joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400105f7
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xffffffffffffffff
lea rax, [0x14001041a]
mov rdx, rax
lea rax, [0x1400341f0]
mov rcx, rax
call fcn.14000fa12
mov eax, dword [0x140027130]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
je 0x14001064a
mov rax, qword [rbp - 0x10]
jmp 0x1400107aa
call fcn.14000f175
mov qword [rbp - 0x10], rax
mov rax, qword [0x140037048]
test rax, rax
je 0x140010666
cmp qword [rbp - 0x10], 0
jne 0x140010670
mov eax, 0
jmp 0x1400107aa
mov rax, qword [rbp - 0x10]
mov dword [rax + 0x44], 1
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call rax
mov rdx, qword [rbp - 0x10]
mov dword [rdx + 0x70], eax
mov r9d, 0
mov r8d, 0
mov edx, 1
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateEventA]
call rax
mov rdx, qword [rbp - 0x10]
mov qword [rdx + 0x30], rax
mov rax, qword [rbp - 0x10]
mov qword [rax + 0x38], 0xffffffffffffffff
mov rax, qword [rbp - 0x10]
lea rcx, [rax + 0x68]
mov rax, qword [rbp - 8]
mov rdx, rax
call fcn.14000f299
mov rax, qword [rbp - 0x10]
mov dword [rax + 0xb8], 0
mov rax, qword [rbp - 0x10]
mov qword [rax + 0x28], 0
mov rax, qword [rbp - 0x10]
lea rdi, [rax + 0x28]
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov rsi, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call rax
mov rbx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, rdi
mov r8, rsi
mov rdx, rbx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DuplicateHandle]
call rax
test eax, eax
jne 0x14001074b
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x28]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetThreadPriority]
call rax
mov rdx, qword [rbp - 0x10]
mov dword [rdx + 0xc0], eax
mov rax, qword [rbp - 0x10]
mov dword [rax + 0xbc], 0
mov rax, qword [rbp - 0x10]
movzx edx, byte [rax + 0x40]
and edx, 0xffffffcf
or edx, 0x10
mov byte [rax + 0x40], dl
mov eax, dword [0x140027130]
mov rdx, qword [rbp - 0x10]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
test eax, eax
jne 0x1400107a6
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov rax, qword [rbp - 0x10]
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x1400108a7
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp - 0x10], 0
mov rax, qword [rbp + 0x10]
mov dword [rbp - 4], eax
call fcn.1400105f7
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
mov rdx, qword [rbp + 0x10]
mov qword [rax + 8], rdx
mov rax, qword [rbp - 0x18]
mov rax, qword [rax + 0x1d8]
mov rcx, rax
call fcn.140010448
mov rax, qword [rbp - 0x18]
movzx eax, byte [rax + 0x40]
and eax, 0x30
test al, al
jne 0x140010914
mov rax, qword [rbp - 0x18]
add rax, 0xd0
mov edx, 1
mov rcx, rax
mov rax, qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_longjmp]
call rax
mov eax, dword [0x140027130]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
je 0x140010a58
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x28]
test rax, rax
jne 0x1400109b1
mov rax, qword [rbp - 0x10]
mov dword [rax], 0xdeadbeef
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x30]
test rax, rax
je 0x14001096c
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x10]
mov qword [rax + 0x30], 0
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 8]
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call fcn.14000f04e
mov qword [rbp - 0x10], 0
mov eax, dword [0x140027130]
mov rdx, qword [rbp - 0x10]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
jmp 0x140010a58
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 8]
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov dword [rax + 0xbc], 1
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x30]
test rax, rax
je 0x1400109eb
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x10]
mov qword [rax + 0x30], 0
mov rax, qword [rbp - 0x10]
mov eax, dword [rax + 0x44]
and eax, 4
test eax, eax
je 0x140010a58
mov rax, qword [rbp - 0x10]
mov dword [rax], 0xdeadbeef
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x28]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x10]
mov qword [rax + 0x28], 0
mov rax, qword [rbp - 0x10]
mov rcx, rax
