx, dword [r9]
jmp 0x1400578b8
cmp ecx, 0x4e0
jb 0x1400578b8
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x1400577f0
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x140057840
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x14005ad70
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
movsx ecx, byte [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x14005ae3c
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x14005ae3c
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x14005ae55
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx + 0x10]
cmp rax, rcx
je 0x14005ae2c
cmp byte [rax], 0x5c
jne 0x14005ae26
lea rdx, [rax + 1]
cmp rdx, rcx
je 0x14005ae26
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x14005ae12
movzx ecx, byte [rdx]
sub cl, 0x28
cmp cl, 1
jbe 0x14005ae23
test r8b, 0x10
jne 0x14005ae26
movzx ecx, byte [rdx]
sub cl, 0x7b
test cl, 0xfd
jne 0x14005ae26
mov rax, rdx
inc rax
mov qword [rbx], rax
mov rcx, rbx
call fcn.140057910
test edi, edi
jne 0x14005ad90
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
call fcn.140057900
int3
Function at 0x140060b70
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140060bba
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140060bba
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140060bba
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140060bba
cmp dword [rcx + 0x84], 0xe
jbe 0x140060bba
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140060bbc
xor al, al
add rsp, 0x28
ret

Function at 0x140060df0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140060e74
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140064a10]
cmp byte [rcx + rax], 0
je 0x140060e74
dec r8
sub rdx, 1
jne 0x140060e5a
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x18000dc98
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.180007e80
sub rsp, rax
mov rax, qword [0x18003f020]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.18001a2ac
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x18000dce7
mov rax, rbp
jmp 0x18000ddef
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x180000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x6d3db0]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.18001a544
mov r13, rax
lea rax, [0x180000000]
mov rcx, qword [rax + rbx*8 + 0x6d3db0]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x18000ddeb
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18000ddeb
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.18001a544
test rax, rax
js 0x18000ddeb
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x18000ddeb
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x18000dddd
lea r8, [0x180000000]
cmp rcx, rdx
jae 0x18000dddd
cmp byte [rcx], 0xd
jne 0x18000ddc3
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x18000ddd2
cmp byte [rcx + 1], 0xa
jne 0x18000ddd2
inc rcx
jmp 0x18000ddd2
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x3f3c0]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x18000dda5
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x18000ddef
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.180007530
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18001c59c
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
movsxd rbp, ecx
mov r9, r8
mov rax, rbp
lea rcx, [0x1806d3db0]
and eax, 0x3f
mov r10, rbp
sar r10, 6
xor edi, edi
mov rsi, rdx
mov r14, rbp
lea r8, [rax + rax*8]
mov rax, qword [rcx + r10*8]
mov ecx, 4
mov qword [rsp + 0x78], rcx
mov r11, qword [rax + r8*8 + 0x28]
lea r12d, [rcx + 6]
test r9, r9
je 0x18001c5fa
cmp word [rdx], r12w
jne 0x18001c5fa
or byte [rax + r8*8 + 0x38], cl
jmp 0x18001c600
and byte [rax + r8*8 + 0x38], 0xfb
lea rdx, [rdx + r9*2]
mov rcx, rsi
mov rbx, rsi
cmp rsi, rdx
jae 0x18001c75b
mov r9d, 0x1a
lea r13d, [r9 - 0xd]
movzx eax, word [rcx]
cmp ax, r9w
je 0x18001c736
lea r9, [rcx + 2]
cmp ax, r13w
je 0x18001c639
mov rcx, r9
jmp 0x18001c65c
cmp r9, rdx
jae 0x18001c673
cmp word [r9], r12w
mov eax, 2
cmove rax, qword [rsp + 0x78]
add rcx, rax
mov eax, r12d
cmp word [r9], r12w
cmovne ax, r13w
mov word [rbx], ax
mov r9d, 0x1a
add rbx, 2
cmp rcx, rdx
jb 0x18001c61d
jmp 0x18001c75b
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rdi
mov r8d, 2
lea rdx, [rsp + 0x70]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18001c730
cmp dword [rsp + 0x80], edi
je 0x18001c730
mov rdx, r14
lea r11, [0x1806d3db0]
sar rdx, 6
and r14d, 0x3f
mov rax, qword [r11 + rdx*8]
lea r8, [r14 + r14*8]
test byte [rax + r8*8 + 0x38], 0x48
je 0x18001c709
movzx eax, word [rsp + 0x70]
cmp ax, r12w
jne 0x18001c6dc
mov word [rbx], r12w
jmp 0x18001c757
mov word [rbx], r13w
mov word [rsp + 0x78], ax
mov rax, qword [r11 + rdx*8]
lea rcx, [rax + r8*8]
mov al, byte [rsp + rdi + 0x78]
mov byte [rcx + rdi + 0x3a], al
inc rdi
cmp rdi, 2
jl 0x18001c6e5
mov rax, qword [r11 + rdx*8]
mov byte [rax + r8*8 + 0x3c], r12b
jmp 0x18001c757
cmp word [rsp + 0x70], r12w
jne 0x18001c716
cmp rbx, rsi
je 0x18001c6d6
mov rdx, 0xfffffffffffffffe
mov ecx, ebp
lea r8d, [rdx + 3]
call fcn.18001a54c
cmp word [rsp + 0x70], r12w
je 0x18001c75b
mov word [rbx], r13w
jmp 0x18001c757
lea r11, [0x1806d3db0]
mov rcx, qword [r11 + r10*8]
mov al, byte [rcx + r8*8 + 0x38]
test al, 0x40
jne 0x18001c753
or al, 2
mov byte [rcx + r8*8 + 0x38], al
jmp 0x18001c75b
mov word [rbx], r9w
add rbx, 2
sub rbx, rsi
sar rbx, 1
lea eax, [rbx + rbx]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18001f800
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x18001f522
call fcn.180015eac
mov dword [rax], 0x16
call fcn.180012da8
jmp 0x18001f672
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x18001f672
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x18001f672
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x18001f551
lock or dword [rcx + 0x14], 0x10
jmp 0x18001f672
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x18001f565
call fcn.18001fd74
mov ebp, dword [rbx + 0x10]
cmp ebp, 1
jne 0x18001f575
mov rax, qword [rbx]
mov r14b, byte [rax]
jmp 0x18001f578
xor r14b, r14b
mov rsi, qword [rbx + 8]
mov rcx, rbx
mov edi, dword [rbx + 0x20]
mov qword [rbx], rsi
call fcn.18001a2ac
mov r8d, edi
mov rdx, rsi
mov ecx, eax
call fcn.18001ca48
mov dword [rbx + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x18001f660
mov eax, dword [rbx + 0x14]
test al, 6
jne 0x18001f60b
mov rcx, rbx
call fcn.18001a2ac
cmp eax, 0xffffffff
je 0x18001f5f6
mov rcx, rbx
call fcn.18001a2ac
cmp eax, 0xfffffffe
je 0x18001f5f6
mov rcx, rbx
call fcn.18001a2ac
movsxd rdi, eax
lea rsi, [0x1806d3db0]
mov rcx, rbx
sar rdi, 6
call fcn.18001a2ac
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [rsi + rdi*8]
lea rdx, [rax + rcx*8]
jmp 0x18001f5fd
lea rdx, [0x18003f4c0]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x18001f60b
lock or dword [rbx + 0x14], 0x20
cmp dword [rbx + 0x20], 0x200
jne 0x18001f62f
mov eax, dword [rbx + 0x14]
shr eax, 6
test al, 1
je 0x18001f62f
mov eax, dword [rbx + 0x14]
shr eax, 8
test al, 1
jne 0x18001f62f
mov dword [rbx + 0x20], 0x1000
mov rdx, qword [rbx]
cmp ebp, 1
jne 0x18001f64d