call fcn.14000f04e
mov qword [rbp - 0x10], 0
mov eax, dword [0x140027130]
mov rdx, qword [rbp - 0x10]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
mov eax, dword [rbp - 4]
mov ecx, eax
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__endthreadex]
call rax
nop
Function at 0x140012690
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov dword [rbp + 0x18], edx
lea rax, [0x140027150]
mov rcx, rax
call fcn.14001390c
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov eax, dword [rax]
cmp eax, 0xbab1f0ed
jne 0x1400126cc
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov eax, dword [rax + 4]
test eax, eax
jg 0x14001270c
mov ecx, 2
mov rax, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
call rax
mov rcx, rax
mov dword [rsp + 0x20], 0x28
lea r9, str..._.._.._mingw_w64_libraries_winpthreads_src_rwlock.c
lea r8, str.___rwlock_t__rwl___valid__LIFE_RWLOCK______rwlock_t__rwl___busy___0_
lea rax, str.Assertion_failed:___s___file__s__line__d_n
mov rdx, rax
call fcn.14000dc00
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov edx, dword [rax + 4]
sub edx, 1
mov dword [rax + 4], edx
lea rax, [0x140027150]
mov rcx, rax
call fcn.14001398b
mov eax, dword [rbp + 0x18]
add rsp, 0x30
pop rbp
ret

Function at 0x140019d60
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
call rcx
nop
jmp 0x1400262e0
Function at 0x140021780
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov dword [rbp - 0x14], 0x80000000
mov dword [rbp - 0x18], 0x7fffffff
mov qword [rbp - 8], 0
jmp 0x140021812
mov rax, qword [rbp + 0x10]
mov rdx, qword [rbp - 8]
mov eax, dword [rax + rdx*4]
and eax, 0x80000000
mov ecx, eax
mov rax, qword [rbp - 8]
lea rdx, [rax + 1]
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + rdx*4]
and eax, 0x7fffffff
or eax, ecx
mov dword [rbp - 0x24], eax
mov rax, qword [rbp - 8]
lea rdx, [rax + 0x18d]
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + rdx*4]
mov edx, dword [rbp - 0x24]
shr edx, 1
xor edx, eax
mov eax, dword [rbp - 0x24]
and eax, 1
test eax, eax
je 0x1400217f9
mov eax, 0x9908b0df
jmp 0x1400217fe
mov eax, 0
xor eax, edx
mov ecx, eax
mov rax, qword [rbp + 0x10]
mov rdx, qword [rbp - 8]
mov dword [rax + rdx*4], ecx
add qword [rbp - 8], 1
cmp qword [rbp - 8], 0xe2
jbe 0x1400217a4
mov qword [rbp - 0x10], 0xe3
jmp 0x140021894
mov rax, qword [rbp + 0x10]
mov rdx, qword [rbp - 0x10]
mov eax, dword [rax + rdx*4]
and eax, 0x80000000
mov ecx, eax
mov rax, qword [rbp - 0x10]
lea rdx, [rax + 1]
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + rdx*4]
and eax, 0x7fffffff
or eax, ecx
mov dword [rbp - 0x20], eax
mov rax, qword [rbp - 0x10]
lea rdx, [rax - 0xe3]
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + rdx*4]
mov edx, dword [rbp - 0x20]
shr edx, 1
xor edx, eax
mov eax, dword [rbp - 0x20]
and eax, 1
test eax, eax
je 0x14002187b
mov eax, 0x9908b0df
jmp 0x140021880
mov eax, 0
xor eax, edx
mov ecx, eax
mov rax, qword [rbp + 0x10]
mov rdx, qword [rbp - 0x10]
mov dword [rax + rdx*4], ecx
add qword [rbp - 0x10], 1
cmp qword [rbp - 0x10], 0x26e
jbe 0x140021826
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x9bc]
and eax, 0x80000000
mov edx, eax
mov rax, qword [rbp + 0x10]
mov eax, dword [rax]
and eax, 0x7fffffff
or eax, edx
mov dword [rbp - 0x1c], eax
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x630]
mov edx, dword [rbp - 0x1c]
shr edx, 1
xor edx, eax
mov eax, dword [rbp - 0x1c]
and eax, 1
test eax, eax
je 0x1400218e1
mov eax, 0x9908b0df
jmp 0x1400218e6
mov eax, 0
xor edx, eax
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x9bc], edx
mov rax, qword [rbp + 0x10]
mov qword [rax + 0x9c0], 0
nop
add rsp, 0x30
pop rbp
ret
Function at 0x140021910
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov dword [rbp + 0x18], edx
mov eax, dword [rbp + 0x18]
mov ecx, eax
call fcn.1400255e0
mov rdx, qword [rbp + 0x10]
mov dword [rdx], eax
mov qword [rbp - 8], 1
jmp 0x140021988
mov rax, qword [rbp - 8]
lea rdx, [rax - 1]
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + rdx*4]
mov dword [rbp - 0xc], eax
mov eax, dword [rbp - 0xc]
shr eax, 0x1e
xor dword [rbp - 0xc], eax