movzx ecx, byte [rdx]
dec dword [rbx + 0x10]
shl cx, 8
movzx eax, r14b
or cx, ax
inc rdx
jmp 0x18001f658
movzx ecx, word [rdx]
add dword [rbx + 0x10], 0xfffffffe
add rdx, 2
mov qword [rbx], rdx
movzx eax, cx
jmp 0x18001f677
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rbx + 0x14], eax
and dword [rbx + 0x10], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
jmp 0x18001f4ec
Function at 0x140390305
Capabilities:
Encode data using xor

Disassembly:
pushfq
add qword [rsp + 0x18], 0xffffffffbf7d4c7c
mov qword [rsp + 0x18], 0x52d85db5
push r12
movabs r12, 0x26de223a33e81d8b
push rcx
not r12b
movabs rcx, 0x438f5460677b3cb1
mov rcx, qword [rsp]
add qword [rsp + 0x20], 0xffffffffbfb30042
movsx r12, r12w
xor r12w, r12w
movsx r12w, r12w
xor r12w, 0x3739
and r12, 0x5af54eb1
setl r12b
xor r12w, 0xe9d
mov r12, qword [rsp + 8]
jle 0x140390332
jns 0x140480c03
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x28]
call fcn.14092d19a
call fcn.14081e696
invalid
Function at 0x140012fe0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xor eax, eax
mov r10, rdx
test ecx, ecx
jle 0x14001304d
mov qword [rsp], rbx
lea rbx, [0x14015c7c0]
mov r11d, ecx
nop dword [rax + rax]
movzx r8d, word [r10]
lea r10, [r10 + 2]
lea ecx, [r8 - 0x61]
cmp ecx, 0x1a
sbb cx, cx
and cx, 0x20
sub r8w, cx
mov ecx, eax
shr eax, 8
movzx r9d, r8w
xor rcx, r9
shr r9, 8
movzx edx, cl
mov ecx, dword [rbx + rdx*4]
xor ecx, eax
mov eax, ecx
shr ecx, 8
xor r9, rax
movzx eax, r9b
mov eax, dword [rbx + rax*4]
xor eax, ecx
sub r11, 1
jne 0x140013000
mov rbx, qword [rsp]
add rsp, 8
ret
Function at 0x14001b3c0
Capabilities:
Accept command line arguments

Disassembly:
push rdi
push r13
sub rsp, 0x68
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r15
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
lea rcx, [0x14011c560]
mov rbx, rax
call fcn.140092500
xor r13d, r13d
xor r14d, r14d
mov r15d, 1
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x40], r14
cmp dword [rsp + 0x20], r15d
jle 0x14001b56b
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x60], r12
lea r12, [rbx + 8]
nop word [rax + rax]
mov rbp, qword [r12]
xor esi, esi
xor edi, edi
mov qword [rsp + 0x28], rsi
xor eax, eax
mov qword [rsp + 0x30], rdi
test rbp, rbp
je 0x14001b4d8
cmp word [rbp], ax
je 0x14001b4d8
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rbp + rbx*2], ax
jne 0x14001b466
inc ebx
test ebx, ebx
jle 0x14001b48f
mov edx, ebx
lea rcx, [rsp + 0x28]
call fcn.1400195a0
mov eax, dword [rsp + 0x34]
mov edi, dword [rsp + 0x30]
mov rsi, qword [rsp + 0x28]
mov edx, edi
add edi, ebx
mov dword [rsp + 0x30], edi
cmp edi, eax
jle 0x14001b4ae
lea rcx, [rsp + 0x28]
call fcn.140019200
mov edi, dword [rsp + 0x30]
mov rsi, qword [rsp + 0x28]
movsxd r8, ebx
mov rdx, rbp
add r8, r8
mov rcx, rsi
call fcn.140032f60
test edi, edi
je 0x14001b4d8
lea eax, [rdi - 1]
test eax, eax
jle 0x14001b4d8
cmp word [rsi], 0x2f
jne 0x14001b4d8
mov eax, 0x2d
mov word [rsi], ax
movsxd rbx, r14d
lea r14d, [rbx + 1]
mov dword [rsp + 0x40], r14d
cmp r14d, dword [rsp + 0x44]
jle 0x14001b501
mov edx, ebx
lea rcx, [rsp + 0x38]
call fcn.140019100
mov r14d, dword [rsp + 0x40]
mov r13, qword [rsp + 0x38]
shl rbx, 4
xor eax, eax
add rbx, r13
mov qword [rbx], rax
mov dword [rbx + 8], edi
test edi, edi
jne 0x14001b519
mov dword [rbx + 0xc], eax
jmp 0x14001b537
xor r8d, r8d
mov edx, edi
mov rcx, rbx
call fcn.140018ed0
mov rcx, qword [rbx]
mov rdx, rsi
movsxd r8, edi
add r8, r8
call sub.VCRUNTIME140.dll_memcpy
test rsi, rsi
je 0x14001b544
mov rcx, rsi
call fcn.1400443e0