mov eax, dword [rbp - 0xc]
imul eax, eax, 0x6c078965
mov dword [rbp - 0xc], eax
mov rax, qword [rbp - 8]
mov ecx, eax
call fcn.140025610
add dword [rbp - 0xc], eax
mov eax, dword [rbp - 0xc]
mov ecx, eax
call fcn.1400255e0
mov rdx, qword [rbp + 0x10]
mov rcx, qword [rbp - 8]
mov dword [rdx + rcx*4], eax
add qword [rbp - 8], 1
cmp qword [rbp - 8], 0x26f
jbe 0x140021939
mov rax, qword [rbp + 0x10]
mov qword [rax + 0x9c0], 0x270
nop
add rsp, 0x30
pop rbp
ret

Function at 0x140021a10
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0x9c0]
cmp rax, 0x26f
jbe 0x140021a3b
mov rax, qword [rbp + 0x10]
mov rcx, rax
call fcn.140021780
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0x9c0]
lea rcx, [rax + 1]
mov rdx, qword [rbp + 0x10]
mov qword [rdx + 0x9c0], rcx
mov rdx, qword [rbp + 0x10]
mov eax, dword [rdx + rax*4]
mov dword [rbp - 4], eax
mov eax, dword [rbp - 4]
shr eax, 0xb
xor dword [rbp - 4], eax
mov eax, dword [rbp - 4]
shl eax, 7
and eax, 0x9d2c5680
xor dword [rbp - 4], eax
mov eax, dword [rbp - 4]
shl eax, 0xf
and eax, 0xefc60000
xor dword [rbp - 4], eax
mov eax, dword [rbp - 4]
shr eax, 0x12
xor dword [rbp - 4], eax
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret
Function at 0x1400262e0
Capabilities:
Write file on windows

Disassembly:
call fcn.140025e30
call fcn.140026080
mov rbx, qword [rax]
test byte [rbx + 0x50], 1
je 0x1400262a7
mov rbx, qword [rbx]
lea r12, [rsp + 0x20]
mov rdx, rbp
xor ecx, ecx
mov r8, r12
call fcn.140019950
mov rdx, qword [rbx - 0x90]
mov r9, rsi
mov r8, rbx
mov rcx, r12
call fcn.140019a40
test al, al
jne 0x1400262c5
lea rbx, [0x14002ae10]
mov r9, rsi
xor r8d, r8d
mov rcx, r12
mov rdx, rbx
call fcn.140019a40
test al, al
je 0x1400262ca
mov ecx, 8
call fcn.140025dc0
lea r8, [0x140020d80]
mov rdx, rbx
mov rcx, rax
mov rax, qword [0x14002aa40]
add rax, 0x10
mov qword [rcx], rax
call fcn.140026140
add rbx, 0x90
jmp 0x140026236
call fcn.1400260f0
mov rcx, rdi
call fcn.140019d60
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov rcx, rax
call fcn.140025e30
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov rcx, rax
mov rax, rdx
sub rax, 1
jne 0x14002637c
call fcn.140025e30
mov rcx, rax
mov rax, qword [rax]
call qword [rax + 0x10]
mov ecx, 2
mov rbx, rax
call rsi
mov r9, rax
mov r8d, 0xb
mov edx, 1
lea rcx, str.__what__:
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov ecx, 2
call rsi
mov rdx, rax
mov rcx, rbx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputs
mov ecx, 2
call rsi
mov rdx, rax
mov ecx, 0xa
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
call fcn.140025f60
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov rcx, rdi
call fcn.14000e030
call fcn.1400260f0
call fcn.140025e30
call fcn.140025f60
jmp 0x14002636a
Function at 0x140026300
Capabilities:
Write file on windows

Disassembly:
call fcn.140025e30
call fcn.140026080
mov rbx, qword [rax]
test byte [rbx + 0x50], 1
je 0x1400262a7
mov rbx, qword [rbx]
lea r12, [rsp + 0x20]
mov rdx, rbp
xor ecx, ecx
mov r8, r12
call fcn.140019950
mov rdx, qword [rbx - 0x90]
mov r9, rsi
mov r8, rbx
mov rcx, r12
call fcn.140019a40
test al, al
jne 0x1400262c5
lea rbx, [0x14002ae10]
mov r9, rsi
xor r8d, r8d
mov rcx, r12
mov rdx, rbx
call fcn.140019a40
test al, al
je 0x1400262ca
mov ecx, 8
call fcn.140025dc0
lea r8, [0x140020d80]
mov rdx, rbx
mov rcx, rax
mov rax, qword [0x14002aa40]
add rax, 0x10
mov qword [rcx], rax
call fcn.140026140
add rbx, 0x90
jmp 0x140026236
call fcn.1400260f0
mov rcx, rdi
call fcn.140019d60
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov rcx, rax
call fcn.140025e30
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov rcx, rax
mov rax, rdx
sub rax, 1
jne 0x14002637c
call fcn.140025e30
mov rcx, rax
mov rax, qword [rax]
call qword [rax + 0x10]
mov ecx, 2
mov rbx, rax
call rsi
mov r9, rax
mov r8d, 0xb
mov edx, 1
lea rcx, str.__what__:
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov ecx, 2
call rsi
mov rdx, rax
mov rcx, rbx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputs
mov ecx, 2
call rsi
mov rdx, rax
mov ecx, 0xa
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