inc r15d
add r12, 8
cmp r15d, dword [rsp + 0x20]
jl 0x14001b440
mov r12, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x88]
lea rcx, [rsp + 0x38]
call fcn.140015f70
mov r15, qword [rsp + 0x50]
mov edi, eax
mov rbx, r13
test r14d, r14d
je 0x14001b59b
mov rcx, qword [rbx]
test rcx, rcx
je 0x14001b591
call fcn.1400443e0
add rbx, 0x10
sub r14d, 1
jne 0x14001b584
mov r14, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x80]
test r13, r13
je 0x14001b5b5
mov rcx, r13
call fcn.1400443e0
mov eax, edi
add rsp, 0x68
pop r13
pop rdi
ret
Function at 0x14001bfe0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, qword [rcx]
test rsi, rsi
je 0x14001c0da
mov eax, 0xffffffff
lock xadd dword [rsi + 0x48], eax
cmp eax, 1
jne 0x14001c0da
mov rcx, qword [rsi + 0x38]
mov qword [rsp + 0x38], rbx
test rcx, rcx
mov qword [rsp + 0x40], rbp
lea rbx, [rsi + 0x18]
mov qword [rsp + 0x48], rdi
cmovne rbx, rcx
mov edi, dword [rsi + 0x40]
test edi, edi
je 0x14001c045
nop word [rax + rax]
mov rcx, rbx
call fcn.14001bfe0
add rbx, 8
sub edi, 1
jne 0x14001c030
mov rcx, qword [rsi + 0x38]
mov rbp, qword [rsp + 0x40]
test rcx, rcx
je 0x14001c054
call fcn.1400443e0
mov ecx, dword [0x140167f08]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor edi, edi
mov rbx, rax
test rax, rax
jne 0x14001c098
lea ecx, [rax + 0x18]
call fcn.1400134a0
mov rbx, rax
test rax, rax
je 0x14001c086
mov qword [rax], rdi
mov qword [rax + 8], rdi
mov dword [rax + 0x10], edi
jmp 0x14001c089
mov rbx, rdi
mov ecx, dword [0x140167f08]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp dword [rbx + 0x10], 0x20
jl 0x14001c0c2
mov rdx, qword [rbx]
test rdx, rdx
je 0x14001c0b2
lea rcx, [0x140167f10]
call fcn.14001f020
mov rax, qword [rbx + 8]
mov qword [rbx], rax
mov qword [rbx + 8], rdi
mov dword [rbx + 0x10], edi
jmp 0x14001c0c6
mov rdi, qword [rbx + 8]
mov qword [rsi], rdi
inc dword [rbx + 0x10]
mov rdi, qword [rsp + 0x48]
mov qword [rbx + 8], rsi
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret

Function at 0x14001cb80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
lea rcx, [0x140167fd0]
jmp fcn.14001e7e0

Function at 0x14001d860
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edi, ecx
mov ecx, dword [0x140167fd0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14001d8b1
lea ecx, [rax + 0xc]
call fcn.1400134a0
mov rbx, rax
test rax, rax
je 0x14001d89f
mov qword [rax], rsi
mov dword [rax + 8], esi
jmp 0x14001d8a2
mov rbx, rsi
mov ecx, dword [0x140167fd0]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp dword [rbx + 8], 0x40
jl 0x14001d8d2
mov edx, dword [rbx]
test edx, edx
je 0x14001d8c9
lea rcx, [0x140167fd8]
call fcn.14001ef40
mov eax, dword [rbx + 4]
mov dword [rbx], eax
mov qword [rbx + 4], rsi
test edi, edi
jne 0x14001d8db
mov rcx, rsi
jmp 0x14001d8fe
mov rcx, rdi
lea rdx, [0x1401680e8]
mov rax, rdi
shr rax, 0xe
and ecx, 0x3fff
mov rax, qword [rdx + rax*8]
lea rcx, [rcx + rcx*2]
lea rcx, [rax + rcx*8]
and qword [rcx], 0xfffffffffc000000
mov dword [rcx + 0x10], esi
mov eax, dword [rbx + 4]
mov rsi, qword [rsp + 0x38]
mov qword [rcx + 8], rax
inc dword [rbx + 8]
mov dword [rbx + 4], edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14001db70
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
movss xmm0, dword [0x14011ed40]
jmp fcn.1400cb670
Function at 0x14001f080
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov r14, rcx
mov rcx, qword [rcx + 0x38]
test rcx, rcx
mov edi, dword [r14 + 0x40]
lea rbx, [r14 + 0x18]
cmovne rbx, rcx
test edi, edi
je 0x14001f0c5
nop
mov rcx, rbx