call fcn.140025f60
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov rcx, rdi
call fcn.14000e030
call fcn.1400260f0
call fcn.140025e30
call fcn.140025f60
jmp 0x14002636a
Function at 0x180683160
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1806832e7
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x180683191
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180683177
add dl, dl
jne 0x18068319e
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1806831fe
xor eax, eax
add dl, dl
jne 0x1806831ad
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1806832b5
add dl, dl
jne 0x1806831be
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1806831cb
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1806831d8
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1806831e5
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1806831f2
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x180683186
mov eax, 1
add dl, dl
jne 0x18068320e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18068321b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180683203
sub eax, ebx
mov ebx, 1
jne 0x180683254
mov ecx, 1
add dl, dl
jne 0x180683236
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180683243
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18068322b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180683186
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x180683270
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x18068327d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180683265
cmp eax, 0x7d00
jae 0x1806832a3
cmp eax, 0x500
jb 0x18068329e
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180683186
cmp eax, 0x7f
ja 0x1806832a6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180683186
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1806832da
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x180683186
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400012d0
Capabilities:
Allocate or change rwx memory
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rdx, rcx
xor ecx, ecx
mov r9d, 0x40
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rcx, rax
test rax, rax
je 0x140001381
xor edx, edx
test rbx, rbx
je 0x140001381
cmp rbx, 0x40
jb 0x14000136a
movdqa xmm2, xmmword [0x1400cc4d0]
mov r8, rbx
and r8, 0xffffffffffffffc0
add rax, 0x20
movdqu xmm0, xmmword [rax - 0x20]
lea rax, [rax + 0x40]
add rdx, 0x40
movdqa xmm1, xmm2
xorps xmm0, xmm2
movdqu xmmword [rax - 0x60], xmm0
movdqu xmm0, xmmword [rax - 0x50]
xorps xmm1, xmm0
movdqu xmmword [rax - 0x50], xmm1
movdqu xmm0, xmmword [rax - 0x40]
xorps xmm0, xmm2
movdqu xmmword [rax - 0x40], xmm0
movdqu xmm0, xmmword [rax - 0x30]
xorps xmm0, xmm2
movdqu xmmword [rax - 0x30], xmm0
cmp rdx, r8
jb 0x140001320
cmp rdx, rbx
jae 0x14000137e
lea rax, [rdx + rcx]
sub rbx, rdx
xor byte [rax], 0xcd
lea rax, [rax + 1]
sub rbx, 1
jne 0x140001371
mov rax, rcx
add rsp, 0x20
pop rbx
ret

Function at 0x140001390
Capabilities:
Block operations on executable memory pages using arbitrary code guard

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor edi, edi
mov dword [rsp + 0x20], edi
mov dword [rsp + 0x24], 1
lea r8d, [rdi + 4]
lea rdx, [rsp + 0x24]
lea ecx, [rdi + 8]
call qword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], rdi
mov edx, 0xf
mov qword [rsp + 0x40], rdx
mov byte [rsp + 0x28], dil
mov dword [rsp + 0x20], 1
lea rbx, str.SensitiveDataToHide
movzx ecx, byte [str.SensitiveDataToHide]
nop dword [rax]
xor cl, 0xaa
cmp rdi, rdx
jae 0x14000142a
lea rax, [rdi + 1]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x28]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x28]
mov byte [rax + rdi], cl
mov byte [rax + rdi + 1], 0
jmp 0x140001438
movzx r9d, cl
lea rcx, [rsp + 0x28]
call fcn.1400ca080
inc rbx
movzx ecx, byte [rbx]
test cl, cl
je 0x14000144e
mov rdx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x38]
jmp 0x140001400
lea rdx, [rsp + 0x28]
cmp qword [rsp + 0x40], 0xf
cmova rdx, qword [rsp + 0x28]
lea rcx, str.Hidden_string_in_ObscureDll_function:__s_n
call fcn.140001010
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x1400014ac