call fcn.14001bfe0
add rbx, 8
sub edi, 1
jne 0x14001f0b0
mov rcx, qword [r14 + 0x38]
test rcx, rcx
je 0x14001f0cf
call fcn.1400443e0
mov ecx, dword [0x140167f08]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor edi, edi
mov rbx, rax
test rax, rax
jne 0x14001f113
lea ecx, [rax + 0x18]
call fcn.1400134a0
mov rbx, rax
test rax, rax
je 0x14001f101
mov qword [rax], rdi
mov qword [rax + 8], rdi
mov dword [rax + 0x10], edi
jmp 0x14001f104
mov rbx, rdi
mov ecx, dword [0x140167f08]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp dword [rbx + 0x10], 0x20
jl 0x14001f13d
mov rdx, qword [rbx]
test rdx, rdx
je 0x14001f12d
lea rcx, [0x140167f10]
call fcn.14001f020
mov rax, qword [rbx + 8]
mov qword [rbx], rax
mov qword [rbx + 8], rdi
mov dword [rbx + 0x10], edi
jmp 0x14001f141
mov rdi, qword [rbx + 8]
mov rsi, qword [rsp + 0x38]
mov qword [r14], rdi
inc dword [rbx + 0x10]
mov rdi, qword [rsp + 0x40]
mov qword [rbx + 8], r14
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r14
ret
Function at 0x140022960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rdi
push r12
sub rsp, 0x50
movsxd rdi, dword [rcx + 8]
mov rbx, rdx
mov r12, rcx
test edi, edi
jne 0x140022986
xor eax, eax
add rsp, 0x50
pop r12
pop rdi
pop rbx
ret
mov rcx, qword [rcx]
xor eax, eax
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], r13
xor r13d, r13d
mov qword [rsp + 0x30], r14
xor r14d, r14d
mov qword [rsp + 0x28], r15
cmp dword [rcx + 8], eax
je 0x1400229c5
mov rcx, qword [rcx]
test rcx, rcx
je 0x1400229c5
mov rax, qword [rcx]
lea rdx, [rsp + 0x70]
call qword [rax + 0x38]
mov rax, qword [rax]
cmp rax, qword [rbx]
mov r15, rdi
setne al
xor esi, esi
mov byte [rsp + 0x70], al
nop dword [rax]
nop dword [rax + rax]
movsxd rbp, r14d
inc rsi
inc r14d
cmp rsi, r15
jge 0x140022a4b
mov rdx, qword [rsp + 0x78]
mov rbx, rsi
shl rbx, 4
movzx edi, al
nop dword [rax]
mov rcx, qword [r12]
xor eax, eax
cmp dword [rcx + rbx + 8], eax
je 0x140022a2b
mov rcx, qword [rcx + rbx]
test rcx, rcx
je 0x140022a2b
mov rax, qword [rcx]
lea rdx, [rsp + 0x88]
call qword [rax + 0x38]
mov rdx, qword [rsp + 0x78]
mov rax, qword [rax]
xor ecx, ecx
cmp rax, qword [rdx]
setne cl
cmp edi, ecx
jne 0x140022a46
inc r14d
inc rsi
add rbx, 0x10
cmp rsi, r15
jl 0x140022a00
movzx eax, byte [rsp + 0x70]
mov edi, r14d
sub edi, ebp
test al, al
je 0x140022a85
cmp r13d, ebp
je 0x140022a80
mov rdx, rbp
movsxd rcx, r13d
shl rdx, 4
add rdx, qword [r12]
shl rcx, 4
add rcx, qword [r12]
movsxd r8, edi
shl r8, 4
call fcn.14011194e
movzx eax, byte [rsp + 0x70]
add r13d, edi
jmp 0x140022afc
mov rbx, rbp
shl rbx, 4
add rbx, qword [r12]
test edi, edi
je 0x140022afc
mov eax, dword [rbx + 8]
test eax, eax
je 0x140022aa3
mov rcx, qword [rbx]
mov r8, rcx
jmp 0x140022aa8
mov r8, qword [rbx]
xor ecx, ecx
test rcx, rcx
je 0x140022ab2
mov rax, qword [rcx]
jmp 0x140022ac1
test eax, eax
je 0x140022ae1
test r8, r8
je 0x140022ae1
mov rax, qword [r8]
mov rcx, r8
xor edx, edx
call qword [rax]
mov rcx, qword [rbx]
test rcx, rcx
je 0x140022ada
xor r8d, r8d
xor edx, edx
call fcn.140047270
mov qword [rbx], rax
mov dword [rbx + 8], 0
mov rcx, qword [rbx]
test rcx, rcx
je 0x140022aee
call fcn.1400443e0
add rbx, 0x10
sub edi, 1
jne 0x140022a94
movzx eax, byte [rsp + 0x70]
xor al, 1
mov byte [rsp + 0x70], al
cmp rsi, r15
jl 0x1400229e0
mov r14, qword [rsp + 0x30]
mov eax, r15d
mov r15, qword [rsp + 0x28]
sub eax, r13d
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov dword [r12 + 8], r13d
mov r13, qword [rsp + 0x38]
add rsp, 0x50
pop r12
pop rdi
pop rbx
ret