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400014a7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400014a7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ca24c
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400ca1f0
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x1400c9ec0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea rdx, str.MainFunctionDataToHide
xor edi, edi
lea rcx, [rsp + 0x38]
call fcn.140001230
cmp qword [rsp + 0x50], 0xf
lea rdx, [rsp + 0x38]
lea rcx, str.Hidden_string_in_main_function:__s_n
cmova rdx, qword [rsp + 0x38]
call fcn.140001010
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_clock]
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_clock]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x1400c9eb0]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test rax, rax
jne 0x1400c9f56
lea rcx, str.Failed_to_create_thread__n
call fcn.140001010
lea edi, [rbx + 1]
jmp 0x1400c9fa8
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, edi
nop
test bl, 1
je 0x1400c9f83
mov edx, ebx
lea rcx, str.Counting:__d_n
call fcn.140001010
inc ebx
cmp ebx, 0x5dc
jl 0x1400c9f70
mov ebx, edi
nop
mov edx, ebx
lea rcx, str.Loop_iteration:__d_n
call fcn.140001010
inc ebx
cmp ebx, 0x12c
jl 0x1400c9f90
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x1400c9fe8
mov rcx, qword [rsp + 0x38]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c9fe3
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400c9fe3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ca24c
mov eax, edi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400ca1f0
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret

Function at 0x1400cab68
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400cabb2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400cabb2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400cabb2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400cabb2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400cabb2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400cabb4
xor al, al
add rsp, 0x28
ret
Function at 0x140002278
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400022c2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400022c2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400022c2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400022c2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400022c2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400022c4
xor al, al
add rsp, 0x28
ret
Function at 0x1400034b0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14000350d
lea rbx, [0x140066d90]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x1400034f4
cmp r10, 2
jb 0x1400034f4
cmp byte [r9], r8b
jne 0x1400034f4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x1400034d0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14000354f
lea rbx, [0x140066d90]
cmp r8b, 0x23
jne 0x140003533
cmp byte [r9], r8b
jne 0x140003533
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140003520
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140003690
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x1400036aa
mov qword [r8], 0
lea rdx, [0x1400668f0]
call fcn.140003560
mov rbx, rax
test rax, rax
jne 0x1400036ca
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x1400037a1
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1400037a1
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x1400037a1
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1400037a1
cmp rdi, 0xffffffffffffffff
je 0x1400037a1
mov rax, qword [0x14019abf0]
test rax, rax
je 0x14000373e
inc dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x1400037a1
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x14000378e
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x14019abf0]
test rax, rax
je 0x140003783
dec dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1400037aa
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x14000379c
mov qword [r14], rdi
mov rax, rsi
jmp 0x1400037ac
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret